forked from unom/punktfunk
enricobuehlerandClaude Opus 4.8
191c9a4e18
MINOR, not the 0.15.1 originally planned: the 24 commits since v0.15.0 carry 7 features, and they are not incidental — they change the plugin runner's privilege model. It stops holding the console's full-admin token (scoped plugin-token lane), the Windows runner drops from SYSTEM to LocalService, public-registry plugin installs are gated behind an explicit flag, and the systemd user unit is sandboxed. Operators have workflow-visible changes to absorb (a plugin genuinely needing the admin surface must now set PUNKTFUNK_MGMT_TOKEN; installing outside the @punktfunk scope needs --allow-public-registry). A patch label would understate all of that, and sdk-publish pushes this version straight to consumers. The other 12 fixes are largely the pf-encode/zerocopy/capture/inject quality sweep landing: teardown deadlocks, error-path leaks, a GL->CUDA copy race, an odd-height NV12 overrun, a cursor-meta OOB read, plus the two loss-recovery gaps 0.15.0 left open (Vulkan Video never got the LTR taint sweep; QSV's sweep skipped its modal single-swept-slot case). `WIRE_VERSION` stays 2 and the driver protocol stays v4 — pairings, clients and installed drivers keep working. The C ABI moves 8 -> 9 (PunktfunkFrame grows `received_ns`, so receipt is stamped at the session boundary rather than at the embedder's pull); the gitignored Apple xcframework needs a rebuild for that to reach the Apple clients. No OpenAPI path changes (45 before and after) — the new plugin-token lane is auth-layer only — so api/openapi.json moves info.version only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>