fix: WebviewUrl::App hash fragment bug — tool windows loading empty page

ROOT CAUSE FOUND: WebviewUrl::App takes a PathBuf, not a URL.
Passing "index.html#/tool/ping?sessionId=abc" treated the ENTIRE
string including # and ? as a file path. Tauri looked for a file
literally named "index.html#/tool/ping?sessionId=abc" which doesn't
exist. The webview loaded an empty/404 page and WKWebView killed
the content process, closing the window instantly.

Fix:
- Rust: split URL at '#' — pass only "index.html" to WebviewUrl::App,
  then set the hash fragment via window.eval() after build()
- Vue: App.vue now listens for 'hashchange' event in addition to
  checking hash on mount, so the eval-injected hash triggers the
  correct tool/detached mode

This was NEVER a CSP issue, focus issue, crossorigin issue, or
async chunk loading issue. It was always a bad file path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src-tauri/Cargo.lock

@@ -2991,6 +2991,7 @@ checksum = "47c225751e8fbfaaaac5572a80e25d0a0921e9cf408c55509526161b5609157c"
 dependencies = [
  "ironrdp-connector",
  "ironrdp-core",
+ "ironrdp-displaycontrol",
  "ironrdp-graphics",
  "ironrdp-input",
  "ironrdp-pdu",

src-tauri/Cargo.toml

@@ -65,7 +65,7 @@ ureq = "3"
 png = "0.17"
 
 # RDP (IronRDP)
-ironrdp = { version = "0.14", features = ["connector", "session", "graphics", "input"] }
+ironrdp = { version = "0.14", features = ["connector", "session", "graphics", "input", "displaycontrol"] }
 ironrdp-tokio = { version = "0.8", features = ["reqwest-rustls-ring"] }
 ironrdp-tls = { version = "0.2", features = ["rustls"] }
 tokio-rustls = "0.26"

src-tauri/src/commands/docker_commands.rs

@@ -3,6 +3,7 @@
 use tauri::State;
 use serde::Serialize;
 use crate::AppState;
+use crate::ssh::exec::exec_on_session;
 use crate::utils::shell_escape;
 
 #[derive(Debug, Serialize)]
@@ -38,7 +39,7 @@ pub struct DockerVolume {
 pub async fn docker_list_containers(session_id: String, all: Option<bool>, state: State<'_, AppState>) -> Result<Vec<DockerContainer>, String> {
     let session = state.ssh.get_session(&session_id).ok_or("Session not found")?;
     let flag = if all.unwrap_or(true) { "-a" } else { "" };
-    let output = exec(&session.handle, &format!("docker ps {} --format '{{{{.ID}}}}|{{{{.Names}}}}|{{{{.Image}}}}|{{{{.Status}}}}|{{{{.Ports}}}}|{{{{.CreatedAt}}}}' 2>&1", flag)).await?;
+    let output = exec_on_session(&session.handle, &format!("docker ps {} --format '{{{{.ID}}}}|{{{{.Names}}}}|{{{{.Image}}}}|{{{{.Status}}}}|{{{{.Ports}}}}|{{{{.CreatedAt}}}}' 2>&1", flag)).await?;
     Ok(output.lines().filter(|l| !l.is_empty() && !l.starts_with("CONTAINER")).map(|line| {
         let p: Vec<&str> = line.splitn(6, '|').collect();
         DockerContainer {
@@ -55,7 +56,7 @@ pub async fn docker_list_containers(session_id: String, all: Option<bool>, state
 #[tauri::command]
 pub async fn docker_list_images(session_id: String, state: State<'_, AppState>) -> Result<Vec<DockerImage>, String> {
     let session = state.ssh.get_session(&session_id).ok_or("Session not found")?;
-    let output = exec(&session.handle, "docker images --format '{{.ID}}|{{.Repository}}|{{.Tag}}|{{.Size}}|{{.CreatedAt}}' 2>&1").await?;
+    let output = exec_on_session(&session.handle, "docker images --format '{{.ID}}|{{.Repository}}|{{.Tag}}|{{.Size}}|{{.CreatedAt}}' 2>&1").await?;
     Ok(output.lines().filter(|l| !l.is_empty()).map(|line| {
         let p: Vec<&str> = line.splitn(5, '|').collect();
         DockerImage {
@@ -71,7 +72,7 @@ pub async fn docker_list_images(session_id: String, state: State<'_, AppState>)
 #[tauri::command]
 pub async fn docker_list_volumes(session_id: String, state: State<'_, AppState>) -> Result<Vec<DockerVolume>, String> {
     let session = state.ssh.get_session(&session_id).ok_or("Session not found")?;
-    let output = exec(&session.handle, "docker volume ls --format '{{.Name}}|{{.Driver}}|{{.Mountpoint}}' 2>&1").await?;
+    let output = exec_on_session(&session.handle, "docker volume ls --format '{{.Name}}|{{.Driver}}|{{.Mountpoint}}' 2>&1").await?;
     Ok(output.lines().filter(|l| !l.is_empty()).map(|line| {
         let p: Vec<&str> = line.splitn(3, '|').collect();
         DockerVolume {
@@ -99,19 +100,6 @@ pub async fn docker_action(session_id: String, action: String, target: String, s
         "system-prune-all" => "docker system prune -a -f 2>&1".to_string(),
         _ => return Err(format!("Unknown docker action: {}", action)),
     };
-    exec(&session.handle, &cmd).await
+    exec_on_session(&session.handle, &cmd).await
 }
 
-async fn exec(handle: &std::sync::Arc<tokio::sync::Mutex<russh::client::Handle<crate::ssh::session::SshClient>>>, cmd: &str) -> Result<String, String> {
-    let mut channel = { let h = handle.lock().await; h.channel_open_session().await.map_err(|e| format!("Exec failed: {}", e))? };
-    channel.exec(true, cmd).await.map_err(|e| format!("Exec failed: {}", e))?;
-    let mut output = String::new();
-    loop {
-        match channel.wait().await {
-            Some(russh::ChannelMsg::Data { ref data }) => { if let Ok(t) = std::str::from_utf8(data.as_ref()) { output.push_str(t); } }
-            Some(russh::ChannelMsg::Eof) | Some(russh::ChannelMsg::Close) | None => break,
-            _ => {}
-        }
-    }
-    Ok(output)
-}

src-tauri/src/commands/mod.rs

@@ -14,3 +14,4 @@ pub mod updater;
 pub mod tools_commands_r2;
 pub mod workspace_commands;
 pub mod docker_commands;
+pub mod window_commands;

src-tauri/src/commands/rdp_commands.rs

@@ -19,18 +19,37 @@ pub fn connect_rdp(
     state.rdp.connect(config, app_handle)
 }
 
-/// Get the current frame buffer as raw RGBA bytes via binary IPC.
+/// Get the dirty region since last call as raw RGBA bytes via binary IPC.
 ///
-/// Uses `tauri::ipc::Response` to return raw bytes without JSON serialization.
-/// Pixel format: RGBA, 4 bytes per pixel, row-major, top-left origin.
-/// Returns empty payload if frame hasn't changed since last call.
+/// Binary format: 8-byte header + pixel data
+///   Header: [x: u16, y: u16, width: u16, height: u16] (little-endian)
+///   If header is all zeros, the payload is a full frame (width*height*4 bytes).
+///   If header is non-zero, payload contains only the dirty rectangle pixels.
+/// Returns empty payload if nothing changed.
 #[tauri::command]
-pub async fn rdp_get_frame(
+pub fn rdp_get_frame(
     session_id: String,
     state: State<'_, AppState>,
 ) -> Result<Response, String> {
-    let frame = state.rdp.get_frame(&session_id).await?;
-    Ok(Response::new(frame))
+    let (region, pixels) = state.rdp.get_frame(&session_id)?;
+    if pixels.is_empty() {
+        return Ok(Response::new(Vec::new()));
+    }
+    // Prepend 8-byte dirty rect header
+    let mut out = Vec::with_capacity(8 + pixels.len());
+    match region {
+        Some(rect) => {
+            out.extend_from_slice(&rect.x.to_le_bytes());
+            out.extend_from_slice(&rect.y.to_le_bytes());
+            out.extend_from_slice(&rect.width.to_le_bytes());
+            out.extend_from_slice(&rect.height.to_le_bytes());
+        }
+        None => {
+            out.extend_from_slice(&[0u8; 8]); // full frame marker
+        }
+    }
+    out.extend_from_slice(&pixels);
+    Ok(Response::new(out))
 }
 
 /// Send a mouse event to an RDP session.
@@ -45,7 +64,7 @@ pub async fn rdp_get_frame(
 /// - 0x0100 = negative wheel direction
 /// - 0x0400 = horizontal wheel
 #[tauri::command]
-pub async fn rdp_send_mouse(
+pub fn rdp_send_mouse(
     session_id: String,
     x: u16,
     y: u16,
@@ -63,7 +82,7 @@ pub async fn rdp_send_mouse(
 ///
 /// `pressed` is `true` for key-down, `false` for key-up.
 #[tauri::command]
-pub async fn rdp_send_key(
+pub fn rdp_send_key(
     session_id: String,
     scancode: u16,
     pressed: bool,
@@ -74,7 +93,7 @@ pub async fn rdp_send_key(
 
 /// Send clipboard text to an RDP session by simulating keystrokes.
 #[tauri::command]
-pub async fn rdp_send_clipboard(
+pub fn rdp_send_clipboard(
     session_id: String,
     text: String,
     state: State<'_, AppState>,
@@ -82,11 +101,34 @@ pub async fn rdp_send_clipboard(
     state.rdp.send_clipboard(&session_id, &text)
 }
 
+/// Force the next get_frame to return a full frame regardless of dirty state.
+/// Used when switching tabs or after resize to ensure the canvas is fully repainted.
+#[tauri::command]
+pub fn rdp_force_refresh(
+    session_id: String,
+    state: State<'_, AppState>,
+) -> Result<(), String> {
+    state.rdp.force_refresh(&session_id)
+}
+
+/// Resize the RDP session's desktop resolution.
+/// Sends a Display Control Virtual Channel request to the server.
+/// The server will re-render at the new resolution and send updated frames.
+#[tauri::command]
+pub fn rdp_resize(
+    session_id: String,
+    width: u16,
+    height: u16,
+    state: State<'_, AppState>,
+) -> Result<(), String> {
+    state.rdp.resize(&session_id, width, height)
+}
+
 /// Disconnect an RDP session.
 ///
 /// Sends a graceful shutdown to the RDP server and removes the session.
 #[tauri::command]
-pub async fn disconnect_rdp(
+pub fn disconnect_rdp(
     session_id: String,
     state: State<'_, AppState>,
 ) -> Result<(), String> {
@@ -95,7 +137,7 @@ pub async fn disconnect_rdp(
 
 /// List all active RDP sessions (metadata only).
 #[tauri::command]
-pub async fn list_rdp_sessions(
+pub fn list_rdp_sessions(
     state: State<'_, AppState>,
 ) -> Result<Vec<RdpSessionInfo>, String> {
     Ok(state.rdp.list_sessions())

src-tauri/src/commands/tools_commands.rs

@@ -4,6 +4,7 @@ use tauri::State;
 use serde::Serialize;
 
 use crate::AppState;
+use crate::ssh::exec::exec_on_session;
 use crate::utils::shell_escape;
 
 // ── Ping ─────────────────────────────────────────────────────────────────────
@@ -185,32 +186,3 @@ pub fn tool_generate_password_inner(
     Ok(password)
 }
 
-// ── Helper ───────────────────────────────────────────────────────────────────
-
-async fn exec_on_session(
-    handle: &std::sync::Arc<tokio::sync::Mutex<russh::client::Handle<crate::ssh::session::SshClient>>>,
-    cmd: &str,
-) -> Result<String, String> {
-    let mut channel = {
-        let h = handle.lock().await;
-        h.channel_open_session().await.map_err(|e| format!("Exec channel failed: {}", e))?
-    };
-
-    channel.exec(true, cmd).await.map_err(|e| format!("Exec failed: {}", e))?;
-
-    let mut output = String::new();
-    loop {
-        match channel.wait().await {
-            Some(russh::ChannelMsg::Data { ref data }) => {
-                if let Ok(text) = std::str::from_utf8(data.as_ref()) {
-                    output.push_str(text);
-                }
-            }
-            Some(russh::ChannelMsg::Eof) | Some(russh::ChannelMsg::Close) | None => break,
-            Some(russh::ChannelMsg::ExitStatus { .. }) => {}
-            _ => {}
-        }
-    }
-
-    Ok(output)
-}

src-tauri/src/commands/tools_commands_r2.rs

@@ -4,6 +4,7 @@ use tauri::State;
 use serde::Serialize;
 
 use crate::AppState;
+use crate::ssh::exec::exec_on_session;
 use crate::utils::shell_escape;
 
 // ── DNS Lookup ───────────────────────────────────────────────────────────────
@@ -181,27 +182,3 @@ fn to_ip(val: u32) -> String {
     format!("{}.{}.{}.{}", val >> 24, (val >> 16) & 0xFF, (val >> 8) & 0xFF, val & 0xFF)
 }
 
-// ── Helper ───────────────────────────────────────────────────────────────────
-
-async fn exec_on_session(
-    handle: &std::sync::Arc<tokio::sync::Mutex<russh::client::Handle<crate::ssh::session::SshClient>>>,
-    cmd: &str,
-) -> Result<String, String> {
-    let mut channel = {
-        let h = handle.lock().await;
-        h.channel_open_session().await.map_err(|e| format!("Exec channel failed: {}", e))?
-    };
-    channel.exec(true, cmd).await.map_err(|e| format!("Exec failed: {}", e))?;
-    let mut output = String::new();
-    loop {
-        match channel.wait().await {
-            Some(russh::ChannelMsg::Data { ref data }) => {
-                if let Ok(text) = std::str::from_utf8(data.as_ref()) { output.push_str(text); }
-            }
-            Some(russh::ChannelMsg::Eof) | Some(russh::ChannelMsg::Close) | None => break,
-            Some(russh::ChannelMsg::ExitStatus { .. }) => {}
-            _ => {}
-        }
-    }
-    Ok(output)
-}

src-tauri/src/commands/window_commands.rs

@@ -0,0 +1,40 @@
+use tauri::AppHandle;
+use tauri::WebviewWindowBuilder;
+
+/// Open a child window from the Rust side using WebviewWindowBuilder.
+///
+/// The `url` parameter supports hash fragments (e.g. "index.html#/tool/ping?sessionId=abc").
+/// WebviewUrl::App takes a PathBuf and cannot handle hash/query — so we load plain
+/// index.html and set the hash via JS after the window is created.
+#[tauri::command]
+pub fn open_child_window(
+    app_handle: AppHandle,
+    label: String,
+    title: String,
+    url: String,
+    width: f64,
+    height: f64,
+) -> Result<(), String> {
+    // Split "index.html#/tool/ping?sessionId=abc" into path and fragment
+    let (path, hash) = match url.split_once('#') {
+        Some((p, h)) => (p.to_string(), Some(format!("#{}", h))),
+        None => (url.clone(), None),
+    };
+
+    let webview_url = tauri::WebviewUrl::App(path.into());
+    let window = WebviewWindowBuilder::new(&app_handle, &label, webview_url)
+        .title(&title)
+        .inner_size(width, height)
+        .resizable(true)
+        .center()
+        .build()
+        .map_err(|e| format!("Failed to create window '{}': {}", label, e))?;
+
+    // Set the hash fragment after the window loads — this triggers App.vue's
+    // onMounted hash detection to render the correct tool/detached component.
+    if let Some(hash) = hash {
+        let _ = window.eval(&format!("window.location.hash = '{}';", hash));
+    }
+
+    Ok(())
+}

src-tauri/src/connections/mod.rs

@@ -434,27 +434,49 @@ impl ConnectionService {
     /// Batch-update sort_order for a list of connection IDs.
     pub fn reorder_connections(&self, ids: &[i64]) -> Result<(), String> {
         let conn = self.db.conn();
-        for (i, id) in ids.iter().enumerate() {
-            conn.execute(
-                "UPDATE connections SET sort_order = ?1 WHERE id = ?2",
-                params![i as i64, id],
-            )
-            .map_err(|e| format!("Failed to reorder connection {id}: {e}"))?;
+        conn.execute_batch("BEGIN")
+            .map_err(|e| format!("Failed to begin reorder transaction: {e}"))?;
+        let result = (|| {
+            for (i, id) in ids.iter().enumerate() {
+                conn.execute(
+                    "UPDATE connections SET sort_order = ?1 WHERE id = ?2",
+                    params![i as i64, id],
+                )
+                .map_err(|e| format!("Failed to reorder connection {id}: {e}"))?;
+            }
+            Ok(())
+        })();
+        if result.is_err() {
+            let _ = conn.execute_batch("ROLLBACK");
+        } else {
+            conn.execute_batch("COMMIT")
+                .map_err(|e| format!("Failed to commit reorder transaction: {e}"))?;
         }
-        Ok(())
+        result
     }
 
     /// Batch-update sort_order for a list of group IDs.
     pub fn reorder_groups(&self, ids: &[i64]) -> Result<(), String> {
         let conn = self.db.conn();
-        for (i, id) in ids.iter().enumerate() {
-            conn.execute(
-                "UPDATE groups SET sort_order = ?1 WHERE id = ?2",
-                params![i as i64, id],
-            )
-            .map_err(|e| format!("Failed to reorder group {id}: {e}"))?;
+        conn.execute_batch("BEGIN")
+            .map_err(|e| format!("Failed to begin reorder transaction: {e}"))?;
+        let result = (|| {
+            for (i, id) in ids.iter().enumerate() {
+                conn.execute(
+                    "UPDATE groups SET sort_order = ?1 WHERE id = ?2",
+                    params![i as i64, id],
+                )
+                .map_err(|e| format!("Failed to reorder group {id}: {e}"))?;
+            }
+            Ok(())
+        })();
+        if result.is_err() {
+            let _ = conn.execute_batch("ROLLBACK");
+        } else {
+            conn.execute_batch("COMMIT")
+                .map_err(|e| format!("Failed to commit reorder transaction: {e}"))?;
         }
-        Ok(())
+        result
     }
 }
 

src-tauri/src/lib.rs

@@ -224,7 +224,7 @@ pub fn run() {
             commands::credentials::list_credentials, commands::credentials::create_password, commands::credentials::create_ssh_key, commands::credentials::delete_credential, commands::credentials::decrypt_password, commands::credentials::decrypt_ssh_key,
             commands::ssh_commands::connect_ssh, commands::ssh_commands::connect_ssh_with_key, commands::ssh_commands::ssh_write, commands::ssh_commands::ssh_resize, commands::ssh_commands::disconnect_ssh, commands::ssh_commands::disconnect_session, commands::ssh_commands::list_ssh_sessions,
             commands::sftp_commands::sftp_list, commands::sftp_commands::sftp_read_file, commands::sftp_commands::sftp_write_file, commands::sftp_commands::sftp_mkdir, commands::sftp_commands::sftp_delete, commands::sftp_commands::sftp_rename,
-            commands::rdp_commands::connect_rdp, commands::rdp_commands::rdp_get_frame, commands::rdp_commands::rdp_send_mouse, commands::rdp_commands::rdp_send_key, commands::rdp_commands::rdp_send_clipboard, commands::rdp_commands::disconnect_rdp, commands::rdp_commands::list_rdp_sessions,
+            commands::rdp_commands::connect_rdp, commands::rdp_commands::rdp_get_frame, commands::rdp_commands::rdp_force_refresh, commands::rdp_commands::rdp_send_mouse, commands::rdp_commands::rdp_send_key, commands::rdp_commands::rdp_send_clipboard, commands::rdp_commands::rdp_resize, commands::rdp_commands::disconnect_rdp, commands::rdp_commands::list_rdp_sessions,
             commands::theme_commands::list_themes, commands::theme_commands::get_theme,
             commands::pty_commands::list_available_shells, commands::pty_commands::spawn_local_shell, commands::pty_commands::pty_write, commands::pty_commands::pty_resize, commands::pty_commands::disconnect_pty,
             commands::mcp_commands::mcp_list_sessions, commands::mcp_commands::mcp_terminal_read, commands::mcp_commands::mcp_terminal_execute, commands::mcp_commands::mcp_get_session_context, commands::mcp_commands::mcp_bridge_path,
@@ -234,6 +234,7 @@ pub fn run() {
             commands::updater::check_for_updates,
             commands::workspace_commands::save_workspace, commands::workspace_commands::load_workspace,
             commands::docker_commands::docker_list_containers, commands::docker_commands::docker_list_images, commands::docker_commands::docker_list_volumes, commands::docker_commands::docker_action,
+            commands::window_commands::open_child_window,
         ])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");

src-tauri/src/mcp/mod.rs

@@ -36,7 +36,7 @@ impl ScrollbackRegistry {
 
     /// Get the scrollback buffer for a session.
     pub fn get(&self, session_id: &str) -> Option<Arc<ScrollbackBuffer>> {
-        self.buffers.get(session_id).map(|entry| entry.clone())
+        self.buffers.get(session_id).map(|r| r.value().clone())
     }
 
     /// Remove a session's scrollback buffer.

src-tauri/src/mcp/server.rs

@@ -19,6 +19,7 @@ use tokio::net::TcpListener;
 use crate::mcp::ScrollbackRegistry;
 use crate::rdp::RdpService;
 use crate::sftp::SftpService;
+use crate::ssh::exec::exec_on_session;
 use crate::ssh::session::SshService;
 use crate::utils::shell_escape;
 
@@ -186,7 +187,7 @@ async fn handle_screenshot(
     AxumState(state): AxumState<Arc<McpServerState>>,
     Json(req): Json<ScreenshotRequest>,
 ) -> Json<McpResponse<String>> {
-    match state.rdp.screenshot_png_base64(&req.session_id).await {
+    match state.rdp.screenshot_png_base64(&req.session_id) {
         Ok(b64) => ok_response(b64),
         Err(e) => err_response(e),
     }
@@ -308,32 +309,32 @@ struct ToolPassgenRequest { length: Option<usize>, uppercase: Option<bool>, lowe
 
 async fn handle_tool_ping(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<ToolSessionTarget>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
-    match tool_exec(&session.handle, &format!("ping -c 4 {} 2>&1", shell_escape(&req.target))).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &format!("ping -c 4 {} 2>&1", shell_escape(&req.target))).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_tool_traceroute(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<ToolSessionTarget>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
     let t = shell_escape(&req.target);
-    match tool_exec(&session.handle, &format!("traceroute {} 2>&1 || tracert {} 2>&1", t, t)).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &format!("traceroute {} 2>&1 || tracert {} 2>&1", t, t)).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_tool_dns(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<ToolDnsRequest>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
     let rt = shell_escape(&req.record_type.unwrap_or_else(|| "A".to_string()));
     let d = shell_escape(&req.domain);
-    match tool_exec(&session.handle, &format!("dig {} {} +short 2>/dev/null || nslookup -type={} {} 2>/dev/null || host -t {} {} 2>/dev/null", d, rt, rt, d, rt, d)).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &format!("dig {} {} +short 2>/dev/null || nslookup -type={} {} 2>/dev/null || host -t {} {} 2>/dev/null", d, rt, rt, d, rt, d)).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_tool_whois(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<ToolSessionTarget>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
-    match tool_exec(&session.handle, &format!("whois {} 2>&1 | head -80", shell_escape(&req.target))).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &format!("whois {} 2>&1 | head -80", shell_escape(&req.target))).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_tool_wol(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<ToolWolRequest>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
     let mac_clean = req.mac_address.replace([':', '-'], "");
     let cmd = format!(r#"python3 -c "import socket;mac=bytes.fromhex({});pkt=b'\xff'*6+mac*16;s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM);s.setsockopt(socket.SOL_SOCKET,socket.SO_BROADCAST,1);s.sendto(pkt,('255.255.255.255',9));s.close();print('WoL sent to {}')" 2>&1"#, shell_escape(&mac_clean), shell_escape(&req.mac_address));
-    match tool_exec(&session.handle, &cmd).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &cmd).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_tool_scan_network(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<ToolScanNetworkRequest>) -> Json<McpResponse<serde_json::Value>> {
@@ -364,7 +365,7 @@ async fn handle_tool_subnet(_state: AxumState<Arc<McpServerState>>, Json(req): J
 async fn handle_tool_bandwidth(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<ToolSessionOnly>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
     let cmd = r#"if command -v speedtest-cli >/dev/null 2>&1; then speedtest-cli --simple 2>&1; elif command -v curl >/dev/null 2>&1; then curl -o /dev/null -w "Download: %{speed_download} bytes/sec\n" https://speed.cloudflare.com/__down?bytes=25000000 2>/dev/null; else echo "No speedtest tool found"; fi"#;
-    match tool_exec(&session.handle, cmd).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, cmd).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_tool_keygen(_state: AxumState<Arc<McpServerState>>, Json(req): Json<ToolKeygenRequest>) -> Json<McpResponse<serde_json::Value>> {
@@ -381,20 +382,6 @@ async fn handle_tool_passgen(_state: AxumState<Arc<McpServerState>>, Json(req):
     }
 }
 
-async fn tool_exec(handle: &std::sync::Arc<tokio::sync::Mutex<russh::client::Handle<crate::ssh::session::SshClient>>>, cmd: &str) -> Result<String, String> {
-    let mut channel = { let h = handle.lock().await; h.channel_open_session().await.map_err(|e| format!("Exec failed: {}", e))? };
-    channel.exec(true, cmd).await.map_err(|e| format!("Exec failed: {}", e))?;
-    let mut output = String::new();
-    loop {
-        match channel.wait().await {
-            Some(russh::ChannelMsg::Data { ref data }) => { if let Ok(t) = std::str::from_utf8(data.as_ref()) { output.push_str(t); } }
-            Some(russh::ChannelMsg::Eof) | Some(russh::ChannelMsg::Close) | None => break,
-            _ => {}
-        }
-    }
-    Ok(output)
-}
-
 // ── Docker handlers ──────────────────────────────────────────────────────────
 
 #[derive(Deserialize)]
@@ -408,7 +395,7 @@ struct DockerExecRequest { session_id: String, container: String, command: Strin
 
 async fn handle_docker_ps(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<DockerListRequest>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
-    match tool_exec(&session.handle, "docker ps -a --format '{{.Names}}|{{.Image}}|{{.Status}}|{{.Ports}}' 2>&1").await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, "docker ps -a --format '{{.Names}}|{{.Image}}|{{.Status}}|{{.Ports}}' 2>&1").await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_docker_action(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<DockerActionRequest>) -> Json<McpResponse<String>> {
@@ -424,13 +411,13 @@ async fn handle_docker_action(AxumState(state): AxumState<Arc<McpServerState>>,
         "system-prune" => "docker system prune -f 2>&1".to_string(),
         _ => return err_response(format!("Unknown action: {}", req.action)),
     };
-    match tool_exec(&session.handle, &cmd).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &cmd).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_docker_exec(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<DockerExecRequest>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
     let cmd = format!("docker exec {} {} 2>&1", shell_escape(&req.container), shell_escape(&req.command));
-    match tool_exec(&session.handle, &cmd).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &cmd).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 // ── Service/process handlers ─────────────────────────────────────────────────
@@ -438,13 +425,13 @@ async fn handle_docker_exec(AxumState(state): AxumState<Arc<McpServerState>>, Js
 async fn handle_service_status(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<ToolSessionTarget>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
     let t = shell_escape(&req.target);
-    match tool_exec(&session.handle, &format!("systemctl status {} --no-pager 2>&1 || service {} status 2>&1", t, t)).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &format!("systemctl status {} --no-pager 2>&1 || service {} status 2>&1", t, t)).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_process_list(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<ToolSessionTarget>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
     let filter = if req.target.is_empty() { "aux --sort=-%cpu | head -30".to_string() } else { format!("aux | grep -i {} | grep -v grep", shell_escape(&req.target)) };
-    match tool_exec(&session.handle, &format!("ps {}", filter)).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &format!("ps {}", filter)).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 // ── Git handlers ─────────────────────────────────────────────────────────────
@@ -454,17 +441,17 @@ struct GitRequest { session_id: String, path: String }
 
 async fn handle_git_status(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<GitRequest>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
-    match tool_exec(&session.handle, &format!("cd {} && git status --short --branch 2>&1", shell_escape(&req.path))).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &format!("cd {} && git status --short --branch 2>&1", shell_escape(&req.path))).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_git_pull(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<GitRequest>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
-    match tool_exec(&session.handle, &format!("cd {} && git pull 2>&1", shell_escape(&req.path))).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &format!("cd {} && git pull 2>&1", shell_escape(&req.path))).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 async fn handle_git_log(AxumState(state): AxumState<Arc<McpServerState>>, Json(req): Json<GitRequest>) -> Json<McpResponse<String>> {
     let session = match state.ssh.get_session(&req.session_id) { Some(s) => s, None => return err_response(format!("Session {} not found", req.session_id)) };
-    match tool_exec(&session.handle, &format!("cd {} && git log --oneline -20 2>&1", shell_escape(&req.path))).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
+    match exec_on_session(&session.handle, &format!("cd {} && git log --oneline -20 2>&1", shell_escape(&req.path))).await { Ok(o) => ok_response(o), Err(e) => err_response(e) }
 }
 
 // ── Session creation handlers ────────────────────────────────────────────────

src-tauri/src/rdp/mod.rs

@@ -13,7 +13,7 @@ use serde::{Deserialize, Serialize};
 use tokio::io::{AsyncRead, AsyncWrite};
 use tokio::net::TcpStream;
 use tokio::sync::mpsc;
-use tokio::sync::Mutex as TokioMutex;
+
 
 use ironrdp::connector::{self, ClientConnector, ConnectionResult, Credentials, DesktopSize};
 use ironrdp::graphics::image_processing::PixelFormat;
@@ -63,15 +63,29 @@ enum InputEvent {
         pressed: bool,
     },
     Clipboard(String),
+    Resize { width: u16, height: u16 },
     Disconnect,
 }
 
+/// Dirty rectangle from the last GraphicsUpdate — used for partial frame transfer.
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DirtyRect {
+    pub x: u16,
+    pub y: u16,
+    pub width: u16,
+    pub height: u16,
+}
+
 struct RdpSessionHandle {
     id: String,
     hostname: String,
     width: u16,
     height: u16,
-    frame_buffer: Arc<TokioMutex<Vec<u8>>>,
+    /// Frame buffer: RDP thread writes via RwLock write, IPC reads via RwLock read.
+    front_buffer: Arc<std::sync::RwLock<Vec<u8>>>,
+    /// Accumulated dirty region since last get_frame — union of all GraphicsUpdate rects.
+    dirty_region: Arc<std::sync::Mutex<Option<DirtyRect>>>,
     frame_dirty: Arc<AtomicBool>,
     input_tx: mpsc::UnboundedSender<InputEvent>,
 }
@@ -99,7 +113,8 @@ impl RdpService {
         for pixel in initial_buf.chunks_exact_mut(4) {
             pixel[3] = 255;
         }
-        let frame_buffer = Arc::new(TokioMutex::new(initial_buf));
+        let front_buffer = Arc::new(std::sync::RwLock::new(initial_buf));
+        let dirty_region = Arc::new(std::sync::Mutex::new(None));
         let frame_dirty = Arc::new(AtomicBool::new(false));
 
         let (input_tx, input_rx) = mpsc::unbounded_channel();
@@ -109,7 +124,8 @@ impl RdpService {
             hostname: hostname.clone(),
             width,
             height,
-            frame_buffer: frame_buffer.clone(),
+            front_buffer: front_buffer.clone(),
+            dirty_region: dirty_region.clone(),
             frame_dirty: frame_dirty.clone(),
             input_tx,
         });
@@ -156,7 +172,8 @@ impl RdpService {
                 if let Err(e) = run_active_session(
                     connection_result,
                     framed,
-                    frame_buffer,
+                    front_buffer,
+                    dirty_region,
                     frame_dirty,
                     input_rx,
                     width as u16,
@@ -200,27 +217,57 @@ impl RdpService {
         Ok(session_id)
     }
 
-    pub async fn get_frame(&self, session_id: &str) -> Result<Vec<u8>, String> {
+    /// Get the dirty region since the last call. Returns (region_metadata, pixel_bytes).
+    /// The pixel bytes contain only the dirty rectangle in row-major RGBA order.
+    /// If nothing changed, returns empty bytes. If the dirty region covers >50% of the
+    /// frame, falls back to full frame for efficiency (avoids row-by-row extraction).
+    pub fn get_frame(&self, session_id: &str) -> Result<(Option<DirtyRect>, Vec<u8>), String> {
         let handle = self.sessions.get(session_id).ok_or_else(|| format!("RDP session {} not found", session_id))?;
-        if !handle.frame_dirty.swap(false, Ordering::Relaxed) {
-            return Ok(Vec::new()); // No change — return empty
+        if !handle.frame_dirty.swap(false, Ordering::Acquire) {
+            return Ok((None, Vec::new()));
+        }
+
+        let region = handle.dirty_region.lock().unwrap_or_else(|e| e.into_inner()).take();
+        let buf = handle.front_buffer.read().unwrap_or_else(|e| e.into_inner());
+        let stride = handle.width as usize * 4;
+        let total_pixels = handle.width as usize * handle.height as usize;
+
+        match region {
+            Some(rect) if (rect.width as usize * rect.height as usize) < total_pixels / 2 => {
+                // Partial: extract only the dirty rectangle
+                let rw = rect.width as usize;
+                let rh = rect.height as usize;
+                let rx = rect.x as usize;
+                let ry = rect.y as usize;
+                let mut out = Vec::with_capacity(rw * rh * 4);
+                for row in ry..ry + rh {
+                    let start = row * stride + rx * 4;
+                    let end = start + rw * 4;
+                    if end <= buf.len() {
+                        out.extend_from_slice(&buf[start..end]);
+                    }
+                }
+                Ok((Some(rect), out))
+            }
+            _ => {
+                // Full frame: dirty region covers most of the screen or is missing
+                Ok((None, buf.clone()))
+            }
         }
-        let buf = handle.frame_buffer.lock().await;
-        Ok(buf.clone())
     }
 
-    pub async fn get_frame_raw(&self, session_id: &str) -> Result<Vec<u8>, String> {
+    pub fn get_frame_raw(&self, session_id: &str) -> Result<Vec<u8>, String> {
         let handle = self.sessions.get(session_id).ok_or_else(|| format!("RDP session {} not found", session_id))?;
-        let buf = handle.frame_buffer.lock().await;
+        let buf = handle.front_buffer.read().unwrap_or_else(|e| e.into_inner());
         Ok(buf.clone())
     }
 
     /// Capture the current RDP frame as a base64-encoded PNG.
-    pub async fn screenshot_png_base64(&self, session_id: &str) -> Result<String, String> {
+    pub fn screenshot_png_base64(&self, session_id: &str) -> Result<String, String> {
         let handle = self.sessions.get(session_id).ok_or_else(|| format!("RDP session {} not found", session_id))?;
         let width = handle.width as u32;
         let height = handle.height as u32;
-        let buf = handle.frame_buffer.lock().await;
+        let buf = handle.front_buffer.read().unwrap_or_else(|e| e.into_inner());
 
         // Encode RGBA raw bytes to PNG (fast compression for speed)
         let mut png_data = Vec::new();
@@ -253,6 +300,19 @@ impl RdpService {
         handle.input_tx.send(InputEvent::Key { scancode, pressed }).map_err(|_| format!("RDP session {} input channel closed", session_id))
     }
 
+    pub fn force_refresh(&self, session_id: &str) -> Result<(), String> {
+        let handle = self.sessions.get(session_id).ok_or_else(|| format!("RDP session {} not found", session_id))?;
+        // Clear any accumulated dirty region so get_frame returns the full buffer
+        *handle.dirty_region.lock().unwrap_or_else(|e| e.into_inner()) = None;
+        handle.frame_dirty.store(true, Ordering::Release);
+        Ok(())
+    }
+
+    pub fn resize(&self, session_id: &str, width: u16, height: u16) -> Result<(), String> {
+        let handle = self.sessions.get(session_id).ok_or_else(|| format!("RDP session {} not found", session_id))?;
+        handle.input_tx.send(InputEvent::Resize { width, height }).map_err(|_| format!("RDP session {} input channel closed", session_id))
+    }
+
     pub fn disconnect(&self, session_id: &str) -> Result<(), String> {
         let handle = self.sessions.get(session_id).ok_or_else(|| format!("RDP session {} not found", session_id))?;
         let _ = handle.input_tx.send(InputEvent::Disconnect);
@@ -306,7 +366,11 @@ fn build_connector_config(config: &RdpConfig) -> Result<connector::Config, Strin
         request_data: None,
         autologon: false,
         enable_audio_playback: false,
-        performance_flags: PerformanceFlags::default(),
+        performance_flags: PerformanceFlags::DISABLE_WALLPAPER
+            | PerformanceFlags::DISABLE_MENUANIMATIONS
+            | PerformanceFlags::DISABLE_CURSOR_SHADOW
+            | PerformanceFlags::ENABLE_FONT_SMOOTHING
+            | PerformanceFlags::ENABLE_DESKTOP_COMPOSITION,
         desktop_scale_factor: 0,
         hardware_id: None,
         license_cache: None,
@@ -336,7 +400,7 @@ async fn establish_connection(config: connector::Config, hostname: &str, port: u
     Ok((connection_result, upgraded_framed))
 }
 
-async fn run_active_session(connection_result: ConnectionResult, framed: UpgradedFramed, frame_buffer: Arc<TokioMutex<Vec<u8>>>, frame_dirty: Arc<AtomicBool>, mut input_rx: mpsc::UnboundedReceiver<InputEvent>, width: u16, height: u16, app_handle: tauri::AppHandle, session_id: String) -> Result<(), String> {
+async fn run_active_session(connection_result: ConnectionResult, framed: UpgradedFramed, front_buffer: Arc<std::sync::RwLock<Vec<u8>>>, dirty_region: Arc<std::sync::Mutex<Option<DirtyRect>>>, frame_dirty: Arc<AtomicBool>, mut input_rx: mpsc::UnboundedReceiver<InputEvent>, mut width: u16, mut height: u16, app_handle: tauri::AppHandle, session_id: String) -> Result<(), String> {
     let (mut reader, mut writer) = split_tokio_framed(framed);
     let mut image = DecodedImage::new(PixelFormat::RgbA32, width, height);
     let mut active_stage = ActiveStage::new(connection_result);
@@ -388,18 +452,67 @@ async fn run_active_session(connection_result: ConnectionResult, framed: Upgrade
                         }
                         all_outputs
                     }
+                    Some(InputEvent::Resize { width: new_w, height: new_h }) => {
+                        // Ensure dimensions are within RDP spec (200-8192, even width)
+                        let w = (new_w.max(200).min(8192) & !1) as u32;
+                        let h = new_h.max(200).min(8192) as u32;
+                        if let Some(Ok(resize_frame)) = active_stage.encode_resize(w, h, None, None) {
+                            writer.write_all(&resize_frame).await.map_err(|e| format!("Failed to send resize: {}", e))?;
+                            // Reallocate image and front buffer for new dimensions
+                            image = DecodedImage::new(PixelFormat::RgbA32, w as u16, h as u16);
+                            let buf_size = w as usize * h as usize * 4;
+                            let mut new_buf = vec![0u8; buf_size];
+                            for pixel in new_buf.chunks_exact_mut(4) { pixel[3] = 255; }
+                            *front_buffer.write().unwrap_or_else(|e| e.into_inner()) = new_buf;
+                            width = w as u16;
+                            height = h as u16;
+                            info!("RDP session {} resized to {}x{}", session_id, width, height);
+                        }
+                        Vec::new()
+                    }
                 }
             }
         };
         for out in outputs {
             match out {
                 ActiveStageOutput::ResponseFrame(frame) => { writer.write_all(&frame).await.map_err(|e| format!("Failed to write RDP response frame: {}", e))?; }
-                ActiveStageOutput::GraphicsUpdate(_region) => {
-                    let mut buf = frame_buffer.lock().await;
-                    let src = image.data();
-                    if src.len() == buf.len() { buf.copy_from_slice(src); } else { *buf = src.to_vec(); }
-                    frame_dirty.store(true, Ordering::Relaxed);
-                    // Push frame notification to frontend — no data, just a signal to fetch
+                ActiveStageOutput::GraphicsUpdate(region) => {
+                    let rx = region.left as usize;
+                    let ry = region.top as usize;
+                    let rr = (region.right as usize).saturating_add(1).min(width as usize);
+                    let rb = (region.bottom as usize).saturating_add(1).min(height as usize);
+                    let stride = width as usize * 4;
+
+                    // Copy only the dirty rectangle rows from decoded image → front buffer
+                    {
+                        let src = image.data();
+                        let mut front = front_buffer.write().unwrap_or_else(|e| e.into_inner());
+                        for row in ry..rb {
+                            let src_start = row * stride + rx * 4;
+                            let src_end = row * stride + rr * 4;
+                            if src_end <= src.len() && src_end <= front.len() {
+                                front[src_start..src_end].copy_from_slice(&src[src_start..src_end]);
+                            }
+                        }
+                    }
+
+                    // Accumulate dirty region (union of all rects since last get_frame)
+                    {
+                        let new_rect = DirtyRect { x: rx as u16, y: ry as u16, width: (rr - rx) as u16, height: (rb - ry) as u16 };
+                        let mut dr = dirty_region.lock().unwrap_or_else(|e| e.into_inner());
+                        *dr = Some(match dr.take() {
+                            None => new_rect,
+                            Some(prev) => {
+                                let x = prev.x.min(new_rect.x);
+                                let y = prev.y.min(new_rect.y);
+                                let r = (prev.x + prev.width).max(new_rect.x + new_rect.width);
+                                let b = (prev.y + prev.height).max(new_rect.y + new_rect.height);
+                                DirtyRect { x, y, width: r - x, height: b - y }
+                            }
+                        });
+                    }
+
+                    frame_dirty.store(true, Ordering::Release);
                     let _ = app_handle.emit(&format!("rdp:frame:{}", session_id), ());
                 }
                 ActiveStageOutput::Terminate(reason) => { info!("RDP session terminated: {:?}", reason); return Ok(()); }

src-tauri/src/scanner/mod.rs

@@ -64,11 +64,36 @@ fn service_name(port: u16) -> &'static str {
     }
 }
 
+/// Validate that `subnet` contains exactly three dot-separated octet groups,
+/// each consisting only of 1–3 ASCII digits (e.g. "192.168.1").
+/// Returns an error string if the format is invalid.
+fn validate_subnet(subnet: &str) -> Result<(), String> {
+    let parts: Vec<&str> = subnet.split('.').collect();
+    if parts.len() != 3 {
+        return Err(format!(
+            "Invalid subnet '{}': expected three octets (e.g. 192.168.1)",
+            subnet
+        ));
+    }
+    for part in &parts {
+        if part.is_empty() || part.len() > 3 || !part.chars().all(|c| c.is_ascii_digit()) {
+            return Err(format!(
+                "Invalid subnet '{}': each octet must be 1–3 decimal digits",
+                subnet
+            ));
+        }
+    }
+    Ok(())
+}
+
 /// Discover hosts on the remote network using ARP table and ping sweep.
 pub async fn scan_network(
     handle: &Arc<TokioMutex<Handle<SshClient>>>,
     subnet: &str,
 ) -> Result<Vec<DiscoveredHost>, String> {
+    // Validate subnet format before using it in remote shell commands.
+    validate_subnet(subnet)?;
+
     // Script that works on Linux and macOS:
     // 1. Ping sweep the subnet to populate ARP cache
     // 2. Read ARP table for IP/MAC pairs

src-tauri/src/sftp/mod.rs

@@ -5,7 +5,6 @@
 //! provides all file operations needed by the frontend.
 
 use std::sync::Arc;
-use std::time::{Duration, UNIX_EPOCH};
 
 use dashmap::DashMap;
 use log::{debug, info};
@@ -35,9 +34,6 @@ pub struct FileEntry {
 
 /// Format a Unix timestamp (seconds since epoch) as "Mon DD HH:MM".
 fn format_mtime(unix_secs: u32) -> String {
-    // Build a SystemTime from the raw epoch value.
-    let st = UNIX_EPOCH + Duration::from_secs(unix_secs as u64);
-
     // Convert to seconds-since-epoch for manual formatting.  We avoid pulling
     // in chrono just for this; a simple manual decomposition is sufficient for
     // the "Mar 17 14:30" display format expected by the frontend.
@@ -54,12 +50,10 @@ fn format_mtime(unix_secs: u32) -> String {
     let era = if z >= 0 { z } else { z - 146_096 } / 146_097;
     let doe = z - era * 146_097;
     let yoe = (doe - doe / 1_460 + doe / 36_524 - doe / 146_096) / 365;
-    let y = yoe + era * 400;
     let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
     let mp = (5 * doy + 2) / 153;
     let d = doy - (153 * mp + 2) / 5 + 1;
     let m = if mp < 10 { mp + 3 } else { mp - 9 };
-    let _y = if m <= 2 { y + 1 } else { y };
 
     let month = match m {
         1 => "Jan",
@@ -77,9 +71,6 @@ fn format_mtime(unix_secs: u32) -> String {
         _ => "???",
     };
 
-    // Suppress unused variable warning — st is only used as a sanity anchor.
-    let _ = st;
-
     format!("{} {:2} {:02}:{:02}", month, d, hours, minutes)
 }
 
@@ -319,7 +310,7 @@ impl SftpService {
     ) -> Result<Arc<TokioMutex<SftpSession>>, String> {
         self.clients
             .get(session_id)
-            .map(|r| r.clone())
+            .map(|r| r.value().clone())
             .ok_or_else(|| format!("No SFTP client for session {}", session_id))
     }
 }

src-tauri/src/ssh/exec.rs

@@ -0,0 +1,51 @@
+//! Shared SSH exec-channel helper used by commands, MCP handlers, and tools.
+//!
+//! Opens a one-shot exec channel on an existing SSH handle, runs `cmd`, collects
+//! all stdout/stderr, and returns it as a `String`.  The caller is responsible
+//! for ensuring the session is still alive.
+
+use std::sync::Arc;
+
+use tokio::sync::Mutex as TokioMutex;
+
+use crate::ssh::session::SshClient;
+
+/// Execute `cmd` on a separate exec channel and return all output as a `String`.
+///
+/// Locks the handle for only as long as it takes to open the channel, then
+/// releases it before reading — this avoids holding the lock while waiting on
+/// remote I/O.
+pub async fn exec_on_session(
+    handle: &Arc<TokioMutex<russh::client::Handle<SshClient>>>,
+    cmd: &str,
+) -> Result<String, String> {
+    let mut channel = {
+        let h = handle.lock().await;
+        h.channel_open_session()
+            .await
+            .map_err(|e| format!("Exec channel failed: {}", e))?
+    };
+
+    channel
+        .exec(true, cmd)
+        .await
+        .map_err(|e| format!("Exec failed: {}", e))?;
+
+    let mut output = String::new();
+    loop {
+        match channel.wait().await {
+            Some(russh::ChannelMsg::Data { ref data }) => {
+                if let Ok(text) = std::str::from_utf8(data.as_ref()) {
+                    output.push_str(text);
+                }
+            }
+            Some(russh::ChannelMsg::Eof)
+            | Some(russh::ChannelMsg::Close)
+            | None => break,
+            Some(russh::ChannelMsg::ExitStatus { .. }) => {}
+            _ => {}
+        }
+    }
+
+    Ok(output)
+}

src-tauri/src/ssh/mod.rs

@@ -2,3 +2,4 @@ pub mod session;
 pub mod host_key;
 pub mod cwd;
 pub mod monitor;
+pub mod exec;

src-tauri/src/ssh/session.rs

@@ -258,7 +258,7 @@ impl SshService {
     }
 
     pub fn get_session(&self, session_id: &str) -> Option<Arc<SshSession>> {
-        self.sessions.get(session_id).map(|entry| entry.clone())
+        self.sessions.get(session_id).map(|r| r.value().clone())
     }
 
     pub fn list_sessions(&self) -> Vec<SessionInfo> {
@@ -405,22 +405,23 @@ fn extract_osc7_cwd(data: &[u8]) -> Option<String> {
 }
 
 fn percent_decode(input: &str) -> String {
-    let mut output = String::with_capacity(input.len());
+    let mut bytes: Vec<u8> = Vec::with_capacity(input.len());
     let mut chars = input.chars();
     while let Some(ch) = chars.next() {
         if ch == '%' {
             let hex: String = chars.by_ref().take(2).collect();
             if let Ok(byte) = u8::from_str_radix(&hex, 16) {
-                output.push(byte as char);
+                bytes.push(byte);
             } else {
-                output.push('%');
-                output.push_str(&hex);
+                bytes.extend_from_slice(b"%");
+                bytes.extend_from_slice(hex.as_bytes());
             }
         } else {
-            output.push(ch);
+            let mut buf = [0u8; 4];
+            bytes.extend_from_slice(ch.encode_utf8(&mut buf).as_bytes());
         }
     }
-    output
+    String::from_utf8_lossy(&bytes).into_owned()
 }
 
 /// Resolve a private key string — if it looks like PEM content, return as-is.

src-tauri/src/theme/mod.rs

@@ -59,6 +59,7 @@ struct BuiltinTheme {
 
 // ── service ───────────────────────────────────────────────────────────────────
 
+#[derive(Clone)]
 pub struct ThemeService {
     db: Database,
 }
@@ -253,7 +254,7 @@ impl ThemeService {
                     t.bright_blue, t.bright_magenta, t.bright_cyan, t.bright_white,
                 ],
             ) {
-                eprintln!("theme::seed_builtins: failed to seed '{}': {}", t.name, e);
+                wraith_log!("theme::seed_builtins: failed to seed '{}': {}", t.name, e);
             }
         }
     }
@@ -272,7 +273,7 @@ impl ThemeService {
         ) {
             Ok(s) => s,
             Err(e) => {
-                eprintln!("theme::list: failed to prepare query: {}", e);
+                wraith_log!("theme::list: failed to prepare query: {}", e);
                 return vec![];
             }
         };
@@ -280,12 +281,12 @@ impl ThemeService {
         match stmt.query_map([], map_theme_row) {
             Ok(rows) => rows
                 .filter_map(|r| {
-                    r.map_err(|e| eprintln!("theme::list: row error: {}", e))
+                    r.map_err(|e| wraith_log!("theme::list: row error: {}", e))
                         .ok()
                 })
                 .collect(),
             Err(e) => {
-                eprintln!("theme::list: query failed: {}", e);
+                wraith_log!("theme::list: query failed: {}", e);
                 vec![]
             }
         }

src-tauri/src/workspace/mod.rs

@@ -24,6 +24,7 @@ pub struct WorkspaceSnapshot {
 const SNAPSHOT_KEY: &str = "workspace_snapshot";
 const CLEAN_SHUTDOWN_KEY: &str = "clean_shutdown";
 
+#[derive(Clone)]
 pub struct WorkspaceService {
     settings: SettingsService,
 }
@@ -47,7 +48,7 @@ impl WorkspaceService {
     pub fn load(&self) -> Option<WorkspaceSnapshot> {
         let json = self.settings.get(SNAPSHOT_KEY)?;
         serde_json::from_str(&json)
-            .map_err(|e| eprintln!("workspace::load: failed to deserialize snapshot: {e}"))
+            .map_err(|e| wraith_log!("workspace::load: failed to deserialize snapshot: {e}"))
             .ok()
     }
 

src-tauri/tauri.conf.json

@@ -18,11 +18,12 @@
         "minHeight": 600,
         "decorations": true,
         "resizable": true,
-        "dragDropEnabled": false
+        "dragDropEnabled": false,
+        "additionalBrowserArgs": "--enable-gpu-rasterization --enable-zero-copy --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection"
       }
     ],
     "security": {
-      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' asset: https://asset.localhost data:; connect-src 'self' ipc: http://ipc.localhost"
+      "csp": null
     },
     "withGlobalTauri": false
   },

src/App.vue

@@ -1,48 +1,65 @@
 <script setup lang="ts">
-import { ref, onMounted, defineAsyncComponent } from "vue";
+import { ref, onMounted, onErrorCaptured, defineAsyncComponent } from "vue";
 import { useAppStore } from "@/stores/app.store";
 import UnlockLayout from "@/layouts/UnlockLayout.vue";
+import ToolWindow from "@/components/tools/ToolWindow.vue";
 
-const MainLayout = defineAsyncComponent(
-  () => import("@/layouts/MainLayout.vue")
-);
-const ToolWindow = defineAsyncComponent(
-  () => import("@/components/tools/ToolWindow.vue")
-);
-const DetachedSession = defineAsyncComponent(
-  () => import("@/components/session/DetachedSession.vue")
-);
+const MainLayout = defineAsyncComponent({
+  loader: () => import("@/layouts/MainLayout.vue"),
+  onError(error) { console.error("[App] MainLayout load failed:", error); },
+});
+const DetachedSession = defineAsyncComponent({
+  loader: () => import("@/components/session/DetachedSession.vue"),
+  onError(error) { console.error("[App] DetachedSession load failed:", error); },
+});
 
 const app = useAppStore();
+const appError = ref<string | null>(null);
 
-// Tool window mode — detected from URL hash: #/tool/network-scanner?sessionId=abc
 const isToolMode = ref(false);
 const isDetachedMode = ref(false);
 const toolName = ref("");
 const toolSessionId = ref("");
 
-onMounted(async () => {
-  const hash = window.location.hash;
+onErrorCaptured((err) => {
+  appError.value = err instanceof Error ? err.message : String(err);
+  console.error("[App] Uncaught error:", err);
+  return false;
+});
+
+/** Parse hash and set mode flags. Called on mount and on hashchange. */
+function applyHash(hash: string): void {
   if (hash.startsWith("#/tool/")) {
     isToolMode.value = true;
-    const rest = hash.substring(7); // after "#/tool/"
+    const rest = hash.substring(7);
     const [name, query] = rest.split("?");
     toolName.value = name;
     toolSessionId.value = new URLSearchParams(query || "").get("sessionId") || "";
   } else if (hash.startsWith("#/detached-session")) {
     isDetachedMode.value = true;
-  } else {
+  }
+}
+
+onMounted(async () => {
+  // Check hash at load time (present if JS-side WebviewWindow set it in the URL)
+  applyHash(window.location.hash);
+
+  // Also listen for hash changes (Rust-side window sets hash via eval after load)
+  window.addEventListener("hashchange", () => applyHash(window.location.hash));
+
+  // Only init vault for the main app window (no hash)
+  if (!isToolMode.value && !isDetachedMode.value) {
     await app.checkVaultState();
   }
 });
 </script>
 
 <template>
-  <!-- Detached session window mode -->
-  <DetachedSession v-if="isDetachedMode" />
-  <!-- Tool popup window mode -->
+  <div v-if="appError" class="fixed inset-0 z-50 flex items-center justify-center bg-[#0d1117] text-red-400 p-8 text-sm font-mono whitespace-pre-wrap">
+    {{ appError }}
+  </div>
+  <DetachedSession v-else-if="isDetachedMode" />
   <ToolWindow v-else-if="isToolMode" :tool="toolName" :session-id="toolSessionId" />
-  <!-- Normal app mode -->
   <div v-else class="app-root">
     <UnlockLayout v-if="!app.isUnlocked" />
     <MainLayout v-else />

src/assets/css/terminal.css

@@ -2,7 +2,7 @@
 
 .terminal-container {
   width: 100%;
-  height: 100%;
+  min-height: 0;
   position: relative;
   overflow: hidden;
   background: var(--wraith-bg-primary);
@@ -20,14 +20,16 @@
   height: 100%;
 }
 
-/* Selection styling */
-.terminal-container .xterm-selection div {
-  background-color: rgba(88, 166, 255, 0.3) !important;
-}
-
-/* Cursor styling */
-.terminal-container .xterm-cursor-layer {
-  z-index: 4;
+/* WKWebView focus fix: xterm.js hides its helper textarea with opacity: 0,
+   width/height: 0, left: -9999em. macOS WKWebView doesn't reliably focus
+   elements with zero dimensions positioned off-screen. Override to keep it
+   within the viewport with non-zero dimensions so focus events fire. */
+.terminal-container .xterm .xterm-helper-textarea {
+  left: 0 !important;
+  top: 0 !important;
+  width: 1px !important;
+  height: 1px !important;
+  opacity: 0.01 !important;
 }
 
 /* Scrollbar inside terminal */

src/components/common/StatusBar.vue

@@ -1,5 +1,5 @@
 <template>
-  <div class="h-6 flex items-center justify-between px-4 bg-[var(--wraith-bg-secondary)] border-t border-[var(--wraith-border)] text-[10px] text-[var(--wraith-text-muted)] shrink-0">
+  <div class="h-[48px] flex items-center justify-between px-6 bg-[var(--wraith-bg-secondary)] border-t border-[var(--wraith-border)] text-base text-[var(--wraith-text-muted)] shrink-0">
     <!-- Left: connection info -->
     <div class="flex items-center gap-3">
       <template v-if="sessionStore.activeSession">

src/components/common/ThemePicker.vue

@@ -112,6 +112,8 @@ export interface ThemeDefinition {
   brightMagenta: string;
   brightCyan: string;
   brightWhite: string;
+  selectionBackground?: string;
+  selectionForeground?: string;
   isBuiltin?: boolean;
 }
 

src/components/rdp/RdpView.vue

@@ -28,7 +28,8 @@
 </template>
 
 <script setup lang="ts">
-import { ref, onMounted, onBeforeUnmount, watch } from "vue";
+import { ref, computed, onMounted, onBeforeUnmount, watch } from "vue";
+import { invoke } from "@tauri-apps/api/core";
 import { useRdp, MouseFlag } from "@/composables/useRdp";
 
 const props = defineProps<{
@@ -42,8 +43,8 @@ const containerRef = ref<HTMLElement | null>(null);
 const canvasWrapper = ref<HTMLElement | null>(null);
 const canvasRef = ref<HTMLCanvasElement | null>(null);
 
-const rdpWidth = props.width ?? 1920;
-const rdpHeight = props.height ?? 1080;
+const rdpWidth = computed(() => props.width ?? 1920);
+const rdpHeight = computed(() => props.height ?? 1080);
 
 const {
   connected,
@@ -76,8 +77,8 @@ function toRdpCoords(e: MouseEvent): { x: number; y: number } | null {
   if (!canvas) return null;
 
   const rect = canvas.getBoundingClientRect();
-  const scaleX = rdpWidth / rect.width;
-  const scaleY = rdpHeight / rect.height;
+  const scaleX = canvas.width / rect.width;
+  const scaleY = canvas.height / rect.height;
 
   return {
     x: Math.floor((e.clientX - rect.left) * scaleX),
@@ -153,25 +154,95 @@ function handleKeyUp(e: KeyboardEvent): void {
   sendKey(props.sessionId, e.code, false);
 }
 
+let resizeObserver: ResizeObserver | null = null;
+let resizeTimeout: ReturnType<typeof setTimeout> | null = null;
+
 onMounted(() => {
   if (canvasRef.value) {
-    startFrameLoop(props.sessionId, canvasRef.value, rdpWidth, rdpHeight);
+    startFrameLoop(props.sessionId, canvasRef.value, rdpWidth.value, rdpHeight.value);
+  }
+
+  // Watch container size and request server-side RDP resize (debounced 500ms)
+  if (canvasWrapper.value) {
+    resizeObserver = new ResizeObserver((entries) => {
+      const entry = entries[0];
+      if (!entry || !connected.value) return;
+      const { width: cw, height: ch } = entry.contentRect;
+      if (cw < 200 || ch < 200) return;
+
+      // Round to even width (RDP spec requirement)
+      const newW = Math.round(cw) & ~1;
+      const newH = Math.round(ch);
+
+      if (resizeTimeout) clearTimeout(resizeTimeout);
+      resizeTimeout = setTimeout(() => {
+        invoke("rdp_resize", {
+          sessionId: props.sessionId,
+          width: newW,
+          height: newH,
+        }).then(() => {
+          if (canvasRef.value) {
+            canvasRef.value.width = newW;
+            canvasRef.value.height = newH;
+          }
+          // Force full frame after resize so canvas gets a clean repaint
+          setTimeout(() => {
+            invoke("rdp_force_refresh", { sessionId: props.sessionId }).catch(() => {});
+          }, 200);
+        }).catch((err: unknown) => {
+          console.warn("[RdpView] resize failed:", err);
+        });
+      }, 500);
+    });
+    resizeObserver.observe(canvasWrapper.value);
   }
 });
 
 onBeforeUnmount(() => {
   stopFrameLoop();
+  if (resizeObserver) { resizeObserver.disconnect(); resizeObserver = null; }
+  if (resizeTimeout) { clearTimeout(resizeTimeout); resizeTimeout = null; }
 });
 
-// Focus canvas when this tab becomes active and keyboard is grabbed
+// Focus canvas, re-check dimensions, and force full frame on tab switch.
+// Uses 300ms delay to let the flex layout fully settle (copilot panel toggle, etc.)
 watch(
   () => props.isActive,
   (active) => {
-    if (active && keyboardGrabbed.value && canvasRef.value) {
-      setTimeout(() => {
-        canvasRef.value?.focus();
-      }, 0);
-    }
+    if (!active || !canvasRef.value) return;
+
+    // Immediate focus so keyboard works right away
+    if (keyboardGrabbed.value) canvasRef.value.focus();
+
+    // Immediate force refresh to show SOMETHING while we check dimensions
+    invoke("rdp_force_refresh", { sessionId: props.sessionId }).catch(() => {});
+
+    // Delayed dimension check — layout needs time to settle
+    setTimeout(() => {
+      const wrapper = canvasWrapper.value;
+      const canvas = canvasRef.value;
+      if (!wrapper || !canvas) return;
+
+      const { width: cw, height: ch } = wrapper.getBoundingClientRect();
+      const newW = Math.round(cw) & ~1;
+      const newH = Math.round(ch);
+
+      if (newW >= 200 && newH >= 200 && (newW !== canvas.width || newH !== canvas.height)) {
+        invoke("rdp_resize", {
+          sessionId: props.sessionId,
+          width: newW,
+          height: newH,
+        }).then(() => {
+          if (canvas) {
+            canvas.width = newW;
+            canvas.height = newH;
+          }
+          setTimeout(() => {
+            invoke("rdp_force_refresh", { sessionId: props.sessionId }).catch(() => {});
+          }, 500);
+        }).catch(() => {});
+      }
+    }, 300);
   },
 );
 </script>
@@ -196,9 +267,8 @@ watch(
 }
 
 .rdp-canvas {
-  max-width: 100%;
-  max-height: 100%;
-  object-fit: contain;
+  width: 100%;
+  height: 100%;
   cursor: default;
   outline: none;
   image-rendering: auto;

src/components/session/TabBar.vue

@@ -133,16 +133,14 @@ async function detachTab(): Promise<void> {
   session.active = false;
 
   // Open a new Tauri window for this session
-  const { WebviewWindow } = await import("@tauri-apps/api/webviewWindow");
-  const label = `detached-${session.id.substring(0, 8)}-${Date.now()}`;
-  new WebviewWindow(label, {
-    title: `${session.name} — Wraith`,
-    width: 900,
-    height: 600,
-    resizable: true,
-    center: true,
-    url: `index.html#/detached-session?sessionId=${session.id}&name=${encodeURIComponent(session.name)}&protocol=${session.protocol}`,
-  });
+  try {
+    await invoke("open_child_window", {
+      label: `detached-${session.id.substring(0, 8)}-${Date.now()}`,
+      title: `${session.name} — Wraith`,
+      url: `index.html#/detached-session?sessionId=${session.id}&name=${encodeURIComponent(session.name)}&protocol=${session.protocol}`,
+      width: 900, height: 600,
+    });
+  } catch (err) { console.error("Detach window error:", err); }
 }
 
 function closeMenuTab(): void {

src/components/terminal/LocalTerminalView.vue

@@ -12,6 +12,7 @@
 import { ref, onMounted, onBeforeUnmount, watch } from "vue";
 import { invoke } from "@tauri-apps/api/core";
 import { useTerminal } from "@/composables/useTerminal";
+import { useSessionStore } from "@/stores/session.store";
 import "@/assets/css/terminal.css";
 
 const props = defineProps<{
@@ -19,13 +20,57 @@ const props = defineProps<{
   isActive: boolean;
 }>();
 
+const sessionStore = useSessionStore();
 const containerRef = ref<HTMLElement | null>(null);
 const { terminal, mount, fit, destroy } = useTerminal(props.sessionId, "pty");
 
+/** Apply the session store's active theme to this local terminal instance. */
+function applyTheme(): void {
+  const theme = sessionStore.activeTheme;
+  if (!theme) return;
+  terminal.options.theme = {
+    background: theme.background,
+    foreground: theme.foreground,
+    cursor: theme.cursor,
+    cursorAccent: theme.background,
+    selectionBackground: theme.selectionBackground ?? "#264f78",
+    selectionForeground: theme.selectionForeground ?? "#ffffff",
+    selectionInactiveBackground: theme.selectionBackground ?? "#264f78",
+    black: theme.black,
+    red: theme.red,
+    green: theme.green,
+    yellow: theme.yellow,
+    blue: theme.blue,
+    magenta: theme.magenta,
+    cyan: theme.cyan,
+    white: theme.white,
+    brightBlack: theme.brightBlack,
+    brightRed: theme.brightRed,
+    brightGreen: theme.brightGreen,
+    brightYellow: theme.brightYellow,
+    brightBlue: theme.brightBlue,
+    brightMagenta: theme.brightMagenta,
+    brightCyan: theme.brightCyan,
+    brightWhite: theme.brightWhite,
+  };
+
+  if (containerRef.value) {
+    containerRef.value.style.backgroundColor = theme.background;
+  }
+
+  terminal.refresh(0, terminal.rows - 1);
+}
+
 onMounted(() => {
   if (containerRef.value) {
     mount(containerRef.value);
   }
+
+  // Apply current theme immediately if one is already active
+  if (sessionStore.activeTheme) {
+    applyTheme();
+  }
+
   setTimeout(() => {
     fit();
     terminal.focus();
@@ -56,6 +101,11 @@ watch(
   },
 );
 
+// Watch for theme changes and apply to this local terminal
+watch(() => sessionStore.activeTheme, (newTheme) => {
+  if (newTheme) applyTheme();
+}, { deep: true });
+
 onBeforeUnmount(() => {
   destroy();
 });

src/components/terminal/MonitorBar.vue

@@ -1,7 +1,7 @@
 <template>
   <div
     v-if="stats"
-    class="flex items-center gap-4 px-3 h-6 bg-[var(--wraith-bg-tertiary)] border-t border-[var(--wraith-border)] text-[10px] font-mono shrink-0 select-none"
+    class="flex items-center gap-4 px-6 h-[48px] bg-[var(--wraith-bg-tertiary)] border-t border-[var(--wraith-border)] text-base font-mono shrink-0 select-none"
   >
     <!-- CPU -->
     <span class="flex items-center gap-1">

src/components/terminal/TerminalView.vue

@@ -77,6 +77,10 @@ const containerRef = ref<HTMLElement | null>(null);
 const { terminal, searchAddon, mount, fit } = useTerminal(props.sessionId);
 let resizeDisposable: IDisposable | null = null;
 
+function handleFocus(): void {
+  terminal.focus();
+}
+
 // --- Search state ---
 const searchVisible = ref(false);
 const searchQuery = ref("");
@@ -185,6 +189,10 @@ function applyTheme(): void {
     background: theme.background,
     foreground: theme.foreground,
     cursor: theme.cursor,
+    cursorAccent: theme.background,
+    selectionBackground: theme.selectionBackground ?? "#264f78",
+    selectionForeground: theme.selectionForeground ?? "#ffffff",
+    selectionInactiveBackground: theme.selectionBackground ?? "#264f78",
     black: theme.black,
     red: theme.red,
     green: theme.green,
@@ -202,12 +210,22 @@ function applyTheme(): void {
     brightCyan: theme.brightCyan,
     brightWhite: theme.brightWhite,
   };
+
+  // Sync the container background so areas outside the canvas match the theme
+  if (containerRef.value) {
+    containerRef.value.style.backgroundColor = theme.background;
+  }
+
+  // Force xterm.js to repaint all visible rows with the new theme colors
+  terminal.refresh(0, terminal.rows - 1);
 }
 
-// Watch for theme changes in the session store and apply to this terminal
+// Watch for theme changes in the session store and apply to this terminal.
+// Uses deep comparison because the theme is an object — a shallow watch may miss
+// updates if Pinia returns the same reactive proxy wrapper after reassignment.
 watch(() => sessionStore.activeTheme, (newTheme) => {
   if (newTheme) applyTheme();
-});
+}, { deep: true });
 
 onBeforeUnmount(() => {
   if (resizeDisposable) {
@@ -215,8 +233,4 @@ onBeforeUnmount(() => {
     resizeDisposable = null;
   }
 });
-
-function handleFocus(): void {
-  terminal.focus();
-}
 </script>

src/composables/useRdp.ts

@@ -158,8 +158,8 @@ export interface UseRdpReturn {
   keyboardGrabbed: Ref<boolean>;
   /** Whether clipboard sync is enabled */
   clipboardSync: Ref<boolean>;
-  /** Fetch the current frame as RGBA ImageData */
-  fetchFrame: (sessionId: string, width: number, height: number) => Promise<ImageData | null>;
+  /** Fetch and render the dirty region directly to a canvas context */
+  fetchAndRender: (sessionId: string, width: number, height: number, ctx: CanvasRenderingContext2D) => Promise<boolean>;
   /** Send a mouse event to the backend */
   sendMouse: (sessionId: string, x: number, y: number, flags: number) => void;
   /** Send a key event to the backend */
@@ -199,38 +199,50 @@ export function useRdp(): UseRdpReturn {
   let unlistenFrame: (() => void) | null = null;
 
   /**
-   * Fetch the current frame from the Rust RDP backend.
+   * Fetch the dirty region from the Rust RDP backend and apply it to the canvas.
    *
-   * rdp_get_frame returns raw RGBA bytes (width*height*4) serialised as a
-   * base64 string over Tauri's IPC bridge. We decode it to Uint8ClampedArray
-   * and wrap in an ImageData for putImageData().
+   * Binary format from backend: 8-byte header + pixel data
+   *   Header: [x: u16, y: u16, w: u16, h: u16] (little-endian)
+   *   If header is all zeros → full frame (width*height*4 bytes)
+   *   If header is non-zero → dirty rectangle (w*h*4 bytes)
+   *
+   * Returns true if a frame was rendered, false if nothing changed.
    */
-  async function fetchFrame(
+  async function fetchAndRender(
     sessionId: string,
     width: number,
     height: number,
-  ): Promise<ImageData | null> {
+    ctx: CanvasRenderingContext2D,
+  ): Promise<boolean> {
     let raw: ArrayBuffer;
     try {
       raw = await invoke<ArrayBuffer>("rdp_get_frame", { sessionId });
     } catch {
-      return null;
+      return false;
     }
 
-    if (!raw || raw.byteLength === 0) return null;
+    if (!raw || raw.byteLength <= 8) return false;
 
-    // Binary IPC — tauri::ipc::Response delivers raw bytes as ArrayBuffer
-    const bytes = new Uint8ClampedArray(raw);
+    const view = new DataView(raw);
+    const rx = view.getUint16(0, true);
+    const ry = view.getUint16(2, true);
+    const rw = view.getUint16(4, true);
+    const rh = view.getUint16(6, true);
+    const pixelData = new Uint8ClampedArray(raw, 8);
 
-    const expected = width * height * 4;
-    if (bytes.length !== expected) {
-      console.warn(
-        `[useRdp] Frame size mismatch: got ${bytes.length}, expected ${expected}`,
-      );
-      return null;
+    if (rx === 0 && ry === 0 && rw === 0 && rh === 0) {
+      // Full frame
+      const expected = width * height * 4;
+      if (pixelData.length !== expected) return false;
+      ctx.putImageData(new ImageData(pixelData, width, height), 0, 0);
+    } else {
+      // Dirty rectangle — apply at offset
+      const expected = rw * rh * 4;
+      if (pixelData.length !== expected) return false;
+      ctx.putImageData(new ImageData(pixelData, rw, rh), rx, ry);
     }
 
-    return new ImageData(bytes, width, height);
+    return true;
   }
 
   /**
@@ -299,30 +311,35 @@ export function useRdp(): UseRdpReturn {
     canvas.height = height;
 
     let fetchPending = false;
+    let rafScheduled = false;
 
-    // Fetch frame when backend signals a new frame is ready
-    async function onFrameReady(): Promise<void> {
-      if (fetchPending) return; // Don't stack fetches
-      fetchPending = true;
-      const imageData = await fetchFrame(sessionId, width, height);
-      fetchPending = false;
-      if (imageData && ctx) {
-        ctx.putImageData(imageData, 0, 0);
-        if (!connected.value) connected.value = true;
-      }
+    // Fetch and render dirty region when backend signals new frame data.
+    // Uses rAF to coalesce rapid events into one fetch per display frame.
+    function scheduleFrameFetch(): void {
+      if (rafScheduled) return;
+      rafScheduled = true;
+      animFrameId = requestAnimationFrame(async () => {
+        rafScheduled = false;
+        if (fetchPending) return;
+        fetchPending = true;
+        if (!ctx) return;
+        const rendered = await fetchAndRender(sessionId, width, height, ctx);
+        fetchPending = false;
+        if (rendered && !connected.value) connected.value = true;
+      });
     }
 
     // Listen for frame events from the backend (push model)
     import("@tauri-apps/api/event").then(({ listen }) => {
       listen(`rdp:frame:${sessionId}`, () => {
-        onFrameReady();
+        scheduleFrameFetch();
       }).then((unlisten) => {
         unlistenFrame = unlisten;
       });
     });
 
-    // Also do an initial poll in case frames arrived before listener was set up
-    onFrameReady();
+    // Initial poll in case frames arrived before listener was set up
+    scheduleFrameFetch();
   }
 
   /**
@@ -356,7 +373,7 @@ export function useRdp(): UseRdpReturn {
     connected,
     keyboardGrabbed,
     clipboardSync,
-    fetchFrame,
+    fetchAndRender,
     sendMouse,
     sendKey,
     sendClipboard,

src/composables/useTerminal.ts

@@ -14,8 +14,9 @@ const defaultTheme = {
   foreground: "#e0e0e0",
   cursor: "#58a6ff",
   cursorAccent: "#0d1117",
-  selectionBackground: "rgba(88, 166, 255, 0.3)",
+  selectionBackground: "#264f78",
   selectionForeground: "#ffffff",
+  selectionInactiveBackground: "#264f78",
   black: "#0d1117",
   red: "#f85149",
   green: "#3fb950",
@@ -155,6 +156,7 @@ export function useTerminal(sessionId: string, backend: 'ssh' | 'pty' = 'ssh'):
     // cell widths — producing tiny dashes and 200+ column terminals.
     document.fonts.ready.then(() => {
       fitAddon.fit();
+      terminal.focus();
     });
 
     // Right-click paste on the terminal's DOM element

src/layouts/MainLayout.vue

@@ -367,16 +367,14 @@ function closeHelpMenuDeferred(): void {
 
 async function handleHelpAction(page: string): Promise<void> {
   showHelpMenu.value = false;
-  const { WebviewWindow } = await import("@tauri-apps/api/webviewWindow");
-  const label = `help-${page}-${Date.now()}`;
-  new WebviewWindow(label, {
-    title: `Wraith — Help`,
-    width: 750,
-    height: 600,
-    resizable: true,
-    center: true,
-    url: `index.html#/tool/help?page=${page}`,
-  });
+  try {
+    await invoke("open_child_window", {
+      label: `help-${page}-${Date.now()}`,
+      title: "Wraith — Help",
+      url: `index.html#/tool/help?page=${page}`,
+      width: 750, height: 600,
+    });
+  } catch (err) { console.error("Help window error:", err); alert("Window error: " + String(err)); }
 }
 
 async function handleToolAction(tool: string): Promise<void> {
@@ -390,8 +388,6 @@ async function handleToolAction(tool: string): Promise<void> {
     return;
   }
 
-  const { WebviewWindow } = await import("@tauri-apps/api/webviewWindow");
-
   const toolConfig: Record<string, { title: string; width: number; height: number }> = {
     "network-scanner": { title: "Network Scanner", width: 800, height: 600 },
     "port-scanner": { title: "Port Scanner", width: 700, height: 500 },
@@ -412,16 +408,14 @@ async function handleToolAction(tool: string): Promise<void> {
 
   const sessionId = activeSessionId.value || "";
 
-  // Open tool in a new Tauri window
-  const label = `tool-${tool}-${Date.now()}`;
-  new WebviewWindow(label, {
-    title: `Wraith — ${config.title}`,
-    width: config.width,
-    height: config.height,
-    resizable: true,
-    center: true,
-    url: `index.html#/tool/${tool}?sessionId=${sessionId}`,
-  });
+  try {
+    await invoke("open_child_window", {
+      label: `tool-${tool}-${Date.now()}`,
+      title: `Wraith — ${config.title}`,
+      url: `index.html#/tool/${tool}?sessionId=${sessionId}`,
+      width: config.width, height: config.height,
+    });
+  } catch (err) { console.error("Tool window error:", err); alert("Tool window error: " + String(err)); }
 }
 
 async function handleFileMenuAction(action: string): Promise<void> {
@@ -441,18 +435,13 @@ function handleThemeSelect(theme: ThemeDefinition): void {
 async function handleOpenFile(entry: FileEntry): Promise<void> {
   if (!activeSessionId.value) return;
   try {
-    const { WebviewWindow } = await import("@tauri-apps/api/webviewWindow");
     const fileName = entry.path.split("/").pop() || entry.path;
-    const label = `editor-${Date.now()}`;
     const sessionId = activeSessionId.value;
-
-    new WebviewWindow(label, {
+    await invoke("open_child_window", {
+      label: `editor-${Date.now()}`,
       title: `${fileName} — Wraith Editor`,
-      width: 800,
-      height: 600,
-      resizable: true,
-      center: true,
       url: `index.html#/tool/editor?sessionId=${sessionId}&path=${encodeURIComponent(entry.path)}`,
+      width: 800, height: 600,
     });
   } catch (err) { console.error("Failed to open editor:", err); }
 }
@@ -502,6 +491,19 @@ onMounted(async () => {
 
   await connectionStore.loadAll();
 
+  // Restore saved theme so every terminal opens with the user's preferred colors
+  try {
+    const savedThemeName = await invoke<string | null>("get_setting", { key: "active_theme" });
+    if (savedThemeName) {
+      const themes = await invoke<Array<{ name: string; foreground: string; background: string; cursor: string; black: string; red: string; green: string; yellow: string; blue: string; magenta: string; cyan: string; white: string; brightBlack: string; brightRed: string; brightGreen: string; brightYellow: string; brightBlue: string; brightMagenta: string; brightCyan: string; brightWhite: string }>>("list_themes");
+      const theme = themes?.find(t => t.name === savedThemeName);
+      if (theme) {
+        sessionStore.setTheme(theme);
+        statusBar.value?.setThemeName(theme.name);
+      }
+    }
+  } catch {}
+
   // Restore workspace — reconnect saved tabs (non-blocking, non-fatal)
   setTimeout(async () => {
     try {

vite.config.ts

@@ -1,10 +1,20 @@
-import { defineConfig } from "vite";
+import { defineConfig, type Plugin } from "vite";
 import vue from "@vitejs/plugin-vue";
 import tailwindcss from "@tailwindcss/vite";
 import { resolve } from "path";
 
+/** Strip crossorigin attribute from HTML — WKWebView + Tauri custom protocol compatibility. */
+function stripCrossOrigin(): Plugin {
+  return {
+    name: "strip-crossorigin",
+    transformIndexHtml(html) {
+      return html.replace(/ crossorigin/g, "");
+    },
+  };
+}
+
 export default defineConfig({
-  plugins: [vue(), tailwindcss()],
+  plugins: [vue(), tailwindcss(), stripCrossOrigin()],
   resolve: {
     alias: {
       "@": resolve(__dirname, "src"),
@@ -23,5 +33,9 @@ export default defineConfig({
     target: ["es2021", "chrome100", "safari13"],
     minify: !process.env.TAURI_DEBUG ? "esbuild" : false,
     sourcemap: !!process.env.TAURI_DEBUG,
+    // Disable crossorigin attribute on script/link tags — WKWebView on
+    // macOS may reject CORS-mode requests for Tauri's custom tauri://
+    // protocol in dynamically created child WebviewWindows.
+    crossOriginLoading: false,
   },
 });