Cada lanzamiento, en la red.

Settings → Audio output device picker + Linux AppImage/RPM + zsync delta updates + GPG-signed RPM

• NEWSettings → Audio now exposes an OUTPUT device picker alongside the existing input picker — route remote-session audio through specific headphones / USB DAC instead of always-system-default. Backed by the GoDesk `main_get_sound_outputs` FFI (mirror of upstream's input enumeration; cpal on Win/Mac, PulseAudio sinks on Linux). Closes the last item from the v0.13.29 post-ship code audit.
• NEWLinux now ships in 3 formats: `.deb` (Debian/Ubuntu, primary), `.AppImage` (single-file double-clickable, 38 MB), `.rpm` (Fedora / RHEL / openSUSE, 30 MB). Previously the .deb was the only Linux artifact; AppImage + RPM were both mailto-waitlist links on /download.
• NEWAppImage now embeds zsync update-info pointing at `GoDesk-latest-x86_64.AppImage.zsync`. Existing AppImage installs get delta updates via `appimageupdatetool` instead of re-downloading the full 38 MB every release.
• NEWRPM is now GPG-signed (`GoDesk Release Signing` key, RSA-4096, fingerprint 41C27D40…22729A80). Fedora/RHEL/openSUSE users import the public key from `/dist/GODESK-GPG-KEY.asc` once and subsequent `rpm -K *.rpm` returns 'digests signatures OK'.
• BETTERBoth `build-desktop-{macos,linux}.sh` scripts now derive their default VERSION from `pubspec.yaml` instead of a hardcoded `0.13.18` — eliminates the per-release manual rename step that bit us on v0.13.32-34.
• BETTER`build-desktop-windows.ps1` now probes default NSIS install dirs (`C:\Program Files (x86)\NSIS\`) when `makensis` isn't on $PATH, and throws instead of silently skipping packaging — previously a missing makensis produced a 'successful' build with no installer file.

RealBridge file-transfer UI population (transfers actually show progress now) + build-script hardening

• FIXFile transfers under the real bridge now actually show progress / Cancel / done indicators on the Files screen. Previously the queue stayed empty even when files were transferring fine on the wire — `addTransfer` queued the file with Rust but never inserted a `TransferItem` for the UI. Now `addTransfer` adds the row immediately and three new event handlers (`job_progress` / `job_done` / `job_error`) mutate it in place. Bidirectional id mapping makes Cancel-after-retry work too (was a silent no-op before).
• BETTERAll build scripts (Windows PowerShell + macOS bash + Linux bash) now derive their version default from `pubspec.yaml` and probe canonical NSIS install paths — release pipeline self-corrects artifact filenames and fails loud on missing tools instead of silently shipping broken builds.

Bridge + UI hardening — 6 fixes from the v0.13.29 post-ship code audit

• FIXRealBridge.dispose() is now async — awaits subscription cancels + calls `_hardTeardownSession` before closing controllers. Closes 'add after close' on app shutdown mid-session + the native session + GPU texture leak.
• FIXSession event listener gained an id guard — late `peer_info` / `connection_ready` events from a torn-down session can no longer resurrect state or re-fire connect events for a peer the user already disconnected from.
• FIXRight-click and middle-click RELEASE on the remote frame now actually release the right/middle button — previously `onPointerUp` was sending a left-button-up regardless (forced bit-0 on the button mask), so right-click context menus never dismissed.
• FIXAddress-book Add-machine dialog disposes its 3 text controllers on the Cancel path too — previously dispose only ran on Save, so every Esc/outside-tap leaked controllers.
• FIXConnecting overlay's reduce-motion handling moved from `build()` into `didChangeDependencies()` — AnimationController status listeners no longer trigger setState during build.
• FIXSettings → Logs `_refresh()` guards against `setState` on disposed State after the file-read await — fixes the warning when the user navigates away mid-load.

Permanent password UI in Settings → Security (fixes 'Remember password' on reconnect)

• NEWSettings → Security now has a permanent-password setter. The controller's 'Remember password' previously couldn't persist usefully because the controllee defaulted to a 6-minute rotating one-time password — the saved hash was invalid as soon as the OTP rotated. With a permanent password set, the controller's Remember actually works across sessions.

Recording lag fix (AV1 → VP9) + drag-drop file destination

• FIXToggling REC on the controller no longer causes mouse-lag-during-recording. Two layers: (a) the controllee's video service no longer restarts on REC toggle (previously a `bail!('SWITCH')` tore down + restarted the entire encoder loop, ~300 ms freeze + QoS reset), (b) when recording, the encoder picks VP9 instead of AV1 — AV1 SW-encode on M-chip MacBooks burns a CPU core, and the resulting .webm can't be played by Windows Media Player without the AV1 Video Extension. VP9 is universally playable + ~2-3× cheaper to SW-encode.
• NEWDrag-drop a file into the live remote-desktop view now lands the file on the remote DESKTOP (matching TeamViewer / AnyDesk UX) instead of always `~/Downloads`. The explicit 'Send file' picker still lands in `~/Downloads`. The queued-files snackbar spells out the destination subdir + peer hostname.

Translator catch-up (Win-only) for 2 late-added ARB keys

• FIXTwo ARB keys (`lightSessionRecordingSaved`, `lightSessionShowInFolder`) were added AFTER the v0.13.30 OpenAI translator pass for es/pt/fr, so the recording-saved toast rendered English under those locales. Re-ran the translator. Windows-only spin (Dart-only change).

Recording folder rebrand + ConnectingOverlay i18n fix + Win→Mac black-screen regression fix

• FIXRecording folder renamed from `~/Videos/RustDesk/` to `~/Videos/GoDesk/`. The session toolbar shows a 'Recording saved to … [Show in folder]' toast on REC stop.
• FIXWin→Mac black-screen-after-connect regression that turned out NOT to be the v0.13.27 light re-skin — root cause was a stale `mode='terminal'` saved in the peer's options TOML (residue from an earlier-era test). The controller was sending a Terminal LoginRequest, the Mac started terminal_service instead of video_service, so the controller showed a black texture. Fixed two ways: (a) Dart guard in `_connectPeer` validates the saved mode against the surfaced set (fullControl / viewOnly) and re-writes to fullControl if it sees a stale value; (b) the peer toml on the test machine was patched.
• BETTERConnectingOverlay i18n — was rendering Turkish text while the rest of the UI was English, root-caused to a missed ARB key during the light re-skin. Translator picked it up.

Android Direct APK rebuild — Russian locale fix, GoDesk-branded launcher icons, full 3-ABI native bundle

• FIXAndroid: Russian system locale was rendering Arabic onboarding instead of falling back to English. Root cause was Flutter's default `basicLocaleListResolution` returning `supportedLocales.first` for unmatched languages — and gen-l10n sorts ARB files alphabetically, so `app_ar.arb` happened to be index 0. Added an explicit `localeListResolutionCallback` that walks the device's preferred-locale list, matches by languageCode, and falls back to `Locale('en')` cleanly.
• FIXAndroid: launcher icon was the default cyan-blue Flutter placeholder, not the GoDesk brand mark. Replaced with the amber (#f0a020) + cream (#f0e8d8) brand mark from `branding/godesk-window-favicon.svg` — generated 5 ic_launcher.png densities (mdpi/hdpi/xhdpi/xxhdpi/xxxhdpi) plus 5 ic_launcher_foreground.png at adaptive-icon densities (108..432px with 16% Material safe-zone inset), plus mipmap-anydpi-v26 adaptive-icon descriptor referencing the cream background color.
• FIXAndroid: previous APK was 124 MB but rebuild produced only 54 MB without the rustdesk native core. Native libs (`librustdesk.so` for arm64-v8a/armeabi-v7a/x86_64) live in `~/godesk-client/jniLibs/` from cargo-ndk but the Gradle source-set expected them at `flutter_godesk/android/app/src/main/jniLibs/`. Copied them into the right location + renamed the typo'd `liblibrustdesk.so` (arm64) to `librustdesk.so`. Final APK is 130 MB with all 3 ABIs bundled.
• FIXAndroid: build was failing with Jetifier transform error on byte-buddy-1.17.5.jar (`Unsupported class file major version 68`). byte-buddy 1.17.5 is compiled for Java 24, which Jetifier's bundled ASM doesn't understand. Set `android.enableJetifier=false` in gradle.properties — safe because all transitives are already AndroidX-native.
• ADRBuild pipeline: native Windows Flutter (`C:\src\flutter\bin\flutter.bat`) doesn't accept UNC paths as cwd (CMD limitation), and WSL's flutter expects Linux-native Java + Android SDK. New build flow: robocopy from `\\wsl.localhost\...` to `D:\godesk-build-tmp\`, build there, scp APK back. Documented in wiki/log.md so the next builder doesn't repeat the discovery.

Reality-Checker UI audit response — 12 dead controls fixed, 6 documented for next Rust patch round

• FIXSecurity/trust: View-only mode chip now actually enforces view-only on the remote session. Previously the chip wrote a key the Rust core ignored, so users got a full-control session despite picking view-only.
• FIXSettings → Image Quality: Eco / Balanced / Quality / Lossless presets now apply to every connect. Previously persisted to a key with zero readers.
• FIXSettings → General → Startup: Launch-at-login wired through `launch_at_startup` (writes the platform-native autostart record). Check-for-updates re-keyed to the option Rust actually reads.
• FIXSettings → Defaults: 6 of 11 toggles now apply on connect via per-session option toggles (show-cursor, mute-audio, lock-on-end, view-only, hide-wallpaper, clipboard). 4 still cosmetic, scoped for next round.
• FIXSettings → Network → Proxy: each save now calls `mainSetSocks` so the proxy is applied at runtime instead of just being persisted to options.json (where the runtime path ignored it).
• FIXSettings → About: IPC + E2E status panels reflect the live FFI bridge state instead of a hardcoded `ok: true`. They'll go red if the Rust core stops responding.
• FIXSession → FIT cycle button: choice now persists across sessions via a dedicated `godesk-display-fit-last` key.
• FIXSession → MORE → REBOOT: shows a follow-up message if the remote doesn't reboot in 30s (typical cause: controllee not running with admin rights).
• NEWSettings → General → Language: manual locale picker added (System default + 12 native names). Previously the app only respected the system locale, so users on Russian Windows couldn't preview the German / Polish / Turkish translations we ship.
• NEWgodeskflow.com/c/<slug>: invite links now actually resolve. Decodes the embedded peer ID + OTP and offers a deep-link into the GoDesk client. Previously these URLs returned 404.
• NEWSettings → Network → Custom HTTP headers: hidden — no Rust consumer existed for the option, so the field was deceptive. Will return when the consumer ships.
• NEWAuth gate: dart-define flags for Supabase URL + anon key are now baked into every Win build. Earlier v0.13.4 build silently shipped without them, bypassing the AuthScreen entirely. The 12 client locales now correctly land on email-OTP for first-run.

P1+P2 client UX polish — Simple/Advanced settings, mode chips, empty-state coaching, LCD palette differentiation

• NEWSettings has a Simple/Advanced toggle. Power-user sections (Network, Defaults, Encryption, Logs) hide by default and persist your choice across launches.
• BETTERConnect-mode chips reduced to [Full control] [View only] + Advanced ▾. File-transfer / TCP / RDP / Terminal modes still available, just one tap deeper.
• BETTERSession toolbar advanced ops (Privacy / Lock / Reboot) collapsed behind a single MORE ▾ menu. Reboot is visually flagged as destructive.
• BETTERLCD palettes differentiate by purpose: green for IDs and connection state, amber for file-transfer throughput, blue for diagnostics + encryption readouts.
• NEWEmpty-state coaching banner on Home shows ID-sharing tip when peer list is empty. Dismissible and persisted.
• NEWConnecting overlay stage labels (Resolving / NAT traversal / Encrypting / Connected) now i18n-keyed across all 12 locales.
• NEWAuthScreen has a Quit GoDesk option for users who don't want to authenticate.
• FIXAudio volume + mic-gain controls switched from rotary knobs to sliders — async cursor tracking on knobs felt unresponsive.
• NEWConcurrent-session enforcement live: tier limits (Free 1 / Lite 1 / Pro 3 / Team 10) gate at connect time via the active_session_count Supabase RPC. 30-minute stale-session window protects against crashed clients.

Interactive-control audit + sound-output FFI + macOS notarization

• FIXOnboarding GRANT buttons now actually request OS permissions (Accessibility / Screen Recording / Input Monitoring on macOS). Earlier builds toggled a local boolean — gate could be passed without granting anything.
• FIXVolume + Mic-gain knobs in Settings → Audio now persist their value across restarts (godesk-audio-volume / godesk-audio-mic-gain options).
• NEWmacOS .dmg signed by Developer ID Application: UPDEVTEAM LTD — notarized + stapled by Apple. spctl reports 'Notarized Developer ID'.
• NEWSound-output FFI: Settings → Audio → Output device picker now enumerates real devices via cpal/PulseAudio.
• BETTERWindows installer (NSIS) bundles librustdesk.dll directly. v0.9.5 → v0.13.1 jump caught it missing.

Full per-screen i18n coverage — Settings, Onboarding, Invite Manager

• NEWOnboarding (38 keys), Invite Manager (20 keys), Settings (26 keys: tabs + section labels + buttons) all read from AppLocalizations. 9 locales updated in lock-step.
• NEWmain_get_sound_outputs FFI exported from the Rust core. Linux uses a new get_pa_sinks helper (mirror of get_pa_sources).

Phase F — tray status icon + client-side ban check + per-screen i18n start

• NEWTray menu now shows live account state (email, tier badge, device count) and a Sign out leaf wired to Supabase signOut.
• NEWis_account_banned Supabase RPC + client-side gate. Banned accounts can't open new sessions even with device-count headroom.
• NEWAuthScreen, Home tier banner, Connecting overlay password form, Session toolbar tooltips, Files toolbar buttons all i18n-keyed.
• FIXEmail field couldn't accept the letter 'O' (global keyboard handler ate it). Skip global shortcuts when EditableText has focus.

Phase C/D/E — account enforcement, sessions audit, i18n scaffold

• NEWTier limits config table seeded (Free 30 devices / Lite 50 / Pro 200 / Team unlimited). RealBridge.connect() pre-gate refuses dials when the device cap is hit.
• NEWSessions audit telemetry — every successful connection inserts a row into Supabase 'sessions' with peer IDs + duration. Failures silent (don't kill an in-flight session if Supabase is down).
• NEWi18n scaffold for 9 locales: en, es, pt, fr, ar, hi, id, vi, zh. flutter_localizations + intl wired in main.dart.
• NEWTier usage banner pinned above YOUR ID — used / cap devices + amber-at-80% upgrade prompt.

Phase A — Supabase magic-link auth + interactive-control audit

• NEWSupabase project (eu-west-1) — accounts, devices, subscriptions, sessions audit, ban_list. Magic-link OTP via Supabase signInWithOtp; AuthScreen accepts both 6-digit token and full URL paste.
• NEWComprehensive interactive-control audit: VIEW + FILES session-toolbar buttons wired, retryTransfer re-issues sessionSendFiles from _transferOrigins, defensive try-catch wraps every input handler.
• FIXMouse jitter (was 1000+ Hz pumping FFI). 8 ms throttle = 120 Hz on the wire.

ScreenCaptureKit migration — replaces CGDisplayStream on macOS Tahoe

• FIXApple killed CGDisplayStream on Tahoe — Capturer::new succeeded but no frames came back. New ObjC bridge (libs/scrap/native/macos_sck/sck_bridge.{h,m}) exposing C ABI to Rust. Verified 25 fps capture.
• BETTERPermission prompts (Accessibility, Screen Recording, Input Monitoring) fired at startup instead of mid-session for clearer UX.

Mac↔Win remote-desktop end-to-end on godeskflow.com infra

• NEWMigrated rendezvous + relay off rustdesk.com onto self-hosted hbbs/hbbr at id.godeskflow.com / relay.godeskflow.com.
• NEWSingle-binary architecture (ADR-014): try_start_cm bypassed when CM binary missing, desktop_changed loop bypassed in user-mode GUI launch.
• NEWmacOS Hardened Runtime + cs.disable-library-validation so dlopen of librustdesk.dylib works under notarization.

Address book — ADD PEER, hotkeys, latency graph, inline logs

• NEWADD PEER dialog with OS picker + ID validation. Address book persists via bridge.upsertPeer / forgetPeer.
• NEWLatency sparkline panel (live diagnostics stream).
• NEWHotkeys: Ctrl+L for ID input focus, Ctrl+1..9 for display switch in active session.

Drag-drop, sort menu, inline theme controls, multi-monitor

• NEWFiles screen: drag-drop file paths from explorer, drag handle to reorder transfer queue.
• NEWSettings → General → inline theme controls (dark mode toggle, accent palette, LCD palette, intensity slider).
• NEWMulti-monitor support: switchDisplay FFI + display switcher PopupMenuButton in session toolbar.