mirror of
https://github.com/rustdesk/rustdesk.git
synced 2026-11-03 16:32:22 +00:00
350966b331bb873650668549b3fa4a42e81e6a81
11589
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 fufesou
|
350966b331 |
Add trusted-device V2 with legacy upgrade compatibility (#16548)
* fix: secure trusted devices with host-issued V2 tokens Signed-off-by: fufesou <linlong1266@gmail.com> * fix: preserve trusted-device management and ordinary authentication Restore selected-device deletion using nonsecret record identifiers and acknowledged V2 revocation errors. Preserve password and TOTP authentication when the V2 authority or cached controller credentials are unavailable. Disable V2 for the affected attempt while retaining authentication, configuration, and revocation rejection. Validation: 20 selected Rust tests, Flutter-feature Rust compilation, focused Dart analysis, formatting, and whitespace checks passed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix: simplify trusted-device caching and stabilize tests Signed-off-by: fufesou <linlong1266@gmail.com> * fix: persist trusted-device grants in host configuration Store host grants in RustDesk2.toml and preserve revocation across configuration writes and service transitions. Use local authority on macOS when no background service is installed. Preserve both configuration imports by checking Config2 eligibility before revocation writes. Cover the password and 2FA import regression alongside the existing trusted-device tests. Signed-off-by: fufesou <linlong1266@gmail.com> * fix: store trusted-device credentials in peer configuration Signed-off-by: fufesou <linlong1266@gmail.com> * fix: minimize trusted-device persistence changes Signed-off-by: fufesou <linlong1266@gmail.com> * refactor: minimize trusted-device integration changes Keep ordinary policy writes on the generic configuration path and document authentication updates. Restore the macOS installer to master, rename the V2 version gate, and relocate the existing client regression test. Signed-off-by: fufesou <linlong1266@gmail.com> * fix: harden trusted-device revocation and persistence Recover corrupt grant data without skipping authentication-write validation, and avoid revoking trust when IPC synchronizes an unchanged salt. Make desktop management IPC async and keep runtime creation at the Flutter worker boundary. Update hbb_common to preserve V2 credentials when configuration reads fail, and extend existing regressions for clear, salt synchronization, and persistence failures. Signed-off-by: fufesou <linlong1266@gmail.com> * fix: preserve trusted-device validation and no-op settings Validate trust before connection side effects and retain tickets for the final check when the authority is unavailable after TOTP. Disable enrollment on that path. Skip revocation for password operations that the existing setter treats as no-ops, extend the existing IPC regression, and clean up client state on initialization or credential errors. Validation: 36 targeted native tests, Flutter-feature Rust check, formatting, and git diff --check passed. Signed-off-by: fufesou <linlong1266@gmail.com> * feat: add trusted-device expiry and per-device renewal Keep legacy records for password-and-TOTP migration, encrypt host grant storage, and add configurable trust periods that revoke grants when changed. Allow renewing individual unexpired devices from the manager, hide renewal for never-expiring grants, and preserve the mobile table height constraints. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(macos): report trusted-device cleanup failure before uninstall Revoke local trusted-device grants before dispatching the uninstall closure so cleanup failures return false without starting the uninstall script. Keep the existing synchronous and asynchronous script execution paths. Signed-off-by: fufesou <linlong1266@gmail.com> * fix: preserve trusted-device settings and revoke macOS service grants Default unsupported expiration values on read while keeping explicit edits strict. Allow password/TOTP when stored grants are out of sync, after validating the authentication scope. Revoke root-owned grants during macOS service removal. Bump hbb_common for malformed-file recovery and legacy-record preservation, and retain the reviewed regression coverage. Signed-off-by: fufesou <linlong1266@gmail.com> * fix: avoid duplicate trusted-device revocation during config sync Signed-off-by: fufesou <linlong1266@gmail.com> * fix: preserve trusted-device revocation during config mismatches Allow grant clearing when authentication snapshots are unavailable and validate existing snapshots before applying authentication updates. Restore optimistic caching for non-auth bulk options and restrict the trusted-device IPC helper to desktop targets. Signed-off-by: fufesou <linlong1266@gmail.com> * feat: preserve trusted devices when trust duration changes Adjust existing grant deadlines for duration changes and startup policy overrides, support 90 days, and use an adaptive inline duration selector without the obsolete revocation warning. Consolidate management IPC and trim redundant tests while retaining authentication and revocation coverage. Validation: four existing focused Rust tests and the startup override reproduction passed; Windows default/service and Flutter-feature cargo checks passed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix: finish trusted-device notice cleanup and duration sync Remove the recurring legacy notice, unused response metadata and translation key. Allow duration-only saves with a readable inactive grant scope while preserving storage and authentication errors. Update hbb_common to 040bf3f662ae7422f2f9570701cc8451f7bb1d59, which removes the unused legacy detector. Validation: four existing focused Rust tests passed; Windows default/service and Flutter-feature cargo checks passed. No new tests were added. Signed-off-by: fufesou <linlong1266@gmail.com> * fix: refine trusted-device duration layout Indent the duration row beneath the trusted-device option, add vertical spacing, and compact the desktop selector. Mobile sizing and other dropdowns remain unchanged. Validation: targeted Dart analysis passed with existing informational diagnostics. Actual window rendering was not exercised. Signed-off-by: fufesou <linlong1266@gmail.com> * refact: adjust indentation Signed-off-by: fufesou <linlong1266@gmail.com> * fix: preserve trusted devices across version upgrades Honor existing legacy trust without creating new legacy registrations. Import live records into encrypted grants, apply the current expiration policy, and migrate consenting controllers to V2 tokens while retaining grouped revocation. Advertise V2 capability explicitly and hide enrollment for mixed-version sessions. Update existing coverage and use the paired hbb_common migration API. Signed-off-by: fufesou <linlong1266@gmail.com> * fix: translations Signed-off-by: fufesou <linlong1266@gmail.com> * Align the compact trusted-device duration selector on mobile Signed-off-by: fufesou <linlong1266@gmail.com> * Default trusted devices to 90 days and drop unreleased V2 migrations Signed-off-by: fufesou <linlong1266@gmail.com> * Avoid masking macOS daemon stop failures during uninstall Signed-off-by: fufesou <linlong1266@gmail.com> * restore uninstall.scpt, do not clear trusted devices on uninstall Signed-off-by: fufesou <linlong1266@gmail.com> * Preserve trusted devices when uninstalling services Signed-off-by: fufesou <linlong1266@gmail.com> * Preserve trusted devices when importing host configuration Signed-off-by: fufesou <linlong1266@gmail.com> * Recover from unreadable trusted-device grants Log and persistently revoke invalid or undecryptable V2 payloads so password and TOTP can enroll a new device. Keep configuration read and write errors explicit and extend existing tests to cover recovery and rejection of old tokens. Signed-off-by: fufesou <linlong1266@gmail.com> * Preserve trusted devices across service transitions Run grant operations in the accepting server and synchronize current grants and revocations through the existing service configuration channel. Keep ordinary settings saves from restoring stale credentials and retain root peer verification. Recognize explicit configuration errors as live service responses during IPC probing, so duplicate startup does not remove the active socket. Validated with five trusted-device tests, seven Linux IPC filesystem tests, an isolated IPC regression probe, and Windows Flutter and Linux compilation checks. Installed-service transitions and macOS runtime behavior remain untested. Signed-off-by: fufesou <linlong1266@gmail.com> * Keep trusted-device grants under the service authority Preserve root-owned grants when copying service configuration and route installed-host trust operations through the root service. Keep local authentication edits available when the Linux service is explicitly stopped, then synchronize pending revocation before using service grants. Serialize pending revocation synchronization and cover service copies, stale user snapshots, and stopped-service authentication updates with the existing focused tests. Signed-off-by: fufesou <linlong1266@gmail.com> * Replace same-ID grants when enrolling trusted devices Signed-off-by: fufesou <linlong1266@gmail.com> * Allow macOS security edits after service removal Reuse pending trusted-device revocation for offline password and 2FA changes. Honor pending revocation during installation copies and before root-authority requests and configuration synchronization. Validation: five focused macOS tests, macOS and Windows cargo checks, and targeted formatting checks. Signed-off-by: fufesou <linlong1266@gmail.com> * Allow macOS security edits before daemon reinstallation Detect an absent daemon using retained service ownership instead of the incoming-connections stop flag. General Start resumes connections without reinstalling the daemon, so local authentication edits must continue using pending revocation until installation. Adjust the existing recovery test to check that toggling incoming connections does not make a standalone profile service-owned. Signed-off-by: fufesou <linlong1266@gmail.com> * Allow re-enrollment after invalid controller credentials Ignore malformed or undecryptable stored token payloads with a throttled warning while preserving file access errors and host identity checks. Fresh authorized enrollment can replace the unusable credential. Restore logged, non-propagating IPC errors for non-authentication option changes and extend the existing credential recovery test. Signed-off-by: fufesou <linlong1266@gmail.com> * Update hbb_common to serialize peer deletion Signed-off-by: fufesou <linlong1266@gmail.com> * fix(macos): preserve trusted devices across service removal Hand off the current root grant store to the removing user and restore that user's latest grants on reinstallation. Keep other retained profiles from becoming authoritative, and preserve user settings when the service has no optional configuration. Validate the macOS build, five trusted-device tests, isolated headless transfer cases, and AppleScript syntax. Real privileged service transitions remain untested. Signed-off-by: fufesou <linlong1266@gmail.com> * refactor(trusted-devices): use local grants and existing config sync Keep grant decisions in the accepting host process and transfer grants and removals through the existing background configuration sync. Remove root-only grant RPC, ownership handoff, pending revocation, and dedicated copy commands; restore the master service lifecycle on Linux and macOS. Preserve V2 credentials, authentication revocation, and ordinary-save protections. Accept the existing asynchronous sync and multiple-user limitations. Validated Windows and macOS Flutter checks, the Linux library/tests/service check, four macOS trusted-device tests, and AppleScript syntax. Real service transitions remain untested. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(trusted-devices): preserve migrated tokens at capacity Raise the shared V2 token limit to 128 and order newly migrated tokens by issuance time without extending their legacy expiration. Extend the existing migration regression coverage to verify token reuse and expiry preservation at capacity. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): preserve trust across service stop and start Export current on-disk grants and explicitly synchronize them into the GUI configuration at startup and before stopping a running service. Abort the stop if synchronization fails so the next service import cannot use a stale local copy. Extend the existing synchronization regression coverage to check revoked, retained and newly enrolled devices and the actual import-source file. Remove unrelated import logging changes. Validation: trusted-device tests passed on Windows and macOS (4 each); changed-line formatting and git diff --check passed. Real Windows GUI/UAC service transitions remain untested. Signed-off-by: fufesou <linlong1266@gmail.com> * refactor(trusted-devices): simplify local authorization Replace local authorization envelopes with typed operations while retaining locked authentication checks and persistence. Remove redundant configuration and Dart wrappers without changing credential formats or management requests. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): allow service removal when host is unavailable Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): preserve trust revocations before full uninstall Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): sync trust changes to the retained user config Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): sync trust after security setting changes Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
fufesou
|
d0a1af8c51 |
feat(android): transfer files directly through SAF folders (#16644)
* feat(android): transfer files directly through SAF folders Let Android users choose folders in the existing file-transfer browser and stream documents through provider descriptors without workspace copies. Keep local browsing separate from host sharing, and restrict new peer document requests to the current shared folder. Preserve traversal checks, overwrite protection, cancellation, empty files, and provider errors through completion. Run Android provider IO on blocking workers and reuse the native directory-listing bridge. Retain the existing workspace import/export flow and non-Android file-transfer behavior. Validation: all 11 base tests pass, including shared-root confinement, document IO, cancellation, provider failures, and resume cleanup. macOS Rust checking and isolated Kotlin compilation pass. Flutter analysis reports no errors, with existing warnings. Full Android builds and device tests remain unperformed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): group storage locations in the file menu Replace the standalone folder icon and ambiguous RustDesk entry with adjacent RustDesk storage and Other folders actions in the existing menu. Reuse the current storage handlers and register the two localized labels. Validation: targeted Flutter analysis reports no errors and six existing diagnostics. Translation consistency and git diff checks pass. Android device interaction was not tested. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(file-transfer): keep batch deletion running across refreshes Snapshot selected files before awaiting deletion confirmations so directory refreshes cannot invalidate the batch iterator. Defer refreshes for awaited file deletions until the batch finishes, while retaining refreshes for late completions. Retain one regression test for completing all three confirmations after selection reconciliation. All nine file-model tests pass; focused analysis reports no errors and one existing informational diagnostic. Android visual behavior was not tested on a device. Signed-off-by: fufesou <linlong1266@gmail.com> * refactor(android): narrow SAF scope and move folder selection to settings Move shared-folder selection from Share screen permissions to Settings > Transfer file, preserving live connection locking and managed settings visibility. Trim optional SAF resume and thread-identity assertions while retaining transfer and authorization regressions. Split the independent batch-deletion fix into commit 06313a9aa on fix/file-transfer-batch-deletion. Validation: 19 base unit tests and 11 Flutter file-model/download-path tests passed. Focused Flutter analysis reports only existing informational diagnostics. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): clean up failed SAF transfers and reset navigation Cancel pending SAF writes when the client receives a transfer error or the connection manager handles WriteError. Log cleanup failures without replacing the original transfer error or discarding data retained after publication fails. Clear local navigation history after successfully selecting a storage root, so Back does not attempt to return to the previous workspace. Validation: 19 base unit tests and 11 Flutter file-model/download-path tests passed. macOS cargo check passed; focused Flutter analysis reports only existing diagnostics. Android build and device validation were not performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): guard SAF overwrites and clean up interrupted receives Require matching per-file confirmation before SAF downloads replace an existing destination, including transfers from peers without overwrite detection. Enforce the policy before creating a temporary document. Cancel unfinished SAF receives when the Android client session exits. Delete newly created temporary documents if opening them fails, preserving the original error and reporting cleanup failures. Keep publication-failure recovery and non-Android transfer paths unchanged. Validation: 19 base unit tests and macOS cargo check --lib --features flutter passed. The document storage Kotlin modules compiled against Android SDK 35. Full Android builds and device validation were not performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): clean up SAF uploads on host disconnect Cancel pending SAF receives after the Android connection manager removes a closed connection, including receiver EOF. Log cleanup failures without preventing cleanup of other jobs. Preserve publication-failure recovery. Validation: 19 base unit tests and macOS cargo check --lib --features flutter passed. Android host disconnect behavior still requires device validation. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): restore storage root after failed folder selection Restore the previous local home when opening a selected SAF folder or the RustDesk workspace fails or throws. Preserve navigation history on failure and retain existing error reporting. Keep the home assignment before the asynchronous read so superseded read completions cannot overwrite a newer storage selection. Validation: 11 existing file-model/download-path Flutter tests passed. Focused analysis reports no errors and six pre-existing diagnostics. Changed-method formatting and whitespace checks passed. Android device validation of overlapping storage switches remains pending. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): enforce shared storage and protect SAF overwrites Authorize peer filesystem requests against the currently shared root so remembered workspace paths cannot bypass a selected SAF folder. Offer text-only RustDesk storage and Other folders choices under Change path, including an explicit switch back to the application workspace. Reject SAF host overwrites from peers without overwrite-detection support, while preserving modern senders' existing confirmation flow. Cover legacy creation, rejected replacement, and modern replacement in the Rust fixture. Validation: 19 base tests, 11 Flutter tests, focused Dart analysis, Android Rust/APK builds, and whitespace checks passed. Device checks verified storage switching, cancellation, old-path rejection, and Android-initiated three-file overwrite/Skip batches against macOS. The separate legacy-host overwrite guard was verified by Rust tests and was not in the device APK. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): reject partial SAF listings and restore folder roots Reject provider cursors reporting loading or errors before using their cached rows as a complete directory listing. Propagate the error through the existing folder-transfer initialization and browsing paths. After restoring a local SAF directory, derive its navigation root from the displayed document path so Home and breadcrumbs use the selected tree independently of the host's shared-folder setting. Validation: Kotlin storage modules compile; an Android runtime cursor check covers complete, loading, and error results. Eleven existing Flutter tests and three temporary reconnect checks pass. Focused Dart analysis reports only the existing setter lint; diff checks pass. Cloud-provider transfers and navigation in a rebuilt APK were not tested. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): discard pending SAF writes after block errors Cancel pending document receives when a data-block write fails, removing temporary data before cancellation or disconnect. Preserve the original write error and throttle cleanup-error logging. Keep publication-failure retention unchanged. Extend the existing provider tests with a real descriptor I/O failure and a cleanup-failure case. Validation: - Regression failed before the fix. - cargo test --offline -p base --lib: 19 passed within 60 seconds. - Rustfmt and git diff --check passed. - No Android build or on-device storage-exhaustion test was performed. Signed-off-by: fufesou <linlong1266@gmail.com> * feat(android): guide first-time file transfer folder setup Prompt users to choose the folder remote devices may access when first opening File transfer, manually starting the service, or enabling file transfer. Offer RustDesk storage and the existing SAF picker, and explain where to change the shared folder later in Settings. Remember successful setup or explicit Skip, while allowing canceled setup to be retried. Honor existing settings and permission restrictions. Use the native translation placeholder convention for the settings path. Validation: - Two onboarding widget tests pass, including the breadcrumb regression. - Flutter analysis and Dart formatting checks pass for the new files. - Staged diff whitespace checks pass. Android system-picker and service integration were not tested on a device. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): group file transfer folder choices Replace plain list rows with an indented group of full-width outlined buttons. Tighten spacing while preserving the standard Android touch target and allowing labels to wrap. Validation: both existing onboarding widget tests, scoped Flutter analysis, Dart formatting, and diff whitespace checks pass. Android visual validation was not performed on a device. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): clean up SAF finalization and guard source resume Discard temporary documents when flushing, syncing, or closing a receive fails before publication. Attempt discard even when cancellation cannot close the descriptor, and retain both errors when cleanup also fails. Keep recovery documents after publication failures. Reject nonzero source offsets when the SAF modification time is unknown, so same-size changes cannot combine with a previous partial download. Report that the transfer must restart; fresh sends remain supported. Validation: all 19 base library tests pass, including finalization and cancellation cleanup, combined provider errors, unknown-timestamp resume, fresh sends, and failed-publication retention. Tests used a 60-second limit. Rustfmt and diff whitespace checks pass. Android device/provider failure testing and a rebuilt APK were not performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(file-transfer): restore reliable batch deletion Snapshot selected entries before awaiting deletion confirmations so refreshes cannot invalidate the batch iterator. Defer refreshes for awaited file deletions until the batch finishes, while preserving refreshes for late completions. Completing the batch lets the existing mobile delete handler clear the selection and exit selection mode. Restore the previously split fix on the SAF branch with one five-file regression test. Validation: all nine file-model tests pass. The regression reproduced Concurrent modification during iteration before the fix. Focused Flutter analysis has no errors or warnings, with one existing setter-style informational diagnostic. Formatting and diff checks pass. Android device deletion and selection-mode rendering were not tested. Signed-off-by: fufesou <linlong1266@gmail.com> * feat(android): store logs in app media storage Write release logs to Android/media/com.carriez.flutter_hbb/RustDesk, using Android's package-specific media directory and the existing logger. Include this directory in Export Logs alongside legacy logs and recordings, and restrict the added export access to the canonical log directory. Suggest Android/media for the first SAF folder selection on API 26+. Validation: Android ARM64 release cargo check and Kotlin compilation passed. Focused Flutter analysis found no new diagnostics; git diff --check passed. Full APK linking is blocked by missing libvpx.a in the build environment. On-device log writing, export, and initial picker location remain unverified. Signed-off-by: fufesou <linlong1266@gmail.com> * feat(android): keep logs in a user-authorized shared folder Write release logs through SAF in Android/media/RustDesk instead of the package-owned media directory. Require the independent log-folder grant before starting the service, and include these logs in Export Logs while retaining export of existing logs and recordings. Keep daily/size rotation and bounded retention within the log backend. Report provider failures explicitly and route JNI lifetime diagnostics directly to logcat to avoid re-entering JNI during native thread teardown. Allow a deleted log folder to be selected and created again. Validation: Android ARM64 release cargo check, Kotlin compilation, and two existing Flutter setup tests passed. A temporary real-JVM reproduction using the production writer passed native thread exit at debug and trace levels after reproducing the earlier crash. Full Rust/APK builds passed before the final JNI and missing-folder fixes; those fixes passed Rust and Kotlin checks. The final APK and folder authorization, rotation, export, and uninstall retention have not been tested on an Android device. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): validate SAF parent names and restore workspace navigation Reject a newly created SAF parent when the provider changes its display name, before receiving data into that directory. This prevents sanitized names from splitting one source folder into multiple destination folders while reporting success. An adjusted empty directory can remain. Restore the local navigation root for saved paths inside the actual app workspace before checking the saved directory. Keep that choice separate from the host's shared SAF root and leave peer access checks unchanged. Validation: 12 tracked Flutter file-model/download-path tests passed. Three temporary controller tests passed for workspace root/subfolder restoration, local SAF restoration, and workspace-prefix rejection; the workspace case failed before the fix. Kotlin compilation, focused Dart analysis, and diff checks passed, with one existing analysis info. No rebuilt APK or device provider-name/navigation test was performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): authorize log storage before outgoing connections Require the existing log-folder authorization before opening an Android remote-control, file-transfer, camera, or terminal session. Canceling or failing authorization leaves the connection unstarted; check that the page is still mounted before navigation. Validation: two temporary authorization regression tests and two existing setup widget tests passed. Focused analysis reported only unchanged diagnostics, and git diff --check passed. No rebuilt APK or device validation. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): clear terminal admin intent on canceled log setup Clear IS_TERMINAL_ADMIN when the Android log-folder authorization guard aborts a terminal launch. A canceled administrator-terminal attempt can no longer pass its one-shot intent to a later ordinary terminal connection. Successful authorization keeps the existing session initialization behavior. Validation: the temporary regression test reproduced the stale flag before the fix; all three temporary widget tests pass after it, including successful administrator intent preservation. Focused Dart analysis reports only unchanged diagnostics, and git diff --check passes. Android authentication dialogs were not tested on a device. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): clarify log setup and default folder selection Show a concise log-directory prompt before opening the picker, and skip the prompt when existing log access is ready. Start first file-transfer folder selection in Documents, excluding the separate log grant from the check for previous transfer-folder selections. Validation: - Focused Flutter analysis, locale consistency, and diff checks passed. - Six temporary authorization/dialog tests passed during implementation. - The review rerun of existing setup tests timed out while loading (60s). - Kotlin/APK builds and Android device validation were not performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): check log readiness before boot hosting Run the log-directory preflight off the receiver thread before creating the hosting service. Abort startup with an explicit error when logging is unavailable, and finish the asynchronous broadcast on every path. Validation: four temporary JVM startup tests, Android Kotlin compilation, and git diff --check passed. Release APK reboot and provider validation were not performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): simplify log setup and preserve reconnect paths Use a single Choose folder action with clearer log-storage guidance and request Android/media/RustDesk as the initial picker location. Reuse the existing directory ID and add the button label to the locale maps. Restore the workspace root before opening each Android local reconnect candidate, preserving the currently browsed directory ahead of saved locations while retaining the existing fallback order. Validation: 14 existing Flutter tests and two temporary Android-controller regression tests passed. Scoped Dart analysis and git diff --check passed, with only the existing setter-style informational diagnostic. Android compilation and device validation were not performed for these changes. The initial picker location remains a system hint and can be ignored if the directory does not exist. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): prioritize log setup and separate picker defaults Authorize log storage before showing first-use file-transfer setup. Always request Documents for transfer folder selection, independently of previously granted folders. Request Android/media/RustDesk for logs when accessible, otherwise use Android/media so the existing authorization flow can create the child. Remove the obsolete log-grant classifier. Validation: two temporary setup-order tests, three temporary JVM picker tests, and two existing Flutter setup tests passed. Scoped Dart analysis, Android Kotlin compilation, and git diff --check passed. Actual picker behavior was not tested on a device. Initial locations remain system hints supported from API 26. Signed-off-by: fufesou <linlong1266@gmail.com> * refact: translation Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): preserve default logs and simplify folder setup Limit folder setup prompts to hosting startup and remember successful manual shared-folder selections. Outgoing sessions and file-transfer permission toggles no longer request folder configuration. Keep release logs in Config::log_path() until public storage is authorized, and use that original directory when public writes fail. A failed default writer must not prevent logging to a working public folder. Report the fallback explicitly and retain both errors when neither destination works. Use Android/media/<installed AppName>/Logs for public logs. Resolve and create only authorized descendants, verify provider-created directory names, and update picker and startup messages. Keep hosting authorization and the Documents transfer-picker default unchanged. Validation: - Two focused Rust regressions using the real writer and flexi_logger with a supplied Android bridge: default/public routing, fallback and failures. - Five temporary Flutter checks and two existing folder-setup widget tests. - Two temporary Kotlin checks for standard/custom app names, authorized directory creation and independent picker defaults. - Android :app:compileDebugKotlin -Ptarget-platform=android-arm64 passed. - Scoped Dart analysis matches HEAD's existing diagnostics; rustfmt and git diff --check passed. The temporary checks supply Android APIs; release APK logging, permission revocation, fallback and reboot behavior have not been verified on device. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): simplify log folder selection errors Show "Please select Android/media." when a log-folder selection is invalid. Display the platform error message instead of the full PlatformException, while keeping the complete error in debug output. Directory validation and permission handling are unchanged. Validation: scoped Dart analysis, both existing folder-setup widget tests, and git diff --check passed. No APK rebuild or device verification. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): simplify the log folder picker location Always request Android/media as the initial log authorization location and show the same short path in the picker title. Keep creating and using <AppName>/Logs internally. Remove the obsolete filesystem probe for an existing Logs directory. Preserve accepted grants, logging policy and the Documents default for the separate file-transfer picker. Validation: two temporary picker checks with supplied Android APIs, Android :app:compileDebugKotlin -Ptarget-platform=android-arm64, and git diff --check passed. Actual system-picker positioning has not been verified on a device. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): keep hosting independent of log access Restore boot and native service startup without requiring public log folder authorization. The existing logger uses the original directory when public logging is unconfigured or fails. Removing the early service stops also avoids the foreground-service startup failure path. Keep log and shared-folder setup on deliberate hosting startup, but allow hosting confirmation after cancellation or setup failure. Request log setup once, before shared-folder setup. Route Android SAF AllFiles requests through the existing CM enumeration and result channel so the connection loop can continue processing messages. Preserve path validation, file-count limits and ordinary filesystem paths. Validation: - Android Kotlin compilation and ARM64 release cargo check passed. - Focused Dart analysis and both existing folder-setup tests passed. - Temporary source-based startup, cancellation, log fallback and SAF dispatch checks passed using supplied platform/provider APIs. - git diff --check passed; no new rustfmt differences from HEAD. The CM unit test timed out during dependency compilation at the 60-second limit and did not execute. No APK/device reboot, revocation or slow-provider validation was performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): reject SAF root deletion before traversal Reject the selected SAF tree root before recursive enumeration or deletion, so a failed root-deletion request cannot remove its empty subdirectories. Keep ordinary subdirectory deletion on the existing path and strengthen one existing root-rejection assertion. Validation: - cargo test -p base --lib fs::android (2 passed) - Three temporary source-backed filesystem checks passed for root preservation, ordinary subtree deletion and nonempty subtree rejection - rustfmt --check and git diff --check passed - No Android device validation performed Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): reject stale SAF source metadata Check provider size and modification time after opening a SAF source against its listed metadata. Reject changed sources before advertising a stale digest, preventing resumed downloads from combining old and new file contents. Treat negative provider timestamps as unknown instead of rejecting the entire listing. Offset resume remains disallowed for sources with unknown timestamps. Validation: - cargo test -p base --lib: 20 tests passed. - Standalone Rust transfer checks: reject a changed source, restart with the current contents, and preserve resume for an unchanged source. - rustfmt --check and git diff --check passed. - No Android APK build or device validation performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): move shared folder selection under permissions Place Change Path below Transfer file on the Share screen page, retaining custom-client visibility and active-session permission restrictions. Remove the Settings entry and shorten the first-use sharing prompt. Keep the existing translation key and update its English and Chinese display text. Adjust the existing setup widget test to match. Validation: - Existing setup widget tests: 2 passed. - Focused Dart analysis: no errors or warnings; existing page deprecation notices remain. - Locale consistency, Dart formatting, and git diff --check passed. - No Android APK build or device layout validation. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): tidy shared folder option layout Render Change Path as a compact, full-width sub-option below Transfer file, with one directional inset and a trailing chevron. This removes the extra mobile text-button padding while preserving permission locking. Validation: - Focused Dart analysis: no errors or warnings; three existing deprecation notices remain. - Dart formatting and git diff --check passed. - No new tests for this presentation-only change; updated device layout has not been validated on Android. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): authorize legacy public logs without a folder picker On Android versions below 8, request the system storage permission and write configured public logs to Android/media/<AppName>/Logs. Limit WRITE_EXTERNAL_STORAGE to API 25; keep the existing SAF flow on newer Android versions. General storage permission alone does not redirect logs before explicit setup. Keep the original log destination before setup and on public-write errors. Permission denial completes promptly and does not prevent hosting. Retain log rotation and export, and reopen the writer during readiness checks if the fixed directory has been moved or removed. Validation: - Nox Android 7.1.2: permission grant/denial, original-log fallback, fixed public destination, persisted setup, and actual Rust logs after restart. - Isolated device regression: exported public logs match the source bytes; moved-directory readiness fails before the fix and passes afterward. - Full ARMv7 Flutter debug APK with the release Rust library built and installed successfully. - Two Flutter setup tests, scoped Dart analysis, whitespace checks, and a fresh CodeRabbit review passed. Android 5/6 and Android 8+ device testing was not performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): restore SAF log setup and surface folder errors Use SAF for public logs on all supported Android versions. Remove the legacy direct writer and WRITE_EXTERNAL_STORAGE permission, preserving the original logging fallback and normal picker cancellation. Keep log-folder errors visible until acknowledged, then exit the current manual hosting setup instead of advancing to file-transfer setup. Translate the error text, add Chinese translations, and register the missing key in the language catalogs. Boot startup and existing services are unchanged. Validation: - Two existing Flutter file-transfer setup tests passed. - Focused Flutter analysis and git diff --check passed. - Built the release ARMv7 Rust library and Flutter debug APK. - On Nox Android 7.1.2, invalid-root selection showed the persistent Chinese error; acknowledgement exited setup without starting hosting. - Ordinary picker cancellation continued the existing optional setup flow. - APK inspection found no READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, or MANAGE_EXTERNAL_STORAGE permissions. Device validation used the debug APK on Nox; other Android versions and a full release APK were not device-tested for this change. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): bind SAF digests to opened files and simplify setup Read size and modification time from the opened document descriptor so replacing a source path cannot pair old data with a newer resume digest. Refresh stale metadata for regular files and keep streams non-resumable while preserving fresh sequential sends. Shorten the shared-folder setup prompt and direct log-folder selection to Android/media. Remove obsolete app-media log-directory queries and export allowances; retain SAF logs, original app-data logs, and recordings export. Validation: - Focused base Android tests: 3 passed; the replacement regression failed before the descriptor fix and passed afterward. - Existing Flutter setup and file-model tests: 11 passed. - ARMv7 release Rust library and Flutter debug APK builds passed. - Scoped CodeRabbit re-review: 0 findings; git diff --check passed. No Android device validation was performed for this revision. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): avoid blocking log callers during folder setup Bypass per-record JSON/JNI dispatch after discovering that public logging is unconfigured. Publish routing changes from the application-owned Kotlin logger so a late fallback response cannot undo successful folder setup. Return contended public writes to the existing original-directory writer instead of waiting for provider operations. Keep the JNI callback available in debug Android builds without changing their logcat logger, and remove the unused English tree-picker title. Validation: - ARMv7 release Rust build and full Flutter debug APK packaging passed. - Android 7 provider contention check reproduced the wait before the fix and passed with the rebuilt Kotlin code and native library. - Temporary native routing test passed: one initial backend lookup, subsequent bypass, re-enabling, and all records in the fallback file. - Formatting and diff checks passed; scoped CodeRabbit findings were reviewed against the Rust fallback and picker callers. The full APK was built but not installed for this change. Device checks used the existing isolated probe; full release-app end-to-end validation remains pending. No permanent test infrastructure was added. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): allow slower SAF empty-directory scans Use the existing 30-second remote-directory timeout only for SAF scans. Ordinary filesystem scans keep the two-second timeout, and the request lifecycle is unchanged. Add a regression for a SAF response arriving after three seconds. The file-model suite passes all 10 tests. Targeted analysis reports only the existing setter lint; Android device validation was not performed. Scans exceeding 30 seconds can still time out. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): isolate SAF empty-directory scan lifecycles Only remove an empty-directory request when its timeout still owns the registered completer. Cancel pending SAF scans when the remote session changes so the same directory can be retried immediately. Ordinary filesystem reconnect behavior and timeout durations remain unchanged. Share regression coverage for completed and reconnected scans, keeping each retry pending across the previous timer deadline without adding production state. Validation: all 11 file-model tests pass. Test-file analysis and whitespace checks pass; targeted production analysis reports only the existing setter lint. No Android build or device validation was performed for this change. Signed-off-by: fufesou <linlong1266@gmail.com> * refactor(android): deduplicate SAF helpers and test setup Share local storage navigation, tree-picker Intent construction, and provider listing readiness checks. Preserve independent picker defaults, error messages, failed-navigation rollback, and authorization lifecycles. Reuse Rust transfer-test fixtures and remove text-only setup assertions while retaining behavioral regression coverage. Reduce the branch diff by 78 lines without changing transfer or logging policy. Validation: - Focused Rust SAF tests: 3 passed. - Four focused Flutter suites: 20 passed; the two setup tests were rerun successfully after removing text-only assertions. - Kotlin 2.1.21 / Android SDK 36 compilation passed for all six document integration sources in an isolated Linux directory. - git diff --check passed. No APK build or device validation this round. Signed-off-by: fufesou <linlong1266@gmail.com> * chore(android): organize SAF tests and complete zh-TW label Move the two SAF test files into libs/base/src/fs/tests and update the module path, preserving their contents and module hierarchy. Fill the missing Traditional Chinese translation for Choose folder. Validation: cargo test -p base --lib fs::android passed (3 tests). Verified both moved files are byte-identical and all six new SAF/logging keys have nonempty Traditional Chinese translations. Diff check passed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): keep hosting available and reject stale SAF scans Keep the log-folder error dialog, skip remaining folder setup after an error, and continue to the existing hosting confirmation. Public-log failures retain the existing default-directory logging fallback. Reject remote SAF empty-directory requests if the session changes while awaiting bridge dispatch. Reuse the existing session generation and leave ordinary filesystem requests unchanged. Extend the existing lifecycle test to cover reconnecting during dispatch. Validation: 21 focused Flutter tests passed. A temporary startup-flow check passed for setup error, success and cancellation. Analysis reports only the existing setter-return-type info. Diff check passed; CodeRabbit review completed with no findings. No Android device validation. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): avoid logging raw folder setup errors Log fixed status messages for Android log-folder setup failures instead of provider-derived exception text. Preserve detailed errors in the dialog and keep the existing folder setup and hosting flow unchanged. Validation: focused Flutter analysis and both existing folder-setup widget tests passed. Diff check passed. No Android device validation. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): offload access checks and restore identical-file hints Run Android peer-path authorization on blocking workers for initial folders, file actions and rename destinations. Preserve fail-closed access decisions and the existing non-Android path. Set the SAF identical-file hint only for matching sizes and known, matching modification times. Keep overwrite confirmation and reject receive resume. Extend the existing transfer test to cover the hint. Validation: - cargo test -p base --lib fs::android: 3 passed. - Android ARMv7 API 21 release cargo check with flutter,hwcodec passed using an isolated copy of HEAD plus these changes, verified by SHA256. - macOS cargo check --lib --features flutter passed for the access fix. - Temporary scheduling check failed before the fix and passed afterward. - Scoped CodeRabbit reviews and diff checks passed. No APK build or device testing was performed for this follow-up. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): limit SAF dispatch and clarify log exports Use blocking workers only for document-backed file operations. Keep ordinary Android filesystem calls on their original execution path and retain asynchronous peer-path authorization checks. Report success and failure counts when log export succeeds only partly. Skip the destination picker when there are no default log sources and no public-folder permission. Preserve public-log permission errors. Validation: - cargo test -p base --lib fs::: 19 passed. - Flutter file-model and Android setup suites: 14 passed. - Android ARMv7 API 21 release cargo check with flutter,hwcodec passed against an isolated source copy, verified by SHA256. - Temporary Dart feedback and Kotlin export-handler checks failed before the fix and passed afterward. - Focused Dart analysis found only existing diagnostics; diff checks passed. No APK build or device testing was performed for this follow-up. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): allow longer SAF deletion scans Use the existing 30-second deadline when recursively scanning SAF folders before deletion. Keep the two-second timeout for ordinary filesystem paths, with request handling and deletion behavior unchanged. Validation: - Existing Flutter file-model and Android setup suites: 14 passed. - Targeted Dart analysis found no new diagnostics. - git diff --check passed. No Android APK build or device testing was performed for this fix. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): keep public logging active after cleanup failures Log a warning when deleting an expired log fails, and continue writing to the newly opened public log. Keep creation, open, and write failures on the existing fallback path. Failed deletions may leave extra old logs. Validation: - Four temporary Kotlin checks passed: deletion false/exception, normal rotation, and propagation of a genuine log-open failure. - Actual document-storage Kotlin sources compiled against Android API 36. - git diff --check passed. No APK build or device test performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): keep accepted SAF download file lists immutable Reject replacement of an accepted generic SAF download file list before any mutation, so per-file overwrite approval cannot be redirected to a different destination. Preserve the ordinary download and upload paths. Extend the existing overwrite test and construct each receive fixture with its initial file list only once. Validation: - The added assertion failed before the fix; all 19 filesystem tests passed afterward: cargo test --offline -p base --lib fs::. - Scoped CodeRabbit review completed with no findings. - No new rustfmt differences; git diff --check passed. - No Android build or device test performed for this fix. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): preserve secondary document-transfer exceptions Attach cleanup and backup-restore exceptions to the original error before wrapping it in IOException. Preserve the existing error messages, primary cause, and transfer control flow. Validation: - Confirmed the diff contains only the two addSuppressed calls. - git diff --check passed. - No Android build or device test performed for this diagnostic change. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(android): log authorization failures with throttling Report document access-check errors at warning level and blocking-task failures at error level. Throttle each site to one record per minute while preserving existing deny decisions and failure messages. Validation: - Existing hbb_common log_throttle tests: 4 passed. - Rust formatting and git diff --check passed. - Android target build and device testing not performed. Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
Maison da Silva
|
894f532835 | Update API server connection tips in Portuguese (#16734) | ||
|
Lukas
|
eb23902450 |
fix(lang): keep the {} value and the meaning in four translations (#16701)
* fix(lang): keep the {} value and the meaning in four translations
* test(lang): check that the fixed translations keep their key's {}
translate() replaces {} with the value from the call. The test checks that no non-empty ru, sc or vi translation of a key with {} drops it; on master it fails with "Downloading {}" => "Скачивание".
|
||
|
Minh Nguyen
|
59f2953c94 |
fix(windows): name the privacy window executable explicitly (#16711)
Turning on privacy mode 1 could fail with `os error 193`, "%1 is not a valid Win32 application", naming a broker executable that is perfectly intact. `CreateProcessAsUserW` was given a NULL `lpApplicationName` and the unquoted broker path as `lpCommandLine`. With no application name Windows has to work out the image from the command line, and it does so by trying each whitespace-delimited prefix in turn. The default install path is `C:\Program Files\RustDesk\...`, so the first candidate is `C:\Program`. On a machine where a file by that name happens to exist, Windows loads it, fails to read it as a PE image, and returns ERROR_BAD_EXE_FORMAT. The path in the error message is the command line that was intended, not the file Windows tried. Pass the path as `lpApplicationName`, which removes the guessing entirely, and quote the copy that goes in as `lpCommandLine` so the child still sees a well-formed `argv[0]`. Bind that buffer mutably while here: the API declares it as an in/out `LPWSTR` the Unicode implementation may rewrite, so handing over a const pointer cast to mutable was the wrong interface for the call. Both other `CreateProcess` call sites in the tree already name the executable explicitly, one of them with a comment giving this exact reason, so this brings the third into line rather than introducing a pattern. Refs #16705 |
||
|
Alex Rijckaert
|
a5e986401c | Update Dutch translations (#16702) | ||
|
Minh Nguyen
|
182356ee8b |
fix(linux): load peers when the app dir is unset (#16698)
Recent sessions and Favorites load only when `APP_DIR` is non-empty. That precondition belongs to mobile alone: `Config::path` resolves through `APP_DIR` on Android and iOS, so reading peers before it is set would look in the wrong place there, but on desktop the peer path never consults it. On Linux the Flutter side fills `APP_DIR` from `getApplicationDocumentsDirectory()`, which shells out to `xdg-user-dir`. When that executable is absent, as in a minimal Debian install or a container, the call throws, the exception is only `debugPrint`ed, and `APP_DIR` stays empty. All three loaders then skip their work, so both lists stay empty for good while `~/.config/rustdesk/peers/*.toml` sit there unread and nothing in the log says why. Windows and macOS carry the same trap, merely with a lookup that is far less likely to fail. Move the predicate into one helper that applies it only where the path actually depends on it. Mobile keeps the existing check; everywhere else the peers load. Refs #16622 |
||
|
github-actions[bot]
|
f96a44a019 |
chore: update webpki-roots to latest Mozilla root store (#16713)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
VenusGirl❤
|
1297da6d18 |
Update Korean language (#16687)
Update ko.rs |
||
|
Lukas
|
8814503e06 | fix(linux): pick up pulsectl's default source fix for voice calls (#16685) | ||
|
Lukas
|
c8a4e0680c |
fix(linux): capture the default output's monitor for remote audio (#16681)
* fix(linux): capture the default output's monitor for remote audio With no audio input chosen, the _pa service recorded the first source whose name contains "monitor". Sources are listed in creation order, so on a host with more than one output, such as onboard audio plus HDMI, a USB headset or a Bluetooth speaker, that monitor can belong to an output the desktop does not play to, and the controlling side hears silence. Ask the server for the default sink and record its monitor, keeping the first monitor as the fallback. * fix(linux): log the lookups that fall back to the first monitor * fix(linux): fall back to the first monitor when the default sink has no monitor name * fix(linux): throttle the default monitor lookup warnings |
||
|
Cody SwartzandClaude Opus 5.5
|
ed6a1acce8 |
feat(address-book): add a toolbar button to open the web console (#16680)
The web console is only reachable from the "More on web console" item in the menu beside the Tags heading, which is easy to miss and hidden when the tags panel is turned off. Add a button to the Address Book toolbar that opens the same URL and reuses the same tooltip text. It shows under the same conditions as the menu item: logged in, not in legacy address book mode, and write access to the current book. Signed-off-by: Cody Swartz <ctsstc@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
21pages
|
4d37f00af9 |
fix(client): invalidate auto FPS state when updating FPS limits (#16283)
* fix(client): sync FPS control and reset limits on quality changes Track the last sent FPS across manual and automatic updates. Reset the FPS limit to 30 when leaving custom image quality, while preserving lower automatic limits when already capped at 30. fix(client): reset last sent FPS state on reconnect Signed-off-by: 21pages <sunboeasy@gmail.com> fix(client): invalidate auto FPS state when updating FPS limits Clear last_auto_fps when setting custom FPS so the controller recomputes on its next tick. Restore the 30 FPS cap when switching to preset quality while preserving the saved custom FPS setting. Signed-off-by: 21pages <sunboeasy@gmail.com> fix(client): reset auto FPS state after successful login Move last_auto_fps invalidation from login send paths to handle_peer_info, covering both normal and switch-side logins. Signed-off-by: 21pages <sunboeasy@gmail.com> fix(client): scope auto FPS state to each connection Keep automatic FPS state in the connection loop and invalidate it when processing manual FPS updates or successful login. Validate queued automatic updates against the current FPS cap and record the value only after a successful send. Signed-off-by: 21pages <sunboeasy@gmail.com> * test(client): cover FPS adjustment after manual updates Signed-off-by: 21pages <sunboeasy@gmail.com> --------- Signed-off-by: 21pages <sunboeasy@gmail.com> |
||
|
Lukas
|
21c488b6ce |
fix(linux): recognize a login screen whose greeter uses another nologin path (#16675)
* fix(linux): recognize a login screen whose greeter uses another nologin path is_prelogin() reads the active user's passwd entry and treats /bin/false or /usr/sbin/nologin as a greeter account. Greeter accounts on Arch use /usr/bin/nologin (gdm, sddm and lightdm) and others /sbin/nologin, so there a login screen was not detected: the audio service kept retrying the _pa ipc every second, which #16390 stopped at a login screen, and file transfer used the greeter's name. Match any nologin path. * fix(linux): match nologin only in the shell field of the passwd entry Checking the whole getent line also matched a home directory such as /home/nologin-test. Read the last field of each line and require it to end in /false or /nologin. Output with several lines, as getent prints for an empty name, still counts if any entry has such a shell, as before. * fix(linux): compare the greeter shell with the known paths only Match the shell field against /bin/false, /usr/bin/false, /usr/sbin/nologin, /sbin/nologin and /usr/bin/nologin instead of any path that ends in /false or /nologin, so a custom shell elsewhere is not taken for a login screen. |
||
|
Lukas
|
01e1323e51 |
fix(linux): keep listing resolutions after an interlaced xrandr mode (#16672)
* fix(linux): keep listing resolutions after an interlaced xrandr mode
resolutions() reads the mode lines below an output with (\s*\d+x\d+\s+\d+.*\n)+, which needs whitespace right after the size. A TV usually lists 1920x1080i right after 1920x1080, so the list ended there and the resolution menu offered only the current mode. Allow a suffix after the size; the per-mode pattern still skips the interlaced lines, so only the following progressive modes are added.
* test(linux): check the resolutions parsed from xrandr output
Move the parsing of resolutions() into resolutions_from_xrandr(), which takes the xrandr output, so the test asserts the returned list instead of the captured mode lines. resolutions() runs xrandr and calls it; the parsing is unchanged.
* Revert "test(linux): check the resolutions parsed from xrandr output"
This reverts commit
|
||
|
Lukas
|
106f700be4 |
fix(linux): read Debian's GDM config when checking for a Wayland login screen (#16674)
is_login_wayland() looks for WaylandEnable in /etc/gdm3/custom.conf and /etc/gdm/custom.conf. Debian's gdm3 package ships /etc/gdm3/daemon.conf instead (bookworm and trixie), whose default has '#WaylandEnable=false', so on Debian the function always returned false and the 'Login screen using Wayland is not supported' card never appeared. Read daemon.conf after the two custom.conf paths. |
||
|
Lukas
|
f7b0af78cb |
fix(lang): pick Traditional Chinese for Hong Kong and Macao system locales (#16671)
* fix(lang): pick Traditional Chinese for Hong Kong and Macao system locales With no language chosen in Settings, resolve_lang picks zh-tw only when the system locale contains tw. Hong Kong and Macao locales (zh_HK, zh-Hant-HK, zh_HK_#Hant, zh_MO) and a bare zh-Hant got Simplified Chinese, although they write Traditional Chinese. Pick zh-tw for them too, unless the locale names the Hans script. * test(lang): cover a bare zh-Hant locale |
||
|
Lukas
|
25d2742273 |
fix(lang): pick the Kazakh and Georgian translations from the system locale (#16670)
With no language chosen in Settings, resolve_lang takes the language from the system locale prefix. Kazakh locales are kk_* and Georgian locales are ka_*, but their translation tables are keyed kz and ge, so both fell through to English. Map kk to kz and ka to ge for the locale-derived language. A language saved in Settings is unchanged. |
||
|
Hüseyin Durna
|
eb6c32bd57 |
l10n(tr): fill missing shortcut and API server translations (#16669)
Signed-off-by: Hüseyin Durna <76519526+husodrn46@users.noreply.github.com> |
||
|
Rafał Sikora
|
398364fa18 |
fix(ios): keep background music playing during remote sessions (#16660)
Configure the iOS audio session with the ambient category so remote playback mixes with other apps while respecting Silent mode and lock. Log configuration errors and leave audio activation to playback. Signed-off-by: Rafal <mrsikorarafal@gmail.com> |
||
|
rustdeskandClaude Opus 5.5
|
828d1101af |
chore(deps): pin hwcodec to rustdesk-org/hwcodec#47
Move the locked hwcodec revision from febec27 to ec38eba, the merge of rustdesk-org/hwcodec#47: GPU query failure handling, Windows resource handling and recoverable fragmented MP4 recording. hwcodec's own dependencies are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
RustDeskandClaude Opus 5.5
|
3ec041644d |
fix(linux): gtk sudo shows no false "Sorry, try again." and retries with sudo-rs (#16652)
* fix(linux): no false "Sorry, try again." in gtk sudo after a PAM info line The gtk sudo dialog takes the password before sudo starts and drops it when sudo prints a non-prompt line first, such as pam_fprintd's "Place your finger on the fingerprint reader". The real password prompt then came up labelled as a retry, "Sorry, try again.", although no password had been sent, so users took it as a rejected password. Treat the next prompt as a first prompt when the typed password is dropped. The dialog comes back prefilled and without the error. Keeping the password and sending it to the next prompt instead is not safe: when sudo authenticates without a prompt (fingerprint, NOPASSWD), use_pty, the default since sudo 1.9.14, holds the tty in raw mode while the command runs, so any output line ending in ':' would receive it. Fixes #16647 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(linux): let gtk sudo retry after sudo-rs rejects a password sudo-rs reports a rejected password with "sudo: Authentication failed, try again." and then asks again. The line starts with "sudo:", so ui_parent treated it as fatal: it showed it in an error dialog and exited instead of offering a retry, as it does after classic sudo's "Sorry, try again." (the second log in #16647). Exempt exactly that line from the fatal check. It then goes through the ordinary non-prompt branch, so the held-password drop rule still applies. sudo-rs's final "maximum N incorrect authentication attempts" stays fatal, and so does every other sudo:/su: line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
RustDeskandClaude Opus 5.5
|
d97351ad73 |
Custom websocket port (#16658)
* feat: let custom client settings set websocket-port A domain endpoint becomes ws(s)://<domain>/ws/id with no port, so a WebSocket reverse proxy that cannot listen on 443 (or 80) is unreachable. hbb_common adds websocket-port for that; list it in KEYS_SETTINGS so default-settings and override-settings carry it. The hbb_common bump also brings in 20d5019 (quiets smithay client toolkit logs, rustdesk/hbb_common#620). https://github.com/rustdesk/rustdesk-server-pro/discussions/1029 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Update hbb_common for the websocket-port warning throttle Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Update hbb_common: match websocket-port only against configured servers Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Pin hbb_common to the merged websocket-port change rustdesk/hbb_common#626 is merged as edefa08. The range from master's pin 5d52530 also includes 20d5019 (quiets smithay client toolkit logs, rustdesk/hbb_common#620). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
fufesou
|
2b6fedfc8e |
fix(windows): protect installer handoff and use native service control (#16562)
* fix(windows): use native APIs for manual service control rustdesk/rustdesk#16557 Replace elevated service-control batch scripts with SCM operations and native tray shortcuts. Preserve SYSTEM configuration import and propagate helper failures. * fix(windows): preserve service state during manual control Keep existing service registration and synchronize failed operations with SCM state. Run the installed legacy importer directly as SYSTEM, bound its exit waits, and keep auxiliary cleanup errors separate from service lifecycle results. * fix(windows): preserve legacy service import without debug privilege * fix(windows): replace installer certutil and findstr Use native SHA-256 verification and shortcut decoding, and execute the protected batch script in a single cmd process. Preserve protected staging, verification receipts and failure exit codes. Restore the master service-control flow and remove the separate SCM and Task Scheduler implementation to keep the antivirus fix focused and preserve legacy configuration import. Validation: Windows Rust library build, nine focused tests, and isolated single-cmd success, failure, tamper rejection and cleanup checks passed. Bitdefender validation remains pending. * fix(windows): preserve installer helper path compatibility * fix(windows): preserve caret-only installer helper paths * fix(windows): protect installer data and use native service control Stage installer scripts, shortcuts and verified updates with restricted ACLs before elevation. Remove the elevated portable-verifier launch while keeping certutil and findstr out of the shared installer handoff. Use the installed Flutter runner for native normal-service create/start and stop/delete operations. Preserve existing registrations on repeated setup, legacy configuration import, and compatibility with older installed runners. Report installer failures and document the security and compatibility reasons. Validation: Windows Rust test build and Release runner build passed; six isolated service checks and runner exit-code checks passed. Focused Rust installer/update tests passed 8/9; the directory-cleanup ACL test also fails in the earlier binary. Final service lifecycle and Bitdefender testing is pending. * fix(windows): clean staged installer files on UAC cancellation Retain DELETE handles until the elevated cmd connects to a local pipe, then release the handles before allowing the BAT to run. This preserves protected staging while allowing cancellation cleanup and cmd file access. Handle interrupted handoffs, supply the byte-count pointer required on Windows 7, and explain early service dispatch in the C++ runner. Keep the staging tests inline with their implementation. Validation: Windows Rust test build, focused installer-file and handoff tests, rustfmt, and staged diff checks passed. The pre-existing directory ACL test failure is unchanged. Actual UAC cancellation, Windows 7 runtime, and final-build Bitdefender validation remain pending. * fix(windows): roll back new service registration on start failure Delete a registration created by this attempt if startup fails, while preserving existing services and already-running success. Keep the original startup error and report rollback failures separately. Validation: eight isolated service checks and the Release Flutter runner build passed. Real service startup failure and final-build Bitdefender validation remain pending. * fix(windows): continue uninstall after service stop errors Log an unsuccessful stop and still request deletion so the uninstall script can reach its existing taskkill and cleanup commands. Treat an already marked service as a satisfied deletion request, while preserving other deletion errors and the normal stop wait. Validation: all twelve isolated service-control checks passed, including already-marked, stop-rejected, stop-timeout and deletion-denied cases. The Release Flutter runner build and existing argument/exit-code checks passed. Real SCM failure scenarios and Bitdefender remain unverified. * fix(windows): finish installer setup before service startup Complete SAS policy and printer setup before native service activation so a startup failure cannot skip independent installation steps. Preserve the startup error, rollback and legacy command sequences, and document uninstall_service's continuation result. Validation: Windows Rust test compilation, four isolated command cases and two existing installer handoff tests passed. CodeRabbit completed with no findings. Actual installer, SCM and Bitdefender validation remains pending. * fix(windows): use native service control for Sciter Share the existing native service operations with Sciter and dispatch --service-control before UI initialization. Keep Flutter's entry point and the legacy commands for a different installed executable unchanged. Validated the Windows x64 Sciter build, Flutter-feature test build, x86 C++ bridge compilation, and real EXE/BAT error propagation. Final Bitdefender installation and service lifecycle validation remain pending. * fix(windows): propagate negative service-control exit codes Treat every nonzero service-control exit status as a failure so crash and loader error codes cannot be reported as success. Verified six real cmd.exe exit-code cases; CodeRabbit review completed with no findings. Actual service crashes were not exercised. * fix(windows): handle UAC cancellation and scope service rollback Preserve the typed elevation error and its diagnostic details so canceled UAC prompts do not show an installation-failure dialog. Use create-service for normal installation and create-service-with-rollback for manual Start Service. Retain a new registration after a normal installation startup error; roll back only the manual path that restores stop-service=Y. Validation: Windows Rust test compilation, Release Flutter runner and Sciter builds, cancellation/error-chain checks, isolated service-result cases, and real executable argument/exit propagation checks passed. Actual UAC cancellation and Bitdefender were not rerun. |
||
|
CatzTimesandCatzTimes
|
f010d33ca6 |
fix(android): wheel scrolling from the controller does not reach Android peers (#16409)
The controller sends a wheel tick as a MouseEvent whose type bits are MOUSE_TYPE_WHEEL (src/common.rs) with the scroll delta in y, but InputService only handles the legacy WHEEL_DOWN/WHEEL_UP masks (523331/963) that current controllers never send. As a result the mouse wheel does nothing on every Android controlled device. Handle MOUSE_TYPE_WHEEL with the same stroke emulation the legacy masks use, as a purely additive branch: a 90px vertical stroke (MOUSE_WHEEL_STEP, three quarters of the legacy WHEEL_STEP - the full 120px felt too far per tick to reviewers on real devices) over WHEEL_DURATION at the current cursor position, with the same top-edge guard and queue consumption, mapped with the controller's sign convention (y < 0 = wheel down; y == 0, a horizontal tick, is ignored). The branch is gated to API 24+ like the rest of the gesture path - below that, legacy devices take the Shizuku backend or a no-op, not this class. The legacy WHEEL_DOWN/WHEEL_UP implementations are untouched. Community reports matching this gap on modern devices: #9321 (Pixel 8, Android 14) and #1466 (Android tablet). Signed-off-by: CatzTimes <CatzTimes@users.noreply.github.com> Co-authored-by: CatzTimes <CatzTimes@users.noreply.github.com> |
||
|
Leo Camus
|
bd92623972 |
fix(linux): match the xrandr output name at the start of its line (#16590)
The pattern resolutions() and current_resolution() build from the output name is not anchored, so DP-1 also matches the eDP-1 line. On a laptop where xrandr lists eDP-1 first, the external DP-1 reports the built-in panel's current mode and mode list. |
||
|
21pages
|
4e93a41ecc |
Tune MediaCodec static refresh budgets (#16579)
* Tune MediaCodec static refresh budgets Use H.264 budgets 50/20/20/10 and H.265 budgets 90/20/20/20 from MT6855 1080p measurements with early stopping at 80% of observed-best improvement, not full convergence. Retain the existing H.265 low-quality budget because the line-pattern sample did not confirm convergence within 150 repeat calls. Keep the existing ten latency-draining repeats, other backends, and refresh timing unchanged. Extend output-budget and backend-selection regression coverage. Static refresh tests pass with hwcodec (17 tests) and default features (16 tests). * fix(video): retain the largest static refresh budget per frame |
||
|
21pages
|
ce54e33c71 |
fix(ffmpeg): handle QSV encoder stalls and undersized buffers (#16303)
* fix(ffmpeg): bound QSV encoder retries Limit QSV frame submission to 100 retries and synchronization to 10 retries so persistent SDK warnings return an error to the caller. Retain queued buffers when synchronization reaches its retry limit, and allow later calls to retry without latching an error. Wait 1 ms between retryable submission warnings on Windows: the original av_usleep(500) becomes Sleep(0), exhausting the retry budget before even a brief device-busy interval can end. Preserve non-Windows wait behavior and the existing negative SDK result handling. Validated against FFmpeg 7.1.1 on Intel UHD 730 with 42 fault/control cases, synchronization-timeout recovery and close cleanup, real H.264 and HEVC encoding, and separate QSV hardware decoding. Four concurrent 1080p encoders completed 2400 frames without errors. * fix(ffmpeg): handle undersized QSV HEVC buffers Reserve at least three bytes per aligned pixel for HEVC output, following Intel's documented workaround for underestimated bitstream capacity. Check the size before assigning it to AVPacket's integer capacity. Report negative synchronization results before reading output metadata or draining the FIFO, keeping failed tasks owned until encoder close. On Intel UHD 730, the existing code fails at input 242 with real desktop captures; the patched code encodes and decodes all 1,200 inputs. Inputs and PTS match, and the first 241 encoded frames are byte-identical. H.264 also passes 300 frames, and restoring the small buffer verifies error handling. * fix(ffmpeg): refresh QSV HEVC capacity after reset and shorten sync waits * fix(ffmpeg): apply QSV buffer sizing to H.264 * fix: backport FFmpeg hybrid MP4 finalization fix Backport FFmpeg commit 36896af64a9ecf6835758186e7161a2e954c364d so hybrid MP4 finalization writes the final moov before hiding the original fragmented index. Preserve recoverable fragments when the final index cannot be written. |
||
|
RustDeskandClaude Opus 5.5
|
2016f48dd7 |
fix(file-transfer): keyboard navigation in the desktop file list (#16642)
* fix(file-transfer): keyboard navigation in the desktop file list Up/Down never moved the selection in the desktop file transfer list. The arrow keys fell through to directional focus traversal instead, which moved focus out of the list and stopped type-to-search until the mouse entered the list again. Handle the navigation keys on the list, as the Sciter grid did: - Up/Down move the selection one row; Shift extends or shrinks a range from its anchor. - PageUp/PageDown go to the edge of the visible rows first, then a page further; Home/End go to the first/last row. Shift extends with each. - Enter/numpad Enter opens the selected folder, like a double click. - Left/Right are consumed so focus does not jump to the other pane. Type-to-search now ignores control characters. On macOS and Linux Enter carries "\r", which matched no name and cleared the selection before Enter could open it. Fixes #16635 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(file-transfer): keep default keys on focused file list children The navigation bindings wrapped the whole file list, sort headers included, so a header focused with Tab lost Enter to sort and the arrow keys to move between headers: Enter ran the open-folder binding instead. Handle the bindings only while the list itself has primary focus and let keys on a focused child take their default path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(file-transfer): focus the file list when a row is clicked The navigation keys only act while the file list holds primary focus. Keyboard focus was handed to the list only when the mouse entered it, so after Tab moved focus to a sort header, clicking a row left the arrow keys inert until the mouse left and re-entered the list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
fufesou
|
b44b71cfab |
Fix/download path validation (#16601)
* fix: validate download destinations and peer filename rules Reject unsafe or linked download destinations and validate empty-directory paths before creating them. Bind overwrite approval to accepted transfer entries and propagate receiver errors to the UI. Validate remote listings using the peer's filename rules so Unix names remain browsable on Windows. Reject locally unsafe basenames before starting downloads from either the Flutter or legacy UI. Finish the previous file before validating the next digest so rejecting the next destination preserves the file already received. Require confirmation before restarting interrupted downloads with stale staging files. Preserve matching resumes and cover receiver recovery. Retain explicit overwrite rejection for peers older than 1.1.10 that cannot negotiate confirmation. Signed-off-by: fufesou <linlong1266@gmail.com> * comments Signed-off-by: fufesou <linlong1266@gmail.com> * fix: use async I/O for download preparation and resume Use Tokio filesystem APIs for download setup and resume metadata checks. Run the Windows link-count query on the blocking pool and flush digest writes before returning. Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
mvtbh
|
eef1096395 | Update fa.rs (#16587) | ||
|
|
8b61033178 |
Update pl.rs (#16588)
* Update pl.rs Update Polish language (shortcuts screen). * Update src/lang/pl.rs Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update src/lang/pl.rs Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * Update pl.rs * Update pl.rs Corrected typo. --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: RustDesk <71636191+rustdesk@users.noreply.github.com> |
||
|
Alex Rijckaert
|
c29bef18bb | Update Dutch translations for keyboard shortcuts (#16625) | ||
|
fathur
|
c6258f4166 |
Fix typo in Indonesian translation (#16630)
* docs(id): translate misuse disclaimer section * docs(id): add Flathub download badge * i18n(id): fix typo in Indonesian translation * fix broken translation tuple in id.rs * i18n(id): fix typo in Indonesian translation |
||
|
bovirus
|
989beee17f | Update Italian language (#16633) | ||
|
Ricardo Simõesandgreptile-apps[bot]
|
4b1821d1ff |
Update pt pt translation + README.md to include Portuguese (Portugal) (docs/README-PTPT.md) (#16634)
* Update pt_PT.rs
* Add files via upload
* Update README-PTPT.md
* Update README-PTPT.md
* Update README.md to include new pt-PT (docs/README-PTPT.md)
* Update docs/README-PTPT.md
Corrected link libs/base
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Update docs/README-PTPT.md
Corrected "área de trabalho" to "área de transferência"
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Update pt_PT.rs
Fix api_server_connection_tip and api_server_empty_tip: translate from en.rs source
* Fix relative links in README-PTPT.md (remove extra docs/ prefix)
* Fix section anchors in README-PTPT.md to match PT-PT headings
* Fix typos and gender agreement in README-PTPT.md disclaimer
* Use European Portuguese terms in README-PTPT.md screenshot alt text
* Translate shortcut instructions from en.rs source
* Update pt_PT.rs
Align shortcut and API server strings with en.rs source (keep {} placeholders)
* Revert JumpLink to original value (out of scope for this PR
* Replace remaining Brazilian Portuguese terms in README-PTPT.md
Replaces leftover Brazilian Portuguese wording with European Portuguese
equivalents (e.g. "conosco" -> "connosco", "controle" -> "controlo",
"conexão" -> "ligação", "Você tem" -> "Tem", "amigável" -> "acessível",
"desktop" -> "ambiente de trabalho"), consistent with the terminology
already used in src/lang/pt_PT.rs.
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
|
||
|
Shaan Majid
|
3202d1764c |
chore(deps): update webpki-roots and rustls-webpki in Cargo.lock (#16639)
webpki-roots and webpki-root-certs 1.0.10 drop emSign ECC Root CA - G3, whose eMudhra intermediates had their private keys compromised. rustls-webpki 0.103.16 rejects chains through those intermediates (RUSTSEC-2026-0382, RUSTSEC-2026-0383); it needs rustls-pki-types >= 1.12. Signed-off-by: Shaan Majid <70789625+shaanmajid@users.noreply.github.com> |
||
|
fufesou
|
c7f212df2c |
fix: warn about insecure custom API server connections (#16616)
* fix: warn about insecure custom API server connections Signed-off-by: fufesou <linlong1266@gmail.com> * fix: limit API server warning to HTTP addresses Signed-off-by: fufesou <linlong1266@gmail.com> * fix: resolve API warnings against effective server configuration Signed-off-by: fufesou <linlong1266@gmail.com> * fix: reuse common sync for API server previews Signed-off-by: fufesou <linlong1266@gmail.com> * fix: keep server settings usable on API preview errors Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
fathur
|
7f5a401947 |
Update README-ID translations (#16626)
* docs(id): translate misuse disclaimer section * docs(id): add Flathub download badge |
||
|
Leo Camus
|
bbffc1de5a |
fix: bracket a bare IPv6 ID server when deriving the API server (#16624)
With the API server field empty, get_api_server_ builds the URL from the ID server as "http://{host}:21114". For an ID server entered as a bare IPv6 address such as 2001:db8::1, which test_if_valid_server accepts, increase_port leaves it unchanged and the result is http://2001:db8::1:21114. That does not parse as a URL (InvalidPort), so login and every other API request fail. Wrap the address in brackets in that branch only. Hostnames, IPv4 and "[addr]:port" take the same path as before. |
||
|
Leo Camus
|
4b92080e3e |
fix(x11): keep the RandR monitors reply alive while iterating it (#16595)
DisplayIter::next_screen built the monitor iterator from the xcb_randr_get_monitors reply and freed the reply on the next line. The iterator's data pointer points into that reply, so next() read every monitor's name atom, position and size from freed memory, and xcb_randr_monitor_info_next() walked it too. Keep the reply with the iterator and free it when moving to the next screen or when the DisplayIter is dropped. |
||
|
Chris21xandchg
|
0cbeb04730 |
Forward audio latency environment to Linux user server (#16597)
* Forward audio latency environment to Linux user server Preserve PULSE_LATENCY_MSEC and PIPEWIRE_LATENCY when the root service spawns the per-user RustDesk server. The systemd service defines these variables, but they were not included in the explicit environment passed to run_as_user(), causing the user server and connection manager to fall back to higher audio latency. Forward the existing values without changing their defaults. * Add regression test for Linux audio latency forwarding --------- Co-authored-by: chg <chg@vis-ag.ch> |
||
|
fathur
|
1042a26deb |
Add Flutter code section to README-ID (#16600)
* Add Flutter code section to README-ID Added a section for Flutter code related to desktop and mobile platforms. * Fix link formatting for Flutter code section |
||
|
solokot
|
53996e3c40 | Update ru.rs (#16570) | ||
|
RustDesk
|
e400bb7554 | Enforce lockfile during pub get in build script | ||
|
21pages
|
392188596c |
fix(video): improve clarity after scrolling by re-encoding static frames (#16128)
* fix(video): re-encode static frames for up to 10 seconds to improve clarity Signed-off-by: 21pages <sunboeasy@gmail.com> fix(video): limit static re-encoding to 300 frames instead of 10 seconds Signed-off-by: 21pages <sunboeasy@gmail.com> refactor(video): move static frame refresh into a dedicated module Signed-off-by: 21pages <sunboeasy@gmail.com> fix(video): preserve stuck-encoder detection state across static repeats test(video): cover cached texture lifetime across capture restarts fix(video): reduce static re-encoding limit to 100 frames fix(qos): lower qos_trace logging to trace level Signed-off-by: 21pages <sunboeasy@gmail.com> fix(video): skip static frame re-encoding for AV1 perf(video): reuse VRAM encoder input for static refresh Remove the DXGI repeat texture cache and use hwcodec's repeat entry point to avoid copying each captured frame. Isolate static refresh failures, pause after three errors, and resume after a real frame is sent successfully. Cover cached input ownership, repeat failure recovery, refresh limits, and normal encoder failover with regression tests. fix(vram): ignore cached SDK codec backends chore(deps): temporarily use hwcodec re-encode branch perf(video): wait 200ms before starting static refresh chore(deps): update hwcodec for FFI exception handling chore(deps): update hwcodec to 0.8.0 perf(video): start static refresh after 100ms chore(deps): update hwcodec for exception-safe cleanup chore(deps): update hwcodec for device-loss handling and noexcept FFI chore(deps): update hwcodec to bbfc306 chore(qos): remove verbose diagnostics while retaining trace logs * update hwcodec Signed-off-by: 21pages <sunboeasy@gmail.com> * refactor(scrap): keep repeat encoding in the vram module * perf(vram): avoid intermediate frame vectors - Drain normal and repeated encode output into protobuf messages. - Cover null-texture encoding failures. - Clarify the count-based static refresh budget. - Update hwcodec to fix RAM decode buffers on resolution changes. Signed-off-by: 21pages <sunboeasy@gmail.com> * fix(scrap): preserve hardware encoder error codes * test(video): remove uptime dependency from static refresh tests * feat(video): configure static repeat limits by codec and quality * fix(video): exempt VPx and AV1 from static repeat failure limit * fix(video): count only successful static repeat frames * fix(video): refine static repeat scheduling and VPx frame handling Allow static refinement after a VP8/VP9 captured frame produces no output without enabling it after a genuine encoding error. Carry this distinction alongside the send result so the latest cached frame can still be sent when capture becomes idle. Keep VP8/VP9 repeats at a minimum of 100ms. Other codecs wait at least 100ms initially, then follow the QoS frame interval aligned with the capture loop. Use four quality bands, with VP8/VP9 limits of 30/20/20/0 and the tuned H264/H265 limits. Include only production behavior and regression tests. Validation: 16 static_refresh tests passed with hwcodec,vram,flutter enabled, covering latest-frame recovery, genuine errors, timing, and repeat budgets. * fix(video): tune static repeat limits by codec and backend Use the measured obvious-improvement checkpoints for VP8/VP9 and separate NVENC, QSV, and AMF H.264/HEVC limits for each quality tier. The checkpoints recover 80% of the observed error improvement across the tested inputs. Resolve the hardware backend from EncoderCfg during StaticRefresh construction, including the VRAM adapter vendor. Keep the existing limits for other hardware backends. Validation: 19 static_refresh tests passed with hwcodec,vram,flutter. The repeat measurements cover 192 series with no encode/decode errors. * fix(video): refine static refresh budgets and cap repeat FPS Add VideoToolbox HEVC budgets and tune quality bands from repeat-frame comparisons. Cap static refresh at 30 FPS and use the speed preset consistently at quality 0.5. * remove unused variables Signed-off-by: 21pages <sunboeasy@gmail.com> * fix(video): repair static refresh tests and throttle repeat logs --------- Signed-off-by: 21pages <sunboeasy@gmail.com> |
||
|
RustDeskandClaude Opus 5.5
|
c0750fb50c |
fix(client): report one error when both WebRTC race legs fail (#16563)
Both legs of race_transports_prefer_webrtc send their own punch request to the same rendezvous server for the same peer, so a refusal there (offline, unknown ID, key mismatch, a server-supplied other_failure) fails both with the same text. Joining them as "WebRTC failed: X; fallback failed: X" showed it twice and broke the UI's whole-string matching: the offline auto-retry needs exactly "Remote desktop is offline", the message box translates the text as one string, and check_if_retry hides the retry button for any text containing "failed". Return the error of the leg that failed last, as select_ok did before the race existed, and log the other one once. Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
fufesou
|
f705902ec3 |
fix(windows): move installer scripts into protected temp directories (#16554)
* fix(windows): move installer scripts into protected temp directories Create a private directory under Windows Temp with its final DACL in CreateDirectoryW. Grant Administrators and SYSTEM full access and use OWNER RIGHTS to suppress the ordinary creator's implicit WRITE_DAC. Keep the existing elevated system-cmd copy and SHA-256 verification flow. Keep auxiliary files in the same directory, report cleanup failures, and check command length before creating the directory. This avoids PowerShell, helper executables, and application startup or DLL linking changes. The Windows Temp parent must retain its standard protection against deletion by unprivileged users. UAC cancellation can leave an empty protected directory; the error reports its path. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): preserve installer results when cleanup fails Keep the original installer exit code and report remaining temporary directories or inspection errors as warnings with their paths. Include the directory path in creation errors. Restore the existing handoff assertions in a separate test module, add a locked-directory regression for successful and failed installers, and remove the unrelated ERRORLEVEL environment change. Validation: scoped formatting and whitespace checks passed. Native cmd probes reproduced the failure before the fix and preserved both exit codes afterwards. No project build or Rust test execution was performed. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): clarify installer cleanup warnings Describe protected directories as possibly remaining when cleanup cannot be verified. Remove the cleanup-only test added during review while retaining existing handoff coverage. Signed-off-by: fufesou <linlong1266@gmail.com> * test(windows): keep installer handoff tests inline Restore the inline test module and original helper order to reduce the diff against master. Keep the directory cleanup assertions and original bootstrap checks. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): include paths in installer directory check errors Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): clear inherited ERRORLEVEL before installation Signed-off-by: fufesou <linlong1266@gmail.com> * fix(windows): avoid duplicate directory error messages Signed-off-by: fufesou <linlong1266@gmail.com> * test(windows): verify installer directory permissions Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> |
||
|
RustDeskandClaude Opus 5.5
|
0d36ac0cba |
fix(linux): stop using the window in onWindowClose once GTK destroyed it (#16561)
On Linux, GTK destroys the window on a close request unless prevent-close is on. When the main window is the last active one, onActiveWindowChanged() turns prevent-close off and calls close(), yet onWindowClose() still went on to hide() the destroyed window, and the close event that close() emits re-entered onWindowClose() to save the frame through isMaximized(). The cm and install windows never turn prevent-close on, so their window is always gone by the time onWindowClose() runs. With window_manager before cf4aef05 those calls segfaulted in gtk_window_is_maximized; since then they fail with an unhandled PlatformException(window_destroyed). Return early in both places instead. Other platforms and sub windows keep the old path. Fixes #16512 Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
RustDeskandClaude Opus 5.5
|
f1fa432bc8 |
Fix fdroid bridge version (#16560)
* fix(fdroid): generate the bridge with the Flutter version bridge.yml uses #15139 moved the bridge Flutter version from bridge.yml's env into its job matrix, so build_fdroid.sh read `.env.FLUTTER_VERSION` as "null". The F-Droid recipe worked around that by pinning it to 3.24.5, which equals ANDROID_FLUTTER_VERSION, and the script only generated the bridge when the two versions differed, so the build failed on the missing src/bridge_generated.rs. Read the version from the default bridge-artifact matrix entry (3.22.3), and always generate the bridge: the build needs it whether or not the two Flutter versions match. Fixes #16549 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF * fix(fdroid): keep the recipe's version sed from overriding the bridge Flutter The F-Droid recipe works around the old "null" read with `sed 's/${FLUTTER_BRIDGE_VERSION}/<version>/'`, and its auto-update copies that line into every new version. The 1.5.0 recipe pinned 3.24.5 and then 3.47.7, but flutter_rust_bridge codegen only works with the Flutter version bridge.yml uses (3.22.3). Pass the unbraced variable to prepare_flutter so that sed no longer matches the call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF * fix(fdroid): raise the Gradle heap for the AGP 8 build #15603 moved the Android build to Gradle 8.11.1 / AGP 8.10.1 with compileSdk 36 and desugaring. The first F-Droid 1.5.0 build got past the bridge and the Rust library, then failed in assembleRelease with "Gradle build daemon has been stopped: since the JVM garbage collector is thrashing", because gradle.properties still caps the heap at 1 GiB. CI has long raised it to 2g; do the same here. A recipe that already rewrites the -Xmx1024M setting keeps its own value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |