14 Commits

Include renames

Author	SHA1	Message	Date
enricobuehlerandClaude Opus 5	45f04f50fe	test(mgmt): gamescope reports no monitors, and that is not a missing explanation ... /display/monitors must never answer empty AND silent — the console reads that as "the host is broken". But gamescope is nested: it owns no physical heads by construction, so empty-and-silent is the correct answer there, not an unexplained one. Any dev box that has ever been in game mode keeps gamescope-0 sockets in its runtime dir, so detect() resolves gamescope and the test failed on the machine rather than on the code (found running the suite on .136). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Opus 5	95e3314d9a	feat(vdisplay): enumerate the host's physical monitors ... P0 of per-monitor capture (design/per-monitor-portal-capture.md): nothing in the tree could answer "what heads does this host have?", which both a monitor pin and a console picker need first. One read per compositor, each beside the code that already speaks that dialect: KWin's kde_output_device_v2 (the topology session now also records geometry + scale), Mutter's DisplayConfig.GetCurrentState, swaymsg get_outputs, hyprctl monitors. Logical geometry throughout, because x/y is what identifies a head — two monitors can share a size but never an origin. PUNKTFUNK_CAPTURE_MONITOR parses here and is reported at startup, loudly including that it is not yet enforced: a knob that is read but inert has to say so, or "it didn't work" reads as a bug. GET /display/monitors always answers 200 with an explained empty list, so a compositor-less host renders as "nothing to pick", not as a broken console. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 23:51:41 +02:00
enricobuehlerandClaude Fable 5	64c0ff96bc	feat(session): bind a session's life to its game's, in both directions (Linux) ... Two of the most-asked-for behaviors, and until now the host could only manage a sliver of one of them: end the streaming session when the launched game exits, and — when the operator asks — end the game when the session ends. Ending the session on game exit already worked, but only for a Steam title under a bare-spawn gamescope. Everywhere else the host spawned a launch and forgot it: the pid was logged and dropped, so on KWin, Mutter, wlroots or gamescope-attach a finished game left the client staring at a desktop. Ending a game was not possible at all — there was no primitive for it. The missing piece was never plumbing, it was knowledge: a launch says what to run, not what the game looks like once a launcher has handed off. So each store now also reports how to recognize its game (DetectSpec, previous commit's subject matter, folded in here), procscan turns that into live pids on Linux, and gamelease turns pids into a lifetime — with four kinds covering how the game got started: nested gamescope owns it; its display teardown ends the game child the host spawned it, in its own process group matched a launcher owns it; recognized by its store's signals untracked nothing identifies it — both behaviors stay off, and the host says so once rather than guessing A child that exits successfully within 5s was a launcher handing off, not the game: the lease re-resolves to matched (or to untracked) instead of reporting an exit. That single rule is what keeps steam://, epic:// and playnite:// launches from ending a session the moment they start. Ending a game is destructive, so three rules bound it. It is opt-in (game_on_session_end defaults to keep). A drop is not a decision — `always` waits out a reconnect window (5 min) that a returning client cancels by reclaiming its own game, matched on fingerprint and title. And only ever this session's game: a pid is adopted only if it started after the launch, so a copy the player already had open is never touched, and every pid is re-verified against its start time immediately before being signalled, so a recycled pid never is. Termination asks first (SIGTERM to the group, 10s) and only then insists. Also here, because they are the same decision seen from other angles: - A management stop is now a deliberate stop. `DELETE /session` sets quit before stop, so it behaves like a client pressing Stop — the display skips its keep-alive linger instead of lingering for a session nobody is coming back to. - `/status` reports what is running (games[]), including a game whose session has gone and which is waiting out its window, so the console can show it and offer `POST /game/end`. - New game.running / game.exited events, filterable like every other kind, which is the whole polling loop of the community plugin this replaces. - session_status::register takes a named struct: eleven positional arguments, half of them same-typed Arc<Atomic…>, is a transposition waiting to happen. Gates on Linux (.21): check, clippy --all-targets, fmt, and 291 tests green. Windows (Job Objects, Toolhelp matching) and the GameStream plane are phases 2 and 3; both are inert here, as is macOS, which has no launch path at all. Design + plan: punktfunk-planning/design/session-game-lifetime{,-implementation-plan}.md Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 18:28:13 +02:00
enricobuehlerandClaude Fable 5	6c2c8b6eab	feat(mgmt/web): surface the host.env encoder pin so a conflicting GPU choice isn't invisible ... listGpus gains encoder_pin (PUNKTFUNK_ENCODER when it actually pins something — unset/auto stay null), and the console's GPU card shows it: a muted note when the pin is compatible, an amber warning naming the pinned vendor and the next session's GPU when it contradicts the selection (the host overrides such a pin at session open — without this field the selection just looked broken). Docs updated to say the adapter wins. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 16:53:19 +02:00
enricobuehlerandClaude Opus 5	d49f1bba49	fix(tray): count native sessions as streaming, and stop hiding "Open web console" ... The tray sat at "Idle" through an entire stream, and its Windows context menu could come up without its main action. Two separate causes. `GET /api/v1/local/summary` reported `video_streaming`/`audio_streaming` straight from `AppState.streaming` — flags only the GameStream media pipeline raises. The native punktfunk/1 plane is the DEFAULT (GameStream is opt-in) and never touches them, so every native session read as idle: idle icon, and a tooltip that printed that session's own resolution next to the word "idle" (the `session` field was already native-aware). This is the blind spot `/status` was fixed for — see the `session_status` module doc — which the summary kept. Both flags now OR in a live native session, and the tray additionally treats a reported session as streaming, so a new tray reads an older host correctly too. The menu built "Open web console" (and the pairing entry) only while a live loopback probe of the console had just succeeded. A console still starting, or an SSR render slower than the 2 s probe timeout, therefore deleted the tray's most-wanted action outright — indistinguishable from a tray that never had one, with left-clicking the icon as the only, undiscoverable, way in. The entry is now always present and the default item; a failed probe changes its label to "(not responding)" instead of hiding it, and takes two consecutive misses to say so, since one timeout is not "down". While here: a "Release kept display…" entry when displays are held (the summary field's own doc promised a one-click release that did not exist), and entries deep-link to /pairing and /displays instead of all landing on the dashboard. The Linux SNI menu mirrors all of it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-25 00:46:30 +02:00
enricobuehlerandClaude Fable 5	833f3348a0	feat(store): console plugin store, index repo, and the fixes on-glass found ... Console: a Plugins section (Browse / Installed / Sources) on a static nav entry, with install friction proportional to trust — a plain confirm for a verified entry, a warning naming the curator for an external one, and a danger dialog that makes you retype the spec for a raw package. Tier badges are permanent and follow the plugin onto its own UI page. Index: unom/punktfunk-plugin-index published and served from Gitea's raw endpoint (real HTTPS, byte-exact, no vhost to stand up) — merge to main is publish, which resolves the design's open hosting question. Four things only running it could find: - runner discovery matched @punktfunk/plugin-* only, so a third-party scoped plugin (which D8 requires) would install and never run - ...and that convention also matches @punktfunk/plugin-kit, a plugin's own framework: it listed as installed and would have been imported as a unit. Both now key off the plugins dir's top-level dependencies, with an emptied dependency list meaning 'nothing installed' rather than falling back to the naming convention - the store must not pass new flags to the runner: the scripting package ships separately and an older one reads an unknown flag's value as a package name. The host writes the bunfig scope mapping itself - ureq reports only >= 400 as Err, so a conditional request's 304 arrives as Ok with an empty body — handled as an error it made every refresh after the first verify a signature over zero bytes and sit stale Also: the console's first Tabs use exposed an @unom/ui theme gap that rendered inactive tabs invisible (caught in a browser pass, not by types). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 20:48:02 +02:00
enricobuehlerandClaude Fable 5	9b5ca0eff3	feat(security): scope the plugin runner to a capability-limited bearer token ... The scripting runner used to hold the console's full-admin mgmt-token — a plugin defect could rewrite hooks.json (arbitrary command execution) or administer pairing. The host now mints a second persisted secret, plugin-token (PUNKTFUNK_PLUGIN_TOKEN), and require_auth grows a third lane for it: loopback-confined like the admin token, but plugin_may_access carves out /hooks (read AND write), everything under /pair, /native/pair, /native/pending, client unpair DELETEs, and other plugins' ui-credential. Everything a plugin legitimately does (status/library/events/sessions, its own UI lease) is untouched. The SDK's zero-config connect() now prefers PUNKTFUNK_PLUGIN_TOKEN / plugin-token over mgmt-token, so plugins pick the scoped credential up automatically; a script that genuinely needs the admin surface sets PUNKTFUNK_MGMT_TOKEN explicitly. Old hosts without a plugin-token fall back to mgmt-token unchanged. No OpenAPI change: the lane is auth-layer only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-20 00:45:27 +02:00
enricobuehlerandClaude Fable 5	c2bba13405	feat(host/web): per-scanner library toggles in the console ... Every installed-store scanner (Steam; Lutris+Heroic on Linux; Epic/GOG/ Xbox on Windows) was hardwired on. New library-scanners.json persists the operator's disabled set (default all on; absent/malformed = all on); all_games() gates each provider, so disabling one hides its titles from every surface (console grid, native clients, GameStream app list, launch resolve). GET /library/scanners lists this platform's scanners + state; PUT /library/scanners/{id} toggles and emits library.changed — admin lane only (the cert allowlist's exact-path /library match keeps both off the LAN surface). The console's Library page grows a "Game sources" card with one chip per scanner (platform-shaped by the API), EN+DE strings, story. The scanners are slated to become plugins; the stable per-scanner ids are the migration seam. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 19:58:05 +02:00
enricobuehlerandClaude Opus 4.8	ec84b30eae	feat(plugins): console-hosted plugin UI surface (host registry + SDK servePluginUi + console proxy/nav) ... Implements planning/design/plugin-ui-surface.md (U1-U3): - host: in-memory lease-based plugin registry (mgmt/plugins.rs) — PUT/GET/DELETE /api/v1/plugins + GET /plugins/{id}/ui-credential; bearer+loopback only (not on the mTLS read-only allowlist); plugins.changed event; port-only registration (proxy always dials 127.0.0.1); secret never in the listing. - sdk: servePluginUi — loopback ephemeral bind + per-boot secret + constant-time check + /__health + static/SPA-fallback + register/renew(30s)/deregister via pf.request (skew-proof, D7). Example + tests. - console: /plugin-ui/{id}/** reverse proxy (server-side secret injection, cookie strip, SSE streaming, stale-secret 401-retry) + credential cache; BFF denylist for the credential endpoint; dynamic Plugins nav (desktop + mobile) fed by a polled list; iframe-in-shell page with health probe, offline card, open-in-tab, deep-link sync. Dev-mode /plugin-ui middleware in vite.config.ts. OpenAPI regen for the new endpoints follows in the next commit (built on Linux). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 09:48:37 +02:00
enricobuehlerandClaude Fable 5	600693914f	fix(security): land the 2026-07 audit fixes — SSRF guards, roster lane, SYSTEM path hygiene ... The low/medium findings from the July host+Windows security review, as implemented in the audit session's working tree: - Webhooks and library-art fetches refuse loopback/link-local/metadata targets and no longer follow redirects (SSRF pivots from the privileged host process). - The paired-client rosters (/clients, /native/clients) move off the streaming-client auth lane — one paired device could enumerate every other device's name + fingerprint; only the bearer/loopback console keeps them. - Device-name sanitizing extends to bidi/format control characters (spoofable rendering) via the shared native_pairing::is_spoofy_char; stream-marker quoting uses the same set. - The SYSTEM service resolves powershell by its full System32 path — CreateProcess checks the launching EXE's own directory first, so a planted powershell.exe beside the host binary would have run as SYSTEM. - The pf-vdisplay driver's opt-in file log moves from world-writable C:\Users\Public to WUDFHost's own temp dir. - GameStream pairing sessions are single-use (removed whatever the outcome). - Uninstall also removes the pf_mouse driver-store entry (rider from the virtual-HID-mouse work). - openapi.json regenerated (hardened-config-dir doc wording). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 17:20:15 +02:00
enricobuehlerandClaude Opus 4.8	f2a58f3a91	feat(host/library): external provider API — declarative reconcile (M4) ... External game-library providers become first-class (RFC §8): a plugin computes its desired title list and PUTs it — the host owns the diff. - CustomEntry gains `provider` + `external_id` (API-set only; never on manual entries). GameEntry surfaces `provider` for console attribution and the new `GET /library?provider=` filter. - PUT /api/v1/library/provider/{p}: atomic declarative reconcile keyed on the provider's `external_id` — host ids stay stable across syncs, orphans drop, manual entries and other providers are never touched, an empty array clears the set. Validated: provider id [a-z0-9._-] (`manual` reserved), unique non-empty external_ids. - DELETE /api/v1/library/provider/{p}: clean uninstall, returns the removed count. - Ownership is unambiguous both ways: manual CRUD now returns 409 for a provider-owned entry (MutateOutcome::ProviderOwned) instead of letting an edit be silently clobbered at the next sync. - library.changed now carries the mutating source (`manual` or the provider id) — hooks and the SDK filter on it. - Spec + SDK schemas regenerated; sdk/examples/provider-sync.ts is the provider-plugin skeleton. 347 host tests green (pure reconcile: stable ids, orphan drop, idempotence, bystanders untouched; name/payload validation; route 400s) + 11 SDK tests. Live-verified end to end THROUGH the SDK against a real host: sync → filtered list → manual-delete 409 → re-sync with stable id + orphan drop → uninstall (removed=2), with three library.changed(source=romm) events observed on the live stream. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 00:33:42 +02:00
enricobuehlerandClaude Opus 4.8	46c0e0e483	feat(host/hooks): operator hooks — exec + webhooks on lifecycle events (M2a) ... hooks.json (RFC §6): commands and webhooks fired on host lifecycle events, managed over GET|PUT /api/v1/hooks (validated, applied immediately) and dispatched fire-and-forget by a bus-subscriber runner — hooks observe, never veto, and no operator code sits in any streaming path. - exec: detached sh -c with the event JSON on stdin + flat PF_EVENT_* env (the PF_STREAM_* vocabulary's sibling), per-hook timeout (default 30 s) with process-group kill, off-thread reap, per-hook debounce, bounded concurrency (8 in flight, excess dropped loudly). Windows runs hooks in the interactive user session (temp-file JSON argument; console-mode dev hosts get env + stdin like Unix). - webhook: POST the event JSON, TLS-verified, redirects never followed, no punktfunk credentials outbound; optional per-hook secret file yields X-Punktfunk-Signature: sha256=<hex HMAC> (fails closed if unreadable). - filters: exact-match client/fingerprint/plane/app + the same kind patterns as the SSE ?kinds= filter (shared crate::events::kind_matches). - hardening (RFC §9.1): hooks.json via the private-dir/secret-file helpers; a hook script path must be operator/root-owned and not group/world-writable or it is refused loudly (the sshd rule). - env mirrors PUNKTFUNK_ON_CONNECT_CMD / PUNKTFUNK_ON_DISCONNECT_CMD for the zero-config cases, beside PUNKTFUNK_RECOVER_SESSION_CMD. Live-verified on Linux: PUT config via API → library.changed fired a real script (env + stdin observed) and an HMAC webhook (receiver-verified signature); a chmod-777 script was refused. 342 host tests green (store/validation/filter/env-flatten/exec-timeout/ownership + routes), clippy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-16 21:52:05 +02:00
enricobuehlerandClaude Opus 4.8	9bc70e59fc	feat(host/events): GET /api/v1/events — SSE lifecycle event stream (M1) ... Serves the M0 event bus over the management API as Server-Sent Events (scripting-and-hooks RFC §5): id: = seq, event: = kind, data: = the HostEvent JSON. Standard Last-Event-ID (or ?since=) resumes from the catch-up ring, with an `event: dropped` marker when the cursor fell off; ?kinds= filters server-side (exact kinds or `domain.*` prefixes). Bounds per RFC §9.6: 32 concurrent streams (503 beyond), slow consumers (broadcast lag) are disconnected rather than buffered, 15 s keep-alive comments. Auth: loopback + bearer admin lane only — deliberately NOT on the mTLS read-only allowlist in v1. Note: api/openapi.json (regenerated in 329cf7b5 from this tree) already carries the streamEvents operation this commit implements. Verified live on Linux: catch-up + mid-stream library.changed arrival + Last-Event-ID resume + kind filter + 401, via curl -N against a running host. 335 host tests green (incl. the spec drift test), clippy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-16 20:46:17 +02:00
enricobuehlerandClaude Opus 4.8	ecfa71212d	chore: consolidate all in-progress parallel-session WIP ... Wholesale commit of every uncommitted change across the tree, at the user's explicit request — host refactor-campaign W1 (native.rs facade + native/ dir, library/ + mgmt/ splits), Android, core. These streams were mid-flight and not individually built/tested together; this supersedes the per-session HOLD markers. Consolidating so everything lands on main in one pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-16 20:08:29 +02:00