feat: add mstsc/ssh config options for agentless RDP/SSH

Exposes MeshCentral's built-in web-based RDP (mstsc) and SSH (ssh)
clients as add-on options, matching MeshCentral's own defaults
(mstsc: true, ssh: false). Warns at startup if ssh is enabled
together with agent_pong/browser_pong, since agentless SSH breaks
when keepalive data is mixed into the same WebSocket.

Closes #12

Author: andlo

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## \[0.2.15\] - 2026-08-08
+
+### Added
+
+- `mstsc` — enable/disable MeshCentral's built-in web-based RDP client (agentless RDP). Enabled by default, matching MeshCentral's own default.
+- `ssh` — enable MeshCentral's built-in web-based SSH client (agentless SSH). Disabled by default, matching MeshCentral's own default. A startup warning is logged if enabled together with `agent_pong`/`browser_pong`, since agentless SSH is incompatible with those keepalive options.
+
+Requested in [#12](https://github.com/andlo/ha-meshcentral-addon/issues/12).
+
 ## \[0.2.14\] - 2026-07-26
 
 ### Added

meshcentral/config.yaml

@@ -1,6 +1,6 @@
 {
   "name": "MeshCentral",
-  "version": "0.2.14",
+  "version": "0.2.15",
   "slug": "meshcentral",
   "description": "Self-hosted remote device management — monitor and control your PCs from Home Assistant",
   "url": "https://github.com/andlo/ha-meshcentral-addon",
@@ -34,6 +34,8 @@
     "web_rtc": false,
     "compression": true,
     "allow_high_quality_desktop": true,
+    "mstsc": true,
+    "ssh": false,
     "self_update": false,
     "maintenance_mode": false,
     "no_2fa": false,
@@ -83,6 +85,8 @@
     "web_rtc": "bool",
     "compression": "bool",
     "allow_high_quality_desktop": "bool",
+    "mstsc": "bool",
+    "ssh": "bool",
     "self_update": "bool",
     "maintenance_mode": "bool",
     "no_2fa": "bool",

meshcentral/run.sh

@@ -10,6 +10,8 @@ TLS_OFFLOAD=$(bashio::config 'tls_offload')
 WEB_RTC=$(bashio::config 'web_rtc')
 COMPRESSION=$(bashio::config 'compression')
 ALLOW_HQ_DESKTOP=$(bashio::config 'allow_high_quality_desktop')
+MSTSC=$(bashio::config 'mstsc')
+SSH_CLIENT=$(bashio::config 'ssh')
 SELF_UPDATE=$(bashio::config 'self_update')
 MAINTENANCE=$(bashio::config 'maintenance_mode')
 NO_2FA=$(bashio::config 'no_2fa')
@@ -201,7 +203,13 @@ DOMAIN=$(echo "$DOMAIN" | jq \
     --argjson ss   "$SITE_STYLE" \
     --argjson gs   "$GUEST_SHARING" \
     --argjson ar   "$AUTO_REMOVE" \
-    '. + {title: $ttl, newAccounts: $na, siteStyle: $ss, guestDeviceSharing: $gs, autoRemoveInactiveDevices: $ar}')
+    --argjson mst  "$MSTSC" \
+    --argjson sshc "$SSH_CLIENT" \
+    '. + {title: $ttl, newAccounts: $na, siteStyle: $ss, guestDeviceSharing: $gs, autoRemoveInactiveDevices: $ar, mstsc: $mst, ssh: $sshc}')
+
+if [ "$SSH_CLIENT" = "true" ] && { [ "$AGENT_PONG" -gt 0 ] 2>/dev/null || [ "$BROWSER_PONG" -gt 0 ] 2>/dev/null; }; then
+    bashio::log.warning "ssh is enabled together with agent_pong/browser_pong keepalive — agentless SSH sessions will break, as keepalive data gets mixed into the same WebSocket as SSH traffic."
+fi
 
 if bashio::config.has_value 'domain_title2'; then
     DOMAIN=$(echo "$DOMAIN" | jq --arg v "$(bashio::config 'domain_title2')" '. + {title2: $v}')

meshcentral/translations/en.yaml

@@ -89,6 +89,22 @@ configuration:
       Allow agents to stream remote desktop at full quality.
       Disable to cap image quality and reduce bandwidth on slow connections.
 
+  mstsc:
+    name: Enable web-based RDP client
+    description: >-
+      Activates MeshCentral's built-in web-based RDP client, letting you connect to Windows devices
+      via RDP directly from the browser — including devices without the MeshAgent installed
+      (agentless). Enabled by default.
+
+  ssh:
+    name: Enable web-based SSH client
+    description: >-
+      Activates MeshCentral's built-in web-based SSH client, letting you connect to devices
+      via SSH directly from the browser — including devices without the MeshAgent installed
+      (agentless). Disabled by default. Note: agentless SSH is incompatible with the agent/browser
+      keepalive options above (agent_pong / browser_pong) — enabling those will break SSH sessions,
+      since keepalive data gets mixed into the same WebSocket as the SSH traffic.
+
   self_update:
     name: Allow MeshCentral self-update
     description: >-