8 Commits

Author	SHA1	Message	Date
Viktor Liu	be33e9eaf4	Merge branch 'main' into embedded-vnc	2026-09-02 19:10:03 +02:00
Maycon Santos	ebc259e30b	[management,client] Gate remote jobs behind an admin opt-in with MDM support (#7153) ... This introduces a disabled-by-default allow-remote-jobs setting that controls whether the management server may run jobs (such as debug bundles) on a peer. The flag propagates end to end: through client configuration, the daemon SetConfig and Login requests, authentication, and system info, up to management, where it is stored on the peer and exposed on the peers API as remote_jobs_allowed. The client refuses any management-requested job unless the peer has opted in. Because enabling remote jobs crosses the user-to-root boundary, turning it on requires privilege, mirroring the SSH-server gate. Administrators can enforce the setting through MDM policy on both macOS and Windows, and MDM can also override the debug-bundle upload URL. The change ships policy documentation and generated profile templates, and adds configuration, conflict, and enforcement tests covering the opt-in, privilege, and MDM paths.	2026-09-01 17:53:41 +02:00
Viktor Liu	432d249cde	Accept bare marker protocols, reject msb_right framebuffers, split the policy row conversion	2026-08-29 08:24:36 +02:00
Viktor Liu	071bd94d14	Close view-only input, approval-responder and inbound-block gaps in the VNC path	2026-08-27 21:07:03 +02:00
Viktor Liu	f7e186fbd0	Merge branch 'main' into embedded-vnc	2026-08-27 16:01:14 +02:00
Viktor Liu	63c26be72f	[client] Add local Prometheus metrics endpoint (#6689)	2026-08-27 13:53:06 +02:00
Viktor Liu	abe8bc1b53	Require privilege for VNC server and approval config changes	2026-07-30 10:43:26 +02:00
Viktor Liu	0f5d2d91fb	[client] Authorize daemon IPC callers by their local identity (#6967)	2026-07-29 20:32:26 +02:00