Remote Desktop

Terminality includes an RDP client backed by IronRDP. It is an independent, immutable Host family — never shares credentials or endpoints with SSH, SFTP, or FTP.

Protocol Support

• IronRDP backend with a patched TLS adapter: per-connection policy, handshake signature checks, no resumption, no key logging.
• Direct and RD Gateway transport.
• NLA default — legacy TLS fallback requires explicit opt-in per profile.
• Dynamic display resize through the bounded input path.

Certificate Trust

• First-use pinning: on first connection, the SHA-256 leaf certificate is presented for review. Approval stores the exact pin; a changed leaf re-triggers review.
• System-trust mode: normal chain and DNS/IP-name validation.
• Destination pin ≠ gateway pin: an RD Gateway uses its own trust record.

Credential Separation

Record	Scope
RDP Host Profile	Endpoint, display options, certificate policy
Target Credential	Opaque ID → separate encrypted vault record
RD Gateway Credential	Separate opaque ID — never shared with target

Host duplication scrubs the gateway reference. Secure deletion tombstones both credential records.

Channel Restrictions

• Clipboard and drive redirection channels are not compiled in this build — imported requests fail closed.
• Input/output queues are bounded.
• Connect and close have explicit deadlines.

Frame Protocol

RGBA frames use a specialized binary channel (TXRF) tagged with connection generation and frame sequence:

• Header validation: dimensions, bounds, stride, length, version, trailing data — all checked before painting.
• Stale frames (wrong generation) are dropped.
• Renderer destruction releases native frame subscriptions even when normal React cleanup cannot run.

Lifecycle

RDP Pane mounts
  → RemoteDesktopPaneViewModel (keyed child)
  → RemoteDesktopSession (generation-guarded)
  → IronRDP backend (transport, credentials, cert policy)
  → TXRF binary frames → Canvas presentation

Connect, disconnect, resize, and shutdown are all owned by the Rust session.