[Marc-André Moreau (mamoreau-devolutions)]

The viewer could only show a full desktop; it ignored the RemoteApp settings and dropped windowing orders.

--remote-app (or remoteapplicationmode and remoteapplicationprogram in an .rdp file) starts a RemoteApp session without a desktop window. Each server window becomes an undecorated local window that follows the window orders: position, size, title, show state, owner and taskbar visibility, and its icon. Windows are painted from their rectangle of the session frame, or from the graphics pipeline surface the server maps to them. Keyboard, mouse and wheel input are translated into session coordinates; focus changes send Activate and closing a window asks the server with a Close system command. The server's active window is focused when a RemoteApp window already has focus.

Program arguments, the working directory, notification icons, z-order, local move/size and window shapes are not handled yet.

🤖 Generated with Claude Code

[Marc-André Moreau (mamoreau-devolutions)]

Line counts: production code about +300/−166 (new rail.rs and the RemoteApp branch in app.rs; the key, modifier, wheel and button mapping moved into shared helpers so the desktop window behaves as before); tests +168 in ironrdp-testsuite-extra/tests/client/viewer_rail.rs (window model merging, coordinate translation, frame cropping, surface updates, icon conversion); manifests and lockfile +3 (ironrdp-rail, which the meta crate does not re-export).

Not run against a server yet.

[github-actions]

The PR adds RemoteApp (RAIL) support to the viewer: server windows become local winit windows fed from the session frame or mapped graphics surfaces, with Activate/Close PDUs and translated input. I independently verified the window-order handling, model merging, coordinate translation, frame cropping and icon decoding in rail.rs, the input wiring in app.rs, and the cited line ranges against pr-head. The change is well scoped and the desktop input path is a faithful extraction into shared helpers. All 18 specialist candidates check out on inspection; none has an incorrect root cause, so all are accepted unchanged. The material concerns are the public API surface added solely for external tests, the focus-loss path releasing only modifier keys, style/owner/taskbar attributes that are write-only after window creation, icons dropped when their window order has not arrived yet, and several testability gaps. The rest are mechanical style and compression nits.

Push a commit after addressing these findings. If no code change is needed, you may resolve inline threads and comment @github-actions review-ready to request human review.

[github-actions]

[skeptical] `rail` module made public API solely for external tests — medium 🟠 — `pub mod rail` exposes RailWindowModel with public fields, ModelChanges, WindowPixels, crop_frame, window_point_to_desktop, icon_to_rgba and MAX_RAIL_WINDOWS as public API of the published viewer crate. The only external consumer is the new integration test in ironrdp-testsuite-extra/tests/client/viewer_rail.rs, which reads model.title/model.x directly; no other crate uses these items and the viewer keeps `keymap` private (lib.rs:16). Placing the same tests as a unit-test module inside rail.rs would test identical behavior without committing the crate to a public, must-maintain surface of internal pixel/window-model helpers.

[Marc-André Moreau (mamoreau-devolutions)]

Declined. Kept public on purpose: AGENTS.md puts tests in ironrdp-testsuite-extra and the viewer library builds with test = false, so the helpers must be reachable from there, as cli and drives already are. The exposed items are the pure model and pixel helpers; the window manager itself stays crate-private.

[Copilot]

🟡 Changes recommended

Unbounded rendering allocations, native ownership handling, and dropped input during queue saturation leave significant correctness and reliability issues.

6 open issues

• Bound native window and crop allocations by pixel budget · New
• Preserve owned descendants during late-owner recreation · New
• Retry RAIL controls when the input queue is full · New
• Retry focus-loss releases when the input queue is full · New
• Apply owner changes to existing native windows · New
• Persist cursor visibility for windows created later · New

What changed in this PR

Adds native RemoteApp windows to the viewer, using the client’s windowing orders and graphics output instead of displaying a full desktop.

Changes:

• Adds RemoteApp CLI configuration and starts RemoteApp sessions without a desktop window.
• Creates and paints per-application windows, forwards input, and sends activation and close commands.
• Adds tests for window models, coordinate translation, pixel cropping, icons, and graphics-buffer budgets.

File	Description
crates/​ironrdp-viewer/​src/​rail.rs	Implements RemoteApp window management, rendering, and icons.
crates/​ironrdp-viewer/​src/​main.rs	Passes RemoteApp mode into viewer initialization.
crates/​ironrdp-viewer/​src/​lib.rs	Exposes the RemoteApp module.
crates/​ironrdp-viewer/​src/​cli.rs	Adds RemoteApp options and rejects RPC combinations.
crates/​ironrdp-viewer/​src/​app.rs	Routes RemoteApp output, window events, and input.
crates/​ironrdp-viewer/​Cargo.toml	Adds the RAIL dependency and marks the public facade dependency.
crates/​ironrdp-testsuite-extra/​tests/​client/​viewer_rail.rs	Tests RemoteApp models and rendering helpers.
crates/​ironrdp-testsuite-extra/​tests/​client/​mod.rs	Registers the RemoteApp viewer tests.
Cargo.lock	Records the viewer’s RAIL dependency.

_{Review effort: Balanced}