QuMesh v1.4.1

A fix-only release. Everything here lands on the redirection path —
KVM, Serial-over-LAN, and IDE-R — plus the WSMAN Digest client
underneath them. No new features, no configuration changes.

KVM sessions died the moment consent was granted

Connecting to a consent-gated machine failed with "The remote host
closed the connection" as soon as the operator typed the 6-digit PIN,
and the target then refused further connections until the ME settled.
Two independent defects fired at that same instant.

The display buffer overflowed on large desktops. AMT caps its KVM
buffer at 9,216,000 bytes. QuMesh pinned 16-bit RGB565 unconditionally,
which at 3840x2160 asks for 16.6 MB — 1.8x over the limit. The firmware
doesn't report the overflow; it drops the socket. The pixel format is
now chosen to fit: QuMesh picks the richest format the desktop can hold
(16-bit where it fits, 8-bit RGB332 above that), re-picks on a resize,
and a desktop too large even for 8-bit now fails with a message naming
the limit instead of hanging up mid-handshake. A Colour menu on the
KVM panel lets you override the choice, and shows when 8-bit was
selected for you.

Consent was revoked the instant it was given. Sending the PIN moves
AMT to RECEIVED; only a live redirection session reaches
IN_SESSION. The gate tested for IN_SESSION alone, so a freshly
accepted code still read as "consent needed" and re-issued the request
— cancelling what had just been granted, in an uncapped loop that
hammered an ME which accepts very few concurrent sessions. Consent is
now an explicit state machine: both satisfied states are accepted, the
request is non-reentrant, consecutive failures are capped, the status
poll won't overlap itself, and a pending request is cancelled when the
window closes. Redirection now waits for consent to clear rather than
racing it.

"KVM only" consent policy no longer prompts for Serial Console

AMT's OptInRequired is a tri-state — not required, required for KVM
only, or always required — and QuMesh flattened it to a yes/no. That
was harmless while consent gated KVM alone, but the fix above routes
SOL and IDE-R through the same gate, so a machine set to KVM only
started throwing a consent PIN onto the target's local screen for
Serial Console sessions that need none. The policy value now carries
through intact and is evaluated per protocol. An unrecognised value
errs toward asking.

KVM picture froze instead of reporting a bad stream

A stream desync producing an implausible block length parked the
decoder waiting for data that would never arrive: no further frame
requests went out and the picture simply stopped, with no error shown.
Block lengths are now bounded against what a legitimate block could
need for that rectangle and colour depth, and an over-length block ends
the session with a visible error. Also fixes a length comparison that
could overflow on very large values.

WSMAN requests could hang forever, or retry a bad password endlessly

Two defects on the Digest authentication path:

• Unbounded 401 retries. A persistent 401 — a wrong password being
  the realistic trigger — looped connect → 401 → connect indefinitely,
  opening a fresh TCP connection each bounce. Retries are now capped
  per request, with one extra attempt allowed when the server reports a
  stale nonce, since that invalidates an attempt through no fault of
  the credentials.
• No timeout on pre-authenticated requests. The request timeout was
  only armed on the first, unauthenticated path. Once a Digest
  challenge was cached, every subsequent request ran with no timeout at
  all — so a device that went quiet left the request outstanding
  forever and the UI stuck on "busy" rather than failing. The timeout
  is now armed on every path and bounds the whole request including
  retries.

A related race is fixed alongside: the Digest nonce counter is rewound
only when the nonce actually changes, so two concurrent replies can no
longer send the same counter value against one nonce and trip a
server's replay check.

Session diagnostics you can actually attach to a bug report

Redirection failures previously surfaced as a generic Qt socket string
with no indication of which protocol phase had failed. QuMesh now
records a full session transcript — state transitions, session-reply
status, authentication capabilities, the KVM setup round-trip, TLS
trust outcomes, and a phase-tagged line at the point of failure.

Warnings and once-per-session facts are on by default; the phase-by-
phase transcript is behind an environment variable:

QT_LOGGING_RULES='qumesh.*=true' QuMesh

Because these logs get pasted into public issues, secrets are redacted
by construction: the Digest realm and nonce are logged as present or
absent only (the cnonce and response never at all, since together they
would permit an offline attack on the AMT password), the consent PIN is
replaced with a marker, KVM settings log key names without values, and
nothing from the SOL byte stream is recorded — it carries whatever is
typed at a login prompt. A test asserts known secrets never reach the
log.

This release also fixes an existing leak that needed no environment
variable to trigger: a KVM decompression failure hex-dumped 32 bytes of
the compressed block, which is remote screen content, at warning level.
It now logs the 2-byte header only.

Build

Release builds move to Qt 6.9.3 on all platforms, matching CI. Earlier
Qt versions reference the AGL framework Apple removed from the macOS 26
SDK, which breaks the macOS link.

Upgrading

• macOS — Check for Updates… from the QuMesh menu, or grab the
  .dmg from the Releases page.
• Windows — Check for Updates… from the menu, or download the
  .exe from Releases.
• Linux — sudo apt update && sudo apt upgrade qumesh if you've
  added the repo (snippet in the v1.2.0 notes). Otherwise grab the
  .deb matching your distro / architecture from the Releases page.

Install

• macOS — drag QuMesh.app from the .dmg to Applications. The bundle
  is Developer ID signed, notarized by Apple, and the notarization
  ticket is stapled to the .dmg, so it opens normally on first launch.

• Windows — run the .exe installer. SmartScreen will warn that the
  publisher is unverified; click "More info" → "Run anyway".

• Linux (Debian 13 / Ubuntu 26.04, amd64 or arm64) — preferred
  path is the APT repo so apt handles upgrades. The snippet picks
  the right suite (ubuntu26.04 / debian13) from
  /etc/os-release:

  . /etc/os-release
  SUITE="${ID}${VERSION_ID}"
  
  curl -fsSL https://benmcollins.github.io/QuMesh/apt-pub.asc | \
      sudo tee /etc/apt/keyrings/qumesh.asc > /dev/null
  echo "deb [signed-by=/etc/apt/keyrings/qumesh.asc] \
      https://benmcollins.github.io/QuMesh $SUITE main" | \
      sudo tee /etc/apt/sources.list.d/qumesh.list
  sudo apt update && sudo apt install qumesh
  

  Or grab the matching .deb below and sudo apt install ./qumesh_*.deb.

Full changelog