Add Without password actions and pass the selection through desktop,
mobile and Web sessions. Omit the password when constructing LoginRequest,
preserve saved credentials, and reuse the existing approval and OS login
dialogs. Keep protocol and controlled-side authentication changes separate.
* test: remove tests that do not pin user-visible behavior
Apply the AGENTS.md test rules to the existing Rust and Flutter suites.
A test is kept when it is the only coverage of user- or API-visible
behavior, the regression test of a reported or fixed bug, a security
boundary (one test per rejection class), or a check against an external
reference. Tests that assert private state or the order of internal
steps, pin review-round corner cases, or repeat what a kept test already
covers are removed.
Rust: 679 -> 298 tests. Dart: 118 -> 45 tests.
Test-only helpers left without callers go with them
(applyLastOnlineStateForTesting, terminalKeyboardRowWidth,
debugBufferedInputCount, tokio's test-util dev feature), and cfg gates
and visibility that existed only for the deleted tests are narrowed.
Runtime behavior is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
* test: keep tests that pin security and user-visible behavior
Restore six tests that review showed are the only coverage of their
behavior:
- update metadata rejects an artifact file name with path components;
- ICE candidates from another session are dropped;
- KCP delivers every multi-segment frame queued before a close;
- set_files rejects an empty name in a multi-file transfer;
- a lopsided elongated cursor keeps its centre hotspot (#16242);
- toggling Show hidden during a pending same-path read issues a new read.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
* test: keep offline update and key-exchange downgrade rejections
Restore three tests that are the only coverage of their rejection class:
- offline update metadata rejects a signed artifact with an http or
credential-bearing URL;
- offline verification rejects a renamed local file and a version that
does not match the release;
- a key-exchange pick lowered in transit leaves both sides unable to
decrypt, so a v0 fallback after a failed v1 decrypt cannot pass
unnoticed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
* test: keep the decomposed-grapheme and reconnect-cancel tests
Each catches a plausible wrong change that passes every kept test:
mapping the first scalar under a locked Ctrl turns é into \x05,
and a reconnect that does not fail pending reads leaves them hanging
until the 30 s timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(update): verify signed update metadata
* fix(update): harden metadata publishing and app names
- share strict app-name validation across Windows and macOS
- preserve published sidecars until replacements are ready
- select macOS test features by target architecture
- update the signing dependency and URL validation coverage
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): prevent replacing published release assets
- block reruns after signed update metadata is published
- clarify the security rationale for app-name validation
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): cache TLS responses and avoid double translations
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact: reduce the diffs
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): remove obsolete update paths
- remove unused FFI update branches
- delete legacy Windows and macOS update helpers
- simplify macOS daemon updates and redundant gating
Signed-off-by: fufesou <linlong1266@gmail.com>
* feat(update): secure same-identity macOS offline updates
- verify DMGs using signed metadata, size, and SHA-256
- enforce package and bundle identity plus macOS signature checks
- support custom release policies and propagate manual update failures
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): verify Windows installers with Authenticode
Reject unsigned or untrusted EXE/MSI updates
before elevation, clean up failed verified copies,
and fix the macOS manual updater logging import.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): clear stale URL on response body errors
Keep body-read failures in the common cleanup path and document the
cache-only Authenticode verification policy.
Signed-off-by: fufesou <linlong1266@gmail.com>
* refactor(update): remove OS signature sanity checks
Remove Windows Authenticode and macOS codesign/Gatekeeper verification.
Keep metadata, artifact integrity, bundle identity, and transaction checks.
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): move update scripts into res/update
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): secure Windows MSI handoff against junction races
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): secure Windows EXE handoff against junction races
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): preserve legacy custom client app names
- allow names starting with digits or underscores
- preserve leading hyphens on Windows for compatibility
- reject leading hyphens on macOS to avoid pgrep option parsing
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): remove some simple wrappers
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): simple refactor
* refact(update): comments on update.scpt
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): comments
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): create download destinations exclusively
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): roll back updates when final readiness checks fail
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(msi): propagate MSI installation failures
Signed-off-by: fufesou <linlong1266@gmail.com>
* chore
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): reject stale IPC sockets during updates
Require open IPC sockets in addition to launchd running state before committing the privileged update transaction. Inspect sockets with lsof to avoid triggering IPC authentication.
Add native socket regression coverage to macOS CI. Remove the unused Windows helper, combine offline metadata exports, and restore unrelated formatting changed by the PR.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): allow offline updates without an installed bundle
Validate app-only updates against the running client's bundle identifier and check the destination identity when it exists. Replace source-text assertions with behavioral identity tests and run the macOS update tests in CI.
Signed-off-by: fufesou <linlong1266@gmail.com>
* ci, gate test with PUBLISH_UPDATE_METADATA == 'true'
Signed-off-by: fufesou <linlong1266@gmail.com>
---------
Signed-off-by: fufesou <linlong1266@gmail.com>
* add the base crate and repoint the moved modules at it
`libs/base` (crate `base`) takes the parts of hbb_common that only this app
uses: `fs`, `platform`, `keyboard`, `message.proto`, and 145 of the 177
`config::keys` constants. hbb_common keeps what the server names, and the 32
keys it reads itself are re-exported from `base::config::keys` so call sites
still see the full set through one path.
Sources move verbatim. The only edits inside them are `crate::` prefixes that
now have to say `hbb_common::`; `keyboard.rs` and `platform/windows.rs` are
byte-identical. The crate stays on edition 2018, the edition the moved code was
written under. `log`, `lazy_static` and `anyhow` become direct dependencies so
the bare paths in that code resolve exactly as before, and its winapi features
are spelled out rather than left to feature unification.
Two call sites outside Rust and Cargo had to follow the move: the Android
protobuf source dir, which still pointed at hbb_common/protos for message.proto,
and the three AGENTS.md entries that named hbb_common for options, protos and
file transfer.
`scrap`'s `drm` feature now forwards to `base/wayland_probe`. Left pointing at
hbb_common it would still have compiled, silently dropping the Wayland
socket-probe fallback, so that forward is verified by a build with and without
the feature.
`config::keys` carries a test asserting its names stay disjoint from the ones
hbb_common kept: the glob re-export and the local constants share a namespace,
and Rust prefers the local item silently, so a name added to both sides would
otherwise let client and server disagree with no diagnostic.
Verified: macOS and Linux, debug and release, `--all-targets`; the 177 key
constants diffed name-for-name and value-for-value; the generated protobuf types
compared before and after; every `#[cfg]` gate on a moved import checked against
its original; and every file that was `rustfmt`-clean before this change still
is, compared against master file by file. Windows is checked by inspection only
-- it cannot be compiled here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ49AbZJYfm8NTp5yDPMab
* one `use` per crate, and write the rule down
`fs.rs` came out of the move with two ungated `use hbb_common::` statements,
because the original single `use crate::{...}` had to give up `message_proto`
to the new crate and the rest was left in a second block. Fold it back into one.
A scan of the whole tree for the same shape finds nothing else: every other file
with more than one top-level `use base::` or `use hbb_common::` is split by a
`#[cfg]` that does not cover the whole block, or by `pub use` next to `use`.
Those are the cases that cannot merge, so AGENTS.md now states both the rule and
the exemption.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ49AbZJYfm8NTp5yDPMab
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
`rustdesk --deploy --id ""` (e.g. an unset variable in a deployment
script) deploys a blank id, then wipes the local id and unconfirms the
key through the IPC config write. The Android deploy flow already guards
an empty id (#15146); apply the same guard to the CLI, and reject an
empty id at the IPC write boundary the same way the read path was fixed
in #15626.
* Fix disabled installation bypass
Prevent install.exe and --install from opening the install flow when disable-installation is set.
Signed-off-by: 21pages <sunboeasy@gmail.com>
* Refine disabled installation handling for portable clients
Document why --install must be filtered from both Rust and Flutter runner arguments for portable wrappers such as no-install.exe. Remove redundant UI-
layer installation checks because the install entry points are already gated upstream.
---------
Signed-off-by: 21pages <sunboeasy@gmail.com>
* --deploy, reuse the device token
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix review
* no id validation in deploy, so to keep the same behavior in udp register
pk
* Fix collapsed toolbar drag preview sizing
* Revert "Fix collapsed toolbar drag preview sizing"
This reverts commit 66e39abb74.
* remove too many logs
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1. `TERM` on linux terminal.
2. `htop` command not found on macOS.
3. `vim` and `claude code cli` hung up on windows.
Signed-off-by: fufesou <linlong1266@gmail.com>
Prevent --password, --set-id, and --option command line arguments
from modifying settings when is_disable_settings() returns true.
Signed-off-by: 21pages <sunboeasy@gmail.com>
1. Rename `Group` tab to `Accessible devices`
2. Add accessible device groups at the top of search list
3. option `preset-device-group-name` and command line `--assign --device_group_name`
Signed-off-by: 21pages <sunboeasy@gmail.com>
* Fix https://github.com/rustdesk/rustdesk/issues/9286, replace pkexec
with gtk sudo. Tested on gnome (ubuntu 22.04, debian 13), xfce (manjaro, suse), kde (kubuntu 23), lxqt (lubuntu 22), Cinnamon (mint 21.3), Mate (mint 21.2)
* Fix incorrect config of the main window opened by the tray, replace
xdg-open with run_me, replace with dbus + run_me
* Fix `check_if_stop_service`, it causes the problem fixed in
https://github.com/rustdesk/rustdesk/pull/8414, now revert that fix and fix itself.
Signed-off-by: 21pages <sunboeasy@gmail.com>
21pages