* fix(client): sync FPS control and reset limits on quality changes
Track the last sent FPS across manual and automatic updates.
Reset the FPS limit to 30 when leaving custom image quality,
while preserving lower automatic limits when already capped at 30.
fix(client): reset last sent FPS state on reconnect
Signed-off-by: 21pages <sunboeasy@gmail.com>
fix(client): invalidate auto FPS state when updating FPS limits
Clear last_auto_fps when setting custom FPS so the controller recomputes
on its next tick. Restore the 30 FPS cap when switching to preset quality
while preserving the saved custom FPS setting.
Signed-off-by: 21pages <sunboeasy@gmail.com>
fix(client): reset auto FPS state after successful login
Move last_auto_fps invalidation from login send paths to
handle_peer_info, covering both normal and switch-side logins.
Signed-off-by: 21pages <sunboeasy@gmail.com>
fix(client): scope auto FPS state to each connection
Keep automatic FPS state in the connection loop and invalidate it when processing manual FPS updates or successful login.
Validate queued automatic updates against the current FPS cap and record the value only after a successful send.
Signed-off-by: 21pages <sunboeasy@gmail.com>
* test(client): cover FPS adjustment after manual updates
Signed-off-by: 21pages <sunboeasy@gmail.com>
---------
Signed-off-by: 21pages <sunboeasy@gmail.com>
* fix(linux): recognize a login screen whose greeter uses another nologin path
is_prelogin() reads the active user's passwd entry and treats /bin/false or /usr/sbin/nologin as a greeter account. Greeter accounts on Arch use /usr/bin/nologin (gdm, sddm and lightdm) and others /sbin/nologin, so there a login screen was not detected: the audio service kept retrying the _pa ipc every second, which #16390 stopped at a login screen, and file transfer used the greeter's name. Match any nologin path.
* fix(linux): match nologin only in the shell field of the passwd entry
Checking the whole getent line also matched a home directory such as /home/nologin-test. Read the last field of each line and require it to end in /false or /nologin. Output with several lines, as getent prints for an empty name, still counts if any entry has such a shell, as before.
* fix(linux): compare the greeter shell with the known paths only
Match the shell field against /bin/false, /usr/bin/false, /usr/sbin/nologin, /sbin/nologin and /usr/bin/nologin instead of any path that ends in /false or /nologin, so a custom shell elsewhere is not taken for a login screen.
* fix(linux): keep listing resolutions after an interlaced xrandr mode
resolutions() reads the mode lines below an output with (\s*\d+x\d+\s+\d+.*\n)+, which needs whitespace right after the size. A TV usually lists 1920x1080i right after 1920x1080, so the list ended there and the resolution menu offered only the current mode. Allow a suffix after the size; the per-mode pattern still skips the interlaced lines, so only the following progressive modes are added.
* test(linux): check the resolutions parsed from xrandr output
Move the parsing of resolutions() into resolutions_from_xrandr(), which takes the xrandr output, so the test asserts the returned list instead of the captured mode lines. resolutions() runs xrandr and calls it; the parsing is unchanged.
* Revert "test(linux): check the resolutions parsed from xrandr output"
This reverts commit 854beb1. AGENTS.md asks not to reshape existing code only to enable a test, so resolutions() keeps its structure and the test checks the captured mode lines, as output_name_does_not_match_inside_another_name checks get_xrandr_conn_pat.
is_login_wayland() looks for WaylandEnable in /etc/gdm3/custom.conf and /etc/gdm/custom.conf. Debian's gdm3 package ships /etc/gdm3/daemon.conf instead (bookworm and trixie), whose default has '#WaylandEnable=false', so on Debian the function always returned false and the 'Login screen using Wayland is not supported' card never appeared. Read daemon.conf after the two custom.conf paths.
* fix(lang): pick Traditional Chinese for Hong Kong and Macao system locales
With no language chosen in Settings, resolve_lang picks zh-tw only when the system locale contains tw. Hong Kong and Macao locales (zh_HK, zh-Hant-HK, zh_HK_#Hant, zh_MO) and a bare zh-Hant got Simplified Chinese, although they write Traditional Chinese. Pick zh-tw for them too, unless the locale names the Hans script.
* test(lang): cover a bare zh-Hant locale
With no language chosen in Settings, resolve_lang takes the language from the system locale prefix. Kazakh locales are kk_* and Georgian locales are ka_*, but their translation tables are keyed kz and ge, so both fell through to English. Map kk to kz and ka to ge for the locale-derived language. A language saved in Settings is unchanged.
Configure the iOS audio session with the ambient category so remote
playback mixes with other apps while respecting Silent mode and lock.
Log configuration errors and leave audio activation to playback.
Signed-off-by: Rafal <mrsikorarafal@gmail.com>
Move the locked hwcodec revision from febec27 to ec38eba, the merge of
rustdesk-org/hwcodec#47: GPU query failure handling, Windows resource
handling and recoverable fragmented MP4 recording. hwcodec's own
dependencies are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(linux): no false "Sorry, try again." in gtk sudo after a PAM info line
The gtk sudo dialog takes the password before sudo starts and drops it
when sudo prints a non-prompt line first, such as pam_fprintd's "Place
your finger on the fingerprint reader". The real password prompt then
came up labelled as a retry, "Sorry, try again.", although no password
had been sent, so users took it as a rejected password.
Treat the next prompt as a first prompt when the typed password is
dropped. The dialog comes back prefilled and without the error.
Keeping the password and sending it to the next prompt instead is not
safe: when sudo authenticates without a prompt (fingerprint, NOPASSWD),
use_pty, the default since sudo 1.9.14, holds the tty in raw mode while
the command runs, so any output line ending in ':' would receive it.
Fixes#16647
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(linux): let gtk sudo retry after sudo-rs rejects a password
sudo-rs reports a rejected password with "sudo: Authentication failed,
try again." and then asks again. The line starts with "sudo:", so
ui_parent treated it as fatal: it showed it in an error dialog and
exited instead of offering a retry, as it does after classic sudo's
"Sorry, try again." (the second log in #16647).
Exempt exactly that line from the fatal check. It then goes through
the ordinary non-prompt branch, so the held-password drop rule still
applies. sudo-rs's final "maximum N incorrect authentication attempts"
stays fatal, and so does every other sudo:/su: line.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: let custom client settings set websocket-port
A domain endpoint becomes ws(s)://<domain>/ws/id with no port, so a
WebSocket reverse proxy that cannot listen on 443 (or 80) is
unreachable. hbb_common adds websocket-port for that; list it in
KEYS_SETTINGS so default-settings and override-settings carry it.
The hbb_common bump also brings in 20d5019 (quiets smithay client
toolkit logs, rustdesk/hbb_common#620).
https://github.com/rustdesk/rustdesk-server-pro/discussions/1029
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Update hbb_common for the websocket-port warning throttle
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Update hbb_common: match websocket-port only against configured servers
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Pin hbb_common to the merged websocket-port change
rustdesk/hbb_common#626 is merged as edefa08. The range from master's
pin 5d52530 also includes 20d5019 (quiets smithay client toolkit logs,
rustdesk/hbb_common#620).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(windows): use native APIs for manual service control
rustdesk/rustdesk#16557
Replace elevated service-control batch scripts with SCM operations
and native tray shortcuts. Preserve SYSTEM configuration import
and propagate helper failures.
* fix(windows): preserve service state during manual control
Keep existing service registration and synchronize failed operations with SCM state. Run the installed legacy importer directly as SYSTEM, bound its exit waits, and keep auxiliary cleanup errors separate from service lifecycle results.
* fix(windows): preserve legacy service import without debug privilege
* fix(windows): replace installer certutil and findstr
Use native SHA-256 verification and shortcut decoding, and execute the protected batch script in a single cmd process. Preserve protected staging, verification receipts and failure exit codes.
Restore the master service-control flow and remove the separate SCM and Task Scheduler implementation to keep the antivirus fix focused and preserve legacy configuration import.
Validation: Windows Rust library build, nine focused tests, and isolated single-cmd success, failure, tamper rejection and cleanup checks passed. Bitdefender validation remains pending.
* fix(windows): preserve installer helper path compatibility
* fix(windows): preserve caret-only installer helper paths
* fix(windows): protect installer data and use native service control
Stage installer scripts, shortcuts and verified updates with restricted ACLs
before elevation. Remove the elevated portable-verifier launch while keeping
certutil and findstr out of the shared installer handoff.
Use the installed Flutter runner for native normal-service create/start and
stop/delete operations. Preserve existing registrations on repeated setup,
legacy configuration import, and compatibility with older installed runners.
Report installer failures and document the security and compatibility reasons.
Validation: Windows Rust test build and Release runner build passed; six
isolated service checks and runner exit-code checks passed. Focused Rust
installer/update tests passed 8/9; the directory-cleanup ACL test also fails in
the earlier binary. Final service lifecycle and Bitdefender testing is pending.
* fix(windows): clean staged installer files on UAC cancellation
Retain DELETE handles until the elevated cmd connects to a local pipe, then
release the handles before allowing the BAT to run. This preserves protected
staging while allowing cancellation cleanup and cmd file access.
Handle interrupted handoffs, supply the byte-count pointer required on
Windows 7, and explain early service dispatch in the C++ runner. Keep the
staging tests inline with their implementation.
Validation: Windows Rust test build, focused installer-file and handoff
tests, rustfmt, and staged diff checks passed. The pre-existing directory
ACL test failure is unchanged. Actual UAC cancellation, Windows 7 runtime,
and final-build Bitdefender validation remain pending.
* fix(windows): roll back new service registration on start failure
Delete a registration created by this attempt if startup fails, while preserving existing services and already-running success. Keep the original startup error and report rollback failures separately.
Validation: eight isolated service checks and the Release Flutter runner build passed. Real service startup failure and final-build Bitdefender validation remain pending.
* fix(windows): continue uninstall after service stop errors
Log an unsuccessful stop and still request deletion so the uninstall
script can reach its existing taskkill and cleanup commands. Treat an
already marked service as a satisfied deletion request, while preserving
other deletion errors and the normal stop wait.
Validation: all twelve isolated service-control checks passed, including
already-marked, stop-rejected, stop-timeout and deletion-denied cases.
The Release Flutter runner build and existing argument/exit-code checks
passed. Real SCM failure scenarios and Bitdefender remain unverified.
* fix(windows): finish installer setup before service startup
Complete SAS policy and printer setup before native service activation so a startup failure cannot skip independent installation steps. Preserve the startup error, rollback and legacy command sequences, and document uninstall_service's continuation result.
Validation: Windows Rust test compilation, four isolated command cases and two existing installer handoff tests passed. CodeRabbit completed with no findings. Actual installer, SCM and Bitdefender validation remains pending.
* fix(windows): use native service control for Sciter
Share the existing native service operations with Sciter and dispatch
--service-control before UI initialization. Keep Flutter's entry point and
the legacy commands for a different installed executable unchanged.
Validated the Windows x64 Sciter build, Flutter-feature test build,
x86 C++ bridge compilation, and real EXE/BAT error propagation. Final
Bitdefender installation and service lifecycle validation remain pending.
* fix(windows): propagate negative service-control exit codes
Treat every nonzero service-control exit status as a failure so crash and loader error codes cannot be reported as success. Verified six real cmd.exe exit-code cases; CodeRabbit review completed with no findings. Actual service crashes were not exercised.
* fix(windows): handle UAC cancellation and scope service rollback
Preserve the typed elevation error and its diagnostic details so canceled UAC prompts do not show an installation-failure dialog.
Use create-service for normal installation and create-service-with-rollback for manual Start Service. Retain a new registration after a normal installation startup error; roll back only the manual path that restores stop-service=Y.
Validation: Windows Rust test compilation, Release Flutter runner and Sciter builds, cancellation/error-chain checks, isolated service-result cases, and real executable argument/exit propagation checks passed. Actual UAC cancellation and Bitdefender were not rerun.
The controller sends a wheel tick as a MouseEvent whose type bits are
MOUSE_TYPE_WHEEL (src/common.rs) with the scroll delta in y, but
InputService only handles the legacy WHEEL_DOWN/WHEEL_UP masks
(523331/963) that current controllers never send. As a result the
mouse wheel does nothing on every Android controlled device.
Handle MOUSE_TYPE_WHEEL with the same stroke emulation the legacy
masks use, as a purely additive branch: a 90px vertical stroke
(MOUSE_WHEEL_STEP, three quarters of the legacy WHEEL_STEP - the full
120px felt too far per tick to reviewers on real devices) over
WHEEL_DURATION at the current cursor position, with the same top-edge
guard and queue consumption, mapped with the controller's sign
convention (y < 0 = wheel down; y == 0, a horizontal tick, is
ignored). The branch is gated to API 24+ like the rest of the gesture
path - below that, legacy devices take the Shizuku backend or a
no-op, not this class. The legacy WHEEL_DOWN/WHEEL_UP implementations
are untouched.
Community reports matching this gap on modern devices: #9321 (Pixel
8, Android 14) and #1466 (Android tablet).
Signed-off-by: CatzTimes <CatzTimes@users.noreply.github.com>
Co-authored-by: CatzTimes <CatzTimes@users.noreply.github.com>
The pattern resolutions() and current_resolution() build from the
output name is not anchored, so DP-1 also matches the eDP-1 line. On a
laptop where xrandr lists eDP-1 first, the external DP-1 reports the
built-in panel's current mode and mode list.
* Tune MediaCodec static refresh budgets
Use H.264 budgets 50/20/20/10 and H.265 budgets 90/20/20/20 from MT6855 1080p measurements with early stopping at 80% of observed-best improvement, not full convergence.
Retain the existing H.265 low-quality budget because the line-pattern sample did not confirm convergence within 150 repeat calls. Keep the existing ten latency-draining repeats, other backends, and refresh timing unchanged.
Extend output-budget and backend-selection regression coverage. Static refresh tests pass with hwcodec (17 tests) and default features (16 tests).
* fix(video): retain the largest static refresh budget per frame
* fix(ffmpeg): bound QSV encoder retries
Limit QSV frame submission to 100 retries and synchronization to 10
retries so persistent SDK warnings return an error to the caller. Retain
queued buffers when synchronization reaches its retry limit, and allow
later calls to retry without latching an error.
Wait 1 ms between retryable submission warnings on Windows: the original
av_usleep(500) becomes Sleep(0), exhausting the retry budget before even
a brief device-busy interval can end. Preserve non-Windows wait behavior
and the existing negative SDK result handling.
Validated against FFmpeg 7.1.1 on Intel UHD 730 with 42 fault/control
cases, synchronization-timeout recovery and close cleanup, real H.264
and HEVC encoding, and separate QSV hardware decoding. Four concurrent
1080p encoders completed 2400 frames without errors.
* fix(ffmpeg): handle undersized QSV HEVC buffers
Reserve at least three bytes per aligned pixel for HEVC output, following
Intel's documented workaround for underestimated bitstream capacity. Check
the size before assigning it to AVPacket's integer capacity.
Report negative synchronization results before reading output metadata or
draining the FIFO, keeping failed tasks owned until encoder close.
On Intel UHD 730, the existing code fails at input 242 with real desktop
captures; the patched code encodes and decodes all 1,200 inputs. Inputs and
PTS match, and the first 241 encoded frames are byte-identical. H.264 also
passes 300 frames, and restoring the small buffer verifies error handling.
* fix(ffmpeg): refresh QSV HEVC capacity after reset and shorten sync waits
* fix(ffmpeg): apply QSV buffer sizing to H.264
* fix: backport FFmpeg hybrid MP4 finalization fix
Backport FFmpeg commit 36896af64a9ecf6835758186e7161a2e954c364d so hybrid MP4 finalization writes the final moov before hiding the original fragmented index. Preserve recoverable fragments when the final index cannot be written.
* fix(file-transfer): keyboard navigation in the desktop file list
Up/Down never moved the selection in the desktop file transfer list. The
arrow keys fell through to directional focus traversal instead, which
moved focus out of the list and stopped type-to-search until the mouse
entered the list again.
Handle the navigation keys on the list, as the Sciter grid did:
- Up/Down move the selection one row; Shift extends or shrinks a range
from its anchor.
- PageUp/PageDown go to the edge of the visible rows first, then a page
further; Home/End go to the first/last row. Shift extends with each.
- Enter/numpad Enter opens the selected folder, like a double click.
- Left/Right are consumed so focus does not jump to the other pane.
Type-to-search now ignores control characters. On macOS and Linux Enter
carries "\r", which matched no name and cleared the selection before
Enter could open it.
Fixes#16635
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(file-transfer): keep default keys on focused file list children
The navigation bindings wrapped the whole file list, sort headers
included, so a header focused with Tab lost Enter to sort and the arrow
keys to move between headers: Enter ran the open-folder binding instead.
Handle the bindings only while the list itself has primary focus and let
keys on a focused child take their default path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(file-transfer): focus the file list when a row is clicked
The navigation keys only act while the file list holds primary focus.
Keyboard focus was handed to the list only when the mouse entered it,
so after Tab moved focus to a sort header, clicking a row left the
arrow keys inert until the mouse left and re-entered the list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: validate download destinations and peer filename rules
Reject unsafe or linked download destinations and validate empty-directory
paths before creating them. Bind overwrite approval to accepted transfer
entries and propagate receiver errors to the UI.
Validate remote listings using the peer's filename rules so Unix names
remain browsable on Windows. Reject locally unsafe basenames before
starting downloads from either the Flutter or legacy UI.
Finish the previous file before validating the next digest so rejecting
the next destination preserves the file already received.
Require confirmation before restarting interrupted downloads with stale
staging files. Preserve matching resumes and cover receiver recovery.
Retain explicit overwrite rejection for peers older than 1.1.10 that
cannot negotiate confirmation.
Signed-off-by: fufesou <linlong1266@gmail.com>
* comments
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: use async I/O for download preparation and resume
Use Tokio filesystem APIs for download setup and resume metadata checks. Run the Windows link-count query on the blocking pool and flush digest writes before returning.
Signed-off-by: fufesou <linlong1266@gmail.com>
---------
Signed-off-by: fufesou <linlong1266@gmail.com>
* Update pt_PT.rs
* Add files via upload
* Update README-PTPT.md
* Update README-PTPT.md
* Update README.md to include new pt-PT (docs/README-PTPT.md)
* Update docs/README-PTPT.md
Corrected link libs/base
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Update docs/README-PTPT.md
Corrected "área de trabalho" to "área de transferência"
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Update pt_PT.rs
Fix api_server_connection_tip and api_server_empty_tip: translate from en.rs source
* Fix relative links in README-PTPT.md (remove extra docs/ prefix)
* Fix section anchors in README-PTPT.md to match PT-PT headings
* Fix typos and gender agreement in README-PTPT.md disclaimer
* Use European Portuguese terms in README-PTPT.md screenshot alt text
* Translate shortcut instructions from en.rs source
* Update pt_PT.rs
Align shortcut and API server strings with en.rs source (keep {} placeholders)
* Revert JumpLink to original value (out of scope for this PR
* Replace remaining Brazilian Portuguese terms in README-PTPT.md
Replaces leftover Brazilian Portuguese wording with European Portuguese
equivalents (e.g. "conosco" -> "connosco", "controle" -> "controlo",
"conexão" -> "ligação", "Você tem" -> "Tem", "amigável" -> "acessível",
"desktop" -> "ambiente de trabalho"), consistent with the terminology
already used in src/lang/pt_PT.rs.
---------
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
webpki-roots and webpki-root-certs 1.0.10 drop emSign ECC Root CA - G3, whose
eMudhra intermediates had their private keys compromised. rustls-webpki
0.103.16 rejects chains through those intermediates (RUSTSEC-2026-0382,
RUSTSEC-2026-0383); it needs rustls-pki-types >= 1.12.
Signed-off-by: Shaan Majid <70789625+shaanmajid@users.noreply.github.com>
* fix: warn about insecure custom API server connections
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: limit API server warning to HTTP addresses
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: resolve API warnings against effective server configuration
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: reuse common sync for API server previews
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: keep server settings usable on API preview errors
Signed-off-by: fufesou <linlong1266@gmail.com>
---------
Signed-off-by: fufesou <linlong1266@gmail.com>
With the API server field empty, get_api_server_ builds the URL from the
ID server as "http://{host}:21114". For an ID server entered as a bare
IPv6 address such as 2001:db8::1, which test_if_valid_server accepts,
increase_port leaves it unchanged and the result is
http://2001:db8::1:21114. That does not parse as a URL (InvalidPort), so
login and every other API request fail.
Wrap the address in brackets in that branch only. Hostnames, IPv4 and
"[addr]:port" take the same path as before.
DisplayIter::next_screen built the monitor iterator from the
xcb_randr_get_monitors reply and freed the reply on the next line.
The iterator's data pointer points into that reply, so next() read
every monitor's name atom, position and size from freed memory, and
xcb_randr_monitor_info_next() walked it too.
Keep the reply with the iterator and free it when moving to the next
screen or when the DisplayIter is dropped.
* Forward audio latency environment to Linux user server
Preserve PULSE_LATENCY_MSEC and PIPEWIRE_LATENCY when the root service spawns the per-user RustDesk server.
The systemd service defines these variables, but they were not included in the explicit environment passed to run_as_user(), causing the user server and connection manager to fall back to higher audio latency.
Forward the existing values without changing their defaults.
* Add regression test for Linux audio latency forwarding
---------
Co-authored-by: chg <chg@vis-ag.ch>
* Add Flutter code section to README-ID
Added a section for Flutter code related to desktop and mobile platforms.
* Fix link formatting for Flutter code section
* fix(video): re-encode static frames for up to 10 seconds to improve clarity
Signed-off-by: 21pages <sunboeasy@gmail.com>
fix(video): limit static re-encoding to 300 frames instead of 10 seconds
Signed-off-by: 21pages <sunboeasy@gmail.com>
refactor(video): move static frame refresh into a dedicated module
Signed-off-by: 21pages <sunboeasy@gmail.com>
fix(video): preserve stuck-encoder detection state across static repeats
test(video): cover cached texture lifetime across capture restarts
fix(video): reduce static re-encoding limit to 100 frames
fix(qos): lower qos_trace logging to trace level
Signed-off-by: 21pages <sunboeasy@gmail.com>
fix(video): skip static frame re-encoding for AV1
perf(video): reuse VRAM encoder input for static refresh
Remove the DXGI repeat texture cache and use hwcodec's repeat entry point to avoid copying each captured frame. Isolate static refresh failures, pause after three errors, and resume after a real frame is sent successfully.
Cover cached input ownership, repeat failure recovery, refresh limits, and normal encoder failover with regression tests.
fix(vram): ignore cached SDK codec backends
chore(deps): temporarily use hwcodec re-encode branch
perf(video): wait 200ms before starting static refresh
chore(deps): update hwcodec for FFI exception handling
chore(deps): update hwcodec to 0.8.0
perf(video): start static refresh after 100ms
chore(deps): update hwcodec for exception-safe cleanup
chore(deps): update hwcodec for device-loss handling and noexcept FFI
chore(deps): update hwcodec to bbfc306
chore(qos): remove verbose diagnostics while retaining trace logs
* update hwcodec
Signed-off-by: 21pages <sunboeasy@gmail.com>
* refactor(scrap): keep repeat encoding in the vram module
* perf(vram): avoid intermediate frame vectors
- Drain normal and repeated encode output into protobuf messages.
- Cover null-texture encoding failures.
- Clarify the count-based static refresh budget.
- Update hwcodec to fix RAM decode buffers on resolution changes.
Signed-off-by: 21pages <sunboeasy@gmail.com>
* fix(scrap): preserve hardware encoder error codes
* test(video): remove uptime dependency from static refresh tests
* feat(video): configure static repeat limits by codec and quality
* fix(video): exempt VPx and AV1 from static repeat failure limit
* fix(video): count only successful static repeat frames
* fix(video): refine static repeat scheduling and VPx frame handling
Allow static refinement after a VP8/VP9 captured frame produces no output
without enabling it after a genuine encoding error. Carry this distinction
alongside the send result so the latest cached frame can still be sent when
capture becomes idle.
Keep VP8/VP9 repeats at a minimum of 100ms. Other codecs wait at least 100ms
initially, then follow the QoS frame interval aligned with the capture loop.
Use four quality bands, with VP8/VP9 limits of 30/20/20/0 and the tuned
H264/H265 limits. Include only production behavior and regression tests.
Validation: 16 static_refresh tests passed with hwcodec,vram,flutter enabled,
covering latest-frame recovery, genuine errors, timing, and repeat budgets.
* fix(video): tune static repeat limits by codec and backend
Use the measured obvious-improvement checkpoints for VP8/VP9 and separate
NVENC, QSV, and AMF H.264/HEVC limits for each quality tier. The checkpoints
recover 80% of the observed error improvement across the tested inputs.
Resolve the hardware backend from EncoderCfg during StaticRefresh
construction, including the VRAM adapter vendor. Keep the existing limits
for other hardware backends.
Validation: 19 static_refresh tests passed with hwcodec,vram,flutter.
The repeat measurements cover 192 series with no encode/decode errors.
* fix(video): refine static refresh budgets and cap repeat FPS
Add VideoToolbox HEVC budgets and tune quality bands from repeat-frame comparisons. Cap static refresh at 30 FPS and use the speed preset consistently at quality 0.5.
* remove unused variables
Signed-off-by: 21pages <sunboeasy@gmail.com>
* fix(video): repair static refresh tests and throttle repeat logs
---------
Signed-off-by: 21pages <sunboeasy@gmail.com>
Both legs of race_transports_prefer_webrtc send their own punch request
to the same rendezvous server for the same peer, so a refusal there
(offline, unknown ID, key mismatch, a server-supplied other_failure)
fails both with the same text. Joining them as "WebRTC failed: X;
fallback failed: X" showed it twice and broke the UI's whole-string
matching: the offline auto-retry needs exactly "Remote desktop is
offline", the message box translates the text as one string, and
check_if_retry hides the retry button for any text containing "failed".
Return the error of the leg that failed last, as select_ok did before
the race existed, and log the other one once.
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(windows): move installer scripts into protected temp directories
Create a private directory under Windows Temp with its final DACL in
CreateDirectoryW. Grant Administrators and SYSTEM full access and use
OWNER RIGHTS to suppress the ordinary creator's implicit WRITE_DAC.
Keep the existing elevated system-cmd copy and SHA-256 verification flow.
Keep auxiliary files in the same directory, report cleanup failures, and
check command length before creating the directory.
This avoids PowerShell, helper executables, and application startup or DLL
linking changes. The Windows Temp parent must retain its standard protection
against deletion by unprivileged users. UAC cancellation can leave an empty
protected directory; the error reports its path.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): preserve installer results when cleanup fails
Keep the original installer exit code and report remaining temporary directories or inspection errors as warnings with their paths. Include the directory path in creation errors.
Restore the existing handoff assertions in a separate test module, add a locked-directory regression for successful and failed installers, and remove the unrelated ERRORLEVEL environment change.
Validation: scoped formatting and whitespace checks passed. Native cmd probes reproduced the failure before the fix and preserved both exit codes afterwards. No project build or Rust test execution was performed.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): clarify installer cleanup warnings
Describe protected directories as possibly remaining when cleanup cannot be verified. Remove the cleanup-only test added during review while retaining existing handoff coverage.
Signed-off-by: fufesou <linlong1266@gmail.com>
* test(windows): keep installer handoff tests inline
Restore the inline test module and original helper order to reduce the diff against master. Keep the directory cleanup assertions and original bootstrap checks.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): include paths in installer directory check errors
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): clear inherited ERRORLEVEL before installation
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): avoid duplicate directory error messages
Signed-off-by: fufesou <linlong1266@gmail.com>
* test(windows): verify installer directory permissions
Signed-off-by: fufesou <linlong1266@gmail.com>
---------
Signed-off-by: fufesou <linlong1266@gmail.com>
On Linux, GTK destroys the window on a close request unless prevent-close
is on. When the main window is the last active one, onActiveWindowChanged()
turns prevent-close off and calls close(), yet onWindowClose() still went
on to hide() the destroyed window, and the close event that close() emits
re-entered onWindowClose() to save the frame through isMaximized(). The cm
and install windows never turn prevent-close on, so their window is always
gone by the time onWindowClose() runs.
With window_manager before cf4aef05 those calls segfaulted in
gtk_window_is_maximized; since then they fail with an unhandled
PlatformException(window_destroyed). Return early in both places instead.
Other platforms and sub windows keep the old path.
Fixes#16512
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(fdroid): generate the bridge with the Flutter version bridge.yml uses
#15139 moved the bridge Flutter version from bridge.yml's env into its
job matrix, so build_fdroid.sh read `.env.FLUTTER_VERSION` as "null".
The F-Droid recipe worked around that by pinning it to 3.24.5, which
equals ANDROID_FLUTTER_VERSION, and the script only generated the bridge
when the two versions differed, so the build failed on the missing
src/bridge_generated.rs.
Read the version from the default bridge-artifact matrix entry (3.22.3),
and always generate the bridge: the build needs it whether or not the
two Flutter versions match.
Fixes#16549
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF
* fix(fdroid): keep the recipe's version sed from overriding the bridge Flutter
The F-Droid recipe works around the old "null" read with
`sed 's/${FLUTTER_BRIDGE_VERSION}/<version>/'`, and its auto-update
copies that line into every new version. The 1.5.0 recipe pinned 3.24.5
and then 3.47.7, but flutter_rust_bridge codegen only works with the
Flutter version bridge.yml uses (3.22.3). Pass the unbraced variable to
prepare_flutter so that sed no longer matches the call.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF
* fix(fdroid): raise the Gradle heap for the AGP 8 build
#15603 moved the Android build to Gradle 8.11.1 / AGP 8.10.1 with
compileSdk 36 and desugaring. The first F-Droid 1.5.0 build got past the
bridge and the Rust library, then failed in assembleRelease with "Gradle
build daemon has been stopped: since the JVM garbage collector is
thrashing", because gradle.properties still caps the heap at 1 GiB. CI
has long raised it to 2g; do the same here. A recipe that already
rewrites the -Xmx1024M setting keeps its own value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P1grQ39ByRWPUtTBdTzEBF
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
get_custom_server_from_string located "host=" in s.to_lowercase() and
sliced s with that byte index. Lowercasing can change a character's byte
length ("İ" is 2 bytes, "i̇" is 3), and on Windows the string is the full
exe path, so a profile such as C:\Users\İsmail shifted the slice past the
"h" and host came back empty. The client then fell back to the default
rendezvous server.
"host=" is ASCII, so search s.to_ascii_lowercase(), which keeps byte
offsets.
* feat: add opt-in WebSocket proxy support
Add a WebSocket proxy option to the proxy dialog and custom client settings.
Keep WebSocket connections direct by default and use the configured proxy
without direct fallback when enabled.
Preserve relay targets regardless of the proxy address family and restart
connections when the option changes. Update hbb_common for proxy support.
Signed-off-by: 21pages <sunboeasy@gmail.com>
* update hbb_common
Signed-off-by: 21pages <sunboeasy@gmail.com>
* fix: remove WebSocket proxy opt-in
* chore: restore proxy settings UI and translations
* fix: update hbb_common for proxy read progress
* fix: update hbb_common proxy connections and IPv6 parsing
* fix: update hbb_common WebSocket local address
* update to rustdesk/hbb_common
Signed-off-by: 21pages <sunboeasy@gmail.com>
---------
Signed-off-by: 21pages <sunboeasy@gmail.com>
* ci: run every Dart test, not three files
The step ran only the three cursor test files, so the other nine files
under flutter/test (terminal, file model, autocomplete, ...) never ran
on any pull request. With no path the runner takes the whole directory.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ49AbZJYfm8NTp5yDPMab
* ci: run the Rust tests CI could not reach
cargo test --workspace runs with the default features on x86_64 Linux
only, so the tests behind `windows`, `not(target_os = "linux")`,
`unix-file-copy-paste` and drmtap_dl's `tests` module never ran: the
platform, portable-service and audio tests, the clipboard crate's file
copy-paste and Windows file-name tests, and the drmtap loader's.
The macOS and Windows build jobs now run `cargo test --lib` after the
build with the build's own feature set, plus the clipboard crate. The
Linux job's list of named test runs gains drmtap_dl and the clipboard
feature. AGENTS.md says where tests go and what CI runs.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ49AbZJYfm8NTp5yDPMab
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
* ci: drop the skips for tests that no longer exist
#16539 removed test_get_cursor_pos and test_get_key_state, the only
tests these skips matched.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(wayland): a pending portal request no longer stalls the server
The screencast portal waits for the user while its picker is open, up to
three minutes. check_init waited under the CAP_DISPLAY_INFO write lock on
a tokio worker and get_capturables under RDP_SESSION_INFO. Every desktop
login read the display state on a worker behind them, and the session
close when the last connection went waited for the slot on a worker too.
With the server on 4 cpus a second login was enough: new connections
were accepted by the kernel and not served until the request ended
(#15973).
The locks keep their role: the write lock still serializes inits and
orders them with clear(), and the slot still orders the session close
calls after a pending request. What changes is where the waiting happens.
The part of check_init under the write lock moves, as is, to
init_displays(), run in spawn_blocking. is_inited and the first look in
check_init use try_read; when a writer holds the lock, is_inited answers
not inited yet and check_init redoes its look in spawn_blocking, then
goes on as before. get_displays_and_primary takes its read guard in
spawn_blocking, is_rdp_session_hold uses try_lock, close_session from the
ipc listener runs in spawn_blocking, and try_close_session from
AuthedConnID::drop on its own thread.
* fix(wayland): throttle the log when the session close thread cannot start
A peer can drop connections at any rate, so the error logged when
AuthedConnID::drop cannot spawn the thread for try_close_session goes
through throttled_log!, once a minute, like the auto-login logs of this
file (greptile on #16542).
* fix(wayland): count the remote connections again in the close thread
The session close moved to its own thread in this pr, so a remote that
comes in after the count and before the thread runs could have the
session it reuses closed under it. The thread counts the remote
connections again right before try_close_session, which brings the
window back to the one the close had on the dropping thread (coderabbit
on #16542).
* fix(wayland): one portal session close at a time, for remote and camera connections only
The close that AuthedConnID::drop runs off the dropping thread spawned one
OS thread per drop that left no remote connection, whatever the connection
type, and while a portal request waits for the user each of those threads
waited for the session slot. Now only a remote or view camera connection
leaving asks for the close (their video service is the one that opens the
portal session), no thread starts when the slot is free and empty (drm,
x11, nothing left to close), and one close runs at a time: a close asked
while one runs is left to it. The logic moves to wayland.rs; connection.rs
keeps a hook.
* test: remove tests that do not pin user-visible behavior
Apply the AGENTS.md test rules to the existing Rust and Flutter suites.
A test is kept when it is the only coverage of user- or API-visible
behavior, the regression test of a reported or fixed bug, a security
boundary (one test per rejection class), or a check against an external
reference. Tests that assert private state or the order of internal
steps, pin review-round corner cases, or repeat what a kept test already
covers are removed.
Rust: 679 -> 298 tests. Dart: 118 -> 45 tests.
Test-only helpers left without callers go with them
(applyLastOnlineStateForTesting, terminalKeyboardRowWidth,
debugBufferedInputCount, tokio's test-util dev feature), and cfg gates
and visibility that existed only for the deleted tests are narrowed.
Runtime behavior is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
* test: keep tests that pin security and user-visible behavior
Restore six tests that review showed are the only coverage of their
behavior:
- update metadata rejects an artifact file name with path components;
- ICE candidates from another session are dropped;
- KCP delivers every multi-segment frame queued before a close;
- set_files rejects an empty name in a multi-file transfer;
- a lopsided elongated cursor keeps its centre hotspot (#16242);
- toggling Show hidden during a pending same-path read issues a new read.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
* test: keep offline update and key-exchange downgrade rejections
Restore three tests that are the only coverage of their rejection class:
- offline update metadata rejects a signed artifact with an http or
credential-bearing URL;
- offline verification rejects a renamed local file and a version that
does not match the release;
- a key-exchange pick lowered in transit leaves both sides unable to
decrypt, so a v0 fallback after a failed v1 decrypt cannot pass
unnoticed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
* test: keep the decomposed-grapheme and reconnect-cancel tests
Each catches a plausible wrong change that passes every kept test:
mapping the first scalar under a locked Ctrl turns é into \x05,
and a reconnect that does not fail pending reads leaves them hanging
until the 30 s timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(terminal): trim the replay buffer when output has no newline
OutputBuffer::append returned early when the last line was incomplete
and the new chunk had no newline, so the trim loop never ran. A program
that writes without newlines (a minified file through cat, a \r
progress bar) grew the replay buffer past MAX_OUTPUT_BUFFER_SIZE
without bound, one 4 KiB PTY read at a time, until a newline arrived.
Signed-off-by: leoca <leo.camus23@gmail.com>
* fix(terminal): keep recent output when trimming a line without newline
Trimming popped the whole incomplete line once it passed
MAX_OUTPUT_BUFFER_SIZE, so the reconnect replay could come back empty.
Newline-free output now goes into a new chunk once the incomplete one
holds DEFAULT_RECONNECT_BUFFER_BYTES, and trimming drops the oldest
chunks while the newest bytes stay. The test checks get_recent.
Signed-off-by: leoca <leo.camus23@gmail.com>
* fix(terminal): trim an oversized incomplete line to its newest half
Splitting the incomplete line into chunks made get_recent return whole
chunks only, so a reconnect could replay as little as the newest read.
Keep one line and, when it alone is over MAX_OUTPUT_BUFFER_SIZE, drop
its oldest bytes down to half the cap. The copy then happens once per
half buffer instead of on every append, and the replay keeps the
newest DEFAULT_RECONNECT_BUFFER_BYTES.
Signed-off-by: leoca <leo.camus23@gmail.com>
---------
Signed-off-by: leoca <leo.camus23@gmail.com>
* fix(drm): pace the producer to the rate the encoder takes, with the panel refresh as floor
The root producer slept a fixed 33 ms after every grab, so every DRM stream topped
out at 30 fps whatever the client asked (rustdesk#16175). Measured on a
1920x1080@60 i915 box with the client at Custom 60 and QoS settled at 60: 30
grabs, 30 converted, 29.8 sent. A shorter fixed interval reaches the rate but
oversamples: at 8 ms the same box grabbed and converted 117/s for 60 sent.
The consumer now tells the producer the rate it encodes at, in the ack byte it
already sends per converted frame: 0x01 as before, or 0x80|fps. Every producer
counts ack bytes and never read their value, so an older service sees exactly
the same credit and keeps its 33 ms; the JSON handshake and the ack count and
timing do not change. The rate is the encoder's spf (what frame() is called
with), lowered to what the encoder achieves when it is busy longer than spf per
frame: the time from one frame() call to the next, less what the call spent
waiting for a frame, so a late producer cannot talk its own demand down.
The producer replaces the post-work sleep with a deadline: the encoder's period
above 30 fps, the old 33 ms from 30 down to 15, and half the encoder's period
below 15, never faster than the panel (the exact CRTC refresh from libdrmtap
0.5.9's drmtap_crtc_refresh, re-read once a second; with an older library the
whole-hertz refresh the enumeration already read, so no extra connector probe).
The worker still wakes at least every 33 ms, because each tick also reads the
cursor and a slow frame rate must not slow the cursor down. Without a demand (an
older consumer, or before the first frame() call) the old 33 ms sleep stays.
MAX_STALLED and the WouldBlock retry keep their 5 s budget, pinned by a const
assertion.
Tests: the ack byte round trip and that it is one byte on the wire, the drain
(seeded byte streams: every byte one credit, the newest demand wins), the pacing
interval table (panel floor, below 30 and below 15, a 23.976 Hz panel), the panel
period rounded up, the deadline and its overrun, the wake that keeps the cursor
at 33 ms, the demand from spf and from a busy encoder, the busy time without the
wait (pure and through frame()), the demand log once per connection, the
whole-hertz fallback, and the reader's refresh answer. Each rule has a mutation
that turns its test red.
* ci: run the drm pacing tests in the drm step
drm_pacing_tests (src/ipc/drm.rs) and crtc_refresh_tests (libs/scrap
drm_reader.rs) match none of the existing filters.
* test(drm): keep three tests, on outputs and not on internal state
Per AGENTS.md (Tests), keep one to three tests, on outputs and not on internal
state: the demand ack as it goes on the wire, the producer interval for a
demand and a panel, and the exact refresh the reader returns.
* test(drm): the ack test goes through the producer drain
Per review: send_frame_ack(60) read back through drain_frame_acks gives one
credit and a demand of 60, so dropping the demand read in the producer turns
the test red. The interval test also pins drm_panel_period(148352, 2475) to
16_683_294 ns.
* fix(drm): time the encoder only after a frame() call that returned a frame
Since #16450 frame() drops a repeat as WouldBlock. The time after such a
call is video_service sleeping out its spf, and after a timeout it is
about zero once the wait is subtracted. Neither follows an encode, so
neither is a sample of the encoder pace now. Uses returned_at from #16450;
no new state.
* fix(drm): ask for the old 33 ms tick while the screen is still
Since #16450 a still screen is grabbed at the demand and dropped in
frame(), twice as often as master at 60. After 100 ms without a new
frame the demand is capped at 30, the old producer tick, and the next
new frame lifts it. 100 ms is three of those ticks, so a producer paced
at 30 in motion never reads as still. Uses returned_at; no new state.
* test(drm): a dropped repeat or timeout is no encoder time; a still screen asks for the old tick
Per review: the demand frame() reports stays with a 50 ms encoder through
a still screen of repeats and timeouts, and a still screen asks for 30
after STILL_AFTER until a new frame brings back 60.
* fix(drm): start the encoder average over when the rate goes up
Per review: the samples hold the sleep video_service paces itself with, so
after a rate increase (custom fps 1 -> 60, or QoS recovering) an average
taken at the old rate kept the demand low and the producer slow. A
shorter spf than the last now starts the average over and drops the
sample that spans the change. The demand is computed in one method that
takes its time as input, the still cap included.
* test(drm): drop the two pacing tests of the last round
Per review: they read shared.demand_fps and slept for real. The three
tests stay.
* build: pin libdrmtap 0.5.12 (rustdesk-org/libdrmtap 5936a7a88)
The panel floor of the pacing reads drmtap_crtc_refresh(), added in
libdrmtap 0.5.9. The mirror carries v0.5.12 since 2026-10-13, so the pin
moves there.
The rest of the range from 0.5.8 changes no struct in drmtap.h: 0.5.10
reads its environment through secure_getenv and loads no GL in a setuid,
setgid or file-capability process, which rustdesk does not run; 0.5.11
makes drmtap_deswizzle, also the CPU fallback of a tiled grab, refuse a
destination stride narrower than its rows instead of writing past it,
and exports drmtap_frame_owns_data, unused here; 0.5.12 changes only
docs and the version.
21pages