* fix: secure trusted devices with host-issued V2 tokens
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: preserve trusted-device management and ordinary authentication
Restore selected-device deletion using nonsecret record identifiers and acknowledged V2 revocation errors.
Preserve password and TOTP authentication when the V2 authority or cached controller credentials are unavailable. Disable V2 for the affected attempt while retaining authentication, configuration, and revocation rejection.
Validation: 20 selected Rust tests, Flutter-feature Rust compilation, focused Dart analysis, formatting, and whitespace checks passed.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: simplify trusted-device caching and stabilize tests
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: persist trusted-device grants in host configuration
Store host grants in RustDesk2.toml and preserve revocation across configuration writes and service transitions. Use local authority on macOS when no background service is installed.
Preserve both configuration imports by checking Config2 eligibility before revocation writes. Cover the password and 2FA import regression alongside the existing trusted-device tests.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: store trusted-device credentials in peer configuration
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: minimize trusted-device persistence changes
Signed-off-by: fufesou <linlong1266@gmail.com>
* refactor: minimize trusted-device integration changes
Keep ordinary policy writes on the generic configuration path and document authentication updates. Restore the macOS installer to master, rename the V2 version gate, and relocate the existing client regression test.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: harden trusted-device revocation and persistence
Recover corrupt grant data without skipping authentication-write validation, and avoid revoking trust when IPC synchronizes an unchanged salt. Make desktop management IPC async and keep runtime creation at the Flutter worker boundary.
Update hbb_common to preserve V2 credentials when configuration reads fail, and extend existing regressions for clear, salt synchronization, and persistence failures.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: preserve trusted-device validation and no-op settings
Validate trust before connection side effects and retain tickets for the final check when the authority is unavailable after TOTP. Disable enrollment on that path.
Skip revocation for password operations that the existing setter treats as no-ops, extend the existing IPC regression, and clean up client state on initialization or credential errors.
Validation: 36 targeted native tests, Flutter-feature Rust check, formatting, and git diff --check passed.
Signed-off-by: fufesou <linlong1266@gmail.com>
* feat: add trusted-device expiry and per-device renewal
Keep legacy records for password-and-TOTP migration, encrypt host grant storage, and add configurable trust periods that revoke grants when changed. Allow renewing individual unexpired devices from the manager, hide renewal for never-expiring grants, and preserve the mobile table height constraints.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): report trusted-device cleanup failure before uninstall
Revoke local trusted-device grants before dispatching the uninstall closure so cleanup failures return false without starting the uninstall script. Keep the existing synchronous and asynchronous script execution paths.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: preserve trusted-device settings and revoke macOS service grants
Default unsupported expiration values on read while keeping explicit edits strict. Allow password/TOTP when stored grants are out of sync, after validating the authentication scope.
Revoke root-owned grants during macOS service removal. Bump hbb_common for malformed-file recovery and legacy-record preservation, and retain the reviewed regression coverage.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: avoid duplicate trusted-device revocation during config sync
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: preserve trusted-device revocation during config mismatches
Allow grant clearing when authentication snapshots are unavailable and validate existing snapshots before applying authentication updates. Restore optimistic caching for non-auth bulk options and restrict the trusted-device IPC helper to desktop targets.
Signed-off-by: fufesou <linlong1266@gmail.com>
* feat: preserve trusted devices when trust duration changes
Adjust existing grant deadlines for duration changes and startup policy overrides, support 90 days, and use an adaptive inline duration selector without the obsolete revocation warning.
Consolidate management IPC and trim redundant tests while retaining authentication and revocation coverage.
Validation: four existing focused Rust tests and the startup override reproduction passed; Windows default/service and Flutter-feature cargo checks passed.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: finish trusted-device notice cleanup and duration sync
Remove the recurring legacy notice, unused response metadata and translation key. Allow duration-only saves with a readable inactive grant scope while preserving storage and authentication errors.
Update hbb_common to 040bf3f662ae7422f2f9570701cc8451f7bb1d59, which removes the unused legacy detector.
Validation: four existing focused Rust tests passed; Windows default/service and Flutter-feature cargo checks passed. No new tests were added.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: refine trusted-device duration layout
Indent the duration row beneath the trusted-device option, add vertical spacing, and compact the desktop selector. Mobile sizing and other dropdowns remain unchanged.
Validation: targeted Dart analysis passed with existing informational diagnostics. Actual window rendering was not exercised.
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact: adjust indentation
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: preserve trusted devices across version upgrades
Honor existing legacy trust without creating new legacy registrations. Import live records into encrypted grants, apply the current expiration policy, and migrate consenting controllers to V2 tokens while retaining grouped revocation.
Advertise V2 capability explicitly and hide enrollment for mixed-version sessions. Update existing coverage and use the paired hbb_common migration API.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix: translations
Signed-off-by: fufesou <linlong1266@gmail.com>
* Align the compact trusted-device duration selector on mobile
Signed-off-by: fufesou <linlong1266@gmail.com>
* Default trusted devices to 90 days and drop unreleased V2 migrations
Signed-off-by: fufesou <linlong1266@gmail.com>
* Avoid masking macOS daemon stop failures during uninstall
Signed-off-by: fufesou <linlong1266@gmail.com>
* restore uninstall.scpt, do not clear trusted devices on uninstall
Signed-off-by: fufesou <linlong1266@gmail.com>
* Preserve trusted devices when uninstalling services
Signed-off-by: fufesou <linlong1266@gmail.com>
* Preserve trusted devices when importing host configuration
Signed-off-by: fufesou <linlong1266@gmail.com>
* Recover from unreadable trusted-device grants
Log and persistently revoke invalid or undecryptable V2 payloads so password and TOTP can enroll a new device. Keep configuration read and write errors explicit and extend existing tests to cover recovery and rejection of old tokens.
Signed-off-by: fufesou <linlong1266@gmail.com>
* Preserve trusted devices across service transitions
Run grant operations in the accepting server and synchronize current grants and revocations through the existing service configuration channel. Keep ordinary settings saves from restoring stale credentials and retain root peer verification.
Recognize explicit configuration errors as live service responses during IPC probing, so duplicate startup does not remove the active socket.
Validated with five trusted-device tests, seven Linux IPC filesystem tests, an isolated IPC regression probe, and Windows Flutter and Linux compilation checks. Installed-service transitions and macOS runtime behavior remain untested.
Signed-off-by: fufesou <linlong1266@gmail.com>
* Keep trusted-device grants under the service authority
Preserve root-owned grants when copying service configuration and route installed-host trust operations through the root service. Keep local authentication edits available when the Linux service is explicitly stopped, then synchronize pending revocation before using service grants.
Serialize pending revocation synchronization and cover service copies, stale user snapshots, and stopped-service authentication updates with the existing focused tests.
Signed-off-by: fufesou <linlong1266@gmail.com>
* Replace same-ID grants when enrolling trusted devices
Signed-off-by: fufesou <linlong1266@gmail.com>
* Allow macOS security edits after service removal
Reuse pending trusted-device revocation for offline password and 2FA changes. Honor pending revocation during installation copies and before root-authority requests and configuration synchronization.
Validation: five focused macOS tests, macOS and Windows cargo checks, and targeted formatting checks.
Signed-off-by: fufesou <linlong1266@gmail.com>
* Allow macOS security edits before daemon reinstallation
Detect an absent daemon using retained service ownership instead of the incoming-connections stop flag. General Start resumes connections without reinstalling the daemon, so local authentication edits must continue using pending revocation until installation.
Adjust the existing recovery test to check that toggling incoming connections does not make a standalone profile service-owned.
Signed-off-by: fufesou <linlong1266@gmail.com>
* Allow re-enrollment after invalid controller credentials
Ignore malformed or undecryptable stored token payloads with a throttled warning while preserving file access errors and host identity checks. Fresh authorized enrollment can replace the unusable credential.
Restore logged, non-propagating IPC errors for non-authentication option changes and extend the existing credential recovery test.
Signed-off-by: fufesou <linlong1266@gmail.com>
* Update hbb_common to serialize peer deletion
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): preserve trusted devices across service removal
Hand off the current root grant store to the removing user and restore that user's latest grants on reinstallation. Keep other retained profiles from becoming authoritative, and preserve user settings when the service has no optional configuration.
Validate the macOS build, five trusted-device tests, isolated headless transfer cases, and AppleScript syntax. Real privileged service transitions remain untested.
Signed-off-by: fufesou <linlong1266@gmail.com>
* refactor(trusted-devices): use local grants and existing config sync
Keep grant decisions in the accepting host process and transfer grants and removals through the existing background configuration sync. Remove root-only grant RPC, ownership handoff, pending revocation, and dedicated copy commands; restore the master service lifecycle on Linux and macOS.
Preserve V2 credentials, authentication revocation, and ordinary-save protections. Accept the existing asynchronous sync and multiple-user limitations.
Validated Windows and macOS Flutter checks, the Linux library/tests/service check, four macOS trusted-device tests, and AppleScript syntax. Real service transitions remain untested.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(trusted-devices): preserve migrated tokens at capacity
Raise the shared V2 token limit to 128 and order newly migrated tokens by issuance time without extending their legacy expiration. Extend the existing migration regression coverage to verify token reuse and expiry preservation at capacity.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): preserve trust across service stop and start
Export current on-disk grants and explicitly synchronize them into the GUI configuration at startup and before stopping a running service. Abort the stop if synchronization fails so the next service import cannot use a stale local copy.
Extend the existing synchronization regression coverage to check revoked, retained and newly enrolled devices and the actual import-source file. Remove unrelated import logging changes.
Validation: trusted-device tests passed on Windows and macOS (4 each); changed-line formatting and git diff --check passed. Real Windows GUI/UAC service transitions remain untested.
Signed-off-by: fufesou <linlong1266@gmail.com>
* refactor(trusted-devices): simplify local authorization
Replace local authorization envelopes with typed operations while retaining locked authentication checks and persistence. Remove redundant configuration and Dart wrappers without changing credential formats or management requests.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): allow service removal when host is unavailable
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): preserve trust revocations before full uninstall
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): sync trust changes to the retained user config
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): sync trust after security setting changes
Signed-off-by: fufesou <linlong1266@gmail.com>
---------
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(windows): use native APIs for manual service control
rustdesk/rustdesk#16557
Replace elevated service-control batch scripts with SCM operations
and native tray shortcuts. Preserve SYSTEM configuration import
and propagate helper failures.
* fix(windows): preserve service state during manual control
Keep existing service registration and synchronize failed operations with SCM state. Run the installed legacy importer directly as SYSTEM, bound its exit waits, and keep auxiliary cleanup errors separate from service lifecycle results.
* fix(windows): preserve legacy service import without debug privilege
* fix(windows): replace installer certutil and findstr
Use native SHA-256 verification and shortcut decoding, and execute the protected batch script in a single cmd process. Preserve protected staging, verification receipts and failure exit codes.
Restore the master service-control flow and remove the separate SCM and Task Scheduler implementation to keep the antivirus fix focused and preserve legacy configuration import.
Validation: Windows Rust library build, nine focused tests, and isolated single-cmd success, failure, tamper rejection and cleanup checks passed. Bitdefender validation remains pending.
* fix(windows): preserve installer helper path compatibility
* fix(windows): preserve caret-only installer helper paths
* fix(windows): protect installer data and use native service control
Stage installer scripts, shortcuts and verified updates with restricted ACLs
before elevation. Remove the elevated portable-verifier launch while keeping
certutil and findstr out of the shared installer handoff.
Use the installed Flutter runner for native normal-service create/start and
stop/delete operations. Preserve existing registrations on repeated setup,
legacy configuration import, and compatibility with older installed runners.
Report installer failures and document the security and compatibility reasons.
Validation: Windows Rust test build and Release runner build passed; six
isolated service checks and runner exit-code checks passed. Focused Rust
installer/update tests passed 8/9; the directory-cleanup ACL test also fails in
the earlier binary. Final service lifecycle and Bitdefender testing is pending.
* fix(windows): clean staged installer files on UAC cancellation
Retain DELETE handles until the elevated cmd connects to a local pipe, then
release the handles before allowing the BAT to run. This preserves protected
staging while allowing cancellation cleanup and cmd file access.
Handle interrupted handoffs, supply the byte-count pointer required on
Windows 7, and explain early service dispatch in the C++ runner. Keep the
staging tests inline with their implementation.
Validation: Windows Rust test build, focused installer-file and handoff
tests, rustfmt, and staged diff checks passed. The pre-existing directory
ACL test failure is unchanged. Actual UAC cancellation, Windows 7 runtime,
and final-build Bitdefender validation remain pending.
* fix(windows): roll back new service registration on start failure
Delete a registration created by this attempt if startup fails, while preserving existing services and already-running success. Keep the original startup error and report rollback failures separately.
Validation: eight isolated service checks and the Release Flutter runner build passed. Real service startup failure and final-build Bitdefender validation remain pending.
* fix(windows): continue uninstall after service stop errors
Log an unsuccessful stop and still request deletion so the uninstall
script can reach its existing taskkill and cleanup commands. Treat an
already marked service as a satisfied deletion request, while preserving
other deletion errors and the normal stop wait.
Validation: all twelve isolated service-control checks passed, including
already-marked, stop-rejected, stop-timeout and deletion-denied cases.
The Release Flutter runner build and existing argument/exit-code checks
passed. Real SCM failure scenarios and Bitdefender remain unverified.
* fix(windows): finish installer setup before service startup
Complete SAS policy and printer setup before native service activation so a startup failure cannot skip independent installation steps. Preserve the startup error, rollback and legacy command sequences, and document uninstall_service's continuation result.
Validation: Windows Rust test compilation, four isolated command cases and two existing installer handoff tests passed. CodeRabbit completed with no findings. Actual installer, SCM and Bitdefender validation remains pending.
* fix(windows): use native service control for Sciter
Share the existing native service operations with Sciter and dispatch
--service-control before UI initialization. Keep Flutter's entry point and
the legacy commands for a different installed executable unchanged.
Validated the Windows x64 Sciter build, Flutter-feature test build,
x86 C++ bridge compilation, and real EXE/BAT error propagation. Final
Bitdefender installation and service lifecycle validation remain pending.
* fix(windows): propagate negative service-control exit codes
Treat every nonzero service-control exit status as a failure so crash and loader error codes cannot be reported as success. Verified six real cmd.exe exit-code cases; CodeRabbit review completed with no findings. Actual service crashes were not exercised.
* fix(windows): handle UAC cancellation and scope service rollback
Preserve the typed elevation error and its diagnostic details so canceled UAC prompts do not show an installation-failure dialog.
Use create-service for normal installation and create-service-with-rollback for manual Start Service. Retain a new registration after a normal installation startup error; roll back only the manual path that restores stop-service=Y.
Validation: Windows Rust test compilation, Release Flutter runner and Sciter builds, cancellation/error-chain checks, isolated service-result cases, and real executable argument/exit propagation checks passed. Actual UAC cancellation and Bitdefender were not rerun.
* test: remove tests that do not pin user-visible behavior
Apply the AGENTS.md test rules to the existing Rust and Flutter suites.
A test is kept when it is the only coverage of user- or API-visible
behavior, the regression test of a reported or fixed bug, a security
boundary (one test per rejection class), or a check against an external
reference. Tests that assert private state or the order of internal
steps, pin review-round corner cases, or repeat what a kept test already
covers are removed.
Rust: 679 -> 298 tests. Dart: 118 -> 45 tests.
Test-only helpers left without callers go with them
(applyLastOnlineStateForTesting, terminalKeyboardRowWidth,
debugBufferedInputCount, tokio's test-util dev feature), and cfg gates
and visibility that existed only for the deleted tests are narrowed.
Runtime behavior is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
* test: keep tests that pin security and user-visible behavior
Restore six tests that review showed are the only coverage of their
behavior:
- update metadata rejects an artifact file name with path components;
- ICE candidates from another session are dropped;
- KCP delivers every multi-segment frame queued before a close;
- set_files rejects an empty name in a multi-file transfer;
- a lopsided elongated cursor keeps its centre hotspot (#16242);
- toggling Show hidden during a pending same-path read issues a new read.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
* test: keep offline update and key-exchange downgrade rejections
Restore three tests that are the only coverage of their rejection class:
- offline update metadata rejects a signed artifact with an http or
credential-bearing URL;
- offline verification rejects a renamed local file and a version that
does not match the release;
- a key-exchange pick lowered in transit leaves both sides unable to
decrypt, so a v0 fallback after a failed v1 decrypt cannot pass
unnoticed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
* test: keep the decomposed-grapheme and reconnect-cancel tests
Each catches a plausible wrong change that passes every kept test:
mapping the first scalar under a locked Ctrl turns é into \x05,
and a reconnect that does not fail pending reads leaves them hanging
until the 30 s timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WS1HTjp6UQuG43KEcQPq1R
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(update): verify signed update metadata
* fix(update): harden metadata publishing and app names
- share strict app-name validation across Windows and macOS
- preserve published sidecars until replacements are ready
- select macOS test features by target architecture
- update the signing dependency and URL validation coverage
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): prevent replacing published release assets
- block reruns after signed update metadata is published
- clarify the security rationale for app-name validation
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): cache TLS responses and avoid double translations
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact: reduce the diffs
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): remove obsolete update paths
- remove unused FFI update branches
- delete legacy Windows and macOS update helpers
- simplify macOS daemon updates and redundant gating
Signed-off-by: fufesou <linlong1266@gmail.com>
* feat(update): secure same-identity macOS offline updates
- verify DMGs using signed metadata, size, and SHA-256
- enforce package and bundle identity plus macOS signature checks
- support custom release policies and propagate manual update failures
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): verify Windows installers with Authenticode
Reject unsigned or untrusted EXE/MSI updates
before elevation, clean up failed verified copies,
and fix the macOS manual updater logging import.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): clear stale URL on response body errors
Keep body-read failures in the common cleanup path and document the
cache-only Authenticode verification policy.
Signed-off-by: fufesou <linlong1266@gmail.com>
* refactor(update): remove OS signature sanity checks
Remove Windows Authenticode and macOS codesign/Gatekeeper verification.
Keep metadata, artifact integrity, bundle identity, and transaction checks.
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): move update scripts into res/update
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): secure Windows MSI handoff against junction races
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): secure Windows EXE handoff against junction races
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): preserve legacy custom client app names
- allow names starting with digits or underscores
- preserve leading hyphens on Windows for compatibility
- reject leading hyphens on macOS to avoid pgrep option parsing
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): remove some simple wrappers
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): simple refactor
* refact(update): comments on update.scpt
Signed-off-by: fufesou <linlong1266@gmail.com>
* refact(update): comments
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(update): create download destinations exclusively
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): roll back updates when final readiness checks fail
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(msi): propagate MSI installation failures
Signed-off-by: fufesou <linlong1266@gmail.com>
* chore
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): reject stale IPC sockets during updates
Require open IPC sockets in addition to launchd running state before committing the privileged update transaction. Inspect sockets with lsof to avoid triggering IPC authentication.
Add native socket regression coverage to macOS CI. Remove the unused Windows helper, combine offline metadata exports, and restore unrelated formatting changed by the PR.
Signed-off-by: fufesou <linlong1266@gmail.com>
* fix(macos): allow offline updates without an installed bundle
Validate app-only updates against the running client's bundle identifier and check the destination identity when it exists. Replace source-text assertions with behavioral identity tests and run the macOS update tests in CI.
Signed-off-by: fufesou <linlong1266@gmail.com>
* ci, gate test with PUBLISH_UPDATE_METADATA == 'true'
Signed-off-by: fufesou <linlong1266@gmail.com>
---------
Signed-off-by: fufesou <linlong1266@gmail.com>
* add the base crate and repoint the moved modules at it
`libs/base` (crate `base`) takes the parts of hbb_common that only this app
uses: `fs`, `platform`, `keyboard`, `message.proto`, and 145 of the 177
`config::keys` constants. hbb_common keeps what the server names, and the 32
keys it reads itself are re-exported from `base::config::keys` so call sites
still see the full set through one path.
Sources move verbatim. The only edits inside them are `crate::` prefixes that
now have to say `hbb_common::`; `keyboard.rs` and `platform/windows.rs` are
byte-identical. The crate stays on edition 2018, the edition the moved code was
written under. `log`, `lazy_static` and `anyhow` become direct dependencies so
the bare paths in that code resolve exactly as before, and its winapi features
are spelled out rather than left to feature unification.
Two call sites outside Rust and Cargo had to follow the move: the Android
protobuf source dir, which still pointed at hbb_common/protos for message.proto,
and the three AGENTS.md entries that named hbb_common for options, protos and
file transfer.
`scrap`'s `drm` feature now forwards to `base/wayland_probe`. Left pointing at
hbb_common it would still have compiled, silently dropping the Wayland
socket-probe fallback, so that forward is verified by a build with and without
the feature.
`config::keys` carries a test asserting its names stay disjoint from the ones
hbb_common kept: the glob re-export and the local constants share a namespace,
and Rust prefers the local item silently, so a name added to both sides would
otherwise let client and server disagree with no diagnostic.
Verified: macOS and Linux, debug and release, `--all-targets`; the 177 key
constants diffed name-for-name and value-for-value; the generated protobuf types
compared before and after; every `#[cfg]` gate on a moved import checked against
its original; and every file that was `rustfmt`-clean before this change still
is, compared against master file by file. Windows is checked by inspection only
-- it cannot be compiled here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ49AbZJYfm8NTp5yDPMab
* one `use` per crate, and write the rule down
`fs.rs` came out of the move with two ungated `use hbb_common::` statements,
because the original single `use crate::{...}` had to give up `message_proto`
to the new crate and the rest was left in a second block. Fold it back into one.
A scan of the whole tree for the same shape finds nothing else: every other file
with more than one top-level `use base::` or `use hbb_common::` is split by a
`#[cfg]` that does not cover the whole block, or by `pub use` next to `use`.
Those are the cases that cannot merge, so AGENTS.md now states both the rule and
the exemption.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ49AbZJYfm8NTp5yDPMab
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* feat(recording): add visibility and service storage options
- support hide-recording-button in Flutter and Sciter
- allow a custom save directory for Windows service recordings
- sanitize peer IDs used in recording filenames
Tested:
- with hide-recording-button=Y and allow-auto-record-outgoing=Y,
outgoing sessions are recorded automatically while the recording button
remains hidden and cannot be stopped from the UI; verified on Flutter
desktop, Sciter, and Android
- windows-service-video-save-directory takes effect when the Windows client
runs as an installed service
- the Windows controlling side can save recordings for direct IP:port
connections
Signed-off-by: 21pages <sunboeasy@gmail.com>
* update hbb_common
Signed-off-by: 21pages <sunboeasy@gmail.com>
* fix(recording): validate configured save directories
- trim configured recording directory paths
- reject non-absolute paths and fall back to defaults
- warn when a non-empty path is invalid
Signed-off-by: 21pages <sunboeasy@gmail.com>
* fix(recording): validate configured save directories
Signed-off-by: 21pages <sunboeasy@gmail.com>
---------
Signed-off-by: 21pages <sunboeasy@gmail.com>
* avatar
* refactor avatar display: unify rendering and resolve at use time
- Extract buildAvatarWidget() in common.dart to share avatar rendering
logic across desktop settings, desktop CM and mobile CM
- Add resolve_avatar_url() in Rust, exposed via FFI (SyncReturn),
to resolve relative avatar paths (e.g. "/avatar/xxx") to absolute URLs
- Store avatar as-is in local config, only resolve when displaying
(settings page) or sending (LoginRequest)
- Resolve avatar in LoginRequest before sending to remote peer
- Add error handling for network image load failures
- Guard against empty client.name[0] crash
- Show avatar in mobile settings page account tile
Signed-off-by: 21pages <sunboeasy@gmail.com>
* web: implement mainResolveAvatarUrl via js getByName
Signed-off-by: 21pages <sunboeasy@gmail.com>
* increase ipc Data enum size limit to 120 bytes
Signed-off-by: 21pages <sunboeasy@gmail.com>
---------
Signed-off-by: 21pages <sunboeasy@gmail.com>
Co-authored-by: 21pages <sunboeasy@gmail.com>
* For custom client, the incoming record directory of installing Windows app and the Android record directory still use RustDesk, it works, but replace 'RustDesk' with the custom client's name.
Signed-off-by: 21pages <sunboeasy@gmail.com>
1. Enable the RustDesk client to use WebSocket for either controlling or being controlled.
2. Fix TCP sending `register_pk` frequently
Note:
1. Because hbb_common directly uses `use_ws` to read config directly, rustdesk also directly reads config
Signed-off-by: 21pages <sunboeasy@gmail.com>
1. Always block desktop settings page if video connection exists, both mouse event and key event are blocked..
2. Server control page always block key event.
Signed-off-by: 21pages <sunboeasy@gmail.com>
* add custom password to unlock settings
* If not set, use admin password; if set, use custom settings password.
* At least 4 characters.
* Set with gui or command line.
Signed-off-by: 21pages <sunboeasy@gmail.com>
* Update cn.rs
---------
Signed-off-by: 21pages <sunboeasy@gmail.com>
Co-authored-by: RustDesk <71636191+rustdesk@users.noreply.github.com>
1. Merge code of mobile and desktop virtual display menu.
2. Mobile add seperate resolution menu, only support changing
resolutions.
3. Android add proxy setting
Signed-off-by: 21pages <sunboeasy@gmail.com>
* h265 encoding: the second frame always fails, use repeat encoding to achieve real-time encoding
* h264 encoding: Not supported because encoding fails too frequently, about 50%, with one failure followed by another success.
* h264/h265 decoding: No issues found.
* Does not support dynamically changing the bitrate and changing the quality by resetting the encoder.
Signed-off-by: 21pages <sunboeasy@gmail.com>
check process send config to ipc server, other process get config from ipc server. Process will save config to toml, and the toml will be used if the config is none.
when start check process: ipc server process start or option changed
from disable to enable
when get config: main window start or option changed from disable to
enable, start_video_audio_threads.
Only windows implements signature, which is used to mark whether the gpu software and hardware information changes. After reboot, the signature doesn't change. https://asawicki.info/news_1773_how_to_programmatically_check_graphics_driver_version, use dxgi way to get software version, it's not consistent with the visible driver version, after updating intel driver with small version change, the signature doesn't change. Linux doesn't use toml file.
Signed-off-by: 21pages <sunboeasy@gmail.com>
fufesou