- Updated .gitignore to include new binary paths and retain .gitkeep.
- Modified Gitleaks configuration to ignore additional directories.
- Adjusted CI workflows to prevent execution on version bump pushes and improved version bump handling in scripts.
- Bumped BetterDesk Console Manager version to 3.3.136 in betterdesk.sh and related scripts.
- Removed outdated binary files for Windows and Linux from the binaries directory.
- Added a new documentation file for GitHub Actions CI troubleshooting, outlining common failures and local commands to mirror branch protection checks.
- Bumped `vitest` and `vite` versions in both root and agent-client lockfiles.
- Added `web-nodejs` overrides for `@babel/core` and `js-yaml` to address Dependabot alerts.
- Implemented `NewConnLimiterFromInt` for relay per-IP limits in the Go server, removing the deprecated `deepSet` function from the patch-role-scope-i18n script.
- Extended CodeQL coverage to include new query filters and improved npm audit configurations.
Added support for `allow-supports-multiple-windows` and `deny-supports-multiple-windows` permissions in the Windows schema. Updated existing permissions to include `allow-set-icon-with-as-template` and its denial counterpart.
Bump support-agent Go deps, harden relay recording paths and clipboard HTML stripping, update agent-client Rust lockfile, and extend CodeQL/Dependabot config for known upstream limits.
Remove internal LAN IP, SSH user, and developer paths from docs and examples; move deploy runbook to gitignored docs/private with a public template; drop Cursor debug logging leftovers; add CI checks to prevent regression.
Co-authored-by: Cursor <cursoragent@cursor.com>
Updated captureFFmpegStrategies functions across macOS, Linux, and Windows to accept a DesktopStreamer parameter, enabling better management of portal sessions for screen capture. Introduced a new portalScreenCastSession type for handling session cleanup on Linux. Improved the handling of xdg-desktop-portal for Wayland, ensuring proper resource management and user experience during remote desktop sessions. Additionally, added warnings for missing dependencies in the preflight checks for Linux environments.
Restore agent-client to git and wire agentClientBuildWorker for Tauri builds
(deb/rpm/AppImage/MSI) with branding and Go sidecar staging. Add TLS gate,
settings lock, policy sync, preflight UI, CDAP registry, and Generator
product_type split (agent-client vs support-agent vs rdclient).
Created the initial structure for the BetterDesk Agent Client, including essential files such as index.html, package.json, and TypeScript configuration. Implemented core components for the application, including StatusPanel, ChatPanel, and HelpRequest, along with localization support for multiple languages. Added a consent dialog for user permissions and integrated a chat window for real-time communication. Included styling and branding elements to enhance the user interface.
Phases 1-4 of the Go-server centralization plan plus optional-TLS transport.
Go server:
- db: HelpRequest model + SQLite/PostgreSQL stores (help_requests_*.go), GetDeviceOrgID.
- cdap: handleHelpRequest/handleChatMessage handlers, SendChatToDevice delivery.
- api: REST help endpoints (help_handlers.go), publish help_request/chat_message events.
Node.js panel:
- bd-api.routes.js: drop local in-memory Maps, proxy all help/chat/notification
endpoints to the Go server (read-proxy) with status/id/timestamp normalization.
Agent (native Go + Tauri sidecar):
- config.go/agent.go: optional EnforceTLS, ServerCertPin (SPKI pin), TLSInsecureSkipVerify
with env overlays and dialOptions() cert pinning via VerifyPeerCertificate.
- HTTP (ws://) stays a fully supported transport: TLS enforcement is an explicit
operator opt-in (never auto-derived from the URL scheme). The agent logs a warning
recommending wss:// for untrusted networks instead of blocking the connection.
- config.rs/sidecar.rs: propagate enforce_tls + server_cert_pin from AgentConfig
through SidecarConfig to the Go agent config; warn on plaintext ws:// to remote hosts.
This commit was made possible thanks to Insolve.
Complete the web console locale set so all 26 language files share the EN/PL baseline with no missing keys, extra keys, empty values, or English fallback values.
Keep strict i18n audit behavior and disabled auto-fix flow so incomplete translations are surfaced for manual review instead of being filled with English fallback text.
Validated with the strict web-nodejs i18n audit, JSON parsing for all locale files, placeholder preservation checks, and VS Code diagnostics.
This commit was made possible thanks to Insolve.
Enables hardware-accelerated video for the CDAP/OS-agent rdclient path instead of being stuck on 1-2fps MJPEG, including over plain HTTP (no HTTPS/domain/cert required).
Browser viewers (web-nodejs): cdap-adapter.js and cdap-desktop.js now decode video via the shared RDVideo pipeline. WebCodecs (AV1/VP9/H264, hardware-accelerated) is used in secure contexts (HTTPS/localhost); over plain HTTP, H.264 is decoded through JMuxer/MSE using the browser's native (usually GPU) decoder. Viewers advertise decodableCodecs() in the desktop_start init payload so the agent sends a real GPU stream; MJPEG/WebP remain safe fallbacks. cdap-device.ejs preloads jmuxer + RDVideo.
Go agent (betterdesk-agent): codec.go + codec_framing.go add multi-codec engine with GPU encoder probing and selection order AV1 -> VP9 -> H264 -> WebP; desktop.go intersects the operator-advertised codec list with local encoder ability and emits honest desktop_meta (format + codec_string); config.go adds codec config fields.
Go server (betterdesk-server): cdap_handlers.go + cdap/desktop.go thread the codecs[] / video_codec fields through desktop_start so operator codec advertisement reaches the agent.
Tauri agent-client: config.rs/sidecar.rs/commands.rs codec plumbing, SettingsPanel codec dropdown + en/pl/zh i18n, refreshed agent sidecar binary.
Note: AV1/VP9 still require WebCodecs (HTTPS/localhost); H.264-over-MSE covers the plain-HTTP case. Self-signed HTTPS (installer SSL menu option C) unlocks all codecs. Fully backward compatible.
This commit was made possible thanks to Insolve.
The Tauri externalBin config requires binaries/betterdesk-agent-<triple>.exe to exist at build time. build.rs only cross-builds the Go sidecar when the betterdesk-agent source is a sibling, which is absent in the build worker's work dir. Pre-staging the Windows sidecar (mirroring the committed Linux one) unblocks the windows/exe NSIS build in the agent-build pipeline.
This commit was made possible thanks to Insolve.
App.tsx now loads the per-deployment branding profile (get_branding IPC) during boot and applies it to the document: primary/accent colors map onto the existing --accent CSS variables, product name becomes the document title, and an optional logo data URL becomes the favicon. New src/lib/branding.ts exposes loadBranding()/getBranding() with safe fallbacks to built-in BetterDesk defaults so unbranded developer builds still render.
install-build-toolchain.sh now installs the x86_64-pc-windows-msvc Rust target instead of windows-gnu, because the build worker cross-compiles Windows installers via cargo-xwin (MSVC ABI). The previous gnu target caused every windows/exe build to fail with 'Target x86_64-pc-windows-msvc is not installed'.
This commit was made possible thanks to Insolve.
.gitignore: scope /lib/ and /lib64/ to repo root only — was matching Tauri src/lib directories. Go server: re-issue device_token on re-registration so agents that lost config can recover auth. Go agent: emit SESSION_START/SESSION_END stdout events for overlay integration, handle DESKTOP_STOP stdin command.
This commit was made possible thanks to Insolve.
The boot path in lib.rs only fires the sidecar auto-start when the device is already registered at app launch. For a freshly-installed agent the user completes the Setup Wizard while the app is running, so the auto-start gate is evaluated as false and the Go CDAP sidecar never starts until the next app restart — leaving the StatusPanel stuck on 'Not configured'.
Hook sync_initial_config (the wizard's last step) so that as soon as the device is registered and auto_start_sidecar is enabled, the managed Go agent is spawned through the same SidecarManager path used at boot. This bypasses the OS-admin gate on start_sidecar (which only guards the user-facing IPC), matching the boot-time auto-start behaviour.
This commit was made possible thanks to Insolve.
- Implemented server management service providing resource snapshots, file browser, service control, and audit logging.
- Added terminal proxy for WebSocket-backed PTY, allowing browser-based shell access with user authentication and role-based access control.
- Created server management view with tabs for overview, terminal, file management, and services, including UI elements for displaying system metrics and managing files/services.
Co-authored-by: Copilot <copilot@github.com>
Update rustls-webpki 0.103.12 → 0.103.13 in both Tauri application
crates to fix a reachable panic in CRL parsing (Dependabot alert).
Also commit Cargo.lock files for both Tauri apps — per Rust best
practice, application crates should version-lock dependencies for
reproducible builds and accurate Dependabot scanning.
Changes:
- betterdesk-agent-client/src-tauri/Cargo.lock: added (rustls-webpki fixed)
- betterdesk-mgmt/src-tauri/Cargo.lock: added (already on latest)
- .gitignore: stop ignoring Cargo.lock for application crates
Remaining Dependabot warnings (20) are all unmaintained GTK3 bindings
from Tauri 2.x on Linux — unavoidable until Tauri migrates to GTK4.
Refs: Dependabot alerts, #103 (cc @SterlynKong @dgmw-sys)
- deployServerBinary: use rename(2) for atomic replace, fixes ETXTBSY
when target Go binary is busy (Linux kernel handles inode swap).
Falls back to copyFileSync on cross-device rename or non-Linux.
Windows: rename target out of the way first, then move new in.
- settings.js: mark 'server' phase as error when build succeeded but
deploy failed (was incorrectly marking 'done' from build alone).
- settings.js: completion modal now shows error title, error message
and pre-formatted stderr when serverDeploy.success === false.
- i18n: added complete_with_errors, modal_done_with_errors_title in
en/pl.
Multiple coordinated changes: frontend, backend (Tauri Rust), and web server.
Key points:
- Web remote unified to /remote/🆔 redirects legacy /remote-desktop, updated device actions, and removed old viewer rendering.
- Added adaptive quality to RDClient to avoid low-FPS stalls and defaulted to Balanced@30 with runtime promotion/demotion logic.
- Fixed session/tab cleanup to avoid stale tabs and made session teardown more robust.
- Improved agent startup responsiveness: get_agent_status now avoids slow SystemSnapshot::collect(); added a separate get_system_info command for expensive telemetry. Frontend invokes now use timeouts and parallel checks so the UI never hangs, and SetupWizard normalizes addresses before validation.
- Windows privilege check changed to CheckTokenMembership against Administrators group so menu items remain visible to admin users even without UAC elevation; tray menu items are always visible and checked on click.
- Registration/probing: server scheme (HTTPS vs HTTP) is probed and cached; API URL builder updated accordingly.
- UI/UX: added bottom navigation bar, help-session event handling, diagnostics feedback, locale display name support, CSS updates (including bundling Material Symbols font); included material-symbols-rounded.ttf and adjusted CSP to allow fonts.googleapis.com / fonts.gstatic.com.
- Added docs/PATCH_PLAN_2026-04-18.md with patch plan and rationale.
These changes aim to make the desktop agent snappier at startup, unify the web remote entrypoint, improve remote streaming stability, and harden privilege/UX behaviors.
Add OS-level admin detection and use it to gate sensitive agent UI and tray actions. Introduce privileges.rs (Windows TokenElevation / Unix geteuid) and expose is_os_admin as a Tauri command; wire it into tray setup to hide admin-only menu items (Settings, Quit) and re-check privileges before executing those actions. Add show_window helper and emit navigate events from the tray; frontend listens for navigate and conditionally renders /settings (shows AdminRequired component for non-admins). Update App.tsx to query is_os_admin on startup and include navigation listener; add AdminRequired component, styles, and i18n keys. Update Cargo.toml with platform deps (windows features + libc for unix). Also add UI/locale assets and CSS for agent lazy-loaded device tabs and a notifications dropdown, plus several web-nodejs route/view/style updates and new task docs describing phase work.
Centralize HTTP client creation and add an opt-in TLS hardening gate (BETTERDESK_STRICT_TLS). Refactor repeated reqwest::Client::builder() usages into helper builders that warn once when self-signed certs are accepted and allow enforcing strict validation. Apply changes across agent-client and management codepaths (registration, commands, inventory collector, bd_registration). Also: warn when native agent is configured with plaintext ws:// to non-local hosts, whitelist LOG_FORMAT env var to {"text","json"} in server config, and update the audit docs to reflect these fixes.
Multiple security and maintenance fixes across components:
- betterdesk-mgmt: validate peer_id format to prevent injection in connect_to_peer (reject empty/oversized/invalid chars).
- betterdesk-mgmt (tauri.conf.json): tighten CSP by removing 'unsafe-eval' from script-src.
- betterdesk-agent-client: increase device ID entropy from 4 to 8 bytes (BD- prefix) to reduce collision/brute-force risk.
- betterdesk-server: enforce RBAC (operator+) before upgrading CDAP video WebSocket to block unauthorized access.
- betterdesk-server DBs: exclude soft_deleted peers in GetPeer queries for Postgres and SQLite.
- web-nodejs: add audit log housekeeping (hourly cleanup), add indices for audit_log, and implement cleanupOldAuditLogs(days) in sqlite adapter.
- web-nodejs brandingService: validate logo/favicon URLs to allow only http(s) or relative paths, preventing javascript:/data: XSS/SSRF vectors.
- docs: add AUDIT_BETTERDESK_2026-04-17.md (security audit summary).
These changes tighten client CSP, improve input validation, increase device identifier entropy, ensure RBAC is enforced before websocket upgrades, hide soft-deleted peers from normal queries, and add audit log maintenance and DB indexes for better performance and retention management.
Adds a full Phase-52 RBAC implementation and multiple server/frontend fixes. Key changes: new auth/permissions.go with 28 granular permissions and DefaultRolePermissions, expanded 7-role hierarchy and helpers in auth/roles.go, JWT org context and GenerateOrgToken, requirePermission/requireOrgMembership middlewares (Go + Node.js), DB schema & adapter changes for role_permissions and is_server_admin, org role boundary checks and peer org scoping, and guards for last-admin demotion and self-demotion. Also: TCP EOF/connection-reset log filtering in signal/relay servers, improved startup banner port display, KEYS_PATH auto-detect warning, CSS hover/transition layout fixes, admin password race mitigation, ID-change ghost peer cleanup, added Tauri ACL schema files, and a new RBAC_PHASE52.md doc. Misc: numerous web-nodejs i18n, CSS, JS and route updates and an updated .github/copilot-instructions.md timestamp/summary.
- Add zh-TW translations for web console, agent client, and MGMT client
- Update VALID_LANG_CODE regex to support BCP 47 tags (e.g. zh-TW)
- Add zh-TW to LANGUAGE_META in i18nService
Introduce two new desktop apps: betterdesk-mgmt (operator/admin console) and betterdesk-agent-client (lightweight endpoint agent).
Key changes:
- Add complete betterdesk-agent-client scaffold: frontend (index.html, TSX components, i18n, styles, Vite/TS configs, package.json) and Rust Tauri backend (Cargo.toml, build.rs, tauri.conf.json, commands.rs, config.rs, registration.rs, sysinfo_collect.rs, NSIS language file).
- Add betterdesk-mgmt entries and assets (registered in docs) and update repo docs to describe both MGMT and Agent clients.
- Update .github/copilot-instructions.md to reflect MGMT/Agent client split and add detailed TODO/feature lists.
- Update .gitignore to exclude build artifacts for both new Tauri apps.
- Add docs/new_agents/client1.md and docs/new_agents/client2.md.
- Minor changes to server DB files and web-nodejs i18n/asset files.
This commit adds the initial scaffolding and core IPC/registration/diag features for the agent and registers the MGMT client in repository docs; further implementation and testing remain.
UNITRONIX