[vibesoftwarecoder]

Fourth step of USB forwarding, after the capability stub (ApolloVibe #12), the client core (#25) and the host tunnel (ApolloVibe #13). It adds the logic that will drive USB forwarding during a stream. Nothing calls it yet, and both new settings are off by default, so nothing changes for a user. Wiring it into the stream, the settings screen and the hotkey is the next PR.

What it adds

• Two settings: usbForwardingEnabled (off) and usbForwardingAutoDevices. Devices are stored by identity (vendor:product, plus serial when there is one), not by port-dependent bus id.
• UsbForwardingManager: does nothing at all when disabled. When enabled it checks the host's capability, then opens one tunnel per chosen device that is currently shared. It runs on its own thread, retries with backoff (2, 5, 15, 30, 60 s), and can be polled without a Qt event loop. stop() is idempotent and safe from any thread.
• Trust boundary: the tunnel host is always the host the stream is connected to, never user input, and the pinned server certificate and client certificate are both required. The capability reply can only supply a port and a token.
• Sharing or unsharing a device no longer blocks the GUI while the UAC prompt is open. The result is reported when the elevated tool really finishes, and the wait runs on its own thread so it cannot hold up quitting.
• Tunnels turn on TCP keepalive after the handshake, so a vanished host is noticed. Idle devices are not dropped.

Tests

• 270 passed, 1 skipped, 0 failed across 9 standalone Qt Test projects (loopback only). The skip needs usbipd-win installed.
• 20 deliberate breaks of the code were each caught by a test.
• An independent review found no Critical issues. Its High finding (a use-after-free when stop() is called from inside a callback) and its Medium findings are fixed, with tests repeated 200 times.

Not covered

• The full app build (CI builds it); preferences and the manager are compiled in CI only.
• A real UAC prompt, a real host, and a real USB device.
• Whether the OS drops a silent peer on schedule: the tests check that the keepalive options are set on the live socket, not that Windows gives up.

Derived in part from qiin2333/moonlight-qt (GPL-3.0); ported files say so at the top.

🤖 Generated with Claude Code