9 Commits

Include renames

Author	SHA1	Message	Date
enricobuehler	62a6fa9fac	fix(packaging): create the punktfunk group everywhere the udev rule needs it ... 60-punktfunk.rules chgrp's the usbip vhci attach/detach nodes to a dedicated `punktfunk` group (security-review 2026-08-05 M-4: writing `attach` materialises an arbitrary emulated USB device, so it must not ride on `input`). Four of the six install paths shipped that rule in 0.25.0 without ever creating the group. chgrp then failed, the nodes stayed root:root 0644, and the virtual Steam Deck pad silently never attached — while `usermod -aG punktfunk` failed outright with "group 'punktfunk' does not exist". Affected and fixed: * arch — post_upgrade() called only _ensure_update_group, so every box that reached 0.25.0 by `pacman -Syu` missed it; post_install was correct. * nix — no users.groups.punktfunk at all, though host.users' own description already promised the usbip/vhci pad. Declares it now and adds host.users to both groups. * bazzite sysext — a group is host state and cannot ride an image, and the deb/rpm scriptlets that would create it never run there. * steamdeck install.sh/update.sh — handled `input` only. Both now create the group and join it: running that script IS the statement "make my Deck a host with native pad passthrough". deb and rpm were correct throughout (one postinst/%post for install + upgrade). Also on the Deck path: web.env secret hygiene. install.sh's `chmod 600` sat inside the create-only branch despite a comment calling it "the idempotent belt for a pre-existing file", and update.sh never touched the config dir at all — so an install set up once and only updated since kept web.env world-readable (0644) with the console password and session secret in it. Both scripts now harden ~/.config/punktfunk to 0700 and web.env to 0600 on every run, and say so loudly, because a chmod does not un-leak an already-readable secret: the password still needs rotating. Both group blocks are `if ensure_group ...` rather than `ensure_group || true`: a failed groupadd must not fall through to a usermod against a nonexistent group, which under `set -e` aborted install.sh after the long build and update.sh before the service restart (verified: exit 6, no restart). Docs: the group is now documented where people actually look — the per-distro guides, install.md, steamos-host.md, a new troubleshooting entry for "pad arrives as an Xbox 360 controller", and the uninstall pages. The 0.25.0 notes gain the "group does not exist" caveat and turn the password bullet from "consider rotating" into a real instruction, and CHANGELOG records the known issue against the breaking change that introduced it. Verified: bash -n on all four scripts; the arch scriptlet's post_upgrade driven in a container (creates the group, idempotent on re-run); the ensure_group helper and both membership branches, including a control that reproduces the original bug (chgrp to a missing group leaves the node root:root 0644); the find -perm /0077 probe across 0644/0640/0604/0600/0400 on GNU findutils; `nix flake check --no-build` (the exact CI gate) and a NixOS eval showing alice.extraGroups == ["input","punktfunk"]; docs-site build + typecheck.	2026-08-08 17:53:36 +02:00
enricobuehlerandClaude Fable 5	19392918ff	feat(gamescope/hdr): HDR is attempted by default and every install path ships the patched gamescope ... Field report (RX 5700 / SteamOS): 10-bit HEVC "unsupported" — but the GPU was never the blocker (RADV probed Main10 fine on that box). The session stayed SDR because stock gamescope offers no 10-bit PQ capture formats and nothing shipped our pipewire-hdr build outside the Bazzite sysext, while PUNKTFUNK_GAMESCOPE_HDR additionally defaulted off everywhere. Close all three gaps: - PUNKTFUNK_GAMESCOPE_HDR now defaults ON (explicit-off grammar, the flip the config comment planned post-canary). Safe by construction: the +pfhdr banner probe, managed-spawn term, and client 10-bit cap keep stock-gamescope boxes on the exact 8-bit path. The nix module's gamescopeHdr (default true now) only controls whether the patched binary is on PATH; it no longer sets the env. - SteamOS: new scripts/steamdeck/build-gamescope.sh builds the HDR gamescope in the same pf2 trixie distrobox (apt dep list validated by a full build in a debian:trixie container), installs ~/.local/bin/punktfunk-gamescope, and maintains PUNKTFUNK_GAMESCOPE_BIN in host.env ONLY while the binary passes its on-glass --version/+pfhdr check — a stale absolute override would break session spawning, not just HDR. Wired into install.sh (§3b), update.sh (retrofit), and rebuild-check.sh (ldd-probes it like the host binary). - Arch: build-sysext.sh gains a --gamescope fold-in (banner-verified by execution, host-image-only), and punktfunk-host optdepends the companion. Deliberately NO CI-published host sysext: per the 2026-07-22 packaging verdict a prebuilt SteamOS host breaks on A/B soname bumps (and /var is per-partition-set), so arch.yml records that instead — SteamOS hosts use the distrobox flow above. Also fixes a latent bug that made build-sysext.sh fail every invocation as documented: a literal `}` inside `${1:?usage …{host,client}…}` terminates the expansion early and corrupts $PKG (caught by the new synthetic-package test, which also covers the fold-in, the unmarked-gamescope refusal, and the client-image guard). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-31 13:50:31 +02:00
enricobuehlerandClaude Fable 5	acce43ebbf	feat(steamdeck): self-healing reliability — post-OS-update rebuild check + script/docs polish ... - rebuild-check.sh + punktfunk-rebuild-check.service (enabled, ordered Before=punktfunk-host): ldd-probes the host binary at session start — milliseconds when healthy, a full update.sh rebuild only when a SteamOS update actually broke its library links. update.sh restarts go --no-block so the check → update.sh → restart chain can't deadlock against the unit ordering. update.sh retrofits the unit. - installer summary: web console is https (the unit serves TLS). - docs: steamos-host.md (runner in the build step, keep-list + auto rebuild = updates survive hands-free), gamescope.md (Gaming Mode touch = single-finger pointer, exact taps, no multi-touch), plugins.mdx (SteamOS runner note), scripts/steamdeck/README.md (rebuild-check, runner payload, keep list, honest packaging trade-off + the CI-prebuilt future direction). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 11:56:09 +02:00
enricobuehlerandClaude Fable 5	068da456f5	fix(steamdeck): survive SteamOS A/B updates — register system tuning on the atomic-update keep list ... Verified live on a SteamOS 3.8.14→3.8.16 update: the A/B partset switch rebuilds /etc and drops everything not on Valve's keep list — the udev rule (uhid access: virtual pads silently degrade to Xbox 360), the vhci-hcd autoload (native Deck pad transport), and the UDP buffer sysctl (back to 208 KB → stutter). Valve's sanctioned extension point is a drop-in under /etc/atomic-update.conf.d/ — itself on the stock keep list, so it self-preserves. install.sh §4 and update.sh now register scripts/punktfunk-atomic-keep.conf there. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 10:07:19 +02:00
enricobuehlerandClaude Fable 5	256aa5f7f2	fix(steamdeck): install the plugin runner + harden Deck pad typing + repair update.sh ... - scripts/steamdeck/install.sh (§2b) + update.sh: build and install the scripting runner user-scoped (~/.local wrapper + pinned bun + bundle) — SteamOS's read-only /usr can't take the .deb layout, so the console's plugin store reported "the plugin runner isn't installed" on every SteamOS host. update.sh retrofits it onto existing installs. - plugins.rs runner discovery: check the ~/.local layout after the /usr ones; mention the SteamOS path in the not-installed error. - update.sh: define warn() — it was used but never defined, so under `set -e` the first warn aborted the update before services restarted. - pf-client-core gamepad: a Steam Input virtual pad forwarded on a real Deck (the only-pad case) now declares the DECK kind in its per-pad arrival instead of the wrapper's Xbox 360 identity — the session-level auto_pref already resolved SteamDeck, but the arrival overrides it on current hosts. - reject tests: cover SetupFailed; move the foreign-code probe off 0x68. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-22 10:01:54 +02:00
enricobuehlerandClaude Opus 4.8	f36d13e371	fix(steamdeck/install): prompt for sudo instead of requiring passwordless ... The system-tuning block (UDP buffers, gamepad udev rule, vhci-hcd autoload, input group) was gated on `sudo -n true` — passwordless sudo — so on a stock SteamOS box (the deck account needs a password) the whole block was silently skipped: /dev/uhid stayed root-only so the gamepad degraded to an Xbox 360 pad, and the UDP buffers stayed at the 416 KB default. Video was unaffected because Game Mode/gamescope needs none of it, which masked the skip on-glass. - install.sh + update.sh: acquire sudo interactively (`sudo -v` prompt on a TTY) instead of requiring passwordless; skip only when there's no TTY or auth fails, and then print the exact manual block plus a `passwd` hint — a stock SteamOS 'deck' account has no password, so sudo can't work until one is set. - update.sh: also retrofit the UDP-buffer sysctl for older/skipped installs, and loudly nag to reboot when the input group was just added (a --user restart does not pick up the new group; only a fresh login does). - steamos-host.md: note this step prompts for the sudo password. Root is unavoidable: the udev rule, input group, and vhci-hcd module are all kernel operations with no user-space alternative. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 21:56:20 +02:00
enricobuehlerandClaude Opus 4.8	aacd610b68	fix(steamdeck/install): set up controller passthrough + surface the required reboot ... A fresh SteamOS host install failed on-glass two ways: KWin denied Desktop-mode capture (zkde_screencast_unstable_v1) so every session died in the pipeline build, and the native Steam Deck pad degraded to an Xbox 360 controller. Both stem from setup that only a fresh login applies — the host user-service keeps the pre-install group set and KWin reads its .desktop grant at session start — plus a missing vhci-hcd autoload the pad's USB/IP transport needs (the deb/rpm/arch packages ship it; the Deck installer did not). - install.sh: install punktfunk-modules.conf (+ modprobe vhci-hcd now) for the native Deck controller transport, seed the KDE RemoteDesktop grant (kde-authorized) for Desktop-mode input, and print a loud "reboot before streaming" notice when a relogin is actually required (input group added or the .desktop grant first installed). - update.sh: retrofit the udev rule, vhci-hcd autoload, input group, and grant so existing installs pick them up on the next update without a reinstall. - steamos-host.md: document the first-install reboot and the native controller passthrough requirements (input group + vhci-hcd + client-side Steam Input Off). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 19:22:08 +02:00
enricobuehlerandClaude Opus 4.8	946f1b3d69	fix(steamdeck): build the host with vulkan-encode, and wire up what it needs to actually engage ... The SteamOS scripts built the host featureless, so PlatformAuto could never pick the Vulkan Video backend (default-on since 84329205) and every session silently ran libav VAAPI — unlike the deb/arch/rpm/sysext builds, which all pass the feature. Three gaps, found live on a Deck host: - install.sh/update.sh: cargo build with --features punktfunk-host/vulkan-encode (matches the packaged builds; pure-Rust ash, no new system dep). - host.env: RADV_PERFTEST=video_encode — Van Gogh RADV still gates VK_KHR_video_encode_* behind it, so without it the backend can't open and falls back to VAAPI. Harmless where encode is exposed by default. - io.unom.Punktfunk.Host.desktop (Exec rewritten to this install's binary): KWin only grants zkde_screencast_unstable_v1/org_kde_kwin_fake_input to an exe a .desktop authorizes — without it Desktop-Mode capture fails outright and a mid-stream Game↔Desktop switch strands the stream on the old backend. update.sh retrofits the last two idempotently so existing installs get them without a reinstall. Validated on a SteamOS 3.8.14 Deck (Van Gogh): Vulkan HEVC opened on both the KWin and gamescope paths at 5120x1440 — in-place ABR reconfigure (no IDR, no encoder rebuild) vs the VAAPI path's full teardown per ABR step, and Desktop capture came up without a re-login. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 10:14:31 +02:00
enricobuehlerandClaude Opus 4.8	e235177bf8	feat(steamdeck): one-command host install + docs (build-on-device) ... SteamOS is immutable read-only Arch, and the Deck is AMD (VAAPI) — so none of the checked-in packaging (arch/sysext is NVENC-first + client-oriented, deb/rpm are soname-mismatched) actually installs a working host on a Steam Deck. The proven path (distrobox-built native binary + systemd-run units) was 100% manual. Make it one command. - scripts/steamdeck/install.sh — idempotent installer: ensure the pf2 Debian-trixie distrobox + toolchain → build host (+web console) → write config (generated web login password) → raise UDP buffers to 32 MB + udev + input group (sudo, skipped gracefully if unavailable) → install + start punktfunk-host / punktfunk-web systemd USER services with linger. Flags: --open (accept unpaired clients), --no-web, --src=DIR. Builds on-device so a rebuild always matches the running SteamOS (no prebuilt-binary fragility across OS updates); VAAPI on the Deck's AMD GPU. - scripts/steamdeck/update.sh — rebuild from current source + restart (config/pairings persist). - scripts/steamdeck/README.md — deep reference (why on-device, what's installed, gotchas). - docs-site: new "Steam Deck (Host)" guide + sidebar entry; install.md splits Arch from the Steam Deck host path; packaging/arch/README points Deck-host users here and corrects the stale "NVENC-only" note (VAAPI host encode landed). Live-validated on the Deck: installer runs clean, both services come up, host listens (QUIC :9777 + mgmt :47990), web serves (302→login); on a client connect it takes over the Game-Mode gamescope session at the client's mode, captures via PipeWire, and VAAPI-encodes (hevc_vaapi) — full pipeline confirmed in the host journal. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-20 22:20:00 +00:00