update version

app/ui.js

@@ -9,7 +9,7 @@
 import * as Log from '../core/util/logging.js';
 import _, { l10n } from './localization.js';
 import { isTouchDevice, isMac, isIOS, isAndroid, isChromeOS, isSafari,
-         hasScrollbarGutter, dragThreshold }
+         hasScrollbarGutter, dragThreshold, browserAsyncClipboardSupport }
     from '../core/util/browser.js';
 import { setCapture, getPointerEvent } from '../core/util/events.js';
 import KeyTable from "../core/input/keysym.js";
@@ -20,7 +20,7 @@ import * as WebUtil from "./webutil.js";
 
 const PAGE_TITLE = "noVNC";
 
-const LINGUAS = ["cs", "de", "el", "es", "fr", "it", "ja", "ko", "nl", "pl", "pt_BR", "ru", "sv", "tr", "zh_CN", "zh_TW"];
+const LINGUAS = ["cs", "de", "el", "es", "fr", "hr", "it", "ja", "ko", "nl", "pl", "pt_BR", "ru", "sv", "tr", "zh_CN", "zh_TW"];
 
 const UI = {
 
@@ -1160,6 +1160,7 @@ const UI = {
         UI.rfb.showDotCursor = UI.getSetting('show_dot');
 
         UI.updateViewOnly(); // requires UI.rfb
+        UI.updateClipboard();
     },
 
     disconnect() {
@@ -1817,6 +1818,31 @@ const UI = {
         }
     },
 
+    updateClipboard() {
+        browserAsyncClipboardSupport()
+            .then((support) => {
+                if (support === 'unsupported') {
+                    // Use fallback clipboard panel
+                    return;
+                }
+                if (support === 'denied' || support === 'available') {
+                    UI.closeClipboardPanel();
+                    document.getElementById('noVNC_clipboard_button')
+                        .classList.add('noVNC_hidden');
+                    document.getElementById('noVNC_clipboard_button')
+                        .removeEventListener('click', UI.toggleClipboardPanel);
+                    document.getElementById('noVNC_clipboard_text')
+                        .removeEventListener('change', UI.clipboardSend);
+                    if (UI.rfb) {
+                        UI.rfb.removeEventListener('clipboard', UI.clipboardReceive);
+                    }
+                }
+            })
+            .catch(() => {
+                // Treat as unsupported
+            });
+    },
+
     updateShowDotCursor() {
         if (!UI.rfb) return;
         UI.rfb.showDotCursor = UI.getSetting('show_dot');

core/clipboard.js

@@ -0,0 +1,72 @@
+/*
+ * noVNC: HTML5 VNC client
+ * Copyright (c) 2025 The noVNC authors
+ * Licensed under MPL 2.0 or any later version (see LICENSE.txt)
+ */
+
+import * as Log from './util/logging.js';
+import { browserAsyncClipboardSupport } from './util/browser.js';
+
+export default class AsyncClipboard {
+    constructor(target) {
+        this._target = target || null;
+
+        this._isAvailable = null;
+
+        this._eventHandlers = {
+            'focus': this._handleFocus.bind(this),
+        };
+
+        // ===== EVENT HANDLERS =====
+
+        this.onpaste = () => {};
+    }
+
+    // ===== PRIVATE METHODS =====
+
+    async _ensureAvailable() {
+        if (this._isAvailable !== null) return this._isAvailable;
+        try {
+            const status = await browserAsyncClipboardSupport();
+            this._isAvailable = (status === 'available');
+        } catch {
+            this._isAvailable = false;
+        }
+        return this._isAvailable;
+    }
+
+    async _handleFocus(event) {
+        if (!(await this._ensureAvailable())) return;
+        try {
+            const text = await navigator.clipboard.readText();
+            this.onpaste(text);
+        } catch (error) {
+            Log.Error("Clipboard read failed: ", error);
+        }
+    }
+
+    // ===== PUBLIC METHODS =====
+
+    writeClipboard(text) {
+        // Can lazily check cached availability
+        if (!this._isAvailable) return false;
+        navigator.clipboard.writeText(text)
+            .catch(error => Log.Error("Clipboard write failed: ", error));
+        return true;
+    }
+
+    grab() {
+        if (!this._target) return;
+        this._ensureAvailable()
+            .then((isAvailable) => {
+                if (isAvailable) {
+                    this._target.addEventListener('focus', this._eventHandlers.focus);
+                }
+            });
+    }
+
+    ungrab() {
+        if (!this._target) return;
+        this._target.removeEventListener('focus', this._eventHandlers.focus);
+    }
+}

core/decoders/jpeg.js

@@ -119,18 +119,33 @@ export default class JPEGDecoder {
         let extra = 0;
         if (type === 0xDA) {
             // start of scan
-            extra += 2;
+            if (sock.rQwait("JPEG", length-2 + 2, 4)) {
+                return null;
+            }
+
+            let len = sock.rQlen();
+            let data = sock.rQpeekBytes(len, false);
+
             while (true) {
-                if (sock.rQwait("JPEG", length-2+extra, 4)) {
+                let idx = data.indexOf(0xFF, length-2+extra);
+                if (idx === -1) {
+                    sock.rQwait("JPEG", Infinity, 4);
                     return null;
                 }
-                let data = sock.rQpeekBytes(length-2+extra, false);
-                if (data.at(-2) === 0xFF && data.at(-1) !== 0x00 &&
-                    !(data.at(-1) >= 0xD0 && data.at(-1) <= 0xD7)) {
-                    extra -= 2;
-                    break;
+
+                if (idx === len-1) {
+                    sock.rQwait("JPEG", Infinity, 4);
+                    return null;
                 }
-                extra++;
+
+                if (data.at(idx+1) === 0x00 ||
+                    (data.at(idx+1) >= 0xD0 && data.at(idx+1) <= 0xD7)) {
+                    extra = idx+2 - (length-2);
+                    continue;
+                }
+
+                extra = idx - (length-2);
+                break;
             }
         }
 

core/display.js

@@ -521,6 +521,9 @@ export default class Display {
                             return;
                         }
                         this.drawImage(a.img, a.x, a.y);
+                        // This helps the browser free the memory right
+                        // away, rather than ballooning
+                        a.img.src = "";
                     } else {
                         a.img._noVNCDisplay = this;
                         a.img.addEventListener('load', this._resumeRenderQ);

core/rfb.js

@@ -15,6 +15,7 @@ import { clientToElement } from './util/element.js';
 import { setCapture } from './util/events.js';
 import EventTargetMixin from './util/eventtarget.js';
 import Display from "./display.js";
+import AsyncClipboard from "./clipboard.js";
 import Inflator from "./inflator.js";
 import Deflator from "./deflator.js";
 import Keyboard from "./input/keyboard.js";
@@ -164,6 +165,7 @@ export default class RFB extends EventTargetMixin {
         this._sock = null;              // Websock object
         this._display = null;           // Display object
         this._flushing = false;         // Display flushing state
+        this._asyncClipboard = null;    // Async clipboard object
         this._keyboard = null;          // Keyboard input handler object
         this._gestures = null;          // Gesture input handler object
         this._resizeObserver = null;    // Resize observer object
@@ -266,6 +268,9 @@ export default class RFB extends EventTargetMixin {
             throw exc;
         }
 
+        this._asyncClipboard = new AsyncClipboard(this._canvas);
+        this._asyncClipboard.onpaste = this.clipboardPasteFrom.bind(this);
+
         this._keyboard = new Keyboard(this._canvas);
         this._keyboard.onkeyevent = this._handleKeyEvent.bind(this);
         this._remoteCapsLock = null; // Null indicates unknown or irrelevant
@@ -317,8 +322,10 @@ export default class RFB extends EventTargetMixin {
             this._rfbConnectionState === "connected") {
             if (viewOnly) {
                 this._keyboard.ungrab();
+                this._asyncClipboard.ungrab();
             } else {
                 this._keyboard.grab();
+                this._asyncClipboard.grab();
             }
         }
     }
@@ -2221,7 +2228,10 @@ export default class RFB extends EventTargetMixin {
         this._setDesktopName(name);
         this._resize(width, height);
 
-        if (!this._viewOnly) { this._keyboard.grab(); }
+        if (!this._viewOnly) {
+            this._keyboard.grab();
+            this._asyncClipboard.grab();
+        }
 
         this._fbDepth = 24;
 
@@ -2336,6 +2346,15 @@ export default class RFB extends EventTargetMixin {
         return this._fail("Unexpected SetColorMapEntries message");
     }
 
+    _writeClipboard(text) {
+        if (this._viewOnly) return;
+        if (this._asyncClipboard.writeClipboard(text)) return;
+        // Fallback clipboard
+        this.dispatchEvent(
+            new CustomEvent("clipboard", {detail: {text: text}})
+        );
+    }
+
     _handleServerCutText() {
         Log.Debug("ServerCutText");
 
@@ -2355,9 +2374,7 @@ export default class RFB extends EventTargetMixin {
                 return true;
             }
 
-            this.dispatchEvent(new CustomEvent(
-                "clipboard",
-                { detail: { text: text } }));
+            this._writeClipboard(text);
 
         } else {
             //Extended msg.
@@ -2493,9 +2510,7 @@ export default class RFB extends EventTargetMixin {
 
                     textData = textData.replaceAll("\r\n", "\n");
 
-                    this.dispatchEvent(new CustomEvent(
-                        "clipboard",
-                        { detail: { text: textData } }));
+                    this._writeClipboard(textData);
                 }
             } else {
                 return this._fail("Unexpected action in extended clipboard message: " + actions);

core/util/browser.js

@@ -11,6 +11,39 @@
 import * as Log from './logging.js';
 import Base64 from '../base64.js';
 
+// Async clipboard detection
+
+/* Evaluates if there is browser support for the async clipboard API and
+ * relevant clipboard permissions. Returns 'unsupported' if permission states
+ * cannot be resolved. On the other hand, detecting 'granted' or 'prompt'
+ * permission states for both read and write indicates full API support with no
+ * imposed native browser paste prompt. Conversely, detecting 'denied' indicates
+ * the user elected to disable clipboard.
+ */
+export async function browserAsyncClipboardSupport() {
+    if (!(navigator?.permissions?.query &&
+          navigator?.clipboard?.writeText &&
+          navigator?.clipboard?.readText)) {
+        return 'unsupported';
+    }
+    try {
+        const writePerm = await navigator.permissions.query(
+            {name: "clipboard-write", allowWithoutGesture: true});
+        const readPerm = await navigator.permissions.query(
+            {name: "clipboard-read",  allowWithoutGesture: false});
+        if (writePerm.state === "denied" || readPerm.state  === "denied") {
+            return 'denied';
+        }
+        if ((writePerm.state === "granted" || writePerm.state === "prompt") &&
+            (readPerm.state  === "granted" || readPerm.state  === "prompt")) {
+            return 'available';
+        }
+    } catch {
+        return 'unsupported';
+    }
+    return 'unsupported';
+}
+
 // Touch detection
 export let isTouchDevice = ('ontouchstart' in document.documentElement) ||
                                  // required for Chrome debugger

core/websock.js

@@ -124,6 +124,10 @@ export default class Websock {
         return res >>> 0;
     }
 
+    rQlen() {
+        return this._rQlen - this._rQi;
+    }
+
     rQshiftStr(len) {
         let str = "";
         // Handle large arrays in steps to avoid long strings on the stack

docs/API-internal.md

@@ -18,17 +18,19 @@ keysym values.
 * __Display__ (core/display.js): Efficient 2D rendering abstraction
 layered on the HTML5 canvas element.
 
+* __Clipboard__ (core/clipboard.js): Clipboard event handler.
+
 * __Websock__ (core/websock.js): Websock client from websockify
 with transparent binary data support.
 [Websock API](https://github.com/novnc/websockify-js/wiki/websock.js) wiki page.
 
 
 ## 1.2 Callbacks
 
-For the Mouse, Keyboard and Display objects the callback functions are
-assigned to configuration attributes, just as for the RFB object. The
-WebSock module has a method named 'on' that takes two parameters: the
-callback event name, and the callback function.
+For the Mouse, Keyboard, Display, and Clipboard objects, the callback
+functions are assigned to configuration attributes, just as for the RFB
+object. The WebSock module has a method named 'on' that takes two
+parameters: the callback event name, and the callback function.
 
 ## 2. Modules
 
@@ -81,3 +83,23 @@ None
 | blitImage          | (x, y, width, height, arr, offset, from_queue)          | Blit pixels (of R,G,B,A) to the display
 | drawImage          | (img, x, y)                                             | Draw image and track damage
 | autoscale          | (containerWidth, containerHeight)                       | Scale the display
+
+## 2.3 Clipboard module
+
+### 2.3.1 Configuration attributes
+
+None
+
+### 2.3.2 Methods
+
+| name               | parameters        | description
+| ------------------ | ----------------- | ------------
+| writeClipboard     | (text)            | An async write text to clipboard
+| grab               | ()                | Begin capturing clipboard events
+| ungrab             | ()                | Stop capturing clipboard events
+
+### 2.3.3 Callbacks
+
+| name    | parameters | description
+| ------- | ---------- | ------------
+| onpaste | (text)     | Called following a target focus event and an async clipboard read

package.json

@@ -2,24 +2,20 @@
   "name": "@novnc/novnc",
   "version": "1.6.0",
   "description": "An HTML5 VNC client",
-  "browser": "lib/rfb",
-  "directories": {
-    "lib": "lib",
-    "doc": "docs",
-    "test": "tests"
-  },
+  "type": "module",
   "files": [
-    "lib",
+    "core",
+    "vendor",
     "AUTHORS",
     "VERSION",
     "docs/API.md",
     "docs/LIBRARY.md",
     "docs/LICENSE*"
   ],
+  "exports": "./core/rfb.js",
   "scripts": {
     "lint": "eslint app core po/po2js po/xgettext-html tests utils",
-    "test": "karma start karma.conf.js",
-    "prepublish": "node ./utils/convert.js --clean"
+    "test": "karma start karma.conf.cjs"
   },
   "repository": {
     "type": "git",