100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
enricobuehlerandClaude Fable 5	1e9957d97b	chore(web): clear the 2026-07-22 JS advisory wave — overrides + lock re-resolve ... bun-audit went red mid-day on a fresh advisory wave (13 findings across two snapshots of a moving DB): node-tar DoS trio+1 (critical), sharp/libvips CVEs, fast-uri host confusion, undici ×7, brace-expansion/linkify-it/js-yaml/postcss DoS-class, immutable, dompurify. All transitive pins in the management-console tree; none ship in the streaming stack. Every fix version is in-range for its consumers, so: pin overrides for the single-major packages (tar/dompurify/linkify-it/sharp/fast-uri/immutable/ undici/postcss/js-yaml — bun ignores range-scoped override keys, so plain keys) and a full lockfile re-resolve, which also lifts brace-expansion 2.1.1→2.1.2 in place while its 5.x line (minimatch@10) stays untouched. : No vulnerabilities found. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-23 00:20:44 +02:00
enricobuehlerandClaude Opus 4.8	92f38ec3dd	chore(cleanup): drop TEMP cursor probes + clear KWin-leg clippy debt ... The KWin/Phase-A/B commits were built but never clippy-checked (that distrobox had no clippy component), so they left TEMP on-glass probes and lint debt in the tree. With clippy now runnable (fedora rust 1.96.1 = CI parity): - drop the `fec424ee`/`8cff30d5` TEMP probes: the `update_cursor_meta` SPA_META diagnostic logs (also un-detaches the `// SAFETY:` comment from its `unsafe` block → fixes `undocumented_unsafe_blocks`) and the KWin composite-arm probe in the encode loop. - `#[allow(clippy::too_many_arguments)]` on `spawn_pipewire` (8 params since the KWin leg added `expect_exact_dims`; mirrors `from_virtual_output`). clippy `-p pf-capture -p pf-vdisplay -p punktfunk-host --locked --features nvenc,vulkan-encode -- -D warnings` is now green. (--all-targets additionally trips a pre-existing env mismatch: the fedora libspa binding lacks `SPA_VIDEO_TRANSFER_SMPTE2084`, referenced only by a `#[cfg(test)]` guard-test — not a code issue; CI's pinned pipewire has it.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:54:56 +02:00
enricobuehlerandClaude Fable 5	7058647264	fix(vdisplay/capture): channel-less sessions composite the pointer on a sticky-declared target ... A declared IddCx hardware cursor is IRREVOCABLE for its OS target's life (§8.6), and the sticky exclusion survives monitor REMOVE→ADD because each client gets a STABLE target id — so once any desktop-mode session declared, every later pure-capture session on that target streamed a cursor-less desktop: DWM excluded the pointer, no channel forwarded it, no blend drew it (the exact no-regression gap §8.6's per-session cap gate cannot see). Driver: track every successful SetupHardwareCursor per target (DECLARED_TARGETS — scoped to the WUDFHost's life, exactly the sticky state's scope) and report it in a new AddReply::cursor_excluded tail field (dual-size discipline, both skews degrade cleanly; no proto bump). Host: the flag rides AddedMonitor → Monitor → WinCaptureTarget; a session WITHOUT the cursor channel on a flagged target forces composite mode in the IDD-push capturer — GDI poller + blend for the session's life, pinned on (set_cursor_forward cannot clear it: with no client drawing, un-compositing would erase the pointer entirely). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Opus 4.8	d5ae8dcc3e	feat(capture): gamescope cursor via XFixes shape + QueryPointer position (Phase C) ... gamescope excludes its pointer from the PipeWire node it feeds us and can't embed one either (`set_hw_cursor` is inert), so every gamescope stream was cursorless. Read the pointer from gamescope's nested Xwayland instead — XFixesGetCursorImage for shape/hotspot/visibility, core QueryPointer for position — and publish a CursorOverlay into the capturer's existing `cursor_live` slot, so the encoder blend composites it into the video exactly like the SPA_META_Cursor path. - pf-capture/src/linux/xfixes_cursor.rs (new): the XFixes reader. Connects to EVERY nested Xwayland (Gaming Mode runs one per --xwayland-count) and follows the focused one each tick (the display whose pointer moves), reading that display's own cursor shape. Un-premultiplies ARGB -> straight RGBA. Drop stops the thread. - Capturer::attach_gamescope_cursor + the PortalCapturer override spawn it into the same `cursor_live` slot; pf_vdisplay::gamescope_xwayland_cursor_targets discovers the (DISPLAY, XAUTHORITY) pairs via the GAMESCOPE_WAYLAND_DISPLAY scan. - host: SessionPlan.gamescope_cursor (set from the compositor at both resolve sites AND on a mid-stream Desktop->Gaming switch); the blend gate now builds the encoder blend for gamescope; a sibling composite arm attaches capturer.cursor() per tick for capture-mode clients (no channel needed). native NV12 is disabled for these sessions — that encode path can't blend the cursor (it assumes gamescope embeds the pointer), so we capture RGB and route to the proven CUDA VkSlotBlend / compute-CSC blend. - the pipewire thread no longer clobbers `cursor_live` with None on a buffer that carries no SPA_META_Cursor (gamescope) — that raced the XFixes writer and strobed the composited pointer on/off. On-glass (home-bazzite-2, RTX 5070 Ti, Gaming Mode): cursor visible + steady in Big Picture and CS2 menus, follows focus between the two Xwaylands, hidden in-game. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	925130d1f9	feat(vdisplay): compositor-embedded pointer for sessions without the cursor channel (Phase B) ... Since the cursor-channel work, every Linux virtual output was created in metadata pointer mode — making ALL sessions depend on host-side cursor compositing, including the ones that can never use the channel (Moonlight/ GameStream, legacy clients, capture-mode starts). Those sessions paid the blend bring-up per session and, whenever a visible cursor was composited, the loss of NVENC's stream-ordered submit — for a strictly worse cursor than the compositor's own. Mirror the Windows no-regression gate: the already-wired per-session set_hw_cursor(cursor_forward) now drives the Linux backends too. A cursor-channel session gets metadata (shapes forwarded, composite flip blends host-side — today's validated path, unchanged); every other session gets the pointer compositor-EMBEDDED at creation (KWin zkde pointer=2, Mutter cursor-mode=1, wlroots/hyprland portal CursorMode::Embedded — their pre-channel default; the portal pair also gains the Metadata arm for channel sessions, wired but untested on-glass). SessionPlan.cursor_blend narrows to cursor-forward sessions and rides into the direct-SDK NVENC open, which skips the Vulkan slot-blend bring-up entirely when off — embedded sessions ring on plain CUDA surfaces and pay zero cursor cost, per-session or per-frame. The keep-alive registry's reuse key grows the created pointer mode (new VirtualDisplay::hw_cursor getter): a kept embedded display has no cursor metadata for a channel session to forward, and a kept metadata display would leave a channel-less session with no pointer in its frames. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	d2c46eaf3c	feat(encode/nvenc): SPIR-V cursor blend over Vulkan-allocated input slots — retire the PTX kernels ... A vendored PTX blob is JIT'd against the driver's ISA ceiling, so the cursor-blend module silently dies on drivers older than the generating toolkit (CUDA_ERROR_UNSUPPORTED_PTX_VERSION/INVALID_PTX, 222/218 — the KWin leg's invisible composite cursor on driver 595/CUDA 13.2 vs a CUDA 13.3 blob). SPIR-V has no such coupling, and the in-tree precedent already exists twice (vulkan_video's CSC blend, VkBridge's exportable OPAQUE_FD → cuImportExternalMemory bridge). New pf_zerocopy::vkslot::VkSlotBlend: the direct-SDK NVENC encoder now allocates its input ring as exportable Vulkan buffers CUDA-imports (same contiguous InputSurface layouts, pitch = row bytes rounded to 256), and the cursor composite is a compute dispatch over the cursor's rectangle (cursor_blend.comp, vendored .spv; spec-constant selects ARGB/NV12/YUV444; BT.709 limited, matching the retired .cu). The surface SSBO is uint[] with every invocation owning whole words — no 8-bit-storage device dependency. Cursor-bearing frames force the existing CPU-synced submit path so the CUDA copy → Vulkan dispatch (fence-waited) → NVENC encode ordering is CPU-established; cursorless frames keep the stream-ordered fast path untouched. Any bring-up/alloc/registration failure falls back wholesale to plain pitched CUDA surfaces (never a mixed or short ring): sessions always encode, composite mode just loses the cursor, warned once. cursor_blend.cu / cursor_blend.ptx and the CursorBlend PTX loader are deleted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	33121ece4d	chore(kwin-composite): TEMP blend-path probes — DROP BEFORE MERGE ... Rate-limited journal logging bracketing the silent segment of the Linux composite path: what overlay (if any) the encode loop's composite arm hands the encoder, and whether the NVENC cursor-blend kernel launches and with what geometry. On-glass (KWin leg) the blend module loads yet the composite cursor stays invisible — these two probes attribute it to no-overlay / stripped-en-route / kernel-draws-nothing. The module-loaded INFO line is permanent (success must be as attributable as failure); everything else in this commit is temporary. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	af87549052	fix(linux/vdisplay): KWin virtual outputs stream above 60 Hz via sacrificial-birth renegotiation ... KWin's ScreenCastStream builds its PipeWire format offer — including the maxFramerate cap it actively throttles delivery to — ONCE at stream creation, when the virtual output sits at its hardcoded birth 60 Hz. A kscreen custom-mode change afterwards updates the OUTPUT (readback says 240) but never the offer, so every consumer negotiates max=60 and the stream delivers 60 (pw-dump-verified on KWin 6.6.4). The only path that rebuilds the offer is the stream's own resize handling: a source SIZE change while recording re-runs buildFormats — picking up the output's current refresh — and renegotiates the live stream. So above 60 Hz, birth the output at a sacrificial height (+16), then install + select the real WxH@hz custom mode: the first frame recorded after the consumer connects triggers KWin's resize path, which renegotiates the live stream to WxH@hz. The capturer holds (requeues) buffers until the negotiated size matches — new expect_exact_dims plumbing VirtualOutput → registry (fresh creates only) → open_virtual_output → a self-disarming gate in the process callback — bounded by a 3 s deadline that accepts the producer's dims rather than wedging the session into the first-frame retry loop. set_custom_refresh reads back the full active mode; a size reject (pre-6.6 KWin) recreates plain at the real size @60. Every kscreen operation now addresses the output by its NUMERIC id, resolved by matching the managed name-prefix AND the just-created birth size (newest id wins): a mode-switch supersede reuses the per-slot output NAME (deliberately, for KWin's per-name config persistence) while the superseded sibling is still alive, and name addressing hit the FIRST match = the OLD output — on-glass that resized the live session's display out from under it (wrong-res/black), read the old output back as 'mode applied', and set the old output primary while the replacement starved at its birth mode. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	09113c9899	fix(encode/nvenc): cursor-blend PTX must carry a driver-portable ISA version ... The vendored cursor_blend.ptx was regenerated with the CUDA 13.3 toolkit, which stamps '.version 9.3' — and a driver whose JIT predates that ISA refuses the whole module with CUDA_ERROR_UNSUPPORTED_PTX_VERSION (222), silently killing host-side cursor compositing (on-glass: composite-mode cursor invisible on driver 595.58, KWin leg). The kernels use only baseline arithmetic, so hand-lower the version directive to 8.0 (CUDA 12.0), which every supported Turing+ driver JITs. Both files now warn that an nvcc regeneration re-stamps the version and must be re-lowered. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	4436c7fb61	fix(host/stream): composite mode re-blends the LIVE cursor on repeat ticks ... The frame-attached overlay is the pointer position at the last damage frame; repeats re-encoding a static desktop froze the blended cursor between redraws — on-glass the composite-mode cursor stuttered while window drags (constant damage) were smooth. Refresh the repeat's overlay from Capturer::cursor each tick so pointer-only motion re-blends at tick rate — the bandwidth the pre-channel embedded mode already paid. Linux only: the Windows capturer composites internally and its frames must never carry an overlay a blend path would double-draw. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	088004cac4	feat(linux/capture): serve the LIVE cursor overlay through Capturer::cursor ... The forwarder read only frame.cursor — the overlay attached to the LAST EMITTED frame. Mutter's pointer-only buffers update the capture-side cursor state but are skipped as frames, so between damage frames the forwarder re-sent a stale snapshot: on-glass the client cursor appeared exactly when clicking or crossing hover targets (damage) and froze/vanished otherwise — the same pointer-only-motion gap the Windows IddCx channel fills, which is why the encode tick already prefers the capturer's LIVE cursor. Publish the overlay from every dequeued buffer (frames or not) into a shared slot and implement the Capturer::cursor hook on PortalCapturer. Host-composite mode on Linux still updates the blended pointer only on damage frames (no re-encode of a static desktop on cursor motion) — the regen-on-cursor-change the Windows path has is a follow-up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	63d83217ef	fix(linux/capture): a stale id-0 cursor meta is 'no information', not 'hidden' ... Mutter only rewrites a buffer's SPA_META_Cursor region when the cursor changed; recycled buffers between damage frames carry a stale id-0 meta. Treating id 0 as a hidden pointer flickered the client cursor off between hovers on-glass — per the SPA contract id 0 is 'invalid/no cursor info', so keep the last-known state (OBS's consumer does the same). A genuinely hidden pointer stops producing updates; the M3 relative-mode hint keeps its Windows CURSOR_SUPPRESSED source. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	9db4841ce4	fix(linux/capture): cursor meta size range must cover Mutter's fixed 384x384 offer ... Mutter offers SPA_META_Cursor with a FIXED size pod — SPA_POD_Int(CURSOR_META_SIZE(384, 384)) in meta-screen-cast-stream-src.c — while our request capped the range at meta_size(256, 256). The intersection is empty, so the Meta param silently failed to negotiate and no buffer ever carried the meta region: the entire Linux cursor pipeline (forward AND blend) was blind on GNOME, proven by an on-glass probe counting 32k+ buffers with zero metas. KWin's offer fits inside 256², which is why the same consumer code passed there. Raise the max to 1024² headroom (the negotiated allocation follows the producer's value, not our max) and align the bitmap parse guard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	151adc4bcc	chore(m2b): TEMP cursor-meta probe — DROP BEFORE MERGE ... Rate-limited journal logging of SPA_META_Cursor arrival/absence, reported id/position/bitmap offset, and bitmap acceptance — the Linux cursor pipeline is otherwise blind end-to-end during Mutter RecordVirtual metadata bring-up on .21. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	0619af391e	fix(linux/inject): map absolute pointer/touch into the streamed output's region ... The libei absolute device advertises one region per logical monitor, and both MouseMoveAbs and touch mapped into regions().first() — whichever output the compositor announced first. Next to a physical monitor (on-glass: GNOME with a dummy HDMI beside the virtual primary) that put the pointer and every click on the WRONG output: the seat cursor never entered the streamed monitor, so neither embedded nor metadata cursor capture could ever see it, and the cursor channel had nothing to forward. Pick the region whose logical size matches the streamed mode (the wire flags already carry it); fall back to first() for the single-monitor case. Region geometry now rides the device-RESUMED log line for diagnosability; matching the screencast mapping_id instead of the size is the follow-up for same-sized-monitor ambiguity. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:47:53 +02:00
enricobuehlerandClaude Fable 5	afe120bf34	fix(linux/vdisplay): kwin virtual output ships the cursor as metadata too ... Same trap as the Mutter backend: zkde_screencast pointer mode 2 (embedded) never delivers SPA_META_Cursor, starving both the cursor channel and the encoder blend. Mode 4 (metadata) feeds both. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Fable 5	c29186bd1a	fix(host+vdisplay): a mode-switch replacement display inherits the group topology ... The resize rebuild creates the new virtual display BEFORE retiring the old one (create-before-drop), so the registry saw a live same-backend sibling — its own dying predecessor — and told the backend it was not first in group. Mutter then skipped the Primary/Exclusive apply ("joining an existing display group — extending") and the retiring owner took the topology with it: every resize silently demoted the virtual output to an extended, shell-less desktop. Thread the superseded pool gen through acquire so the replacement establishes topology, and stop counting kept (Lingering/Pinned) entries as demoting siblings — no session owns them, so there is no live desktop to clobber. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Fable 5	315ffaf144	fix(linux/vdisplay): mutter virtual monitor ships the cursor as SPA_META_Cursor ... RecordVirtual was created with cursor-mode EMBEDDED, which never delivers cursor metadata — the cursor channel had nothing to forward (client-drawn cursor invisible) and the always-built encoder blend had nothing to composite (host-drawn cursor invisible too). Metadata mode feeds both: non-forwarding sessions get the blended pointer (same pixels Mutter would have embedded), forwarding sessions strip the overlay and send shape/state. The capturer already negotiates the meta on every stream (meta_param). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	c63ac48c9c	fix(windows/capture): actually QUERY the HDR SDR-white scale — the refresh block was silently dropped ... faad4b57 shipped the field, shader scale, and plumbing but the scripted edit inserting the sdr_white_level_scale() refresh in the scratch-rebuild arm matched nothing and silently no-op'd (no assert) — sdr_white_scale stayed at its 1.0 init, i.e. 80 nits, i.e. exactly the old dark cursor. Now queried on every scratch rebuild, with an info log of queried/applied so an HDR session shows what it uses. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	cecc059830	fix(windows/capture): 250 Hz cursor poll + HDR white-scale observability ... - The polled position is also the composite-blend position: at 16 ms a 240 fps session reused a stale position for ~4 consecutive frames and the composited pointer visibly stuttered against the video. 4 ms out-paces every session rate; a tick is one GetCursorInfo syscall. - Log the queried DISPLAYCONFIG_SDR_WHITE_LEVEL scale on each blend- scratch rebuild so an HDR session shows what is actually applied (the virtual display's own SDR-brightness setting is the suspect when the cursor still reads dark). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	d31d41b6b8	fix(windows/capture): match the HDR-composited cursor to the target's SDR white level ... sRGB→linear alone lands cursor-white at 80 nits (scRGB 1.0) while DWM composes the surrounding SDR desktop at the user's SDR-brightness setting (~200+ nits by default) — the cursor read visibly dark on HDR. Scale by DISPLAYCONFIG_SDR_WHITE_LEVEL (new win_display::sdr_white_level_scale, queried on blend-scratch rebuilds — the CCD query stays off the per-frame path). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	6e37da8b4e	fix(windows/capture): clippy unnecessary_lazy_evaluations in scratch build ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	0af280a793	feat(windows/capture): host-side cursor compositing for the capture model — the deterministic fix ... Root cause, proven on-glass across five driver builds: a declared IddCx hardware cursor is IRREVOCABLE. There is no un-declare DDI, the empty-caps re-setup is rejected INVALID_PARAMETER, and after a successful same-mode re-commit with the driver's re-declare provably suppressed (sticky per-target flag, zero re-setups logged) DWM still never composites the software cursor back into the monitor's frames. Every DWM-based composite flip is therefore unfixable. The composite (capture) model is now implemented in OUR pipeline: - the driver keeps its hardware cursor declared for the session's whole life (the state that works) — frames stay pointer-free always; - in composite mode try_consume routes the conversion through a blend scratch: slot copy + one alpha-blended quad of the GDI poller's shape at its polled position (CursorBlendPass — fullscreen-triangle VS with viewport placement, straight-alpha PS, sRGB→linear for FP16/HDR rings), covering all four convert paths (NV12, 4:4:4 copy, P010, PyroWave) GPU-side under the slot's keyed mutex; - pointer-only motion produces no driver publish (declared hw cursor), so try_consume REGENERATES from the last slot whenever the polled cursor state changes — the cursor moves on a static desktop at tick rate, without faking freshness for the stall/death watchdogs; - set_cursor_forward becomes purely host-internal state; the SET_CURSOR_FORWARD IOCTL machinery is no longer used by the host (driver keeps it, dormant) and its sender plumbing is removed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	89cfef429e	fix(windows/vdisplay): cursor-render state sticky per TARGET across monitor generations ... On-glass: 're-setup on swap-chain assign -> 0x0' fired AFTER 'enable=0 stored' — duplicate/successor monitor entries (re-arrival churn) kept their default-true flag and re-declared the hardware cursor right after the composite flip's re-commit, undoing it. The desired state now lives in a per-target static (CURSOR_FORWARD_DESIRED): every arrival inherits it (no generation can resurrect a declare the session turned off), and the flip stamps EVERY live entry matching the target, declaring against whichever has the live worker. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	b50e4767de	fix(windows/cursor-flip): flag + forced same-mode re-commit — the working un-declare ... The empty-caps un-declare is REJECTED by IddCx (STATUS_INVALID_PARAMETER, on-glass driver 9.9.0722.1407) — there is no un-declare DDI. The composite flip now works with the only lever the OS gives us: every mode COMMIT reverts the path to the software cursor, and the driver skips its per-commit re-declare while cursor_forward_on is off. So: - driver: disable stores the flag only (no DDI call); enable still declares immediately against the live worker's event. - host capturer: after a successful disable flip, force a same-mode re-commit (win_display::force_mode_reenumeration) — DWM composites the pointer from the very next commit; the swap-chain flap is the class the driver's preserved-publisher machinery already rides out. - state now survives re-arrivals end-to-end: the capturer caches the APPLIED state (cleared on every channel (re)delivery, which re-created driver entries need — their flag defaults to declared), and the stream loop re-applies every tick instead of edge-gating (steady-state cost: one Option compare). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	79d30fde64	fix(windows/capture): unsafe block for the extracted dup_into_public call ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	6a8df2ba97	fix(windows/cursor-flip): survive driver-side monitor re-arrival — flag-based flip + channel re-delivery ... On-glass (.173, match-window session): every window-size convergence re-creates the driver-side monitor (re-arrival resize / sibling-session slot churn), destroying the cursor worker the channel was delivered to — the flip then died NOT_FOUND (no entry with target_id ∧ worker) and the declared state was lost entirely. Driver: set_cursor_forward becomes STATE, not an edge on one monitor generation — find by target_id ∧ hw_cursor, store cursor_forward_on even without a live worker (it steers the next delivery/re-setup); declare/un-declare only when a worker exists. Channel delivery honors the flag: setup_and_spawn(declare=false) adopts + spawns WITHOUT declaring (composite mode), so a later enable-flip declares against the worker's event. Host: retain the SET_CURSOR_CHANNEL sender; extract deliver_cursor_channel and RE-deliver the surviving section on every ring recreate and — with one retry — when a flip IOCTL fails (the re-arrived entry gets a fresh worker, declared per its flag). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	030a779391	feat(windows/vdisplay): the driver leg of the mid-stream cursor-render flip ... Belongs to 493f4fae (which shipped only the crates/ side — this packaging/ half was left unstaged, so the deployed driver silently lacked the IOCTL and every flip died NOT_FOUND at dispatch): IOCTL_SET_CURSOR_FORWARD dispatch + monitor::set_cursor_forward (cursor_forward_on flag, resetup gate) + cursor_worker:: unsetup_hardware_cursor (empty-caps un-declare experiment). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	d86073dc6a	feat(apple/cursor): send the mid-stream cursor-render flip — ABI v12 ... PunktfunkConnection.setCursorRender(clientDraws:) over the new punktfunk_connection_set_cursor_render export, driven by one edge-detected reconciler in StreamView (clientDraws = captured && desktopMouse) called from every transition — the ⌃⌥⇧M chord, engage/release, and session start. Capture model and released now get the host-composited pointer back in the video (full fidelity); the desktop model keeps the local NSCursor path. xcframework rebuilt v12. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	92761813a9	feat(core+host+driver+client): mid-stream cursor-render flip — host composites in the capture model ... The cursor channel excluded the host pointer from the video for the whole session, but the client only draws it under the DESKTOP mouse model — flipping ⌃⌥⇧M to capture mid-stream left the session pointer-blind (user-found). The fix makes render ownership LIVE state: - wire: CursorRenderMode 0x51 (client→host, control stream) — client_draws: true = desktop model (host excludes + forwards), false = capture model / released (host composites, full fidelity — DWM on Windows incl. real XOR inversion, encoder blend on Linux). Sessions start client_draws=true (the pre-message behavior). - host: control task stores the flag; the encode loop edge-detects it — forwarding + frame.cursor strip while the client draws, quiet forwarder + overlay-into-blend while composited. SessionPlan now grants blend CAPABILITY wherever the capture has a pointer (dropping the !cursor_forward gate) so the composite side needs no encoder rebuild; per-tick frame.cursor decides what is drawn. - Windows: Capturer::set_cursor_forward → retained IOCTL_SET_CURSOR_FORWARD sender (proto v6) → driver (un)declares the IddCx hardware cursor on the LIVE monitor. Un-declare re-issues the setup with EMPTY caps (candidate mechanism — the DDI has no documented un-setup); resetup-on-commit is skipped while off, so a mode commit's software-cursor default is the fallback path. Failure against a pre-v6 driver logs and keeps declared-at-ADD behavior. - SDL client: one edge-detected reconciler at the cursor pump site — desktop-active = client draws; capture model or released = host composites. Covers the chord, the M3 auto-flip, and engage/release. - C ABI v12: punktfunk_connection_set_cursor_render (additive; wire version unchanged — pre-§8 hosts ignore the unknown message type). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	0420be9fa5	fix(apple/cursor): reset per-session cursor-channel state in stop() ... cursorChannelActive/hostCursors/cursorState stayed latched across sessions — a next session against a host WITHOUT the cursor cap would wear the previous session's stale shapes via resetCursorRects. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	f2082f8b57	fix(windows/capture): drop redundant unsafe at the poller-spawn CCD call (inside open_on's unsafe region) ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	9162e7b451	fix(windows/vdisplay): drop now-unused INFINITE import (poll-loop wait) ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	e59634a578	feat(windows/capture): GDI cursor-shape poller — masked/monochrome cursors for the cursor channel ... The M2c redesign (design/remote-desktop-sweep.md §8): the IddCx hardware- cursor query is alpha-only by design — IDDCX_CURSOR_SHAPE_TYPE has no monochrome value, the OS pre-converts monochrome to masked-color, and masked-color delivery is dead code on modern builds (proven on-glass at every ColorXorCursorSupport level). The driver keeps its hardware cursor declared (XOR FULL) purely so DWM excludes every cursor type from the IDD frame; the SHAPE now comes from a GDI poller in the capture host — which runs as SYSTEM inside the interactive session, so no helper process is needed. CursorPoller (idd_push/cursor_poll.rs, the RustDesk/WebRTC/OBS pattern): ~60 Hz GetCursorInfo on a dedicated thread; rasterise via CopyIcon→GetIconInfo→GetDIBits only when the HCURSOR value changes; monochrome via the WebRTC truth table with invert pixels as opaque black plus a white outline; AND-mask alpha for alpha-less color cursors; CURSOR_SUPPRESSED = hidden; per-output visibility via the target's desktop rect; per-monitor-V2 DPI awareness thread-scoped; input-desktop reattach on failure + 2 s cadence (GetCursorInfo on a stale desktop succeeds with stale data). Spawned iff the cursor channel was delivered; a live poller is the sole overlay source (no serial-namespace mixing) — the driver shm read remains as fallback if the poller dies. Not chosen: DXGI Desktop Duplication GetFramePointerShape — PointerPosition.Visible goes stale under injected-only input on current Win11 (Sunshine #5293, exactly our topology), it burns one of the session's four duplication slots, and IDD-output metadata has conflicting field reports. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Opus 4.8	d2cc770938	fix(windows/vdisplay): QueryHardwareCursor3 + per-mode-commit cursor re-setup — M2c findings ... Durable results of the M2c on-glass bring-up (.173, 2026-07-22): - The base IddCxMonitorQueryHardwareCursor DDI slot is stubbed to STATUS_NOT_SUPPORTED on WDK 26100 — add the ...QueryHardwareCursor3 wrapper (wdk-iddcx) and drain it instead; v3 X/Y are only meaningful when PositionValid, so a position-invalid tick keeps the prior position. - Hardware-cursor setup is per-mode-commit: the OS silently reverts to a software cursor on every mode commit, so re-issue the setup on each swap-chain assignment (monitor::resetup_cursor, called from assign_swap_chain) or the query fails NOT_SUPPORTED forever. - One caps definition for initial setup and re-setup, resting at XOR FULL: the query delivers ONLY alpha shapes in every configuration (all three ColorXorCursorSupport levels, event-driven and 30 Hz polled) — masked/monochrome cursors never arrive. FULL keeps the frame cursor-free for ALL cursor types; the full-fidelity shape comes from the session-side cursor source in the host (design/remote-desktop-sweep.md §8). - Poll the query at ~30 Hz instead of pure event-wait: masked cursors never fire the data event, and the seqlock's position/visibility should stay fresh regardless. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Fable 5	2bbcbc81c6	fix(apple/cursor): disable M3 visibility-based auto-flip — it broke desktop drags ... On-glass (Mac ↔ Windows M2c host): the host cursor's VISIBILITY is not a usable 'a game grabbed the mouse' signal — Windows hides the pointer for ordinary desktop activity (clicking, typing). The per-frame forwarder turned those transients into relative_hint=true, so the client flipped desktop→capture→desktop, which (a) warped the cursor to view-centre and (b) flushed held buttons via releaseAll — a spurious mouse-up ~200 ms into every press that broke window dragging/resizing. Disable the auto-flip; the mouse model stays user-driven (⌃⌥⇧M). The hint still rides the wire, unused, for a future M3 that keys off a REAL pointer-lock signal (host-side ClipCursor/raw-input detection) instead of visibility. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Fable 5	a99ef7f940	fix(windows): hw_cursor_capable must not assume an initialised display manager ... The FIRST session's Welcome runs before any backend construction (vdisplay::open happens at display prep, after the Welcome), so the capability probe's vdm() expect panicked the very first handshake of a fresh service — the client saw a dead connect and auto-wake kicked in. init() is idempotent and the driver facade is a unit struct, so the probe now initialises the manager itself. Found on-glass (.173, first Mac-client connect), fix deployed there. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Fable 5	ec8ca9a535	feat(apple): cursor channel on the Mac client — ABI v11 + NSCursor rendering ... The Mac client now exercises the full cursor channel against capable hosts: desktop-mode sessions advertise CLIENT_CAP_CURSOR, the host stops compositing the pointer, and StreamView draws the forwarded shapes as the real NSCursor — plus the M3 host-driven model flip. - ABI v11: punktfunk_connect_ex9 (adds client_caps; ex7/ex8 pass 0 — Android untouched), PunktfunkCursorShape/State + the two next_cursor_* poll fns (audio-style borrow contract), and PUNKTFUNK_CLIENT_CAP_CURSOR. Fixed in passing: the first insertion split next_host_timing's cfg/no_mangle attributes off the fn, which silently dropped the symbol from the header AND dylib — caught by the Swift build, reattached with its docs. - PunktfunkConnection: clientCaps connect param, hostSupportsCursor, CursorShapeEvent/CursorStateEvent + nextCursorShape/nextCursorState (one cursor thread drains both planes; cursorLock joins the close() ladder). - SessionModel: desktop-mode sessions (DefaultsKey.mouseMode) connect with the cursor cap on macOS. - StreamView: shape cache (serial → NSCursor, straight-alpha RGBA via CGImage), resetCursorRects wears the HOST shape while the desktop model is engaged (hidden host pointer ⇒ invisible), latest-wins state pump, and the M3 auto-flip — edge-triggered on relative_hint, ⌃⌥⇧M sets an override latch cleared by the next host edge, leaving relative warps the pointer to the host position via the inverse letterbox mapping (CGWarpMouseCursorPosition, CursorCapture's coordinate convention). Verified: swift build + full test suites green (xcframework rebuilt at ABI v11, signed); core 218 tests + clippy -D warnings on Linux (.21). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Fable 5	3a34440a6b	feat(windows): IddCx hardware-cursor channel — remote-desktop sweep M2c ... Brings the cursor channel to Windows hosts. The pf-vdisplay driver declares an IddCx hardware cursor for sessions that negotiated cursor-forward — DWM then EXCLUDES the pointer from the IDD frame and delivers shape/position out-of-band, into the same CursorOverlay → forwarder → wire → client pipeline the Linux portal path uses. - pf-driver-proto v5 (additive, host floor stays 3): AddRequest's spare tail becomes hw_cursor (same size/offsets); IOCTL_SET_CURSOR_CHANNEL delivers a host-created CursorShm section (64-byte seqlock header + 256² shape buffer, layout pinned + tested). No event crosses the boundary — the host polls at encode-tick pace. - driver: wdk-iddcx grows the two cursor DDI wrappers; a per-monitor cursor worker (event wait → QueryHardwareCursor → seqlock publish) starts only when BOTH the ADD asked and the channel arrived, so a failed delivery leaves DWM compositing as today. Shape bytes ship raw (BGRA/masked + pitch); the host converts. - host: the section rides the existing sealed-channel broker (least- privilege dup, remote reap on failure); IddPushCapturer::cursor() seqlock-reads → CursorOverlay (BGRA→RGBA, masked-color approximation, desktop→frame origin shift, per-shape conversion cache). New Capturer::cursor() trait hook — the encode loop prefers it over the frame-attached overlay because hardware-cursor moves produce NO new frame on a static desktop. hw_cursor survives the re-arrival resize (carried on the manager's Monitor). - negotiation: cursor_forward grows the Windows arm (client cap ∧ driver proto ≥ 5, probed once via the control device); SessionPlan carries cursor_forward → OutputFormat.hw_cursor. - drive-by: wdk-probe's two pre-existing same-type casts (clippy) and pf-vdisplay's stale spike-test refs (crate::win_display moved to pf-win-display; tracing-subscriber was never a dep) repaired. Verified: proto tests on Mac AND MSVC (15/15 incl. the CursorShm layout pin); clippy -D warnings for proto/frame/capture/vdisplay/host on Linux (.21) and native Windows (.173); the DRIVER workspace clippy -D warnings green against the real WDK 10.0.26100 bindgen (DDI names, enum variants and IDARG layouts all bind). On-box driver deploy + on-glass validation follow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Fable 5	c3cbffe662	feat(host+client): host-driven mouse-model flip — remote-desktop sweep M3 ... The full Parsec model: launching a game from a desktop session flips the client into captured relative automatically, and back — no chords. - Capture overlay now distinguishes 'hidden' from 'no cursor yet': CursorOverlay grows a visible flag, overlay() returns Some whenever a bitmap is known (the encode loop strips invisible overlays after forwarding so no blend path ever draws one; the CPU composite guarded on visibility already). - Host forwarder maps it onto the reserved wire bit: visible ⇒ VISIBLE, hidden-but-known ⇒ RELATIVE_HINT (an app grabbed/hid the pointer), never any hint before the first bitmap — a cold start can't flip a desktop session into capture. - Presenter: edge-triggered auto-flip on hint changes via the new Capture::set_desktop (chord semantics untouched); a manual ⌃⌥⇧M sets an override latch that holds until the HOST's intent next changes, so the hint never fights the user. Leaving relative warps the local cursor to the host's last pointer position through the new content_to_window inverse-letterbox mapping (unit-tested against finger_to_content) — the hand-back is seamless. Verified on .21: fmt + clippy -D warnings + tests (presenter 20 incl. the inverse-mapping roundtrip, host 245). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Fable 5	4a01bc4463	feat(core+host+client): cursor channel — remote-desktop sweep M2a+M2b ... The host cursor stops riding the video and becomes a real OS cursor on the client (the Parsec/RDP model): pointer feel no longer pays the capture→encode→network→decode→present round trip. Wire (M2a): - Hello grows a client_caps trailing byte (CLIENT_CAP_CURSOR) after the fixed display_hdr block — presence disambiguated by remaining length, which caps the post-HDR tail at 27 bytes (documented); Welcome answers HOST_CAP_CURSOR (capable-and-asked, the 444/clipboard precedent). - CursorShape (0x50, control stream): serial + dims + hotspot + straight RGBA, ≤120px/side so the u16 frame always fits (128² would overshoot); client caches by serial — re-showing a known shape costs 14 bytes, not a bitmap (RDP pointer-cache for free). - CursorState (0xD0 datagram): serial + visible/relative_hint flags + position, sent once per encode-loop tick — latest-wins, self-healing under loss, no refresh timer. relative_hint is reserved for M3. - Client core: two new planes (control-task + datagram-task arms) → next_cursor_shape/next_cursor_state; connect() grows client_caps (C ABI passes 0 until the v11 cursor poll fns exist). Host (M2b, Linux portal only): - handshake::cursor_forward is THE predicate (client asked ∧ Linux ∧ compositor ≠ gamescope) — Welcome bit and session wiring both read it. - SessionPlan.cursor_blend goes false for a forwarding session; the encode loop ticks a CursorForwarder every iteration: shape-serial diff → control-task bridge (mirrors probe_result), state datagram → conn. - CursorOverlay/capture CursorState carry the hotspot through (nearest-neighbor downscale backstop for XL cursors, unit-tested). Presenter: - CursorChannel drains both planes per loop iteration; shapes become SDL color cursors (from_surface + hotspot), applied while the desktop mouse model is engaged; visibility follows the host; capture/released hands back the system cursor. Sessions advertise the cap when they START in desktop mode. Verified on .21: fmt + clippy -D warnings (7 crates) + tests green (core 218 incl. new wire roundtrips, host 245 incl. e2e + forwarder downscale tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:43:23 +02:00
enricobuehlerandClaude Fable 5	97d20e1f0a	feat(apple/input): desktop (absolute) mouse mode on macOS — remote-desktop sweep M1 ... Folds the parked client-side-cursor machinery (cursorMode auto/always/ never, hidden while disabled) into the cross-client mouse model: MouseInputMode capture|desktop under DefaultsKey.mouseMode, picked in Settings ▸ Keyboard & mouse (macOS), resolved at session start and gated off on gamescope hosts (relative-only EIS). Desktop model = the un-neutered absolute path with the SDL cursor policy: pointer never disassociated (enters/leaves the stream freely), monitor forwards letterboxed absolute positions, and the local cursor hides only while over the view via an invisible-cursor rect (the host's composited cursor is the one you see; AppKit manages the rect, so no hide/unhide balancing). ⌘⇧C becomes ⌃⌥⇧M — the same chord as the SDL clients — flipping the model live with an atomic release/re-engage. Verified: swift build + full test suites green (macOS arm64). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:37:32 +02:00
enricobuehlerandClaude Fable 5	df04880273	feat(client/input): desktop (absolute) mouse mode — remote-desktop sweep M1 ... New physical-mouse model beside capture: Desktop leaves the pointer uncaptured and sends absolute positions through the letterbox (MouseMoveAbs — every host injector already consumes it). Capture stays the default and the game model. - pf-client-core: MouseMode (capture|desktop) persisted in Settings, default capture so existing stores are unchanged. - pf-presenter: Capture grows a desktop model — latest-wins pending abs position coalesced per loop iteration (same 1000 Hz discipline as relative), flushed before clicks/keys/wheel so they land where the cursor is; Ctrl+Alt+Shift+M flips the model live; local cursor stays hidden over the window (the host's composited cursor is the one you see until the M2 cursor channel); Windows keyboard grab only engages for capture (a desktop stream is something you Alt-Tab away from). - gamescope gating: its EIS is relative-only, so desktop mode is pinned off there (resolved_compositor), with a log note. - Settings surfaces: GTK row (dynamic caption), WinUI combo, console-UI row + step test, capture-hint line. Verified: fmt + clippy -D warnings + tests (33/40/19) on Linux .21; clippy -D warnings for all five crates incl. punktfunk-client-windows native on .173. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 23:37:32 +02:00
enricobuehlerandClaude Fable 5	73fee86337	chore(release): bump workspace version to 0.18.0 ... The 0.17.2 placeholder underestimated this cycle: Android mouse & keyboard (physical mouse + capture, TV remote-as-pointer, IME text, clipboard), the new committed-text input plane (InputKind::TextInput / HOST_CAP_TEXT_INPUT), and the ChaCha20-Poly1305 session cipher are feature work — a minor, not a patch. Wire/driver/C-ABI markers all unchanged (2 / 4 / 10): every addition is negotiated or ignored by older peers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 22:13:20 +02:00
enricobuehlerandClaude Fable 5	b5ed486243	ci(android): survive fleet-load download truncation in the SDK setup ... The android leg failed twice on 2026-07-22 with sdkmanager's "Error on ZipFile unknown archive" — once in our NDK/build-tools step, once inside setup-android's default package set. Root cause is the shared runner fleet dropping packets under parallel-job load (the same class retry.sh documents for the flatpak leg): sdkmanager unzips while streaming, so a truncated stream reads as a corrupt archive. A solo re-download on the same runner verified clean. - setup-android: install only platform-tools — the action's default legacy `tools` package drags in the ~250 MB emulator this job never uses, which was the largest and flakiest download in the whole leg. - NDK/build-tools/CMake: wrap sdkmanager in retry.sh (4 attempts, linear backoff) — a failed attempt leaves no partial package, so re-invoking is safe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 22:12:02 +02:00
enricobuehlerandClaude Opus 4.8	0e7f6d85d6	feat(gamestream): signal HDR mode to the client via the 0x010e control message ... punktfunk negotiates HDR correctly (the stream is BT.2020 PQ 10-bit) but never told the client to switch its display into HDR picture mode, so HDR streams stayed in SDR on the TV. Sunshine sends an async control-stream message (IDX_HDR_MODE, type 0x010e, carrying SS_HDR_METADATA) shortly after the stream starts; Moonlight only flips the TV into HDR on that cue. We sent exactly one host→client control message (rumble 0x010B) and never this one. (aurora-tv PR #53 worked around it client-side by inferring HDR from the negotiated format; this fixes it host-side so stock Moonlight clients switch too.) Once the control stream is live and the session negotiated HDR, send a one-shot 0x010e message (enable + 26-byte SS_HDR_METADATA from generic HDR10 defaults), latched per connection and re-armed on Disconnect. The rumble sequence counter is unified into a single monotonic `host_seq` shared by both message types — the GCM nonce derives from `seq`, so a separate per-type counter would reuse (key, nonce) pairs in the host direction. The BT.2020 PQ VUI already rides the bitstream (the encoder derives it from the P010 capture format), so this is purely the missing "switch now" signal; no encoder change needed. Wire layout locked by unit tests. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 21:35:16 +02:00
enricobuehlerandClaude Opus 4.8	2dddf0fefc	fix(gamestream): accept legacy X.509 v2 Moonlight client certs in mTLS pairing ... rustls-webpki 0.103 accepts only X.509 v3 certs and returns `UnsupportedCertVersion` for anything older, aborting the mTLS handshake at the `CertificateVerify` step before it ever checks the signature. The moonlight-embedded client family (moonlight-embedded, aurora-tv, …) still mint self-signed **v2** certs with no keyUsage extension, so pairing fails against punktfunk while it works against Sunshine — whose OpenSSL verify callback never inspects the cert version. (aurora-tv PR #53 worked around this client-side by switching to v3 + keyUsage; this fixes it host-side for stock clients too.) The cert's X.509 version and extensions carry no security weight here: the client cert is self-signed and pinned by SHA-256 (`peer_is_paired`), and the PIN pairing ceremony is the real proof of identity. The property that DOES matter — that the peer holds the private key for the cert it presented — is still enforced: when webpki rejects the cert we re-run exactly that `CertificateVerify` check with a version-agnostic parser (x509-parser SPKI + the same `rsa` verify `pairing::verify256` uses). This is a full cryptographic check, never a bypass: a bad signature still fails, and non-RSA / unsupported schemes fall through to webpki's original error. Matches Sunshine's leniency without loosening the pinned trust model. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-22 21:35:03 +02:00
enricobuehlerandClaude Fable 5	c90343c22f	feat(android): shared clipboard (text) — device↔host sync while streaming ... The desktop clients' clipboard protocol, adopted on Android (text-only v1): opt-in ClipControl at stream start when the host advertises HOST_CAP_CLIPBOARD and the new "Shared clipboard" setting (default on) allows. Device → host: local copies (primary-clip listener + a probe at start) are announced as lazy format-list offers; the text crosses only when the host actually pastes (FetchRequest → served from the live clipboard). Host → device: a host copy's offer is fetched eagerly and lands in the system clipboard (Android has no practical lazy-paste provider), with an echo guard so the resulting clip-changed callback doesn't bounce it back as a new offer. Native side: session/clipboard.rs JNI shims over NativeClient's clip_* surface; events cross to Kotlin as compact strings from a blocking nativeNextClip poll on a dedicated thread (the nativeNextRumble pattern), joined before the session handle is freed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 19:27:19 +02:00
enricobuehlerandClaude Fable 5	abe6228b42	feat(core+host+android): committed-text input plane (IME path) — InputKind::TextInput ... The VK key-event vocabulary cannot express text an input method COMMITS (autocorrect, gesture typing, non-Latin scripts, emoji). Add a first-class text event and negotiate it: - punktfunk-core: InputKind::TextInput (= 15) carries one Unicode scalar per event in `code`; HOST_CAP_TEXT_INPUT (0x04) in Welcome::host_caps. - Host advertises the cap only where the session's inject backend can type text: Windows SendInput (KEYEVENTF_UNICODE, surrogate-pair aware) and the Linux wlroots backend — a dedicated second zwp_virtual_keyboard whose xkb keymap grows Unicode keysyms on demand (the wtype model), so keymap re-uploads never disturb the main device's layout/modifier state. The KWin-fake-input/libei/gamescope backends can only press layout keycodes, so those sessions don't set the bit and clients keep the VK fallback. - GameStream plane: Moonlight's UTF-8 text packet (MAGIC_UTF8, previously recognized-and-dropped) now decodes to the same TextInput events. - Android: KeyCaptureView picks a real editable InputConnection when the host has the cap — the IME runs its full machinery, mirrored to the host live via common-prefix diffs of the composition (backspaces + new suffix), with setComposingRegion adopting committed text so autocorrect-revert flows diff instead of retyping; newline→Enter, deleteSurroundingText→Backspace/Delete. Older hosts keep the TYPE_NULL raw-key path unchanged. - keymap: media VKs (0xB0-0xB3) → evdev so the Android media keys land on Linux hosts too. Verified: punktfunk-core + host gamestream + pf-inject tests green on Linux (Ubuntu box), clippy clean; Android app+native builds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 19:19:11 +02:00
enricobuehlerandClaude Fable 5	ddb72edcba	feat(android): physical mouse + TV remote-as-pointer + keyboard hardening ... Phase A — hardware mouse: new MouseForwarder routes every SOURCE_MOUSE event while streaming. Uncaptured (default): hover/drag positions forward as absolute cursor moves, wheel with fractional accumulation (high-res wheels), all five buttons incl. back/forward as X1/X2; the local cursor is hidden over the stream (TYPE_NULL pointer icon) so the host's composited cursor is the visible one. Captured ("Capture pointer for games" setting, or Ctrl+Alt+Shift+Q live): the OS pointer is grabbed via requestPointerCapture on the (repurposed) key-capture view and raw relative deltas forward as mouse-look; held buttons are tracked and flushed on capture loss/teardown, and the engaging click is swallowed (desktop parity). Mouse clicks are intercepted before Compose so they can never be misread as trackpad taps; a mouse back-button's FALLBACK BACK is dropped so it can't yank the user out of the stream. Phase B — keyboard: media/consumer keys (play/pause/next/prev/stop) now map to their VKs instead of falling to the system; TV-remote SELECT maps to Enter. Phase D — Android TV: RemotePointer turns a D-pad-only remote into a pointer (Siri-remote analogue): hold SELECT ~0.8s toggles, D-pad glides the host cursor with ramped acceleration (Choreographer-paced, diagonal-normalized), SELECT taps click, play/pause right-clicks, holding it toggles the on-screen keyboard, BACK leaves pointer mode; an overlay hint teaches the vocabulary. Settings: "Capture pointer for games" + "Invert scroll direction" (applies to the wheel and two-finger touch scrolling). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 18:56:38 +02:00
enricobuehlerandClaude Fable 5	5e088af7ed	fix(pf-win-display): unpin mode indexes on paths the CCD isolate deactivates ... Field report: with Exclusive Topology, the physical monitor sometimes stayed lit — every isolate attempt re-committed and failed SetDisplayConfig with 0x57 ERROR_INVALID_PARAMETER. Clearing DISPLAYCONFIG_PATH_ACTIVE alone leaves the deactivated path's source/target modeInfoIdx pinned to the queried mode entries, and per the SetDisplayConfig contract a path being turned off must have BOTH mode indexes set to DISPLAYCONFIG_PATH_MODE_IDX_INVALID; some driver/topology combinations (notably when the doomed path shares a source with the kept virtual path) reject the supplied config outright, so the retry loop could never converge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 12:26:44 +02:00
enricobuehlerandClaude Fable 5	b7a00137eb	feat(host): hold a logind sleep/idle inhibitor while clients stream ... Remote INPUT resets the compositor's idle timers, but a passive (video-only) viewer sends none — observed live: a SteamOS Game-Mode host s2idled mid-day and dropped off the network (in a VM with GPU passthrough it never woke again). Refcounted across planes: the native LiveSessionGuard and the GameStream video worker each hold a share; first hold takes the logind sleep:idle block inhibitor on a dedicated plain thread (zbus blocking must not run on a tokio worker), last drop releases. Best-effort: no logind → warn once and stream on. No-op off Linux (macOS/Windows manage their own assertions). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 12:09:47 +02:00
enricobuehlerandClaude Fable 5	acce43ebbf	feat(steamdeck): self-healing reliability — post-OS-update rebuild check + script/docs polish ... - rebuild-check.sh + punktfunk-rebuild-check.service (enabled, ordered Before=punktfunk-host): ldd-probes the host binary at session start — milliseconds when healthy, a full update.sh rebuild only when a SteamOS update actually broke its library links. update.sh restarts go --no-block so the check → update.sh → restart chain can't deadlock against the unit ordering. update.sh retrofits the unit. - installer summary: web console is https (the unit serves TLS). - docs: steamos-host.md (runner in the build step, keep-list + auto rebuild = updates survive hands-free), gamescope.md (Gaming Mode touch = single-finger pointer, exact taps, no multi-touch), plugins.mdx (SteamOS runner note), scripts/steamdeck/README.md (rebuild-check, runner payload, keep list, honest packaging trade-off + the CI-prebuilt future direction). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 11:56:09 +02:00
enricobuehlerandClaude Fable 5	35923080fb	fix(host/linux): scale degenerate-region absolute coords by the session's real output size ... The raw-client-pixels fallback is exact only while the managed session runs at the client's mode. When they diverge — foreign-gamescope attach at its own resolution, supersample/under-render, transitions — raw pixels drift or land out of range. The EIS relay file now carries the session's current output size as a second "WxH" line (from current_gamescope_output_size()); the injector scales normalized client positions into it, keeping raw pixels only as the last resort. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 10:53:14 +02:00
enricobuehlerandClaude Fable 5	0c9461242c	fix(host/linux): don't normalize absolute coords into gamescope's degenerate INT32_MAX EIS region ... The previous commit's no-region fallback never fired: gamescope DOES advertise a region — (0,0,INT32_MAX,INT32_MAX), meaning "coordinates are raw". Mapping normalized positions into it explodes a center tap to x≈1e9, clamped by gamescope to the far corner — the cursor pinned at (1279,799) and every degraded-touch tap landing there. Treat a region as an output geometry only when plausibly sized (≤16384 px); otherwise emit raw client pixels. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 10:40:02 +02:00
enricobuehlerandClaude Fable 5	cc6b37fef0	fix(host/linux): emit absolute pointer/touch on region-less EIS devices + abs input-test probe ... gamescope's "Gamescope Virtual Input" advertises pointer_abs but no region, so every MouseMoveAbs (and the degraded-touch moves built on it) was silently dropped (emitted=false) — clicks then landed at a stale cursor position. With no region, the managed session runs at the client's mode, so client pixels are output pixels: emit them raw. Also: log region count/dims at device-resume, and add PUNKTFUNK_INPUT_TEST_ABS=WxH to `input-test` (corners + center, 1s apart) so the degraded-touch path is verifiable with xdotool alone. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 10:36:05 +02:00
enricobuehlerandClaude Fable 5	1927077cbe	fix(host/linux): degrade touch to absolute pointer when the EIS has no touchscreen device ... gamescope's EIS ("Gamescope Virtual Input") advertises pointer/ pointer_abs/button but never a touchscreen — so in Game Mode every remote TouchDown/Move/Up was dropped on the floor (Desktop Mode works via KwinFakeInput, which does touch). Headless KWin's libei has the same gap. Instead of dropping: degrade to a single-finger absolute pointer — down = abs-move + left press, move = abs-move, up = release — synthesized through the normal Mouse* inject paths so region mapping, held-state tracking, and release_all apply. First finger drives the pointer; later fingers are ignored (a pinch degrades to a drag). A touchscreen device appearing later takes over on the next touch — checked per event, never latched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 10:24:28 +02:00
enricobuehlerandClaude Fable 5	068da456f5	fix(steamdeck): survive SteamOS A/B updates — register system tuning on the atomic-update keep list ... Verified live on a SteamOS 3.8.14→3.8.16 update: the A/B partset switch rebuilds /etc and drops everything not on Valve's keep list — the udev rule (uhid access: virtual pads silently degrade to Xbox 360), the vhci-hcd autoload (native Deck pad transport), and the UDP buffer sysctl (back to 208 KB → stutter). Valve's sanctioned extension point is a drop-in under /etc/atomic-update.conf.d/ — itself on the stock keep list, so it self-preserves. install.sh §4 and update.sh now register scripts/punktfunk-atomic-keep.conf there. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 10:07:19 +02:00
enricobuehlerandClaude Fable 5	256aa5f7f2	fix(steamdeck): install the plugin runner + harden Deck pad typing + repair update.sh ... - scripts/steamdeck/install.sh (§2b) + update.sh: build and install the scripting runner user-scoped (~/.local wrapper + pinned bun + bundle) — SteamOS's read-only /usr can't take the .deb layout, so the console's plugin store reported "the plugin runner isn't installed" on every SteamOS host. update.sh retrofits it onto existing installs. - plugins.rs runner discovery: check the ~/.local layout after the /usr ones; mention the SteamOS path in the not-installed error. - update.sh: define warn() — it was used but never defined, so under `set -e` the first warn aborted the update before services restarted. - pf-client-core gamepad: a Steam Input virtual pad forwarded on a real Deck (the only-pad case) now declares the DECK kind in its per-pad arrival instead of the wrapper's Xbox 360 identity — the session-level auto_pref already resolved SteamDeck, but the arrival overrides it on current hosts. - reject tests: cover SetupFailed; move the foreign-code probe off 0x68. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 10:01:54 +02:00
enricobuehlerandClaude Fable 5	2562663fc6	fix(host/linux): survive and self-heal dead gamescope sessions on headless SteamOS boxes ... Three fixes for the "most connects simply fail" trap on a SteamOS host with no physical display (VM testbox, panel-less mini PC): - restore path: skip the restore-to-physical-panel when no DRM connector reports a connected display — removing the headless drop-in and restarting gamescope-session.target on such a box just crash-loops gamescope and strands every later connect on "no usable compositor". Keep the headless session (and the takeover state) instead. - connect path: when no live graphical session exists but the MANAGED gamescope infra is present (SteamOS gamescope-session / Bazzite session-plus), route to the gamescope takeover — which rebuilds the session at the client's mode — instead of failing the connect. - error delivery: a session-setup failure used to just drop the QUIC connection, reaching the client as "control stream finished mid-frame" (indistinguishable from transport trouble). Close with a typed setup-failed code (0x68, RejectedSetupFailed = -29) carrying the error text, and give the client handshake/pairing error paths a short grace for the CONNECTION_CLOSE to beat the stream error it caused. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 09:50:30 +02:00
enricobuehler	87e7c82cbc	chore(release): bump workspace version to 0.17.2	2026-07-21 23:33:53 +02:00
enricobuehlerandClaude Opus 4.8	b2e3d1b540	fix(steamdeck/install): add cmake dep + acquire sudo in preflight ... pyrowave-sys's build.rs runs cmake to build the vendored PyroWave C library, but cmake wasn't in the distrobox apt list — so `cargo build -p punktfunk-host` dies on every SteamOS host with "is cmake not installed?". Add it. Also move sudo acquisition from step 4 (after the ~15-min build) into preflight and keep the timestamp warm across the build. Before, a non-interactive run (`ssh host 'bash install.sh'`) silently skipped the UDP-buffer/udev/vhci-hcd/ input-group tuning AND enable-linger — a "successful" host with no gamepad passthrough, lossy streaming, and no headless persistence (dies on logout). Now sudo is prompted once up front (authorize and walk away), and a no-TTY / no-password run fails loudly before the build instead of silently at the end. Validated end-to-end on SteamOS 3.8 in a VM with Radeon 780M passthrough: full host + web build, all planes listening, VAAPI render node, headless auto-start via linger. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 22:50:00 +02:00
enricobuehlerandClaude Fable 5	d36bec6e9d	feat(core+host): negotiate ChaCha20-Poly1305 as the session cipher for soft-AES clients ... Lifts the ~100 Mbps decrypt ceiling on clients without hardware AES — the armv7 soft-AES targets (webOS TVs), where AES-128-GCM resolves to fixsliced software AES + software GHASH (~50-100 cpb) while ChaCha20-Poly1305's ARX construction runs ~10-17 cpb portable, a 4-7x lift that PyroWave-on-TV needs (design/chacha20-session-cipher.md). Phase 1 (core crypto, no wire change): SessionKey merges cipher choice and key material (invalid combinations unrepresentable, zeroize + redacted-Debug discipline kept); SessionCrypto dispatches both aead-0.5 ciphers per call — the salt||seq nonce scheme, per-direction salts, seq-as-AAD and replay window carry over verbatim (same 96-bit nonce / 16-byte tag, const-asserted). Config.key becomes SessionKey; validate's zero-key rejection follows the active variant. The C ABI keeps its fixed 16-byte key mapped to AES — no ABI_VERSION bump. Phase 2 (negotiation): VIDEO_CAP_CHACHA20 (0x40) — support-plus-request in one bit, the VIDEO_CAP_444 precedent. Welcome grows cipher@68 + key_chacha@69..101, emitted only when non-zero so an AES session's Welcome stays byte-identical to the pre-cipher form; decode is fail-closed (short key or unknown id -> Err, never a silent AES fallback). No WIRE_VERSION bump; downgrade resistance inherited from the pinned-TLS control channel. Phase 3 (host): grant only when the client advertised the bit and the PUNKTFUNK_CHACHA20 kill-switch (default on, documented) allows; fresh 32-byte per-session key from the same RNG discipline, legacy key field stays independently random; resolved cipher logged at session start. Verification: seal/open suites parameterized over both ciphers + a cross-cipher tamper case; Welcome roundtrip/truncation/fail-closed tests; ChaCha lossy-loopback soak (loss/replay is cipher-independent); bench gains _chacha20 series (AES ids unchanged for CI history) — host-side sealing line-rate-trivial on both x86 (~640 MiB/s) and Apple Silicon (~535 MiB/s). punktfunk-probe drives the interop matrix via PUNKTFUNK_CLIENT_CHACHA20=1 and logs the negotiated cipher. Phase 4 (pf-webos pin bump + unconditional cap bit) follows the next core release. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 22:50:00 +02:00
enricobuehlerandClaude Fable 5	abc54a7d13	fix(decky): actually ship shortcut artwork + Steam Input layout in the published plugin ... The CI workflow assembled the store zip by hand and silently drifted from scripts/package.sh when 60d46530 added assets/ and controller_config/ — every published build (canary and stable through 0.17.1) was missing both, so the Steam shortcut a fresh install creates had no images and no controller layout (shortcut_art() found nothing to send; apply_controller_config failed with template-missing). CI now stages through scripts/package.sh — the plugin file list lives in one place — and a backstop verifies the runtime-loaded pieces are in the zip before publishing. Frontend hardening for installs poisoned by those builds: applyArtwork stamped its per-appId ART_VERSION marker even when zero assets were applied, so shipping the files alone would never heal existing shortcuts — only mark done when something actually landed, and bump ART_VERSION 2→3 to force one re-apply. Same guard for the controller-config marker (ok with zero account configset dirs is not done), plus one deferred artwork retry for the fresh-AddShortcut registration race setShortcutHidden already defers around. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 22:36:55 +02:00
enricobuehlerandClaude Fable 5	309e37f1e1	fix(host/linux): scope the GPU clock pin to live client sessions ... The PUNKTFUNK_PIN_CLOCKS clock pin (AMD power_dpm_force_performance_level=high / NVIDIA nvmlDeviceSetGpuLockedClocks) was armed once at host start and released only at host exit, so the box's clocks stayed pinned the whole time the host ran — even with no client connected. Move the pin behind a box-wide refcount (gpuclocks::session_pin()) shared across both streaming planes (native + GameStream): it arms on the first live client and releases on the last disconnect. on_host_start() now only installs the process-scoped NVIDIA P2-cap application profile. No behavior change when PUNKTFUNK_PIN_CLOCKS is unset. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 22:36:55 +02:00
enricobuehlerandClaude Fable 5	56d21f9445	fix(client/wol): retry the QUIC dial across the connect budget so wake-from-sleep launches survive ... Launching from the Decky plugin against a sleeping host fired the Wake-on-LAN packet and dialed immediately — but the dial was a single quinn attempt that gave up after the transport's 8 s idle window, far shorter than a suspend-to-RAM resume. The host woke to find the client already gone (its retransmitted Initials show up host-side as "QUIC accept failed error=timed out"), the stream shortcut exited, and the launch looked cancelled. - punktfunk-core: dial in a loop until the embedder's connect budget is spent — short 3 s attempts keep the Initial cadence dense, so the connect lands within ~a second of the host's network returning. Only silence is retried: pin mismatches, typed rejections, and any real answer surface immediately, and the shutdown flag stops the loop. - decky: stretch the budget to 75 s when a magic packet actually went out (PF_CONNECT_TIMEOUT → --connect-timeout via the wrapper), so the retry window covers the resume; an awake host still connects in <1 s. - host: a clean close before the control handshake is a reachability probe (hosts-page online pips), not a failed session — log it at debug instead of WARN "session ended with error", which buried the real failures in the reporter's log. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 22:26:10 +02:00
enricobuehlerandClaude Opus 4.8	f36d13e371	fix(steamdeck/install): prompt for sudo instead of requiring passwordless ... The system-tuning block (UDP buffers, gamepad udev rule, vhci-hcd autoload, input group) was gated on `sudo -n true` — passwordless sudo — so on a stock SteamOS box (the deck account needs a password) the whole block was silently skipped: /dev/uhid stayed root-only so the gamepad degraded to an Xbox 360 pad, and the UDP buffers stayed at the 416 KB default. Video was unaffected because Game Mode/gamescope needs none of it, which masked the skip on-glass. - install.sh + update.sh: acquire sudo interactively (`sudo -v` prompt on a TTY) instead of requiring passwordless; skip only when there's no TTY or auth fails, and then print the exact manual block plus a `passwd` hint — a stock SteamOS 'deck' account has no password, so sudo can't work until one is set. - update.sh: also retrofit the UDP-buffer sysctl for older/skipped installs, and loudly nag to reboot when the input group was just added (a --user restart does not pick up the new group; only a fresh login does). - steamos-host.md: note this step prompts for the sudo password. Root is unavoidable: the udev rule, input group, and vhci-hcd module are all kernel operations with no user-space alternative. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 21:56:20 +02:00
enricobuehlerandClaude Opus 4.8	aacd610b68	fix(steamdeck/install): set up controller passthrough + surface the required reboot ... A fresh SteamOS host install failed on-glass two ways: KWin denied Desktop-mode capture (zkde_screencast_unstable_v1) so every session died in the pipeline build, and the native Steam Deck pad degraded to an Xbox 360 controller. Both stem from setup that only a fresh login applies — the host user-service keeps the pre-install group set and KWin reads its .desktop grant at session start — plus a missing vhci-hcd autoload the pad's USB/IP transport needs (the deb/rpm/arch packages ship it; the Deck installer did not). - install.sh: install punktfunk-modules.conf (+ modprobe vhci-hcd now) for the native Deck controller transport, seed the KDE RemoteDesktop grant (kde-authorized) for Desktop-mode input, and print a loud "reboot before streaming" notice when a relogin is actually required (input group added or the .desktop grant first installed). - update.sh: retrofit the udev rule, vhci-hcd autoload, input group, and grant so existing installs pick them up on the next update without a reinstall. - steamos-host.md: document the first-install reboot and the native controller passthrough requirements (input group + vhci-hcd + client-side Steam Input Off). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 19:22:08 +02:00
enricobuehlerandClaude Opus 4.8	081ff64087	docs: explain how to actually run the VirtualHere passthrough example ... The VirtualHere DualSense recipe linked the `virtualhere-dualsense.ts` SDK example as a deployable recipe but skipped everything needed to run it: that VirtualHere is a server (couch) + client (host) pair, and that the example — like every example — imports `../src/index.js`, which only resolves inside the SDK repo. A user copying it out had no way to know they must `bun add @punktfunk/host` and swap that import. - automation.md: rewrite the recipe into a full walkthrough — the two-sided VirtualHere setup, the `-t` verbs, the zero-code hooks version, and a new scripted section with exact deploy steps, env vars, and running it as a service (its own SIGTERM handler makes `systemctl stop` release the pad). - sdk/README.md: say how to run an example in-repo vs deployed on a host. - virtualhere-dualsense.ts: header note on the import swap + service setup, since that file is where the doc link lands. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 17:28:23 +02:00
enricobuehlerandClaude Opus 4.8	675fd24cce	chore(release): bump workspace version to 0.17.1 ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 16:37:32 +02:00
enricobuehlerandClaude Fable 5	0e60e58cab	perf(apple): windowed macOS presents — off-main transactional commit, surface prototype, safe-present setting ... Task 1 (latency): the transactional present now commits from the RENDER thread inside an explicit CATransaction + flush() instead of hopping to main. The present harness (2026-07-21, 240 Hz Studio, full-size window) measured the main hop batching presents at runloop-iteration rate when main is busy — an active implicit transaction NESTS the explicit one — which is the field's presents=55 @ fps=240 / display_p50 18.6 ms. Off-main commits measured immune to main churn: glass p50 ~10 ms, cadence a clean 4.17 ms at 240. flush() is load-bearing: without it the render thread's own implicit transaction (drawableSize/colour writes) swallows the explicit commit and NOTHING reaches glass — the harness reproduced the exact freeze (every present dropped). Legacy main-hop kept as PUNKTFUNK_TXN_PRESENT=main for field A/B. New pf-windowed Console line (subsystem io.unom.punktfunk, category presenter) decomposes the issue side per second. Task 1 lever D: the f407f418 IOSurface contents-swap path is resurrected format-aware as WindowedPresentMode.surface — bgra8 SDR / rgba16Float+PQ-tagged HDR pool, swap committed off-main from the completion handler; EDR anchored by the metal layer underneath. Env-only prototype (PUNKTFUNK_WINDOWED_PRESENT=surface) until the HDR composite is eyeballed on glass. Task 2 (setting): punktfunk.windowedSafePresent (default ON = transactional mitigation; OFF = the fast async path whose panic the saga is about — the caption says so in plain words). Rows in the touch Settings (Presentation) and gamepad settings, macOS-only. PUNKTFUNK_WINDOWED_PRESENT=async|transaction|surface overrides for dev A/B. maximumDrawableCount stays 3 — the harness measured 2 starving the render loop (172/s) and worsening glass p50. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 15:58:47 +02:00
enricobuehlerandClaude Fable 5	71faf38a85	fix(apple): stats os_log used %d for 64-bit Swift Int — macOS 26 drops the line ... Swift `Int` is 64-bit (Foundation infers %lld); the stats mirror's format string used %d (32-bit C int) for fps/presents/lost. macOS 26's strict String(format:) validator rejects the mismatch and drops the whole line (the error also cascades onto the float args, mis-blaming floor_p50). Use %lld for the three Int fields. Pre-existing, unrelated to the DCP work; surfaced while reading presenter logs during the panic fix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 15:14:41 +02:00
enricobuehlerandClaude Fable 5	f49d38826b	fix(apple): windowed macOS DCP panic via presentsWithTransaction — keep real HDR, drop the SDR IOSurface path ... The windowed-macOS "mismatched swapID's" @UnifiedPipeline.cpp kernel panic is the CAMetalLayer ASYNC image queue (commandBuffer.present, mandatory with displaySyncEnabled=false) diverging from WindowServer's compositor on a high-refresh composited session — it survived glass pacing (PyroWave, 2026-07-18) and hit windowed HEVC on the same 240 Hz Mac Studio (2026-07-21), so it's the async queue itself, at any codec or pacing. f407f418's mitigation routed windowed PyroWave through a BGRA8 IOSurface layer.contents pool, which cannot carry HDR — extending it to HEVC would have tone-mapped windowed HDR down to SDR. Instead, present the drawable through a Core Animation transaction (CAMetalLayer.presentsWithTransaction) for every windowed session: commit, waitUntilScheduled, then drawable.present() inside a CATransaction, so the swap commits with the layer tree and stays in lockstep with the compositor instead of racing it. The full rgba16Float / PQ / EDR render path is untouched — windowed HDR is real HDR again. Fullscreen keeps the async path (direct scanout, lowest latency, no panic there). Removes the IOSurface surface pool, its surfaceLayer sibling, and the macOS windowed PQ->SDR tone-map (tvOS keeps its no-headroom tone-map). Net -150 lines. swift build + 169 tests green. Needs on-glass soak on the 240 Hz Mac Studio (kernel race — only real hardware confirms). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 14:45:11 +02:00
enricobuehlerandClaude Fable 5	42198eb1b6	feat(linux/vulkan-encode): default-on native NV12 capture + RGB true-extent ... Flip both zero-copy levers from opt-in to default: - The capture negotiation now PREFERS gamescope's producer-side NV12 pod by default (PUNKTFUNK_PIPEWIRE_NV12=0 restores the packed-RGB negotiation). Codec-aware gating rides a new OutputFormat::nv12_native -> ZeroCopyPolicy::native_nv12_session edge resolved by the host facade from the session plan (pf_encode::linux_native_nv12_ok): only H265/AV1 sessions whose backend can open the raw Vulkan Video encoder ever see the NV12 pod -- an H264/Moonlight session (libav VAAPI, which would misread the two-plane buffer) keeps today's BGRx negotiation, as do the GameStream-resolve and portal-mirror paths, PyroWave, and NVENC prefs. - RGB-direct's unaligned modes default to the true-extent direct import (PUNKTFUNK_VULKAN_RGB_TRUE_EXTENT=0 restores the padded-copy staging). Guarded-tested on Van Gogh with the kernel journal watched: clean, and at 5.38 ms p50 the fastest 1080p encode path measured on that hardware. The EFC only exists on Mesa >= 26, where the codedExtent-driven session_init padding is guaranteed (verified back to Mesa 24.2). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 14:01:28 +02:00
enricobuehlerandClaude Fable 5	b4fbc94e36	feat(linux/vulkan-encode): PUNKTFUNK_VULKAN_RGB_TRUE_EXTENT bring-up gate ... Opt-in alternative to RGB-direct's padded-copy staging at unaligned modes: direct-import the visible-size capture and declare the TRUE-SIZE source codedExtent. RADV has derived the VCN session_init firmware padding from srcPictureResource.codedExtent since Mesa 24.2, so the EFC is told the source lacks the alignment rows and the hardware edge-extends them internally -- which also reframes the 2026-07-20 field GPU reset: that crash passed the ALIGNED extent as the source codedExtent (firmware padding zero) over a visible-size buffer. Off by default until a guarded live test proves the EFC front-end honors the padding like the YUV fetch path does; the padded-copy staging remains the shipped behavior. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 14:01:28 +02:00
enricobuehlerandClaude Fable 5	004f0cacb8	perf(linux/vulkan-encode): true-size headers make native NV12 zero-copy at every mode ... Drop the padded-copy staging for producer-native NV12 and direct-import the visible-size buffer at unaligned modes (1080p) too. Safe by the driver's own contract rather than by allocation luck: native sessions now author the H265 SPS / AV1 sequence header at the RENDER size and pass the matching codedExtent on every picture resource. RADV rounds the bitstream SPS up itself (with a conformance window -- radv_video_patch_encode_session_parameters, per the VK_KHR_video_encode_h265 proposal's "implementations may override" clause) and programs the VCN session_init with the true extent plus nonzero firmware padding, so the hardware edge-extends the alignment rows internally and never fetches past the source's real extent -- the exact mechanism VAAPI/radeonsi has always used to encode 1080p. The driver-emitted header NALs already carry the patched SPS, so the wire format is unchanged. The CSC and RGB-direct paths keep the app-aligned convention (their sources genuinely cover the aligned extent); RGB padded-copy staging is untouched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 14:01:28 +02:00
enricobuehlerandClaude Fable 5	49c6dd00c9	fix(presenter): CPU frames never take the HDR10 passthrough surface ... Software decode uploads swscale RGBA with no CSC/tonemap pass. On the new desktop-compositor HDR10 surfaces (GNOME 48 / Plasma 6 + Mesa >= 25.1 offer ST2084 even on SDR desktops) that sRGB-encoded content was composed as PQ — the field-reported psychedelic picture (Fedora clients decode HEVC in software because stock Mesa strips it; reproduced + fix live-validated on GNOME Wayland: mode-0 soup -> HDR→SDR washed-out-but-correct). The CPU lane keeps the SDR swapchain and its known untonemapped-PQ gap; a real PQ→sRGB pass for CPU frames is the follow-up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 13:30:35 +02:00
enricobuehlerandClaude Fable 5	e7c6c96e5f	fix(presenter): set the Wayland app_id so the session window gets its icon ... SDL_APP_ID = io.unom.Punktfunk — compositors match it against the shipped .desktop for the window icon; without it KWin/mutter show the generic Wayland icon (field-noticed on the Deck). Linux analog of win32 AppUserModelID. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 13:30:35 +02:00
enricobuehlerandClaude Fable 5	da134ad045	feat(presenter): PUNKTFUNK_HDR10=0 refuses the HDR10 swapchain (SDR tonemap pin) ... GNOME 48 / Plasma 6 with Mesa >= 25.1 now offer HDR10_ST2084 surfaces even on SDR desktops, silently flipping PQ streams into the mode-0 passthrough lane — previously unreachable on desktop compositors and never validated there. The hatch pins the shader tonemap for diagnosis and as the field escape. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 13:30:35 +02:00
enricobuehlerandClaude Fable 5	428bd2519c	test(qsv): converter→ring-profile-P010→encoder live e2e (the RTV-written seam) ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 13:30:35 +02:00
enricobuehlerandClaude Fable 5	87d7eceabf	fix(encode/qsv): write the colour VUI unconditionally + Intel-lane colour diagnostics ... The native QSV encoder only attached mfxExtVideoSignalInfo on HDR sessions — an SDR stream carried no colour description at all (NVENC writes 709-limited unconditionally; qsv.rs now mirrors it). Diagnostics for the field-reported blue/magenta Intel-host colours: - hdr-p010-selftest takes an optional WxH + GPU vendor (intel|nvidia|amd) and prints which adapter it tested — 64x64 on the default GPU proved nothing on dual-GPU boxes, and the field heights (1080/1400) are not 16-aligned. - pf-capture: ignored live test running the converter at 1920x1080 pinned to the Intel adapter. - pf-encode: qsv_live_p010_1080_colorbars_dump — known P010 bars through the UNALIGNED-height ingest copy (1080 src -> align16 1088 pool, the seam no 640x480 test exercises) to Main10 HEVC, dumped for off-box decode checks. - dxgi.rs: drop the stale 'falls back to the R10 path' claim (no such path). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 13:30:35 +02:00
enricobuehlerandClaude Fable 5	1d4795666e	feat(linux/vulkan-encode): opt-in gamescope producer-native NV12 encode source ... With PUNKTFUNK_PIPEWIRE_NV12=1 (bring-up gate), the PipeWire negotiation offers an NV12 LINEAR DMA-BUF pod (BT.709 limited pinned MANDATORY) ahead of the BGRx one, and gamescope's producer-side RGB->YUV pass replaces the host CSC entirely: the encoder imports the two-plane buffer as a profiled VIDEO_ENCODE_SRC image and the VCN encodes it directly. Contributed measurements: encode p99 2.9 ms (from ~4-4.5 ms via EFC RGB-direct), 60 fps capture, 0 send drops. Hardening on top of the contributed patch: - unaligned modes (1080p!) stage through a padded aligned NV12 copy (edge rows/columns duplicated, transfer-only) instead of direct-importing the visible-size buffer -- a direct import would make the VCN read past the producer allocation, the exact OOB class behind the 2026-07-20 field GPU reset; the encode extents return to the aligned coded extent everywhere - the UV plane layout honors the producer's plane-1 chunk (offset/stride) when the SPA buffer carries one (same-BO verified by inode), with the contiguous-plane contract as fallback - PyroWave sessions are excluded from the gate (their Vulkan compute CSC ingests packed RGB), and a native-NV12 session that resolves to libav VAAPI (H264 codec, PUNKTFUNK_VULKAN_ENCODE=0, feature off, or a failed Vulkan open) refuses at open instead of streaming garbage chroma - pad staging images carry TRANSFER_SRC (the width-padding pass self-copies the staging image -- previously missing on 1366-wide modes) - metadata-cursor one-shot warn (parity with RGB-direct) and a padded-NV12 PUNKTFUNK_PERF split label; the padded RGB copy gets its timestamps too Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 11:57:42 +02:00
enricobuehlerandClaude Opus 4.8	58b27acbd5	fix(vdisplay/session): scrub the dead desktop's WAYLAND_DISPLAY from the user-manager env ... settle_desktop_portal pushes the live desktop's WAYLAND_DISPLAY into the systemd --user manager (import-environment) so a re-activated portal inherits the right session — but the import PERSISTS after that desktop dies. Every later user unit then inherits the stale socket, including gamescope-session.target: gamescope sees WAYLAND_DISPLAY, runs NESTED, and aborts with "Failed to connect to wayland socket: wayland-0" — observed live on a Deck, where Game Mode could not start at all (autologin crash-looped) until the var was unset by hand. Two-layer fix, mirroring the protection launch_session already gives its transient unit: - observe_session_instance: when a desktop compositor instance goes away, unset WAYLAND_DISPLAY/DISPLAY from the manager env (a desktop bounce is harmless — the next portal settle re-imports). - write_steamos_dropin: UnsetEnvironment=DISPLAY WAYLAND_DISPLAY on the takeover drop-in, unit-scoped belt-and-suspenders for host-initiated restarts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 11:06:55 +02:00
enricobuehlerandClaude Opus 4.8	333c8979e9	fix(vdisplay/gamescope): capture-loss rebuild probes must not steal the box session ... Observed live on a Deck host: the user switched Game Mode → Desktop, KDE came up in 0.8 s — and the capture-loss rebuild's FIRST detection ran inside that gap, still said Gaming, and its gamescope re-acquire restarted gamescope-session.target. On SteamOS that steals the seat: the user was yanked out of the KDE session they had just chosen, the two session managers fought (job canceled / dependency failed), no gamescope node appeared within 30 s, and the stream died at the 40 s rebuild budget. A rebuild probe acting on possibly-stale detection must never stop, relaunch, or take over box sessions. New pf_vdisplay::rebuild_probe_scope (RAII, counted): while held, the gamescope managed/takeover create paths only attach to a live node and fail fast otherwise — no stop_autologin_sessions, no session-plus relaunch, no gamescope-session.target restart. The capture-loss loop holds it for the first 4 s after a loss (the detection-ambiguity window); after that, destructive rebuilds are allowed again, so a genuine switch INTO Game Mode still gets its headless takeover. Probe failures are instant, so the loop now paces itself at ~2 Hz instead of spinning. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 11:00:02 +02:00
enricobuehlerandClaude Opus 4.8	46d09ed973	fix(host/linux): stop burning retry budget on doomed pipeline builds ... Two session-transition stalls found live on a SteamOS Deck host, one cause: the pipeline retry loop couldn't tell a wait-it-out failure from a retry-now-and-it-works one. - Gamescope first-frame race: a PipeWire stream connected while gamescope re-initializes its headless takeover negotiates a format, reaches Streaming, and never receives a buffer — while a fresh connect delivers within ~0.5 s. Every gamescope bring-up ate the full 10 s first-frame budget on attempt 1 (17 s bring-ups; KWin: 1.2 s). The retry loop's FIRST attempt now waits 2.5 s (Capturer::next_frame_within), so the reconnect that fixes the race happens at ~3 s. Later attempts keep the patient 10 s — the documented 30-60 s Big Picture cold start still fits the budget. - Capture-loss rebuild vs session switch: the rebuild loop re-detects the active session between build_pipeline_with_retry calls, but each call burned 8 attempts (~13 s) against a compositor that no longer exists (a Desktop→Gaming switch spent 13 of its 27 s retrying gone-KWin). The capture-loss path now passes max_attempts=2, turning the outer loop into ~1 s detect-and-retry cycles that follow the box to the new session. The resize path's direct build_pipeline call keeps the default budget (no retry wrapper there to absorb an early bail). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 10:34:49 +02:00
enricobuehlerandClaude Opus 4.8	946f1b3d69	fix(steamdeck): build the host with vulkan-encode, and wire up what it needs to actually engage ... The SteamOS scripts built the host featureless, so PlatformAuto could never pick the Vulkan Video backend (default-on since 84329205) and every session silently ran libav VAAPI — unlike the deb/arch/rpm/sysext builds, which all pass the feature. Three gaps, found live on a Deck host: - install.sh/update.sh: cargo build with --features punktfunk-host/vulkan-encode (matches the packaged builds; pure-Rust ash, no new system dep). - host.env: RADV_PERFTEST=video_encode — Van Gogh RADV still gates VK_KHR_video_encode_* behind it, so without it the backend can't open and falls back to VAAPI. Harmless where encode is exposed by default. - io.unom.Punktfunk.Host.desktop (Exec rewritten to this install's binary): KWin only grants zkde_screencast_unstable_v1/org_kde_kwin_fake_input to an exe a .desktop authorizes — without it Desktop-Mode capture fails outright and a mid-stream Game↔Desktop switch strands the stream on the old backend. update.sh retrofits the last two idempotently so existing installs get them without a reinstall. Validated on a SteamOS 3.8.14 Deck (Van Gogh): Vulkan HEVC opened on both the KWin and gamescope paths at 5120x1440 — in-place ABR reconfigure (no IDR, no encoder rebuild) vs the VAAPI path's full teardown per ABR step, and Desktop capture came up without a re-login. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 10:14:31 +02:00
enricobuehlerandClaude Fable 5	7c0313a7cb	fix(web): flush card content, so a full-bleed table stops doubling its inset ... `<CardContent className="p-0">` never removed the padding it looked like it removed: tailwind-merge resolves conflicts within a variant, so `p-0` cancels `p-4` but leaves `sm:p-6` standing. Every call site that used it nests a CardHeader inside, which brings its own `sm:p-6` — so at >=640px the title sat 24px further in than its neighbours'. Visible on the Plugins page as 'Installed plugins' not lining up with 'Plugin runner'. Give CardContent a `flush` prop that omits the padding outright, and use it at the three call sites (Store, Pairing, Stats) rather than fixing the symptom three times and leaving the footgun in place. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 00:25:31 +02:00
enricobuehlerandClaude Fable 5	04c975e9cb	fix(store): uninstall must refuse a plugin's framework, not just odd names ... The guard checked the package NAME shape, and `@punktfunk/plugin-kit` — the framework every kit-built plugin depends on — matches `@scope/plugin-*` exactly. Windows on-glass accepted an uninstall of it; bun no-ops removing a non-dependency so nothing broke, but the store was offering to pull a library out from under the plugins using it. Require membership in the top-level dependency list, the same authority that already keeps plugin-kit out of the installed listing. Same blind spot, two call sites — the listing was fixed during implementation, this one wasn't. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 00:10:49 +02:00
enricobuehler	402ec90edc	fix(web/store): restore the plugin cards' top padding, and capitalise platform names ... Two things looked wrong in the store: The cards had no space above the icon. `CardContent` zeroes its own top padding (`pt-0`/`sm:pt-0`) because it normally sits under a `CardHeader` that supplies it — but these cards have no header, so the top padding simply vanished while the other three sides kept `p-card`. `p-card` does not undo it: `card` is a custom `--spacing-*` token, which tailwind-merge does not recognise as a spacing value and so never dedupes against `pt-0`, leaving the longhand to win. Both header-less cards in this section now restore it explicitly, at both breakpoints. Platform chips read "windows" / "linux". Those are the catalog's platform IDENTIFIERS (the index validator pins `linux | windows | macos`), which is right for the wire and wrong on screen; the card now maps them to display names — Linux, Windows, macOS. Proper nouns, so deliberately not routed through i18n. Adds Store/StoreCard stories covering the padding, the platform labels, and the installed / update / incompatible / blocked / external states, so the card can be eyeballed without a host or a catalog.	2026-07-21 00:00:37 +02:00
enricobuehler	d783d5445c	chore(release): bump workspace version to 0.17.0	2026-07-20 23:55:51 +02:00
enricobuehlerandClaude Fable 5	67b7981096	feat(encode/nvenc-linux): LN1 phase-3 — multi-slice sub-frame encode DEFAULT-ON for Linux direct-NVENC ... Gates recorded (nvenc-subframe-slice-output.md Phase 3): loss-harness curve identical streamed-vs-whole; adversarial security review clean; live .21 3-leg A/B — streamed 0 corrupted frames, p99 8527→5363 µs vs sliced-whole, first_slice_us ~500 µs of a ~1250 µs encode reaching the send thread; wire bytes rate-governed under CBR + 1-frame VBV (the ~1-2 % slice-header cost is absorbed by rate control, not added to the wire). GameStream: plane has zero code diff (own RTP packetizer; shares only untouched send_pacing); a live Moonlight re-test joins the standing owed Moonlight item. - resolve_slices(codec, default): env 1..=32 wins (1 = the NEW explicit single-slice escape), else the backend default — 4 on Linux direct-NVENC, 1 elsewhere. resolve_subframe(default_on): PUNKTFUNK_NVENC_SUBFRAME tri-state (0 = never, 1 = force, unset = backend default). - Linux nvenc_cuda: resolves both ONCE in query_caps — the sub-frame default is gated on the GPU's SUBFRAME_READBACK cap so an unsupporting GPU never has enableSubFrameWrite forced into its init params — and feeds the same resolved values to build_config, build_init_params (open AND in-place reconfigure) and the chunked-poll latch. - Windows: env-only as before (async path untouched, byte-identical config for unset env); LowLatencyConfig.slices + the explicit subframe param replace the shared env reads. - Tests: chunked e2e now runs at the DEFAULTS (no knobs); the fallback test becomes the escape test (SLICES=1 disarms; SUBFRAME=0 disarms while 4-slice encode continues on the plain poll path). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 23:44:41 +02:00
enricobuehlerandClaude Fable 5	e6cdd79f71	fix(loss-harness): drop the needless mut on send_wires — workspace clippy is -D warnings ... Slipped through 421e8112: the on-box clippy runs covered punktfunk-core and punktfunk-host but not the tools crates; CI's workspace-wide pass caught it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 23:44:37 +02:00
enricobuehlerandClaude Fable 5	7e5ec7eba9	chore(store): repin the official plugin-index signing key ... The bootstrap key generated during implementation was lost, and its replacement was pasted into the wrong repository's secret store — Gitea secrets neither cross repos nor read back, so neither is usable. The private half of this one lives in punktfunk-plugin-index's own INDEX_SIGNING_KEY, which is the only thing that signs the catalog. Nothing has shipped pinning any of these, so this is a straight replacement of slot 0; the second slot stays reserved for a genuine rotation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 23:25:16 +02:00
enricobuehlerandClaude Fable 5	3736bbdc73	fix(core): streamed-AU hardening from the security-review pass ... Review verdict: no exploitable memory-safety / amplification / splice / resurrection issue; nonce order and two-lane seal byte-identical for the legacy path. Actionable findings applied: - explicit per-block data_shards cross-check next to the recovery_shards one (defense-in-depth — the geometry invariants make it unreachable today, but have_data indexing assumes it) - partial delivery skips an UNPINNED streamed frame (frame_bytes still 0) instead of truncating its max-sized buffer to an empty "partial" - regression tests for the two untested load-bearing guards: the final-first out-of-range-sentinel drop (the exact-sized-buffer guard) and second-final-with-different-totals rejection Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 23:13:59 +02:00
enricobuehlerandClaude Fable 5	421e811225	feat(loss-harness): sweep the streamed-AU wire shape alongside whole-AU ... The Phase-2 gate: more, smaller wire units must not regress FEC recovery. Adds a GF16 streamed column (three chunk pushes + finish per AU — sentinel blocks then real totals). Measured: identical to whole-AU at every loss rate (50/50 through 1/6, the same 25%-budget cliff). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 22:59:09 +02:00
enricobuehlerandClaude Fable 5	79913a430e	feat(probe): advertise VIDEO_CAP_STREAMED_AU ... The probe's reassembler is the shared core one, and the probe is the tool that measures the streamed-AU overlap win — advertise the cap so a host with chunked encode streams to it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 22:55:34 +02:00
enricobuehlerandClaude Fable 5	c5402cb1f7	feat(core+host): LN1 phase-2 — VIDEO_CAP_STREAMED_AU streamed access units ... The wire half of sub-frame slice output (latency §7 LN1, planning design/nvenc-subframe-slice-output.md Phase 2): toward a client that advertises the new cap bit (0x20), a chunked-poll encoder session ships each AU's completed FEC blocks while the tail of the frame is still encoding — the AU's last packet leaves the host as the encode finishes instead of after it. Wire semantics (negotiated; zero change for anyone else): - Non-final blocks ride SENTINEL headers: block_count = 0 (a value no legacy sender emits) + frame_bytes = 0 + exactly max_data_per_block data shards, so the receiver's shard-offset formula needs no total. - The final block's headers carry the real frame_bytes/block_count (+ FLAG_EOF) and RETRO-VALIDATE the whole frame: totals under which a received sentinel block is out of range or not full-K kill the frame wholesale (no spliced delivery) and the index can't be resurrected. - Firewall: sentinels are bounded by the negotiated limits (full-K exactly, never the last block the limits allow, no total to lie about); the exact derived-geometry check runs unchanged on every non-sentinel packet and retroactively at pinning. Sentinel opens commit a max_frame_bytes buffer, bounded by the existing IN_FLIGHT_BUF_FACTOR budget (amplification test). - Order-agnostic like legacy: a reversed frame (final block first) opens legacy-shaped and still accepts its sentinels against the pinned totals. - Small/empty streamed AUs degenerate to byte-identical legacy headers. Host: Packetizer::{begin,push,finish}_streamed seal full-K blocks (data + parity per block) as chunks arrive; Session::seal_streamed_* share the pooled-wire + two-lane seal machinery via the new seal_run; the send thread paces each flush under the frame's existing deadline (pace_sealed split out of paced_submit) and runs the whole-AU accounting at the last chunk; the encode pump forwards poll_chunk output as ChunkMsg when the client has the cap AND the encoder chunks (re-queried per AU — an escalation falls back seamlessly). Probes never run mid-AU. PUNKTFUNK_STREAMED_AU=0 = host escape hatch. Client core ORs the cap into Hello (the shared reassembler carries the support). Sampled first_slice_us vs encode_us PERF log measures the overlap; the 0xCF stage-field extension stays a follow-up. Core tests: streamed round-trip (clean/loss/reorder/duplicate, both orders), sentinel firewall bounds, lying-final wholesale kill + no-resurrect, open-amplification budget, header-shape pins. Gates still owed before default-on: security review pass, loss-harness curve, GameStream smoke (plane untouched structurally), bitrate A/B. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 22:53:53 +02:00
enricobuehlerandClaude Fable 5	9d3b114fd6	feat(encode/nvenc): LN1 phase-1 — slice-boundary chunked encoder poll (poll_chunk/AuChunk) ... The encoder half of sub-frame slice output (latency §7 LN1, planning design/nvenc-subframe-slice-output.md Phase 1): with PUNKTFUNK_NVENC_SLICES=N + PUNKTFUNK_NVENC_SUBFRAME=1 on a sync depth-1 session, Encoder::poll_chunk hands the in-flight AU out as slice-boundary chunks read through doNotWait sub-frame locks while the tail is still encoding — the readback loop the on-hw probe validated (~200 µs slice spacing on the 5070 Ti), productionized. - codec.rs: AuChunk (AU metadata on the first chunk, `last` closes the AU; chunks concatenate to exactly the poll() bytes) + supports_chunked_poll / poll_chunk trait surface. Default impl wraps poll() as one self-closing chunk, so a chunk-driven consumer works against every backend. - nvenc_cuda: chunked readback cut at slice boundaries only (bitstream size at n reported slices = end of slice n, Annex-B contiguous); completion is NEVER numSlices alone — one finishing BLOCKING lock is the authority and the wedge watchdog, so the final chunk blocks exactly like sync poll (the depth-1 pump contract; 6dc195f9 bug class). Keyframe on early chunks is the submit-time IDR prediction (exact under P-only/infinite-GOP), cross-checked at finish. Debug builds shadow-check emitted chunks against the finished AU prefix. Mutually exclusive with pipelined retrieve (gated off when async_rt exists, dropped by the escalation rebuild); composes with stream-ordered submit. - nvenc_core: slices_env/subframe_requested shared parses so the config author and the chunked-poll arming can't disagree. - TrackedEncoder forwards both new methods (the set_wire_chunking trap class). Host loop untouched — Phase 2 (VIDEO_CAP_STREAMED_AU seal/send) consumes this. On-hw: nvenc_cuda_chunked_poll_end_to_end + nvenc_cuda_chunked_poll_fallback_whole_au. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:53:32 +02:00
enricobuehlerandClaude Fable 5	411c6dc06a	fix(encode): forward set_pipelined through TrackedEncoder — the LN3 escalation no-oped through the wrapper ... Every session encoder is boxed in TrackedEncoder (open_video), and the wrapper never forwarded Encoder::set_pipelined — so the host loop's contention escalation (ae673158) hit the trait default, which returns false ("backend can't pipeline, stop asking"), and the pipelined-retrieve stage could never engage adaptively. Only the explicit PUNKTFUNK_NVENC_ASYNC=1 open-time path worked. The exact defaulted-method trap the wrapper's own comment documents for set_wire_chunking. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:53:32 +02:00
enricobuehlerandClaude Fable 5	833f3348a0	feat(store): console plugin store, index repo, and the fixes on-glass found ... Console: a Plugins section (Browse / Installed / Sources) on a static nav entry, with install friction proportional to trust — a plain confirm for a verified entry, a warning naming the curator for an external one, and a danger dialog that makes you retype the spec for a raw package. Tier badges are permanent and follow the plugin onto its own UI page. Index: unom/punktfunk-plugin-index published and served from Gitea's raw endpoint (real HTTPS, byte-exact, no vhost to stand up) — merge to main is publish, which resolves the design's open hosting question. Four things only running it could find: - runner discovery matched @punktfunk/plugin-* only, so a third-party scoped plugin (which D8 requires) would install and never run - ...and that convention also matches @punktfunk/plugin-kit, a plugin's own framework: it listed as installed and would have been imported as a unit. Both now key off the plugins dir's top-level dependencies, with an emptied dependency list meaning 'nothing installed' rather than falling back to the naming convention - the store must not pass new flags to the runner: the scripting package ships separately and an older one reads an unknown flag's value as a package name. The host writes the bunfig scope mapping itself - ureq reports only >= 400 as Err, so a conditional request's 304 arrives as Ok with an empty body — handled as an error it made every refresh after the first verify a signature over zero bytes and sit stale Also: the console's first Tabs use exposed an @unom/ui theme gap that rendered inactive tabs invisible (caught in a browser pass, not by types). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:48:02 +02:00