Merge branch 'main' into move-feature-flags-to-build-script

Per maintainer review feedback. The bump to v1_2 in commit
a45e00e was unnecessary — none of the macOS menubar work uses
a libadwaita 1.2-only API (no AdwMessageDialog, AdwAboutWindow,
AdwBanner, etc.). Drop the floor back to v1.1 so distros and
flake users on slightly older libadwaita aren't pushed forward
just to run the GTK frontend.

Verified with cargo clean -p libadwaita followed by cargo check
-p lan-mouse-gtk: libadwaita rebuilds with v1_1 features only
and the workspace compiles, clippy-clean, tests passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.editorconfig

@@ -0,0 +1,24 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+charset = utf-8
+
+[*.rs]
+indent_style = space
+indent_size = 4
+max_line_length = 100
+
+[*.{yml,yaml}]
+indent_style = space
+indent_size = 2
+
+[*.toml]
+indent_style = space
+indent_size = 4
+
+[*.nix]
+indent_style = space
+indent_size = 2

.githooks/pre-commit

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Ensure we're at the repo root
+cd "$(git rev-parse --show-toplevel)" || exit 1
+
+echo "Running cargo fmt (auto-format)..."
+# Run formatter to apply fixes but do not stage them. If formatting changed,
+# fail the commit so the user can review and stage the changes manually.
+cargo fmt --all
+if ! git diff --quiet --exit-code; then
+  echo "" >&2
+  echo "ERROR: cargo fmt modified files. Review changes, stage them, and commit again." >&2
+  git --no-pager diff --name-only
+  exit 1
+fi
+
+echo "Running cargo clippy..."
+# Matches CI: deny warnings to keep code health strict
+if ! cargo clippy --workspace --all-targets --all-features -- -D warnings; then
+  echo "" >&2
+  echo "ERROR: clippy found warnings/errors. Fix them before committing." >&2
+  exit 1
+fi
+
+echo "Running cargo test..."
+if ! cargo test --workspace --all-features; then
+  echo "" >&2
+  echo "ERROR: Some tests failed. Fix tests before committing." >&2
+  exit 1
+fi
+
+echo "All pre-commit checks passed."
+exit 0

.github/workflows/cachix.yml

@@ -1,40 +1,50 @@
-name: Binary Cache
+name: Nix Binary Cache
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
-on: [push, pull_request, workflow_dispatch]
 jobs:
   nix:
     strategy:
       matrix:
-       os: 
-        - ubuntu-latest
-        - macos-13
-        - macos-14
+        os:
+          - ubuntu-latest
+          - macos-15-intel
+          - macos-latest
     name: "Build"
-    runs-on: ${{ matrix.os }} 
+    runs-on: ${{ matrix.os }}
     steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        submodules: recursive
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
 
-    - uses: DeterminateSystems/nix-installer-action@main
-      with:
-        logger: pretty
-    - uses: DeterminateSystems/magic-nix-cache-action@main
-    - uses: cachix/cachix-action@v14
-      with:
-        name: lan-mouse
-        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+      # - uses: DeterminateSystems/nix-installer-action@main
+      #   with:
+      #     logger: pretty
+      # - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: cachix/install-nix-action@v31
+      - uses: cachix/cachix-action@v16
+        with:
+          name: lan-mouse
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
-    - name: Build lan-mouse (x86_64-linux)
-      if: matrix.os == 'ubuntu-latest'
-      run: nix build --print-build-logs --show-trace .#packages.x86_64-linux.lan-mouse
+      - name: Build lan-mouse (x86_64-linux)
+        if: matrix.os == 'ubuntu-latest'
+        run: nix build --print-build-logs --show-trace .#packages.x86_64-linux.lan-mouse
 
-    - name: Build lan-mouse (x86_64-darwin)
-      if: matrix.os == 'macos-13'
-      run: nix build --print-build-logs --show-trace .#packages.x86_64-darwin.lan-mouse
-
-    - name: Build lan-mouse (aarch64-darwin)
-      if: matrix.os == 'macos-14'
-      run: nix build --print-build-logs --show-trace .#packages.aarch64-darwin.lan-mouse
+      - name: Build lan-mouse (x86_64-darwin)
+        if: matrix.os == 'macos-15-intel'
+        run: nix build --print-build-logs --show-trace .#packages.x86_64-darwin.lan-mouse
 
+      - name: Build lan-mouse (aarch64-darwin)
+        if: matrix.os == 'macos-latest'
+        run: nix build --print-build-logs --show-trace .#packages.aarch64-darwin.lan-mouse

.github/workflows/release.yml

@@ -1,31 +1,59 @@
-name: "pre-release"
+name: "Release"
+run-name: "Release - ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || github.event.inputs.name || github.ref_name }}"
 
 on:
   push:
     branches: [ "main" ]
-
-
+    tags:
+      - v**
+  workflow_dispatch:
+    inputs:
+      name:
+        description: 'Development release name'
+        required: false
+        default: ''
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
   linux-release-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: install dependencies
       run: |
         sudo apt-get update
         sudo apt-get install libx11-dev libxtst-dev
         sudo apt-get install libadwaita-1-dev libgtk-4-dev
     - name: Release Build
-      run: cargo build --release
+      run: |
+        cargo build --release
+        cp target/release/lan-mouse lan-mouse-linux-x86_64
     - name: Upload build artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
-        name: lan-mouse-linux
-        path: target/release/lan-mouse
+        name: lan-mouse-linux-x86_64
+        path: lan-mouse-linux-x86_64
+
+  linux-arm64-release-build:
+    runs-on: ubuntu-22.04-arm
+    steps:
+    - uses: actions/checkout@v6
+    - name: install dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install libx11-dev libxtst-dev
+        sudo apt-get install libadwaita-1-dev libgtk-4-dev
+    - name: Release Build
+      run: |
+        cargo build --release
+        cp target/release/lan-mouse lan-mouse-linux-arm64
+    - name: Upload build artifact
+      uses: actions/upload-artifact@v6
+      with:
+        name: lan-mouse-linux-arm64
+        path: lan-mouse-linux-arm64
 
   windows-release-build:
     runs-on: windows-latest
@@ -64,7 +92,7 @@ jobs:
         gvsbuild build --msys-dir=C:\msys64 gtk4 libadwaita librsvg
         Move-Item "C:\Program Files\Git\usr\notbin" "C:\Program Files\Git\usr\bin"
         Move-Item "C:\Program Files\Git\notbin" "C:\Program Files\Git\bin"
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Release Build
       run: cargo build --release
     - name: Create Archive
@@ -72,19 +100,21 @@ jobs:
         mkdir "lan-mouse-windows"
         Get-Childitem -Path "C:\\gtk-build\\gtk\\x64\\release\\bin\\*.dll" -File -Recurse | Copy-Item -Destination "lan-mouse-windows"
         Copy-Item -Path "target\release\lan-mouse.exe" -Destination "lan-mouse-windows"
-        Compress-Archive -Path "lan-mouse-windows\*" -DestinationPath lan-mouse-windows.zip
+        Compress-Archive -Path "lan-mouse-windows\*" -DestinationPath lan-mouse-windows-x86_64.zip
     - name: Upload build artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
-        name: lan-mouse-windows
-        path: lan-mouse-windows.zip
+        name: lan-mouse-windows-x86_64
+        path: lan-mouse-windows-x86_64.zip
 
   macos-release-build:
-    runs-on: macos-13
+    runs-on: macos-15-intel
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: install dependencies
-      run: brew install gtk4 libadwaita imagemagick
+      run: |
+        brew install --cask inkscape
+        brew install gtk4 libadwaita imagemagick librsvg
     - name: Release Build
       run: |
         cargo build --release
@@ -94,59 +124,81 @@ jobs:
     - name: Install cargo bundle
       run: cargo install cargo-bundle
     - name: Bundle
-      run: cargo bundle --release
+      run: |
+        cargo bundle --release
+        scripts/copy-macos-dylib.sh "target/release/bundle/osx/Lan Mouse.app/Contents/MacOS/lan-mouse"
     - name: Zip bundle
       run: |
         cd target/release/bundle/osx
         zip -r "lan-mouse-macos-intel.zip" "Lan Mouse.app"
     - name: Upload build artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: lan-mouse-macos-intel
         path: target/release/bundle/osx/lan-mouse-macos-intel.zip
 
-  macos-aarch64-release-build:
-    runs-on: macos-14
+  macos-arm64-release-build:
+    runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: install dependencies
-      run: brew install gtk4 libadwaita imagemagick
+      run: |
+        brew install --cask inkscape
+        brew install gtk4 libadwaita imagemagick librsvg
     - name: Release Build
       run: |
         cargo build --release
-        cp target/release/lan-mouse lan-mouse-macos-aarch64
+        cp target/release/lan-mouse lan-mouse-macos-arm64
     - name: Make icns
       run: scripts/makeicns.sh
     - name: Install cargo bundle
       run: cargo install cargo-bundle
     - name: Bundle
-      run: cargo bundle --release
+      run: |
+        cargo bundle --release
+        scripts/copy-macos-dylib.sh "target/release/bundle/osx/Lan Mouse.app/Contents/MacOS/lan-mouse"
     - name: Zip bundle
       run: |
         cd target/release/bundle/osx
-        zip -r "lan-mouse-macos-aarch64.zip" "Lan Mouse.app"
+        zip -r "lan-mouse-macos-arm64.zip" "Lan Mouse.app"
     - name: Upload build artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
-        name: lan-mouse-macos-aarch64
-        path: target/release/bundle/osx/lan-mouse-macos-aarch64.zip
+        name: lan-mouse-macos-arm64
+        path: target/release/bundle/osx/lan-mouse-macos-arm64.zip
 
-  pre-release:
-    name: "Pre Release"
-    needs: [windows-release-build, linux-release-build, macos-release-build, macos-aarch64-release-build]
+  release:
+    name: "Release"
+    needs: [windows-release-build, linux-release-build, linux-arm64-release-build, macos-release-build, macos-arm64-release-build]
     runs-on: "ubuntu-latest"
     steps:
     - name: Download build artifacts
       uses: actions/download-artifact@v4
-    - name: Create Release
-      uses: "marvinpinto/action-automatic-releases@latest"
+    - name: Create Pre-Release
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      uses: softprops/action-gh-release@v2
       with:
-        repo_token: "${{ secrets.GITHUB_TOKEN }}"
-        automatic_release_tag: "latest"
+        token: ${{ secrets.GITHUB_TOKEN }}
+        tag_name: ${{ github.event.inputs.name || github.ref_name }}
+        name: ${{ github.event.inputs.name || github.ref_name }}
         prerelease: true
-        title: "Development Build"
+        generate_release_notes: true
         files: |
-          lan-mouse-linux/lan-mouse
+          lan-mouse-linux-x86_64/lan-mouse-linux-x86_64
+          lan-mouse-linux-arm64/lan-mouse-linux-arm64
           lan-mouse-macos-intel/lan-mouse-macos-intel.zip
-          lan-mouse-macos-aarch64/lan-mouse-macos-aarch64.zip
-          lan-mouse-windows/lan-mouse-windows.zip
+          lan-mouse-macos-arm64/lan-mouse-macos-arm64.zip
+          lan-mouse-windows-x86_64/lan-mouse-windows-x86_64.zip
+    - name: Create Tagged Release
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: softprops/action-gh-release@v2
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        name: ${{ github.ref_name }}
+        generate_release_notes: true
+        files: |
+          lan-mouse-linux-x86_64/lan-mouse-linux-x86_64
+          lan-mouse-linux-arm64/lan-mouse-linux-arm64
+          lan-mouse-macos-intel/lan-mouse-macos-intel.zip
+          lan-mouse-macos-arm64/lan-mouse-macos-arm64.zip
+          lan-mouse-windows-x86_64/lan-mouse-windows-x86_64.zip

.github/workflows/rust.yml

@@ -9,146 +9,92 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  build-linux:
-
+  fmt:
+    name: Formatting
     runs-on: ubuntu-latest
-
     steps:
-    - uses: actions/checkout@v4
-    - name: install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install libx11-dev libxtst-dev
-        sudo apt-get install libadwaita-1-dev libgtk-4-dev
-    - name: Build
-      run: cargo build --verbose
-    - name: Run tests
-      run: cargo test --verbose
-    - name: Check Formatting
-      run: cargo fmt --check
-    - name: Clippy
-      run: cargo clippy --all-features --all-targets -- --deny warnings
-    - name: Upload build artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: lan-mouse
-        path: target/debug/lan-mouse
-
-  build-windows:
-
-    runs-on: windows-latest
+      - uses: actions/checkout@v6
+      - name: cargo fmt
+        run: cargo fmt --check
 
+  ci:
+    name: ${{ matrix.job }} ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+          - macos-latest
+          - macos-15-intel
+        job:
+          - build
+          - check
+          - clippy
+          - test
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.11'
-    # needed for cache restore
-    - name: create gtk dir
-      run: mkdir C:\gtk-build\gtk\x64\release
-    - uses: actions/cache@v3
-      id: cache
-      with:
-        path: c:/gtk-build/gtk/x64/release/**
-        key: gtk-windows-build
-        restore-keys: gtk-windows-build
-    - name: Update path
-      run: |
-        echo "PKG_CONFIG=C:\gtk-build\gtk\x64\release\bin\pkgconf.exe" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-        echo "C:\pkg-config-lite-0.28-1\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
-        echo "C:\gtk-build\gtk\x64\release\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
-        echo $env:GITHUB_PATH
-        echo $env:PATH
-    - name: Install dependencies
-      if: steps.cache.outputs.cache-hit != 'true'
-      run: |
-        # choco install msys2
-        # choco install visualstudio2022-workload-vctools
-        # choco install pkgconfiglite
-        py -m venv .venv
-        .venv\Scripts\activate.ps1
-        py -m pip install gvsbuild
-        # see https://github.com/wingtk/gvsbuild/pull/1004
-        Move-Item "C:\Program Files\Git\usr\bin" "C:\Program Files\Git\usr\notbin"
-        Move-Item "C:\Program Files\Git\bin" "C:\Program Files\Git\notbin"
-        gvsbuild build --msys-dir=C:\msys64 gtk4 libadwaita librsvg
-        Move-Item "C:\Program Files\Git\usr\notbin" "C:\Program Files\Git\usr\bin"
-        Move-Item "C:\Program Files\Git\notbin" "C:\Program Files\Git\bin"
-    - name: Build
-      run: cargo build --verbose
-    - name: Run tests
-      run: cargo test --verbose
-    - name: Check Formatting
-      run: cargo fmt --check
-    - name: Clippy
-      run: cargo clippy --all-features --all-targets -- --deny warnings
-    - name: Copy Gtk Dlls
-      run: Get-Childitem -Path "C:\\gtk-build\\gtk\\x64\\release\\bin\\*.dll" -File -Recurse | Copy-Item -Destination "target\\debug"
-    - name: Upload build artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: lan-mouse-windows
-        path: |
-          target/debug/lan-mouse.exe
-          target/debug/*.dll
+      - uses: actions/checkout@v6
+      - uses: Swatinem/rust-cache@v2
+      - name: Install Linux deps
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install libx11-dev libxtst-dev libadwaita-1-dev libgtk-4-dev
+      - name: Install macOS dependencies
+        if: runner.os == 'macOS'
+        run: brew install gtk4 libadwaita imagemagick
+      - name: Install Windows Dependencies - create gtk dir
+        if: runner.os == 'Windows'
+        run: mkdir C:\gtk-build\gtk\x64\release
+      - name: Install Windows Dependencies - install gtk from cache
+        uses: actions/cache@v3
+        if: runner.os == 'Windows'
+        id: cache
+        with:
+          path: c:/gtk-build/gtk/x64/release/**
+          key: gtk-windows-build
+          restore-keys: gtk-windows-build
+      - name: Install Windows Dependencies - update PATH
+        if: runner.os == 'Windows'
+        run: |
+          echo "PKG_CONFIG=C:\gtk-build\gtk\x64\release\bin\pkgconf.exe" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          echo "C:\pkg-config-lite-0.28-1\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          echo "C:\gtk-build\gtk\x64\release\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          echo $env:GITHUB_PATH
+          echo $env:PATH
+      - name: Install Windows dependencies - build gtk
+        if: runner.os == 'Windows' && steps.cache.outputs.cache-hit != 'true'
+        run: |
+          # choco install msys2
+          # choco install visualstudio2022-workload-vctools
+          # choco install pkgconfiglite
+          py -m venv .venv
+          .venv\Scripts\activate.ps1
+          py -m pip install gvsbuild
+          gvsbuild build --msys-dir=C:\msys64 gtk4 libadwaita librsvg
+      - name: cargo build
+        if: matrix.job == 'build'
+        run: cargo build
 
-  build-macos:
-    runs-on: macos-13
-    steps:
-    - uses: actions/checkout@v4
-    - name: install dependencies
-      run: brew install gtk4 libadwaita imagemagick
-    - name: Build
-      run: cargo build --verbose
-    - name: Run tests
-      run: cargo test --verbose
-    - name: Check Formatting
-      run: cargo fmt --check
-    - name: Clippy
-      run: cargo clippy --all-features --all-targets -- --deny warnings
-    - name: Make icns
-      run: scripts/makeicns.sh
-    - name: Install cargo bundle
-      run: cargo install cargo-bundle
-    - name: Bundle
-      run: cargo bundle
-    - name: Zip bundle
-      run: |
-        cd target/debug/bundle/osx
-        zip -r "Lan Mouse macOS (Intel).zip" "Lan Mouse.app"
-    - name: Upload build artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: Lan Mouse macOS (Intel)
-        path: target/debug/bundle/osx/Lan Mouse macOS (Intel).zip
+      - name: cargo check
+        if: matrix.job == 'check'
+        run: cargo check --workspace --all-targets --all-features
 
-  build-macos-aarch64:
-    runs-on: macos-14
-    steps:
-    - uses: actions/checkout@v4
-    - name: install dependencies
-      run: brew install gtk4 libadwaita imagemagick
-    - name: Build
-      run: cargo build --verbose
-    - name: Run tests
-      run: cargo test --verbose
-    - name: Check Formatting
-      run: cargo fmt --check
-    - name: Clippy
-      run: cargo clippy --all-features --all-targets -- --deny warnings
-    - name: Make icns
-      run: scripts/makeicns.sh
-    - name: Install cargo bundle
-      run: cargo install cargo-bundle
-    - name: Bundle
-      run: cargo bundle
-    - name: Zip bundle
-      run: |
-        cd target/debug/bundle/osx
-        zip -r "Lan Mouse macOS (ARM).zip" "Lan Mouse.app"
-    - name: Upload build artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: Lan Mouse macOS (ARM)
-        path: target/debug/bundle/osx/Lan Mouse macOS (ARM).zip
+      - name: cargo test
+        if: matrix.job == 'test'
+        run: cargo test --workspace --all-features
+
+      - name: cargo clippy
+        if: matrix.job == 'clippy'
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+
+      - uses: clechasseur/rs-clippy-check@v4
+        if: matrix.job == 'clippy'
+        with:
+          args: --workspace --all-targets --all-features

.github/workflows/tagged-release.yml

@@ -1,146 +0,0 @@
-name: "Tagged Release"
-
-on:
-  push:
-    tags:
-      - v**
-
-jobs:
-  linux-release-build:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-    - name: install dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install libx11-dev libxtst-dev
-        sudo apt-get install libadwaita-1-dev libgtk-4-dev
-    - name: Release Build
-      run: cargo build --release
-    - name: Upload build artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: lan-mouse-linux
-        path: target/release/lan-mouse
-
-  windows-release-build:
-    runs-on: windows-latest
-    steps:
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.11'
-    # needed for cache restore
-    - name: create gtk dir
-      run: mkdir C:\gtk-build\gtk\x64\release
-    - uses: actions/cache@v3
-      id: cache
-      with:
-        path: c:/gtk-build/gtk/x64/release/**
-        key: gtk-windows-build
-        restore-keys: gtk-windows-build
-    - name: Update path
-      run: |
-        echo "PKG_CONFIG=C:\gtk-build\gtk\x64\release\bin\pkgconf.exe" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-        echo "C:\pkg-config-lite-0.28-1\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
-        echo "C:\gtk-build\gtk\x64\release\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
-        echo $env:GITHUB_PATH
-        echo $env:PATH
-    - name: Install dependencies
-      if: steps.cache.outputs.cache-hit != 'true'
-      run: |
-        # choco install msys2
-        # choco install visualstudio2022-workload-vctools
-        # choco install pkgconfiglite
-        py -m venv .venv
-        .venv\Scripts\activate.ps1
-        py -m pip install gvsbuild
-        # see https://github.com/wingtk/gvsbuild/pull/1004
-        Move-Item "C:\Program Files\Git\usr\bin" "C:\Program Files\Git\usr\notbin"
-        Move-Item "C:\Program Files\Git\bin" "C:\Program Files\Git\notbin"
-        gvsbuild build --msys-dir=C:\msys64 gtk4 libadwaita librsvg
-        Move-Item "C:\Program Files\Git\usr\notbin" "C:\Program Files\Git\usr\bin"
-        Move-Item "C:\Program Files\Git\notbin" "C:\Program Files\Git\bin"
-    - uses: actions/checkout@v4
-    - name: Release Build
-      run: cargo build --release
-    - name: Create Archive
-      run: |
-        mkdir "lan-mouse-windows"
-        Get-Childitem -Path "C:\\gtk-build\\gtk\\x64\\release\\bin\\*.dll" -File -Recurse | Copy-Item -Destination "lan-mouse-windows"
-        Copy-Item -Path "target\release\lan-mouse.exe" -Destination "lan-mouse-windows"
-        Compress-Archive -Path "lan-mouse-windows\*" -DestinationPath lan-mouse-windows.zip
-    - name: Upload build artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: lan-mouse-windows
-        path: lan-mouse-windows.zip
-
-  macos-release-build:
-    runs-on: macos-13
-    steps:
-    - uses: actions/checkout@v4
-    - name: install dependencies
-      run: brew install gtk4 libadwaita imagemagick
-    - name: Release Build
-      run: |
-        cargo build --release
-        cp target/release/lan-mouse lan-mouse-macos-intel
-    - name: Make icns
-      run: scripts/makeicns.sh
-    - name: Install cargo bundle
-      run: cargo install cargo-bundle
-    - name: Bundle
-      run: cargo bundle --release
-    - name: Zip bundle
-      run: |
-        cd target/release/bundle/osx
-        zip -r "lan-mouse-macos-intel.zip" "Lan Mouse.app"
-    - name: Upload build artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: lan-mouse-macos-intel.zip
-        path: target/release/bundle/osx/lan-mouse-macos-intel.zip
-
-  macos-aarch64-release-build:
-    runs-on: macos-14
-    steps:
-    - uses: actions/checkout@v4
-    - name: install dependencies
-      run: brew install gtk4 libadwaita imagemagick
-    - name: Release Build
-      run: |
-        cargo build --release
-        cp target/release/lan-mouse lan-mouse-macos-aarch64
-    - name: Make icns
-      run: scripts/makeicns.sh
-    - name: Install cargo bundle
-      run: cargo install cargo-bundle
-    - name: Bundle
-      run: cargo bundle --release
-    - name: Zip bundle
-      run: |
-        cd target/release/bundle/osx
-        zip -r "lan-mouse-macos-aarch64.zip" "Lan Mouse.app"
-    - name: Upload build artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: lan-mouse-macos-aarch64.zip
-        path: target/release/bundle/osx/lan-mouse-macos-aarch64.zip
-
-  tagged-release:
-    name: "Tagged Release"
-    needs: [windows-release-build, linux-release-build, macos-release-build, macos-aarch64-release-build]
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: Download build artifacts
-      uses: actions/download-artifact@v4
-    - name: Create Release
-      uses: "marvinpinto/action-automatic-releases@latest"
-      with:
-        repo_token: "${{ secrets.GITHUB_TOKEN }}"
-        prerelease: false
-        files: |
-          lan-mouse-linux/lan-mouse
-          lan-mouse-macos-intel/lan-mouse-macos-intel.zip
-          lan-mouse-macos-aarch64/lan-mouse-macos-aarch64.zip
-          lan-mouse-windows/lan-mouse-windows.zip

.gitignore

@@ -8,3 +8,7 @@ result
 *.pem
 *.csr
 extfile.conf
+
+# flatpak files
+.flatpak-builder
+repo

.rustfmt.toml

@@ -0,0 +1,4 @@
+style_edition = "2024"
+
+max_width = 100
+tab_spaces = 4

AGENTS.md

@@ -0,0 +1,65 @@
+# Lan Mouse Agent Instructions
+
+## Overview
+
+Lan Mouse is an open-source Software KVM sharing mouse/keyboard input across local networks. The Rust workspace combines a GTK frontend, CLI/daemon mode, and multi-OS capture/emulation backends for Linux, Windows, and macOS.
+
+## Core principles
+
+- **Scope discipline.** Only implement what was requested; describe follow-up work instead of absorbing it.
+- **Clarify OS behavior.** Ask when requirements touch OS-specific capture/emulation (they differ significantly).
+- **Docs stay current.** Update [README.md](README.md) or [DOC.md](DOC.md) when touching public APIs or platform support.
+- **Rust idioms.** Use `Result`/`Option`, `thiserror` for errors, descriptive logs, and concise comments for non-obvious invariants.
+
+## Terminology
+
+- **Client:** A remote machine that can receive or send input events. Each client is either _active_ (receiving events) or _inactive_ (can send events back). This mutual exclusion prevents feedback loops.
+- **Backend:** OS-specific implementation for capture or emulation (e.g., libei, layer-shell, wlroots, X11, Windows, macOS).
+- **Handle:** A per-client identifier used to route events and track state (pressed keys, position).
+
+## Architecture
+
+**Pipeline:** `input-capture` → `lan-mouse-ipc` → `input-emulation`
+
+- **input-capture:** Reads OS events into a `Stream<CaptureEvent>`. Backends tried in priority order (libei → layer-shell → X11 → fallback). Tracks `pressed_keys` to avoid stuck modifiers. `position_map` queues events when multiple clients share a screen edge.
+- **input-emulation:** Replays events via the `Emulation` trait (`consume`, `create`, `destroy`, `terminate`). Maintains `pressed_keys` and releases them on disconnect.
+- **lan-mouse-ipc / lan-mouse-proto:** Protocol glue and serialization. Events are UDP; connection requests are TCP on the same port. Version bumps required when serialization changes.
+- **input-event:** Shared scancode enums and abstract event types—extend here, don't duplicate translations.
+
+## Feature & cfg discipline
+
+- Feature flags live in root `Cargo.toml`. Gate OS-specific modules with tight cfgs (e.g., `cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))`).
+- Prefer module-level gating over per-function cfgs to avoid empty stubs.
+- New backends: add feature in `Cargo.toml`, create gated module, log backend selection.
+
+## Async patterns
+
+- Tokio runtime with `futures` streams and `async_trait`. Model new flows as streams or async methods.
+- Avoid blocking; use `spawn_blocking` if needed. Prefer existing single-threaded stream handling.
+- `InputCapture` implements `Stream` and manually pumps backends—don't short-circuit this logic.
+
+## Commands
+
+```sh
+cargo build --workspace                                    # full build
+cargo build -p <crate>                                     # single crate
+cargo test --workspace                                     # all tests
+cargo fmt && cargo clippy --workspace --all-targets --all-features  # lint
+RUST_LOG=lan_mouse=debug cargo run                         # debug logging
+```
+
+Run from repo root—no `cd` in scripts.
+
+## Testing
+
+- Unit tests for utilities; integration tests for protocol behavior.
+- OS-specific backends: test via GTK/CLI on target OS or document manual verification.
+- Dummy backend exercises pipeline without real dependencies.
+- Verify `terminate()` releases keys on unexpected disconnect.
+
+## Workflow
+
+1. Clarify ambiguous requirements, especially OS-specific behavior.
+2. Implement minimal change; flag follow-up work.
+3. Add proportional tests; run `cargo test` on affected crates.
+4. Run `cargo fmt` and `cargo clippy --workspace --all-targets --all-features`.

Cargo.toml

@@ -24,7 +24,7 @@ strip = true
 panic = "abort"
 
 [build-dependencies]
-shadow-rs = "0.38.0"
+shadow-rs = "1.2.0"
 
 [dependencies]
 input-event = { path = "input-event", version = "0.3.0" }
@@ -34,10 +34,11 @@ lan-mouse-cli = { path = "lan-mouse-cli", version = "0.2.0" }
 lan-mouse-gtk = { path = "lan-mouse-gtk", version = "0.2.0", optional = true }
 lan-mouse-ipc = { path = "lan-mouse-ipc", version = "0.2.0" }
 lan-mouse-proto = { path = "lan-mouse-proto", version = "0.2.0" }
-shadow-rs = { version = "0.38.0", features = ["metadata"] }
+shadow-rs = { version = "1.2.0", features = ["metadata"] }
 
-hickory-resolver = "0.24.1"
+hickory-resolver = "0.25.2"
 toml = "0.8"
+toml_edit = { version = "0.22", features = ["serde"] }
 serde = { version = "1.0", features = ["derive"] }
 log = "0.4.20"
 env_logger = "0.11.3"
@@ -58,14 +59,15 @@ slab = "0.4.9"
 thiserror = "2.0.0"
 tokio-util = "0.7.11"
 local-channel = "0.1.5"
-webrtc-dtls = { version = "0.10.0", features = ["pem"] }
-webrtc-util = "0.9.0"
+webrtc-dtls = { version = "0.12.0", features = ["pem"] }
+webrtc-util = "0.11.0"
 rustls = { version = "0.23.12", default-features = false, features = [
     "std",
     "ring",
 ] }
 rcgen = "0.13.1"
 sha2 = "0.10.8"
+notify = "8.2.0"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2.148"
@@ -94,3 +96,5 @@ rdp_emulation = ["input-emulation/remote_desktop_portal"]
 name = "Lan Mouse"
 icon = ["target/icon.icns"]
 identifier = "de.feschber.LanMouse"
+osx_info_plist_exts = ["build-aux/macos-lsui-element.plist"]
+resources = ["target/menubar-template.png"]

README.md

@@ -1,4 +1,9 @@
 # Lan Mouse
+
+[![CI](https://github.com/feschber/lan-mouse/actions/workflows/rust.yml/badge.svg)](https://github.com/feschber/lan-mouse/actions/workflows/rust.yml) [![Cachix](https://github.com/feschber/lan-mouse/actions/workflows/cachix.yml/badge.svg)](https://github.com/feschber/lan-mouse/actions/workflows/cachix.yml) [![Release](https://github.com/feschber/lan-mouse/actions/workflows/release.yml/badge.svg)](https://github.com/feschber/lan-mouse/actions/workflows/release.yml)
+
+[![crates.io](https://img.shields.io/crates/v/lan-mouse.svg)](https://crates.io/crates/lan-mouse)  [![license](https://img.shields.io/crates/l/lan-mouse.svg)](https://github.com/feschber/lan-mouse/blob/main/Cargo.toml)
+
 Lan Mouse is a *cross-platform* mouse and keyboard sharing software similar to universal-control on Apple devices.
 It allows for using multiple PCs via a single set of mouse and keyboard.
 This is also known as a Software KVM switch.
@@ -81,15 +86,38 @@ paru -S lan-mouse-git
 - flake: [README.md](./nix/README.md)
 </details>
 
+<details>
+    <summary>Fedora</summary>
+You can install Lan Mouse from the [Terra Repository](https://terra.fyralabs.com).
+
+
+After enabling Terra:
+
+```sh
+dnf install lan-mouse
+```
+</details>
+
+<details>
+    <summary>MacOS</summary>
+
+- Download the package for your Mac (Intel or ARM) from the releases page
+- Unzip it
+- Remove the quarantine with `xattr -rd com.apple.quarantine "Lan Mouse.app"`
+- Launch the app
+- Use the menu bar item to open the settings window or quit Lan Mouse. Bundled macOS builds run as a menu bar app and do not keep a Dock icon visible.
+- Grant accessibility permissions in System Preferences
+
+</details>
 
 
 <details>
     <summary>Manual Installation</summary>
 
-First make sure to [install the necessary dependencies](#installing-dependencies).
+First make sure to [install the necessary dependencies](#installing-dependencies-for-development--compiling-from-source).
 
 Precompiled release binaries for Windows, MacOS and Linux are available in the [releases section](https://github.com/feschber/lan-mouse/releases).
-For Windows, the depenedencies are included in the .zip file, for other operating systems see [Installing Dependencies](#installing-dependencies).
+For Windows, the depenedencies are included in the .zip file, for other operating systems see [Installing Dependencies](#installing-dependencies-for-development--compiling-from-source).
 
 Alternatively, the `lan-mouse` binary can be compiled from source (see below).
 
@@ -144,23 +172,51 @@ rust toolchain.
 Additionally, available backends and frontends can be configured manually via
 [cargo features](https://doc.rust-lang.org/cargo/reference/features.html).
 
-E.g. if only wayland support is needed, the following command produces
-an executable with just support for wayland:
+E.g. if only support for sway is needed, the following command produces
+an executable with support for only the `layer-shell` capture backend
+and `wlroots` emulation backend:
 ```sh
-cargo build --no-default-features --features wayland
+cargo build --no-default-features --features layer_shell_capture,wlroots_emulation
 ```
 For a detailed list of available features, checkout the [Cargo.toml](./Cargo.toml)
 </details>
 
 
 
+## Development
 
-## Installing Dependencies for Development / Compiling from Source
+### Git pre-commit hook
+
+This repository includes a local git hooks directory `.githooks/` with a `pre-commit` script that enforces formatting, lints, and tests before allowing a commit.  It is optional to enable it, but it will prevent you from committing code with failing unit tests or that needs clippy/fmt fixes. To enable the hook locally:
+
+1. Make the hook executable:
+
+```sh
+chmod +x .githooks/pre-commit
+```
+
+2. Point git to the hooks directory (one-time per clone):
+
+```sh
+git config core.hooksPath .githooks
+```
+
+The `pre-commit` script runs `cargo fmt --all` (and fails if files were modified), `cargo clippy --workspace --all-targets --all-features -- -D warnings`, and `cargo test --workspace --all-features`.
+
+### Dependencies & Compiling from Source
 <details>
     <summary>MacOS</summary>
 
 ```sh
-brew install libadwaita pkg-config
+# Install dependencies
+brew install libadwaita pkg-config imagemagick
+cargo install cargo-bundle
+# Create the macOS icon file
+scripts/makeicns.sh
+# Create the .app bundle
+cargo bundle
+# Copy all dynamic libraries into the bundle, and update the bundle to find them there
+scripts/copy-macos-dylib.sh
 ```
 </details>
 
@@ -267,19 +323,17 @@ If the device still can not be entered, make sure you have UDP port `4242` (or t
 <details>
     <summary>Command Line Interface</summary>
 
-The cli interface can be enabled using `--frontend cli` as commandline arguments.
-Type `help` to list the available commands.
-
-E.g.:
+The cli interface can be accessed by passing `cli` as a commandline argument.
+Use
 ```sh
-$ cargo run --release -- --frontend cli
-(...)
-> connect <host> left|right|top|bottom
-(...)
-> list
-(...)
-> activate 0
+lan-mouse cli help
 ```
+ to list the available commands and
+```sh
+lan-mouse cli <cmd> help
+```
+for information on how to use a specific command.
+
 </details>
 
 <details>
@@ -287,11 +341,14 @@ $ cargo run --release -- --frontend cli
 
 Lan Mouse can be launched in daemon mode to keep it running in the background (e.g. for use in a systemd-service).
 
-To do so, add `--daemon` to the commandline args:
+To do so, use the `daemon` subcommand:
 
 ```sh
-lan-mouse --daemon
+lan-mouse daemon
 ```
+</details>
+
+## Systemd Service
 
 In order to start lan-mouse with a graphical session automatically,
 the [systemd-service](service/lan-mouse.service) can be used:
@@ -303,7 +360,9 @@ cp service/lan-mouse.service ~/.config/systemd/user
 systemctl --user daemon-reload
 systemctl --user enable --now lan-mouse.service
 ```
-</details>
+> [!Important]
+> Make sure to point `ExecStart=/usr/bin/lan-mouse daemon` to the actual `lan-mouse` binary (in case it is not under `/usr/bin`, e.g. when installed manually.
+
 
 ## Configuration
 To automatically load clients on startup, the file `$XDG_CONFIG_HOME/lan-mouse/config.toml` is parsed.
@@ -325,9 +384,6 @@ release_bind = [ "KeyA", "KeyS", "KeyD", "KeyF" ]
 
 # optional port (defaults to 4242)
 port = 4242
-# # optional frontend -> defaults to gtk if available
-# # possible values are "cli" and "gtk"
-# frontend = "gtk"
 
 # list of authorized tls certificate fingerprints that
 # are accepted for incoming traffic
@@ -335,7 +391,9 @@ port = 4242
 "bc:05:ab:7a:a4:de:88:8c:2f:92:ac:bc:b8:49:b8:24:0d:44:b3:e6:a4:ef:d7:0b:6c:69:6d:77:53:0b:14:80" = "iridium"
 
 # define a client on the right side with host name "iridium"
-[right]
+[[clients]]
+# position (left | right | top | bottom)
+position = "right"
 # hostname
 hostname = "iridium"
 # activate this client immediately when lan-mouse is started
@@ -344,7 +402,8 @@ activate_on_startup = true
 ips = ["192.168.178.156"]
 
 # define a client on the left side with IP address 192.168.178.189
-[left]
+[[clients]]
+position = "left"
 # The hostname is optional: When no hostname is specified,
 # at least one ip address needs to be specified.
 hostname = "thorium"

build-aux/de.feschber.LanMouse.yml

@@ -0,0 +1,50 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/flatpak/flatpak-builder/refs/heads/main/data/flatpak-manifest.schema.json
+app-id: de.feschber.LanMouse
+runtime: org.gnome.Platform
+runtime-version: "48"
+sdk: org.gnome.Sdk
+sdk-extensions:
+  - org.freedesktop.Sdk.Extension.rust-stable
+  - org.freedesktop.Sdk.Extension.llvm20
+command: /app/bin/lan-mouse
+build-options:
+  append-path: "/usr/lib/sdk/rust-stable/bin:/usr/lib/sdk/llvm20/bin"
+  env:
+    "CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER": "clang"
+    "CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS": "-C link-arg=-fuse-ld=/usr/lib/sdk/rust-stable/bin/mold"
+    "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER": "clang"
+    "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS": "-C link-arg=-fuse-ld=/usr/lib/sdk/rust-stable/bin/mold"
+    build-args:
+      "--share=network"
+    prepend-ld-library-path:
+      "/usr/lib/sdk/llvm19/lib"
+
+finish-args:
+  - "--socket=wayland"
+  - "--socket=fallback-x11"
+  - "--device=dri"
+  - "--socket=session-bus"
+  - "--share=network"
+  - "--filesystem=xdg-config"
+  - "--env=RUST_BACKTRACE=1"
+  - "--env=RUST_LOG=lan-mouse=debug"
+  - "--env=GTK_PATH=/app/lib/gtk-4.0"
+
+modules:
+  - name: lan-mouse
+    buildsystem: simple
+    build-options:
+      build-args:
+        - "--share=network"
+      append-path: /usr/lib/sdk/rust-stable/bin
+      env:
+        CARGO_HOME: /run/build/lan-mouse/cargo
+    build-commands:
+      - cargo fetch --manifest-path Cargo.toml --verbose
+      - cargo build
+      - install -Dm0755 target/debug/lan-mouse /app/bin/lan-mouse
+      - install -Dm0644 lan-mouse-gtk/resources/de.feschber.LanMouse.svg ${FLATPAK_DEST}/share/icons/hicolor/scalable/apps/${FLATPAK_ID}.svg
+      - install -Dm0644 de.feschber.LanMouse.desktop ${FLATPAK_DEST}/share/applications/${FLATPAK_ID}.desktop
+    sources:
+      - type: dir
+        path: ..

build-aux/macos-lsui-element.plist

@@ -0,0 +1,8 @@
+  <key>LSUIElement</key>
+  <true/>
+  <key>NSAppSleepDisabled</key>
+  <true/>
+  <key>NSInputMonitoringUsageDescription</key>
+  <string>Lan Mouse needs Input Monitoring access to capture keyboard and mouse input and forward it to remote machines on your network.</string>
+  <key>NSAppleEventsUsageDescription</key>
+  <string>Lan Mouse uses Apple Events to deliver synthesized keyboard and mouse events to the system.</string>

config.toml

@@ -1,14 +1,10 @@
 # example configuration
 
-# capture_backend = "LayerShell"
-
-# release bind
-release_bind = ["KeyA", "KeyS", "KeyD", "KeyF"]
+# configure release bind
+release_bind = [ "KeyA", "KeyS", "KeyD", "KeyF" ]
 
 # optional port (defaults to 4242)
 port = 4242
-# optional frontend -> defaults to gtk if available
-# frontend = "gtk"
 
 # list of authorized tls certificate fingerprints that
 # are accepted for incoming traffic
@@ -16,14 +12,19 @@ port = 4242
 "bc:05:ab:7a:a4:de:88:8c:2f:92:ac:bc:b8:49:b8:24:0d:44:b3:e6:a4:ef:d7:0b:6c:69:6d:77:53:0b:14:80" = "iridium"
 
 # define a client on the right side with host name "iridium"
-[right]
+[[clients]]
+# position (left | right | top | bottom)
+position = "right"
 # hostname
 hostname = "iridium"
+# activate this client immediately when lan-mouse is started
+activate_on_startup = true
 # optional list of (known) ip addresses
 ips = ["192.168.178.156"]
 
 # define a client on the left side with IP address 192.168.178.189
-[left]
+[[clients]]
+position = "left"
 # The hostname is optional: When no hostname is specified,
 # at least one ip address needs to be specified.
 hostname = "thorium"

de.feschber.LanMouse.yml

@@ -1,14 +0,0 @@
-app-id: de.feschber.LanMouse
-runtime: org.freedesktop.Platform
-runtime-version: '22.08'
-sdk: org.freedesktop.Sdk
-command: target/release/lan-mouse
-modules:
-  - name: hello
-    buildsystem: simple
-    build-commands:
-      - cargo build --release
-      - install -D lan-mouse /app/bin/lan-mouse
-    sources:
-      - type: file
-        path: target/release/lan-mouse

dylibs/.gitignore

@@ -0,0 +1 @@
+*

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1740560979,
-        "narHash": "sha256-Vr3Qi346M+8CjedtbyUevIGDZW8LcA1fTG0ugPY/Hic=",
+        "lastModified": 1772963539,
+        "narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5135c59491985879812717f4c9fea69604e7f26f",
+        "rev": "9dcb002ca1690658be4a04645215baea8b95f31d",
         "type": "github"
       },
       "original": {
@@ -29,11 +29,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740623427,
-        "narHash": "sha256-3SdPQrZoa4odlScFDUHd4CUPQ/R1gtH4Mq9u8CBiK8M=",
+        "lastModified": 1773025773,
+        "narHash": "sha256-Wik8+xApNfldpUFjPmJkPdg0RrvUPSWGIZis+A/0N1w=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "d342e8b5fd88421ff982f383c853f0fc78a847ab",
+        "rev": "3c06fdbbd36ff60386a1e590ee0cd52dcd1892bf",
         "type": "github"
       },
       "original": {

flake.nix

@@ -7,60 +7,87 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
-  outputs = {
-    self,
-    nixpkgs,
-    rust-overlay,
-    ...
-  }: let
-    inherit (nixpkgs) lib;
-    genSystems = lib.genAttrs [
-      "aarch64-darwin"
-      "aarch64-linux"
-      "x86_64-darwin"
-      "x86_64-linux"
-    ];
-    pkgsFor = system:
-      import nixpkgs {
-        inherit system;
-
-        overlays = [
-          rust-overlay.overlays.default
-        ];
-      };
-    mkRustToolchain = pkgs:
-      pkgs.rust-bin.stable.latest.default.override {
-        extensions = ["rust-src"];
-      };
-    pkgs = genSystems (system: import nixpkgs {inherit system;});
-  in {
-    packages = genSystems (system: rec {
-      default = pkgs.${system}.callPackage ./nix {};
-      lan-mouse = default;
-    });
-    homeManagerModules.default = import ./nix/hm-module.nix self;
-    devShells = genSystems (system: let
-      pkgs = pkgsFor system;
-      rust = mkRustToolchain pkgs;
-    in {
-      default = pkgs.mkShell {
-        packages = with pkgs; [
-          rust
-          rust-analyzer-unwrapped
-          pkg-config
-          xorg.libX11
-          gtk4
-          libadwaita
-          librsvg
-          xorg.libXtst
-        ] ++ lib.optionals stdenv.isDarwin
-        (with darwin.apple_sdk_11_0.frameworks; [
-          CoreGraphics
-          ApplicationServices
-        ]);
-
-        RUST_SRC_PATH = "${rust}/lib/rustlib/src/rust/library";
-      };
-    });
-  };
+  outputs =
+    {
+      nixpkgs,
+      rust-overlay,
+      self,
+      ...
+    }:
+    let
+      inherit (nixpkgs) lib;
+      forEachPkgs =
+        f:
+        lib.genAttrs
+          [
+            "aarch64-darwin"
+            "aarch64-linux"
+            "x86_64-darwin"
+            "x86_64-linux"
+          ]
+          (
+            system:
+            let
+              pkgs = import nixpkgs {
+                inherit system;
+                overlays = [ rust-overlay.overlays.default ];
+              };
+              # Default toolchain for devshell
+              rustToolchain = pkgs.rust-bin.stable.latest.default.override {
+                extensions = [
+                  # includes already:
+                  # rustc
+                  # cargo
+                  # rust-std
+                  # rust-docs
+                  # rustfmt-preview
+                  # clippy-preview
+                  "rust-analyzer"
+                  "rust-src"
+                ];
+              };
+              # Minimal toolchain for builds (rustc + cargo + rust-std only)
+              rustToolchainForBuild = pkgs.rust-bin.stable.latest.minimal;
+            in
+            f { inherit pkgs rustToolchain rustToolchainForBuild; }
+          );
+    in
+    {
+      packages = forEachPkgs (
+        { pkgs, rustToolchainForBuild, ... }:
+        let
+          customRustPlatform = pkgs.makeRustPlatform {
+            cargo = rustToolchainForBuild;
+            rustc = rustToolchainForBuild;
+          };
+          lan-mouse = pkgs.callPackage ./nix { rustPlatform = customRustPlatform; };
+        in
+        {
+          default = lan-mouse;
+          inherit lan-mouse;
+        }
+      );
+      devShells = forEachPkgs (
+        { pkgs, rustToolchain, ... }:
+        {
+          default = pkgs.mkShell {
+            packages =
+              with pkgs;
+              [
+                rustToolchain
+                pkg-config
+                gtk4
+                libadwaita
+                librsvg
+              ]
+              ++ lib.optionals pkgs.stdenv.isLinux [
+                libX11
+                libXtst
+              ];
+            env.RUST_SRC_PATH = "${rustToolchain}/lib/rustlib/src/rust/library";
+          };
+        }
+      );
+      homeManagerModules.default = import ./nix/hm-module.nix self;
+    };
 }

input-capture/Cargo.toml

@@ -12,7 +12,7 @@ futures-core = "0.3.30"
 log = "0.4.22"
 input-event = { path = "../input-event", version = "0.3.0" }
 memmap = "0.7"
-tempfile = "3.8"
+tempfile = "3.25.0"
 thiserror = "2.0.0"
 tokio = { version = "1.32.0", features = [
     "io-util",
@@ -23,6 +23,7 @@ tokio = { version = "1.32.0", features = [
     "rt",
     "sync",
     "signal",
+    "time",
 ] }
 once_cell = "1.19.0"
 async-trait = "0.1.81"
@@ -40,21 +41,22 @@ wayland-protocols-wlr = { version = "0.3.1", features = [
     "client",
 ], optional = true }
 x11 = { version = "2.21.0", features = ["xlib", "xtest"], optional = true }
-ashpd = { version = "0.10", default-features = false, features = [
+ashpd = { version = "0.13.9", default-features = false, features = [
+    "input_capture",
     "tokio",
 ], optional = true }
-reis = { version = "0.4", features = ["tokio"], optional = true }
+reis = { version = "0.5.0", features = ["tokio"], optional = true }
 
 [target.'cfg(target_os="macos")'.dependencies]
-core-graphics = { version = "0.24.0", features = ["highsierra"] }
+core-graphics = { version = "0.25.0", features = ["highsierra"] }
 core-foundation = "0.10.0"
 core-foundation-sys = "0.8.6"
 libc = "0.2.155"
-keycode = "0.4.0"
+keycode = "1.0.0"
 bitflags = "2.6.0"
 
 [target.'cfg(windows)'.dependencies]
-windows = { version = "0.58.0", features = [
+windows = { version = "0.61.2", features = [
     "Win32_System_LibraryLoader",
     "Win32_System_Threading",
     "Win32_Foundation",

input-capture/build.rs

@@ -0,0 +1,25 @@
+fn main() {
+    let unix = cfg!(unix);
+    let layer_shell = cfg!(feature = "layer_shell");
+    let libei = cfg!(feature = "libei");
+    let x11 = cfg!(feature = "x11");
+    let macos = cfg!(target_os = "macos");
+
+    let libei = unix && !macos && libei;
+    let layer_shell = unix && !macos && layer_shell;
+    let x11 = unix && !macos && x11;
+
+    println!("cargo::rustc-check-cfg=cfg(layer_shell)");
+    println!("cargo::rustc-check-cfg=cfg(libei)");
+    println!("cargo::rustc-check-cfg=cfg(x11)");
+
+    if layer_shell {
+        println!("cargo::rustc-cfg=layer_shell");
+    }
+    if libei {
+        println!("cargo::rustc-cfg=libei");
+    }
+    if x11 {
+        println!("cargo::rustc-cfg=x11");
+    }
+}

input-capture/src/dummy.rs

@@ -1,6 +1,6 @@
 use std::f64::consts::PI;
 use std::pin::Pin;
-use std::task::{ready, Context, Poll};
+use std::task::{Context, Poll, ready};
 use std::time::Duration;
 
 use async_trait::async_trait;

input-capture/src/error.rs

@@ -8,16 +8,16 @@ pub enum InputCaptureError {
     Capture(#[from] CaptureError),
 }
 
-#[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+#[cfg(layer_shell)]
 use std::io;
-#[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+#[cfg(layer_shell)]
 use wayland_client::{
+    ConnectError, DispatchError,
     backend::WaylandError,
     globals::{BindError, GlobalError},
-    ConnectError, DispatchError,
 };
 
-#[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+#[cfg(libei)]
 use ashpd::desktop::ResponseError;
 
 #[cfg(target_os = "macos")]
@@ -31,13 +31,13 @@ pub enum CaptureError {
     EndOfStream,
     #[error("io error: `{0}`")]
     Io(#[from] std::io::Error),
-    #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+    #[cfg(libei)]
     #[error("libei error: `{0}`")]
     Reis(#[from] reis::Error),
-    #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+    #[cfg(libei)]
     #[error(transparent)]
     Portal(#[from] ashpd::Error),
-    #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+    #[cfg(libei)]
     #[error("libei disconnected - reason: `{0}`")]
     Disconnected(String),
     #[cfg(target_os = "macos")]
@@ -61,13 +61,13 @@ pub enum CaptureError {
 pub enum CaptureCreationError {
     #[error("no backend available")]
     NoAvailableBackend,
-    #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+    #[cfg(libei)]
     #[error("error creating input-capture-portal backend: `{0}`")]
     Libei(#[from] LibeiCaptureCreationError),
-    #[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+    #[cfg(layer_shell)]
     #[error("error creating layer-shell capture backend: `{0}`")]
     LayerShell(#[from] LayerShellCaptureCreationError),
-    #[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+    #[cfg(x11)]
     #[error("error creating x11 capture backend: `{0}`")]
     X11(#[from] X11InputCaptureCreationError),
     #[cfg(windows)]
@@ -80,7 +80,7 @@ pub enum CaptureCreationError {
 
 impl CaptureCreationError {
     /// request was intentionally denied by the user
-    #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+    #[cfg(libei)]
     pub(crate) fn cancelled_by_user(&self) -> bool {
         matches!(
             self,
@@ -89,20 +89,20 @@ impl CaptureCreationError {
             )))
         )
     }
-    #[cfg(not(all(unix, feature = "libei", not(target_os = "macos"))))]
+    #[cfg(not(libei))]
     pub(crate) fn cancelled_by_user(&self) -> bool {
         false
     }
 }
 
-#[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+#[cfg(libei)]
 #[derive(Debug, Error)]
 pub enum LibeiCaptureCreationError {
     #[error("xdg-desktop-portal: `{0}`")]
     Ashpd(#[from] ashpd::Error),
 }
 
-#[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+#[cfg(layer_shell)]
 #[derive(Debug, Error)]
 #[error("{protocol} protocol not supported: {inner}")]
 pub struct WaylandBindError {
@@ -110,14 +110,14 @@ pub struct WaylandBindError {
     protocol: &'static str,
 }
 
-#[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+#[cfg(layer_shell)]
 impl WaylandBindError {
     pub(crate) fn new(inner: BindError, protocol: &'static str) -> Self {
         Self { inner, protocol }
     }
 }
 
-#[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+#[cfg(layer_shell)]
 #[derive(Debug, Error)]
 pub enum LayerShellCaptureCreationError {
     #[error(transparent)]
@@ -134,7 +134,7 @@ pub enum LayerShellCaptureCreationError {
     Io(#[from] io::Error),
 }
 
-#[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+#[cfg(x11)]
 #[derive(Debug, Error)]
 pub enum X11InputCaptureCreationError {
     #[error("X11 input capture is not yet implemented :(")]
@@ -149,6 +149,10 @@ pub enum MacosCaptureCreationError {
     #[cfg(target_os = "macos")]
     #[error("event tap creation failed")]
     EventTapCreation,
+    #[error("accessibility permission is required")]
+    AccessibilityPermission,
+    #[error("input monitoring permission is required")]
+    InputMonitoringPermission,
     #[error("failed to set CG Cursor property")]
     CGCursorProperty,
     #[cfg(target_os = "macos")]

input-capture/src/layer_shell.rs

@@ -7,7 +7,7 @@ use std::{
     io::{self, ErrorKind},
     os::fd::{AsFd, RawFd},
     pin::Pin,
-    task::{ready, Context, Poll},
+    task::{Context, Poll, ready},
 };
 use tokio::io::unix::AsyncFd;
 
@@ -45,9 +45,10 @@ use wayland_protocols_wlr::layer_shell::v1::client::{
 };
 
 use wayland_client::{
+    Connection, Dispatch, DispatchError, EventQueue, QueueHandle, WEnum,
     backend::{ReadEventsGuard, WaylandError},
     delegate_noop,
-    globals::{registry_queue_init, Global, GlobalList, GlobalListContents},
+    globals::{Global, GlobalList, GlobalListContents, registry_queue_init},
     protocol::{
         wl_buffer, wl_compositor,
         wl_keyboard::{self, WlKeyboard},
@@ -58,7 +59,6 @@ use wayland_client::{
         wl_seat, wl_shm, wl_shm_pool,
         wl_surface::WlSurface,
     },
-    Connection, Dispatch, DispatchError, EventQueue, QueueHandle, WEnum,
 };
 
 use input_event::{Event, KeyboardEvent, PointerEvent};
@@ -66,8 +66,8 @@ use input_event::{Event, KeyboardEvent, PointerEvent};
 use crate::{CaptureError, CaptureEvent};
 
 use super::{
-    error::{LayerShellCaptureCreationError, WaylandBindError},
     Capture, Position,
+    error::{LayerShellCaptureCreationError, WaylandBindError},
 };
 
 struct Globals {
@@ -535,7 +535,7 @@ impl State {
     fn update_windows(&mut self) {
         log::info!("active outputs: ");
         for output in self.outputs.iter().filter(|o| o.info.is_some()) {
-            log::info!(" * {}", output);
+            log::info!(" * {output}");
         }
 
         self.active_windows.clear();
@@ -582,17 +582,17 @@ impl Inner {
         match self.queue.dispatch_pending(&mut self.state) {
             Ok(_) => {}
             Err(DispatchError::Backend(WaylandError::Io(e))) => {
-                log::error!("Wayland Error: {}", e);
+                log::error!("Wayland Error: {e}");
             }
             Err(DispatchError::Backend(e)) => {
-                panic!("backend error: {}", e);
+                panic!("backend error: {e}");
             }
             Err(DispatchError::BadMessage {
                 sender_id,
                 interface,
                 opcode,
             }) => {
-                panic!("bad message {}, {} , {}", sender_id, interface, opcode);
+                panic!("bad message {sender_id}, {interface} , {opcode}");
             }
         }
     }
@@ -813,7 +813,7 @@ impl Dispatch<WlPointer, ()> for State {
                     })),
                 ));
             }
-            wl_pointer::Event::Frame {} => {
+            wl_pointer::Event::Frame => {
                 // TODO properly handle frame events
                 // we simply insert a frame event on the client side
                 // after each event for now
@@ -974,7 +974,7 @@ impl Dispatch<ZxdgOutputV1, u32> for State {
             .find(|o| o.global.name == *name)
             .expect("output");
 
-        log::debug!("xdg_output {name} - {:?}", event);
+        log::debug!("xdg_output {name} - {event:?}");
         match event {
             zxdg_output_v1::Event::LogicalPosition { x, y } => {
                 output.pending_info.position = (x, y);
@@ -1010,7 +1010,7 @@ impl Dispatch<WlOutput, u32> for State {
         _conn: &Connection,
         _qhandle: &QueueHandle<Self>,
     ) {
-        log::debug!("wl_output {name} - {:?}", event);
+        log::debug!("wl_output {name} - {event:?}");
         if let wl_output::Event::Done = event {
             state.update_output_info(*name);
         }

input-capture/src/lib.rs

@@ -2,32 +2,32 @@ use std::{
     collections::{HashMap, HashSet, VecDeque},
     fmt::Display,
     mem::swap,
-    task::{ready, Poll},
+    task::{Poll, ready},
 };
 
 use async_trait::async_trait;
 use futures::StreamExt;
 use futures_core::Stream;
 
-use input_event::{scancode, Event, KeyboardEvent};
+use input_event::{Event, KeyboardEvent, scancode};
 
 pub use error::{CaptureCreationError, CaptureError, InputCaptureError};
 
 pub mod error;
 
-#[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+#[cfg(libei)]
 mod libei;
 
 #[cfg(target_os = "macos")]
 mod macos;
 
-#[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+#[cfg(layer_shell)]
 mod layer_shell;
 
 #[cfg(windows)]
 mod windows;
 
-#[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+#[cfg(x11)]
 mod x11;
 
 /// fallback input capture (does not produce events)
@@ -79,17 +79,17 @@ impl Display for Position {
             Position::Top => "top",
             Position::Bottom => "bottom",
         };
-        write!(f, "{}", pos)
+        write!(f, "{pos}")
     }
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum Backend {
-    #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+    #[cfg(libei)]
     InputCapturePortal,
-    #[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+    #[cfg(layer_shell)]
     LayerShell,
-    #[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+    #[cfg(x11)]
     X11,
     #[cfg(windows)]
     Windows,
@@ -101,11 +101,11 @@ pub enum Backend {
 impl Display for Backend {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
-            #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+            #[cfg(libei)]
             Backend::InputCapturePortal => write!(f, "input-capture-portal"),
-            #[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+            #[cfg(layer_shell)]
             Backend::LayerShell => write!(f, "layer-shell"),
-            #[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+            #[cfg(x11)]
             Backend::X11 => write!(f, "X11"),
             #[cfg(windows)]
             Backend::Windows => write!(f, "windows"),
@@ -171,6 +171,19 @@ impl InputCapture {
         self.capture.release().await
     }
 
+    /// Drain and return every key the capture has forwarded as
+    /// down-but-not-up. The caller is expected to synthesize key-up
+    /// events to the remote peer for each — otherwise the peer
+    /// retains phantom-held keys after capture is released. The
+    /// canonical case is the release-bind chord
+    /// (Ctrl+Shift+Alt+Meta): the down events were sent while
+    /// capture was active, but the matching up events arrive after
+    /// the local tap has flipped to passthrough and never reach
+    /// the peer.
+    pub fn take_pressed_keys(&mut self) -> HashSet<scancode::Linux> {
+        std::mem::take(&mut self.pressed_keys)
+    }
+
     /// destroy the input capture
     pub async fn terminate(&mut self) -> Result<(), CaptureError> {
         self.capture.terminate().await
@@ -285,11 +298,11 @@ async fn create_backend(
     CaptureCreationError,
 > {
     match backend {
-        #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+        #[cfg(libei)]
         Backend::InputCapturePortal => Ok(Box::new(libei::LibeiInputCapture::new().await?)),
-        #[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+        #[cfg(layer_shell)]
         Backend::LayerShell => Ok(Box::new(layer_shell::LayerShellInputCapture::new()?)),
-        #[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+        #[cfg(x11)]
         Backend::X11 => Ok(Box::new(x11::X11InputCapture::new()?)),
         #[cfg(windows)]
         Backend::Windows => Ok(Box::new(windows::WindowsInputCapture::new())),
@@ -314,11 +327,11 @@ async fn create(
     }
 
     for backend in [
-        #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+        #[cfg(libei)]
         Backend::InputCapturePortal,
-        #[cfg(all(unix, feature = "layer_shell", not(target_os = "macos")))]
+        #[cfg(layer_shell)]
         Backend::LayerShell,
-        #[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+        #[cfg(x11)]
         Backend::X11,
         #[cfg(windows)]
         Backend::Windows,

input-capture/src/libei.rs

@@ -1,10 +1,10 @@
 use ashpd::{
     desktop::{
-        input_capture::{
-            Activated, ActivatedBarrier, Barrier, BarrierID, Capabilities, InputCapture, Region,
-            Zones,
-        },
         Session,
+        input_capture::{
+            Activated, ActivatedBarrier, Barrier, BarrierID, Capabilities, CreateSessionOptions,
+            InputCapture, Region, ReleaseOptions, Zones,
+        },
     },
     enumflags2::BitFlags,
 };
@@ -28,8 +28,8 @@ use std::{
 };
 use tokio::{
     sync::{
-        mpsc::{self, Receiver, Sender},
         Notify,
+        mpsc::{self, Receiver, Sender},
     },
     task::JoinHandle,
 };
@@ -42,8 +42,8 @@ use input_event::Event;
 use crate::CaptureEvent;
 
 use super::{
-    error::{CaptureError, LibeiCaptureCreationError},
     Capture as LanMouseInputCapture, Position,
+    error::{CaptureError, LibeiCaptureCreationError},
 };
 
 /* there is a bug in xdg-remote-desktop-portal-gnome / mutter that
@@ -58,8 +58,8 @@ enum LibeiNotifyEvent {
 }
 
 #[allow(dead_code)]
-pub struct LibeiInputCapture<'a> {
-    input_capture: Pin<Box<InputCapture<'a>>>,
+pub struct LibeiInputCapture {
+    input_capture: Pin<Box<InputCapture>>,
     capture_task: JoinHandle<Result<(), CaptureError>>,
     event_rx: Receiver<(Position, CaptureEvent)>,
     notify_capture: Sender<LibeiNotifyEvent>,
@@ -130,12 +130,15 @@ fn select_barriers(
 }
 
 async fn update_barriers(
-    input_capture: &InputCapture<'_>,
-    session: &Session<'_, InputCapture<'_>>,
+    input_capture: &InputCapture,
+    session: &Session<InputCapture>,
     active_clients: &[Position],
     next_barrier_id: &mut NonZeroU32,
 ) -> Result<(Vec<ICBarrier>, HashMap<BarrierID, Position>), ashpd::Error> {
-    let zones = input_capture.zones(session).await?.response()?;
+    let zones = input_capture
+        .zones(session, Default::default())
+        .await?
+        .response()?;
     log::debug!("zones: {zones:?}");
 
     let (barriers, id_map) = select_barriers(&zones, active_clients, next_barrier_id);
@@ -144,31 +147,38 @@ async fn update_barriers(
 
     let ashpd_barriers: Vec<Barrier> = barriers.iter().copied().map(|b| b.into()).collect();
     let response = input_capture
-        .set_pointer_barriers(session, &ashpd_barriers, zones.zone_set())
+        .set_pointer_barriers(
+            session,
+            &ashpd_barriers,
+            zones.zone_set(),
+            Default::default(),
+        )
         .await?;
     let response = response.response()?;
     log::debug!("{response:?}");
     Ok((barriers, id_map))
 }
 
-async fn create_session<'a>(
-    input_capture: &'a InputCapture<'a>,
-) -> std::result::Result<(Session<'a, InputCapture<'a>>, BitFlags<Capabilities>), ashpd::Error> {
+async fn create_session(
+    input_capture: &InputCapture,
+) -> std::result::Result<(Session<InputCapture>, BitFlags<Capabilities>), ashpd::Error> {
     log::debug!("creating input capture session");
+    let create_session_options = CreateSessionOptions::default().set_capabilities(
+        Capabilities::Keyboard | Capabilities::Pointer | Capabilities::Touchscreen,
+    );
     input_capture
-        .create_session(
-            None,
-            Capabilities::Keyboard | Capabilities::Pointer | Capabilities::Touchscreen,
-        )
+        .create_session(None, create_session_options)
         .await
 }
 
 async fn connect_to_eis(
-    input_capture: &InputCapture<'_>,
-    session: &Session<'_, InputCapture<'_>>,
+    input_capture: &InputCapture,
+    session: &Session<InputCapture>,
 ) -> Result<(ei::Context, Connection, EiConvertEventStream), CaptureError> {
     log::debug!("connect_to_eis");
-    let fd = input_capture.connect_to_eis(session).await?;
+    let fd = input_capture
+        .connect_to_eis(session, Default::default())
+        .await?;
 
     // create unix stream from fd
     let stream = UnixStream::from(fd);
@@ -201,10 +211,10 @@ async fn libei_event_handler(
     }
 }
 
-impl LibeiInputCapture<'_> {
+impl LibeiInputCapture {
     pub async fn new() -> std::result::Result<Self, LibeiCaptureCreationError> {
         let input_capture = Box::pin(InputCapture::new().await?);
-        let input_capture_ptr = input_capture.as_ref().get_ref() as *const InputCapture<'static>;
+        let input_capture_ptr = input_capture.as_ref().get_ref() as *const InputCapture;
         let first_session = Some(create_session(unsafe { &*input_capture_ptr }).await?);
 
         let (event_tx, event_rx) = mpsc::channel(1);
@@ -238,10 +248,10 @@ impl LibeiInputCapture<'_> {
 }
 
 async fn do_capture(
-    input_capture: *const InputCapture<'static>,
+    input_capture: *const InputCapture,
     mut capture_event: Receiver<LibeiNotifyEvent>,
     notify_release: Arc<Notify>,
-    session: Option<(Session<'_, InputCapture<'_>>, BitFlags<Capabilities>)>,
+    session: Option<(Session<InputCapture>, BitFlags<Capabilities>)>,
     event_tx: Sender<(Position, CaptureEvent)>,
     cancellation_token: CancellationToken,
 ) -> Result<(), CaptureError> {
@@ -307,7 +317,7 @@ async fn do_capture(
 
             // disable capture
             log::debug!("disabling input capture");
-            if let Err(e) = input_capture.disable(&session).await {
+            if let Err(e) = input_capture.disable(&session, Default::default()).await {
                 log::warn!("input_capture.disable(&session) {e}");
             }
             if let Err(e) = session.close().await {
@@ -336,8 +346,8 @@ async fn do_capture(
 }
 
 async fn do_capture_session(
-    input_capture: &InputCapture<'_>,
-    session: &mut Session<'_, InputCapture<'_>>,
+    input_capture: &InputCapture,
+    session: &mut Session<InputCapture>,
     event_tx: &Sender<(Position, CaptureEvent)>,
     active_clients: &[Position],
     next_barrier_id: &mut NonZeroU32,
@@ -356,7 +366,7 @@ async fn do_capture_session(
         update_barriers(input_capture, session, active_clients, next_barrier_id).await?;
 
     log::debug!("enabling session");
-    input_capture.enable(session).await?;
+    input_capture.enable(session, Default::default()).await?;
 
     // cancellation token to release session
     let release_session = Arc::new(Notify::new());
@@ -462,9 +472,9 @@ async fn do_capture_session(
     Ok(())
 }
 
-async fn release_capture<'a>(
-    input_capture: &InputCapture<'a>,
-    session: &Session<'a, InputCapture<'a>>,
+async fn release_capture(
+    input_capture: &InputCapture,
+    session: &Session<InputCapture>,
     activated: Activated,
     current_pos: Position,
 ) -> Result<(), CaptureError> {
@@ -484,9 +494,10 @@ async fn release_capture<'a>(
     };
     // release 1px to the right of the entered zone
     let cursor_position = (x as f64 + dx, y as f64 + dy);
-    input_capture
-        .release(session, activated.activation_id(), Some(cursor_position))
-        .await?;
+    let release_options = ReleaseOptions::default()
+        .set_activation_id(activated.activation_id())
+        .set_cursor_position(Some(cursor_position));
+    input_capture.release(session, release_options).await?;
     Ok(())
 }
 
@@ -561,7 +572,7 @@ async fn handle_ei_event(
 }
 
 #[async_trait]
-impl LanMouseInputCapture for LibeiInputCapture<'_> {
+impl LanMouseInputCapture for LibeiInputCapture {
     async fn create(&mut self, pos: Position) -> Result<(), CaptureError> {
         let _ = self
             .notify_capture
@@ -587,14 +598,18 @@ impl LanMouseInputCapture for LibeiInputCapture<'_> {
         self.cancellation_token.cancel();
         let task = &mut self.capture_task;
         log::debug!("waiting for capture to terminate...");
-        let res = task.await.expect("libei task panic");
-        log::debug!("done!");
+        let res = if !task.is_finished() {
+            task.await.expect("libei task panic")
+        } else {
+            Ok(())
+        };
         self.terminated = true;
+        log::debug!("done!");
         res
     }
 }
 
-impl Drop for LibeiInputCapture<'_> {
+impl Drop for LibeiInputCapture {
     fn drop(&mut self) {
         if !self.terminated {
             /* this workaround is needed until async drop is stabilized */
@@ -603,10 +618,10 @@ impl Drop for LibeiInputCapture<'_> {
     }
 }
 
-impl Stream for LibeiInputCapture<'_> {
+impl Stream for LibeiInputCapture {
     type Item = Result<(Position, CaptureEvent), CaptureError>;
 
-    fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+    fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context) -> Poll<Option<Self::Item>> {
         match self.capture_task.poll_unpin(cx) {
             Poll::Ready(r) => match r.expect("failed to join") {
                 Ok(()) => Poll::Ready(None),

input-capture/src/macos.rs

@@ -1,31 +1,42 @@
-use super::{error::MacosCaptureCreationError, Capture, CaptureError, CaptureEvent, Position};
+use super::{Capture, CaptureError, CaptureEvent, Position, error::MacosCaptureCreationError};
 use async_trait::async_trait;
 use bitflags::bitflags;
-use core_foundation::base::{kCFAllocatorDefault, CFRelease};
-use core_foundation::date::CFTimeInterval;
-use core_foundation::number::{kCFBooleanTrue, CFBooleanRef};
-use core_foundation::runloop::{kCFRunLoopCommonModes, CFRunLoop, CFRunLoopSource};
-use core_foundation::string::{kCFStringEncodingUTF8, CFStringCreateWithCString, CFStringRef};
-use core_graphics::base::{kCGErrorSuccess, CGError};
-use core_graphics::display::{CGDisplay, CGPoint};
-use core_graphics::event::{
-    CGEvent, CGEventFlags, CGEventTap, CGEventTapLocation, CGEventTapOptions, CGEventTapPlacement,
-    CGEventTapProxy, CGEventType, EventField,
+use core_foundation::{
+    base::{CFRelease, TCFType, kCFAllocatorDefault},
+    date::CFTimeInterval,
+    number::{CFBooleanRef, kCFBooleanTrue},
+    runloop::{CFRunLoop, CFRunLoopSource, kCFRunLoopCommonModes},
+    string::{CFStringCreateWithCString, CFStringRef, kCFStringEncodingUTF8},
+};
+use core_graphics::{
+    base::{CGError, kCGErrorSuccess},
+    display::{CGDisplay, CGPoint},
+    event::{
+        CGEvent, CGEventFlags, CGEventTap, CGEventTapLocation, CGEventTapOptions,
+        CGEventTapPlacement, CGEventTapProxy, CGEventType, CallbackResult, EventField,
+    },
+    event_source::{CGEventSource, CGEventSourceStateID},
 };
-use core_graphics::event_source::{CGEventSource, CGEventSourceStateID};
 use futures_core::Stream;
-use input_event::{Event, KeyboardEvent, PointerEvent, BTN_LEFT, BTN_MIDDLE, BTN_RIGHT};
+use input_event::{
+    BTN_BACK, BTN_FORWARD, BTN_LEFT, BTN_MIDDLE, BTN_RIGHT, Event, KeyboardEvent, PointerEvent,
+};
 use keycode::{KeyMap, KeyMapping};
 use libc::c_void;
 use once_cell::unsync::Lazy;
-use std::collections::HashSet;
-use std::ffi::{c_char, CString};
-use std::pin::Pin;
-use std::sync::Arc;
-use std::task::{ready, Context, Poll};
-use std::thread::{self};
-use tokio::sync::mpsc::{self, Receiver, Sender};
-use tokio::sync::{oneshot, Mutex};
+use std::{
+    collections::HashSet,
+    ffi::{CString, c_char},
+    pin::Pin,
+    sync::{Arc, OnceLock},
+    task::{Context, Poll, ready},
+    thread::{self},
+};
+use tokio::sync::{
+    Mutex,
+    mpsc::{self, Receiver, Sender},
+    oneshot,
+};
 
 #[derive(Debug, Default)]
 struct Bounds {
@@ -37,9 +48,16 @@ struct Bounds {
 
 #[derive(Debug)]
 struct InputCaptureState {
+    /// active capture positions
     active_clients: Lazy<HashSet<Position>>,
+    /// the currently entered capture position, if any
     current_pos: Option<Position>,
+    /// position where the cursor was captured
+    enter_position: Option<CGPoint>,
+    /// bounds of the input capture area
     bounds: Bounds,
+    /// current state of modifier keys
+    modifier_state: XMods,
 }
 
 #[derive(Debug)]
@@ -49,6 +67,7 @@ enum ProducerEvent {
     Destroy(Position),
     Grab(Position),
     EventTapDisabled,
+    DisplayReconfigured,
 }
 
 impl InputCaptureState {
@@ -56,7 +75,9 @@ impl InputCaptureState {
         let mut res = Self {
             active_clients: Lazy::new(HashSet::new),
             current_pos: None,
+            enter_position: None,
             bounds: Bounds::default(),
+            modifier_state: Default::default(),
         };
         res.update_bounds()?;
         Ok(res)
@@ -96,45 +117,34 @@ impl InputCaptureState {
         Ok(())
     }
 
-    // We can't disable mouse movement when in a client so we need to reset the cursor position
-    // to the edge of the screen, the cursor will be hidden but we dont want it to appear in a
-    // random location when we exit the client
-    fn reset_mouse_position(&self, event: &CGEvent) -> Result<(), CaptureError> {
-        if let Some(pos) = self.current_pos {
-            let location = event.location();
-            let edge_offset = 1.0;
+    /// start the input capture by
+    fn start_capture(&mut self, event: &CGEvent, position: Position) -> Result<(), CaptureError> {
+        let mut location = event.location();
+        let edge_offset = 1.0;
+        // move cursor location to display bounds
+        match position {
+            Position::Left => location.x = self.bounds.xmin + edge_offset,
+            Position::Right => location.x = self.bounds.xmax - edge_offset,
+            Position::Top => location.y = self.bounds.ymin + edge_offset,
+            Position::Bottom => location.y = self.bounds.ymax - edge_offset,
+        };
+        self.enter_position = Some(location);
+        self.reset_cursor()
+    }
 
-            // After the cursor is warped no event is produced but the next event
-            // will carry the delta from the warp so only half the delta is needed to move the cursor
-            let delta_y = event.get_double_value_field(EventField::MOUSE_EVENT_DELTA_Y) / 2.0;
-            let delta_x = event.get_double_value_field(EventField::MOUSE_EVENT_DELTA_X) / 2.0;
+    /// resets the cursor to the position, where the capture started
+    fn reset_cursor(&mut self) -> Result<(), CaptureError> {
+        let pos = self.enter_position.expect("capture active");
+        log::trace!("Resetting cursor position to: {}, {}", pos.x, pos.y);
+        CGDisplay::warp_mouse_cursor_position(pos).map_err(CaptureError::WarpCursor)
+    }
 
-            let mut new_x = location.x + delta_x;
-            let mut new_y = location.y + delta_y;
+    fn hide_cursor(&self) -> Result<(), CaptureError> {
+        CGDisplay::hide_cursor(&CGDisplay::main()).map_err(CaptureError::CoreGraphics)
+    }
 
-            match pos {
-                Position::Left => {
-                    new_x = self.bounds.xmin + edge_offset;
-                }
-                Position::Right => {
-                    new_x = self.bounds.xmax - edge_offset;
-                }
-                Position::Top => {
-                    new_y = self.bounds.ymin + edge_offset;
-                }
-                Position::Bottom => {
-                    new_y = self.bounds.ymax - edge_offset;
-                }
-            }
-            let new_pos = CGPoint::new(new_x, new_y);
-
-            log::trace!("Resetting cursor position to: {new_x}, {new_y}");
-
-            return CGDisplay::warp_mouse_cursor_position(new_pos)
-                .map_err(CaptureError::WarpCursor);
-        }
-
-        Err(CaptureError::ResetMouseWithoutClient)
+    fn show_cursor(&self) -> Result<(), CaptureError> {
+        CGDisplay::show_cursor(&CGDisplay::main()).map_err(CaptureError::CoreGraphics)
     }
 
     async fn handle_producer_event(
@@ -145,15 +155,13 @@ impl InputCaptureState {
         match producer_event {
             ProducerEvent::Release => {
                 if self.current_pos.is_some() {
-                    CGDisplay::show_cursor(&CGDisplay::main())
-                        .map_err(CaptureError::CoreGraphics)?;
+                    self.show_cursor()?;
                     self.current_pos = None;
                 }
             }
             ProducerEvent::Grab(pos) => {
                 if self.current_pos.is_none() {
-                    CGDisplay::hide_cursor(&CGDisplay::main())
-                        .map_err(CaptureError::CoreGraphics)?;
+                    self.hide_cursor()?;
                     self.current_pos = Some(pos);
                 }
             }
@@ -163,14 +171,37 @@ impl InputCaptureState {
             ProducerEvent::Destroy(p) => {
                 if let Some(current) = self.current_pos {
                     if current == p {
-                        CGDisplay::show_cursor(&CGDisplay::main())
-                            .map_err(CaptureError::CoreGraphics)?;
+                        self.show_cursor()?;
                         self.current_pos = None;
                     };
                 }
                 self.active_clients.remove(&p);
             }
-            ProducerEvent::EventTapDisabled => return Err(CaptureError::EventTapDisabled),
+            ProducerEvent::EventTapDisabled => {
+                // Tap death can happen mid-capture (TCC Accessibility
+                // revoked, tap-timeout, etc). Release state so we
+                // don't leave the cursor hidden even if the outer
+                // task only logs this error rather than propagating.
+                if self.current_pos.is_some() {
+                    self.show_cursor()?;
+                    self.current_pos = None;
+                }
+                return Err(CaptureError::EventTapDisabled);
+            }
+            ProducerEvent::DisplayReconfigured => {
+                // The macOS display configuration changed — a monitor
+                // was plugged in/out, the resolution changed, the
+                // arrangement was rearranged, etc. Re-fetch the
+                // active-display bounds so barrier crossings and the
+                // cursor-warp on capture-start use the current
+                // geometry instead of whatever was true at process
+                // start.
+                if let Err(e) = self.update_bounds() {
+                    log::warn!("failed to refresh display bounds: {e}");
+                } else {
+                    log::info!("display reconfigured: {:?}", self.bounds);
+                }
+            }
         };
         Ok(())
     }
@@ -180,6 +211,7 @@ fn get_events(
     ev_type: &CGEventType,
     ev: &CGEvent,
     result: &mut Vec<CaptureEvent>,
+    modifier_state: &mut XMods,
 ) -> Result<(), CaptureError> {
     fn map_pointer_event(ev: &CGEvent) -> PointerEvent {
         PointerEvent::Motion {
@@ -215,29 +247,42 @@ fn get_events(
             })));
         }
         CGEventType::FlagsChanged => {
-            let mut mods = XMods::empty();
+            let mut depressed = XMods::empty();
             let mut mods_locked = XMods::empty();
             let cg_flags = ev.get_flags();
 
             if cg_flags.contains(CGEventFlags::CGEventFlagShift) {
-                mods |= XMods::ShiftMask;
+                depressed |= XMods::ShiftMask;
             }
             if cg_flags.contains(CGEventFlags::CGEventFlagControl) {
-                mods |= XMods::ControlMask;
+                depressed |= XMods::ControlMask;
             }
             if cg_flags.contains(CGEventFlags::CGEventFlagAlternate) {
-                mods |= XMods::Mod1Mask;
+                depressed |= XMods::Mod1Mask;
             }
             if cg_flags.contains(CGEventFlags::CGEventFlagCommand) {
-                mods |= XMods::Mod4Mask;
+                depressed |= XMods::Mod4Mask;
             }
             if cg_flags.contains(CGEventFlags::CGEventFlagAlphaShift) {
-                mods |= XMods::LockMask;
+                depressed |= XMods::LockMask;
                 mods_locked |= XMods::LockMask;
             }
 
+            // check if pressed or released
+            let state = if depressed > *modifier_state { 1 } else { 0 };
+            *modifier_state = depressed;
+
+            if let Ok(key) = map_key(ev) {
+                let key_event = CaptureEvent::Input(Event::Keyboard(KeyboardEvent::Key {
+                    time: 0,
+                    key,
+                    state,
+                }));
+                result.push(key_event);
+            }
+
             let modifier_event = KeyboardEvent::Modifiers {
-                depressed: mods.bits(),
+                depressed: depressed.bits(),
                 latched: 0,
                 locked: mods_locked.bits(),
                 group: 0,
@@ -286,35 +331,73 @@ fn get_events(
             })))
         }
         CGEventType::OtherMouseDown => {
+            let btn_num = ev.get_integer_value_field(EventField::MOUSE_EVENT_BUTTON_NUMBER);
+            let button = match btn_num {
+                3 => BTN_BACK,
+                4 => BTN_FORWARD,
+                _ => BTN_MIDDLE,
+            };
             result.push(CaptureEvent::Input(Event::Pointer(PointerEvent::Button {
                 time: 0,
-                button: BTN_MIDDLE,
+                button,
                 state: 1,
             })))
         }
         CGEventType::OtherMouseUp => {
+            let btn_num = ev.get_integer_value_field(EventField::MOUSE_EVENT_BUTTON_NUMBER);
+            let button = match btn_num {
+                3 => BTN_BACK,
+                4 => BTN_FORWARD,
+                _ => BTN_MIDDLE,
+            };
             result.push(CaptureEvent::Input(Event::Pointer(PointerEvent::Button {
                 time: 0,
-                button: BTN_MIDDLE,
+                button,
                 state: 0,
             })))
         }
         CGEventType::ScrollWheel => {
-            let v = ev.get_integer_value_field(EventField::SCROLL_WHEEL_EVENT_POINT_DELTA_AXIS_1);
-            let h = ev.get_integer_value_field(EventField::SCROLL_WHEEL_EVENT_POINT_DELTA_AXIS_2);
-            if v != 0 {
-                result.push(CaptureEvent::Input(Event::Pointer(PointerEvent::Axis {
-                    time: 0,
-                    axis: 0, // Vertical
-                    value: v as f64,
-                })));
-            }
-            if h != 0 {
-                result.push(CaptureEvent::Input(Event::Pointer(PointerEvent::Axis {
-                    time: 0,
-                    axis: 1, // Horizontal
-                    value: h as f64,
-                })));
+            if ev.get_integer_value_field(EventField::SCROLL_WHEEL_EVENT_IS_CONTINUOUS) != 0 {
+                let v =
+                    ev.get_integer_value_field(EventField::SCROLL_WHEEL_EVENT_POINT_DELTA_AXIS_1);
+                let h =
+                    ev.get_integer_value_field(EventField::SCROLL_WHEEL_EVENT_POINT_DELTA_AXIS_2);
+                if v != 0 {
+                    result.push(CaptureEvent::Input(Event::Pointer(PointerEvent::Axis {
+                        time: 0,
+                        axis: 0, // Vertical
+                        value: v as f64,
+                    })));
+                }
+                if h != 0 {
+                    result.push(CaptureEvent::Input(Event::Pointer(PointerEvent::Axis {
+                        time: 0,
+                        axis: 1, // Horizontal
+                        value: h as f64,
+                    })));
+                }
+            } else {
+                // line based scrolling
+                const LINES_PER_STEP: i32 = 3;
+                const V120_STEPS_PER_LINE: i32 = 120 / LINES_PER_STEP;
+                let v = ev.get_integer_value_field(EventField::SCROLL_WHEEL_EVENT_DELTA_AXIS_1);
+                let h = ev.get_integer_value_field(EventField::SCROLL_WHEEL_EVENT_DELTA_AXIS_2);
+                if v != 0 {
+                    result.push(CaptureEvent::Input(Event::Pointer(
+                        PointerEvent::AxisDiscrete120 {
+                            axis: 0, // Vertical
+                            value: V120_STEPS_PER_LINE * v as i32,
+                        },
+                    )));
+                }
+                if h != 0 {
+                    result.push(CaptureEvent::Input(Event::Pointer(
+                        PointerEvent::AxisDiscrete120 {
+                            axis: 1, // Horizontal
+                            value: V120_STEPS_PER_LINE * h as i32,
+                        },
+                    )));
+                }
             }
         }
         _ => (),
@@ -327,6 +410,14 @@ fn create_event_tap<'a>(
     notify_tx: Sender<ProducerEvent>,
     event_tx: Sender<(Position, CaptureEvent)>,
 ) -> Result<CGEventTap<'a>, MacosCaptureCreationError> {
+    // Shared slot for the tap's mach port pointer. Stored as `usize`
+    // because raw pointers aren't `Send`, but the integer
+    // representation is — and CGEventTapEnable is documented as
+    // thread-safe. Set immediately after CGEventTap::new returns;
+    // read by the callback to recover from a TapDisabledByTimeout.
+    let tap_mach_port: Arc<OnceLock<usize>> = Arc::new(OnceLock::new());
+    let tap_mach_port_cb = Arc::clone(&tap_mach_port);
+
     let cg_events_of_interest: Vec<CGEventType> = vec![
         CGEventType::LeftMouseDown,
         CGEventType::LeftMouseUp,
@@ -344,62 +435,114 @@ fn create_event_tap<'a>(
         CGEventType::FlagsChanged,
     ];
 
-    let event_tap_callback =
-        move |_proxy: CGEventTapProxy, event_type: CGEventType, cg_ev: &CGEvent| {
-            log::trace!("Got event from tap: {event_type:?}");
-            let mut state = client_state.blocking_lock();
-            let mut pos = None;
-            let mut res_events = vec![];
+    let event_tap_callback = move |_proxy: CGEventTapProxy,
+                                   event_type: CGEventType,
+                                   cg_ev: &CGEvent| {
+        log::trace!("Got event from tap: {event_type:?}");
+        let mut state = client_state.blocking_lock();
+        let mut capture_position = None;
+        let mut res_events = vec![];
 
+        if matches!(event_type, CGEventType::TapDisabledByTimeout) {
+            // The kernel disables the tap when our callback runs
+            // longer than ~1s on a single event — typical causes
+            // are heavy load, scheduler contention, or this
+            // process being briefly suspended (e.g. App Nap on a
+            // long idle). It is NOT a fatal condition: Apple's
+            // documented recovery is to call CGEventTapEnable
+            // and resume processing. Re-enable in place and KEEP
+            // existing capture state so the user doesn't see the
+            // cursor pop back to the local screen mid-session.
+            if let Some(&port) = tap_mach_port_cb.get() {
+                log::warn!("CGEventTap disabled by timeout — re-enabling");
+                unsafe {
+                    CGEventTapEnable(port as *mut c_void, true);
+                }
+            } else {
+                log::error!(
+                    "CGEventTap disabled by timeout, but mach port not yet stored — cannot re-enable"
+                );
+            }
+            return CallbackResult::Keep;
+        }
+
+        if matches!(event_type, CGEventType::TapDisabledByUserInput) {
+            // Deliberate kill — secure-input mode (e.g. password
+            // field), TCC Accessibility revoked mid-session, or
+            // the user disabling event-monitoring. We can't
+            // recover from this; drop captured state synchronously
+            // and return Keep on this event. Otherwise the
+            // `current_pos.is_some()` branch below would drop this
+            // event (and any racing callback still in flight) back
+            // into `CallbackResult::Drop`, silently eating the
+            // user's clicks and keypresses while the tap winds
+            // down. Clear state + show the cursor here, then
+            // notify the producer loop so the service can tear
+            // down cleanly.
+            log::error!("CGEventTap disabled by user input, releasing capture state");
+            if state.current_pos.is_some() {
+                let _ = CGDisplay::show_cursor(&CGDisplay::main());
+                state.current_pos = None;
+            }
+            notify_tx
+                .blocking_send(ProducerEvent::EventTapDisabled)
+                .unwrap_or_else(|e| {
+                    log::error!("Failed to send notification: {e}");
+                });
+            return CallbackResult::Keep;
+        }
+
+        // Are we in a client?
+        if let Some(current_pos) = state.current_pos {
+            capture_position = Some(current_pos);
+            get_events(
+                &event_type,
+                cg_ev,
+                &mut res_events,
+                &mut state.modifier_state,
+            )
+            .unwrap_or_else(|e| {
+                log::error!("Failed to get events: {e}");
+            });
+
+            // Keep (hidden) cursor at the edge of the screen
             if matches!(
                 event_type,
-                CGEventType::TapDisabledByTimeout | CGEventType::TapDisabledByUserInput
+                CGEventType::MouseMoved
+                    | CGEventType::LeftMouseDragged
+                    | CGEventType::RightMouseDragged
+                    | CGEventType::OtherMouseDragged
             ) {
-                log::error!("CGEventTap disabled");
-                notify_tx
-                    .blocking_send(ProducerEvent::EventTapDisabled)
-                    .unwrap_or_else(|e| {
-                        log::error!("Failed to send notification: {e}");
-                    });
-            }
-
-            // Are we in a client?
-            if let Some(current_pos) = state.current_pos {
-                pos = Some(current_pos);
-                get_events(&event_type, cg_ev, &mut res_events).unwrap_or_else(|e| {
-                    log::error!("Failed to get events: {e}");
-                });
-
-                // Keep (hidden) cursor at the edge of the screen
-                if matches!(event_type, CGEventType::MouseMoved) {
-                    state.reset_mouse_position(cg_ev).unwrap_or_else(|e| {
-                        log::error!("Failed to reset mouse position: {e}");
-                    })
-                }
+                state.reset_cursor().unwrap_or_else(|e| log::warn!("{e}"));
             }
+        } else if matches!(event_type, CGEventType::MouseMoved) {
             // Did we cross a barrier?
-            else if matches!(event_type, CGEventType::MouseMoved) {
-                if let Some(new_pos) = state.crossed(cg_ev) {
-                    pos = Some(new_pos);
-                    res_events.push(CaptureEvent::Begin);
-                    notify_tx
-                        .blocking_send(ProducerEvent::Grab(new_pos))
-                        .expect("Failed to send notification");
-                }
+            if let Some(new_pos) = state.crossed(cg_ev) {
+                capture_position = Some(new_pos);
+                state
+                    .start_capture(cg_ev, new_pos)
+                    .unwrap_or_else(|e| log::warn!("{e}"));
+                res_events.push(CaptureEvent::Begin);
+                notify_tx
+                    .blocking_send(ProducerEvent::Grab(new_pos))
+                    .expect("Failed to send notification");
             }
+        }
 
-            if let Some(pos) = pos {
-                res_events.iter().for_each(|e| {
-                    event_tx
-                        .blocking_send((pos, *e))
-                        .expect("Failed to send event");
-                });
-                // Returning None should stop the event from being processed
-                // but core fundation still returns the event
-                cg_ev.set_type(CGEventType::Null);
-            }
-            Some(cg_ev.to_owned())
-        };
+        if let Some(pos) = capture_position {
+            res_events.iter().for_each(|e| {
+                // error must be ignored, since the event channel
+                // may already be closed when the InputCapture instance is dropped.
+                let _ = event_tx.blocking_send((pos, *e));
+            });
+            // Returning Drop should stop the event from being processed
+            // but core fundation still returns the event
+            cg_ev.set_type(CGEventType::Null);
+            CallbackResult::Drop
+        } else {
+            CallbackResult::Keep
+        }
+    };
 
     let tap = CGEventTap::new(
         CGEventTapLocation::Session,
@@ -410,8 +553,15 @@ fn create_event_tap<'a>(
     )
     .map_err(|_| MacosCaptureCreationError::EventTapCreation)?;
 
+    // Hand the mach port pointer to the callback so it can re-enable
+    // the tap on TapDisabledByTimeout. The pointer is valid for the
+    // lifetime of `tap` (which lives on the event-tap thread until
+    // the run loop exits).
+    let port_ptr = tap.mach_port().as_concrete_TypeRef() as usize;
+    let _ = tap_mach_port.set(port_ptr);
+
     let tap_source: CFRunLoopSource = tap
-        .mach_port
+        .mach_port()
         .create_runloop_source(0)
         .expect("Failed creating loop source");
 
@@ -426,31 +576,89 @@ fn event_tap_thread(
     client_state: Arc<Mutex<InputCaptureState>>,
     event_tx: Sender<(Position, CaptureEvent)>,
     notify_tx: Sender<ProducerEvent>,
-    ready: std::sync::mpsc::Sender<Result<(), MacosCaptureCreationError>>,
-    exit: oneshot::Sender<Result<(), &'static str>>,
+    ready: std::sync::mpsc::Sender<Result<CFRunLoop, MacosCaptureCreationError>>,
+    exit: oneshot::Sender<()>,
 ) {
+    // Clone now: create_event_tap consumes notify_tx into its closure.
+    let display_notify_tx = notify_tx.clone();
+
     let _tap = match create_event_tap(client_state, notify_tx, event_tx) {
         Err(e) => {
             ready.send(Err(e)).expect("channel closed");
             return;
         }
         Ok(tap) => {
-            ready.send(Ok(())).expect("channel closed");
+            let run_loop = CFRunLoop::get_current();
+            ready.send(Ok(run_loop)).expect("channel closed");
             tap
         }
     };
-    CFRunLoop::run_current();
 
-    let _ = exit.send(Err("tap thread exited"));
+    // Register a Quartz display-reconfiguration callback so the
+    // capture state's bounds get refreshed when the user plugs in a
+    // monitor, changes resolution, or rearranges displays. The
+    // callback runs on this thread's CFRunLoop. Box-leak the sender
+    // so the C side has a stable user_info pointer; reclaim it after
+    // the run loop exits.
+    let display_user_info = Box::into_raw(Box::new(display_notify_tx)) as *mut c_void;
+    unsafe {
+        CGDisplayRegisterReconfigurationCallback(
+            display_reconfiguration_callback,
+            display_user_info,
+        );
+    }
+
+    log::debug!("running CFRunLoop...");
+    CFRunLoop::run_current();
+    log::debug!("event tap thread exiting!...");
+
+    unsafe {
+        CGDisplayRemoveReconfigurationCallback(display_reconfiguration_callback, display_user_info);
+        // Reclaim the leaked sender Box so we don't leak a tokio
+        // channel sender on every capture create/destroy cycle.
+        drop(Box::from_raw(
+            display_user_info as *mut Sender<ProducerEvent>,
+        ));
+    }
+
+    let _ = exit.send(());
+}
+
+/// Quartz display-reconfiguration callback. Fires twice per change:
+/// once with `kCGDisplayBeginConfigurationFlag` set (BEFORE the
+/// change is applied — the bounds are still stale at this point),
+/// then again afterwards with the actual change flags (Add, Remove,
+/// Mode, DesktopShapeChanged, etc.). Skip the begin phase; on the
+/// real notification, kick the producer task to refresh bounds.
+extern "C" fn display_reconfiguration_callback(_display: u32, flags: u32, user_info: *mut c_void) {
+    const K_CG_DISPLAY_BEGIN_CONFIGURATION_FLAG: u32 = 1 << 0;
+    if flags & K_CG_DISPLAY_BEGIN_CONFIGURATION_FLAG != 0 {
+        return;
+    }
+    if user_info.is_null() {
+        return;
+    }
+    // SAFETY: user_info is a Box::into_raw of Sender<ProducerEvent>
+    // owned by `event_tap_thread`. It's valid for the lifetime of
+    // that thread; the registration is removed before the box is
+    // freed. The callback only fires while the run loop is running
+    // on that thread, so we know the box is live here.
+    let sender = unsafe { &*(user_info as *const Sender<ProducerEvent>) };
+    if let Err(e) = sender.blocking_send(ProducerEvent::DisplayReconfigured) {
+        log::warn!("failed to notify display reconfiguration: {e}");
+    }
 }
 
 pub struct MacOSInputCapture {
     event_rx: Receiver<(Position, CaptureEvent)>,
     notify_tx: Sender<ProducerEvent>,
+    run_loop: CFRunLoop,
 }
 
 impl MacOSInputCapture {
     pub async fn new() -> Result<Self, MacosCaptureCreationError> {
+        request_macos_capture_permissions()?;
+
         let state = Arc::new(Mutex::new(InputCaptureState::new()?));
         let (event_tx, event_rx) = mpsc::channel(32);
         let (notify_tx, mut notify_rx) = mpsc::channel(32);
@@ -475,36 +683,73 @@ impl MacOSInputCapture {
         });
 
         // wait for event tap creation result
-        ready_rx.recv().expect("channel closed")?;
+        let run_loop = ready_rx.recv().expect("channel closed")?;
 
         let _tap_task: tokio::task::JoinHandle<()> = tokio::task::spawn_local(async move {
             loop {
                 tokio::select! {
                     producer_event = notify_rx.recv() => {
-                        let producer_event = producer_event.expect("channel closed");
+                        let Some(producer_event) = producer_event else {
+                            break;
+                        };
                         let mut state = state.lock().await;
                         state.handle_producer_event(producer_event).await.unwrap_or_else(|e| {
                             log::error!("Failed to handle producer event: {e}");
                         })
                     }
-
-                    res = &mut tap_exit_rx => {
-                        if let Err(e) = res.expect("channel closed") {
-                            log::error!("Tap thread failed: {:?}", e);
-                            break;
-                        }
-                    }
+                    _ = &mut tap_exit_rx => break,
                 }
             }
+            // show cursor
+            let _ = CGDisplay::show_cursor(&CGDisplay::main());
         });
 
         Ok(Self {
             event_rx,
             notify_tx,
+            run_loop,
         })
     }
 }
 
+fn request_macos_capture_permissions() -> Result<(), MacosCaptureCreationError> {
+    // Call both request functions unconditionally so macOS surfaces both
+    // TCC prompts on the very first launch. TCC always returns `false` the
+    // first time a permission is requested (the grant only becomes visible
+    // on the next process launch), so returning early on the first failure
+    // would skip the second prompt and force the user through an extra
+    // relaunch just to see it.
+    let accessibility = request_accessibility_permission();
+    let input_monitoring = request_input_monitoring_permission();
+
+    if !accessibility {
+        return Err(MacosCaptureCreationError::AccessibilityPermission);
+    }
+    if !input_monitoring {
+        return Err(MacosCaptureCreationError::InputMonitoringPermission);
+    }
+    Ok(())
+}
+
+fn request_accessibility_permission() -> bool {
+    // Silent check. The GUI owns the one-time user-visible prompt at
+    // startup (see lan_mouse_gtk::macos_privacy) so retries triggered by
+    // clicking the "Reenable" button don't pop a fresh Accessibility
+    // alert every time.
+    unsafe { AXIsProcessTrusted() }
+}
+
+fn request_input_monitoring_permission() -> bool {
+    // Silent check, same reasoning as above.
+    unsafe { CGPreflightListenEventAccess() }
+}
+
+impl Drop for MacOSInputCapture {
+    fn drop(&mut self) {
+        self.run_loop.stop();
+    }
+}
+
 #[async_trait]
 impl Capture for MacOSInputCapture {
     async fn create(&mut self, pos: Position) -> Result<(), CaptureError> {
@@ -570,6 +815,30 @@ extern "C" {
         event_source: CGEventSource,
         seconds: CFTimeInterval,
     );
+    fn CGPreflightListenEventAccess() -> bool;
+    /// Re-enable an event tap that was disabled by a
+    /// `kCGEventTapDisabledByTimeout` event. The Apple-documented
+    /// recovery path: see Quartz Event Services Reference. The `tap`
+    /// argument is a `CFMachPortRef`; we pass the raw pointer so we
+    /// can store it as `usize` for cross-thread sharing.
+    fn CGEventTapEnable(tap: *mut c_void, enable: bool);
+
+    /// Register a callback invoked when the display configuration
+    /// changes (monitor add/remove, resolution change, mirror,
+    /// rearrange, etc). See Quartz Display Services Reference.
+    fn CGDisplayRegisterReconfigurationCallback(
+        callback: extern "C" fn(u32, u32, *mut c_void),
+        user_info: *mut c_void,
+    ) -> CGError;
+    fn CGDisplayRemoveReconfigurationCallback(
+        callback: extern "C" fn(u32, u32, *mut c_void),
+        user_info: *mut c_void,
+    ) -> CGError;
+}
+
+#[link(name = "ApplicationServices", kind = "framework")]
+extern "C" {
+    fn AXIsProcessTrusted() -> bool;
 }
 
 unsafe fn configure_cf_settings() -> Result<(), MacosCaptureCreationError> {
@@ -579,6 +848,7 @@ unsafe fn configure_cf_settings() -> Result<(), MacosCaptureCreationError> {
     let event_source = CGEventSource::new(CGEventSourceStateID::CombinedSessionState)
         .map_err(|_| MacosCaptureCreationError::EventSourceCreation)?;
     CGEventSourceSetLocalEventsSuppressionInterval(event_source, 0.05);
+    // FIXME Memory Leak
 
     // This is a private settings that allows the cursor to be hidden while in the background.
     // It is used by Barrier and other apps.

input-capture/src/windows.rs

@@ -5,7 +5,7 @@ use futures::Stream;
 use std::pin::Pin;
 
 use std::task::ready;
-use tokio::sync::mpsc::{channel, Receiver};
+use tokio::sync::mpsc::{Receiver, channel};
 
 use super::{Capture, CaptureError, CaptureEvent, Position};
 

input-capture/src/windows/event_thread.rs

@@ -6,33 +6,32 @@ use std::default::Default;
 use std::sync::atomic::{AtomicBool, AtomicI32, Ordering};
 use std::sync::{Arc, Condvar, Mutex};
 use std::thread;
-use tokio::sync::mpsc::error::TrySendError;
 use tokio::sync::mpsc::Sender;
-use windows::core::{w, PCWSTR};
-use windows::Win32::Foundation::{FALSE, HINSTANCE, HWND, LPARAM, LRESULT, RECT, WPARAM};
+use tokio::sync::mpsc::error::TrySendError;
+use windows::Win32::Foundation::{FALSE, HWND, LPARAM, LRESULT, RECT, WPARAM};
 use windows::Win32::Graphics::Gdi::{
-    EnumDisplayDevicesW, EnumDisplaySettingsW, DEVMODEW, DISPLAY_DEVICEW,
-    DISPLAY_DEVICE_ATTACHED_TO_DESKTOP, ENUM_CURRENT_SETTINGS,
+    DEVMODEW, DISPLAY_DEVICE_ATTACHED_TO_DESKTOP, DISPLAY_DEVICEW, ENUM_CURRENT_SETTINGS,
+    EnumDisplayDevicesW, EnumDisplaySettingsW,
 };
 use windows::Win32::System::LibraryLoader::GetModuleHandleW;
 use windows::Win32::System::Threading::GetCurrentThreadId;
+use windows::core::{PCWSTR, w};
 
 use windows::Win32::UI::WindowsAndMessaging::{
-    CallNextHookEx, CreateWindowExW, DispatchMessageW, GetMessageW, PostThreadMessageW,
-    RegisterClassW, SetWindowsHookExW, TranslateMessage, EDD_GET_DEVICE_INTERFACE_NAME, HHOOK,
-    HMENU, HOOKPROC, KBDLLHOOKSTRUCT, LLKHF_EXTENDED, MSG, MSLLHOOKSTRUCT, WH_KEYBOARD_LL,
-    WH_MOUSE_LL, WINDOW_STYLE, WM_DISPLAYCHANGE, WM_KEYDOWN, WM_KEYUP, WM_LBUTTONDOWN,
-    WM_LBUTTONUP, WM_MBUTTONDOWN, WM_MBUTTONUP, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_RBUTTONDOWN,
-    WM_RBUTTONUP, WM_SYSKEYDOWN, WM_SYSKEYUP, WM_USER, WM_XBUTTONDOWN, WM_XBUTTONUP, WNDCLASSW,
-    WNDPROC,
+    CallNextHookEx, CreateWindowExW, DispatchMessageW, EDD_GET_DEVICE_INTERFACE_NAME, GetMessageW,
+    HOOKPROC, KBDLLHOOKSTRUCT, LLKHF_EXTENDED, MSG, MSLLHOOKSTRUCT, PostThreadMessageW,
+    RegisterClassW, SetWindowsHookExW, TranslateMessage, WH_KEYBOARD_LL, WH_MOUSE_LL, WINDOW_STYLE,
+    WM_DISPLAYCHANGE, WM_KEYDOWN, WM_KEYUP, WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MBUTTONDOWN,
+    WM_MBUTTONUP, WM_MOUSEHWHEEL, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_RBUTTONDOWN, WM_RBUTTONUP,
+    WM_SYSKEYDOWN, WM_SYSKEYUP, WM_USER, WM_XBUTTONDOWN, WM_XBUTTONUP, WNDCLASSW, WNDPROC,
 };
 
 use input_event::{
+    BTN_BACK, BTN_FORWARD, BTN_LEFT, BTN_MIDDLE, BTN_RIGHT, Event, KeyboardEvent, PointerEvent,
     scancode::{self, Linux},
-    Event, KeyboardEvent, PointerEvent, BTN_BACK, BTN_FORWARD, BTN_LEFT, BTN_MIDDLE, BTN_RIGHT,
 };
 
-use super::{display_util, CaptureEvent, Position};
+use super::{CaptureEvent, Position, display_util};
 
 pub(crate) struct EventThread {
     request_buffer: Arc<Mutex<Vec<ClientUpdate>>>,
@@ -128,7 +127,7 @@ thread_local! {
 fn get_msg() -> Option<MSG> {
     unsafe {
         let mut msg = std::mem::zeroed();
-        let ret = GetMessageW(addr_of_mut!(msg), HWND::default(), 0, 0);
+        let ret = GetMessageW(addr_of_mut!(msg), None, 0, 0);
         match ret.0 {
             0 => None,
             x if x > 0 => Some(msg),
@@ -176,14 +175,15 @@ fn start_routine(
 
     /* register hooks */
     unsafe {
-        let _ = SetWindowsHookExW(WH_MOUSE_LL, mouse_proc, HINSTANCE::default(), 0).unwrap();
-        let _ = SetWindowsHookExW(WH_KEYBOARD_LL, kybrd_proc, HINSTANCE::default(), 0).unwrap();
+        let _ = SetWindowsHookExW(WH_MOUSE_LL, mouse_proc, None, 0).unwrap();
+        let _ = SetWindowsHookExW(WH_KEYBOARD_LL, kybrd_proc, None, 0).unwrap();
     }
 
     let instance = unsafe { GetModuleHandleW(None).unwrap() };
+    let instance = instance.into();
     let window_class: WNDCLASSW = WNDCLASSW {
         lpfnWndProc: window_proc,
-        hInstance: instance.into(),
+        hInstance: instance,
         lpszClassName: w!("lan-mouse-message-window-class"),
         ..Default::default()
     };
@@ -213,20 +213,17 @@ fn start_routine(
             0,
             0,
             0,
-            HWND::default(),
-            HMENU::default(),
-            instance,
+            None,
+            None,
+            Some(instance),
             None,
         )
         .expect("CreateWindowExW");
     }
 
     /* run message loop */
-    loop {
+    while let Some(msg) = get_msg() {
         // mouse / keybrd proc do not actually return a message
-        let Some(msg) = get_msg() else {
-            break;
-        };
         if msg.hwnd.0.is_null() {
             /* messages sent via PostThreadMessage */
             match msg.wParam.0 {
@@ -312,7 +309,7 @@ unsafe extern "system" fn mouse_proc(ncode: i32, wparam: WPARAM, lparam: LPARAM)
 
     /* no client was active */
     if !active {
-        return CallNextHookEx(HHOOK::default(), ncode, wparam, lparam);
+        return CallNextHookEx(None, ncode, wparam, lparam);
     }
 
     /* get active client if any */
@@ -337,7 +334,7 @@ unsafe extern "system" fn mouse_proc(ncode: i32, wparam: WPARAM, lparam: LPARAM)
 unsafe extern "system" fn kybrd_proc(ncode: i32, wparam: WPARAM, lparam: LPARAM) -> LRESULT {
     /* get active client if any */
     let Some(client) = ACTIVE_CLIENT.get() else {
-        return CallNextHookEx(HHOOK::default(), ncode, wparam, lparam);
+        return CallNextHookEx(None, ncode, wparam, lparam);
     };
 
     /* convert to key event */
@@ -388,7 +385,10 @@ fn enumerate_displays(display_rects: &mut Vec<RECT>) {
             if ret == FALSE {
                 break;
             }
-            if device.StateFlags & DISPLAY_DEVICE_ATTACHED_TO_DESKTOP != 0 {
+            if device
+                .StateFlags
+                .contains(DISPLAY_DEVICE_ATTACHED_TO_DESKTOP)
+            {
                 devices.push(device.DeviceName);
             }
         }
@@ -537,6 +537,10 @@ fn to_mouse_event(wparam: WPARAM, lparam: LPARAM) -> Option<PointerEvent> {
                 state: if p == WM_XBUTTONDOWN as usize { 1 } else { 0 },
             })
         }
+        WPARAM(p) if p == WM_MOUSEHWHEEL as usize => Some(PointerEvent::AxisDiscrete120 {
+            axis: 1, // Horizontal
+            value: mouse_low_level.mouseData as i32 >> 16,
+        }),
         w => {
             log::warn!("unknown mouse event: {w:?}");
             None

input-capture/src/x11.rs

@@ -3,7 +3,7 @@ use std::task::Poll;
 use async_trait::async_trait;
 use futures_core::Stream;
 
-use super::{error::X11InputCaptureCreationError, Capture, CaptureError, CaptureEvent, Position};
+use super::{Capture, CaptureError, CaptureEvent, Position, error::X11InputCaptureCreationError};
 
 pub struct X11InputCapture {}
 

input-emulation/Cargo.toml

@@ -21,6 +21,7 @@ tokio = { version = "1.32.0", features = [
     "rt",
     "sync",
     "signal",
+    "time"
 ] }
 once_cell = "1.19.0"
 
@@ -39,18 +40,22 @@ wayland-protocols-misc = { version = "0.3.1", features = [
     "client",
 ], optional = true }
 x11 = { version = "2.21.0", features = ["xlib", "xtest"], optional = true }
-ashpd = { version = "0.10", default-features = false, features = [
+ashpd = { version = "0.13.9", default-features = false, features = [
+    "remote_desktop",
+    "screencast",
     "tokio",
 ], optional = true }
-reis = { version = "0.4", features = ["tokio"], optional = true }
+reis = { version = "0.5.0", features = ["tokio"], optional = true }
 
 [target.'cfg(target_os="macos")'.dependencies]
 bitflags = "2.6.0"
-core-graphics = { version = "0.24.0", features = ["highsierra"] }
-keycode = "0.4.0"
+core-foundation = "0.10.0"
+core-foundation-sys = "0.8.6"
+core-graphics = { version = "0.25.0", features = ["highsierra"] }
+keycode = "1.0.0"
 
 [target.'cfg(windows)'.dependencies]
-windows = { version = "0.58.0", features = [
+windows = { version = "0.61.2", features = [
     "Win32_System_LibraryLoader",
     "Win32_System_Threading",
     "Win32_Foundation",

input-emulation/build.rs

@@ -0,0 +1,31 @@
+fn main() {
+    let unix = cfg!(unix);
+    let libei = cfg!(feature = "libei");
+    let x11 = cfg!(feature = "x11");
+    let macos = cfg!(target_os = "macos");
+    let wlroots = cfg!(feature = "wlroots");
+    let rdp = cfg!(feature = "remote_desktop_portal");
+
+    let libei = unix && !macos && libei;
+    let wlroots = unix && !macos && wlroots;
+    let x11 = unix && !macos && x11;
+    let rdp = unix && !macos && rdp;
+
+    println!("cargo::rustc-check-cfg=cfg(wlroots)");
+    println!("cargo::rustc-check-cfg=cfg(libei)");
+    println!("cargo::rustc-check-cfg=cfg(x11)");
+    println!("cargo::rustc-check-cfg=cfg(rdp)");
+
+    if libei {
+        println!("cargo::rustc-cfg=libei");
+    }
+    if x11 {
+        println!("cargo::rustc-cfg=x11");
+    }
+    if wlroots {
+        println!("cargo::rustc-cfg=wlroots");
+    }
+    if rdp {
+        println!("cargo::rustc-cfg=rdp");
+    }
+}

input-emulation/src/error.rs

@@ -6,37 +6,29 @@ pub enum InputEmulationError {
     Emulate(#[from] EmulationError),
 }
 
-#[cfg(all(
-    unix,
-    any(feature = "remote_desktop_portal", feature = "libei"),
-    not(target_os = "macos")
-))]
-use ashpd::{desktop::ResponseError, Error::Response};
+#[cfg(any(libei, rdp))]
+use ashpd::{Error::Response, desktop::ResponseError};
 use std::io;
 use thiserror::Error;
 
-#[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+#[cfg(wlroots)]
 use wayland_client::{
+    ConnectError, DispatchError,
     backend::WaylandError,
     globals::{BindError, GlobalError},
-    ConnectError, DispatchError,
 };
 
 #[derive(Debug, Error)]
 pub enum EmulationError {
     #[error("event stream closed")]
     EndOfStream,
-    #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+    #[cfg(libei)]
     #[error("libei error: `{0}`")]
     Libei(#[from] reis::Error),
-    #[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+    #[cfg(wlroots)]
     #[error("wayland error: `{0}`")]
     Wayland(#[from] wayland_client::backend::WaylandError),
-    #[cfg(all(
-        unix,
-        any(feature = "remote_desktop_portal", feature = "libei"),
-        not(target_os = "macos")
-    ))]
+    #[cfg(any(rdp, libei))]
     #[error("xdg-desktop-portal: `{0}`")]
     Ashpd(#[from] ashpd::Error),
     #[error("io error: `{0}`")]
@@ -45,16 +37,16 @@ pub enum EmulationError {
 
 #[derive(Debug, Error)]
 pub enum EmulationCreationError {
-    #[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+    #[cfg(wlroots)]
     #[error("wlroots backend: `{0}`")]
     Wlroots(#[from] WlrootsEmulationCreationError),
-    #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+    #[cfg(libei)]
     #[error("libei backend: `{0}`")]
     Libei(#[from] LibeiEmulationCreationError),
-    #[cfg(all(unix, feature = "remote_desktop_portal", not(target_os = "macos")))]
+    #[cfg(rdp)]
     #[error("xdg-desktop-portal: `{0}`")]
     Xdp(#[from] XdpEmulationCreationError),
-    #[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+    #[cfg(x11)]
     #[error("x11: `{0}`")]
     X11(#[from] X11EmulationCreationError),
     #[cfg(target_os = "macos")]
@@ -70,7 +62,7 @@ pub enum EmulationCreationError {
 impl EmulationCreationError {
     /// request was intentionally denied by the user
     pub(crate) fn cancelled_by_user(&self) -> bool {
-        #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+        #[cfg(libei)]
         if matches!(
             self,
             EmulationCreationError::Libei(LibeiEmulationCreationError::Ashpd(Response(
@@ -79,7 +71,7 @@ impl EmulationCreationError {
         ) {
             return true;
         }
-        #[cfg(all(unix, feature = "remote_desktop_portal", not(target_os = "macos")))]
+        #[cfg(rdp)]
         if matches!(
             self,
             EmulationCreationError::Xdp(XdpEmulationCreationError::Ashpd(Response(
@@ -92,7 +84,7 @@ impl EmulationCreationError {
     }
 }
 
-#[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+#[cfg(wlroots)]
 #[derive(Debug, Error)]
 pub enum WlrootsEmulationCreationError {
     #[error(transparent)]
@@ -109,7 +101,7 @@ pub enum WlrootsEmulationCreationError {
     Io(#[from] std::io::Error),
 }
 
-#[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+#[cfg(wlroots)]
 #[derive(Debug, Error)]
 #[error("wayland protocol \"{protocol}\" not supported: {inner}")]
 pub struct WaylandBindError {
@@ -117,14 +109,14 @@ pub struct WaylandBindError {
     protocol: &'static str,
 }
 
-#[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+#[cfg(wlroots)]
 impl WaylandBindError {
     pub(crate) fn new(inner: BindError, protocol: &'static str) -> Self {
         Self { inner, protocol }
     }
 }
 
-#[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+#[cfg(libei)]
 #[derive(Debug, Error)]
 pub enum LibeiEmulationCreationError {
     #[error(transparent)]
@@ -135,14 +127,14 @@ pub enum LibeiEmulationCreationError {
     Reis(#[from] reis::Error),
 }
 
-#[cfg(all(unix, feature = "remote_desktop_portal", not(target_os = "macos")))]
+#[cfg(rdp)]
 #[derive(Debug, Error)]
 pub enum XdpEmulationCreationError {
     #[error(transparent)]
     Ashpd(#[from] ashpd::Error),
 }
 
-#[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+#[cfg(x11)]
 #[derive(Debug, Error)]
 pub enum X11EmulationCreationError {
     #[error("could not open display")]
@@ -154,6 +146,10 @@ pub enum X11EmulationCreationError {
 pub enum MacOSEmulationCreationError {
     #[error("could not create event source")]
     EventSourceCreation,
+    #[error("accessibility permission is required")]
+    AccessibilityPermission,
+    #[error("input control permission is required")]
+    InputControlPermission,
 }
 
 #[cfg(windows)]

input-emulation/src/lib.rs

@@ -11,16 +11,16 @@ pub use self::error::{EmulationCreationError, EmulationError, InputEmulationErro
 #[cfg(windows)]
 mod windows;
 
-#[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+#[cfg(x11)]
 mod x11;
 
-#[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+#[cfg(wlroots)]
 mod wlroots;
 
-#[cfg(all(unix, feature = "remote_desktop_portal", not(target_os = "macos")))]
+#[cfg(rdp)]
 mod xdg_desktop_portal;
 
-#[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+#[cfg(libei)]
 mod libei;
 
 #[cfg(target_os = "macos")]
@@ -34,13 +34,13 @@ pub type EmulationHandle = u64;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum Backend {
-    #[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+    #[cfg(wlroots)]
     Wlroots,
-    #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+    #[cfg(libei)]
     Libei,
-    #[cfg(all(unix, feature = "remote_desktop_portal", not(target_os = "macos")))]
+    #[cfg(rdp)]
     Xdp,
-    #[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+    #[cfg(x11)]
     X11,
     #[cfg(windows)]
     Windows,
@@ -52,13 +52,13 @@ pub enum Backend {
 impl Display for Backend {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
-            #[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+            #[cfg(wlroots)]
             Backend::Wlroots => write!(f, "wlroots"),
-            #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+            #[cfg(libei)]
             Backend::Libei => write!(f, "libei"),
-            #[cfg(all(unix, feature = "remote_desktop_portal", not(target_os = "macos")))]
+            #[cfg(rdp)]
             Backend::Xdp => write!(f, "xdg-desktop-portal"),
-            #[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+            #[cfg(x11)]
             Backend::X11 => write!(f, "X11"),
             #[cfg(windows)]
             Backend::Windows => write!(f, "windows"),
@@ -78,13 +78,13 @@ pub struct InputEmulation {
 impl InputEmulation {
     async fn with_backend(backend: Backend) -> Result<InputEmulation, EmulationCreationError> {
         let emulation: Box<dyn Emulation> = match backend {
-            #[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+            #[cfg(wlroots)]
             Backend::Wlroots => Box::new(wlroots::WlrootsEmulation::new()?),
-            #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+            #[cfg(libei)]
             Backend::Libei => Box::new(libei::LibeiEmulation::new().await?),
-            #[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+            #[cfg(x11)]
             Backend::X11 => Box::new(x11::X11Emulation::new()?),
-            #[cfg(all(unix, feature = "remote_desktop_portal", not(target_os = "macos")))]
+            #[cfg(rdp)]
             Backend::Xdp => Box::new(xdg_desktop_portal::DesktopPortalEmulation::new().await?),
             #[cfg(windows)]
             Backend::Windows => Box::new(windows::WindowsEmulation::new()?),
@@ -109,13 +109,13 @@ impl InputEmulation {
         }
 
         for backend in [
-            #[cfg(all(unix, feature = "wlroots", not(target_os = "macos")))]
+            #[cfg(wlroots)]
             Backend::Wlroots,
-            #[cfg(all(unix, feature = "libei", not(target_os = "macos")))]
+            #[cfg(libei)]
             Backend::Libei,
-            #[cfg(all(unix, feature = "remote_desktop_portal", not(target_os = "macos")))]
+            #[cfg(rdp)]
             Backend::Xdp,
-            #[cfg(all(unix, feature = "x11", not(target_os = "macos")))]
+            #[cfg(x11)]
             Backend::X11,
             #[cfg(windows)]
             Backend::Windows,

input-emulation/src/libei.rs

@@ -1,25 +1,26 @@
-use futures::{future, StreamExt};
+use futures::{StreamExt, future};
 use std::{
-    io,
+    env, fs, io,
     os::{fd::OwnedFd, unix::net::UnixStream},
+    path::PathBuf,
     sync::{
-        atomic::{AtomicBool, Ordering},
         Arc, Mutex, RwLock,
+        atomic::{AtomicBool, Ordering},
     },
     time::{SystemTime, UNIX_EPOCH},
 };
 use tokio::task::JoinHandle;
 
 use ashpd::desktop::{
-    remote_desktop::{DeviceType, RemoteDesktop},
     PersistMode, Session,
+    remote_desktop::{DeviceType, RemoteDesktop, SelectDevicesOptions},
 };
 use async_trait::async_trait;
 
 use reis::{
     ei::{
-        self, button::ButtonState, handshake::ContextType, keyboard::KeyState, Button, Keyboard,
-        Pointer, Scroll,
+        self, Button, Keyboard, Pointer, Scroll, button::ButtonState, handshake::ContextType,
+        keyboard::KeyState,
     },
     event::{self, Connection, DeviceCapability, DeviceEvent, EiEvent, SeatEvent},
     tokio::EiConvertEventStream,
@@ -29,7 +30,7 @@ use input_event::{Event, KeyboardEvent, PointerEvent};
 
 use crate::error::EmulationError;
 
-use super::{error::LibeiEmulationCreationError, Emulation, EmulationHandle};
+use super::{Emulation, EmulationHandle, error::LibeiEmulationCreationError};
 
 #[derive(Clone, Default)]
 struct Devices {
@@ -39,42 +40,85 @@ struct Devices {
     keyboard: Arc<RwLock<Option<(ei::Device, ei::Keyboard)>>>,
 }
 
-pub(crate) struct LibeiEmulation<'a> {
+pub(crate) struct LibeiEmulation {
     context: ei::Context,
     conn: event::Connection,
     devices: Devices,
     ei_task: JoinHandle<()>,
     error: Arc<Mutex<Option<EmulationError>>>,
     libei_error: Arc<AtomicBool>,
-    _remote_desktop: RemoteDesktop<'a>,
-    session: Session<'a, RemoteDesktop<'a>>,
+    _remote_desktop: RemoteDesktop,
+    session: Session<RemoteDesktop>,
 }
 
-async fn get_ei_fd<'a>(
-) -> Result<(RemoteDesktop<'a>, Session<'a, RemoteDesktop<'a>>, OwnedFd), ashpd::Error> {
+/// Get the path to the RemoteDesktop token file
+fn get_token_file_path() -> PathBuf {
+    let cache_dir = env::var("XDG_CACHE_HOME")
+        .ok()
+        .map(PathBuf::from)
+        .unwrap_or_else(|| {
+            let home = env::var("HOME").expect("HOME not set");
+            PathBuf::from(home).join(".cache")
+        });
+
+    cache_dir.join("lan-mouse").join("remote-desktop.token")
+}
+
+/// Read the RemoteDesktop token from file
+fn read_token() -> Option<String> {
+    let token_path = get_token_file_path();
+    match fs::read_to_string(&token_path) {
+        Ok(token) => Some(token.trim().to_string()),
+        Err(_) => None,
+    }
+}
+
+/// Write the RemoteDesktop token to file
+fn write_token(token: &str) -> io::Result<()> {
+    let token_path = get_token_file_path();
+    if let Some(parent) = token_path.parent() {
+        fs::create_dir_all(parent)?;
+    }
+
+    fs::write(&token_path, token)?;
+    Ok(())
+}
+
+async fn get_ei_fd() -> Result<(RemoteDesktop, Session<RemoteDesktop>, OwnedFd), ashpd::Error> {
     let remote_desktop = RemoteDesktop::new().await?;
 
+    let restore_token = read_token();
+
     log::debug!("creating session ...");
-    let session = remote_desktop.create_session().await?;
+    let session = remote_desktop.create_session(Default::default()).await?;
 
     log::debug!("selecting devices ...");
-    remote_desktop
-        .select_devices(
-            &session,
-            DeviceType::Keyboard | DeviceType::Pointer,
-            None,
-            PersistMode::ExplicitlyRevoked,
-        )
-        .await?;
+    let options = SelectDevicesOptions::default()
+        .set_devices(DeviceType::Keyboard | DeviceType::Pointer)
+        .set_persist_mode(PersistMode::ExplicitlyRevoked)
+        .set_restore_token(restore_token.as_deref());
+    remote_desktop.select_devices(&session, options).await?;
 
     log::info!("requesting permission for input emulation");
-    let _devices = remote_desktop.start(&session, None).await?.response()?;
+    let start_response = remote_desktop
+        .start(&session, None, Default::default())
+        .await?
+        .response()?;
 
-    let fd = remote_desktop.connect_to_eis(&session).await?;
+    // The restore token is only valid once, we need to re-save it each time
+    if let Some(token_str) = start_response.restore_token() {
+        if let Err(e) = write_token(token_str) {
+            log::warn!("failed to save RemoteDesktop token: {}", e);
+        }
+    }
+
+    let fd = remote_desktop
+        .connect_to_eis(&session, Default::default())
+        .await?;
     Ok((remote_desktop, session, fd))
 }
 
-impl LibeiEmulation<'_> {
+impl LibeiEmulation {
     pub(crate) async fn new() -> Result<Self, LibeiEmulationCreationError> {
         let (_remote_desktop, session, eifd) = get_ei_fd().await?;
         let stream = UnixStream::from(eifd);
@@ -109,14 +153,14 @@ impl LibeiEmulation<'_> {
     }
 }
 
-impl Drop for LibeiEmulation<'_> {
+impl Drop for LibeiEmulation {
     fn drop(&mut self) {
         self.ei_task.abort();
     }
 }
 
 #[async_trait]
-impl Emulation for LibeiEmulation<'_> {
+impl Emulation for LibeiEmulation {
     async fn consume(
         &mut self,
         event: Event,

input-emulation/src/macos.rs

@@ -1,4 +1,4 @@
-use super::{error::EmulationError, Emulation, EmulationHandle};
+use super::{Emulation, EmulationHandle, error::EmulationError};
 use async_trait::async_trait;
 use bitflags::bitflags;
 use core_graphics::base::CGFloat;
@@ -10,53 +10,50 @@ use core_graphics::event::{
     ScrollEventUnit,
 };
 use core_graphics::event_source::{CGEventSource, CGEventSourceStateID};
-use input_event::{scancode, Event, KeyboardEvent, PointerEvent};
+use input_event::{
+    BTN_BACK, BTN_FORWARD, BTN_LEFT, BTN_MIDDLE, BTN_RIGHT, Event, KeyboardEvent, PointerEvent,
+    scancode,
+};
 use keycode::{KeyMap, KeyMapping};
 use std::cell::Cell;
-use std::ops::{Index, IndexMut};
+use std::collections::HashSet;
 use std::rc::Rc;
 use std::sync::Arc;
-use std::time::Duration;
+use std::time::{Duration, Instant};
 use tokio::{sync::Notify, task::JoinHandle};
 
 use super::error::MacOSEmulationCreationError;
 
 const DEFAULT_REPEAT_DELAY: Duration = Duration::from_millis(500);
 const DEFAULT_REPEAT_INTERVAL: Duration = Duration::from_millis(32);
+const DOUBLE_CLICK_INTERVAL: Duration = Duration::from_millis(500);
 
 pub(crate) struct MacOSEmulation {
+    /// global event source for all events
     event_source: CGEventSource,
+    /// task handle for key repeats
     repeat_task: Option<JoinHandle<()>>,
-    button_state: ButtonState,
+    /// current state of the mouse buttons (tracked by evdev button code)
+    pressed_buttons: HashSet<u32>,
+    /// button previously pressed (evdev button code)
+    previous_button: Option<u32>,
+    /// timestamp of previous click (button down)
+    previous_button_click: Option<Instant>,
+    /// click state, i.e. number of clicks in quick succession
+    button_click_state: i64,
+    /// current modifier state
     modifier_state: Rc<Cell<XMods>>,
+    /// notify to cancel key repeats
     notify_repeat_task: Arc<Notify>,
 }
 
-struct ButtonState {
-    left: bool,
-    right: bool,
-    center: bool,
-}
-
-impl Index<CGMouseButton> for ButtonState {
-    type Output = bool;
-
-    fn index(&self, index: CGMouseButton) -> &Self::Output {
-        match index {
-            CGMouseButton::Left => &self.left,
-            CGMouseButton::Right => &self.right,
-            CGMouseButton::Center => &self.center,
-        }
-    }
-}
-
-impl IndexMut<CGMouseButton> for ButtonState {
-    fn index_mut(&mut self, index: CGMouseButton) -> &mut Self::Output {
-        match index {
-            CGMouseButton::Left => &mut self.left,
-            CGMouseButton::Right => &mut self.right,
-            CGMouseButton::Center => &mut self.center,
-        }
+/// Maps an evdev button code to the CGEventType used for drag events.
+fn drag_event_type(button: u32) -> CGEventType {
+    match button {
+        BTN_LEFT => CGEventType::LeftMouseDragged,
+        BTN_RIGHT => CGEventType::RightMouseDragged,
+        // middle, back, forward, and any other button all use OtherMouseDragged
+        _ => CGEventType::OtherMouseDragged,
     }
 }
 
@@ -64,16 +61,16 @@ unsafe impl Send for MacOSEmulation {}
 
 impl MacOSEmulation {
     pub(crate) fn new() -> Result<Self, MacOSEmulationCreationError> {
+        request_macos_emulation_permissions()?;
+
         let event_source = CGEventSource::new(CGEventSourceStateID::CombinedSessionState)
             .map_err(|_| MacOSEmulationCreationError::EventSourceCreation)?;
-        let button_state = ButtonState {
-            left: false,
-            right: false,
-            center: false,
-        };
         Ok(Self {
             event_source,
-            button_state,
+            pressed_buttons: HashSet::new(),
+            previous_button: None,
+            previous_button_click: None,
+            button_click_state: 0,
             repeat_task: None,
             notify_repeat_task: Arc::new(Notify::new()),
             modifier_state: Rc::new(Cell::new(XMods::empty())),
@@ -89,6 +86,9 @@ impl MacOSEmulation {
         // there can only be one repeating key and it's
         // always the last to be pressed
         self.cancel_repeat_task().await;
+        // initial key event
+        key_event(self.event_source.clone(), key, 1, self.modifier_state.get());
+        // repeat task
         let event_source = self.event_source.clone();
         let notify = self.notify_repeat_task.clone();
         let modifiers = self.modifier_state.clone();
@@ -121,6 +121,42 @@ impl MacOSEmulation {
     }
 }
 
+fn request_macos_emulation_permissions() -> Result<(), MacOSEmulationCreationError> {
+    // Request both permissions up front so the user sees both TCC prompts
+    // on the first launch. See the matching comment in input-capture/src/
+    // macos.rs::request_macos_capture_permissions for the rationale.
+    let accessibility = request_accessibility_permission();
+    let input_control = request_input_control_permission();
+
+    if !accessibility {
+        return Err(MacOSEmulationCreationError::AccessibilityPermission);
+    }
+    if !input_control {
+        return Err(MacOSEmulationCreationError::InputControlPermission);
+    }
+    Ok(())
+}
+
+fn request_accessibility_permission() -> bool {
+    // Silent check. The GUI owns the one-time user-visible prompt at
+    // startup (see lan_mouse_gtk::macos_privacy).
+    unsafe { AXIsProcessTrusted() }
+}
+
+fn request_input_control_permission() -> bool {
+    unsafe { CGPreflightPostEventAccess() }
+}
+
+#[link(name = "CoreGraphics", kind = "framework")]
+extern "C" {
+    fn CGPreflightPostEventAccess() -> bool;
+}
+
+#[link(name = "ApplicationServices", kind = "framework")]
+extern "C" {
+    fn AXIsProcessTrusted() -> bool;
+}
+
 fn key_event(event_source: CGEventSource, key: u16, state: u8, modifiers: XMods) {
     let event = match CGEvent::new_keyboard_event(event_source, key, state != 0) {
         Ok(e) => e,
@@ -161,12 +197,12 @@ fn get_display_at_point(x: CGFloat, y: CGFloat) -> Option<CGDirectDisplayID> {
     };
 
     if error != 0 {
-        log::warn!("error getting displays at point ({}, {}): {}", x, y, error);
+        log::warn!("error getting displays at point ({x}, {y}): {error}");
         return Option::None;
     }
 
     if display_count == 0 {
-        log::debug!("no displays found at point ({}, {})", x, y);
+        log::debug!("no displays found at point ({x}, {y})");
         return Option::None;
     }
 
@@ -224,150 +260,192 @@ impl Emulation for MacOSEmulation {
         event: Event,
         _handle: EmulationHandle,
     ) -> Result<(), EmulationError> {
+        log::trace!("{event:?}");
         match event {
-            Event::Pointer(pointer_event) => match pointer_event {
-                PointerEvent::Motion { time: _, dx, dy } => {
-                    let mut mouse_location = match self.get_mouse_location() {
-                        Some(l) => l,
-                        None => {
-                            log::warn!("could not get mouse location!");
-                            return Ok(());
-                        }
-                    };
+            Event::Pointer(pointer_event) => {
+                match pointer_event {
+                    PointerEvent::Motion { time: _, dx, dy } => {
+                        let mut mouse_location = match self.get_mouse_location() {
+                            Some(l) => l,
+                            None => {
+                                log::warn!("could not get mouse location!");
+                                return Ok(());
+                            }
+                        };
 
-                    let (new_mouse_x, new_mouse_y) =
-                        clamp_to_screen_space(mouse_location.x, mouse_location.y, dx, dy);
+                        let (new_mouse_x, new_mouse_y) =
+                            clamp_to_screen_space(mouse_location.x, mouse_location.y, dx, dy);
 
-                    mouse_location.x = new_mouse_x;
-                    mouse_location.y = new_mouse_y;
+                        mouse_location.x = new_mouse_x;
+                        mouse_location.y = new_mouse_y;
 
-                    let mut event_type = CGEventType::MouseMoved;
-                    if self.button_state.left {
-                        event_type = CGEventType::LeftMouseDragged
-                    } else if self.button_state.right {
-                        event_type = CGEventType::RightMouseDragged
-                    } else if self.button_state.center {
-                        event_type = CGEventType::OtherMouseDragged
-                    };
-                    let event = match CGEvent::new_mouse_event(
-                        self.event_source.clone(),
-                        event_type,
-                        mouse_location,
-                        CGMouseButton::Left,
-                    ) {
-                        Ok(e) => e,
-                        Err(_) => {
-                            log::warn!("mouse event creation failed!");
-                            return Ok(());
+                        // If any button is held, emit a drag event for it;
+                        // otherwise emit a normal mouse-moved event.
+                        let event_type = self
+                            .pressed_buttons
+                            .iter()
+                            .next()
+                            .map(|&btn| drag_event_type(btn))
+                            .unwrap_or(CGEventType::MouseMoved);
+                        let event = match CGEvent::new_mouse_event(
+                            self.event_source.clone(),
+                            event_type,
+                            mouse_location,
+                            CGMouseButton::Left,
+                        ) {
+                            Ok(e) => e,
+                            Err(_) => {
+                                log::warn!("mouse event creation failed!");
+                                return Ok(());
+                            }
+                        };
+                        event.set_integer_value_field(EventField::MOUSE_EVENT_DELTA_X, dx as i64);
+                        event.set_integer_value_field(EventField::MOUSE_EVENT_DELTA_Y, dy as i64);
+                        event.post(CGEventTapLocation::HID);
+                    }
+                    PointerEvent::Button {
+                        time: _,
+                        button,
+                        state,
+                    } => {
+                        // button number for OtherMouse events (3 = back, 4 = forward, etc.)
+                        let cg_button_number: Option<i64> = match button {
+                            BTN_BACK => Some(3),
+                            BTN_FORWARD => Some(4),
+                            _ => None,
+                        };
+                        let (event_type, mouse_button) = match (button, state) {
+                            (BTN_LEFT, 1) => (CGEventType::LeftMouseDown, CGMouseButton::Left),
+                            (BTN_LEFT, 0) => (CGEventType::LeftMouseUp, CGMouseButton::Left),
+                            (BTN_RIGHT, 1) => (CGEventType::RightMouseDown, CGMouseButton::Right),
+                            (BTN_RIGHT, 0) => (CGEventType::RightMouseUp, CGMouseButton::Right),
+                            (BTN_MIDDLE, 1) => (CGEventType::OtherMouseDown, CGMouseButton::Center),
+                            (BTN_MIDDLE, 0) => (CGEventType::OtherMouseUp, CGMouseButton::Center),
+                            (BTN_BACK, 1) | (BTN_FORWARD, 1) => {
+                                (CGEventType::OtherMouseDown, CGMouseButton::Center)
+                            }
+                            (BTN_BACK, 0) | (BTN_FORWARD, 0) => {
+                                (CGEventType::OtherMouseUp, CGMouseButton::Center)
+                            }
+                            _ => {
+                                log::warn!("invalid button event: {button},{state}");
+                                return Ok(());
+                            }
+                        };
+                        // store button state using the evdev button code so
+                        // back, forward, and middle are tracked independently
+                        if state == 1 {
+                            self.pressed_buttons.insert(button);
+                        } else {
+                            self.pressed_buttons.remove(&button);
                         }
-                    };
-                    event.set_integer_value_field(EventField::MOUSE_EVENT_DELTA_X, dx as i64);
-                    event.set_integer_value_field(EventField::MOUSE_EVENT_DELTA_Y, dy as i64);
-                    event.post(CGEventTapLocation::HID);
-                }
-                PointerEvent::Button {
-                    time: _,
-                    button,
-                    state,
-                } => {
-                    let (event_type, mouse_button) = match (button, state) {
-                        (b, 1) if b == input_event::BTN_LEFT => {
-                            (CGEventType::LeftMouseDown, CGMouseButton::Left)
-                        }
-                        (b, 0) if b == input_event::BTN_LEFT => {
-                            (CGEventType::LeftMouseUp, CGMouseButton::Left)
-                        }
-                        (b, 1) if b == input_event::BTN_RIGHT => {
-                            (CGEventType::RightMouseDown, CGMouseButton::Right)
-                        }
-                        (b, 0) if b == input_event::BTN_RIGHT => {
-                            (CGEventType::RightMouseUp, CGMouseButton::Right)
-                        }
-                        (b, 1) if b == input_event::BTN_MIDDLE => {
-                            (CGEventType::OtherMouseDown, CGMouseButton::Center)
-                        }
-                        (b, 0) if b == input_event::BTN_MIDDLE => {
-                            (CGEventType::OtherMouseUp, CGMouseButton::Center)
-                        }
-                        _ => {
-                            log::warn!("invalid button event: {button},{state}");
-                            return Ok(());
-                        }
-                    };
-                    // store button state
-                    self.button_state[mouse_button] = state == 1;
 
-                    let location = self.get_mouse_location().unwrap();
-                    let event = match CGEvent::new_mouse_event(
-                        self.event_source.clone(),
-                        event_type,
-                        location,
-                        mouse_button,
-                    ) {
-                        Ok(e) => e,
-                        Err(()) => {
-                            log::warn!("mouse event creation failed!");
-                            return Ok(());
+                        // update double-click tracking using the evdev button
+                        // code so that back/forward don't alias with middle
+                        if state == 1 {
+                            if self.previous_button == Some(button)
+                                && self
+                                    .previous_button_click
+                                    .is_some_and(|i| i.elapsed() < DOUBLE_CLICK_INTERVAL)
+                            {
+                                self.button_click_state += 1;
+                            } else {
+                                self.button_click_state = 1;
+                            }
+                            self.previous_button = Some(button);
+                            self.previous_button_click = Some(Instant::now());
                         }
-                    };
-                    event.post(CGEventTapLocation::HID);
+
+                        log::debug!("click_state: {}", self.button_click_state);
+                        let location = self.get_mouse_location().unwrap();
+                        let event = match CGEvent::new_mouse_event(
+                            self.event_source.clone(),
+                            event_type,
+                            location,
+                            mouse_button,
+                        ) {
+                            Ok(e) => e,
+                            Err(()) => {
+                                log::warn!("mouse event creation failed!");
+                                return Ok(());
+                            }
+                        };
+                        event.set_integer_value_field(
+                            EventField::MOUSE_EVENT_CLICK_STATE,
+                            self.button_click_state,
+                        );
+                        // Set the button number for extra buttons (back=3, forward=4)
+                        if let Some(btn_num) = cg_button_number {
+                            event.set_integer_value_field(
+                                EventField::MOUSE_EVENT_BUTTON_NUMBER,
+                                btn_num,
+                            );
+                        }
+                        event.post(CGEventTapLocation::HID);
+                    }
+                    PointerEvent::Axis {
+                        time: _,
+                        axis,
+                        value,
+                    } => {
+                        let value = value as i32;
+                        let (count, wheel1, wheel2, wheel3) = match axis {
+                            0 => (1, value, 0, 0), // 0 = vertical => 1 scroll wheel device (y axis)
+                            1 => (2, 0, value, 0), // 1 = horizontal => 2 scroll wheel devices (y, x) -> (0, x)
+                            _ => {
+                                log::warn!("invalid scroll event: {axis}, {value}");
+                                return Ok(());
+                            }
+                        };
+                        let event = match CGEvent::new_scroll_event(
+                            self.event_source.clone(),
+                            ScrollEventUnit::PIXEL,
+                            count,
+                            wheel1,
+                            wheel2,
+                            wheel3,
+                        ) {
+                            Ok(e) => e,
+                            Err(()) => {
+                                log::warn!("scroll event creation failed!");
+                                return Ok(());
+                            }
+                        };
+                        event.post(CGEventTapLocation::HID);
+                    }
+                    PointerEvent::AxisDiscrete120 { axis, value } => {
+                        const LINES_PER_STEP: i32 = 3;
+                        let (count, wheel1, wheel2, wheel3) = match axis {
+                            0 => (1, value / (120 / LINES_PER_STEP), 0, 0), // 0 = vertical => 1 scroll wheel device (y axis)
+                            1 => (2, 0, value / (120 / LINES_PER_STEP), 0), // 1 = horizontal => 2 scroll wheel devices (y, x) -> (0, x)
+                            _ => {
+                                log::warn!("invalid scroll event: {axis}, {value}");
+                                return Ok(());
+                            }
+                        };
+                        let event = match CGEvent::new_scroll_event(
+                            self.event_source.clone(),
+                            ScrollEventUnit::LINE,
+                            count,
+                            wheel1,
+                            wheel2,
+                            wheel3,
+                        ) {
+                            Ok(e) => e,
+                            Err(()) => {
+                                log::warn!("scroll event creation failed!");
+                                return Ok(());
+                            }
+                        };
+                        event.post(CGEventTapLocation::HID);
+                    }
                 }
-                PointerEvent::Axis {
-                    time: _,
-                    axis,
-                    value,
-                } => {
-                    let value = value as i32;
-                    let (count, wheel1, wheel2, wheel3) = match axis {
-                        0 => (1, value, 0, 0), // 0 = vertical => 1 scroll wheel device (y axis)
-                        1 => (2, 0, value, 0), // 1 = horizontal => 2 scroll wheel devices (y, x) -> (0, x)
-                        _ => {
-                            log::warn!("invalid scroll event: {axis}, {value}");
-                            return Ok(());
-                        }
-                    };
-                    let event = match CGEvent::new_scroll_event(
-                        self.event_source.clone(),
-                        ScrollEventUnit::PIXEL,
-                        count,
-                        wheel1,
-                        wheel2,
-                        wheel3,
-                    ) {
-                        Ok(e) => e,
-                        Err(()) => {
-                            log::warn!("scroll event creation failed!");
-                            return Ok(());
-                        }
-                    };
-                    event.post(CGEventTapLocation::HID);
+
+                // reset button click state in case it's not a button event
+                if !matches!(pointer_event, PointerEvent::Button { .. }) {
+                    self.button_click_state = 0;
                 }
-                PointerEvent::AxisDiscrete120 { axis, value } => {
-                    let (count, wheel1, wheel2, wheel3) = match axis {
-                        0 => (1, value, 0, 0), // 0 = vertical => 1 scroll wheel device (y axis)
-                        1 => (2, 0, value, 0), // 1 = horizontal => 2 scroll wheel devices (y, x) -> (0, x)
-                        _ => {
-                            log::warn!("invalid scroll event: {axis}, {value}");
-                            return Ok(());
-                        }
-                    };
-                    let event = match CGEvent::new_scroll_event(
-                        self.event_source.clone(),
-                        ScrollEventUnit::PIXEL,
-                        count,
-                        wheel1,
-                        wheel2,
-                        wheel3,
-                    ) {
-                        Ok(e) => e,
-                        Err(()) => {
-                            log::warn!("scroll event creation failed!");
-                            return Ok(());
-                        }
-                    };
-                    event.post(CGEventTapLocation::HID);
-                }
-            },
+            }
             Event::Keyboard(keyboard_event) => match keyboard_event {
                 KeyboardEvent::Key {
                     time: _,
@@ -381,18 +459,15 @@ impl Emulation for MacOSEmulation {
                             return Ok(());
                         }
                     };
+                    let is_modifier = update_modifiers(&self.modifier_state, key, state);
+                    if is_modifier {
+                        modifier_event(self.event_source.clone(), self.modifier_state.get());
+                    }
                     match state {
                         // pressed
                         1 => self.spawn_repeat_task(code).await,
                         _ => self.cancel_repeat_task().await,
                     }
-                    update_modifiers(&self.modifier_state, key, state);
-                    key_event(
-                        self.event_source.clone(),
-                        code,
-                        state,
-                        self.modifier_state.get(),
-                    );
                 }
                 KeyboardEvent::Modifiers {
                     depressed,

input-emulation/src/windows.rs

@@ -1,22 +1,22 @@
 use super::error::{EmulationError, WindowsEmulationCreationError};
 use input_event::{
-    scancode, Event, KeyboardEvent, PointerEvent, BTN_BACK, BTN_FORWARD, BTN_LEFT, BTN_MIDDLE,
-    BTN_RIGHT,
+    BTN_BACK, BTN_FORWARD, BTN_LEFT, BTN_MIDDLE, BTN_RIGHT, Event, KeyboardEvent, PointerEvent,
+    scancode,
 };
 
 use async_trait::async_trait;
 use std::ops::BitOrAssign;
 use std::time::Duration;
 use tokio::task::AbortHandle;
-use windows::Win32::UI::Input::KeyboardAndMouse::{
-    SendInput, INPUT_0, KEYEVENTF_EXTENDEDKEY, MOUSEEVENTF_XDOWN, MOUSEEVENTF_XUP,
-};
 use windows::Win32::UI::Input::KeyboardAndMouse::{
     INPUT, INPUT_KEYBOARD, INPUT_MOUSE, KEYBDINPUT, KEYEVENTF_KEYUP, KEYEVENTF_SCANCODE,
     MOUSEEVENTF_HWHEEL, MOUSEEVENTF_LEFTDOWN, MOUSEEVENTF_LEFTUP, MOUSEEVENTF_MIDDLEDOWN,
     MOUSEEVENTF_MIDDLEUP, MOUSEEVENTF_MOVE, MOUSEEVENTF_RIGHTDOWN, MOUSEEVENTF_RIGHTUP,
     MOUSEEVENTF_WHEEL, MOUSEINPUT,
 };
+use windows::Win32::UI::Input::KeyboardAndMouse::{
+    INPUT_0, KEYEVENTF_EXTENDEDKEY, MOUSEEVENTF_XDOWN, MOUSEEVENTF_XUP, SendInput,
+};
 use windows::Win32::UI::WindowsAndMessaging::{XBUTTON1, XBUTTON2};
 
 use super::{Emulation, EmulationHandle};

input-emulation/src/wlroots.rs

@@ -1,6 +1,6 @@
 use crate::error::EmulationError;
 
-use super::{error::WlrootsEmulationCreationError, Emulation};
+use super::{Emulation, error::WlrootsEmulationCreationError};
 use async_trait::async_trait;
 use bitflags::bitflags;
 use std::collections::HashMap;
@@ -8,11 +8,11 @@ use std::io;
 use std::os::fd::{AsFd, OwnedFd};
 use std::sync::{Arc, Mutex};
 use std::time::{SystemTime, UNIX_EPOCH};
-use wayland_client::backend::WaylandError;
 use wayland_client::WEnum;
+use wayland_client::backend::WaylandError;
 
 use wayland_client::protocol::wl_keyboard::{self, WlKeyboard};
-use wayland_client::protocol::wl_pointer::{Axis, ButtonState};
+use wayland_client::protocol::wl_pointer::{Axis, AxisSource, ButtonState};
 use wayland_client::protocol::wl_seat::WlSeat;
 use wayland_protocols_wlr::virtual_pointer::v1::client::{
     zwlr_virtual_pointer_manager_v1::ZwlrVirtualPointerManagerV1 as VpManager,
@@ -25,16 +25,15 @@ use wayland_protocols_misc::zwp_virtual_keyboard_v1::client::{
 };
 
 use wayland_client::{
-    delegate_noop,
-    globals::{registry_queue_init, GlobalListContents},
+    Connection, Dispatch, EventQueue, QueueHandle, delegate_noop,
+    globals::{GlobalListContents, registry_queue_init},
     protocol::{wl_registry, wl_seat},
-    Connection, Dispatch, EventQueue, QueueHandle,
 };
 
-use input_event::{scancode, Event, KeyboardEvent, PointerEvent};
+use input_event::{Event, KeyboardEvent, PointerEvent, scancode};
 
-use super::error::WaylandBindError;
 use super::EmulationHandle;
+use super::error::WaylandBindError;
 
 struct State {
     keymap: Option<(u32, OwnedFd, u32)>,
@@ -163,13 +162,13 @@ impl Emulation for WlrootsEmulation {
     async fn create(&mut self, handle: EmulationHandle) {
         self.state.add_client(handle);
         if let Err(e) = self.queue.flush() {
-            log::error!("{}", e);
+            log::error!("{e}");
         }
     }
     async fn destroy(&mut self, handle: EmulationHandle) {
         self.state.destroy_client(handle);
         if let Err(e) = self.queue.flush() {
-            log::error!("{}", e);
+            log::error!("{e}");
         }
     }
     async fn terminate(&mut self) {
@@ -210,7 +209,8 @@ impl VirtualInput {
                     PointerEvent::AxisDiscrete120 { axis, value } => {
                         let axis: Axis = (axis as u32).try_into()?;
                         self.pointer
-                            .axis_discrete(now, axis, value as f64 / 6., value / 120);
+                            .axis_discrete(now, axis, value as f64 / 8., value / 120);
+                        self.pointer.axis_source(AxisSource::Wheel);
                         self.pointer.frame();
                     }
                 }
@@ -221,7 +221,7 @@ impl VirtualInput {
                     self.keyboard.key(time, key, state as u32);
                     if let Ok(mut mods) = self.modifiers.lock() {
                         if mods.update_by_key_event(key, state) {
-                            log::trace!("Key triggers modifier change: {:?}", mods);
+                            log::trace!("Key triggers modifier change: {mods:?}");
                             self.keyboard.modifiers(
                                 mods.mask_pressed().bits(),
                                 0,
@@ -330,7 +330,7 @@ impl XMods {
 
     fn update_by_key_event(&mut self, key: u32, state: u8) -> bool {
         if let Ok(key) = scancode::Linux::try_from(key) {
-            log::trace!("Attempting to process modifier from: {:#?}", key);
+            log::trace!("Attempting to process modifier from: {key:#?}");
             let pressed_mask = match key {
                 scancode::Linux::KeyLeftShift | scancode::Linux::KeyRightShift => XMods::ShiftMask,
                 scancode::Linux::KeyLeftCtrl | scancode::Linux::KeyRightCtrl => XMods::ControlMask,
@@ -348,7 +348,7 @@ impl XMods {
 
             // unchanged
             if pressed_mask.is_empty() && locked_mask.is_empty() {
-                log::trace!("{:#?} is not a modifier key", key);
+                log::trace!("{key:#?} is not a modifier key");
                 return false;
             }
             match state {

input-emulation/src/x11.rs

@@ -6,12 +6,12 @@ use x11::{
 };
 
 use input_event::{
-    Event, KeyboardEvent, PointerEvent, BTN_BACK, BTN_FORWARD, BTN_LEFT, BTN_MIDDLE, BTN_RIGHT,
+    BTN_BACK, BTN_FORWARD, BTN_LEFT, BTN_MIDDLE, BTN_RIGHT, Event, KeyboardEvent, PointerEvent,
 };
 
 use crate::error::EmulationError;
 
-use super::{error::X11EmulationCreationError, Emulation, EmulationHandle};
+use super::{Emulation, EmulationHandle, error::X11EmulationCreationError};
 
 pub(crate) struct X11Emulation {
     display: *mut xlib::Display,
@@ -23,7 +23,7 @@ impl X11Emulation {
     pub(crate) fn new() -> Result<Self, X11EmulationCreationError> {
         let display = unsafe {
             match xlib::XOpenDisplay(ptr::null()) {
-                d if d == ptr::null::<xlib::Display>() as *mut xlib::Display => {
+                d if std::ptr::eq(d, ptr::null_mut::<xlib::Display>()) => {
                     Err(X11EmulationCreationError::OpenDisplay)
                 }
                 display => Ok(display),

input-emulation/src/xdg_desktop_portal.rs

@@ -1,7 +1,10 @@
 use ashpd::{
     desktop::{
-        remote_desktop::{Axis, DeviceType, KeyState, RemoteDesktop},
         PersistMode, Session,
+        remote_desktop::{
+            Axis, DeviceType, KeyState, NotifyPointerAxisOptions, RemoteDesktop,
+            SelectDevicesOptions,
+        },
     },
     zbus::AsyncDrop,
 };
@@ -15,34 +18,33 @@ use input_event::{
 
 use crate::error::EmulationError;
 
-use super::{error::XdpEmulationCreationError, Emulation, EmulationHandle};
+use super::{Emulation, EmulationHandle, error::XdpEmulationCreationError};
 
-pub(crate) struct DesktopPortalEmulation<'a> {
-    proxy: RemoteDesktop<'a>,
-    session: Session<'a, RemoteDesktop<'a>>,
+pub(crate) struct DesktopPortalEmulation {
+    proxy: RemoteDesktop,
+    session: Session<RemoteDesktop>,
 }
 
-impl<'a> DesktopPortalEmulation<'a> {
-    pub(crate) async fn new() -> Result<DesktopPortalEmulation<'a>, XdpEmulationCreationError> {
+impl DesktopPortalEmulation {
+    pub(crate) async fn new() -> Result<DesktopPortalEmulation, XdpEmulationCreationError> {
         log::debug!("connecting to org.freedesktop.portal.RemoteDesktop portal ...");
         let proxy = RemoteDesktop::new().await?;
 
         // retry when user presses the cancel button
         log::debug!("creating session ...");
-        let session = proxy.create_session().await?;
+        let session = proxy.create_session(Default::default()).await?;
 
         log::debug!("selecting devices ...");
-        proxy
-            .select_devices(
-                &session,
-                DeviceType::Keyboard | DeviceType::Pointer,
-                None,
-                PersistMode::ExplicitlyRevoked,
-            )
-            .await?;
+        let options = SelectDevicesOptions::default()
+            .set_devices(DeviceType::Keyboard | DeviceType::Pointer)
+            .set_persist_mode(PersistMode::ExplicitlyRevoked);
+        proxy.select_devices(&session, options).await?;
 
         log::info!("requesting permission for input emulation");
-        let _devices = proxy.start(&session, None).await?.response()?;
+        let _devices = proxy
+            .start(&session, None, Default::default())
+            .await?
+            .response()?;
 
         log::debug!("started session");
         let session = session;
@@ -52,7 +54,7 @@ impl<'a> DesktopPortalEmulation<'a> {
 }
 
 #[async_trait]
-impl Emulation for DesktopPortalEmulation<'_> {
+impl Emulation for DesktopPortalEmulation {
     async fn consume(
         &mut self,
         event: input_event::Event,
@@ -62,7 +64,7 @@ impl Emulation for DesktopPortalEmulation<'_> {
             Pointer(p) => match p {
                 PointerEvent::Motion { time: _, dx, dy } => {
                     self.proxy
-                        .notify_pointer_motion(&self.session, dx, dy)
+                        .notify_pointer_motion(&self.session, dx, dy, Default::default())
                         .await?;
                 }
                 PointerEvent::Button {
@@ -75,7 +77,12 @@ impl Emulation for DesktopPortalEmulation<'_> {
                         _ => KeyState::Pressed,
                     };
                     self.proxy
-                        .notify_pointer_button(&self.session, button as i32, state)
+                        .notify_pointer_button(
+                            &self.session,
+                            button as i32,
+                            state,
+                            Default::default(),
+                        )
                         .await?;
                 }
                 PointerEvent::AxisDiscrete120 { axis, value } => {
@@ -84,7 +91,12 @@ impl Emulation for DesktopPortalEmulation<'_> {
                         _ => Axis::Horizontal,
                     };
                     self.proxy
-                        .notify_pointer_axis_discrete(&self.session, axis, value / 120)
+                        .notify_pointer_axis_discrete(
+                            &self.session,
+                            axis,
+                            value / 120,
+                            Default::default(),
+                        )
                         .await?;
                 }
                 PointerEvent::Axis {
@@ -101,7 +113,12 @@ impl Emulation for DesktopPortalEmulation<'_> {
                         Axis::Horizontal => (value, 0.),
                     };
                     self.proxy
-                        .notify_pointer_axis(&self.session, dx, dy, true)
+                        .notify_pointer_axis(
+                            &self.session,
+                            dx,
+                            dy,
+                            NotifyPointerAxisOptions::default().set_finish(true),
+                        )
                         .await?;
                 }
             },
@@ -117,7 +134,12 @@ impl Emulation for DesktopPortalEmulation<'_> {
                             _ => KeyState::Pressed,
                         };
                         self.proxy
-                            .notify_keyboard_keycode(&self.session, key as i32, state)
+                            .notify_keyboard_keycode(
+                                &self.session,
+                                key as i32,
+                                state,
+                                Default::default(),
+                            )
                             .await?;
                     }
                     KeyboardEvent::Modifiers { .. } => {
@@ -141,9 +163,8 @@ impl Emulation for DesktopPortalEmulation<'_> {
     }
 }
 
-impl AsyncDrop for DesktopPortalEmulation<'_> {
+impl AsyncDrop for DesktopPortalEmulation {
     #[doc = r" Perform the async cleanup."]
-    #[must_use]
     #[allow(clippy::type_complexity, clippy::type_repetition_in_bounds)]
     fn async_drop<'async_trait>(
         self,

input-event/Cargo.toml

@@ -14,7 +14,7 @@ serde = { version = "1.0", features = ["derive"] }
 thiserror = "2.0.0"
 
 [target.'cfg(all(unix, not(target_os="macos")))'.dependencies]
-reis = { version = "0.4", optional = true }
+reis = { version = "0.5.0", optional = true }
 
 [features]
 default = ["libei"]

input-event/src/lib.rs

@@ -112,8 +112,8 @@ impl Display for KeyboardEvent {
 impl Display for Event {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
-            Event::Pointer(p) => write!(f, "{}", p),
-            Event::Keyboard(k) => write!(f, "{}", k),
+            Event::Pointer(p) => write!(f, "{p}"),
+            Event::Keyboard(k) => write!(f, "{k}"),
         }
     }
 }

lan-mouse-cli/Cargo.toml

@@ -9,6 +9,8 @@ repository = "https://github.com/feschber/lan-mouse"
 [dependencies]
 futures = "0.3.30"
 lan-mouse-ipc = { path = "../lan-mouse-ipc", version = "0.2.0" }
+clap = { version = "4.4.11", features = ["derive"] }
+thiserror = "2.0.0"
 tokio = { version = "1.32.0", features = [
     "io-util",
     "io-std",

lan-mouse-cli/src/command.rs

@@ -1,153 +0,0 @@
-use std::{
-    fmt::Display,
-    str::{FromStr, SplitWhitespace},
-};
-
-use lan_mouse_ipc::{ClientHandle, Position};
-
-pub(super) enum CommandType {
-    NoCommand,
-    Help,
-    Connect,
-    Disconnect,
-    Activate,
-    Deactivate,
-    List,
-    SetHost,
-    SetPort,
-}
-
-#[derive(Debug)]
-pub(super) struct InvalidCommand {
-    cmd: String,
-}
-
-impl Display for InvalidCommand {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "invalid command: \"{}\"", self.cmd)
-    }
-}
-
-impl FromStr for CommandType {
-    type Err = InvalidCommand;
-
-    fn from_str(s: &str) -> std::prelude::v1::Result<Self, Self::Err> {
-        match s {
-            "connect" => Ok(Self::Connect),
-            "disconnect" => Ok(Self::Disconnect),
-            "activate" => Ok(Self::Activate),
-            "deactivate" => Ok(Self::Deactivate),
-            "list" => Ok(Self::List),
-            "set-host" => Ok(Self::SetHost),
-            "set-port" => Ok(Self::SetPort),
-            "help" => Ok(Self::Help),
-            _ => Err(InvalidCommand { cmd: s.to_string() }),
-        }
-    }
-}
-
-#[derive(Debug)]
-pub(super) enum Command {
-    None,
-    Help,
-    Connect(Position, String, Option<u16>),
-    Disconnect(ClientHandle),
-    Activate(ClientHandle),
-    Deactivate(ClientHandle),
-    List,
-    SetHost(ClientHandle, String),
-    SetPort(ClientHandle, Option<u16>),
-}
-
-impl CommandType {
-    pub(super) fn usage(&self) -> &'static str {
-        match self {
-            CommandType::Help => "help",
-            CommandType::NoCommand => "",
-            CommandType::Connect => "connect left|right|top|bottom <host> [<port>]",
-            CommandType::Disconnect => "disconnect <id>",
-            CommandType::Activate => "activate <id>",
-            CommandType::Deactivate => "deactivate <id>",
-            CommandType::List => "list",
-            CommandType::SetHost => "set-host <id> <host>",
-            CommandType::SetPort => "set-port <id> <host>",
-        }
-    }
-}
-
-pub(super) enum CommandParseError {
-    Usage(CommandType),
-    Invalid(InvalidCommand),
-}
-
-impl Display for CommandParseError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Usage(cmd) => write!(f, "usage: {}", cmd.usage()),
-            Self::Invalid(cmd) => write!(f, "{}", cmd),
-        }
-    }
-}
-
-impl FromStr for Command {
-    type Err = CommandParseError;
-
-    fn from_str(cmd: &str) -> Result<Self, Self::Err> {
-        let mut args = cmd.split_whitespace();
-        let cmd_type: CommandType = match args.next() {
-            Some(c) => c.parse().map_err(CommandParseError::Invalid),
-            None => Ok(CommandType::NoCommand),
-        }?;
-        match cmd_type {
-            CommandType::Help => Ok(Command::Help),
-            CommandType::NoCommand => Ok(Command::None),
-            CommandType::Connect => parse_connect_cmd(args),
-            CommandType::Disconnect => parse_disconnect_cmd(args),
-            CommandType::Activate => parse_activate_cmd(args),
-            CommandType::Deactivate => parse_deactivate_cmd(args),
-            CommandType::List => Ok(Command::List),
-            CommandType::SetHost => parse_set_host(args),
-            CommandType::SetPort => parse_set_port(args),
-        }
-    }
-}
-
-fn parse_connect_cmd(mut args: SplitWhitespace<'_>) -> Result<Command, CommandParseError> {
-    const USAGE: CommandParseError = CommandParseError::Usage(CommandType::Connect);
-    let pos = args.next().ok_or(USAGE)?.parse().map_err(|_| USAGE)?;
-    let host = args.next().ok_or(USAGE)?.to_string();
-    let port = args.next().and_then(|p| p.parse().ok());
-    Ok(Command::Connect(pos, host, port))
-}
-
-fn parse_disconnect_cmd(mut args: SplitWhitespace<'_>) -> Result<Command, CommandParseError> {
-    const USAGE: CommandParseError = CommandParseError::Usage(CommandType::Disconnect);
-    let id = args.next().ok_or(USAGE)?.parse().map_err(|_| USAGE)?;
-    Ok(Command::Disconnect(id))
-}
-
-fn parse_activate_cmd(mut args: SplitWhitespace<'_>) -> Result<Command, CommandParseError> {
-    const USAGE: CommandParseError = CommandParseError::Usage(CommandType::Activate);
-    let id = args.next().ok_or(USAGE)?.parse().map_err(|_| USAGE)?;
-    Ok(Command::Activate(id))
-}
-
-fn parse_deactivate_cmd(mut args: SplitWhitespace<'_>) -> Result<Command, CommandParseError> {
-    const USAGE: CommandParseError = CommandParseError::Usage(CommandType::Deactivate);
-    let id = args.next().ok_or(USAGE)?.parse().map_err(|_| USAGE)?;
-    Ok(Command::Deactivate(id))
-}
-
-fn parse_set_host(mut args: SplitWhitespace<'_>) -> Result<Command, CommandParseError> {
-    const USAGE: CommandParseError = CommandParseError::Usage(CommandType::SetHost);
-    let id = args.next().ok_or(USAGE)?.parse().map_err(|_| USAGE)?;
-    let host = args.next().ok_or(USAGE)?.parse().map_err(|_| USAGE)?;
-    Ok(Command::SetHost(id, host))
-}
-
-fn parse_set_port(mut args: SplitWhitespace<'_>) -> Result<Command, CommandParseError> {
-    const USAGE: CommandParseError = CommandParseError::Usage(CommandType::SetPort);
-    let id = args.next().ok_or(USAGE)?.parse().map_err(|_| USAGE)?;
-    let port = args.next().and_then(|p| p.parse().ok());
-    Ok(Command::SetPort(id, port))
-}

lan-mouse-cli/src/lib.rs

@@ -1,298 +1,170 @@
+use clap::{Args, Parser, Subcommand};
 use futures::StreamExt;
-use tokio::{
-    io::{AsyncBufReadExt, BufReader},
-    task::LocalSet,
-};
 
-use std::io::{self, Write};
-
-use self::command::{Command, CommandType};
+use std::{net::IpAddr, time::Duration};
+use thiserror::Error;
 
 use lan_mouse_ipc::{
-    AsyncFrontendEventReader, AsyncFrontendRequestWriter, ClientConfig, ClientHandle, ClientState,
-    FrontendEvent, FrontendRequest, IpcError, DEFAULT_PORT,
+    ClientHandle, ConnectionError, FrontendEvent, FrontendRequest, IpcError, Position,
+    connect_async,
 };
 
-mod command;
+#[derive(Debug, Error)]
+pub enum CliError {
+    /// is the service running?
+    #[error("could not connect: `{0}` - is the service running?")]
+    ServiceNotRunning(#[from] ConnectionError),
+    #[error("error communicating with service: {0}")]
+    Ipc(#[from] IpcError),
+}
 
-pub fn run() -> Result<(), IpcError> {
-    let runtime = tokio::runtime::Builder::new_current_thread()
-        .enable_io()
-        .enable_time()
-        .build()?;
-    runtime.block_on(LocalSet::new().run_until(async move {
-        let (rx, tx) = lan_mouse_ipc::connect_async().await?;
-        let mut cli = Cli::new(rx, tx);
-        cli.run().await
-    }))?;
+#[derive(Parser, Clone, Debug, PartialEq, Eq)]
+#[command(name = "lan-mouse-cli", about = "LanMouse CLI interface")]
+pub struct CliArgs {
+    #[command(subcommand)]
+    command: CliSubcommand,
+}
+
+#[derive(Args, Clone, Debug, PartialEq, Eq)]
+struct Client {
+    #[arg(long)]
+    hostname: Option<String>,
+    #[arg(long)]
+    port: Option<u16>,
+    #[arg(long)]
+    ips: Option<Vec<IpAddr>>,
+    #[arg(long)]
+    enter_hook: Option<String>,
+}
+
+#[derive(Clone, Subcommand, Debug, PartialEq, Eq)]
+enum CliSubcommand {
+    /// add a new client
+    AddClient(Client),
+    /// remove an existing client
+    RemoveClient { id: ClientHandle },
+    /// activate a client
+    Activate { id: ClientHandle },
+    /// deactivate a client
+    Deactivate { id: ClientHandle },
+    /// list configured clients
+    List,
+    /// change hostname
+    SetHost {
+        id: ClientHandle,
+        host: Option<String>,
+    },
+    /// change port
+    SetPort { id: ClientHandle, port: u16 },
+    /// set position
+    SetPosition { id: ClientHandle, pos: Position },
+    /// set ips
+    SetIps { id: ClientHandle, ips: Vec<IpAddr> },
+    /// re-enable capture
+    EnableCapture,
+    /// re-enable emulation
+    EnableEmulation,
+    /// authorize a public key
+    AuthorizeKey {
+        description: String,
+        sha256_fingerprint: String,
+    },
+    /// deauthorize a public key
+    RemoveAuthorizedKey { sha256_fingerprint: String },
+    /// save configuration to file
+    SaveConfig,
+}
+
+pub async fn run(args: CliArgs) -> Result<(), CliError> {
+    execute(args.command).await?;
     Ok(())
 }
 
-struct Cli {
-    clients: Vec<(ClientHandle, ClientConfig, ClientState)>,
-    rx: AsyncFrontendEventReader,
-    tx: AsyncFrontendRequestWriter,
-}
-
-impl Cli {
-    fn new(rx: AsyncFrontendEventReader, tx: AsyncFrontendRequestWriter) -> Cli {
-        Self {
-            clients: vec![],
-            rx,
-            tx,
-        }
-    }
-
-    async fn run(&mut self) -> Result<(), IpcError> {
-        let stdin = tokio::io::stdin();
-        let stdin = BufReader::new(stdin);
-        let mut stdin = stdin.lines();
-
-        /* initial state sync */
-        self.clients = loop {
-            match self.rx.next().await {
-                Some(Ok(e)) => {
-                    if let FrontendEvent::Enumerate(clients) = e {
-                        break clients;
+async fn execute(cmd: CliSubcommand) -> Result<(), CliError> {
+    let (mut rx, mut tx) = connect_async(Some(Duration::from_millis(500))).await?;
+    match cmd {
+        CliSubcommand::AddClient(Client {
+            hostname,
+            port,
+            ips,
+            enter_hook,
+        }) => {
+            tx.request(FrontendRequest::Create).await?;
+            while let Some(e) = rx.next().await {
+                if let FrontendEvent::Created(handle, _, _) = e? {
+                    if let Some(hostname) = hostname {
+                        tx.request(FrontendRequest::UpdateHostname(handle, Some(hostname)))
+                            .await?;
                     }
-                }
-                Some(Err(e)) => return Err(e),
-                None => return Ok(()),
-            }
-        };
-
-        loop {
-            prompt()?;
-            tokio::select! {
-                line = stdin.next_line() => {
-                    let Some(line) = line? else {
-                        break Ok(());
-                    };
-                    let cmd: Command = match line.parse() {
-                        Ok(cmd) => cmd,
-                        Err(e) => {
-                            eprintln!("{e}");
-                            continue;
-                        }
-                    };
-                    self.execute(cmd).await?;
-                }
-                event = self.rx.next() => {
-                    if let Some(event) = event {
-                        self.handle_event(event?);
-                    } else {
-                        break Ok(());
+                    if let Some(port) = port {
+                        tx.request(FrontendRequest::UpdatePort(handle, port))
+                            .await?;
                     }
+                    if let Some(ips) = ips {
+                        tx.request(FrontendRequest::UpdateFixIps(handle, ips))
+                            .await?;
+                    }
+                    if let Some(enter_hook) = enter_hook {
+                        tx.request(FrontendRequest::UpdateEnterHook(handle, Some(enter_hook)))
+                            .await?;
+                    }
+                    break;
                 }
             }
         }
-    }
-
-    async fn execute(&mut self, cmd: Command) -> Result<(), IpcError> {
-        match cmd {
-            Command::None => {}
-            Command::Connect(pos, host, port) => {
-                let request = FrontendRequest::Create;
-                self.tx.request(request).await?;
-                let handle = loop {
-                    if let Some(Ok(event)) = self.rx.next().await {
-                        match event {
-                            FrontendEvent::Created(h, c, s) => {
-                                self.clients.push((h, c, s));
-                                break h;
-                            }
-                            _ => {
-                                self.handle_event(event);
-                                continue;
-                            }
-                        }
-                    }
-                };
-                for request in [
-                    FrontendRequest::UpdateHostname(handle, Some(host.clone())),
-                    FrontendRequest::UpdatePort(handle, port.unwrap_or(DEFAULT_PORT)),
-                    FrontendRequest::UpdatePosition(handle, pos),
-                ] {
-                    self.tx.request(request).await?;
-                }
-            }
-            Command::Disconnect(id) => {
-                self.tx.request(FrontendRequest::Delete(id)).await?;
-                loop {
-                    if let Some(Ok(event)) = self.rx.next().await {
-                        self.handle_event(event.clone());
-                        if let FrontendEvent::Deleted(_) = event {
-                            self.handle_event(event);
-                            break;
-                        }
-                    }
-                }
-            }
-            Command::Activate(id) => {
-                self.tx.request(FrontendRequest::Activate(id, true)).await?;
-            }
-            Command::Deactivate(id) => {
-                self.tx
-                    .request(FrontendRequest::Activate(id, false))
-                    .await?;
-            }
-            Command::List => {
-                self.tx.request(FrontendRequest::Enumerate()).await?;
-                while let Some(e) = self.rx.next().await {
-                    let event = e?;
-                    self.handle_event(event.clone());
-                    if let FrontendEvent::Enumerate(_) = event {
-                        break;
-                    }
-                }
-            }
-            Command::SetHost(handle, host) => {
-                let request = FrontendRequest::UpdateHostname(handle, Some(host.clone()));
-                self.tx.request(request).await?;
-            }
-            Command::SetPort(handle, port) => {
-                let request = FrontendRequest::UpdatePort(handle, port.unwrap_or(DEFAULT_PORT));
-                self.tx.request(request).await?;
-            }
-            Command::Help => {
-                for cmd_type in [
-                    CommandType::List,
-                    CommandType::Connect,
-                    CommandType::Disconnect,
-                    CommandType::Activate,
-                    CommandType::Deactivate,
-                    CommandType::SetHost,
-                    CommandType::SetPort,
-                ] {
-                    eprintln!("{}", cmd_type.usage());
-                }
-            }
+        CliSubcommand::RemoveClient { id } => tx.request(FrontendRequest::Delete(id)).await?,
+        CliSubcommand::Activate { id } => tx.request(FrontendRequest::Activate(id, true)).await?,
+        CliSubcommand::Deactivate { id } => {
+            tx.request(FrontendRequest::Activate(id, false)).await?
         }
-        Ok(())
-    }
-
-    fn find_mut(
-        &mut self,
-        handle: ClientHandle,
-    ) -> Option<&mut (ClientHandle, ClientConfig, ClientState)> {
-        self.clients.iter_mut().find(|(h, _, _)| *h == handle)
-    }
-
-    fn remove(
-        &mut self,
-        handle: ClientHandle,
-    ) -> Option<(ClientHandle, ClientConfig, ClientState)> {
-        let idx = self.clients.iter().position(|(h, _, _)| *h == handle);
-        idx.map(|i| self.clients.swap_remove(i))
-    }
-
-    fn handle_event(&mut self, event: FrontendEvent) {
-        match event {
-            FrontendEvent::Created(h, c, s) => {
-                eprint!("client added ({h}): ");
-                print_config(&c);
-                eprint!(" ");
-                print_state(&s);
-                eprintln!();
-                self.clients.push((h, c, s));
-            }
-            FrontendEvent::NoSuchClient(h) => {
-                eprintln!("no such client: {h}");
-            }
-            FrontendEvent::State(h, c, s) => {
-                if let Some((_, config, state)) = self.find_mut(h) {
-                    let old_host = config.hostname.clone().unwrap_or("\"\"".into());
-                    let new_host = c.hostname.clone().unwrap_or("\"\"".into());
-                    if old_host != new_host {
-                        eprintln!(
-                            "client {h}: hostname updated ({} -> {})",
-                            old_host, new_host
+        CliSubcommand::List => {
+            tx.request(FrontendRequest::Enumerate()).await?;
+            while let Some(e) = rx.next().await {
+                if let FrontendEvent::Enumerate(clients) = e? {
+                    for (handle, config, state) in clients {
+                        let host = config.hostname.unwrap_or("unknown".to_owned());
+                        let port = config.port;
+                        let pos = config.pos;
+                        let active = state.active;
+                        let ips = state.ips;
+                        println!(
+                            "id {handle}: {host}:{port} ({pos}) active: {active}, ips: {ips:?}"
                         );
                     }
-                    if config.port != c.port {
-                        eprintln!("client {h} changed port: {} -> {}", config.port, c.port);
-                    }
-                    if config.fix_ips != c.fix_ips {
-                        eprintln!("client {h} ips updated: {:?}", c.fix_ips)
-                    }
-                    *config = c;
-                    if state.active ^ s.active {
-                        eprintln!(
-                            "client {h} {}",
-                            if s.active { "activated" } else { "deactivated" }
-                        );
-                    }
-                    *state = s;
+                    break;
                 }
             }
-            FrontendEvent::Deleted(h) => {
-                if let Some((h, c, _)) = self.remove(h) {
-                    eprint!("client {h} removed (");
-                    print_config(&c);
-                    eprintln!(")");
-                }
-            }
-            FrontendEvent::PortChanged(p, e) => {
-                if let Some(e) = e {
-                    eprintln!("failed to change port: {e}");
-                } else {
-                    eprintln!("changed port to {p}");
-                }
-            }
-            FrontendEvent::Enumerate(clients) => {
-                self.clients = clients;
-                self.print_clients();
-            }
-            FrontendEvent::Error(e) => {
-                eprintln!("ERROR: {e}");
-            }
-            FrontendEvent::CaptureStatus(s) => {
-                eprintln!("capture status: {s:?}")
-            }
-            FrontendEvent::EmulationStatus(s) => {
-                eprintln!("emulation status: {s:?}")
-            }
-            FrontendEvent::AuthorizedUpdated(fingerprints) => {
-                eprintln!("authorized keys changed:");
-                for (desc, fp) in fingerprints {
-                    eprintln!("{desc}: {fp}");
-                }
-            }
-            FrontendEvent::PublicKeyFingerprint(fp) => {
-                eprintln!("the public key fingerprint of this device is {fp}");
-            }
-            FrontendEvent::IncomingConnected(..) => {}
-            FrontendEvent::IncomingDisconnected(..) => {}
         }
-    }
-
-    fn print_clients(&mut self) {
-        for (h, c, s) in self.clients.iter() {
-            eprint!("client {h}: ");
-            print_config(c);
-            eprint!(" ");
-            print_state(s);
-            eprintln!();
+        CliSubcommand::SetHost { id, host } => {
+            tx.request(FrontendRequest::UpdateHostname(id, host))
+                .await?
         }
+        CliSubcommand::SetPort { id, port } => {
+            tx.request(FrontendRequest::UpdatePort(id, port)).await?
+        }
+        CliSubcommand::SetPosition { id, pos } => {
+            tx.request(FrontendRequest::UpdatePosition(id, pos)).await?
+        }
+        CliSubcommand::SetIps { id, ips } => {
+            tx.request(FrontendRequest::UpdateFixIps(id, ips)).await?
+        }
+        CliSubcommand::EnableCapture => tx.request(FrontendRequest::EnableCapture).await?,
+        CliSubcommand::EnableEmulation => tx.request(FrontendRequest::EnableEmulation).await?,
+        CliSubcommand::AuthorizeKey {
+            description,
+            sha256_fingerprint,
+        } => {
+            tx.request(FrontendRequest::AuthorizeKey(
+                description,
+                sha256_fingerprint,
+            ))
+            .await?
+        }
+        CliSubcommand::RemoveAuthorizedKey { sha256_fingerprint } => {
+            tx.request(FrontendRequest::RemoveAuthorizedKey(sha256_fingerprint))
+                .await?
+        }
+        CliSubcommand::SaveConfig => tx.request(FrontendRequest::SaveConfiguration).await?,
     }
-}
-
-fn prompt() -> io::Result<()> {
-    eprint!("lan-mouse > ");
-    std::io::stderr().flush()?;
     Ok(())
 }
-
-fn print_config(c: &ClientConfig) {
-    eprint!(
-        "{}:{} ({}), ips: {:?}",
-        c.hostname.clone().unwrap_or("(no hostname)".into()),
-        c.port,
-        c.pos,
-        c.fix_ips
-    );
-}
-
-fn print_state(s: &ClientState) {
-    eprint!("active: {}, dns: {:?}", s.active, s.ips);
-}

lan-mouse-gtk/Cargo.toml

@@ -13,6 +13,7 @@ async-channel = { version = "2.1.1" }
 hostname = "0.4.0"
 log = "0.4.20"
 lan-mouse-ipc = { path = "../lan-mouse-ipc", version = "0.2.0" }
+thiserror = "2.0.0"
 
 [build-dependencies]
 glib-build-tools = { version = "0.20.0" }

lan-mouse-gtk/resources/authorization_window.ui

@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <requires lib="gtk" version="4.0"/>
+  <requires lib="libadwaita" version="1.0"/>
+  <template class="AuthorizationWindow" parent="AdwWindow">
+    <property name="modal">True</property>
+    <property name="width-request">180</property>
+    <property name="default-width">180</property>
+    <property name="height-request">180</property>
+    <property name="default-height">180</property>
+    <property name="title" translatable="yes">Unauthorized Device</property>
+    <property name="content">
+      <object class="GtkBox">
+        <property name="orientation">vertical</property>
+        <property name="vexpand">True</property>
+        <child type="top">
+          <object class="AdwHeaderBar">
+            <style>
+              <class name="flat"/>
+            </style>
+          </object>
+        </child>
+        <child>
+          <object class="GtkBox">
+            <property name="orientation">vertical</property>
+            <property name="spacing">30</property>
+            <property name="margin-start">30</property>
+            <property name="margin-end">30</property>
+            <property name="margin-top">30</property>
+            <property name="margin-bottom">30</property>
+            <child>
+              <object class="GtkLabel">
+                <property name="label">An unauthorized Device is trying to connect. Do you want to authorize this Device?</property>
+                <property name="width-request">100</property>
+                <property name="wrap">word-wrap</property>
+              </object>
+            </child>
+            <child>
+              <object class="AdwPreferencesGroup">
+                <property name="title">sha256 fingerprint</property>
+                <child>
+                  <object class="AdwActionRow">
+                    <property name="child">
+                      <object class="GtkLabel" id="fingerprint">
+                        <property name="ellipsize">PANGO_ELLIPSIZE_NONE</property>
+                        <property name="vexpand">True</property>
+                        <property name="hexpand">False</property>
+                        <property name="wrap">True</property>
+                        <property name="wrap-mode">word-char</property>
+                        <property name="justify">center</property>
+                        <property name="xalign">0.5</property>
+                        <property name="margin-top">10</property>
+                        <property name="margin-bottom">10</property>
+                        <property name="margin-start">10</property>
+                        <property name="margin-end">10</property>
+                        <property name="width-chars">64</property>
+                      </object>
+                    </property>
+                  </object>
+                </child>
+              </object>
+            </child>
+          </object>
+        </child>
+        <child>
+          <object class="GtkBox">
+            <property name="margin-start">30</property>
+            <property name="margin-end">30</property>
+            <property name="margin-top">30</property>
+            <property name="margin-bottom">30</property>
+            <property name="orientation">horizontal</property>
+            <property name="spacing">30</property>
+            <property name="hexpand">True</property>
+            <property name="vexpand">True</property>
+            <property name="valign">end</property>
+            <child>
+              <object class="GtkButton" id="cancel_button">
+                <signal name="clicked" handler="handle_cancel" swapped="true"/>
+                <property name="label" translatable="yes">Cancel</property>
+                <property name="can-shrink">True</property>
+                <property name="height-request">50</property>
+                <property name="hexpand">True</property>
+              </object>
+            </child>
+            <child>
+              <object class="GtkButton" id="confirm_button">
+                <signal name="clicked" handler="handle_confirm" swapped="true"/>
+                <property name="label" translatable="yes">Authorize</property>
+                <property name="can-shrink">True</property>
+                <property name="height-request">50</property>
+                <property name="hexpand">True</property>
+                <style>
+                  <class name="destructive-action"/>
+                </style>
+              </object>
+            </child>
+          </object>
+        </child>
+      </object>
+    </property>
+  </template>
+</interface>

lan-mouse-gtk/resources/icons/scalable/actions/edit-copy-symbolic.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <path d="m 0 3 c 0 -1.644531 1.355469 -3 3 -3 h 5 c 1.644531 0 3 1.355469 3 3 c 0 0.550781 -0.449219 1 -1 1 s -1 -0.449219 -1 -1 c 0 -0.570312 -0.429688 -1 -1 -1 h -5 c -0.570312 0 -1 0.429688 -1 1 v 5 c 0 0.570312 0.429688 1 1 1 c 0.550781 0 1 0.449219 1 1 s -0.449219 1 -1 1 c -1.644531 0 -3 -1.355469 -3 -3 z m 5 5 c 0 -1.644531 1.355469 -3 3 -3 h 5 c 1.644531 0 3 1.355469 3 3 v 5 c 0 1.644531 -1.355469 3 -3 3 h -5 c -1.644531 0 -3 -1.355469 -3 -3 z m 2 0 v 5 c 0 0.570312 0.429688 1 1 1 h 5 c 0.570312 0 1 -0.429688 1 -1 v -5 c 0 -0.570312 -0.429688 -1 -1 -1 h -5 c -0.570312 0 -1 0.429688 -1 1 z m 0 0" fill="#2e3436"/>
+</svg>

lan-mouse-gtk/resources/icons/scalable/actions/edit-delete-symbolic.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <path d="m 8 0 c -4.410156 0 -8 3.589844 -8 8 s 3.589844 8 8 8 s 8 -3.589844 8 -8 s -3.589844 -8 -8 -8 z m 0 2 c 3.332031 0 6 2.667969 6 6 s -2.667969 6 -6 6 s -6 -2.667969 -6 -6 s 2.667969 -6 6 -6 z m -2.03125 2.96875 c -0.265625 0 -0.519531 0.105469 -0.707031 0.292969 c -0.390625 0.390625 -0.390625 1.023437 0 1.414062 l 1.292969 1.292969 l -1.292969 1.292969 c -0.390625 0.390625 -0.390625 1.023437 0 1.414062 s 1.023437 0.390625 1.414062 0 l 1.292969 -1.292969 l 1.292969 1.292969 c 0.390625 0.390625 1.023437 0.390625 1.414062 0 s 0.390625 -1.023437 0 -1.414062 l -1.292969 -1.292969 l 1.292969 -1.292969 c 0.390625 -0.390625 0.390625 -1.023437 0 -1.414062 c -0.1875 -0.1875 -0.441406 -0.292969 -0.707031 -0.292969 s -0.519531 0.105469 -0.707031 0.292969 l -1.292969 1.292969 l -1.292969 -1.292969 c -0.1875 -0.1875 -0.441406 -0.292969 -0.707031 -0.292969 z m 0 0" fill="#2e3436"/>
+</svg>

lan-mouse-gtk/resources/icons/scalable/actions/emblem-ok-symbolic.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <path d="m 13.753906 4.660156 c 0.175782 -0.199218 0.261719 -0.460937 0.246094 -0.726562 c -0.019531 -0.265625 -0.140625 -0.511719 -0.339844 -0.6875 c -0.199218 -0.175782 -0.460937 -0.261719 -0.726562 -0.246094 c -0.265625 0.019531 -0.511719 0.140625 -0.6875 0.339844 l -6.296875 7.195312 l -2.242188 -2.242187 c -0.390625 -0.390625 -1.023437 -0.390625 -1.414062 0 c -0.1875 0.1875 -0.292969 0.441406 -0.292969 0.707031 s 0.105469 0.519531 0.292969 0.707031 l 3 3 c 0.195312 0.195313 0.464843 0.304688 0.738281 0.292969 c 0.277344 -0.007812 0.539062 -0.132812 0.722656 -0.339844 z m 0 0" fill="#2e3436"/>
+</svg>

lan-mouse-gtk/resources/icons/scalable/actions/list-add-symbolic.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <path d="m 7 1 v 6 h -6 v 2 h 6 v 6 h 2 v -6 h 6 v -2 h -6 v -6 z m 0 0" fill="#2e3436"/>
+</svg>

lan-mouse-gtk/resources/icons/scalable/actions/object-rotate-right-symbolic.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <path d="m 7.085938 2 c 0.574218 0.007812 1.152343 0.085938 1.726562 0.238281 c 3.054688 0.820313 5.1875 3.597657 5.1875 6.761719 h 2 v 1 h -0.007812 c 0.003906 0.265625 -0.101563 0.519531 -0.285157 0.707031 l -2 2 c -0.390625 0.390625 -1.023437 0.390625 -1.414062 0 l -2 -2 c -0.1875 -0.1875 -0.289063 -0.441406 -0.289063 -0.707031 h -0.003906 v -1 h 2 c 0 -2.269531 -1.515625 -4.242188 -3.707031 -4.832031 c -2.1875 -0.585938 -4.488281 0.367187 -5.625 2.332031 c -1.132813 1.964844 -0.808594 4.429688 0.796875 6.035156 c 0.390625 0.390625 0.390625 1.023438 0 1.414063 s -1.023438 0.390625 -1.414063 0 c -2.238281 -2.238281 -2.695312 -5.710938 -1.113281 -8.449219 c 1.1875 -2.054688 3.304688 -3.324219 5.578125 -3.480469 c 0.1875 -0.015625 0.378906 -0.023437 0.570313 -0.019531 z m 0 0" fill="#2e3436"/>
+</svg>

lan-mouse-gtk/resources/icons/scalable/actions/object-select-symbolic.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <path d="m 13.753906 4.660156 c 0.175782 -0.199218 0.261719 -0.460937 0.246094 -0.726562 c -0.019531 -0.265625 -0.140625 -0.511719 -0.339844 -0.6875 c -0.199218 -0.175782 -0.460937 -0.261719 -0.726562 -0.246094 c -0.265625 0.019531 -0.511719 0.140625 -0.6875 0.339844 l -6.296875 7.195312 l -2.242188 -2.242187 c -0.390625 -0.390625 -1.023437 -0.390625 -1.414062 0 c -0.1875 0.1875 -0.292969 0.441406 -0.292969 0.707031 s 0.105469 0.519531 0.292969 0.707031 l 3 3 c 0.195312 0.195313 0.464843 0.304688 0.738281 0.292969 c 0.277344 -0.007812 0.539062 -0.132812 0.722656 -0.339844 z m 0 0" fill="#2e3436"/>
+</svg>

lan-mouse-gtk/resources/icons/scalable/actions/open-menu-symbolic.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <g fill="#2e3436">
+        <path d="m 1 2 h 14 v 2 h -14 z m 0 0"/>
+        <path d="m 1 7 h 14 v 2 h -14 z m 0 0"/>
+        <path d="m 1 12 h 14 v 2 h -14 z m 0 0"/>
+    </g>
+</svg>

lan-mouse-gtk/resources/icons/scalable/actions/process-stop-symbolic.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <path d="m 3 2 c -0.265625 0 -0.519531 0.105469 -0.707031 0.292969 c -0.390625 0.390625 -0.390625 1.023437 0 1.414062 l 4.292969 4.292969 l -4.292969 4.292969 c -0.390625 0.390625 -0.390625 1.023437 0 1.414062 s 1.023437 0.390625 1.414062 0 l 4.292969 -4.292969 l 4.292969 4.292969 c 0.390625 0.390625 1.023437 0.390625 1.414062 0 s 0.390625 -1.023437 0 -1.414062 l -4.292969 -4.292969 l 4.292969 -4.292969 c 0.390625 -0.390625 0.390625 -1.023437 0 -1.414062 c -0.1875 -0.1875 -0.441406 -0.292969 -0.707031 -0.292969 s -0.519531 0.105469 -0.707031 0.292969 l -4.292969 4.292969 l -4.292969 -4.292969 c -0.1875 -0.1875 -0.441406 -0.292969 -0.707031 -0.292969 z m 0 0" fill="#2e3436"/>
+</svg>

lan-mouse-gtk/resources/icons/scalable/devices/auth-fingerprint-symbolic.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <path d="m 8.074219 0 c -1.203125 -0.0117188 -2.40625 0.285156 -3.492188 0.890625 c -0.480469 0.269531 -0.652343 0.878906 -0.382812 1.359375 c 0.269531 0.484375 0.878906 0.65625 1.359375 0.386719 c 1.550781 -0.867188 3.4375 -0.847657 4.972656 0.050781 c 1.53125 0.898438 2.46875 2.535156 2.46875 4.3125 v 1 c 0 0.550781 0.449219 1 1 1 s 1 -0.449219 1 -1 v -1 c 0 -0.019531 0 -0.039062 -0.003906 -0.054688 c -0.019532 -2.460937 -1.332032 -4.738281 -3.457032 -5.984374 c -1.070312 -0.628907 -2.265624 -0.9492192 -3.46875 -0.960938 z m -5.199219 2.832031 c -0.066406 0 -0.132812 0.007813 -0.195312 0.023438 c -0.257813 0.058593 -0.484376 0.21875 -0.625 0.445312 c -0.6875 1.109375 -1.054688 2.390625 -1.054688 3.699219 v 5.0625 c 0 0.550781 0.449219 1 1 1 s 1 -0.449219 1 -1 v -5.0625 c 0 -0.933594 0.261719 -1.851562 0.753906 -2.644531 c 0.292969 -0.46875 0.148438 -1.082031 -0.320312 -1.375 c -0.167969 -0.105469 -0.363282 -0.15625 -0.558594 -0.148438 z m 5.125 0.167969 c -2.199219 0 -4 1.800781 -4 4 v 1 c 0 0.550781 0.449219 1 1 1 s 1 -0.449219 1 -1 v -1 c 0 -1.117188 0.882812 -2 2 -2 s 2 0.882812 2 2 v 5 s 0.007812 0.441406 0.175781 0.941406 s 0.5 1.148438 1.117188 1.765625 c 0.390625 0.390625 1.023437 0.390625 1.414062 0 s 0.390625 -1.023437 0 -1.414062 c -0.382812 -0.382813 -0.550781 -0.734375 -0.632812 -0.984375 s -0.074219 -0.308594 -0.074219 -0.308594 v -5 c 0 -2.199219 -1.800781 -4 -4 -4 z m 0 3 c -0.550781 0 -1 0.449219 -1 1 v 5 s 0 0.59375 0.144531 1.320312 c 0.144531 0.726563 0.414063 1.652344 1.148438 2.386719 c 0.390625 0.390625 1.023437 0.390625 1.414062 0 s 0.390625 -1.023437 0 -1.414062 c -0.265625 -0.265625 -0.496093 -0.839844 -0.601562 -1.363281 c -0.105469 -0.523438 -0.105469 -0.929688 -0.105469 -0.929688 v -5 c 0 -0.550781 -0.449219 -1 -1 -1 z m -3 4 c -0.550781 0 -1 0.449219 -1 1 v 3 c 0 0.550781 0.449219 1 1 1 s 1 -0.449219 1 -1 v -3 c 0 -0.550781 -0.449219 -1 -1 -1 z m 9 0 c -0.550781 0 -1 0.449219 -1 1 s 0.449219 1 1 1 s 1 -0.449219 1 -1 s -0.449219 -1 -1 -1 z m 0 0" fill="#2e3434"/>
+</svg>

lan-mouse-gtk/resources/icons/scalable/devices/network-wired-symbolic.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <path d="m 6 0.015625 c -0.554688 0 -1 0.445313 -1 1 v 3 c 0 0.554687 0.445312 1 1 1 h 1 v 2 h -7 v 2 h 2 v 2 h -1 c -0.554688 0 -1 0.445313 -1 1 v 3 c 0 0.554687 0.445312 1 1 1 h 4 c 0.554688 0 1 -0.445313 1 -1 v -3 c 0 -0.554687 -0.445312 -1 -1 -1 h -1 v -2 h 8 v 2 h -1 c -0.554688 0 -1 0.445313 -1 1 v 3 c 0 0.554687 0.445312 1 1 1 h 4 c 0.554688 0 1 -0.445313 1 -1 v -3 c 0 -0.554687 -0.445312 -1 -1 -1 h -1 v -2 h 2 v -2 h -7 v -2 h 1 c 0.554688 0 1 -0.445313 1 -1 v -3 c 0 -0.554687 -0.445312 -1 -1 -1 z m 0 0" fill="#2e3436"/>
+</svg>

lan-mouse-gtk/resources/icons/scalable/places/user-trash-symbolic.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <g fill="#2e3436">
+        <path d="m 6.5 0 c -1.378906 0 -2.5 1.121094 -2.5 2.5 v 0.5 h -3 c -0.550781 0 -1 0.449219 -1 1 s 0.449219 1 1 1 h 1 v 8 c 0 1.65625 1.34375 3 3 3 h 6 c 1.65625 0 3 -1.34375 3 -3 v -8 h 1 c 0.550781 0 1 -0.449219 1 -1 s -0.449219 -1 -1 -1 h -3.023438 v -0.5 c 0 -1.378906 -1.117187 -2.5 -2.5 -2.5 z m 0 2 h 2.976562 c 0.289063 0 0.5 0.210938 0.5 0.5 v 0.5 h -3.976562 v -0.5 c 0 -0.289062 0.210938 -0.5 0.5 -0.5 z m -2.5 3 h 8 v 8 c 0 0.5625 -0.4375 1 -1 1 h -6 c -0.5625 0 -1 -0.4375 -1 -1 z m 0 0"/>
+        <path d="m 7 7 v 5 c 0 0.277344 -0.222656 0.5 -0.5 0.5 s -0.5 -0.222656 -0.5 -0.5 v -5 c 0 -0.277344 0.222656 -0.5 0.5 -0.5 s 0.5 0.222656 0.5 0.5 z m 0 0"/>
+        <path d="m 10 7 v 5 c 0 0.277344 -0.222656 0.5 -0.5 0.5 s -0.5 -0.222656 -0.5 -0.5 v -5 c 0 -0.277344 0.222656 -0.5 0.5 -0.5 s 0.5 0.222656 0.5 0.5 z m 0 0"/>
+    </g>
+</svg>

lan-mouse-gtk/resources/icons/scalable/status/dialog-warning-symbolic.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <path d="m 7.90625 0.09375 c -0.527344 -0.0273438 -1.039062 0.28125 -1.4375 0.96875 l -6.25 11.59375 c -0.535156 0.964844 0.046875 2.34375 1.09375 2.34375 h 13.15625 c 0.980469 0 1.902344 -1.160156 1.21875 -2.34375 l -6.3125 -11.53125 c -0.398438 -0.644531 -0.941406 -1.003906 -1.46875 -1.03125 z m 1.09375 3.90625 v 5 c 0.007812 0.527344 -0.472656 1 -1 1 s -1.007812 -0.472656 -1 -1 v -5 z m -1 7 c 0.550781 0 1 0.449219 1 1 s -0.449219 1 -1 1 s -1 -0.449219 -1 -1 s 0.449219 -1 1 -1 z m 0 0" fill="#2e3436"/>
+</svg>

lan-mouse-gtk/resources/icons/scalable/status/network-wired-disconnected-symbolic.svg

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">
+    <g fill="#2e3436">
+        <path d="m 15 10 c 0.265625 0 0.519531 0.105469 0.707031 0.292969 c 0.390625 0.390625 0.390625 1.023437 0 1.414062 l -1.292969 1.292969 l 1.292969 1.292969 c 0.390625 0.390625 0.390625 1.023437 0 1.414062 s -1.023437 0.390625 -1.414062 0 l -1.292969 -1.292969 l -1.292969 1.292969 c -0.390625 0.390625 -1.023437 0.390625 -1.414062 0 s -0.390625 -1.023437 0 -1.414062 l 1.292969 -1.292969 l -1.292969 -1.292969 c -0.390625 -0.390625 -0.390625 -1.023437 0 -1.414062 c 0.1875 -0.1875 0.441406 -0.292969 0.707031 -0.292969 s 0.519531 0.105469 0.707031 0.292969 l 1.292969 1.292969 l 1.292969 -1.292969 c 0.1875 -0.1875 0.441406 -0.292969 0.707031 -0.292969 z m 0 0"/>
+        <path d="m 6 0 c -0.554688 0 -1 0.445312 -1 1 v 3 c 0 0.554688 0.445312 1 1 1 h 1 v 2 h -7 v 2 h 2 v 2 h -1 c -0.554688 0 -1 0.445312 -1 1 v 3 c 0 0.554688 0.445312 1 1 1 h 4 c 0.554688 0 1 -0.445312 1 -1 v -3 c 0 -0.554688 -0.445312 -1 -1 -1 h -1 v -2 h 12 v -2 h -7 v -2 h 1 c 0.554688 0 1 -0.445312 1 -1 v -3 c 0 -0.554688 -0.445312 -1 -1 -1 z m 0 0" fill-opacity="0.34902"/>
+    </g>
+</svg>

lan-mouse-gtk/resources/resources.gresource.xml

@@ -2,11 +2,30 @@
 <gresources>
   <gresource prefix="/de/feschber/LanMouse">
     <file compressed="true" preprocess="xml-stripblanks">window.ui</file>
+    <file compressed="true" preprocess="xml-stripblanks">authorization_window.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">fingerprint_window.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">client_row.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">key_row.ui</file>
   </gresource>
   <gresource prefix="/de/feschber/LanMouse/icons">
     <file compressed="true" preprocess="xml-stripblanks">de.feschber.LanMouse.svg</file>
+    <!--
+      Bundled Adwaita symbolic icons so the GTK frontend has a complete icon set
+      on platforms (notably macOS) where the Adwaita icon theme is not installed.
+      Registered via IconTheme::add_resource_path("/de/feschber/LanMouse/icons").
+    -->
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/actions/edit-copy-symbolic.svg">icons/scalable/actions/edit-copy-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/actions/edit-delete-symbolic.svg">icons/scalable/actions/edit-delete-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/actions/emblem-ok-symbolic.svg">icons/scalable/actions/emblem-ok-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/actions/list-add-symbolic.svg">icons/scalable/actions/list-add-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/actions/object-rotate-right-symbolic.svg">icons/scalable/actions/object-rotate-right-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/actions/object-select-symbolic.svg">icons/scalable/actions/object-select-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/actions/open-menu-symbolic.svg">icons/scalable/actions/open-menu-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/actions/process-stop-symbolic.svg">icons/scalable/actions/process-stop-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/devices/auth-fingerprint-symbolic.svg">icons/scalable/devices/auth-fingerprint-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/devices/network-wired-symbolic.svg">icons/scalable/devices/network-wired-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/places/user-trash-symbolic.svg">icons/scalable/places/user-trash-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/status/dialog-warning-symbolic.svg">icons/scalable/status/dialog-warning-symbolic.svg</file>
+    <file compressed="true" preprocess="xml-stripblanks" alias="scalable/status/network-wired-disconnected-symbolic.svg">icons/scalable/status/network-wired-disconnected-symbolic.svg</file>
   </gresource>
 </gresources>

lan-mouse-gtk/resources/window.ui

@@ -63,7 +63,7 @@
                                 <signal name="clicked" handler="handle_capture" swapped="true"/>
                                 <property name="valign">center</property>
                                 <style>
-                                  <class name="circular"/>
+                                  <class name="pill"/>
                                   <class name="flat"/>
                                 </style>
                               </object>
@@ -89,7 +89,7 @@
                                 <property name="valign">center</property>
                                 <signal name="clicked" handler="handle_emulation" swapped="true"/>
                                 <style>
-                                  <class name="circular"/>
+                                  <class name="pill"/>
                                   <class name="flat"/>
                                 </style>
                               </object>

lan-mouse-gtk/src/authorization_window.rs

@@ -0,0 +1,19 @@
+mod imp;
+
+use glib::Object;
+use gtk::{gio, glib, subclass::prelude::ObjectSubclassIsExt};
+
+glib::wrapper! {
+    pub struct AuthorizationWindow(ObjectSubclass<imp::AuthorizationWindow>)
+    @extends adw::Window, gtk::Window, gtk::Widget,
+    @implements gio::ActionGroup, gio::ActionMap, gtk::Accessible, gtk::Buildable,
+                gtk::ConstraintTarget, gtk::Native, gtk::Root, gtk::ShortcutManager;
+}
+
+impl AuthorizationWindow {
+    pub(crate) fn new(fingerprint: &str) -> Self {
+        let window: Self = Object::builder().build();
+        window.imp().set_fingerprint(fingerprint);
+        window
+    }
+}

lan-mouse-gtk/src/authorization_window/imp.rs

@@ -0,0 +1,76 @@
+use std::sync::OnceLock;
+
+use adw::prelude::*;
+use adw::subclass::prelude::*;
+use glib::subclass::InitializingObject;
+use gtk::{
+    Button, CompositeTemplate, Label,
+    glib::{self, subclass::Signal},
+    template_callbacks,
+};
+
+#[derive(CompositeTemplate, Default)]
+#[template(resource = "/de/feschber/LanMouse/authorization_window.ui")]
+pub struct AuthorizationWindow {
+    #[template_child]
+    pub fingerprint: TemplateChild<Label>,
+    #[template_child]
+    pub cancel_button: TemplateChild<Button>,
+    #[template_child]
+    pub confirm_button: TemplateChild<Button>,
+}
+
+#[glib::object_subclass]
+impl ObjectSubclass for AuthorizationWindow {
+    const NAME: &'static str = "AuthorizationWindow";
+    const ABSTRACT: bool = false;
+
+    type Type = super::AuthorizationWindow;
+    type ParentType = adw::Window;
+
+    fn class_init(klass: &mut Self::Class) {
+        klass.bind_template();
+        klass.bind_template_callbacks();
+    }
+
+    fn instance_init(obj: &InitializingObject<Self>) {
+        obj.init_template();
+    }
+}
+
+#[template_callbacks]
+impl AuthorizationWindow {
+    #[template_callback]
+    fn handle_confirm(&self, _button: Button) {
+        let fp = self.fingerprint.text().as_str().trim().to_owned();
+        self.obj().emit_by_name("confirm-clicked", &[&fp])
+    }
+
+    #[template_callback]
+    fn handle_cancel(&self, _: Button) {
+        self.obj().emit_by_name("cancel-clicked", &[])
+    }
+
+    pub(super) fn set_fingerprint(&self, fingerprint: &str) {
+        self.fingerprint.set_text(fingerprint);
+    }
+}
+
+impl ObjectImpl for AuthorizationWindow {
+    fn signals() -> &'static [Signal] {
+        static SIGNALS: OnceLock<Vec<Signal>> = OnceLock::new();
+        SIGNALS.get_or_init(|| {
+            vec![
+                Signal::builder("confirm-clicked")
+                    .param_types([String::static_type()])
+                    .build(),
+                Signal::builder("cancel-clicked").build(),
+            ]
+        })
+    }
+}
+
+impl WidgetImpl for AuthorizationWindow {}
+impl WindowImpl for AuthorizationWindow {}
+impl ApplicationWindowImpl for AuthorizationWindow {}
+impl AdwWindowImpl for AuthorizationWindow {}

lan-mouse-gtk/src/client_row.rs

@@ -4,7 +4,7 @@ use adw::prelude::*;
 use adw::subclass::prelude::*;
 use gtk::glib::{self, Object};
 
-use lan_mouse_ipc::{Position, DEFAULT_PORT};
+use lan_mouse_ipc::{DEFAULT_PORT, Position};
 
 use super::ClientObject;
 

lan-mouse-gtk/src/client_row/imp.rs

@@ -1,11 +1,11 @@
 use std::cell::RefCell;
 
 use adw::subclass::prelude::*;
-use adw::{prelude::*, ActionRow, ComboRow};
-use glib::{subclass::InitializingObject, Binding};
+use adw::{ActionRow, ComboRow, prelude::*};
+use glib::{Binding, subclass::InitializingObject};
 use gtk::glib::subclass::Signal;
-use gtk::glib::{clone, SignalHandlerId};
-use gtk::{glib, Button, CompositeTemplate, Entry, Switch};
+use gtk::glib::{SignalHandlerId, clone};
+use gtk::{Button, CompositeTemplate, Entry, Switch, glib};
 use lan_mouse_ipc::Position;
 use std::sync::OnceLock;
 

lan-mouse-gtk/src/fingerprint_window.rs

@@ -1,7 +1,7 @@
 mod imp;
 
 use glib::Object;
-use gtk::{gio, glib};
+use gtk::{gio, glib, prelude::ObjectExt, subclass::prelude::ObjectSubclassIsExt};
 
 glib::wrapper! {
     pub struct FingerprintWindow(ObjectSubclass<imp::FingerprintWindow>)
@@ -11,8 +11,12 @@ glib::wrapper! {
 }
 
 impl FingerprintWindow {
-    pub(crate) fn new() -> Self {
+    pub(crate) fn new(fingerprint: Option<String>) -> Self {
         let window: Self = Object::builder().build();
+        if let Some(fp) = fingerprint {
+            window.imp().fingerprint.set_property("text", fp);
+            window.imp().fingerprint.set_property("editable", false);
+        }
         window
     }
 }

lan-mouse-gtk/src/fingerprint_window/imp.rs

@@ -4,8 +4,9 @@ use adw::prelude::*;
 use adw::subclass::prelude::*;
 use glib::subclass::InitializingObject;
 use gtk::{
+    Button, CompositeTemplate, Text,
     glib::{self, subclass::Signal},
-    template_callbacks, Button, CompositeTemplate, Text,
+    template_callbacks,
 };
 
 #[derive(CompositeTemplate, Default)]
@@ -51,9 +52,11 @@ impl ObjectImpl for FingerprintWindow {
     fn signals() -> &'static [Signal] {
         static SIGNALS: OnceLock<Vec<Signal>> = OnceLock::new();
         SIGNALS.get_or_init(|| {
-            vec![Signal::builder("confirm-clicked")
-                .param_types([String::static_type(), String::static_type()])
-                .build()]
+            vec![
+                Signal::builder("confirm-clicked")
+                    .param_types([String::static_type(), String::static_type()])
+                    .build(),
+            ]
         })
     }
 }

lan-mouse-gtk/src/key_row.rs

@@ -8,7 +8,7 @@ use super::KeyObject;
 
 glib::wrapper! {
     pub struct KeyRow(ObjectSubclass<imp::KeyRow>)
-    @extends gtk::ListBoxRow, gtk::Widget, adw::PreferencesRow, adw::ExpanderRow,
+    @extends gtk::ListBoxRow, gtk::Widget, adw::PreferencesRow, adw::ActionRow,
     @implements gtk::Accessible, gtk::Actionable, gtk::Buildable, gtk::ConstraintTarget;
 }
 

lan-mouse-gtk/src/key_row/imp.rs

@@ -1,11 +1,11 @@
 use std::cell::RefCell;
 
 use adw::subclass::prelude::*;
-use adw::{prelude::*, ActionRow};
-use glib::{subclass::InitializingObject, Binding};
+use adw::{ActionRow, prelude::*};
+use glib::{Binding, subclass::InitializingObject};
 use gtk::glib::clone;
 use gtk::glib::subclass::Signal;
-use gtk::{glib, Button, CompositeTemplate};
+use gtk::{Button, CompositeTemplate, glib};
 use std::sync::OnceLock;
 
 #[derive(CompositeTemplate, Default)]

lan-mouse-gtk/src/lib.rs

@@ -1,8 +1,13 @@
+mod authorization_window;
 mod client_object;
 mod client_row;
 mod fingerprint_window;
 mod key_object;
 mod key_row;
+#[cfg(target_os = "macos")]
+mod macos_privacy;
+#[cfg(target_os = "macos")]
+mod macos_status_item;
 mod window;
 
 use std::{env, process, str};
@@ -12,13 +17,21 @@ use window::Window;
 use lan_mouse_ipc::FrontendEvent;
 
 use adw::Application;
-use gtk::{gdk::Display, glib::clone, prelude::*, IconTheme};
+use gtk::{IconTheme, gdk::Display, glib::clone, prelude::*};
 use gtk::{gio, glib, prelude::ApplicationExt};
 
 use self::client_object::ClientObject;
 use self::key_object::KeyObject;
 
-pub fn run() -> glib::ExitCode {
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum GtkError {
+    #[error("gtk frontend exited with non zero exit code: {0}")]
+    NonZeroExitCode(i32),
+}
+
+pub fn run() -> Result<(), GtkError> {
     log::debug!("running gtk frontend");
     #[cfg(windows)]
     let ret = std::thread::Builder::new()
@@ -31,16 +44,19 @@ pub fn run() -> glib::ExitCode {
     #[cfg(not(windows))]
     let ret = gtk_main();
 
-    if ret == glib::ExitCode::FAILURE {
-        log::error!("frontend exited with failure");
-    } else {
-        log::info!("frontend exited successfully");
+    match ret {
+        glib::ExitCode::SUCCESS => Ok(()),
+        e => Err(GtkError::NonZeroExitCode(e.value())),
     }
-
-    ret
 }
 
 fn gtk_main() -> glib::ExitCode {
+    #[cfg(target_os = "macos")]
+    {
+        configure_macos_bundle_environment();
+        install_macos_gtk_log_filter();
+    }
+
     gio::resources_register_include!("lan-mouse.gresource").expect("Failed to register resources.");
 
     let app = Application::builder()
@@ -58,6 +74,64 @@ fn gtk_main() -> glib::ExitCode {
     app.run_with_args(&args)
 }
 
+#[cfg(target_os = "macos")]
+fn install_macos_gtk_log_filter() {
+    glib::log_set_writer_func(|level, fields| {
+        if level == glib::LogLevel::Warning && is_gtk_theme_parser_warning(fields) {
+            return glib::LogWriterOutput::Handled;
+        }
+
+        glib::log_writer_default(level, fields)
+    });
+}
+
+#[cfg(target_os = "macos")]
+fn is_gtk_theme_parser_warning(fields: &[glib::LogField<'_>]) -> bool {
+    let mut domain = None;
+    let mut message = None;
+
+    for field in fields {
+        match field.key() {
+            "GLIB_DOMAIN" => domain = field.value_str(),
+            "MESSAGE" => message = field.value_str(),
+            _ => {}
+        }
+    }
+
+    domain == Some("Gtk")
+        && message.is_some_and(|message| message.starts_with("Theme parser warning: gtk.css:"))
+}
+
+#[cfg(target_os = "macos")]
+fn configure_macos_bundle_environment() {
+    let Ok(exe) = env::current_exe() else {
+        return;
+    };
+    let Some(contents) = exe
+        .parent()
+        .and_then(|dir| dir.parent())
+        .map(std::path::Path::to_owned)
+    else {
+        return;
+    };
+
+    let share = contents.join("Resources").join("share");
+    if !share.exists() {
+        return;
+    }
+
+    let schemas = share.join("glib-2.0").join("schemas");
+    if schemas.exists() {
+        env::set_var("GSETTINGS_SCHEMA_DIR", schemas);
+    }
+
+    env::set_var("XDG_DATA_DIRS", &share);
+    env::set_var(
+        "GTK_DATA_PREFIX",
+        contents.join("Resources").to_string_lossy().as_ref(),
+    );
+}
+
 fn load_icons() {
     let display = &Display::default().expect("Could not connect to a display.");
     let icon_theme = IconTheme::for_display(display);
@@ -117,6 +191,41 @@ fn build_ui(app: &Application) {
     });
 
     let window = Window::new(app, frontend_tx);
+    #[cfg(target_os = "macos")]
+    {
+        window.connect_close_request(|window| {
+            window.set_visible(false);
+            glib::Propagation::Stop
+        });
+        macos_status_item::setup(app, &window);
+        // First-launch TCC prompts. No-op when already granted.
+        macos_privacy::fire_initial_prompts();
+        // Watch the Accessibility grant continuously for the lifetime
+        // of the process. On a grant, swap the warning row into its
+        // "relaunch required" state (the daemon subprocess already
+        // bailed and can't recover without a restart). On a REVOKE,
+        // quit immediately — an active CGEventTap at
+        // HeadInsertEventTap can wedge system input if the process
+        // lingers after losing AX, and forcing the process to exit is
+        // the only bulletproof way to guarantee the kernel tears the
+        // tap down.
+        let window_weak = window.downgrade();
+        let app_weak = app.downgrade();
+        macos_privacy::watch_accessibility_state(move |change| match change {
+            macos_privacy::AccessibilityChange::Granted => {
+                if let Some(window) = window_weak.upgrade() {
+                    window.present();
+                    window.refresh_capture_emulation_status();
+                }
+            }
+            macos_privacy::AccessibilityChange::Revoked => {
+                log::warn!("Accessibility revoked — quitting to avoid wedging system input");
+                if let Some(app) = app_weak.upgrade() {
+                    app.quit();
+                }
+            }
+        });
+    }
 
     glib::spawn_future_local(clone!(
         #[weak]
@@ -141,8 +250,21 @@ fn build_ui(app: &Application) {
                     FrontendEvent::EmulationStatus(s) => window.set_emulation(s.into()),
                     FrontendEvent::AuthorizedUpdated(keys) => window.set_authorized_keys(keys),
                     FrontendEvent::PublicKeyFingerprint(fp) => window.set_pk_fp(&fp),
-                    FrontendEvent::IncomingConnected(_fingerprint, addr, pos) => {
-                        window.show_toast(format!("device connected: {addr} ({pos})").as_str());
+                    FrontendEvent::ConnectionAttempt { fingerprint } => {
+                        window.request_authorization(&fingerprint);
+                    }
+                    FrontendEvent::DeviceConnected {
+                        fingerprint: _,
+                        addr,
+                    } => {
+                        window.show_toast(format!("device connected: {addr}").as_str());
+                    }
+                    FrontendEvent::DeviceEntered {
+                        fingerprint: _,
+                        addr,
+                        pos,
+                    } => {
+                        window.show_toast(format!("device entered: {addr} ({pos})").as_str());
                     }
                     FrontendEvent::IncomingDisconnected(addr) => {
                         window.show_toast(format!("{addr} disconnected").as_str());
@@ -152,5 +274,18 @@ fn build_ui(app: &Application) {
         }
     ));
 
+    #[cfg(not(target_os = "macos"))]
     window.present();
+
+    // On macOS, default to presenting the main window on every launch
+    // so the user gets a visible confirmation that the app is running
+    // — including the post-grant relaunch and normal Dock/Finder/`open`
+    // launches. Opt out by setting `LAN_MOUSE_HIDDEN=1` in the
+    // environment (useful for a LaunchAgent / login-item configuration
+    // where the user wants the app to come up quietly into the menu
+    // bar only, with no window on boot).
+    #[cfg(target_os = "macos")]
+    if env::var_os("LAN_MOUSE_HIDDEN").is_none() {
+        window.present();
+    }
 }

lan-mouse-gtk/src/macos_privacy.rs

@@ -0,0 +1,256 @@
+//! Tiny macOS Privacy-pane helpers used by the GUI.
+//!
+//! On macOS 13+, the Accessibility grant transitively confers the
+//! listen-only event-tap privilege that Input Monitoring gates and the
+//! synthesize-event privilege that Post Event gates, and the bundle
+//! typically isn't even listed in those separate panes. So the single
+//! user-facing action for any missing-capture or missing-emulation
+//! scenario is "re-toggle Accessibility" — we don't route elsewhere.
+
+use std::ffi::{c_uchar, c_void};
+use std::process::Command;
+use std::sync::Once;
+
+use gtk::glib;
+
+// Apple declares `AXIsProcessTrusted` as returning `Boolean` (`unsigned char`),
+// NOT C's `bool`. Rust's `bool` has a strict bit pattern (0 or 1) so binding
+// a `Boolean`-returning function as `-> bool` is technically UB if Apple ever
+// returns a non-canonical true value. Keep these as `c_uchar` and normalize.
+#[link(name = "ApplicationServices", kind = "framework")]
+extern "C" {
+    fn AXIsProcessTrusted() -> c_uchar;
+    fn AXIsProcessTrustedWithOptions(options: *const c_void) -> c_uchar;
+}
+
+#[link(name = "CoreFoundation", kind = "framework")]
+extern "C" {
+    static kCFAllocatorDefault: *const c_void;
+    static kCFTypeDictionaryKeyCallBacks: *const c_void;
+    static kCFTypeDictionaryValueCallBacks: *const c_void;
+    static kCFBooleanTrue: *const c_void;
+    fn CFDictionaryCreate(
+        allocator: *const c_void,
+        keys: *const *const c_void,
+        values: *const *const c_void,
+        num: isize,
+        key_callbacks: *const c_void,
+        value_callbacks: *const c_void,
+    ) -> *const c_void;
+    fn CFRelease(cf: *const c_void);
+}
+
+// kAXTrustedCheckOptionPrompt is a CFStringRef exported from ApplicationServices.
+#[link(name = "ApplicationServices", kind = "framework")]
+extern "C" {
+    static kAXTrustedCheckOptionPrompt: *const c_void;
+}
+
+#[link(name = "CoreGraphics", kind = "framework")]
+extern "C" {
+    fn CGRequestListenEventAccess() -> c_uchar;
+    fn CGRequestPostEventAccess() -> c_uchar;
+
+    // CFMachPortRef CGEventTapCreate(
+    //     CGEventTapLocation tap, CGEventTapPlacement place,
+    //     CGEventTapOptions options, CGEventMask eventsOfInterest,
+    //     CGEventTapCallBack callback, void *userInfo);
+    fn CGEventTapCreate(
+        tap: u32,
+        place: u32,
+        options: u32,
+        events_of_interest: u64,
+        callback: *const c_void,
+        user_info: *const c_void,
+    ) -> *const c_void;
+}
+
+pub fn accessibility_granted() -> bool {
+    let raw = unsafe { AXIsProcessTrusted() };
+    log::debug!("AXIsProcessTrusted() = {raw}");
+    raw != 0
+}
+
+pub enum AccessibilityChange {
+    /// AX was missing at startup and the user has now granted it.
+    /// Capture/emulation still need a relaunch to take effect, since
+    /// the daemon subprocess already bailed.
+    Granted,
+    /// AX was granted and the user has now revoked it. Quit immediately
+    /// — leaving the process alive with an active CGEventTap at
+    /// HeadInsertEventTap can wedge system input (clicks/keys silently
+    /// consumed) until the process dies. See
+    /// macos-cgeventtap-drop-fallthrough-tcc-revoke skill for the
+    /// underlying event-tap-disable footgun.
+    Revoked,
+}
+
+/// Poll for Accessibility grant/revoke transitions. Starts a 1-second
+/// GLib timer that fires `on_change` every time `AXIsProcessTrusted()`
+/// flips, and keeps running for the lifetime of the process.
+///
+/// We rely on polling rather than AXObserver because the AX notification
+/// API requires a trusted process to subscribe — the precondition we
+/// can't assume. This runs on the GTK main thread (via
+/// `timeout_add_seconds_local`).
+pub fn watch_accessibility_state<F>(mut on_change: F)
+where
+    F: FnMut(AccessibilityChange) + 'static,
+{
+    let mut last = accessibility_granted();
+    log::info!("watching Accessibility state (initial = {last})");
+    glib::timeout_add_seconds_local(1, move || {
+        let current = accessibility_granted();
+        if current != last {
+            log::info!("Accessibility state flip: {last} -> {current}");
+            on_change(if current {
+                AccessibilityChange::Granted
+            } else {
+                AccessibilityChange::Revoked
+            });
+            last = current;
+        }
+        glib::ControlFlow::Continue
+    });
+}
+
+pub fn open_accessibility_settings() {
+    open_url("x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility");
+}
+
+/// Spawn a fresh instance of the current `.app` bundle via Launch Services
+/// after a 1-second delay, so the new instance starts *after* the current
+/// process has exited — otherwise Launch Services reactivates the existing
+/// process instead of launching a fresh one, and the stale IPC socket
+/// would block the new daemon subprocess. The caller is responsible for
+/// quitting the current process (e.g. `Application::quit()`) after this.
+pub fn relaunch_bundle() {
+    // Resolve the .app bundle path from the current executable: it lives
+    // at <bundle>/Contents/MacOS/lan-mouse, so three parents up is the
+    // bundle root we hand to `open`.
+    let Ok(exe) = std::env::current_exe() else {
+        return;
+    };
+    let Some(bundle) = exe
+        .parent()
+        .and_then(std::path::Path::parent)
+        .and_then(std::path::Path::parent)
+    else {
+        return;
+    };
+
+    // Trailing `&` backgrounds the sleep+open so our shell call returns
+    // immediately; the spawned shell is adopted by launchd once we exit.
+    let cmd = format!("(sleep 1 && open {bundle:?}) &");
+    let _ = Command::new("sh").arg("-c").arg(cmd).spawn();
+}
+
+/// Make sure the app appears in System Settings → Privacy → Input Monitoring.
+///
+/// `CGRequestListenEventAccess()` is *supposed* to register the app in the
+/// list (and prompt) on first call, but in practice — particularly after a
+/// `tccutil reset ListenEvent <bundle>` — it often silently no-ops and the
+/// app never gets added. The reliable way to force registration is to
+/// attempt a protected action: create a `CGEventTap`. If permission is
+/// missing the call returns null, but the attempt itself causes TCC to add
+/// the bundle to the Input Monitoring pane so the user can toggle it on.
+/// If permission already exists the tap is created successfully, and we
+/// tear it down immediately so it doesn't intercept events.
+unsafe fn ensure_listed_in_input_monitoring() {
+    let req = CGRequestListenEventAccess();
+    log::debug!("CGRequestListenEventAccess() = {req}");
+    let cb = input_monitoring_noop_tap_callback as *const c_void;
+    // Use kCGSessionEventTap (1), NOT kCGHIDEventTap (0). The HID tap sits
+    // below window-server input and requires Accessibility in addition to
+    // Input Monitoring, so attempting it when Accessibility isn't granted
+    // surfaces an Accessibility prompt as a side effect — which is confusing
+    // on top of the real Accessibility prompt we already fire explicitly.
+    // The session tap requires only Input Monitoring, so its failure is a
+    // clean "Input Monitoring missing" signal that TCC uses to list the
+    // bundle under the Input Monitoring pane.
+    // kCGHeadInsertEventTap = 0, kCGEventTapOptionListenOnly = 1,
+    // mask kCGEventKeyDown = 1 << 10.
+    let tap = CGEventTapCreate(1, 0, 1, 1 << 10, cb, std::ptr::null());
+    log::debug!("CGEventTapCreate(kCGSessionEventTap) -> {tap:?}");
+    if !tap.is_null() {
+        CFRelease(tap);
+    }
+}
+
+extern "C" fn input_monitoring_noop_tap_callback(
+    _proxy: *const c_void,
+    _ty: u32,
+    event: *const c_void,
+    _refcon: *const c_void,
+) -> *const c_void {
+    // Pass through unchanged. This tap is never added to a run loop, so
+    // in practice the callback never fires — it exists only so the tap
+    // can be created (and the attempt is what forces TCC registration).
+    event
+}
+
+fn open_url(url: &str) {
+    if let Err(e) = Command::new("open").arg(url).spawn() {
+        log::warn!("failed to open {url}: {e}");
+    }
+}
+
+/// One-shot, at GUI startup: if a permission is missing, fire the system
+/// prompt. This is where the familiar first-launch "Lan Mouse.app would
+/// like to control this computer" alert comes from. Subsequent clicks on
+/// the Reenable button use URL-scheme navigation instead, so we never
+/// double up alerts on retries.
+///
+/// Guarded with a `Once` because GApplication::activate can fire more
+/// than once in a process (reactivation, window presentation) and we
+/// must not re-pop the TCC alert on each activation — that looks like a
+/// bug to the user.
+pub fn fire_initial_prompts() {
+    static FIRED: Once = Once::new();
+    FIRED.call_once(fire_initial_prompts_inner);
+}
+
+fn fire_initial_prompts_inner() {
+    if !accessibility_granted() {
+        // When Accessibility isn't granted yet, ONLY fire the Accessibility
+        // prompt. Do NOT also try to register Input Monitoring or Post Event
+        // — those paths have been observed to surface a second Accessibility
+        // dialog on top of the one we fire explicitly (Post Event is part of
+        // the Accessibility category on modern macOS, and CGEventTap attempts
+        // can bail on Accessibility before they reach the Input Monitoring
+        // check). Once the user grants Accessibility and relaunches, this
+        // branch is skipped and we register the other grants cleanly below.
+        log::info!("firing first-launch Accessibility prompt");
+        unsafe {
+            let key = kAXTrustedCheckOptionPrompt;
+            let value = kCFBooleanTrue;
+            let options = CFDictionaryCreate(
+                kCFAllocatorDefault,
+                &key as *const _,
+                &value as *const _,
+                1,
+                kCFTypeDictionaryKeyCallBacks,
+                kCFTypeDictionaryValueCallBacks,
+            );
+            AXIsProcessTrustedWithOptions(options);
+            CFRelease(options);
+        }
+        return;
+    }
+    // Accessibility is granted. Attempt Input Monitoring registration
+    // unconditionally — even if preflight returns true — so the bundle gets
+    // listed in System Settings under its own identity (otherwise launches
+    // from a parent process that already has Input Monitoring, e.g. Terminal,
+    // inherit the grant but the bundle is never listed for the user to
+    // toggle persistently).
+    log::info!("ensuring Lan Mouse is listed under Input Monitoring");
+    unsafe {
+        ensure_listed_in_input_monitoring();
+    }
+    // Same for Post Event: now that Accessibility is present, this call is
+    // safe — it won't surface the generic Accessibility prompt.
+    log::info!("ensuring Lan Mouse is listed under Accessibility > Post Event");
+    unsafe {
+        CGRequestPostEventAccess();
+    }
+}

lan-mouse-gtk/src/macos_status_item.rs

@@ -0,0 +1,346 @@
+#![allow(clashing_extern_declarations)]
+
+use std::{
+    cell::RefCell,
+    ffi::{CStr, CString, c_char, c_double, c_uint, c_void},
+    sync::OnceLock,
+};
+
+use adw::prelude::*;
+use gtk::{gio, glib};
+
+use crate::window::Window;
+
+type Id = *mut c_void;
+type Class = *mut c_void;
+type Sel = *mut c_void;
+type Bool = i8;
+
+struct StatusItem {
+    app: glib::WeakRef<adw::Application>,
+    window: glib::WeakRef<Window>,
+    _hold: gio::ApplicationHoldGuard,
+    _delegate: Id,
+    _status_item: Id,
+}
+
+thread_local! {
+    static STATUS_ITEM: RefCell<Option<StatusItem>> = const { RefCell::new(None) };
+}
+
+pub fn setup(app: &adw::Application, window: &Window) {
+    log::debug!("macos_status_item::setup entered");
+    STATUS_ITEM.with(|item| {
+        let already_initialized = item.borrow().is_some();
+        if already_initialized {
+            let mut cell = item.borrow_mut();
+            if let Some(existing) = cell.as_mut() {
+                existing.app.set(Some(app));
+                existing.window.set(Some(window));
+            }
+            return;
+        }
+
+        unsafe {
+            let hold = app.hold();
+
+            let ns_app = msg_send_id(class(c"NSApplication"), sel(c"sharedApplication"));
+            assert!(
+                !ns_app.is_null(),
+                "NSApplication sharedApplication returned null"
+            );
+            msg_send_bool_usize(ns_app, sel(c"setActivationPolicy:"), 1);
+
+            let delegate = new_delegate();
+            let menu = menu(&[
+                menu_item(c"Open Lan Mouse", c"showLanMouse:"),
+                separator_item(),
+                menu_item(c"Quit Lan Mouse", c"quitLanMouse:"),
+            ]);
+
+            let status_bar = msg_send_id(class(c"NSStatusBar"), sel(c"systemStatusBar"));
+            assert!(
+                !status_bar.is_null(),
+                "NSStatusBar systemStatusBar returned null"
+            );
+            let status_item = msg_send_id_f64(status_bar, sel(c"statusItemWithLength:"), -1.0);
+            assert!(!status_item.is_null(), "statusItemWithLength returned null");
+            // Retain so the status item survives autorelease pool drain.
+            let status_item = msg_send_id(status_item, sel(c"retain"));
+
+            let button = msg_send_id(status_item, sel(c"button"));
+            assert!(!button.is_null(), "NSStatusItem.button was null");
+            set_button_image(button);
+            msg_send_void_id(button, sel(c"setToolTip:"), nsstring(c"Lan Mouse"));
+            msg_send_void_id(status_item, sel(c"setMenu:"), menu);
+
+            for item in menu_items(menu) {
+                msg_send_void_id(item, sel(c"setTarget:"), delegate);
+            }
+
+            install_reopen_handler(delegate);
+
+            log::debug!("macos_status_item ready at {status_item:p}");
+
+            item.replace(Some(StatusItem {
+                app: app.downgrade(),
+                window: window.downgrade(),
+                _hold: hold,
+                _delegate: delegate,
+                _status_item: status_item,
+            }));
+        }
+    });
+}
+
+// Prefer a pre-rendered template PNG (black silhouette with alpha) so macOS
+// auto-tints the glyph to match the menu bar in light and dark modes.
+// Falls back to the full-color icns, then to "LM" text.
+unsafe fn set_button_image(button: Id) {
+    if let Some(image) = load_menubar_template() {
+        msg_send_void_bool(image, sel(c"setTemplate:"), 1);
+        msg_send_void_id(button, sel(c"setImage:"), image);
+        return;
+    }
+    if let Some(image) = load_app_icon() {
+        msg_send_void_id(button, sel(c"setImage:"), image);
+        return;
+    }
+    log::warn!("no menu bar image available; falling back to text title");
+    msg_send_void_id(button, sel(c"setTitle:"), nsstring(c"LM"));
+}
+
+unsafe fn load_menubar_template() -> Option<Id> {
+    load_resource_image(c"menubar-template", c"png", MENUBAR_ICON_SIZE)
+}
+
+unsafe fn load_app_icon() -> Option<Id> {
+    load_resource_image(c"icon", c"icns", MENUBAR_ICON_SIZE)
+}
+
+unsafe fn load_resource_image(name: &CStr, ext: &CStr, size_pt: c_double) -> Option<Id> {
+    let bundle = msg_send_id(class(c"NSBundle"), sel(c"mainBundle"));
+    if bundle.is_null() {
+        return None;
+    }
+    let path = msg_send_id_id_id(
+        bundle,
+        sel(c"pathForResource:ofType:"),
+        nsstring(name),
+        nsstring(ext),
+    );
+    if path.is_null() {
+        return None;
+    }
+    let image = msg_send_id_id(
+        msg_send_id(class(c"NSImage"), sel(c"alloc")),
+        sel(c"initWithContentsOfFile:"),
+        path,
+    );
+    if image.is_null() {
+        return None;
+    }
+    // Render at menu bar height; 22pt is the full status bar icon height.
+    msg_send_void_size(image, sel(c"setSize:"), size_pt, size_pt);
+    Some(image)
+}
+
+const MENUBAR_ICON_SIZE: c_double = 22.0;
+
+unsafe fn menu(items: &[Id]) -> Id {
+    let menu = msg_send_id(msg_send_id(class(c"NSMenu"), sel(c"alloc")), sel(c"init"));
+    for item in items {
+        msg_send_void_id(menu, sel(c"addItem:"), *item);
+    }
+    menu
+}
+
+unsafe fn menu_item(title: &CStr, action: &CStr) -> Id {
+    msg_send_id_id_sel_id(
+        msg_send_id(class(c"NSMenuItem"), sel(c"alloc")),
+        sel(c"initWithTitle:action:keyEquivalent:"),
+        nsstring(title),
+        sel(action),
+        nsstring(c""),
+    )
+}
+
+unsafe fn separator_item() -> Id {
+    msg_send_id(class(c"NSMenuItem"), sel(c"separatorItem"))
+}
+
+unsafe fn menu_items(menu: Id) -> Vec<Id> {
+    let count = msg_send_usize(menu, sel(c"numberOfItems"));
+    (0..count)
+        .map(|idx| msg_send_id_usize(menu, sel(c"itemAtIndex:"), idx))
+        .collect()
+}
+
+unsafe fn new_delegate() -> Id {
+    let class = delegate_class();
+    msg_send_id(msg_send_id(class, sel(c"alloc")), sel(c"init"))
+}
+
+fn delegate_class() -> Class {
+    static CLASS: OnceLock<usize> = OnceLock::new();
+
+    *CLASS.get_or_init(|| unsafe {
+        let superclass = class(c"NSObject");
+        let class_name = CString::new("LanMouseStatusItemDelegate").unwrap();
+        let class = objc_allocateClassPair(superclass, class_name.as_ptr(), 0);
+        assert!(!class.is_null(), "failed to allocate status item delegate");
+
+        class_addMethod(
+            class,
+            sel(c"showLanMouse:"),
+            show_lan_mouse as *const c_void,
+            c"v@:@".as_ptr(),
+        );
+        class_addMethod(
+            class,
+            sel(c"quitLanMouse:"),
+            quit_lan_mouse as *const c_void,
+            c"v@:@".as_ptr(),
+        );
+        // kAEReopenApplication handler — fires when the user re-launches
+        // the .app while it's already running (Finder, `open`, Dock).
+        class_addMethod(
+            class,
+            sel(c"handleReopenEvent:withReplyEvent:"),
+            handle_reopen_event as *const c_void,
+            c"v@:@@".as_ptr(),
+        );
+        objc_registerClassPair(class);
+        class as usize
+    }) as Class
+}
+
+extern "C" fn show_lan_mouse(_this: Id, _cmd: Sel, _sender: Id) {
+    present_window();
+}
+
+extern "C" fn handle_reopen_event(_this: Id, _cmd: Sel, _event: Id, _reply: Id) {
+    log::debug!("kAEReopenApplication received — presenting main window");
+    present_window();
+}
+
+fn present_window() {
+    STATUS_ITEM.with(|item| {
+        let item = item.borrow();
+        let Some(item) = item.as_ref() else {
+            return;
+        };
+        if let Some(window) = item.window.upgrade() {
+            window.present();
+        }
+
+        unsafe {
+            let ns_app = msg_send_id(class(c"NSApplication"), sel(c"sharedApplication"));
+            msg_send_void_bool(ns_app, sel(c"activateIgnoringOtherApps:"), 1);
+        }
+    });
+}
+
+// Register the status-item delegate as the handler for the
+// kAEReopenApplication Apple Event ('aevt'/'rapp'). NSApplication
+// installs a default handler at -finishLaunching that just delegates to
+// applicationShouldHandleReopen:hasVisibleWindows: — which is a no-op
+// here because GApplication owns NSApp's delegate. Replacing it lets us
+// re-present the window when the user double-clicks the .app while
+// we're already running.
+unsafe fn install_reopen_handler(delegate: Id) {
+    const K_CORE_EVENT_CLASS: c_uint = 0x6165_7674; // 'aevt'
+    const K_AE_REOPEN_APPLICATION: c_uint = 0x7261_7070; // 'rapp'
+
+    let manager = msg_send_id(
+        class(c"NSAppleEventManager"),
+        sel(c"sharedAppleEventManager"),
+    );
+    if manager.is_null() {
+        log::warn!("NSAppleEventManager unavailable; re-launch will not re-open window");
+        return;
+    }
+    msg_send_void_id_sel_u32_u32(
+        manager,
+        sel(c"setEventHandler:andSelector:forEventClass:andEventID:"),
+        delegate,
+        sel(c"handleReopenEvent:withReplyEvent:"),
+        K_CORE_EVENT_CLASS,
+        K_AE_REOPEN_APPLICATION,
+    );
+}
+
+extern "C" fn quit_lan_mouse(_this: Id, _cmd: Sel, _sender: Id) {
+    STATUS_ITEM.with(|item| {
+        if let Some(app) = item.borrow().as_ref().and_then(|item| item.app.upgrade()) {
+            app.quit();
+        }
+    });
+}
+
+unsafe fn class(name: &CStr) -> Class {
+    let class = objc_getClass(name.as_ptr());
+    assert!(!class.is_null(), "missing Objective-C class {name:?}");
+    class
+}
+
+unsafe fn sel(name: &CStr) -> Sel {
+    sel_registerName(name.as_ptr())
+}
+
+unsafe fn nsstring(value: &CStr) -> Id {
+    msg_send_id_ptr(
+        class(c"NSString"),
+        sel(c"stringWithUTF8String:"),
+        value.as_ptr(),
+    )
+}
+
+#[link(name = "objc")]
+extern "C" {
+    fn objc_allocateClassPair(superclass: Class, name: *const c_char, extra_bytes: usize) -> Class;
+    fn objc_getClass(name: *const c_char) -> Class;
+    fn objc_registerClassPair(class: Class);
+    fn sel_registerName(name: *const c_char) -> Sel;
+    fn class_addMethod(class: Class, name: Sel, imp: *const c_void, types: *const c_char) -> Bool;
+}
+
+#[link(name = "AppKit", kind = "framework")]
+extern "C" {}
+
+#[link(name = "objc")]
+extern "C" {
+    #[link_name = "objc_msgSend"]
+    fn msg_send_id(receiver: Id, selector: Sel) -> Id;
+    #[link_name = "objc_msgSend"]
+    fn msg_send_id_f64(receiver: Id, selector: Sel, value: c_double) -> Id;
+    #[link_name = "objc_msgSend"]
+    fn msg_send_id_id_sel_id(receiver: Id, selector: Sel, a: Id, b: Sel, c: Id) -> Id;
+    #[link_name = "objc_msgSend"]
+    fn msg_send_id_id_id(receiver: Id, selector: Sel, a: Id, b: Id) -> Id;
+    #[link_name = "objc_msgSend"]
+    fn msg_send_id_id(receiver: Id, selector: Sel, a: Id) -> Id;
+    #[link_name = "objc_msgSend"]
+    fn msg_send_void_size(receiver: Id, selector: Sel, width: c_double, height: c_double);
+    #[link_name = "objc_msgSend"]
+    fn msg_send_id_ptr(receiver: Id, selector: Sel, value: *const c_char) -> Id;
+    #[link_name = "objc_msgSend"]
+    fn msg_send_id_usize(receiver: Id, selector: Sel, value: usize) -> Id;
+    #[link_name = "objc_msgSend"]
+    fn msg_send_usize(receiver: Id, selector: Sel) -> usize;
+    #[link_name = "objc_msgSend"]
+    fn msg_send_void_bool(receiver: Id, selector: Sel, value: Bool);
+    #[link_name = "objc_msgSend"]
+    fn msg_send_void_id(receiver: Id, selector: Sel, value: Id);
+    #[link_name = "objc_msgSend"]
+    fn msg_send_bool_usize(receiver: Id, selector: Sel, value: usize) -> Bool;
+    #[link_name = "objc_msgSend"]
+    fn msg_send_void_id_sel_u32_u32(
+        receiver: Id,
+        selector: Sel,
+        a: Id,
+        b: Sel,
+        c: c_uint,
+        d: c_uint,
+    );
+}

lan-mouse-gtk/src/window.rs

@@ -4,22 +4,35 @@ use std::collections::HashMap;
 
 use adw::prelude::*;
 use adw::subclass::prelude::*;
-use glib::{clone, Object};
+use glib::{Object, clone};
 use gtk::{
-    gio,
+    NoSelection, gio,
     glib::{self, closure_local},
-    NoSelection,
 };
 
 use lan_mouse_ipc::{
-    ClientConfig, ClientHandle, ClientState, FrontendRequest, FrontendRequestWriter, Position,
-    DEFAULT_PORT,
+    ClientConfig, ClientHandle, ClientState, DEFAULT_PORT, FrontendRequest, FrontendRequestWriter,
+    Position,
 };
 
-use crate::{fingerprint_window::FingerprintWindow, key_object::KeyObject, key_row::KeyRow};
+use crate::{
+    authorization_window::AuthorizationWindow, fingerprint_window::FingerprintWindow,
+    key_object::KeyObject, key_row::KeyRow,
+};
 
 use super::{client_object::ClientObject, client_row::ClientRow};
 
+#[cfg(target_os = "macos")]
+fn set_button_content_label(button: &gtk::Button, label: &str) {
+    // The Reenable/Grant/Relaunch button wraps its icon+label in an
+    // AdwButtonContent (see window.ui). Walk into it and swap the label
+    // rather than GtkButton::set_label, which would replace the content
+    // widget and drop the icon.
+    if let Some(content) = button.child().and_downcast::<adw::ButtonContent>() {
+        content.set_label(label);
+    }
+}
+
 glib::wrapper! {
     pub struct Window(ObjectSubclass<imp::Window>)
         @extends adw::ApplicationWindow, gtk::Window, gtk::Widget,
@@ -126,7 +139,7 @@ impl Window {
                             #[strong]
                             window,
                             move |row: ClientRow, hostname: String| {
-                                log::info!("request-hostname-change");
+                                log::debug!("request-hostname-change");
                                 if let Some(client) = window.client_by_idx(row.index() as u32) {
                                     let hostname = Some(hostname).filter(|s| !s.is_empty());
                                     /* changed in response to FrontendEvent
@@ -163,7 +176,7 @@ impl Window {
                             window,
                             move |row: ClientRow, active: bool| {
                                 if let Some(client) = window.client_by_idx(row.index() as u32) {
-                                    log::info!(
+                                    log::debug!(
                                         "request: {} client",
                                         if active { "activating" } else { "deactivating" }
                                     );
@@ -321,7 +334,7 @@ impl Window {
 
     pub(super) fn update_client_config(&self, handle: ClientHandle, client: ClientConfig) {
         let Some(row) = self.row_for_handle(handle) else {
-            log::warn!("could not find row for handle {}", handle);
+            log::warn!("could not find row for handle {handle}");
             return;
         };
         row.set_hostname(client.hostname);
@@ -331,11 +344,11 @@ impl Window {
 
     pub(super) fn update_client_state(&self, handle: ClientHandle, state: ClientState) {
         let Some(row) = self.row_for_handle(handle) else {
-            log::warn!("could not find row for handle {}", handle);
+            log::warn!("could not find row for handle {handle}");
             return;
         };
         let Some(client_object) = self.client_object_for_handle(handle) else {
-            log::warn!("could not find row for handle {}", handle);
+            log::warn!("could not find row for handle {handle}");
             return;
         };
 
@@ -394,8 +407,8 @@ impl Window {
         self.request(FrontendRequest::Create);
     }
 
-    fn open_fingerprint_dialog(&self) {
-        let window = FingerprintWindow::new();
+    fn open_fingerprint_dialog(&self, fp: Option<String>) {
+        let window = FingerprintWindow::new(fp);
         window.set_transient_for(Some(self));
         window.connect_closure(
             "confirm-clicked",
@@ -430,6 +443,10 @@ impl Window {
 
     pub(super) fn show_toast(&self, msg: &str) {
         let toast = adw::Toast::new(msg);
+        self.add_toast(toast);
+    }
+
+    pub(super) fn add_toast(&self, toast: adw::Toast) {
         let toast_overlay = &self.imp().toast_overlay;
         toast_overlay.add_toast(toast);
     }
@@ -444,14 +461,61 @@ impl Window {
         self.update_capture_emulation_status();
     }
 
+    #[cfg(target_os = "macos")]
+    pub(super) fn refresh_capture_emulation_status(&self) {
+        self.update_capture_emulation_status();
+    }
+
     fn update_capture_emulation_status(&self) {
         let capture = self.imp().capture_active.get();
         let emulation = self.imp().emulation_active.get();
-        self.imp().capture_status_row.set_visible(!capture);
-        self.imp().emulation_status_row.set_visible(!emulation);
-        self.imp()
-            .capture_emulation_group
-            .set_visible(!capture || !emulation);
+
+        #[cfg(target_os = "macos")]
+        {
+            // On macOS, capture and emulation share the same TCC gate
+            // (Accessibility). Collapse to a single warning row —
+            // emulation_status_row stays hidden and capture_status_row
+            // doubles as the shared status indicator. Its text and
+            // button mutate based on whether we're waiting for AX or
+            // waiting for the user to relaunch the app.
+            let anything_off = !capture || !emulation;
+            self.imp().emulation_status_row.set_visible(false);
+            self.imp().capture_status_row.set_visible(anything_off);
+            self.imp().capture_emulation_group.set_visible(anything_off);
+
+            if anything_off {
+                self.update_macos_warning_row_text();
+            }
+        }
+
+        #[cfg(not(target_os = "macos"))]
+        {
+            self.imp().capture_status_row.set_visible(!capture);
+            self.imp().emulation_status_row.set_visible(!emulation);
+            self.imp()
+                .capture_emulation_group
+                .set_visible(!capture || !emulation);
+        }
+    }
+
+    #[cfg(target_os = "macos")]
+    fn update_macos_warning_row_text(&self) {
+        let row = &self.imp().capture_status_row;
+        let button = &self.imp().input_capture_button;
+
+        if crate::macos_privacy::accessibility_granted() {
+            // AX granted but capture/emulation still off → the daemon
+            // subprocess bailed at startup and needs a fresh process to
+            // re-initialize with the new grant in place.
+            row.set_title("relaunch required");
+            row.set_subtitle("Accessibility granted — restart to activate capture and emulation");
+            set_button_content_label(button, "Relaunch");
+        } else {
+            // AX missing → send the user to System Settings.
+            row.set_title("input capture is disabled");
+            row.set_subtitle("grant Accessibility permission to enable");
+            set_button_content_label(button, "Grant");
+        }
     }
 
     pub(super) fn set_authorized_keys(&self, fingerprints: HashMap<String, String>) {
@@ -469,4 +533,33 @@ impl Window {
     pub(super) fn set_pk_fp(&self, fingerprint: &str) {
         self.imp().fingerprint_row.set_subtitle(fingerprint);
     }
+
+    pub(super) fn request_authorization(&self, fingerprint: &str) {
+        if let Some(w) = self.imp().authorization_window.borrow_mut().take() {
+            w.close();
+        }
+        let window = AuthorizationWindow::new(fingerprint);
+        window.set_transient_for(Some(self));
+        window.connect_closure(
+            "confirm-clicked",
+            false,
+            closure_local!(
+                #[strong(rename_to = parent)]
+                self,
+                move |w: AuthorizationWindow, fp: String| {
+                    w.close();
+                    parent.open_fingerprint_dialog(Some(fp));
+                }
+            ),
+        );
+        window.connect_closure(
+            "cancel-clicked",
+            false,
+            closure_local!(move |w: AuthorizationWindow| {
+                w.close();
+            }),
+        );
+        window.present();
+        self.imp().authorization_window.replace(Some(window));
+    }
 }

lan-mouse-gtk/src/window/imp.rs

@@ -1,12 +1,14 @@
 use std::cell::{Cell, RefCell};
 
 use adw::subclass::prelude::*;
-use adw::{prelude::*, ActionRow, PreferencesGroup, ToastOverlay};
+use adw::{ActionRow, PreferencesGroup, ToastOverlay, prelude::*};
 use glib::subclass::InitializingObject;
 use gtk::glib::clone;
-use gtk::{gdk, gio, glib, Button, CompositeTemplate, Entry, Image, Label, ListBox};
+use gtk::{Button, CompositeTemplate, Entry, Image, Label, ListBox, gdk, gio, glib};
 
-use lan_mouse_ipc::{FrontendRequestWriter, DEFAULT_PORT};
+use lan_mouse_ipc::{DEFAULT_PORT, FrontendRequestWriter};
+
+use crate::authorization_window::AuthorizationWindow;
 
 #[derive(CompositeTemplate, Default)]
 #[template(resource = "/de/feschber/LanMouse/window.ui")]
@@ -49,6 +51,7 @@ pub struct Window {
     pub port: Cell<u16>,
     pub capture_active: Cell<bool>,
     pub emulation_active: Cell<bool>,
+    pub authorization_window: RefCell<Option<AuthorizationWindow>>,
 }
 
 #[glib::object_subclass]
@@ -139,17 +142,38 @@ impl Window {
 
     #[template_callback]
     fn handle_emulation(&self) {
+        // On macOS the emulation_status_row is hidden — capture_status_row
+        // acts as the shared warning (see update_capture_emulation_status).
+        // This handler still fires for the non-macOS platforms where the
+        // emulation row is distinct.
         self.obj().request_emulation();
     }
 
     #[template_callback]
     fn handle_capture(&self) {
+        #[cfg(target_os = "macos")]
+        {
+            use crate::macos_privacy;
+            if macos_privacy::accessibility_granted() {
+                // AX granted but the row is still visible => the daemon
+                // subprocess bailed before AX was in place and needs a
+                // fresh process. Quit + relaunch via Launch Services.
+                log::info!("capture row clicked in relaunch-required state");
+                macos_privacy::relaunch_bundle();
+                if let Some(app) = self.obj().application() {
+                    app.quit();
+                }
+                return;
+            }
+            log::info!("capture row clicked in AX-missing state, opening pane");
+            macos_privacy::open_accessibility_settings();
+        }
         self.obj().request_capture();
     }
 
     #[template_callback]
     fn handle_add_cert_fingerprint(&self, _button: &Button) {
-        self.obj().open_fingerprint_dialog();
+        self.obj().open_fingerprint_dialog(None);
     }
 
     pub fn set_port(&self, port: u16) {

lan-mouse-ipc/Cargo.toml

@@ -12,5 +12,5 @@ log = "0.4.22"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.107"
 thiserror = "2.0.0"
-tokio = { version = "1.32.0", features = ["net", "io-util", "time"] }
+tokio = { version = "1.32.0", features = ["macros", "net", "io-util", "time"] }
 tokio-stream = { version = "0.1.15", features = ["io-util"] }

lan-mouse-ipc/src/connect.rs

@@ -1,7 +1,7 @@
 use crate::{ConnectionError, FrontendEvent, FrontendRequest, IpcError};
 use std::{
     cmp::min,
-    io::{self, prelude::*, BufReader, LineWriter, Lines},
+    io::{self, BufReader, LineWriter, Lines, prelude::*},
     thread,
     time::Duration,
 };

lan-mouse-ipc/src/connect_async.rs

@@ -1,8 +1,7 @@
 use crate::{ConnectionError, FrontendEvent, FrontendRequest, IpcError};
 use std::{
     cmp::min,
-    io,
-    task::{ready, Poll},
+    task::{Poll, ready},
     time::Duration,
 };
 
@@ -47,7 +46,7 @@ impl Stream for AsyncFrontendEventReader {
 }
 
 impl AsyncFrontendRequestWriter {
-    pub async fn request(&mut self, request: FrontendRequest) -> Result<(), io::Error> {
+    pub async fn request(&mut self, request: FrontendRequest) -> Result<(), IpcError> {
         let mut json = serde_json::to_string(&request).unwrap();
         log::debug!("requesting: {json}");
         json.push('\n');
@@ -57,8 +56,16 @@ impl AsyncFrontendRequestWriter {
 }
 
 pub async fn connect_async(
+    timeout: Option<Duration>,
 ) -> Result<(AsyncFrontendEventReader, AsyncFrontendRequestWriter), ConnectionError> {
-    let stream = wait_for_service().await?;
+    let stream = if let Some(duration) = timeout {
+        tokio::select! {
+            s = wait_for_service() => s?,
+            _ = tokio::time::sleep(duration) => return Err(ConnectionError::Timeout),
+        }
+    } else {
+        wait_for_service().await?
+    };
     #[cfg(unix)]
     let (rx, tx): (ReadHalf<UnixStream>, WriteHalf<UnixStream>) = tokio::io::split(stream);
     #[cfg(windows)]

lan-mouse-ipc/src/lib.rs

@@ -20,8 +20,8 @@ mod connect;
 mod connect_async;
 mod listen;
 
-pub use connect::{connect, FrontendEventReader, FrontendRequestWriter};
-pub use connect_async::{connect_async, AsyncFrontendEventReader, AsyncFrontendRequestWriter};
+pub use connect::{FrontendEventReader, FrontendRequestWriter, connect};
+pub use connect_async::{AsyncFrontendEventReader, AsyncFrontendRequestWriter, connect_async};
 pub use listen::AsyncFrontendListener;
 
 #[derive(Debug, Error)]
@@ -30,6 +30,8 @@ pub enum ConnectionError {
     SocketPath(#[from] SocketPathError),
     #[error(transparent)]
     Io(#[from] io::Error),
+    #[error("connection timed out")]
+    Timeout,
 }
 
 #[derive(Debug, Error)]
@@ -57,6 +59,7 @@ pub enum IpcError {
 pub const DEFAULT_PORT: u16 = 4242;
 
 #[derive(Debug, Default, Eq, Hash, PartialEq, Clone, Copy, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
 pub enum Position {
     #[default]
     Left,
@@ -199,10 +202,21 @@ pub enum FrontendEvent {
     AuthorizedUpdated(HashMap<String, String>),
     /// public key fingerprint of this device
     PublicKeyFingerprint(String),
-    /// incoming connected
-    IncomingConnected(String, SocketAddr, Position),
+    /// new device connected
+    DeviceConnected {
+        addr: SocketAddr,
+        fingerprint: String,
+    },
+    /// incoming device entered the screen
+    DeviceEntered {
+        fingerprint: String,
+        addr: SocketAddr,
+        pos: Position,
+    },
     /// incoming disconnected
     IncomingDisconnected(SocketAddr),
+    /// failed connection attempt (approval for fingerprint required)
+    ConnectionAttempt { fingerprint: String },
 }
 
 #[derive(Debug, Eq, PartialEq, Clone, Serialize, Deserialize)]
@@ -237,6 +251,10 @@ pub enum FrontendRequest {
     AuthorizeKey(String, String),
     /// remove fingerprint (fingerprint)
     RemoveAuthorizedKey(String),
+    /// change the hook command
+    UpdateEnterHook(u64, Option<String>),
+    /// save config file
+    SaveConfiguration,
 }
 
 #[derive(Clone, Copy, PartialEq, Eq, Debug, Default, Serialize, Deserialize)]

lan-mouse-ipc/src/listen.rs

@@ -1,4 +1,4 @@
-use futures::{stream::SelectAll, Stream, StreamExt};
+use futures::{Stream, StreamExt, stream::SelectAll};
 #[cfg(unix)]
 use std::path::PathBuf;
 use std::{
@@ -45,7 +45,7 @@ impl AsyncFrontendListener {
         let (socket_path, listener) = {
             let socket_path = crate::default_socket_path()?;
 
-            log::debug!("remove socket: {:?}", socket_path);
+            log::debug!("remove socket: {socket_path:?}");
             if socket_path.exists() {
                 // try to connect to see if some other instance
                 // of lan-mouse is already running
@@ -63,7 +63,7 @@ impl AsyncFrontendListener {
                 Ok(ls) => ls,
                 // some other lan-mouse instance has bound the socket in the meantime
                 Err(e) if e.kind() == ErrorKind::AddrInUse => {
-                    return Err(IpcListenerCreationError::AlreadyRunning)
+                    return Err(IpcListenerCreationError::AlreadyRunning);
                 }
                 Err(e) => return Err(IpcListenerCreationError::Bind(e)),
             };
@@ -75,7 +75,7 @@ impl AsyncFrontendListener {
             Ok(ls) => ls,
             // some other lan-mouse instance has bound the socket in the meantime
             Err(e) if e.kind() == ErrorKind::AddrInUse => {
-                return Err(IpcListenerCreationError::AlreadyRunning)
+                return Err(IpcListenerCreationError::AlreadyRunning);
             }
             Err(e) => return Err(IpcListenerCreationError::Bind(e)),
         };

nix/README.md

@@ -1,18 +1,18 @@
 # Nix Flake Usage
 
-## run
+## Run
 
 ```bash
 nix run github:feschber/lan-mouse
 
-# with params
+# With params
 nix run github:feschber/lan-mouse -- --help
 
 ```
 
-## home-manager module
+## Home-manager module
 
-add input
+Add input:
 
 ```nix
 inputs = {
@@ -20,14 +20,27 @@ inputs = {
 }
 ```
 
-enable lan-mouse
+Optional: add [our binary cache](https://app.cachix.org/cache/lan-mouse) to allow a faster package install.
+
+```nix
+nixConfig = {
+    extra-substituters = [
+        "https://lan-mouse.cachix.org/"
+    ];
+    extra-trusted-public-keys = [
+      "lan-mouse.cachix.org-1:KlE2AEZUgkzNKM7BIzMQo8w9yJYqUpor1CAUNRY6OyM="
+    ];
+};
+```
+
+Enable lan-mouse:
 
 ``` nix
 {
   inputs,
   ...
 }: {
-  # add the home manager module
+  # Add the Home Manager module
   imports = [inputs.lan-mouse.homeManagerModules.default];
 
   programs.lan-mouse = {

nix/default.nix

@@ -1,34 +1,40 @@
 {
+  stdenv,
   rustPlatform,
   lib,
-  pkgs,
-}: let
-  cargoToml = builtins.fromTOML (builtins.readFile ../Cargo.toml);
+  pkg-config,
+  libX11,
+  gtk4,
+  libadwaita,
+  libXtst,
+  wrapGAppsHook4,
+  librsvg,
+  git,
+}:
+let
+  cargoToml = fromTOML (builtins.readFile ../Cargo.toml);
   pname = cargoToml.package.name;
   version = cargoToml.package.version;
 in
 rustPlatform.buildRustPackage {
-  pname = pname;
-  version = version;
+  inherit pname;
+  inherit version;
 
-  nativeBuildInputs = with pkgs; [
-    git
+  nativeBuildInputs = [
     pkg-config
-    cmake
-    makeWrapper
-    buildPackages.gtk4
+    wrapGAppsHook4
+    git
   ];
 
-  buildInputs = with pkgs; [
-    xorg.libX11
+  buildInputs = [
     gtk4
     libadwaita
-    xorg.libXtst
-  ] ++ lib.optionals stdenv.isDarwin
-  (with darwin.apple_sdk_11_0.frameworks; [
-    CoreGraphics
-    ApplicationServices
-  ]);
+    librsvg
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    libX11
+    libXtst
+  ];
 
   src = builtins.path {
     name = pname;
@@ -40,11 +46,7 @@ rustPlatform.buildRustPackage {
   # Set Environment Variables
   RUST_BACKTRACE = "full";
 
-  # Needed to enable support for SVG icons in GTK
   postInstall = ''
-    wrapProgram "$out/bin/lan-mouse" \
-      --set GDK_PIXBUF_MODULE_FILE ${pkgs.librsvg.out}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache
-
     install -Dm444 *.desktop -t $out/share/applications
     install -Dm444 lan-mouse-gtk/resources/*.svg -t $out/share/icons/hicolor/scalable/apps
   '';

nix/hm-module.nix

@@ -52,7 +52,7 @@ in {
       };
       Service = {
         Type = "simple";
-        ExecStart = "${cfg.package}/bin/lan-mouse --daemon";
+        ExecStart = "${cfg.package}/bin/lan-mouse daemon";
       };
       Install.WantedBy = [
         (lib.mkIf config.wayland.windowManager.hyprland.systemd.enable "hyprland-session.target")
@@ -65,7 +65,7 @@ in {
       config = {
         ProgramArguments = [
           "${cfg.package}/bin/lan-mouse"
-          "--daemon"
+          "daemon"
         ];
         KeepAlive = true;
       };

scripts/copy-macos-dylib.sh

@@ -0,0 +1,136 @@
+#!/bin/sh
+set -eu
+
+homebrew_path=""
+exec_path="target/debug/bundle/osx/Lan Mouse.app/Contents/MacOS/lan-mouse"
+
+usage() {
+    cat <<EOF
+$0: Copy all Homebrew libraries into the macOS app bundle.
+USAGE: $0 [-h] [-b homebrew_path] [exec_path]
+
+OPTIONS:
+  -h, --help    Show this help message and exit
+  -b            Path to Homebrew installation (default: $homebrew_path)
+  exec_path     Path to the main executable in the app bundle
+                (default: get from `brew --prefix`)
+
+When macOS apps are linked to dynamic libraries (.dylib files),
+the fully qualified path to the library is embedded in the binary.
+If the libraries come from Homebrew, that means that Homebrew must be present
+and the libraries must be installed in the same location on the user's machine.
+
+This script copies all of the Homebrew libraries that an executable links to into the app bundle
+and tells all the binaries in the bundle to look for them there.
+EOF
+}
+
+# Gather command-line arguments
+while test $# -gt 0; do
+    case "$1" in
+        -h | --help ) usage; exit 0;;
+        -b | --homebrew ) homebrew_path="$1"; shift 2;;
+        * ) exec_path="$1"; shift;;
+    esac
+done
+
+if [ -z "$homebrew_path" ]; then
+    homebrew_path="$(brew --prefix)"
+fi
+
+# Path to the .app bundle
+bundle_path=$(dirname "$(dirname "$(dirname "$exec_path")")")
+# Path to the Frameworks directory
+fwks_path="$bundle_path/Contents/Frameworks"
+mkdir -p "$fwks_path"
+# Path to bundled GTK/GSettings data
+resources_path="$bundle_path/Contents/Resources"
+share_path="$resources_path/share"
+
+# Copy and fix references for a binary (executable or dylib)
+#
+# This function will:
+# - Copy any referenced dylibs from /opt/homebrew to the Frameworks directory
+# - Update the binary to reference the local copy instead
+# - Add the Frameworks directory to the binary's RPATH
+# - Recursively process the copied dylibs
+fix_references() {
+  local bin="$1"
+
+  # Get all Homebrew libraries referenced by the binary
+  libs=$(otool -L "$bin" | awk -v homebrew="$homebrew_path" '$0 ~ homebrew {print $1}')
+
+  echo "$libs" | while IFS= read -r old_path; do
+    if [ -z "$old_path" ]; then
+      continue
+    fi
+
+    local base_name="$(basename "$old_path")"
+    local dest="$fwks_path/$base_name"
+
+    if [ ! -e "$dest" ]; then
+      echo "Copying $old_path -> $dest"
+      cp -f "$old_path" "$dest"
+      # Ensure the copied dylib is writable so that xattr -rd /path/to/Lan\ Mouse.app works.
+      chmod 644 "$dest"
+
+      echo "Updating $dest to have install_name of @rpath/$base_name..."
+      install_name_tool -id "@rpath/$base_name" "$dest"
+
+      # Recursively process this dylib
+      fix_references "$dest"
+    fi
+
+    echo "Updating $bin to reference @rpath/$base_name..."
+    install_name_tool -change "$old_path" "@rpath/$base_name" "$bin"
+  done
+}
+
+fix_references "$exec_path"
+
+copy_runtime_data() {
+  mkdir -p "$share_path"
+
+  if [ -d "$homebrew_path/share/glib-2.0/schemas" ]; then
+    mkdir -p "$share_path/glib-2.0"
+    rm -rf "$share_path/glib-2.0/schemas"
+    cp -RL "$homebrew_path/share/glib-2.0/schemas" "$share_path/glib-2.0/schemas"
+    if command -v glib-compile-schemas >/dev/null 2>&1; then
+      glib-compile-schemas "$share_path/glib-2.0/schemas"
+    elif [ -x "$homebrew_path/bin/glib-compile-schemas" ]; then
+      "$homebrew_path/bin/glib-compile-schemas" "$share_path/glib-2.0/schemas"
+    fi
+  fi
+
+  if [ -d "$homebrew_path/share/gtk-4.0" ]; then
+    rm -rf "$share_path/gtk-4.0"
+    cp -RL "$homebrew_path/share/gtk-4.0" "$share_path/gtk-4.0"
+  fi
+
+  if [ -d "$homebrew_path/share/icons/Adwaita" ]; then
+    mkdir -p "$share_path/icons"
+    rm -rf "$share_path/icons/Adwaita"
+    cp -RL "$homebrew_path/share/icons/Adwaita" "$share_path/icons/Adwaita"
+  fi
+}
+
+copy_runtime_data
+
+# cargo-bundle preserves the source path under Contents/Resources (so
+# `target/menubar-template.png` lands at `Resources/target/...`). Flatten it
+# so NSBundle pathForResource: finds the file at the Resources root.
+if [ -f "$resources_path/target/menubar-template.png" ]; then
+  mv "$resources_path/target/menubar-template.png" "$resources_path/menubar-template.png"
+  rmdir "$resources_path/target" 2>/dev/null || true
+fi
+
+# Ensure the main executable has our Frameworks path in its RPATH
+if ! otool -l "$exec_path" | grep -q "@executable_path/../Frameworks"; then
+  echo "Adding RPATH to $exec_path"
+  install_name_tool -add_rpath "@executable_path/../Frameworks" "$exec_path"
+fi
+
+# Se-sign the .app
+codesign --force --deep --sign - "$bundle_path"
+
+echo "Done!"

scripts/makeicns.sh

@@ -3,8 +3,15 @@ set -e
 
 usage() {
     cat <<EOF
-$0: Make a macOS icns file from an SVG with ImageMagick and iconutil.
-usage: $0 [SVG [ICNS [ICONSET]]
+$0: Make a macOS icns file from an SVG with rsvg-convert, ImageMagick and iconutil.
+
+Follows the Big Sur+ icon template:
+  - 1024x1024 canvas with a rounded-square (squircle) background
+  - Icon artwork scaled to fit inside an 824x824 content area, centered
+  - Transparent padding outside the squircle so the Dock/Finder render it
+    like other first-party macOS apps.
+
+usage: $0 [SVG [ICNS [ICONSET]]]
 
 ARGUMENTS
     SVG     The SVG file to convert
@@ -28,15 +35,103 @@ iconset="${3:-./target/icon.iconset}"
 
 set -u
 
-mkdir -p "$iconset"
-magick convert -background none -resize 1024x1024 "$svg" "$iconset"/icon_512x512@2x.png
-magick convert -background none -resize 512x512 "$svg" "$iconset"/icon_512x512.png
-magick convert -background none -resize 256x256 "$svg" "$iconset"/icon_256x256.png
-magick convert -background none -resize 128x128 "$svg" "$iconset"/icon_128x128.png
-magick convert -background none -resize 64x64 "$svg" "$iconset"/icon_32x32@2x.png
-magick convert -background none -resize 32x32 "$svg" "$iconset"/icon_32x32.png
-magick convert -background none -resize 16x16 "$svg" "$iconset"/icon_16x16.png
-cp "$iconset"/icon_512x512.png "$iconset"/icon_256x256@2x.png
-cp "$iconset"/icon_256x256.png "$iconset"/icon_128x128@2x.png
-cp "$iconset"/icon_32x32.png "$iconset"/icon_16x16@2x.png
-iconutil -c icns "$iconset" -o "$icns"
+workdir="$(dirname "$iconset")/icon-work"
+rm -rf "$iconset" "$workdir"
+mkdir -p "$iconset" "$workdir"
+
+# Big Sur+ macOS icon template proportions (in a 1024 canvas):
+#   canvas  = 1024
+#   squircle = 824  (the white rounded-square background, inset 100px)
+#   content  = 560  (artwork inside the squircle, with generous margin)
+#   radius   = 185  (~22.5% of the squircle, the characteristic curvature)
+CANVAS=1024
+SQUIRCLE=824
+CONTENT=560
+RADIUS=185
+BG_COLOR="#FFFFFF"
+SQUIRCLE_OFFSET=$(( (CANVAS - SQUIRCLE) / 2 ))
+CONTENT_OFFSET=$(( (CANVAS - CONTENT) / 2 ))
+
+# 1) Render the SVG to the content size at full fidelity.
+#    rsvg-convert handles our SVG correctly; ImageMagick sometimes crops it.
+rsvg-convert -w "$CONTENT" -h "$CONTENT" "$svg" -o "$workdir/content.png"
+
+# 2) Draw the rounded-square (squircle) background on a transparent canvas.
+#    The squircle is inset from the canvas edges (transparent padding), so the
+#    Dock/Finder render it at the same visual size as other first-party apps.
+magick -size ${CANVAS}x${CANVAS} xc:none \
+    -fill "$BG_COLOR" \
+    -draw "roundrectangle ${SQUIRCLE_OFFSET},${SQUIRCLE_OFFSET} $((CANVAS-SQUIRCLE_OFFSET-1)),$((CANVAS-SQUIRCLE_OFFSET-1)) $RADIUS,$RADIUS" \
+    "$workdir/background.png"
+
+# 3) Composite the artwork onto the background, centered inside the content area.
+magick "$workdir/background.png" \
+    "$workdir/content.png" -geometry +${CONTENT_OFFSET}+${CONTENT_OFFSET} -composite \
+    -colorspace sRGB -type TrueColorAlpha PNG32:"$workdir/icon-1024.png"
+
+# 4) Generate each iconset size from the master so all sizes share the same
+#    squircle proportions and look consistent at every resolution.
+for size in 1024 512 256 128 64 32 16; do
+    magick "$workdir/icon-1024.png" -resize ${size}x${size} \
+        -colorspace sRGB -type TrueColorAlpha PNG32:"$workdir/${size}.png"
+done
+
+cp "$workdir/1024.png" "$iconset"/icon_512x512@2x.png
+cp "$workdir/512.png"  "$iconset"/icon_512x512.png
+cp "$workdir/512.png"  "$iconset"/icon_256x256@2x.png
+cp "$workdir/256.png"  "$iconset"/icon_256x256.png
+cp "$workdir/256.png"  "$iconset"/icon_128x128@2x.png
+cp "$workdir/128.png"  "$iconset"/icon_128x128.png
+cp "$workdir/64.png"   "$iconset"/icon_32x32@2x.png
+cp "$workdir/32.png"   "$iconset"/icon_32x32.png
+cp "$workdir/32.png"   "$iconset"/icon_16x16@2x.png
+cp "$workdir/16.png"   "$iconset"/icon_16x16.png
+
+mkdir -p "$(dirname "$icns")"
+
+# Menu bar template icon: flatten all RGB channels to 0 (black) while keeping
+# alpha so the artwork reads as a clean silhouette. NSStatusBarButton tints
+# template images to match the menu bar appearance in light and dark modes.
+menubar_template="$(dirname "$icns")/menubar-template.png"
+rsvg-convert -w 44 -h 44 "$svg" -o "$workdir/menubar-44.png"
+magick "$workdir/menubar-44.png" -channel RGB -evaluate set 0 +channel \
+    "$menubar_template"
+
+if ! iconutil -c icns "$iconset" -o "$icns"; then
+    if ! command -v perl >/dev/null 2>&1; then
+        echo "iconutil failed and perl is not available for the fallback icns writer" >&2
+        exit 1
+    fi
+
+    echo "iconutil rejected the iconset; writing icns directly" >&2
+    perl - "$icns" "$iconset" <<'PERL'
+use strict;
+use warnings;
+
+my ($icns, $iconset) = @ARGV;
+my @icons = (
+    [ 'icp4', "$iconset/icon_16x16.png" ],
+    [ 'ic11', "$iconset/icon_16x16\@2x.png" ],
+    [ 'icp5', "$iconset/icon_32x32.png" ],
+    [ 'ic12', "$iconset/icon_32x32\@2x.png" ],
+    [ 'ic07', "$iconset/icon_128x128.png" ],
+    [ 'ic13', "$iconset/icon_128x128\@2x.png" ],
+    [ 'ic08', "$iconset/icon_256x256.png" ],
+    [ 'ic14', "$iconset/icon_256x256\@2x.png" ],
+    [ 'ic09', "$iconset/icon_512x512.png" ],
+    [ 'ic10', "$iconset/icon_512x512\@2x.png" ],
+);
+
+my $body = '';
+for my $icon (@icons) {
+    my ($type, $path) = @$icon;
+    open my $fh, '<:raw', $path or die "$path: $!";
+    local $/;
+    my $png = <$fh>;
+    $body .= $type . pack('N', length($png) + 8) . $png;
+}
+
+open my $out, '>:raw', $icns or die "$icns: $!";
+print {$out} 'icns' . pack('N', length($body) + 8) . $body;
+PERL
+fi

service/lan-mouse.service

@@ -6,7 +6,7 @@ After=graphical-session.target
 BindsTo=graphical-session.target
 
 [Service]
-ExecStart=/usr/bin/lan-mouse --daemon
+ExecStart=/usr/bin/lan-mouse daemon
 Restart=on-failure
 
 [Install]

src/capture.rs

@@ -8,10 +8,10 @@ use futures::StreamExt;
 use input_capture::{
     CaptureError, CaptureEvent, CaptureHandle, InputCapture, InputCaptureError, Position,
 };
-use input_event::scancode;
+use input_event::{Event, KeyboardEvent, scancode};
 use lan_mouse_proto::ProtoEvent;
-use local_channel::mpsc::{channel, Receiver, Sender};
-use tokio::task::{spawn_local, JoinHandle};
+use local_channel::mpsc::{Receiver, Sender, channel};
+use tokio::task::{JoinHandle, spawn_local};
 use tokio_util::sync::CancellationToken;
 
 use crate::connect::LanMouseConnection;
@@ -49,7 +49,7 @@ pub(crate) enum CaptureType {
     EnterOnly,
 }
 
-#[derive(Clone, Copy, Debug)]
+#[derive(Clone, Debug)]
 enum CaptureRequest {
     /// capture must release the mouse
     Release,
@@ -59,6 +59,8 @@ enum CaptureRequest {
     Destroy(CaptureHandle),
     /// reenable input capture
     Reenable,
+    /// set release bind
+    SetReleaseBind(Vec<scancode::Linux>),
 }
 
 impl Capture {
@@ -131,6 +133,10 @@ impl Capture {
     pub(crate) async fn event(&mut self) -> ICaptureEvent {
         self.event_rx.recv().await.expect("channel closed")
     }
+
+    pub(crate) fn set_release_bind(&mut self, bind: Vec<scancode::Linux>) {
+        let _ = self.request_tx.send(CaptureRequest::SetReleaseBind(bind));
+    }
 }
 
 /// debounce a statement `$st`, i.e. the statement is executed only if the
@@ -205,6 +211,9 @@ impl CaptureTask {
                         CaptureRequest::Create(h, p, t) => self.add_capture(h, p, t),
                         CaptureRequest::Destroy(h) => self.remove_capture(h),
                         CaptureRequest::Release => { /* nothing to do */ }
+                        CaptureRequest::SetReleaseBind(bind) => {
+                            self.release_bind.borrow_mut().clone_from(&bind);
+                        }
                     },
                     _ = self.cancellation_token.cancelled() => return,
                 }
@@ -295,6 +304,9 @@ impl CaptureTask {
                         self.remove_capture(h);
                         capture.destroy(h).await?;
                     }
+                    CaptureRequest::SetReleaseBind(bind) => {
+                        self.release_bind.borrow_mut().clone_from(&bind);
+                    }
                 },
                 _ = self.cancellation_token.cancelled() => break,
             }
@@ -362,7 +374,48 @@ impl CaptureTask {
     }
 
     async fn release_capture(&mut self, capture: &mut InputCapture) -> Result<(), CaptureError> {
-        self.active_client.take();
+        // If we have an active client, notify them we're leaving
+        if let Some(handle) = self.active_client.take() {
+            // Synthesize key-up events for every key still held in the
+            // capture's pressed_keys set BEFORE sending Leave. Without
+            // this, pressing the release-bind chord (typically all four
+            // modifiers) leaves the peer with phantom held modifiers:
+            // the down events were forwarded while capture was active,
+            // but the matching up events arrive after the local tap
+            // flips to passthrough and never reach the peer. The peer
+            // then runs every subsequent keystroke through those held
+            // mods until its watchdog times out (1+ s) or our Leave
+            // arrives — and Leave can be lost over UDP/DTLS.
+            for key in capture.take_pressed_keys() {
+                let key_up = ProtoEvent::Input(Event::Keyboard(KeyboardEvent::Key {
+                    time: 0,
+                    key: key as u32,
+                    state: 0,
+                }));
+                if let Err(e) = self.conn.send(key_up, handle).await {
+                    log::warn!("failed to send key-up to client {handle}: {e}");
+                }
+            }
+            // Reset the modifier mask too. The peer's input-emulation
+            // layer keeps a separate XKB-style modifier state that's
+            // updated by KeyboardEvent::Modifiers, distinct from the
+            // pressed_keys set drained above. Without this, an
+            // already-locked CapsLock would survive the release.
+            let mods_zero = ProtoEvent::Input(Event::Keyboard(KeyboardEvent::Modifiers {
+                depressed: 0,
+                latched: 0,
+                locked: 0,
+                group: 0,
+            }));
+            if let Err(e) = self.conn.send(mods_zero, handle).await {
+                log::warn!("failed to reset modifiers on client {handle}: {e}");
+            }
+
+            log::info!("sending Leave event to client {handle}");
+            if let Err(e) = self.conn.send(ProtoEvent::Leave(0), handle).await {
+                log::warn!("failed to send Leave to client {handle}: {e}");
+            }
+        }
         capture.release().await
     }
 }

src/capture_test.rs

@@ -1,12 +1,16 @@
 use crate::config::Config;
+use clap::Args;
 use futures::StreamExt;
 use input_capture::{self, CaptureError, CaptureEvent, InputCapture, InputCaptureError, Position};
 use input_event::{Event, KeyboardEvent};
 
-pub async fn run(config: Config) -> Result<(), InputCaptureError> {
+#[derive(Args, Clone, Debug, Eq, PartialEq)]
+pub struct TestCaptureArgs {}
+
+pub async fn run(config: Config, _args: TestCaptureArgs) -> Result<(), InputCaptureError> {
     log::info!("running input capture test");
     log::info!("creating input capture");
-    let backend = config.capture_backend.map(|b| b.into());
+    let backend = config.capture_backend().map(|b| b.into());
     loop {
         let mut input_capture = InputCapture::new(backend).await?;
         log::info!("creating clients");

src/client.rs

@@ -9,12 +9,42 @@ use slab::Slab;
 
 use lan_mouse_ipc::{ClientConfig, ClientHandle, ClientState, Position};
 
+use crate::config::ConfigClient;
+
 #[derive(Clone, Default)]
 pub struct ClientManager {
     clients: Rc<RefCell<Slab<(ClientConfig, ClientState)>>>,
 }
 
 impl ClientManager {
+    /// get all clients
+    pub fn clients(&self) -> Vec<(ClientConfig, ClientState)> {
+        self.clients
+            .borrow()
+            .iter()
+            .map(|(_, c)| c.clone())
+            .collect::<Vec<_>>()
+    }
+
+    pub fn add_with_config(&self, config_client: ConfigClient) -> ClientHandle {
+        let config = ClientConfig {
+            hostname: config_client.hostname,
+            fix_ips: config_client.ips.into_iter().collect(),
+            port: config_client.port,
+            pos: config_client.pos,
+            cmd: config_client.enter_hook,
+        };
+        let state = ClientState {
+            active: config_client.active,
+            ips: HashSet::from_iter(config.fix_ips.iter().cloned()),
+            ..Default::default()
+        };
+        let handle = self.add_client();
+        self.set_config(handle, config);
+        self.set_state(handle, state);
+        handle
+    }
+
     /// add a new client to this manager
     pub fn add_client(&self) -> ClientHandle {
         self.clients.borrow_mut().insert(Default::default()) as ClientHandle
@@ -199,6 +229,13 @@ impl ClientManager {
         }
     }
 
+    /// update the enter hook command of the client
+    pub(crate) fn set_enter_hook(&self, handle: ClientHandle, enter_hook: Option<String>) {
+        if let Some((c, _s)) = self.clients.borrow_mut().get_mut(handle as usize) {
+            c.cmd = enter_hook;
+        }
+    }
+
     /// set resolving status of the client
     pub(crate) fn set_resolving(&self, handle: ClientHandle, status: bool) {
         if let Some((_, s)) = self.clients.borrow_mut().get_mut(handle as usize) {
@@ -214,6 +251,15 @@ impl ClientManager {
             .and_then(|(c, _)| c.cmd.clone())
     }
 
+    /// returns all clients that are currently registered
+    pub(crate) fn registered_clients(&self) -> Vec<ClientHandle> {
+        self.clients
+            .borrow()
+            .iter()
+            .map(|(h, _)| h as ClientHandle)
+            .collect()
+    }
+
     /// returns all clients that are currently active
     pub(crate) fn active_clients(&self) -> Vec<ClientHandle> {
         self.clients

src/config.rs

@@ -1,16 +1,22 @@
-use clap::{Parser, ValueEnum};
+use crate::capture_test::TestCaptureArgs;
+use crate::emulation_test::TestEmulationArgs;
+use clap::{Parser, Subcommand, ValueEnum};
+use notify::{EventKind, RecommendedWatcher, Watcher};
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::env::{self, VarError};
 use std::fmt::Display;
-use std::fs;
+use std::fs::{self, File};
+use std::io::Write;
 use std::net::IpAddr;
 use std::path::{Path, PathBuf};
 use std::{collections::HashSet, io};
 use thiserror::Error;
 use toml;
+use toml_edit::{self, DocumentMut};
 
-use lan_mouse_ipc::{Position, DEFAULT_PORT};
+use lan_mouse_cli::CliArgs;
+use lan_mouse_ipc::{DEFAULT_PORT, Position};
 
 use input_event::scancode::{
     self,
@@ -21,33 +27,50 @@ use shadow_rs::shadow;
 
 shadow!(build);
 
-#[derive(Serialize, Deserialize, Debug)]
-pub struct ConfigToml {
-    pub capture_backend: Option<CaptureBackend>,
-    pub emulation_backend: Option<EmulationBackend>,
-    pub port: Option<u16>,
-    pub frontend: Option<Frontend>,
-    pub release_bind: Option<Vec<scancode::Linux>>,
-    pub cert_path: Option<PathBuf>,
-    pub left: Option<TomlClient>,
-    pub right: Option<TomlClient>,
-    pub top: Option<TomlClient>,
-    pub bottom: Option<TomlClient>,
-    pub authorized_fingerprints: Option<HashMap<String, String>>,
+const CONFIG_FILE_NAME: &str = "config.toml";
+const CERT_FILE_NAME: &str = "lan-mouse.pem";
+
+fn default_path() -> Result<PathBuf, VarError> {
+    #[cfg(unix)]
+    let default_path = {
+        let xdg_config_home =
+            env::var("XDG_CONFIG_HOME").unwrap_or(format!("{}/.config", env::var("HOME")?));
+        format!("{xdg_config_home}/lan-mouse/")
+    };
+
+    #[cfg(not(unix))]
+    let default_path = {
+        let app_data =
+            env::var("LOCALAPPDATA").unwrap_or(format!("{}/.config", env::var("USERPROFILE")?));
+        format!("{app_data}\\lan-mouse\\")
+    };
+    Ok(PathBuf::from(default_path))
 }
 
-#[derive(Serialize, Deserialize, Debug, Eq, PartialEq)]
-pub struct TomlClient {
-    pub hostname: Option<String>,
-    pub host_name: Option<String>,
-    pub ips: Option<Vec<IpAddr>>,
-    pub port: Option<u16>,
-    pub activate_on_startup: Option<bool>,
-    pub enter_hook: Option<String>,
+#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
+struct ConfigToml {
+    capture_backend: Option<CaptureBackend>,
+    emulation_backend: Option<EmulationBackend>,
+    port: Option<u16>,
+    release_bind: Option<Vec<scancode::Linux>>,
+    cert_path: Option<PathBuf>,
+    clients: Option<Vec<TomlClient>>,
+    authorized_fingerprints: Option<HashMap<String, String>>,
+}
+
+#[derive(Clone, Serialize, Deserialize, Debug, Eq, PartialEq)]
+struct TomlClient {
+    hostname: Option<String>,
+    host_name: Option<String>,
+    ips: Option<Vec<IpAddr>>,
+    port: Option<u16>,
+    position: Option<Position>,
+    activate_on_startup: Option<bool>,
+    enter_hook: Option<String>,
 }
 
 impl ConfigToml {
-    pub fn new(path: &Path) -> Result<ConfigToml, ConfigError> {
+    fn new(path: &Path) -> Result<ConfigToml, ConfigError> {
         let config = fs::read_to_string(path)?;
         Ok(toml::from_str::<_>(&config)?)
     }
@@ -55,30 +78,14 @@ impl ConfigToml {
 
 #[derive(Parser, Debug)]
 #[command(author, version=build::CLAP_LONG_VERSION, about, long_about = None)]
-struct CliArgs {
+struct Args {
     /// the listen port for lan-mouse
     #[arg(short, long)]
     port: Option<u16>,
 
-    /// the frontend to use [cli | gtk]
-    #[arg(short, long)]
-    frontend: Option<Frontend>,
-
     /// non-default config file location
     #[arg(short, long)]
-    config: Option<String>,
-
-    /// run only the service as a daemon without the frontend
-    #[arg(short, long)]
-    daemon: bool,
-
-    /// test input capture
-    #[arg(long)]
-    test_capture: bool,
-
-    /// test input emulation
-    #[arg(long)]
-    test_emulation: bool,
+    config: Option<PathBuf>,
 
     /// capture backend override
     #[arg(long)]
@@ -91,6 +98,22 @@ struct CliArgs {
     /// path to non-default certificate location
     #[arg(long)]
     cert_path: Option<PathBuf>,
+
+    /// subcommands
+    #[command(subcommand)]
+    command: Option<Command>,
+}
+
+#[derive(Subcommand, Clone, Debug, Eq, PartialEq)]
+pub enum Command {
+    /// test input emulation
+    TestEmulation(TestEmulationArgs),
+    /// test input capture
+    TestCapture(TestCaptureArgs),
+    /// Lan Mouse commandline interface
+    Cli(CliArgs),
+    /// run in daemon mode
+    Daemon,
 }
 
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize, ValueEnum)]
@@ -214,50 +237,22 @@ impl Display for EmulationBackend {
     }
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Eq, Serialize, ValueEnum)]
-pub enum Frontend {
-    #[serde(rename = "gtk")]
-    Gtk,
-    #[serde(rename = "cli")]
-    Cli,
-}
-
-impl Default for Frontend {
-    fn default() -> Self {
-        if cfg!(feature = "gtk") {
-            Self::Gtk
-        } else {
-            Self::Cli
-        }
-    }
-}
-
 #[derive(Debug)]
 pub struct Config {
-    /// the path to the configuration file used
-    pub path: PathBuf,
-    /// public key fingerprints authorized for connection
-    pub authorized_fingerprints: HashMap<String, String>,
-    /// optional input-capture backend override
-    pub capture_backend: Option<CaptureBackend>,
-    /// optional input-emulation backend override
-    pub emulation_backend: Option<EmulationBackend>,
-    /// the frontend to use
-    pub frontend: Frontend,
-    /// the port to use (initially)
-    pub port: u16,
-    /// list of clients
-    pub clients: Vec<(TomlClient, Position)>,
-    /// whether or not to run as a daemon
-    pub daemon: bool,
-    /// configured release bind
-    pub release_bind: Vec<scancode::Linux>,
-    /// test capture instead of running the app
-    pub test_capture: bool,
-    /// test emulation instead of running the app
-    pub test_emulation: bool,
-    /// path to the tls certificate to use
-    pub cert_path: PathBuf,
+    /// command line arguments
+    args: Args,
+    /// path to the certificate file used
+    cert_path: PathBuf,
+    /// path to the config file used
+    config_path: PathBuf,
+    /// path to config directory (parent of above)
+    config_dir: PathBuf,
+    /// the (optional) toml config and it's path
+    config_toml: Option<ConfigToml>,
+    // filesystem watcher
+    watcher: notify::RecommendedWatcher,
+    // channel for filesystem events
+    watch_rx: tokio::sync::mpsc::Receiver<Result<notify::Event, notify::Error>>,
 }
 
 pub struct ConfigClient {
@@ -269,6 +264,52 @@ pub struct ConfigClient {
     pub enter_hook: Option<String>,
 }
 
+impl From<TomlClient> for ConfigClient {
+    fn from(toml: TomlClient) -> Self {
+        let active = toml.activate_on_startup.unwrap_or(false);
+        let enter_hook = toml.enter_hook;
+        let hostname = toml.hostname;
+        let ips = HashSet::from_iter(toml.ips.into_iter().flatten());
+        let port = toml.port.unwrap_or(DEFAULT_PORT);
+        let pos = toml.position.unwrap_or_default();
+        Self {
+            ips,
+            hostname,
+            port,
+            pos,
+            active,
+            enter_hook,
+        }
+    }
+}
+
+impl From<ConfigClient> for TomlClient {
+    fn from(client: ConfigClient) -> Self {
+        let hostname = client.hostname;
+        let host_name = None;
+        let mut ips = client.ips.into_iter().collect::<Vec<_>>();
+        ips.sort();
+        let ips = Some(ips);
+        let port = if client.port == DEFAULT_PORT {
+            None
+        } else {
+            Some(client.port)
+        };
+        let position = Some(client.pos);
+        let activate_on_startup = if client.active { Some(true) } else { None };
+        let enter_hook = client.enter_hook;
+        Self {
+            hostname,
+            host_name,
+            ips,
+            port,
+            position,
+            activate_on_startup,
+            enter_hook,
+        }
+    }
+}
+
 #[derive(Debug, Error)]
 pub enum ConfigError {
     #[error(transparent)]
@@ -277,6 +318,8 @@ pub enum ConfigError {
     Io(#[from] io::Error),
     #[error(transparent)]
     Var(#[from] VarError),
+    #[error(transparent)]
+    Watcher(#[from] notify::Error),
 }
 
 const DEFAULT_RELEASE_KEYS: [scancode::Linux; 4] =
@@ -284,134 +327,234 @@ const DEFAULT_RELEASE_KEYS: [scancode::Linux; 4] =
 
 impl Config {
     pub fn new() -> Result<Self, ConfigError> {
-        let args = CliArgs::parse();
-        const CONFIG_FILE_NAME: &str = "config.toml";
-        const CERT_FILE_NAME: &str = "lan-mouse.pem";
-
-        #[cfg(unix)]
-        let config_path = {
-            let xdg_config_home =
-                env::var("XDG_CONFIG_HOME").unwrap_or(format!("{}/.config", env::var("HOME")?));
-            format!("{xdg_config_home}/lan-mouse/")
-        };
-
-        #[cfg(not(unix))]
-        let config_path = {
-            let app_data =
-                env::var("LOCALAPPDATA").unwrap_or(format!("{}/.config", env::var("USERPROFILE")?));
-            format!("{app_data}\\lan-mouse\\")
-        };
-
-        let config_path = PathBuf::from(config_path);
-        let config_file = config_path.join(CONFIG_FILE_NAME);
+        let args = Args::parse();
 
         // --config <file> overrules default location
-        let config_file = args.config.map(PathBuf::from).unwrap_or(config_file);
+        let config_path = args
+            .config
+            .clone()
+            .unwrap_or(default_path()?.join(CONFIG_FILE_NAME));
+        let config_dir = config_path
+            .parent()
+            .expect("config directory")
+            .to_path_buf();
 
-        let mut config_toml = match ConfigToml::new(&config_file) {
+        // Ensure the config directory exists and write a default config file
+        // if none is present. Runs on every Config::new(), regardless of which
+        // entry path (GUI main, spawned daemon, CLI, test commands) we're on,
+        // so a fresh Mac never hits "No such file or directory" on config.toml
+        // and notify::Watcher (which requires the dir to exist on macOS
+        // FSEvents and some Linux backends) has a concrete path to watch.
+        fs::create_dir_all(&config_dir)?;
+        if !config_path.exists() {
+            let default_toml = toml::to_string_pretty(&ConfigToml::default())
+                .expect("default ConfigToml serialization cannot fail");
+            fs::write(&config_path, default_toml)?;
+        }
+
+        let config_toml = match ConfigToml::new(&config_path) {
             Err(e) => {
-                log::warn!("{config_file:?}: {e}");
+                log::warn!("{config_path:?}: {e}");
                 log::warn!("Continuing without config file ...");
                 None
             }
             Ok(c) => Some(c),
         };
 
-        let frontend_arg = args.frontend;
-        let frontend_cfg = config_toml.as_ref().and_then(|c| c.frontend);
-        let frontend = frontend_arg.or(frontend_cfg).unwrap_or_default();
-
-        let port = args
-            .port
-            .or(config_toml.as_ref().and_then(|c| c.port))
-            .unwrap_or(DEFAULT_PORT);
-
-        log::debug!("{config_toml:?}");
-        let release_bind = config_toml
-            .as_ref()
-            .and_then(|c| c.release_bind.clone())
-            .unwrap_or(Vec::from_iter(DEFAULT_RELEASE_KEYS.iter().cloned()));
-
-        let capture_backend = args
-            .capture_backend
-            .or(config_toml.as_ref().and_then(|c| c.capture_backend));
-
-        let emulation_backend = args
-            .emulation_backend
-            .or(config_toml.as_ref().and_then(|c| c.emulation_backend));
-
+        // --cert-path <file> overrules default location
         let cert_path = args
             .cert_path
+            .clone()
             .or(config_toml.as_ref().and_then(|c| c.cert_path.clone()))
-            .unwrap_or(config_path.join(CERT_FILE_NAME));
+            .unwrap_or(default_path()?.join(CERT_FILE_NAME));
 
-        let authorized_fingerprints = config_toml
-            .as_mut()
-            .and_then(|c| std::mem::take(&mut c.authorized_fingerprints))
-            .unwrap_or_default();
+        let (tx, watch_rx) = tokio::sync::mpsc::channel(16);
+        let watcher = RecommendedWatcher::new(
+            move |res| {
+                let _ = tx.blocking_send(res);
+            },
+            notify::Config::default(),
+        )?;
+        let mut config = Config {
+            args,
+            cert_path,
+            config_path,
+            config_dir,
+            config_toml,
+            watcher,
+            watch_rx,
+        };
+        config.watch()?;
+        Ok(config)
+    }
 
-        let mut clients: Vec<(TomlClient, Position)> = vec![];
+    fn watch(&mut self) -> Result<(), notify::Error> {
+        self.watcher
+            .watch(&self.config_dir, notify::RecursiveMode::NonRecursive)?;
+        Ok(())
+    }
 
-        if let Some(config_toml) = config_toml {
-            if let Some(c) = config_toml.right {
-                clients.push((c, Position::Right))
-            }
-            if let Some(c) = config_toml.left {
-                clients.push((c, Position::Left))
-            }
-            if let Some(c) = config_toml.top {
-                clients.push((c, Position::Top))
-            }
-            if let Some(c) = config_toml.bottom {
-                clients.push((c, Position::Bottom))
+    fn unwatch(&mut self) -> Result<(), notify::Error> {
+        self.watcher.unwatch(&self.config_dir)?;
+        Ok(())
+    }
+
+    pub async fn changed(&mut self) -> Result<(), notify::Error> {
+        loop {
+            let event = self.watch_rx.recv().await.expect("channel closed");
+            let event = event.expect("filesystem event");
+            if event.paths.contains(&self.config_path)
+                && matches!(
+                    event.kind,
+                    EventKind::Create(_) | EventKind::Modify(_) | EventKind::Remove(_)
+                )
+                && self.read_from_disk()?
+            {
+                return Ok(());
             }
         }
-
-        let daemon = args.daemon;
-        let test_capture = args.test_capture;
-        let test_emulation = args.test_emulation;
-
-        Ok(Config {
-            path: config_path,
-            authorized_fingerprints,
-            capture_backend,
-            emulation_backend,
-            daemon,
-            frontend,
-            clients,
-            port,
-            release_bind,
-            test_capture,
-            test_emulation,
-            cert_path,
-        })
     }
 
-    pub fn get_clients(&self) -> Vec<ConfigClient> {
-        self.clients
-            .iter()
-            .map(|(c, pos)| {
-                let port = c.port.unwrap_or(DEFAULT_PORT);
-                let ips: HashSet<IpAddr> = if let Some(ips) = c.ips.as_ref() {
-                    HashSet::from_iter(ips.iter().cloned())
-                } else {
-                    HashSet::new()
-                };
-                let hostname = match &c.hostname {
-                    Some(h) => Some(h.clone()),
-                    None => c.host_name.clone(),
-                };
-                let active = c.activate_on_startup.unwrap_or(false);
-                let enter_hook = c.enter_hook.clone();
-                ConfigClient {
-                    ips,
-                    hostname,
-                    port,
-                    pos: *pos,
-                    active,
-                    enter_hook,
-                }
-            })
+    /// the command to run
+    pub fn command(&self) -> Option<Command> {
+        self.args.command.clone()
+    }
+
+    pub fn config_path(&self) -> &Path {
+        &self.config_path
+    }
+
+    /// public key fingerprints authorized for connection
+    pub fn authorized_fingerprints(&self) -> HashMap<String, String> {
+        self.config_toml
+            .as_ref()
+            .and_then(|c| c.authorized_fingerprints.clone())
+            .unwrap_or_default()
+    }
+
+    /// path to certificate
+    pub fn cert_path(&self) -> &Path {
+        &self.cert_path
+    }
+
+    /// optional input-capture backend override
+    pub fn capture_backend(&self) -> Option<CaptureBackend> {
+        self.args
+            .capture_backend
+            .or(self.config_toml.as_ref().and_then(|c| c.capture_backend))
+    }
+
+    /// optional input-emulation backend override
+    pub fn emulation_backend(&self) -> Option<EmulationBackend> {
+        self.args
+            .emulation_backend
+            .or(self.config_toml.as_ref().and_then(|c| c.emulation_backend))
+    }
+
+    /// the port to use (initially)
+    pub fn port(&self) -> u16 {
+        self.args
+            .port
+            .or(self.config_toml.as_ref().and_then(|c| c.port))
+            .unwrap_or(DEFAULT_PORT)
+    }
+
+    /// list of configured clients
+    pub fn clients(&self) -> Vec<ConfigClient> {
+        self.config_toml
+            .as_ref()
+            .map(|c| c.clients.clone())
+            .unwrap_or_default()
+            .into_iter()
+            .flatten()
+            .map(From::<TomlClient>::from)
             .collect()
     }
+
+    /// release bind for returning control to the host
+    pub fn release_bind(&self) -> Vec<scancode::Linux> {
+        self.config_toml
+            .as_ref()
+            .and_then(|c| c.release_bind.clone())
+            .unwrap_or(Vec::from_iter(DEFAULT_RELEASE_KEYS.iter().cloned()))
+    }
+
+    /// set configured clients
+    pub fn set_clients(&mut self, clients: Vec<ConfigClient>) {
+        if clients.is_empty() {
+            return;
+        }
+        if self.config_toml.is_none() {
+            self.config_toml = Some(Default::default());
+        }
+        self.config_toml.as_mut().expect("config").clients =
+            Some(clients.into_iter().map(|c| c.into()).collect::<Vec<_>>());
+    }
+
+    /// set authorized keys
+    pub fn set_authorized_keys(&mut self, fingerprints: HashMap<String, String>) {
+        if self.config_toml.is_none() {
+            self.config_toml = Some(Default::default());
+        }
+        self.config_toml
+            .as_mut()
+            .expect("config")
+            .authorized_fingerprints = Some(fingerprints);
+    }
+
+    pub fn read_from_disk(&mut self) -> Result<bool, io::Error> {
+        log::info!("reading config from {:?}", &self.config_path);
+
+        let current_config = fs::read_to_string(&self.config_path)?;
+        let current_config = match current_config.parse::<DocumentMut>() {
+            Ok(c) => c,
+            Err(e) => {
+                log::warn!("{:?} {e}", self.config_path());
+                return Ok(false);
+            }
+        };
+        let mut changed = false;
+        match toml_edit::de::from_document::<ConfigToml>(current_config) {
+            Ok(current_config) => {
+                changed = self
+                    .config_toml
+                    .as_ref()
+                    .is_none_or(|c| c != &current_config);
+                self.config_toml.replace(current_config);
+            }
+            Err(e) => log::warn!("{:?} {e}", self.config_path()),
+        };
+        Ok(changed)
+    }
+
+    pub fn write_back(&mut self) -> Result<(), io::Error> {
+        log::info!("writing config to {:?}", &self.config_path);
+        /* the new config */
+        let new_config = self.config_toml.clone().unwrap_or_default();
+        let new_config = toml_edit::ser::to_string_pretty(&new_config).expect("config");
+
+        /*
+         * TODO merge with current config file to preserve comments
+         * => eventually we might want to split this up into clients configured
+         * via the config file and clients managed through the GUI / frontend.
+         * The latter should be saved to $XDG_DATA_HOME instead of $XDG_CONFIG_HOME,
+         * and clients configured through .config could be made permanent.
+         * For now we just override the config file.
+         */
+
+        let _ = self.unwatch();
+        /* write new config to file */
+        if let Some(p) = self.config_path().parent() {
+            fs::create_dir_all(p)?;
+        }
+        {
+            let mut f = File::create(self.config_path())?;
+            f.write_all(new_config.as_bytes())?;
+            f.sync_all()?;
+        }
+
+        let _ = self.watch();
+
+        Ok(())
+    }
 }

src/connect.rs

@@ -1,7 +1,7 @@
 use crate::client::ClientManager;
 use lan_mouse_ipc::{ClientHandle, DEFAULT_PORT};
-use lan_mouse_proto::{ProtoEvent, MAX_EVENT_SIZE};
-use local_channel::mpsc::{channel, Receiver, Sender};
+use lan_mouse_proto::{MAX_EVENT_SIZE, ProtoEvent};
+use local_channel::mpsc::{Receiver, Sender, channel};
 use std::{
     cell::RefCell,
     collections::{HashMap, HashSet},
@@ -15,7 +15,7 @@ use thiserror::Error;
 use tokio::{
     net::UdpSocket,
     sync::Mutex,
-    task::{spawn_local, JoinSet},
+    task::{JoinSet, spawn_local},
 };
 use webrtc_dtls::{
     config::{Config, ExtendedMasterSecretType},
@@ -223,14 +223,18 @@ async fn ping_pong(
 ) {
     loop {
         let (buf, len) = ProtoEvent::Ping.into();
-        if let Err(e) = conn.send(&buf[..len]).await {
-            log::warn!("{addr}: send error `{e}`, closing connection");
-            let _ = conn.close().await;
-            break;
-        }
-        log::trace!("PING >->->->->- {addr}");
 
-        tokio::time::sleep(Duration::from_millis(500)).await;
+        // send 4 pings, at least one must be answered
+        for _ in 0..4 {
+            if let Err(e) = conn.send(&buf[..len]).await {
+                log::warn!("{addr}: send error `{e}`, closing connection");
+                let _ = conn.close().await;
+                break;
+            }
+            log::trace!("PING >->->->->- {addr}");
+
+            tokio::time::sleep(Duration::from_millis(500)).await;
+        }
 
         if !ping_response.borrow_mut().remove(&addr) {
             log::warn!("{addr} did not respond, closing connection");

src/dns.rs

@@ -1,9 +1,9 @@
 use std::{collections::HashMap, net::IpAddr};
 
-use local_channel::mpsc::{channel, Receiver, Sender};
-use tokio::task::{spawn_local, JoinHandle};
+use local_channel::mpsc::{Receiver, Sender, channel};
+use tokio::task::{JoinHandle, spawn_local};
 
-use hickory_resolver::{error::ResolveError, TokioAsyncResolver};
+use hickory_resolver::{ResolveError, TokioResolver};
 use tokio_util::sync::CancellationToken;
 
 use lan_mouse_ipc::ClientHandle;
@@ -26,7 +26,7 @@ pub(crate) enum DnsEvent {
 }
 
 struct DnsTask {
-    resolver: TokioAsyncResolver,
+    resolver: TokioResolver,
     request_rx: Receiver<DnsRequest>,
     event_tx: Sender<DnsEvent>,
     cancellation_token: CancellationToken,
@@ -35,7 +35,7 @@ struct DnsTask {
 
 impl DnsResolver {
     pub(crate) fn new() -> Result<Self, ResolveError> {
-        let resolver = TokioAsyncResolver::tokio_from_system_conf()?;
+        let resolver = TokioResolver::builder_tokio()?.build();
         let (request_tx, request_rx) = channel();
         let (event_tx, event_rx) = channel();
         let cancellation_token = CancellationToken::new();

src/emulation.rs

@@ -1,9 +1,9 @@
-use crate::listen::{LanMouseListener, ListenerCreationError};
+use crate::listen::{LanMouseListener, ListenEvent, ListenerCreationError};
 use futures::StreamExt;
 use input_emulation::{EmulationHandle, InputEmulation, InputEmulationError};
 use input_event::Event;
 use lan_mouse_proto::{Position, ProtoEvent};
-use local_channel::mpsc::{channel, Receiver, Sender};
+use local_channel::mpsc::{Receiver, Sender, channel};
 use std::{
     cell::Cell,
     collections::HashMap,
@@ -13,7 +13,7 @@ use std::{
 };
 use tokio::{
     select,
-    task::{spawn_local, JoinHandle},
+    task::{JoinHandle, spawn_local},
 };
 
 /// emulation handling events received from a listener
@@ -24,8 +24,15 @@ pub(crate) struct Emulation {
 }
 
 pub(crate) enum EmulationEvent {
-    /// new connection
     Connected {
+        addr: SocketAddr,
+        fingerprint: String,
+    },
+    ConnectionAttempt {
+        fingerprint: String,
+    },
+    /// new connection
+    Entered {
         /// address of the connection
         addr: SocketAddr,
         /// position of the connection
@@ -34,7 +41,9 @@ pub(crate) enum EmulationEvent {
         fingerprint: String,
     },
     /// connection closed
-    Disconnected { addr: SocketAddr },
+    Disconnected {
+        addr: SocketAddr,
+    },
     /// the port of the listener has changed
     PortChanged(Result<u16, ListenerCreationError>),
     /// emulation was disabled
@@ -119,33 +128,42 @@ impl ListenTask {
     async fn run(mut self) {
         let mut interval = tokio::time::interval(Duration::from_secs(5));
         let mut last_response = HashMap::new();
+        let mut rejected_connections = HashMap::new();
         loop {
             select! {
-                e = self.listener.next() =>  {
-                    let (event, addr) = match e {
-                        Some(e) => e,
-                        None => break,
-                    };
-                    log::trace!("{event} <-<-<-<-<- {addr}");
-                    last_response.insert(addr, Instant::now());
-                    match event {
-                        ProtoEvent::Enter(pos) => {
-                            if let Some(fingerprint) = self.listener.get_certificate_fingerprint(addr).await {
-                                log::info!("releasing capture: {addr} entered this device");
-                                self.event_tx.send(EmulationEvent::ReleaseNotify).expect("channel closed");
-                                self.listener.reply(addr, ProtoEvent::Ack(0)).await;
-                                self.event_tx.send(EmulationEvent::Connected{addr, pos: to_ipc_pos(pos), fingerprint}).expect("channel closed");
+                e = self.listener.next() => {match e {
+                    Some(ListenEvent::Msg { event, addr }) => {
+                        log::trace!("{event} <-<-<-<-<- {addr}");
+                        last_response.insert(addr, Instant::now());
+                        match event {
+                            ProtoEvent::Enter(pos) => {
+                                if let Some(fingerprint) = self.listener.get_certificate_fingerprint(addr).await {
+                                    log::info!("releasing capture: {addr} entered this device");
+                                    self.event_tx.send(EmulationEvent::ReleaseNotify).expect("channel closed");
+                                    self.listener.reply(addr, ProtoEvent::Ack(0)).await;
+                                    self.event_tx.send(EmulationEvent::Entered{addr, pos: to_ipc_pos(pos), fingerprint}).expect("channel closed");
+                                }
                             }
+                            ProtoEvent::Leave(_) => {
+                                self.emulation_proxy.remove(addr);
+                                self.listener.reply(addr, ProtoEvent::Ack(0)).await;
+                            }
+                            ProtoEvent::Input(event) => self.emulation_proxy.consume(event, addr),
+                            ProtoEvent::Ping => self.listener.reply(addr, ProtoEvent::Pong(self.emulation_proxy.emulation_active.get())).await,
+                            _ => {}
                         }
-                        ProtoEvent::Leave(_) => {
-                            self.emulation_proxy.remove(addr);
-                            self.listener.reply(addr, ProtoEvent::Ack(0)).await;
-                        }
-                        ProtoEvent::Input(event) => self.emulation_proxy.consume(event, addr),
-                        ProtoEvent::Ping => self.listener.reply(addr, ProtoEvent::Pong(self.emulation_proxy.emulation_active.get())).await,
-                        _ => {}
                     }
-                }
+                    Some(ListenEvent::Accept { addr, fingerprint }) => {
+                        self.event_tx.send(EmulationEvent::Connected { addr, fingerprint }).expect("channel closed");
+                    }
+                    Some(ListenEvent::Rejected { fingerprint }) => {
+                        if rejected_connections.insert(fingerprint.clone(), Instant::now())
+                            .is_none_or(|i| i.elapsed() >= Duration::from_secs(2)) {
+                                self.event_tx.send(EmulationEvent::ConnectionAttempt { fingerprint }).expect("channel closed");
+                            }
+                    }
+                    None => break
+                }}
                 event = self.emulation_proxy.event() => {
                     self.event_tx.send(event).expect("channel closed");
                 }

src/emulation_test.rs

@@ -1,4 +1,5 @@
 use crate::config::Config;
+use clap::Args;
 use input_emulation::{InputEmulation, InputEmulationError};
 use input_event::{Event, PointerEvent};
 use std::f64::consts::PI;
@@ -7,10 +8,20 @@ use std::time::{Duration, Instant};
 const FREQUENCY_HZ: f64 = 1.0;
 const RADIUS: f64 = 100.0;
 
-pub async fn run(config: Config) -> Result<(), InputEmulationError> {
+#[derive(Args, Clone, Debug, Eq, PartialEq)]
+pub struct TestEmulationArgs {
+    #[arg(long)]
+    mouse: bool,
+    #[arg(long)]
+    keyboard: bool,
+    #[arg(long)]
+    scroll: bool,
+}
+
+pub async fn run(config: Config, _args: TestEmulationArgs) -> Result<(), InputEmulationError> {
     log::info!("running input emulation test");
 
-    let backend = config.emulation_backend.map(|b| b.into());
+    let backend = config.emulation_backend().map(|b| b.into());
     let mut emulation = InputEmulation::new(backend).await?;
     emulation.create(0).await;
 

src/listen.rs

@@ -1,18 +1,18 @@
 use futures::{Stream, StreamExt};
-use lan_mouse_proto::{ProtoEvent, MAX_EVENT_SIZE};
-use local_channel::mpsc::{channel, Receiver, Sender};
+use lan_mouse_proto::{MAX_EVENT_SIZE, ProtoEvent};
+use local_channel::mpsc::{Receiver, Sender, channel};
 use rustls::pki_types::CertificateDer;
 use std::{
-    collections::HashMap,
+    collections::{HashMap, VecDeque},
     net::SocketAddr,
     rc::Rc,
-    sync::{Arc, RwLock},
+    sync::{Arc, Mutex, RwLock},
     time::Duration,
 };
 use thiserror::Error;
 use tokio::{
-    sync::Mutex,
-    task::{spawn_local, JoinHandle},
+    sync::Mutex as AsyncMutex,
+    task::{JoinHandle, spawn_local},
 };
 use webrtc_dtls::{
     config::{ClientAuthType::RequireAnyClientCert, Config, ExtendedMasterSecretType},
@@ -20,7 +20,7 @@ use webrtc_dtls::{
     crypto::Certificate,
     listener::listen,
 };
-use webrtc_util::{conn::Listener, Conn, Error};
+use webrtc_util::{Conn, Error, conn::Listener};
 
 use crate::crypto;
 
@@ -34,11 +34,25 @@ pub enum ListenerCreationError {
 
 type ArcConn = Arc<dyn Conn + Send + Sync>;
 
+pub(crate) enum ListenEvent {
+    Msg {
+        event: ProtoEvent,
+        addr: SocketAddr,
+    },
+    Accept {
+        addr: SocketAddr,
+        fingerprint: String,
+    },
+    Rejected {
+        fingerprint: String,
+    },
+}
+
 pub(crate) struct LanMouseListener {
-    listen_rx: Receiver<(ProtoEvent, SocketAddr)>,
-    listen_tx: Sender<(ProtoEvent, SocketAddr)>,
+    listen_rx: Receiver<ListenEvent>,
+    listen_tx: Sender<ListenEvent>,
     listen_task: JoinHandle<()>,
-    conns: Rc<Mutex<Vec<(SocketAddr, ArcConn)>>>,
+    conns: Rc<AsyncMutex<Vec<(SocketAddr, ArcConn)>>>,
     request_port_change: Sender<u16>,
     port_changed: Receiver<Result<u16, ListenerCreationError>>,
 }
@@ -58,26 +72,35 @@ impl LanMouseListener {
         let (listen_tx, listen_rx) = channel();
         let (request_port_change, mut request_port_change_rx) = channel();
         let (port_changed_tx, port_changed) = channel();
+        let connection_attempts: Arc<Mutex<VecDeque<String>>> = Default::default();
 
         let authorized = authorized_keys.clone();
-        let verify_peer_certificate: Option<VerifyPeerCertificateFn> = Some(Arc::new(
-            move |certs: &[Vec<u8>], _chains: &[CertificateDer<'static>]| {
-                assert!(certs.len() == 1);
-                let fingerprints = certs
-                    .iter()
-                    .map(|c| crypto::generate_fingerprint(c))
-                    .collect::<Vec<_>>();
-                if authorized
-                    .read()
-                    .expect("lock")
-                    .contains_key(&fingerprints[0])
-                {
-                    Ok(())
-                } else {
-                    Err(webrtc_dtls::Error::ErrVerifyDataMismatch)
-                }
-            },
-        ));
+        let verify_peer_certificate: Option<VerifyPeerCertificateFn> = {
+            let connection_attempts = connection_attempts.clone();
+            Some(Arc::new(
+                move |certs: &[Vec<u8>], _chains: &[CertificateDer<'static>]| {
+                    assert!(certs.len() == 1);
+                    let fingerprints = certs
+                        .iter()
+                        .map(|c| crypto::generate_fingerprint(c))
+                        .collect::<Vec<_>>();
+                    if authorized
+                        .read()
+                        .expect("lock")
+                        .contains_key(&fingerprints[0])
+                    {
+                        Ok(())
+                    } else {
+                        let fingerprint = fingerprints.into_iter().next().expect("fingerprint");
+                        connection_attempts
+                            .lock()
+                            .expect("lock")
+                            .push_back(fingerprint);
+                        Err(webrtc_dtls::Error::ErrVerifyDataMismatch)
+                    }
+                },
+            ))
+        };
         let cfg = Config {
             certificates: vec![cert.clone()],
             extended_master_secret: ExtendedMasterSecretType::Require,
@@ -89,43 +112,69 @@ impl LanMouseListener {
         let listen_addr = SocketAddr::new("0.0.0.0".parse().expect("invalid ip"), port);
         let mut listener = listen(listen_addr, cfg.clone()).await?;
 
-        let conns: Rc<Mutex<Vec<(SocketAddr, ArcConn)>>> = Rc::new(Mutex::new(Vec::new()));
+        let conns: Rc<AsyncMutex<Vec<(SocketAddr, ArcConn)>>> =
+            Rc::new(AsyncMutex::new(Vec::new()));
 
         let conns_clone = conns.clone();
-        let tx = listen_tx.clone();
-        let listen_task: JoinHandle<()> = spawn_local(async move {
-            loop {
-                let sleep = tokio::time::sleep(Duration::from_secs(2));
-                tokio::select! {
-                    /* workaround for https://github.com/webrtc-rs/webrtc/issues/614 */
-                    _ = sleep => continue,
-                    c = listener.accept() => match c {
-                        Ok((conn, addr)) => {
-                            log::info!("dtls client connected, ip: {addr}");
-                            let mut conns = conns_clone.lock().await;
-                            conns.push((addr, conn.clone()));
-                            spawn_local(read_loop(conns_clone.clone(), addr, conn, tx.clone()));
-                        },
-                        Err(e) => log::warn!("accept: {e}"),
-                    },
-                    port = request_port_change_rx.recv() => {
-                        let port = port.expect("channel closed");
-                        let listen_addr = SocketAddr::new("0.0.0.0".parse().expect("invalid ip"), port);
-                        match listen(listen_addr, cfg.clone()).await {
-                            Ok(new_listener) => {
-                                let _ = listener.close().await;
-                                listener = new_listener;
-                                port_changed_tx.send(Ok(port)).expect("channel closed");
-                            }
+        let listen_task: JoinHandle<()> = {
+            let listen_tx = listen_tx.clone();
+            let connection_attempts = connection_attempts.clone();
+            spawn_local(async move {
+                loop {
+                    let sleep = tokio::time::sleep(Duration::from_secs(2));
+                    tokio::select! {
+                        /* workaround for https://github.com/webrtc-rs/webrtc/issues/614 */
+                        _ = sleep => continue,
+                        c = listener.accept() => match c {
+                            Ok((conn, addr)) => {
+                                log::info!("dtls client connected, ip: {addr}");
+                                let mut conns = conns_clone.lock().await;
+                                conns.push((addr, conn.clone()));
+                                let dtls_conn: &DTLSConn = conn.as_any().downcast_ref().expect("dtls conn");
+                                let certs = dtls_conn.connection_state().await.peer_certificates;
+                                let cert = certs.first().expect("cert");
+                                let fingerprint = crypto::generate_fingerprint(cert);
+                                listen_tx.send(ListenEvent::Accept { addr, fingerprint }).expect("channel closed");
+                                spawn_local(read_loop(conns_clone.clone(), addr, conn, listen_tx.clone()));
+                            },
                             Err(e) => {
-                                log::warn!("unable to change port: {e}");
-                                port_changed_tx.send(Err(e.into())).expect("channel closed");
+                                if let Error::Std(ref e) = e {
+                                    if let Some(e) = e.0.downcast_ref::<webrtc_dtls::Error>() {
+                                        match e {
+                                            webrtc_dtls::Error::ErrVerifyDataMismatch => {
+                                                if let Some(fingerprint) = connection_attempts.lock().expect("lock").pop_front() {
+                                                    listen_tx.send(ListenEvent::Rejected { fingerprint }).expect("channel closed");
+                                                }
+                                            }
+                                            _ => log::warn!("accept: {e}"),
+                                        }
+                                    } else {
+                                        log::warn!("accept: {e:?}");
+                                    }
+                                } else {
+                                    log::warn!("accept: {e:?}");
+                                }
                             }
-                        };
-                    },
-                };
-            }
-        });
+                        },
+                        port = request_port_change_rx.recv() => {
+                            let port = port.expect("channel closed");
+                            let listen_addr = SocketAddr::new("0.0.0.0".parse().expect("invalid ip"), port);
+                            match listen(listen_addr, cfg.clone()).await {
+                                Ok(new_listener) => {
+                                    let _ = listener.close().await;
+                                    listener = new_listener;
+                                    port_changed_tx.send(Ok(port)).expect("channel closed");
+                                }
+                                Err(e) => {
+                                    log::warn!("unable to change port: {e}");
+                                    port_changed_tx.send(Err(e.into())).expect("channel closed");
+                                }
+                            };
+                        },
+                    };
+                }
+            })
+        };
 
         Ok(Self {
             conns,
@@ -186,7 +235,7 @@ impl LanMouseListener {
 }
 
 impl Stream for LanMouseListener {
-    type Item = (ProtoEvent, SocketAddr);
+    type Item = ListenEvent;
 
     fn poll_next(
         mut self: std::pin::Pin<&mut Self>,
@@ -197,23 +246,25 @@ impl Stream for LanMouseListener {
 }
 
 async fn read_loop(
-    conns: Rc<Mutex<Vec<(SocketAddr, ArcConn)>>>,
+    conns: Rc<AsyncMutex<Vec<(SocketAddr, ArcConn)>>>,
     addr: SocketAddr,
     conn: ArcConn,
-    dtls_tx: Sender<(ProtoEvent, SocketAddr)>,
+    dtls_tx: Sender<ListenEvent>,
 ) -> Result<(), Error> {
     let mut b = [0u8; MAX_EVENT_SIZE];
 
     while conn.recv(&mut b).await.is_ok() {
         match b.try_into() {
-            Ok(event) => dtls_tx.send((event, addr)).expect("channel closed"),
+            Ok(event) => dtls_tx
+                .send(ListenEvent::Msg { event, addr })
+                .expect("channel closed"),
             Err(e) => {
                 log::warn!("error receiving event: {e}");
                 break;
             }
         }
     }
-    log::info!("dtls client disconnected {:?}", addr);
+    log::info!("dtls client disconnected {addr:?}");
     let mut conns = conns.lock().await;
     let index = conns
         .iter()

src/main.rs

@@ -3,15 +3,18 @@ use input_capture::InputCaptureError;
 use input_emulation::InputEmulationError;
 use lan_mouse::{
     capture_test,
-    config::{Config, ConfigError, Frontend},
+    config::{self, Command, Config, ConfigError},
     emulation_test,
     service::{Service, ServiceError},
 };
+use lan_mouse_cli::CliError;
+#[cfg(feature = "gtk")]
+use lan_mouse_gtk::GtkError;
 use lan_mouse_ipc::{IpcError, IpcListenerCreationError};
 use std::{
     future::Future,
     io,
-    process::{self, Child, Command},
+    process::{self, Child},
 };
 use thiserror::Error;
 use tokio::task::LocalSet;
@@ -30,6 +33,11 @@ enum LanMouseError {
     Capture(#[from] InputCaptureError),
     #[error(transparent)]
     Emulation(#[from] InputEmulationError),
+    #[cfg(feature = "gtk")]
+    #[error(transparent)]
+    Gtk(#[from] GtkError),
+    #[error(transparent)]
+    Cli(#[from] CliError),
 }
 
 fn main() {
@@ -44,35 +52,52 @@ fn main() {
 }
 
 fn run() -> Result<(), LanMouseError> {
-    // parse config file + cli args
-    let config = Config::new()?;
-    if config.test_capture {
-        run_async(capture_test::run(config))?;
-    } else if config.test_emulation {
-        run_async(emulation_test::run(config))?;
-    } else if config.daemon {
-        // if daemon is specified we run the service
-        match run_async(run_service(config)) {
-            Err(LanMouseError::Service(ServiceError::IpcListen(
-                IpcListenerCreationError::AlreadyRunning,
-            ))) => log::info!("service already running!"),
-            r => r?,
-        }
-    } else {
-        //  otherwise start the service as a child process and
-        //  run a frontend
-        let mut service = start_service()?;
-        run_frontend(&config)?;
-        #[cfg(unix)]
-        {
-            // on unix we give the service a chance to terminate gracefully
-            let pid = service.id() as libc::pid_t;
-            unsafe {
-                libc::kill(pid, libc::SIGINT);
+    let config = config::Config::new()?;
+    match config.command() {
+        Some(command) => match command {
+            Command::TestEmulation(args) => run_async(emulation_test::run(config, args))?,
+            Command::TestCapture(args) => run_async(capture_test::run(config, args))?,
+            Command::Cli(cli_args) => run_async(lan_mouse_cli::run(cli_args))?,
+            Command::Daemon => {
+                // if daemon is specified we run the service
+                match run_async(run_service(config)) {
+                    Err(LanMouseError::Service(ServiceError::IpcListen(
+                        IpcListenerCreationError::AlreadyRunning,
+                    ))) => log::info!("service already running!"),
+                    r => r?,
+                }
+            }
+        },
+        None => {
+            //  otherwise start the service as a child process and
+            //  run a frontend
+            #[cfg(feature = "gtk")]
+            {
+                let mut service = start_service()?;
+                let res = lan_mouse_gtk::run();
+                #[cfg(unix)]
+                {
+                    // on unix we give the service a chance to terminate gracefully
+                    let pid = service.id() as libc::pid_t;
+                    unsafe {
+                        libc::kill(pid, libc::SIGINT);
+                    }
+                    service.wait()?;
+                }
+                service.kill()?;
+                res?;
+            }
+            #[cfg(not(feature = "gtk"))]
+            {
+                // run daemon if gtk is diabled
+                match run_async(run_service(config)) {
+                    Err(LanMouseError::Service(ServiceError::IpcListen(
+                        IpcListenerCreationError::AlreadyRunning,
+                    ))) => log::info!("service already running!"),
+                    r => r?,
+                }
             }
-            service.wait()?;
         }
-        service.kill()?;
     }
 
     Ok(())
@@ -94,33 +119,20 @@ where
 }
 
 fn start_service() -> Result<Child, io::Error> {
-    let child = Command::new(std::env::current_exe()?)
+    let child = process::Command::new(std::env::current_exe()?)
         .args(std::env::args().skip(1))
-        .arg("--daemon")
+        .arg("daemon")
         .spawn()?;
     Ok(child)
 }
 
 async fn run_service(config: Config) -> Result<(), ServiceError> {
-    log::info!("using config: {:?}", config.path);
-    log::info!("Press {:?} to release the mouse", config.release_bind);
+    let release_bind = config.release_bind();
+    let config_path = config.config_path().to_owned();
     let mut service = Service::new(config).await?;
+    log::info!("using config: {config_path:?}");
+    log::info!("Press {release_bind:?} to release the mouse");
     service.run().await?;
     log::info!("service exited!");
     Ok(())
 }
-
-fn run_frontend(config: &Config) -> Result<(), IpcError> {
-    match config.frontend {
-        #[cfg(feature = "gtk")]
-        Frontend::Gtk => {
-            lan_mouse_gtk::run();
-        }
-        #[cfg(not(feature = "gtk"))]
-        Frontend::Gtk => panic!("gtk frontend requested but feature not enabled!"),
-        Frontend::Cli => {
-            lan_mouse_cli::run()?;
-        }
-    };
-    Ok(())
-}

src/service.rs

@@ -1,7 +1,7 @@
 use crate::{
     capture::{Capture, CaptureType, ICaptureEvent},
     client::ClientManager,
-    config::Config,
+    config::{Config, ConfigClient},
     connect::LanMouseConnection,
     crypto,
     dns::{DnsEvent, DnsResolver},
@@ -9,10 +9,10 @@ use crate::{
     listen::{LanMouseListener, ListenerCreationError},
 };
 use futures::StreamExt;
-use hickory_resolver::error::ResolveError;
+use hickory_resolver::ResolveError;
 use lan_mouse_ipc::{
-    AsyncFrontendListener, ClientConfig, ClientHandle, ClientState, FrontendEvent, FrontendRequest,
-    IpcError, IpcListenerCreationError, Position, Status,
+    AsyncFrontendListener, ClientHandle, FrontendEvent, FrontendRequest, IpcError,
+    IpcListenerCreationError, Position, Status,
 };
 use log;
 use std::{
@@ -39,6 +39,8 @@ pub enum ServiceError {
 }
 
 pub struct Service {
+    /// configuration
+    config: Config,
     /// input capture
     capture: Capture,
     /// input emulation
@@ -80,48 +82,35 @@ struct Incoming {
 impl Service {
     pub async fn new(config: Config) -> Result<Self, ServiceError> {
         let client_manager = ClientManager::default();
-        for client in config.get_clients() {
-            let config = ClientConfig {
-                hostname: client.hostname,
-                fix_ips: client.ips.into_iter().collect(),
-                port: client.port,
-                pos: client.pos,
-                cmd: client.enter_hook,
-            };
-            let state = ClientState {
-                active: client.active,
-                ips: HashSet::from_iter(config.fix_ips.iter().cloned()),
-                ..Default::default()
-            };
-            let handle = client_manager.add_client();
-            client_manager.set_config(handle, config);
-            client_manager.set_state(handle, state);
+        for client in config.clients() {
+            client_manager.add_with_config(client);
         }
 
         // load certificate
-        let cert = crypto::load_or_generate_key_and_cert(&config.cert_path)?;
+        let cert = crypto::load_or_generate_key_and_cert(config.cert_path())?;
         let public_key_fingerprint = crypto::certificate_fingerprint(&cert);
 
         // create frontend communication adapter, exit if already running
         let frontend_listener = AsyncFrontendListener::new().await?;
 
-        let authorized_keys = Arc::new(RwLock::new(config.authorized_fingerprints.clone()));
+        let authorized_keys = Arc::new(RwLock::new(config.authorized_fingerprints()));
         // listener + connection
         let listener =
-            LanMouseListener::new(config.port, cert.clone(), authorized_keys.clone()).await?;
+            LanMouseListener::new(config.port(), cert.clone(), authorized_keys.clone()).await?;
         let conn = LanMouseConnection::new(cert.clone(), client_manager.clone());
 
         // input capture + emulation
-        let capture_backend = config.capture_backend.map(|b| b.into());
-        let capture = Capture::new(capture_backend, conn, config.release_bind.clone());
-        let emulation_backend = config.emulation_backend.map(|b| b.into());
+        let capture_backend = config.capture_backend().map(|b| b.into());
+        let capture = Capture::new(capture_backend, conn, config.release_bind());
+        let emulation_backend = config.emulation_backend().map(|b| b.into());
         let emulation = Emulation::new(emulation_backend, listener);
 
         // create dns resolver
         let resolver = DnsResolver::new()?;
 
-        let port = config.port;
+        let port = config.port();
         let service = Self {
+            config,
             capture,
             emulation,
             frontend_listener,
@@ -142,11 +131,15 @@ impl Service {
     }
 
     pub async fn run(&mut self) -> Result<(), ServiceError> {
-        for handle in self.client_manager.active_clients() {
+        let active = self.client_manager.active_clients();
+        for handle in active.iter() {
             // small hack: `activate_client()` checks, if the client
             // is already active in client_manager and does not create a
             // capture barrier in that case so we have to deactivate it first
-            self.client_manager.deactivate_client(handle);
+            self.client_manager.deactivate_client(*handle);
+        }
+
+        for handle in active {
             self.activate_client(handle);
         }
 
@@ -157,6 +150,7 @@ impl Service {
                 event = self.emulation.event() => self.handle_emulation_event(event),
                 event = self.capture.event() => self.handle_capture_event(event),
                 event = self.resolver.event() => self.handle_resolver_event(event),
+                _ = self.config.changed() => self.handle_config_change(),
                 r = signal::ctrl_c() => break r.expect("failed to wait for CTRL+C"),
             }
         }
@@ -178,24 +172,100 @@ impl Service {
             Err(e) => return log::error!("error receiving request: {e}"),
         };
         match request {
-            FrontendRequest::Activate(handle, active) => self.set_client_active(handle, active),
-            FrontendRequest::AuthorizeKey(desc, fp) => self.add_authorized_key(desc, fp),
+            FrontendRequest::Activate(handle, active) => {
+                self.set_client_active(handle, active);
+                self.save_config();
+            }
+            FrontendRequest::AuthorizeKey(desc, fp) => {
+                self.add_authorized_key(desc, fp);
+                self.save_config();
+            }
             FrontendRequest::ChangePort(port) => self.change_port(port),
-            FrontendRequest::Create => self.add_client(),
-            FrontendRequest::Delete(handle) => self.remove_client(handle),
+            FrontendRequest::Create => {
+                self.add_client();
+                self.save_config();
+            }
+            FrontendRequest::Delete(handle) => {
+                self.remove_client(handle);
+                self.save_config();
+            }
             FrontendRequest::EnableCapture => self.capture.reenable(),
             FrontendRequest::EnableEmulation => self.emulation.reenable(),
             FrontendRequest::Enumerate() => self.enumerate(),
-            FrontendRequest::UpdateFixIps(handle, fix_ips) => self.update_fix_ips(handle, fix_ips),
-            FrontendRequest::UpdateHostname(handle, host) => self.update_hostname(handle, host),
-            FrontendRequest::UpdatePort(handle, port) => self.update_port(handle, port),
-            FrontendRequest::UpdatePosition(handle, pos) => self.update_pos(handle, pos),
+            FrontendRequest::UpdateFixIps(handle, fix_ips) => {
+                self.update_fix_ips(handle, fix_ips);
+                self.save_config();
+            }
+            FrontendRequest::UpdateHostname(handle, host) => {
+                self.update_hostname(handle, host);
+                self.save_config();
+            }
+            FrontendRequest::UpdatePort(handle, port) => {
+                self.update_port(handle, port);
+                self.save_config();
+            }
+            FrontendRequest::UpdatePosition(handle, pos) => {
+                self.update_pos(handle, pos);
+                self.save_config();
+            }
             FrontendRequest::ResolveDns(handle) => self.resolve(handle),
             FrontendRequest::Sync => self.sync_frontend(),
-            FrontendRequest::RemoveAuthorizedKey(key) => self.remove_authorized_key(key),
+            FrontendRequest::RemoveAuthorizedKey(key) => {
+                self.remove_authorized_key(key);
+                self.save_config();
+            }
+            FrontendRequest::UpdateEnterHook(handle, enter_hook) => {
+                self.update_enter_hook(handle, enter_hook)
+            }
+            FrontendRequest::SaveConfiguration => self.save_config(),
         }
     }
 
+    fn save_config(&mut self) {
+        let clients = self.client_manager.clients();
+        let clients = clients
+            .into_iter()
+            .map(|(c, s)| ConfigClient {
+                ips: HashSet::from_iter(c.fix_ips),
+                hostname: c.hostname,
+                port: c.port,
+                pos: c.pos,
+                active: s.active,
+                enter_hook: c.cmd,
+            })
+            .collect();
+        self.config.set_clients(clients);
+        let authorized_keys = self.authorized_keys.read().expect("lock").clone();
+        self.config.set_authorized_keys(authorized_keys);
+        if let Err(e) = self.config.write_back() {
+            log::warn!("failed to write config: {e}");
+        }
+    }
+
+    fn handle_config_change(&mut self) {
+        for h in self.client_manager.registered_clients() {
+            self.remove_client(h);
+        }
+        for c in self.config.clients() {
+            let handle = self.client_manager.add_with_config(c);
+            log::info!("added client {handle}");
+            let (c, s) = self.client_manager.get_state(handle).unwrap();
+            if s.active {
+                self.client_manager.deactivate_client(handle);
+                self.activate_client(handle);
+            }
+            self.notify_frontend(FrontendEvent::Created(handle, c, s));
+        }
+        let release_bind = self.config.release_bind();
+        self.capture.set_release_bind(release_bind);
+        let authorized_keys = self.config.authorized_fingerprints();
+        self.authorized_keys
+            .write()
+            .unwrap()
+            .clone_from(&authorized_keys);
+        self.sync_frontend();
+    }
+
     async fn handle_frontend_pending(&mut self) {
         while let Some(event) = self.pending_frontend_events.pop_front() {
             self.frontend_listener.broadcast(event).await;
@@ -204,7 +274,10 @@ impl Service {
 
     fn handle_emulation_event(&mut self, event: EmulationEvent) {
         match event {
-            EmulationEvent::Connected {
+            EmulationEvent::ConnectionAttempt { fingerprint } => {
+                self.notify_frontend(FrontendEvent::ConnectionAttempt { fingerprint });
+            }
+            EmulationEvent::Entered {
                 addr,
                 pos,
                 fingerprint,
@@ -212,7 +285,11 @@ impl Service {
                 // check if already registered
                 if !self.incoming_conns.contains(&addr) {
                     self.add_incoming(addr, pos, fingerprint.clone());
-                    self.notify_frontend(FrontendEvent::IncomingConnected(fingerprint, addr, pos));
+                    self.notify_frontend(FrontendEvent::DeviceEntered {
+                        fingerprint,
+                        addr,
+                        pos,
+                    });
                 } else {
                     self.update_incoming(addr, pos, fingerprint);
                 }
@@ -239,6 +316,9 @@ impl Service {
                 self.notify_frontend(FrontendEvent::EmulationStatus(self.emulation_status));
             }
             EmulationEvent::ReleaseNotify => self.capture.release(),
+            EmulationEvent::Connected { addr, fingerprint } => {
+                self.notify_frontend(FrontendEvent::DeviceConnected { addr, fingerprint });
+            }
         }
     }
 
@@ -340,7 +420,11 @@ impl Service {
             self.remove_incoming(addr);
             self.add_incoming(addr, pos, fingerprint.clone());
             self.notify_frontend(FrontendEvent::IncomingDisconnected(addr));
-            self.notify_frontend(FrontendEvent::IncomingConnected(fingerprint, addr, pos));
+            self.notify_frontend(FrontendEvent::DeviceEntered {
+                fingerprint,
+                addr,
+                pos,
+            });
         }
     }
 
@@ -404,7 +488,7 @@ impl Service {
     }
 
     fn activate_client(&mut self, handle: ClientHandle) {
-        log::debug!("activating client");
+        log::debug!("activating client {handle}");
 
         /* resolve dns on activate */
         self.resolve(handle);
@@ -476,6 +560,11 @@ impl Service {
         self.broadcast_client(handle);
     }
 
+    fn update_enter_hook(&mut self, handle: ClientHandle, enter_hook: Option<String>) {
+        self.client_manager.set_enter_hook(handle, enter_hook);
+        self.broadcast_client(handle);
+    }
+
     fn broadcast_client(&mut self, handle: ClientHandle) {
         let event = self
             .client_manager