# RDP FIDO — what's new

Client and gate are updated together; the client offers each new version on
start, the gate is updated from the client after a key-confirmed session
(`Automatically update the gate on this machine`). Downloads:
[RdpFido-Setup.exe](https://accounts.new-imobile.com/updates/RdpFido-Setup.exe)
(host or client), [RdpFidoClient-Setup.msi](https://accounts.new-imobile.com/updates/RdpFidoClient-Setup.msi),
[RdpFidoGate-Setup.msi](https://accounts.new-imobile.com/updates/RdpFidoGate-Setup.msi).
Русская версия: [CHANGELOG.ru.md](CHANGELOG.ru.md).

## 1.17.0 — 2026-09-11

- **One file per side.** The FIDO Stream host agent now lives inside
  `RdpFidoGate.exe` and the stream viewer inside `RdpFidoClient.exe`. Both
  installers and the auto-update ship exactly what a stream needs; nothing has
  to be copied by hand any more. The gate starts itself as `stream serve` in
  the user's session, the client starts itself as `viewer` in a child process,
  so a decoder or driver crash closes only the stream window.
- On an installed host, `RdpFidoGate.exe stream encoders`,
  `stream encoders --bench`, `stream selftest` and `stream audio-devices` are
  available for diagnostics.
- Self-update of a running stream: the old image is renamed aside before the
  new one is copied in, so an update no longer fails while a stream is open.
- **Gate recovers from a hung Windows Firewall service.** If a call into the
  firewall service never returns, a watchdog ends the gate after 90 s and the
  service manager restarts it, instead of the gate answering every request
  with "the firewall worker did not respond in time" until someone notices.
  Grants recorded from the firewall thread expire on schedule even when the
  caller stopped waiting; rule removals are never dropped.

## 1.16.1 — 2026-09-11

- HEVC is decoded on the GPU by a safe route: NVIDIA NVDEC on NVIDIA, a
  hardware DXVA decoder on Intel and AMD. Microsoft's software HEVC extension
  is never used (it crashes), so a viewer without a suitable GPU falls back to
  H.264 instead of crashing and writes the reason to `client.log`.
- The H.264 Media Foundation decoder now runs on the GPU (DXVA) as well.

## 1.16.0 — 2026-09-10

- **Encoder and decoder are selectable per session.** `Encoder (host)`:
  Automatic / NVIDIA NVENC (direct) / Hardware (any GPU) / Software (CPU);
  `Decoder`: Automatic / Hardware (GPU) / Software (CPU). NVENC talks to the
  driver directly, the hardware option is any vendor's Media Foundation
  encoder (Quick Sync, AMF), software is Microsoft's H.264.
- `encoders --bench` measures every backend on synthetic frames without a
  screen or a network.
- Two latency fixes: the desktop-duplication wait no longer stalls the
  encoder thread, and the NVIDIA encoder's low-latency settings are applied
  where it honours them. 2560×1600 encode went from 60 ms to 6.5 ms per frame;
  LAN end-to-end from 380 ms to 25–45 ms.

## 1.15.0 — 2026-09-10

- **FIDO Stream** — a second connection mode next to RDP for games and other
  work where "click-to-photon" latency matters most. Video, audio and input
  go over UDP: AES-256-GCM on keys derived from ECDH bound to a ticket the
  gate issues only after the FIDO2 key confirms; Reed–Solomon FEC instead of
  retransmissions; a reliable channel for input; congestion control.
- Host side: DXGI desktop duplication, hardware encode (NVENC / Quick Sync /
  AMF through Media Foundation) with a zero-copy D3D11 pixel path, WASAPI
  audio, scan-code input injection. Viewer side: hardware decode, D3D11 flip
  rendering without vsync, raw input, mouse capture (Ctrl+Alt+Home), full
  screen (Ctrl+Alt+Enter), disconnect (Ctrl+Alt+End).
- One **Balance** slider from "poor link" to "weak PCs" with an automatic
  mode; two-way audio including the microphone; the host can dial the client
  through most NATs using address candidates exchanged over the gate's HTTPS
  channel. UDP 7441 is opened only for the confirmed address, only for the
  session.

## 1.14.0 — 2026-09-03

- **One combined installer**, `RdpFido-Setup.exe`, asks a single question —
  is this computer the host (connected to) or the client (connected from) —
  and installs the right half. Unattended: `RdpFido-Setup.exe host|client`.
  The client stays a per-user package (no admin rights), the gate a
  per-machine one (service).

## 1.13.0 — 2026-09-01

- The gate ships as an MSI, `RdpFidoGate-Setup.msi`: it enables Remote Desktop
  with NLA, binds the certificate to port 7440, registers the service and
  shows the one-time key enrollment code on its last page, in the Windows
  display language. Silent: `msiexec /i RdpFidoGate-Setup.msi /qn`.

## 1.12.x — 2026-08-30

- Signed license and update manifests, image banners chosen by the server
  with offline rotation, RDP port control, failed gate calls logged in
  `client.log`.