Changelog

Version 1.0.8

Added

• A shared known-hosts store, the way OpenSSH and MobaXterm do it. Fingerprints used to be pinned per session, so trust belonged to whichever session happened to reach a host first — a bastion fronting fifteen servers was vetted fifteen times, and nobody reads the fifteenth prompt. That is exactly the habituation that makes host-key warnings useless. Accept a jump host once and every session through it is now quiet.
• Session-specific pins still win where they exist, and a mismatch against either store refuses the connection. Existing pins keep working and are copied into the shared store on their next successful connect, so the prompts fall away as you use the app rather than needing a migration step.
• Settings → Known hosts lists everything you have trusted and lets you forget entries. Without it a legitimately rebuilt server would be an unrecoverable refusal, since a shared entry has no session editor to clear it from.
• Declining an unknown host is now reported differently from a host whose key has changed — previously a genuine man-in-the-middle against a shared host could have been described as a plain cancellation.

Fixed

• Closing a VNC session no longer kills the app. Teardown now takes the graceful path, ending the session’s background work in an order that does not throw.
• Quitting with a VNC session open no longer crashes. Closing the window used to abandon every live backend — SSH clients, SFTP sessions, VNC — and let process exit rip them away mid-flight. Closing now disposes every tab through the same path a manual tab close uses, bounded to five seconds so a wedged remote cannot hold the app open.
• The VNC “Send keys” button no longer disappears on hover. Pointing at it painted it dark-on-dark until clicked; its colours are now theme-independent.

Security

• The expanded-group list moved into the encrypted vault. The settings file is plain text, and the list it kept was a verbatim copy of your group paths — so a vault whose whole job is hiding that you have a folder called Clients/Acme wrote that name out next to itself in the clear. It now lives inside the vault with the rest of your estate. Existing installs migrate on the first unlock after upgrading, and the old copy is blanked rather than left behind.
• Restoring the tree no longer depends on rebuild ordering, which could silently drop your saved folder expansion for the rest of a session.

Changed

• -c <dir> now moves the vault only, not the runtime cache. A portable vault folder used to fill up with tens of megabytes of browser-runtime bookkeeping sitting next to sessions.vault and looking like app data. A -c directory is now just the vault plus your settings, so using one on a removable drive no longer drags the cache along. Existing cache folders inside a -c directory are left alone — nothing reads them any more, so they can be deleted with the app closed.

Version 1.0.7

Security & credentials

• Changing the master password can no longer destroy the vault. The old flow deleted the vault and rebuilt it session by session, so any failure after the delete lost everything — and empty groups were dropped every single time. It now verifies the current password against the file on disk and re-encrypts the payload in place through an atomic write. Nothing is deleted, groups come along for free, and a failed write leaves the vault usable.
• The session editor no longer hands back saved passwords. Jump-host rows and the VNC tunnel gateway used to pre-fill their password fields with the real stored secret, which made the editor a recovery surface for credentials you can no longer remember. All fields now show “a password is saved” with an explicit Clear saved button; typing replaces, an empty box keeps what is stored, and type-then-delete cannot wipe a password by accident.
• Host-key pins survive a locked vault. Trusting a host is a deliberate decision made at a prompt that spells out the fingerprint — and if the vault had auto-locked while the session was open, that decision was silently thrown away and the next connect re-prompted for the same host. Pins now queue in memory and are written on the next unlock, and the terminal says so when one is deferred. Only fingerprints are queued, never passwords or key material.
• RDP clipboard sharing is now a per-session setting. Redirection is two-way: while the session is open the remote host can read anything copied locally, including a password copied out of a password manager. Still on by default, but refusable.
• A failed remote existence check no longer reads as “the file isn’t there”. A permission error or dropped connection used to turn an overwrite prompt into a silent overwrite; the check is now three-valued and takes the cautious branch when it cannot tell.
• The plaintext-VNC warning no longer fires on Tailscale-style networks. The private-range check missed carrier-grade NAT and IPv6 unique-local addresses, so it warned about unencrypted VNC on exactly the setups where the traffic is already inside an encrypted mesh.
• Cancelled SFTP uploads no longer truncate the remote file. Uploads went straight onto the destination with overwrite enabled, so cancelling mid-flight left it cut short — enough to take down a remote service if it was a config file. Uploads now write to a temporary name and move into place only on success.

Fixed — sessions & connections

• Editing a session no longer reverts itself. A tab already open on that session kept a reference to the pre-edit copy, reconnected with the old credentials, and eventually wrote that stale copy back over your edit.
• The terminal’s Reconnect button was invisible and unclickable. The disconnect banner was being shown exactly as intended and then rendered underneath the terminal, where it could be neither seen nor clicked — so the only way to reconnect a dropped session was to close the tab and reopen it. It now sits in its own row above the terminal.
• Reconnect works on a live RDP session instead of producing an error tab, and Settings → Change master password no longer crashes the app.
• Cancelling an SSH connect actually aborts the handshake. Cancelling mid-handshake used to leave the connection carrying on in the background, unreferenced and never closed — a live session on the server plus, with jump hosts, the whole chain behind it.
• A failed SSH connect now tears the jump chain down. When the jump hosts authenticated but the target refused, the chain stayed up with no way for you to reach it.
• Connect and reconnect are serialized per tab, so double-clicking Reconnect no longer starts two attempts and orphans the loser’s connection.
• Resizing the window on a disconnected session no longer prints errors and flips the tab into an error state; overlapping SFTP listings can no longer repaint the wrong directory.

Improved

• Unlocking no longer freezes the window. The deliberately slow key derivation ran on the interface thread, so every unlock locked the window for up to a second — on the one screen where a frozen window reads as a rejected password. It now runs in the background behind a progress ring.
• A locked vault shows a “Vault locked” placeholder with an Unlock button. An auto-lock and a vault that has lost every session used to look identical.
• Auto-lock can be turned off — the setting was clamped to a one-minute floor; 0 now means never.
• “Exit” on the unlock dialog now actually exits, instead of leaving the app running in a locked empty state that looked like a session list that had lost everything.
• Closing a tab selects its neighbour, not the last tab — closing the 3rd of 6 used to drop you on the 6th, which with Multi Exec on puts your keyboard somewhere you were not expecting.
• Cancelling an SFTP transfer now actually stops it. Once a transfer was underway, “Cancel” on a multi-gigabyte download marked the row cancelled and let the bytes keep coming. Every operation now carries the cancellation through to the wire, and recursive delete checks between every entry.
• Group names are cleared from memory on lock, and idle tracking releases its hooks properly on shutdown.

Changed

• The SSH component was upgraded to clear a published high-severity advisory. For the record, the flaw is in a file-copy feature RemoteDesk has never used, so no shipped build was ever exposed — the upgrade is about clearing the advisory rather than patching a reachable hole.
• Compatibility note: that upgrade drops support for DSA (ssh-dss) entirely. A session against a host old enough to only offer DSA host keys, or using a DSA private key, will stop connecting. Everything else — password and key auth, jump-host forwards, SFTP, compression, SHA-256 fingerprints — is unchanged.

Version 1.0.6

Added — Multi View & Multi Exec

• Multi View — the title-bar button now shows a grid icon with “Switch to Multi View” in single view, and a single-pane icon with “Switch to single view” while panes are tiled.
• Multi Exec. A new title-bar button, visible only in Multi View, broadcasts your keystrokes to every open terminal at once — type in one pane and it types in all of them.
• Each pane gets an “Exclude from multiexec” checkbox to opt out (it neither sends nor receives while excluded), and a “Multi paste” button pastes the clipboard into every included pane. Only genuine keystrokes broadcast, so there is no echo loop. Leaving Multi View turns Multi Exec off.

Added — switch to root with su

• The session editor’s Auth tab (SSH only) gained “Switch to root with su after login”, with an optional root password field.
• With a saved password the session runs su - and enters it automatically once you are logged in, then runs any Initial command as root. Left empty, it runs su - and lets you type the password at the prompt. Works after either password or key-based login, and the root password is stored encrypted in the vault alongside the login password.

Fixed

• Session colour tags now show in the sidebar — the swatch was being clamped to zero width, so the colour never appeared regardless of what you picked.
• “Forgot password / Reset vault” no longer crashes the app at the confirmation step.
• The terminal fills the window immediately. The shell was opened at a fixed 80×24, so top and other full-screen programs only used 24 rows until you manually resized. The terminal now reports its real size before the shell is created.

Version 1.0.4

Added

• Portable vault directory. The -c <dir> switch (aliases --config, /c) points RemoteDesk at one directory of your choosing instead of your user profile — for example RemoteDesk.exe -c D:\RemoteDeskVault. The directory is created if missing; if it has no vault yet the normal create-vault flow runs there, and if one exists the normal unlock flow runs.
• Per-session RDP certificate verification — choose per session between warning on a mismatch (the default, like mstsc), requiring a valid certificate, or not checking at all. Sessions saved before the option existed default to warning.

Fixed

• Terminal: bottom rows are no longer clipped — the last prompt row used to render past the viewport and get cut off, worse when maximized.
• Terminal: the scrollbar is now grab-and-draggable, instead of only responding to the mouse wheel.
• Sidebar: right-click reliably opens the correct menu. Clicks landing in the empty gaps of a row used to fall through and pop the wrong menu at random; rows are now fully hit-testable, which also makes select and open register anywhere on the row.
• Sidebar: “Create your first session” only shows when the vault is genuinely empty, rather than whenever no tab was open.

Version 1.0

SSH Terminal

• Full xterm.js terminal rendered inside WebView2 with the RemoteDesk dark palette
• Password or private-key authentication with optional passphrase
• Inline credential prompts in the terminal when nothing is saved — like OpenSSH, with per-hop banners for jump chains
• First-use host-key confirmation (TOFU) for SSH and SFTP — the SHA-256 fingerprint is shown and you confirm before it’s pinned; a later key change is refused as a possible man-in-the-middle
• Copy / Paste / Select-all (Ctrl+Shift+C / V / A); right-click context menu in the terminal area
• Smart paste — multi-line content opens a confirm dialog with editable preview and a yellow execution warning
• Multi-paste to terminals — pick any subset of open terminals (All / None / Others) and send the same payload to every one
• Reconnect banner on disconnect/error — one click reuses the same tab with scrollback preserved

SFTP File Browser

• Dual-pane Explorer-style browser opened from any SSH session via right-click → Open file browser (SFTP)
• Native Windows shell icons resolved by file extension — matches Explorer for .txt / .zip / .png / etc.
• Drag-drop in both directions; Windows Explorer → remote pane also uploads
• Recursive folder upload and download — tree walked, matching remote dirs created on demand (existing reused, not re-created)
• Per-transfer progress and cancel; transfer drawer with live throughput, direction-tinted arrows, color-coded state
• Merge / overwrite prompts before clobbering anything that already exists
• Concurrency capped at 3 transfers per SFTP tab; the rest queue in the drawer
• Recursive delete with a pre-counted progress display (47 / 189 items)
• Status-bar transfer summary with running totals; throttled so rapid bursts don't churn the UI
• Inline SFTP sign-in card with per-hop credential rows when target or jump credentials are missing
• Download path-traversal guard — server-supplied filenames can’t escape the chosen folder via ..\ or rooted / UNC names

Embedded RDP

• Remote desktop rendered inside the tab via the Windows MsRdpClient ActiveX (mstscax.dll) hosted in a WindowsFormsHost
• No external mstsc.exe window, no taskbar entry, no Windows 11 "Opening Remote Desktop Connection" prompt
• Saved password injected directly via ClearTextPassword — no Credential Manager round-trip
• HiDPI-correct — viewport measured in real pixels and DesktopScaleFactor sent to the server so text stays crisp
• Live resize via UpdateSessionDisplaySettings on modern Windows servers; older hosts fall back to smart-sized scaling
• Per-session server-certificate verification — Warn on mismatch (default) / Require valid certificate / Don’t verify, chosen on the Auth tab
• Clipboard redirection on; smart-card, drive and printer redirection off by default (smart-card redirection would expose the local card/PIN to the remote)
• Connection state polled via the OCX's Connected property — clean Disconnected vs Error attribution with ExtendedDisconnectReason codes

Embedded VNC

• Remote desktop rendered inside the tab using MarcusW.VncClient drawing into a WPF WriteableBitmap
• Aspect-preserving fit with letterboxing — matches TightVNC / TigerVNC viewer behaviour
• Native mouse / keyboard / scroll-wheel forwarding via a hand-built WPF→X11 keysym map
• Send keys menu for Ctrl+Alt+Del, ☔Win, Alt+Tab, Alt+F4 — key chords Windows intercepts locally otherwise
• Auto SSH tunneling when a jump host is configured — otherwise-plaintext VNC traffic rides inside SSH encryption
• Optional "Loopback gateway" hop for the libvirt / QEMU / Proxmox case (VNC bound to 127.0.0.1 of a deeper hypervisor)
• Amber plaintext-VNC warning bar before connecting to non-private hosts with no tunneling configured
• Better error messages for empty passwords and DES-weak password derivations

Jump-Host Chains

• Any number of SSH hops, reorderable in the session editor; first row dialed first, last row does the final TCP forward
• Per-hop credentials — mix password and private-key auth across the chain
• Per-hop error attribution — failures name the exact hop and auth method that rejected the connection
• Inline prompts for missing jump credentials (SSH/SFTP terminals) and clear pre-connect errors for VNC tabs
• Route description visible during connect — e.g. "SSH via 2 jump hosts → 127.0.0.1:5901"
• Host-key verification on every hop — each jump host and the VNC SSH-tunnel gateway pins and checks its fingerprint, closing first-hop interception exposure

Encrypted Vault & Security

• AES-256-GCM authenticated encryption of the full session list
• PBKDF2-SHA256 key derivation with 600,000 iterations and 16-byte salt
• Atomic writes via .tmp + File.Replace — an interrupted save can never corrupt the vault
• Key material zeroed on lock, idle auto-lock, and app exit
• Auto-lock after 15 minutes of inactivity (configurable 1–240); manual lock via Ctrl+Shift+L or title-bar padlock
• Per-credential auto-save policy (target user / password, jump user / password) with conservative defaults
• "Forgot password? Reset vault" flow on the unlock dialog for irrecoverable forgotten passwords
• All session-state mutation and saves serialized under a lock — a background update can never race a UI edit into a half-written vault
• settings.json written atomically (temp + replace) under a lock so an interrupted save can't clobber your preferences

MobaXterm Session Import

• INI-style parser over a .mxtsessions export with a full preview dialog before importing
• Supported protocols (SSH, SFTP, RDP, VNC) pre-checked; unsupported (Telnet, Mosh, Serial, FTP, WSL, ...) listed with an "Unsupported" tag
• Folder structure preserved — MobaXterm's \-separated folders map to RemoteDesk's /-separated groups, including empty folders
• Single-hop "Connect through SSH gateway" jump host imported natively for SSH/SFTP sessions
• Passwords are not imported (MobaXterm encrypts them with its own master key); first connect prompts inline
• Select-all toggle and live footer counter (N of M supported selected, K unsupported skipped, G groups)

Sidebar, Groups & Tabs

• Hierarchical TreeView with /-separated groups, classic Windows Explorer tree lines, persistent expansion state across restarts
• Right-click for New group / New subgroup / New session in this group / Rename / Delete
• Drag sessions between groups (or onto empty area to move to root)
• Multi-select with Ctrl/Shift — action menu items apply to the whole multi-set; Duplicate and Delete also bulk-operate with one confirmation
• Live sidebar search filters by name or user@host:port; group structure preserved while filtering
• Drag-to-reorder tabs without re-parenting WebView2 HwndHosts (no broken focus chains)
• Active tab clearly marked — colored top accent bar, bolder title, lighter background
• Split view renders every open tab simultaneously in an auto-laid 2-column grid; active pane gets a colored border
• Right-click tab strip for Close / Close others / Close all

Polish, Stability & Storage

• Custom wide terminal scrollbar that reserves its own gutter — no characters hiding behind the bar
• Maximize clamp via WM_GETMINMAXINFO — content no longer slides under the taskbar on borderless maximize
• RDP first-connect resolution fix — short-lived retry burst after Connected so the remote fills the tab without manual window-wiggle
• App-close stability — tabs disposed before WebView2 teardown, eliminating late "Cannot access a disposed object" dialogs
• All app-data centralised in %APPDATA%\RemoteDesk\ and %LOCALAPPDATA%\RemoteDesk\ — nothing written next to the .exe
• WebView2 cache redirected so MSIX / Microsoft Store packaging works out of the box (read-only install location)
• Portable vault via the -c <dir> switch — keep the vault, settings, and cache together in one chosen directory (e.g. a USB drive) instead of the per-user folders
• Single-file self-contained .exe (~81 MB) — no separate .NET runtime install required on the target machine
• Branded title-bar logo and window icon; multi-size app.ico (16 / 24 / 32 / 48 / 64 / 128 / 256) for Windows Explorer