v0.21.1

What's Changed

Fixed

• Connections that authenticate with a key waited on a vault lookup before every connect, then warned about the password they never wanted (issue #307) — a user whose hosts are all key-authenticated, with no stored passwords at all, paid a full vault round trip each time. Against the Bitwarden CLI that is several seconds, because it decrypts on every read, and the answer was the same every time: nothing here. The wait then ended in "Vault entry not found. You will be prompted for a password", which is not true of a key-authenticated connection — nothing prompts for an account password there — so the reporter reasonably read it as a fault rather than a notice.

  Two changes, and neither touches which credential a connection uses. The empty answer is now remembered for five minutes, so a burst of connections pays for the lookup once instead of once each; and the notice is only shown when the connection is actually set up to want a password.

  Both are deliberately kept away from the decision of whether a password is needed. The cache sits after that decision and only skips repeating a question already asked, so a stale record can cost a connection the password it would have found — bounded by the five minutes, and cleared immediately when one is saved, when an edit or group move changes the lookup key, and after a bulk transfer between backends — but it can never hand a connection the wrong one. The notice predicate feeds nothing but the toast.

  Worth recording why the "does this want a password" test is keyed on the key configuration and not on the authentication method: SshAuthMethod defaults to Password, so a connection imported from an ssh_config or created without touching that dropdown reads as password auth however it actually connects. A check on the method alone would have kept showing the notice to precisely the people who complained about it. A key path, an agent key source, or an explicit key method — any of the three is enough.

  Not fixed here, and the reason the wait existed at all: the fast path that skips the vault entirely still keys on the connection's Password Source, which is a stored setting rather than a description of how the connection authenticates. A connection migrated from an older release carries Vault because that is what keyring became, not because anyone chose it. Deriving that from the connection is the better fix and a larger one; setting Password Source to None on such a connection is the workaround today.

• Local Shell failed to open in Flatpak on a host without script (issue #306) — the button reported Failed to start command: script and nothing opened. The Local Shell path wraps the host shell in script (util-linux) because that is what allocates a real PTY on the host and so gives the shell job control: Ctrl-Z, fg, bg. It called it unconditionally, and script is not present everywhere. Fedora moved the binary out of util-linux into a package of its own, util-linux-script, in F42, so a host that has util-linux-core — which is what a minimal install carries — does not have script, and installing util-linux-core does not help.

  The host is now probed and the shell is run directly when script is missing. Job control is lost in that fallback, which is a real downgrade and worth stating rather than glossing: a shell that opens without Ctrl-Z is still better than a button that does nothing. On a host that does have script, nothing changes.

  The same probe already existed one module away, on the Generic-command path in window/protocols.rs, added when a missing script broke that path. It was never applied here, so the two copies had drifted and only one of them survived a host without the binary — which is why a Generic command worked on exactly the systems where Local Shell did not.

• Quitting from the tray put the confirmation dialog on a window the user was not looking at — quitting with sessions still open asks for confirmation, which is correct, and 0.20.11 made the tray route present the window first so that dialog could not be drawn on a tray-hidden surface and lost. The guard it used was !win.is_visible(), which answers a different question than the one that matters: a window can be visible and still not be the window in front of the user, behind others, on another workspace, or simply unfocused. In each of those cases the present was skipped, the confirmation was drawn on a surface nobody was watching, and quitting from the tray meant going to look for it. The window is now presented whenever there is something to confirm; on an already-visible window that raises and focuses it, which is what asking to quit should do. Nothing is touched when there is nothing to confirm, which is what the guard was really there to prevent.

• The embedded browser was missing from every OBS .deb — Web connections there offered only System and Custom, with no Embedded row and nothing to say why. The interface was describing the build accurately: debian.rules decides the feature for itself with pkg-config --exists webkitgtk-6.0, that probe can only succeed if libwebkitgtk-6.0-dev is installed in the build chroot, and nothing installed it. The package was named plainly in Build-Depends until 0.20.10, which made all three deb targets unsatisfiable the first time the file actually reached OBS, and the answer at the time was to drop it altogether — trading a build that failed loudly for one that succeeded while quietly producing a binary without the feature, which is why this went unreported for a whole minor release.

  It is now requested as libwebkitgtk-6.0-dev | libglib2.0-dev. Apt installs the first branch it can satisfy, so a repository that ships WebKitGTK 6.0 opts in and one that does not resolves to a package libgtk-4-dev already pulls in, at no cost. All three current targets — xUbuntu_24.04, xUbuntu_26.04 and Debian_13 — do ship it, so all three gain the embedded browser; the second branch is there so that adding an older repository later degrades instead of breaking the build. Runtime linkage needs no entry of its own, because ${shlibs:Depends} derives it from the binary exactly when the feature was compiled in.

  Neither of the other two package families was affected, and it is worth saying which so the fix is not looked for there: the spec guards its WebKit BuildRequires with the same condition that selects the feature, so Tumbleweed and Fedora 43+ RPMs always had it; and the .deb attached to the GitHub release builds with default features, which include web-embedded, against a workflow that installs the dev package.

Installation

Flatpak (Recommended)

flatpak install flathub io.github.totoshko88.RustConn

Snap

sudo snap install rustconn

Debian/Ubuntu (.deb from this release)

sudo dpkg -i rustconn_0.21.1_amd64.deb
sudo apt-get install -f  # Install dependencies if needed

Fedora (.rpm from this release)

sudo dnf install rustconn-0.21.1-1.fc44.x86_64.rpm

AppImage

chmod +x RustConn-0.21.1-x86_64.AppImage
./RustConn-0.21.1-x86_64.AppImage

macOS (Homebrew)

brew tap totoshko88/rustconn
brew install rustconn
open $(brew --prefix)/opt/rustconn/RustConn.app

All dependencies (GTK4, libadwaita, VTE, Adwaita icons) are installed automatically.
Requires macOS 13 (Ventura) or later.

OBS Repositories

Packages available at: https://build.opensuse.org/package/show/home:totoshko88:rustconn/rustconn

# Debian 13 (Trixie)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Debian_13/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Debian_13/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Ubuntu 24.04 LTS (Noble)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_24.04/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_24.04/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Ubuntu 26.04 LTS (Resolute)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_26.04/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_26.04/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Fedora 44
sudo dnf config-manager addrepo --from-repofile=https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Fedora_44/home:totoshko88:rustconn.repo
sudo dnf install rustconn

# Fedora 43
sudo dnf config-manager addrepo --from-repofile=https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Fedora_43/home:totoshko88:rustconn.repo
sudo dnf install rustconn

# openSUSE Tumbleweed
sudo zypper ar https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/openSUSE_Tumbleweed/ rustconn
sudo zypper ref && sudo zypper in rustconn

# openSUSE Leap 16.0
sudo zypper ar https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/openSUSE_Leap_16.0/ rustconn
sudo zypper ref && sudo zypper in rustconn

Arch Linux (AUR)

yay -S rustconn

FreeBSD (Ports)

pkg install rustconn

Full installation guide: https://github.com/totoshko88/RustConn/blob/main/docs/INSTALL.md