1023 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
enricobuehler	2a08ae00c9	build(android): debug APKs ship release-profile rust ... Cargo's debug profile is not "slower" for this library — it is unusable, and it invalidated every on-device performance test to date: RustCrypto's AES-GCM compiles to generic-array iterator closures with per-byte precondition checks instead of ARMv8 hardware AES. Profiled live on a phone (simpleperf, 62k samples): ~800 µs of user CPU per 1.4 KB packet — the receive pump pinned above a full core yet only draining ~1,400 pkt/s of a 1,775 pkt/s (20 Mbps) stream, 2.3 MB standing in the kernel socket buffer, the latency-bound flush firing every 2 s forever. With release rust in the same debug APK: pump at ~12 % of a core, socket queue zero, no flushes, 2800x1260@120 streaming clean. preDebugBuild now depends on cargoNdkRelease; `-PrustDebug` opts back into a debug-profile native build for sessions that actually step through Rust. Kotlin debuggability is unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 08:07:42 +02:00
enricobuehler	dcef3c8600	fix(android): declare WAKE_LOCK — the stream's Wi-Fi locks never actually engaged ... WifiLock.acquire() enforces the WAKE_LOCK permission, which the manifest never declared — every acquisition since the first Wi-Fi lock shipped threw SecurityException, silently swallowed by a bare runCatching. The phone's own accounting proved it (dumpsys wifi: high_perf/low_latency active_time_ms = 0 across weeks of streams): every on-device session ran with Wi-Fi power save fully active, whatever the code intended. Verified live after the fix: both locks registered in WifiLockManager, mPowerSaveDisableRequests=2, ping RTT to the streaming phone 3.8 ms avg. A failed acquire now logs loudly — this class of failure must never be invisible again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 08:07:42 +02:00
enricobuehler	8f06a4334e	fix(android): hold BOTH Wi-Fi locks while streaming — HIGH_PERF alone is a no-op ... The baseline stream held only WIFI_MODE_FULL_HIGH_PERF, which is deprecated AND non-functional on recent Android — so with the low-latency toggle off (the default) Wi-Fi power save stayed fully active: downlink delivery clumped at beacon intervals (a few hundred ms of latency mush, sawtoothing bitrate) and the AP's power-save buffer periodically overflowed, killing whole frames every few seconds (the host log's alternating loss_ppm=0/50000). Now every stream holds FULL_LOW_LATENCY (API 29+, the only effective power-save disable; foreground + screen-on, which a stream always is) AND FULL_HIGH_PERF (covers older releases) — the same pair Moonlight holds. The experimental toggle no longer selects the lock mode. Also: declare tracing's "log" feature explicitly in the native crate (core transport warnings → logcat must not hinge on quinn's default features), and align the low-latency toggle's copy with its actual scope. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 07:35:08 +02:00
enricobuehler	f992298da8	feat(android): console UI — per-controller glyphs, dialog scrolling, animated forms ... - Hint-bar glyphs now wear the driving controller's family (kit Gamepad.styleFor by USB vendor id → MainActivity.lastPadStyle, kept live by real input like lastPadIsGamepad): PlayStation pads get Canvas-drawn cross/circle/square/triangle shapes in the classic colours, Nintendo pads monochrome lettering, Xbox/Valve/unknown the coloured letter discs. Hint chars stay semantic (KEYCODE_BUTTON names); only the rendering changes. - The Options legend renders the pad's real Select-family button (SelectButtonGlyph): Xbox View windows, PlayStation Create capsule, Nintendo minus — instead of a bare capsule outline. - GamepadDialog: body + action stack scroll together (title pinned) with BringIntoViewRequester keeping the focused button visible — a 5-action host options dialog compressed/clipped its last button in short landscape windows because the pinned stack could not scroll. - Console form polish: shared animateConsoleFocus (bg/border cross-fade + spring scale) across settings rows / add-host fields / action rows; ConsoleSwitch (spring knob, tinting track) replaces On/Off text on toggle rows; choice values slide in the direction they were stepped (AnimatedContent + SizeTransform) with chevrons that fade in place; the focused row's detail unfolds via AnimatedVisibility; dialog buttons and keyboard keycaps cross-fade (keycaps at 90 ms for hold-to-repeat). - Console settings gain the "Low-latency mode" (Video) and "Auto-wake on connect" (Interface) rows, round-tripping with the touch settings. - Screenshot scene: StatsOverlay call updated to the 18-double layout + the new decoderLabel parameter (fixes the android-screenshots CI compile). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 07:35:08 +02:00
enricobuehler	e490564316	fix(core,host): make the native data plane survive real Wi-Fi links ... Root-caused live on a phone at 100 Mbps (stream stuck seconds behind, then oscillating): a stack of transport defects, each amplifying the next. - MTU-safe shards: shard_payload 1452 overshot the IPv4/1500 budget (the old math forgot the 40 B header + 24 B crypto ride inside the UDP payload and counted IP+UDP as 8 B) — the kernel silently split EVERY video datagram into two IP fragments, doubling per-datagram loss on Wi-Fi. New config::mtu1500_shard_payload() = 1408 (1472 sealed = the exact ceiling), negotiated in the Welcome, pinned by a unit test. - Android batched I/O: recv/send batching was cfg(linux); Android is target_os="android" and silently fell back to a syscall per datagram. The libc crate binds neither recvmmsg/sendmmsg nor mmsghdr for Android, so a local bionic extern binding provides them (API 21+, floor is 28); cbindgen excludes them from the C header. The pump/runtime threads also get the Apple-QoS analogue on Android: nice −8 (below the decode thread's −10). - Latency-bounded receive: packets are consumed strictly in order at exactly the arrival rate, so a standing queue (Wi-Fi stall, power-save clumping) NEVER drains — observed as a stream permanently 6-7 s behind with both 32 MB socket buffers full. The pump now flushes the entire backlog (Session::flush_backlog: discard ring + kernel queue at memcpy speed, reset the reassembler) and requests a keyframe when frames keep completing > 400 ms behind the skew-corrected capture clock (30 consecutive, 2 s cooldown, logged). - Time-based loss window: the reassembler declared an incomplete frame lost a fixed 4 INDICES behind the newest — 33 ms at 120 fps, inside normal Wi-Fi retry/reorder timescales, so merely-late frames were pruned every few seconds, each costing a recovery-IDR burst + an inflated loss report. Now 120 ms of capture time (LOSS_WINDOW_NS), same fuse at every refresh rate, with a 64-index hard cap bounding memory against hostile pts. - Adaptive-FEC hysteresis: the controller was memoryless — one clean 750 ms report dropped FEC from 8 % straight back to the 1 % floor, so periodic burst loss (Wi-Fi scan / BT coexistence beats) always hit an unprotected stream and ping-ponged 1↔8 % with a frozen frame per cycle (observed in the host log as alternating loss_ppm=0/50000). Attack stays instant; decay is now one point per clean report. Verified: full core suite (incl. new flush + time-window tests) on macOS + Linux, host release build, arm64 cargo-ndk build, and a 30 s wired probe run at 2800x1260@120 — 3559/3559 frames, zero loss, capture→received p50 5.3 ms (host 5.1 + network 0.3). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 07:35:08 +02:00
enricobuehler	b8df6c28b8	style(linux): rustfmt drift from the last two commits ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 00:22:46 +02:00
enricobuehler	ea2726af0a	feat(client-linux): log the release/disconnect keyboard chords ... The Ctrl+Alt+Shift+Q/D handlers had no tracing, so a report of "the disconnect shortcut doesn't work" was unverifiable from logs alone — live tracing (added temporarily, then trimmed to these two lines) showed the chord, `disconnect_quit()`, and the session teardown all firing correctly and instantly every time; the confusion traced back to the (now-fixed) FlowBox click crash having kept everyone from ever reaching a live session to test the shortcut with in the first place. Keep the two low-noise, deliberate-action log lines for the next time this comes up; drop the per-keystroke debug trace used to diagnose it, which would otherwise fire on every key during a stream. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 00:21:26 +02:00
enricobuehler	d190d9f543	fix(client-linux): break the FlowBox activation signal cycle — stack overflow on every host-card click ... `child-activated` (fired by a pointer click) was bridged to `child.activate()` so each card's own connect handler (wired on the child's `activate` signal) would run. But `child.activate()` runs `GtkFlowBoxChild`'s default handler, which re-emits `child-activated` on the FlowBox — bouncing straight back into the same closure. Unguarded, that ping-pong recursed forever, overflowing the stack on every single host-card click or Enter-key activation (confirmed live via coredump/gdb: 43k+ stack frames of gobject signal emission, and the `fatal runtime error: stack overflow, aborting` in the crash log). A re-entrancy flag breaks the cycle after the one real activation. Added a regression test that wires the identical FlowBox/FlowBoxChild signal cycle against a real display and asserts it returns instead of recursing — it reproduces the exact stack overflow against the old code. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 23:59:04 +02:00
enricobuehler	71e1865519	fix(android): gate the latency overhaul behind an experimental toggle, default off ... The 27c53a4 low-latency overhaul regressed badly on some phones. Every piece of it — decoder ranking, per-SoC vendor keys, the async decode loop, pipeline thread boosts, the ADPF max-performance bias, game-tagged AAudio, DSCP marking, the Wi-Fi low-latency lock, HDMI ALLM and the forced TV mode switch — now rides the "Low-latency mode (experimental)" toggle, default OFF. Off restores the pre-overhaul pipeline byte-for-byte: the sync poll loop, the platform-default decoder, and the original format keys (standard low-latency + blind Qualcomm twin + priority=0 + operating-rate=MAX together). - New pref key (low_latency_mode_experimental): the old key shipped default-ON, so any install that ever saved settings persisted true — flipping the default under the old key would leave exactly the regressed devices stuck on. - DSCP is applied at socket creation, so the toggle reaches the transport via NativeBridge.nativeSetLowLatencyMode → transport::set_dscp_default, called in the connect choke point before nativeConnect; the core DSCP default reverts to off everywhere. - nativeStartAudio(handle, lowLatencyMode) gates AAudio usage=Game. - VideoDecoders.pickDecoder now skips `.secure` decoder twins and decoders that require FEATURE_SecurePlayback: they need a secure surface, and a secure twin could out-score its plain sibling (only it advertising FEATURE_LowLatency), which black-screens a clear stream. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 20:18:59 +02:00
enricobuehler	0ea9c46d9f	Merge remote-tracking branch 'origin/main'	2026-07-06 20:02:48 +02:00
enricobuehler	0429e93167	fix(android): auto-wake opt-out + console glyphs default by form factor ... An mDNS discovery miss was forcing connects through the Wake-on-LAN wait even for a host that's already up; add a Settings toggle ("Auto-wake on connect") that skips the mDNS-liveness gate and dials straight through when off. Also default the console UI's button glyphs by form factor instead of always starting in TV-remote style: a phone/tablet only ever enters the console UI via a real controller, so it should show gamepad glyphs from the first frame, not a remote's select/back glyphs. TV keeps the remote default. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:56:31 +02:00
enricobuehler	6e25b91b8e	chore(release): regenerate openapi.json for 0.8.1 ... The 0.8.1 version bump (215a8aa) bumped Cargo.toml but not the generated OpenAPI doc, leaving info.version stale at 0.8.0. Regenerated — version string only, no API surface change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 17:43:06 +00:00
enricobuehler	05a6f39550	style: rustfmt drift from the native AMF SDK encoder ... The native AMF encoder (7649ccb) landed unformatted, failing CI's Format step (and short-circuiting Clippy/Build/Test). Reformatted amf.rs with the pinned rustfmt 1.96.0 — no functional change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 17:39:40 +00:00
enricobuehler	27d25b5f6d	fix(client-linux): share one GamepadService across app activations ... `build_ui` (the GTK `activate` handler) started a fresh SDL3 gamepad worker thread on every reactivation of the already-running singleton (another --connect, the launcher clicked twice, ...). sdl3 only lets the first thread ever to call sdl3::init() hold "main thread" status, so every later activation's worker thread failed permanently with "Cannot initialize `Sdl` from a thread other than the main thread", silently disabling controller support for the rest of the process. Start the GamepadService once in run() and clone it into build_ui instead of starting a new one per activation. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:11:45 +02:00
enricobuehler	f94978f820	feat(android): add higher bitrate options up to 500 Mbps ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 16:31:27 +00:00
enricobuehler	58d7b64978	Merge remote-tracking branch 'origin/main'	2026-07-06 16:29:48 +00:00
enricobuehler	b6f59f5000	fix(apple): resolve macOS modifiers by keyCode — Control was silently dropped ... Modifier keys arrive only as flagsChanged, and the direction was recovered by diffing the device-dependent L/R bits (NX_DEVICE*KEYMASK) alone. Those bits are undocumented and some keyboards omit them (only the class bit, e.g. NX_CONTROLMASK, is set), so the diff saw no transition and the key never reached the host — no Ctrl shortcuts. SDL/Moonlight key off the event's keyCode for exactly this reason; do the same: keyCode names the changed key, the class bit says up, the device bits (when present) pick the side, and a tracked-held-state flip covers keyboards without them. PUNKTFUNK_INPUT_DEBUG=1 now also logs every flagsChanged (keyCode + raw flags) so a field report is diagnosable from client logs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 18:29:40 +02:00
enricobuehler	a041b0aa96	fix(host): stop force-disabling zero-copy on Mutter+NVIDIA by default ... apply_session_env unconditionally forced PUNKTFUNK_FORCE_SHM=1 for every GNOME/Mutter session, added 2026-06-14 after a same-day stale-frame bug hunt found Mutter has no implicit dmabuf fence on NVIDIA. That override silently contradicted the documented "zero-copy is on by default for all Linux GPU backends" behavior and left Mutter+NVIDIA hosts on the slower CPU/SHM path unconditionally, with no way to opt back in. Live retesting (192.168.1.21, RTX 5070 Ti, real client with cursor movement/window drag/typing — the historical trigger) shows no visible staleness with the override removed. Drop the automatic force; PUNKTFUNK_FORCE_SHM stays as a manual escape hatch for anyone who does hit flashing/stale frames on a Mutter+NVIDIA host. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 16:04:25 +00:00
enricobuehler	7649ccb66b	feat(host): native AMF SDK encoder for Windows AMD — drop libavcodec ... Direct-SDK AMF encoder (encode/windows/amf.rs), the AMD analogue of the direct-NVENC path, replacing the libavcodec *_amf dispatch. C-vtable FFI pinned to AMF headers v1.4.36, runtime-loaded from the driver's amfrt64.dll (no build feature, no new dependency) exactly as NVENC loads its DLL. - AVC/HEVC (SDR NV12 + 10-bit HDR P010) and AV1 (RDNA3+, probed); a bounded poll retires the libavcodec ~2-frame output hold; native in-place reset(). - Intra-refresh wave (PUNKTFUNK_INTRA_REFRESH), in-band HDR mastering/CLL metadata (*InHDRMetadata -> HEVC SEI / AV1 OBU), and a native codec probe feeding the GameStream advertisement (windows_backend_is_ffmpeg -> windows_backend_is_probed). - AMD dispatch / advertisement / 4:4:4 are native-only; the libavcodec AMF fallback and the PUNKTFUNK_AMF_FFMPEG hatch are removed. FFmpeg serves QSV only (its AMF path retained solely as the latency A/B comparator). - Overload back-pressure: submit bounds in-flight surfaces below the input ring, draining finished AUs (buffered for poll, FIFO-preserved) to free a slot and retry on AMF_INPUT_FULL instead of tearing the encoder down and forcing an IDR; this also closes a latent ring-overwrite corruption seen under load on-glass. Validated on the lab Ryzen iGPU (AMF runtime 1.4.37): HEVC/AVC across a native reset, HEVC Main10 mastering+CLL SEIs byte-verified, intra-refresh accepted, a backpressure burst FIFO-clean, and end-to-end via the macOS client. Measured §5.2 latency A/B: native encode_us p50 ~5 ms (0.31 frame periods) vs libavcodec ~17 ms (1.01). 4:4:4 stays unsupported (VCN hardware limit). Live-gated tests skip cleanly on non-AMD boxes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 17:33:23 +02:00
enricobuehler	efb49c5afd	feat(windows-client): WOL wait-until-up + IP re-key (Apple/Android parity) ... Like the Linux client, the Windows client had WOL send + MAC storage + a Wake action + fire-and-forget auto-wake, but no poll-until-up + IP re-key. Add the polished flow (mirrors Apple HostWaker + the request_access screen pattern): - connect::wake_and_connect — send the magic packet, show a cancelable Screen::Waking busy page, poll discovery::browse() until the host reappears (re-sending every 6 s, 90 s budget), then dial; re-key the saved host (KnownHosts::upsert) if it woke on a new IP. - Screen::Waking + waking_page, routed in app/mod.rs (mirrors RequestAccess). - the saved-host tile routes an offline-with-MAC tap to wake_and_connect; MENU_WAKE stays a pure send-only button. Reviewed against the request_access reference — DiscoveredHost/KnownHost/Target types, the widgets, .call()/.lock(), and the initiate signature all match; compile-verified by Windows CI (no local Windows toolchain). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 13:50:51 +00:00
enricobuehler	a5254c8798	feat(linux-client): WOL wait-until-up + IP re-key (Apple/Android parity) ... The Linux client already had WOL send + MAC storage + a Wake action + auto-wake- on-connect, but the auto-wake just fired a packet and did one dial to the stored address — so a host that woke on a new DHCP lease failed, and there was no "waiting" feedback. Add the polished flow (mirrors Apple/Android HostWaker): - ui_trust::wake_and_connect — send the magic packet, poll mDNS until the host reappears (re-sending every 6 s, 90 s budget) behind a cancelable "Waking…" dialog, then connect; if it woke on a new IP, re-key the saved host first. - trust::rekey_addr — no-churn addr/port update keyed by fingerprint. - the hosts page routes an offline saved-host-with-MAC tap to on_wake_connect (the new flow) instead of fire-and-forget wake + immediate dial. Builds + clippy + fmt clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 13:47:37 +00:00
enricobuehler	6081502949	feat(clients): signal explicit exit (QUIT_CLOSE_CODE) on deliberate disconnect ... The core's deliberate-quit close (NativeClient::disconnect_quit → QUIT_CLOSE_CODE, host skips the keep-alive linger) was implemented but never called by any client. Wire it to each client's explicit user-disconnect action — NOT to a network drop / host-ended / app-background (those keep the linger for a reconnect): - core: new C-ABI punktfunk_connection_disconnect_quit(c) for the ABI clients - Linux (direct-core): Ctrl+Alt+Shift+D + the controller escape chord - Windows (direct-core): Ctrl+Alt+Shift+D - Apple (C-ABI): PunktfunkConnection.disconnectQuit() + a `deliberate` flag on SessionModel.disconnect() (sessionEnded passes false → keeps the linger) - Android (JNI): new nativeDisconnectQuit export, called from the back gesture + the Select+Start+L1+R1 chord (not the host-gone watchdog) - probe already did this via --quit (b71dc94) Verified: core + Linux client + Android (cargo-ndk + gradle) build clean; Windows/Apple compile-checked by CI. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 13:37:45 +00:00
enricobuehler	a2723e34a1	style: rustfmt drift from the AMF/watchdog commits ... `cargo fmt --all --check` (a CI gate) failed on main: config.rs (the new `zerocopy: val(...).map { !matches!(...) }` from 8fb1264) and punktfunk1.rs (the `reset_stalled_encoder` conditions from 06d594b) were left unwrapped by the pinned rustfmt. Pure reformat, no semantic change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 13:00:23 +00:00
enricobuehler	8df6d07cc6	fix(android): launch games from the library ... The library browser was browse-only — the A button (and a tap) did nothing. Wire it to connect + boot straight into the selected title: thread a `launch` id (the store-qualified library id `steam:<appid>` / `custom:<id>`) through nativeConnect → NativeClient's Hello.launch (was hardcoded None), add a shared connectToHost() the ConnectScreen and the library launcher both use, and have LibraryScreen dial the host with launch=game.id on A / tap — with a launching overlay + an "A Launch" hint. Verified: native compiles (cargo-ndk arm64), app+kit Kotlin compiles (gradle, 3 ABIs). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 12:59:39 +00:00
enricobuehler	2c1bb4de93	docs(design): native AMF encoder handoff — drop ffmpeg for AMF, keep for QSV ... Design + decision record for replacing the libavcodec *_amf path with a direct AMF SDK encoder (encode/windows/amf.rs, the AMD analogue of the direct NVENC path). Motivation is measured, not speculative: the libavcodec wrapper structurally holds ~2 frames (36 ms p50 at 720p60 on VCN, un-tunable), driver wedges surface as forever-EAGAIN instead of typed AMF_RESULTs, and intra-refresh / in-band HDR SEI are inexpressible through it. Covers the C vtable FFI strategy (amfrt64.dll runtime-load, FFmpeg amfenc.c and OBS texture-amf.cpp as references), bounded-poll retrieval, the property table, watchdog/reset interplay, exact dispatch seams, a lab-iGPU validation plan with today's zero-copy baselines, and three phases ending with the ffmpeg-AMF arm deleted (FFmpeg stays QSV-only). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 14:36:55 +02:00
enricobuehler	8fb126482e	feat(host): default the Windows AMF encode input to zero-copy D3D11 ... On-glass A/B on the Ryzen 7000 iGPU (1080p120 HDR P010, hevc_amf, PUNKTFUNK_PERF stage split): the system-memory readback costs the encode thread 2.7-2.9 ms p50 (6.6 ms p99) per frame in submit; the zero-copy D3D11 pool path does the same work in 0.26 ms p50 (0.5 ms p99) — and on an iGPU the readback also burns the shared memory bandwidth the game needs. The docs-site already promised "on by default ... D3D11 on Windows" since the Linux flip (2f9e61d was Linux-only); the Windows code now delivers it. PUNKTFUNK_ZEROCOPY becomes a tri-state override: unset defers to a per-vendor default in zerocopy_enabled(vendor) — ON for AMF (validated above; open failures still fall back to system-memory readback), OFF for QSV until it is validated on Intel glass (the fallback only catches *setup* errors; a QSV derive that opens but maps wrong would corrupt silently, so probe-never-assume applies). Explicit values force either way: 0|false|off|no = readback, anything else = zero-copy, so the old presence-style =1 keeps working. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 14:36:43 +02:00
enricobuehler	06d594bc2a	fix(host): encode-stall watchdog — heal the silent AMF/QSV freeze in place ... Field reports: Windows AMD/Intel streams freeze after ~3-5 min regardless of desktop activity. Root cause: the libavcodec AMF/QSV poll is non-blocking (EAGAIN -> Ok(None)), and the encode loop's drain treated None as benign without popping `inflight` — a wedged driver (QueryOutput stops producing) meant frames kept being submitted, inflight grew unboundedly, no AU ever reached the send thread, and nothing logged: a silent permanent freeze. The input-side twin: once libavcodec's one-frame buffer fills, avcodec_send_frame EAGAINs and the submit `?` killed the whole session. Add `Encoder::reset()` (in-place encoder rebuild; implemented for AMF/QSV by dropping the wedged libavcodec encoder so the next submit re-opens it on the current device, forced IDR) and an encode-stall watchdog in the stream loop: trip on a poll error, on no AU within max(2 s, 8 frame intervals) while frames are owed, or on an owed backlog worth more than the window's frames (the slow-leak latency-runaway form). Recovery is a bounded (5 consecutive, cleared by any delivered AU) in-place rebuild + forced IDR — a logged ~one-second hiccup instead of a dead stream; exhaustion or a reset-less backend still fails the session with a clear error. Submit failures route through the same bounded recovery. The three existing pipeline-rebuild paths (session switch, mode switch, capture loss) now also clear the stale in-flight records that pointed at the dropped encoder. Backends whose poll blocks (direct NVENC sync, software) can't false-trip: they never return Ok(None) mid-stream and drain inflight below depth each tick. Validated: clippy -D warnings (nvenc,amf-qsv), 191 host tests, synthetic E2E 300/300 frames, and an on-glass AMD iGPU session (1080p120 HDR hevc_amf). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 14:36:29 +02:00
enricobuehler	39889c3102	fix(host): silence write-only cur_node_id on non-Linux encoder builds ... cur_node_id (the capture 5-tuple's node id, added for the Linux dedicated- game-exit check) is read only under #[cfg(target_os = "linux")], so on the Windows nvenc/amf-qsv build it was assigned but never read — failing `clippy -D warnings`. Read it on non-Linux platforms (the `let _ = &launch` idiom already used in this file). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 10:49:45 +00:00
enricobuehler	215a8aa9dc	chore(release): bump workspace version to 0.8.1 ... Release 0.8.1: game-mode + dedicated game sessions, zero-copy GPU import process-isolation (and zero-copy on by default on all backends), user-defined custom display presets, and a physical-monitor refresh-preservation fix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 10:38:14 +00:00
enricobuehler	2f9e61d191	feat(host): enable GPU zero-copy by default on all backends ... Now that the per-capture worker subprocess makes an NVENC EGL/CUDA driver fault survivable (design/zerocopy-worker-isolation.md), the reason the NVENC zero-copy path stayed opt-in is gone. zerocopy::enabled() now defaults ON for both GPU backends (was ON VAAPI / OFF NVENC). Fallbacks are intact: VAAPI's one-shot CPU auto-downgrade (VAAPI-gated, never trips for NVENC) and NVENC's per-capture fallback + worker-death latch. Reframe the shipped host.env examples and setup guides to rely on the default rather than force PUNKTFUNK_ZEROCOPY=1 (an explicit =1 skips the VAAPI auto-downgrade). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	a947f48d29	fix(host): preserve a physical monitor's refresh when adding a virtual display ... Connecting reset an existing physical monitor's refresh (e.g. 120->60 Hz) because the topology code read the physical's mode AFTER the virtual output perturbed the compositor layout — by which point it had already been downgraded. Read/preserve each physical's mode from a pre-connect snapshot. - Mutter: build_primary_keeping_physicals takes the pre-virtual snapshot and preserves each physical's real mode (pick_keep_mode, unit-tested) - KWin: capture each output's mode when disabling for exclusive, re-assert it on re-enable (a bare enable defaulted to ~60 Hz) - Windows: skip the refresh-resetting SDC_TOPOLOGY_EXTEND when a physical is already active Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	a4f81dec48	feat(host): user-defined custom display presets ... Save named bundles of the display-management policy (the six behavior axes plus the game-session axis) as custom presets, alongside the built-ins. A custom preset is data — stored in <config>/display-presets.json — not a Preset enum variant, so DisplayPolicy::effective() stays pure and the built-in set is untouched; applying one writes a Custom policy via the existing PUT /display/settings. - policy.rs: CustomPreset/CustomPresetInput + load/add/update/delete store - mgmt.rs: GET/POST /display/presets + PUT/DELETE /display/presets/{id}, surfaced on GET /display/settings - web console: custom-preset cards with save-as / edit / delete + i18n - regenerated api/openapi.json; docs Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	077d8f85ca	feat(host): isolate the zero-copy GPU import in a worker process ... The tiled EGL/GL→CUDA import crashed the whole host (SIGSEGV inside libnvidia-eglcore via cuGraphicsMapResources) when the compositor invalidated an imported dmabuf mid-map — reproduced on the Bazzite F44 Game→Desktop switch (design/zerocopy-hardening-handoff.md). A driver SIGSEGV is uncatchable in-process, so the whole EglImporter (tiled EGL/GL→CUDA and LINEAR Vulkan→CUDA) now runs in a per-capture `zerocopy-worker` subprocess: dmabuf fds go over a SEQPACKET socketpair (SCM_RIGHTS, sent once per buffer keyed by dmabuf st_ino; NeedFd resend self-heals cache desync), frames come back as CUDA-IPC pooled device buffers (still zero-copy, +one socket RTT/frame). Worker death poisons the capturer so the existing capture-loss rebuild runs — the host survives; 3 consecutive deaths latch the GPU import off (CPU/SHM path). PUNKTFUNK_ZEROCOPY_INPROC=1 keeps the old in-process import for debugging/A-B. Also fixed along the way: a failed *tiled* import no longer falls through to the CPU mmap de-pad (which scrambled tiled bytes; LINEAR keeps the fallback); Nv12Blit dropped its GL textures while still CUDA-registered (unregister now runs first); GlBlit had no Drop at all (GL objects leaked per size change); VkBridge's per-fd src cache is now invalidated on renegotiation/eviction instead of never. Design: design/zerocopy-worker-isolation.md. Unit tests: 14 new (protocol fd-passing, worker dispatch, client handshake/death/NeedFd, death latch). On-glass validated on the RTX 5070 Ti/GNOME box (.21): the worker path streams at p50 1.30 ms (NV12, 1800 frames 0-mismatched, parity with the in-process path), and a kill -9 of the worker mid-stream is survived by the host and recovered — poison -> capture lost, rebuilding pipeline in place -> a fresh worker in ~185 ms -> streaming resumes (2385 frames, 0 mismatched). A real KWin compositor-crash repro is still pending (a worker kill -9 is strictly harsher, so it corroborates). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	07d46f865c	docs: zero-copy EGL/CUDA capture-crash hardening handoff ... Describes a reproduced host SIGSEGV in cuGraphicsMapResources (inside libnvidia-eglcore), reached via zerocopy::cuda / zerocopy::egl on the tiled EGL/GL->CUDA capture path, when the KWin dmabuf is invalidated mid-map (observed on .181 during a Game->Desktop switch under zero-copy, with the compositor itself crashing). Pre-existing capture-layer issue, not the gamemode work. Issue description + root cause + solution-space considerations only -- the next agent plans the implementation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	1271fd5ea2	feat(host): game-mode integration + dedicated game sessions ... Implements design/gamemode-and-dedicated-sessions.md (Parts A1-A5 + B0-B2): reconciles the merged display-management registry with session-mobile Bazzite/SteamOS hosts and adds a per-launch dedicated gamescope mode. - A1 DisplayOwnership {Owned,External,SessionManaged} + poolable_now(): the registry pools only what it owns, so gamescope managed/attach outputs are no longer double-owned by the registry AND the gamescope restore worker (fixes the game-mode-reconnect stale-node wedge). - A2 validated reuse: (backend,mode,launch,epoch) reuse key + kept_display_alive liveness probe + reused_gen/mark_failed on a reused-display first-frame failure. - A3 policy-driven managed restore (keep_alive replaces the hardcoded 5s debounce; forever = held = gaming-rig truthful) + crash-restore persist + SIGKILL teardown (kill_unit, applied to our transient unit AND the autologin stop -- validated live on .181 to avoid the F44 GPU-context leak). - A4 session epoch: observe_session_instance bumps the epoch + invalidate_backend on a desktop-compositor instance change; gamescope spawns are exempt. - A5 per-spawn log + PID-scoped gamescope node discovery. - B0 game_session {auto,dedicated} policy (top-level, preset-orthogonal) + pick_gamescope_mode dedicated_launch + steam -silent command shaping. - B1 free the autologin Steam before a dedicated Steam spawn (single-instance). - B2 game-exit -> APP_EXITED_CLOSE_CODE (0x52) clean session end. Adversarially reviewed (11 findings fixed). Validated on glass (.181 Bazzite F44, RTX 4090): dedicated spawn streams a real game smoothly; keep-alive reuse; the SIGKILL fix avoids the F44 vkCreateDevice leak. Workspace green (build / test --workspace / clippy -D warnings / fmt), OpenAPI + C header regenerated, web console tsc + vite build green. clients/probe: bump the no-video timeout 8s->45s for gamescope cold starts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 10:33:43 +00:00
enricobuehler	42b45113a9	fix(android): pass dropped streams through to the ui	2026-07-06 12:14:40 +02:00
enricobuehler	d76a42e0e9	docs(security): add 2026-07-05 whole-project posture audit ... Assessment of the overall security architecture, the state of the prior reviews' remediations, and the process/supply-chain controls. Flags the two web-console residuals (no brute-force throttle; cookie seal key from the login password) that the accompanying web-hardening change fixes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 07:28:51 +02:00
enricobuehler	5a51b0d8e7	ci: SHA-pin secret-bearing third-party actions + audit the web dep tree ... - Pin android-actions/setup-android, appleboy/scp-action, and appleboy/ssh-action to commit SHAs (version kept in a trailing comment). These run in jobs holding the Android signing keystore, Play service-account, and deploy SSH key, so a moved tag on a third-party action could exfiltrate them. - Add a bun-audit job to audit.yml over web/bun.lock — the console holds the login gate, session sealing, and mgmt token, so its deps matter too — and trigger the workflow on web/bun.lock changes alongside Cargo.lock. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 07:28:45 +02:00
enricobuehler	bda5556d37	feat(web): harden login gate — throttle, scoped TLS, token-derived seal key ... Remediates the two web-console residuals from the 2026-07-05 posture audit: - Brute-force throttle (loginThrottle.ts): per-IP exponential backoff after 5 free attempts, plus a global floor for spread-out floods, keyed on the socket peer IP (not spoofable X-Forwarded-For) with a size-capped map. The constant-time compare already stopped the timing leak; this bounds guess *volume* against a by-design LAN-exposed console. - Session seal key now derives from the high-entropy mgmt token instead of the low-entropy login password, so a captured cookie is no longer an offline password oracle. Falls back to the password only when no token is configured (dev/local). Rotating the token now invalidates sessions. - Replace the process-wide NODE_TLS_REJECT_UNAUTHORIZED=0 with per-request Bun TLS scoped to the loopback proxy hop; a non-loopback mgmt URL now verifies normally. Dropped the env var from the systemd unit, Steam Deck installer, Windows run scripts, env examples, and web README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 07:28:39 +02:00
enricobuehler	ab56536842	docs(readme): Windows host capture is IDD-push, not DXGI/WGC ... The DXGI Desktop Duplication + WGC relay paths were removed; sealed IDD-push (finished frames pushed straight into the host's own IddCx driver, no screen-scraping) is now the sole Windows capture path. Fix the stale "DXGI/WGC capture" claims in the root and punktfunk-host READMEs, which also contradicted the push-based IDD description already present in the root README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 07:28:29 +02:00
enricobuehler	27c53a4b53	perf(android): low-latency decode overhaul — vendor keys, async loop, system tuning ... Close the latency gap on the Android client with per-SoC decoder tuning, an event-driven decode loop, and full system integration. - Decoder selection: rank MediaCodecList decoders in Kotlin (hardware/vendor preferred, software avoided, FEATURE_LowLatency probed) and create the chosen one by name. Per-SoC low-latency keys gated on the codec-name prefix: Qualcomm picture-order + low-latency, Exynos (also Google Tensor), Amlogic, HiSilicon; MediaTek vdec-lowlatency set unconditionally. operating-rate = MAX (Qualcomm) vs priority = 0 (else) are mutually exclusive. NVIDIA/Rockchip/Realtek have no vendor key — covered by ranking + the standard low-latency key. - Async decode loop: AMediaCodec async-notify replaces the poll loop, presenting a decoded frame the instant it is ready instead of waiting out a poll interval. Behind USE_ASYNC_DECODE with the synchronous loop kept for A/B during bring-up. - System integration: Wi-Fi FULL_LOW_LATENCY lock and HDMI ALLM (setPreferMinimalPostProcessing) for the stream's lifetime; game_mode_config.xml opting out of OEM downscaling / FPS overrides. - Pipeline: boost the data-plane pump + audio thread priorities, AAudio usage=Game, DSCP marking on by default on Android, ADPF setPreferPowerEfficiency(false), and setFrameRateWithChangeStrategy(ALWAYS) to force the HDMI mode switch on TV. - lowLatencyMode master toggle (default on) as the escape hatch; the stats HUD now shows the resolved decoder name. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 07:25:16 +02:00
enricobuehler	69fcb6e0b1	docs: restructure host setup by distro, configuration by compositor ... Split the docs' single distro×desktop axis (ubuntu-gnome / ubuntu-kde / fedora-kde) into two, which deduplicates the shared mechanics and scales to distros that run several desktops (Arch): - Install the host — per distro/OS (ubuntu, fedora, arch, bazzite, steamos-host, windows-host): GPU driver + package + input group, then a canonical "Configure your desktop" funnel. - Configure your desktop — per compositor (kde, gnome, gamescope, sway): host.env, compositor quirks, the headless session, and starting the host. New shared web-console page (enable · login password · arm pairing) removes the console/password block that was copy-pasted across all seven host pages. Merged ubuntu-gnome + ubuntu-kde into ubuntu; renamed fedora-kde to fedora; kept bazzite and steamos-host as dedicated appliance guides (trimmed of duplication). Moved the KWin headless session, the GNOME EGL/lock traps, and the gamescope attach/managed model out of the distro pages onto their compositor pages. Fixed while restructuring: distro-specific paths on kde (kde-desktop-setup.sh is Fedora/Bazzite-only; the .deb ships host.env.kde under /usr/share/punktfunk-host), the interactive "start the host" step that was lost in the merge, sway over-claiming Hyprland, and a pre-existing broken anchor in how-it-works. Removal of the three old pages was captured by the preceding commit 8ebb614 (a concurrent commit swept up the staged git-rm); the net docs tree is correct. Fumadocs build + internal link/anchor check green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 21:04:31 +00:00
enricobuehler	8ebb61400c	fix(web): clearer topology/identity copy, capped description width, mobile More-nav, preset spacing ... Console polish on the Virtual displays card + shell: - Topology help now leads with the streamed display's role (Extend/Primary/Exclusive) instead of the confusing physical-monitor-only framing; notes the headless case. Identity help spells out the actual behavior (stable per-client identity → the desktop reapplies that client's scaling/resolution on reconnect) + what Shared / Per-client / Per-client+resolution each do. - Cap description/help width at max-w-prose so long help text isn't a full-viewport line on large screens. - Mobile bottom nav: 8 flat tabs were too cramped → 4 pinned tabs + a "More" tab whose sheet holds the rest (Performance/Logs/Pairing/Settings), "More" highlighted when the active route is in the overflow. - More breathing room under the "Preset" heading. web tsc + biome + vite build green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 20:40:35 +00:00
enricobuehler	b57e414618	chore(release): bump workspace version to 0.8.0 ... The [workspace.package] version (inherited by every crate via version.workspace) is the release being cut; refresh the 9 workspace entries in Cargo.lock to match (CI builds --locked). Canary derives from the tag (scripts/ci/pf-version.sh), so cutting v0.8.0 auto-advances canary to 0.9.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 19:39:52 +00:00
enricobuehler	ec40a4062f	build: pin the exact Rust toolchain (1.96.0) to stop rustfmt drift ... rust-toolchain.toml pinned the floating "stable" channel, so the CI image baked whatever stable existed at image-build time. When the image is rebuilt onto a newer stable, rustfmt's rules shift and `cargo fmt --all --check` fails on files nobody touched — the recurring format-drift that keeps red-lighting CI. Pin channel = "1.96.0" (== today's stable: rustc ac68faa20, rustfmt 1.9.0-stable), the exact build CI already runs, so this is a no-op now but locks formatting for good: local dev, the Linux CI image, and the Windows runner all use rustup and honor this file, so they converge on one rustfmt. Formatting now only changes in a deliberate bump-this-pin- and-reformat commit. ci.yml cache comment updated to match. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 19:32:38 +00:00
enricobuehler	19c35de3d7	style(host): cargo fmt --all (rustfmt 1.9.0 drift) ... The CI image's rustfmt reformats these files (multi-line assert!/tracing! macros, match-arm and struct-variant wrapping) — pre-existing drift that the Format job caught. Reformat to match. Pure formatting; no logic change. main.rs also gets a blank line before a standalone comment so rustfmt stops mis-indenting it as a trailing-comment continuation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 19:29:28 +00:00
enricobuehler	aa012c6b45	feat(vdisplay/mutter): pin the client's refresh by default; drop PUNKTFUNK_MUTTER_VIRTUAL_REFRESH ... The >60 Hz virtual-monitor path (RecordVirtual "modes" with the client's exact WxH@Hz) was gated behind PUNKTFUNK_MUTTER_VIRTUAL_REFRESH, default OFF, after a high-refresh virtual CRTC SIGSEGV'd gnome-shell on session teardown. That crash was since fixed by stopping the screencast before any monitor reconfig, so the gate is dead weight — and a silent footgun: every non-headless GNOME client was capped at Mutter's PipeWire-derived 60 Hz unless they knew the hidden flag. Make it the default: the custom-mode path now runs whenever mode.refresh_hz > 60 (≤60 Hz stays byte-identical to before — Mutter's 60 Hz default is already correct), and the virtual_refresh_enabled() env read is removed. Docs updated (configuration.md env table, vrr-plan.md reference). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 19:25:36 +00:00
enricobuehler	74c9e46faf	fix(vdisplay/windows): Windows clippy — per-block SAFETY comments + then_some ... The branch's Windows-host code never ran through the fleet Windows clippy (kept off CI); the merge to main exposed it. Fix the 4 -D warnings failures in cfg(windows) code: - manager.rs: 3 unsafe blocks (isolate_displays_ccd / force_extend_topology / set_virtual_primary_ccd) had one "both arms" SAFETY comment on the `match` line — clippy::undocumented_unsafe_blocks wants it immediately before each block. Split into per-block SAFETY comments. - win_display.rs: `.then(|| …)` on a POD u32 union read → `.then_some(…)` (eager is fine, discarded when false) for clippy::unnecessary_lazy_evaluations. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 19:04:06 +00:00
enricobuehler	95b3496bb5	merge: display-management (Stages 0-5 §6A + keep-alive hardening + gaming-rig) ... Merges display-mgmt-stage0 — the user-configurable virtual-display policy layer above the per-compositor backends. On-glass validated (KWin .116 + Mutter .21; Windows compile-verified .173): - Policy surface (keep_alive · topology · conflict · identity · layout · max) → display-settings.json, console-editable via /api/v1/display/{settings,state,release,layout} + a dedicated "Virtual displays" console section. All five axes enforced, not just stored. - Lifecycle: pure state machine + Linux keep-alive pool (registry + DisplayLease ownership split), incl. keep_alive=forever/Pinned (freed via /display/release); topology extend/primary/exclusive (group-aware); per-client identity (KWin per-slot names → KDE scaling round-trips); mode_conflict admission (Windows default reject, single-capturer IDD); §6A multi-monitor (display groups + layout engine + console arrangement table — several clients as monitors of one desktop). - Keep-alive reconnect hardened: same-client zombie preempt (never a 2nd display), deliberate-quit skip-linger (QUIT_CLOSE_CODE), tunable idle timeout (PUNKTFUNK_IDLE_TIMEOUT_MS). Conflicts (packaging/{arch,debian}/README.md firewall docs): kept main's ufw/nft port commands + the branch's --data-port documentation. build + clippy -D warnings + cargo test --workspace (18 suites, 0 failed) green on the merged tree.	2026-07-05 18:22:17 +00:00
enricobuehler	334f36ce25	test(punktfunk1): serialize in-process-host tests (shared admission table) ... The reconnect-preempt (b53710d, preempt_same_identity) reads the process-global admission table and signals same-identity live sessions. The three in-process-host tests each bind a fixed loopback port and share that ONE table, so running them concurrently let one test's connection preempt + close another's live session — an intermittent `next_au: Closed` in c_abi_connection_roundtrip (surfaced under full-workspace load; a lucky pass hid it at b53710d). Serialize them on a poison-tolerant lock. Test-isolation only — in production a host is one process with unique client certs, so same-identity preempt is correct. Full workspace `cargo test` now green (18 suites, 3× clean). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 18:09:59 +00:00