v0.9.8 — lock while away (--lock-on-disconnect + --auto-unlock)

Lock while away: --lock-on-disconnect + --auto-unlock

A feature release for headless, remote-only Macs, plus a real --shield-primary bug fix. Everything new is opt-in; the default runtime path is unchanged.

#181 — lock when you leave, unlock when you come back (experimental, @antonmos)

--lock-on-disconnect (config LOCK_ON_DISCONNECT=1) locks the Mac about 25 seconds after the last RDP client leaves, so a remote-only Mac isn't left sitting unlocked between sessions. It needs one of the headless modes (--detach-primary, --capture-primary or --shield-primary). The delay is a cancellable buffer, so a blank-recovery reconnect coming back within it doesn't get locked under it.

It locks by starting the screen saver — the old CGSession -suspend trick no longer exists on macOS 26 — which is only a real, password-required lock when System Settings → Lock Screen → "Require password after screen saver begins" is set to Immediately. macrdp warns at startup when it isn't.

--auto-unlock (config AUTO_UNLOCK=1) types your account password into the lock screen when a client connects while the Mac is locked — the same password macrdp validated at startup and the client proved when it authenticated. It is off by default for a reason: it acts on the physical Mac. Once it fires, anyone at the machine has a live desktop, and it will undo a lock it didn't set.

Its safety properties, since a wrong password here costs a macOS attempt:

• a shared budget of 2 password submissions per lock, below macOS's three free attempts, reset only when the unlock is confirmed;
• it skips rather than guesses when Caps Lock is on, the active keyboard layout can't type a character, or the lock state can't be read;
• every character is resolved to a keystroke before anything is typed.

Live-verified on a Mac mini (M1, macOS 26.5). Earlier passes, run over ZeroTier from another island with nobody at the machine, found two bugs — a detection window too short for the mini's unlock, and a false "gave up" that left the next lock impossible to undo remotely. Both were fixed before merge; the final pass ran 4/4 lock/unlock cycles cleanly.

#188 — GUI toggles

The menu-bar controller's Display tab gains a Lock while away section with both options. They're disabled and cleared unless a Detach/Blank mode is picked, and you get a warning if the lock is on without auto-unlock. The controller ships in macrdp-0.9.8-usb.dmg below; it isn't in the .app.zip or the tarball, so otherwise build it with gui/make-tray-app.sh.

#187 — --shield-primary works on a lid-closed MacBook (@antonmos)

A closed lid removes the built-in panel from the display list entirely, so the shield failed with "no physical display to shield". Because that failure only produced a log warning, it silently disabled three things at once — the shield, --restore-windows-on-disconnect and the connect-time window gather — while the RDP session itself kept working. It now degrades cleanly to an empty shield.

Known issue

With --lock-on-disconnect, a reconnect started roughly 12–22 seconds after you leave can be locked mid-handshake: a connection only counts as "back" once it has fully connected. With --auto-unlock on, it unlocks again about 3 seconds later. With the lock alone, a remote user lands on a lock screen they can't get past — which is why the GUI warns about that combination. A fix is tracked as a follow-up.

Repository hardening

.github/CODEOWNERS with required code-owner review on main, CI on fork pull requests gated on approval for all outside collaborators, and SHA pinning of GitHub Actions enforced. No runtime change.

Verified before tagging

Stable and nightly cargo fmt --check, cargo clippy --all-targets -- -D warnings, and the full test suite (212), all clean.

Artifacts

• macrdp-v0.9.8-aarch64-apple-darwin-app.zip — the macrdp.app bundle (Apple Silicon). Ad-hoc signed, so right-click → Open on first launch (or build a locally-notarized bundle with packaging/make-app.sh). Includes the smart-card IFD handler + helpers.
• macrdp-v0.9.8-aarch64-apple-darwin.tar.gz — the bare macrdp binary.
• macrdp-0.9.8-usb.dmg — signed + notarized, containing both macrdp.app (with the USB host-controller entitlement, needed for --enable-usb-redirection, which no-ops in the ad-hoc .app.zip) and the macrdpController.app menu-bar controller. Drag both to /Applications; being notarized, they open without the right-click → Open step. Apple Silicon.
• SHA256SUMS — covers all three files; shasum -a 256 -c SHA256SUMS to verify.

Full narrative notes for every release: docs/release-history.md.

Full Changelog: v0.9.7...v0.9.8