596 Commits

Author	SHA1	Message	Date
enricobuehler	c2bba13405	feat(host/web): per-scanner library toggles in the console ... Every installed-store scanner (Steam; Lutris+Heroic on Linux; Epic/GOG/ Xbox on Windows) was hardwired on. New library-scanners.json persists the operator's disabled set (default all on; absent/malformed = all on); all_games() gates each provider, so disabling one hides its titles from every surface (console grid, native clients, GameStream app list, launch resolve). GET /library/scanners lists this platform's scanners + state; PUT /library/scanners/{id} toggles and emits library.changed — admin lane only (the cert allowlist's exact-path /library match keeps both off the LAN surface). The console's Library page grows a "Game sources" card with one chip per scanner (platform-shaped by the API), EN+DE strings, story. The scanners are slated to become plugins; the stable per-scanner ids are the migration seam. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 19:58:05 +02:00
enricobuehler	940a260506	fix(host): retry the audio first-open instead of running the session silent ... Session start is peak endpoint churn on Windows — the virtual-display attach and the wiring plan's own IPolicyConfig default flips race the first WASAPI activate, which then fails transiently (IAudioClient 0x80070002, endpoint mid-re-registration) — and a first-open failure killed audio for the WHOLE session: wasapi_cap's capture thread sent the error through the ready handshake and exited, and the native plane's audio thread returned instead of entering its reopen loop (each layer's comment claimed the other retried; neither did). Two-layer fix: the WASAPI capture thread gives the first open three attempts a second apart before failing the handshake, and the native audio thread treats a failed first open like a mid-session capture death — it enters the existing reopen-with-backoff loop, so audio starts a few seconds late instead of never. The GameStream plane gets the WASAPI-level retry for free. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 19:37:03 +02:00
enricobuehler	fecbec2daf	fix(encode): make LTR-RFI loss recovery sound under sustained loss ... Field report (lid-closed Intel laptop, ~6-19% sustained loss): the stream never healed — permanent macroblock soup. Three stacked bugs: - QSV answered RFI with PreferredRefList only, a reorder HINT per the VPL spec — the recovery frame could keep predicting from tainted short-term refs. Now rejects every other DPB candidate (RejectedRefList) and caps L0 at one active entry (AVC/HEVC), matching AMF's hard ForceLTRReferenceBitfield / NVENC invalidation semantics. - Neither QSV nor AMF taint-swept LTR slots across losses: a slot marked inside the client's corrupt window became the "known-good" anchor of the NEXT loss, propagating corruption through every recovery. Both now drop slots at-or-after the loss start before picking an anchor, and guard a queued force whose slot the sweep emptied (no false recovery_anchor tag). - The native plane re-anchored the FULL IDR cooldown on every successful RFI, so under sustained loss the client's escalating keyframe requests were coalesced away indefinitely (field log: dozens swallowed, one IDR per ~8 s). RFI now anchors a 300 ms echo window with a 2-swallow budget per loss episode; a client still asking past that gets its IDR. Live-validated on Arc (qsv feature): 6/6 including the new qsv_live_ltr_rfi_taint_sweep_declines (a loss covering every live mark declines the RFI and falls back to IDR recovery). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-19 17:53:48 +02:00
enricobuehler	0b8e8312a5	fix(gamestream): announce the stream marker + lifecycle events on the compat plane ... Only the native punktfunk/1 loop announced the script-facing marker file, so a Moonlight session left it absent and wrapper scripts took their "not streaming" branch mid-stream. The GameStream plane now announces before run() (the marker must exist when the title's wrapper executes) and retracts before client.disconnected, keeping the native loop's event order; StreamRef call sites carry the plane/launch fields. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 16:34:43 +02:00
enricobuehler	f0c511c8fa	feat(plugins): punktfunk-host plugins CLI — add/remove/list/enable/disable/status ... One-liner plugin management replacing the manual scripting-dir + bunfig + bun-add ritual: package ops forward to the bun runner (new sdk plugins module + runner-cli subcommands, 11 tests green), enable/disable/status drive the systemd unit on Linux and the PunktfunkScripting scheduled task on Windows (installer support in the ISS). Docs page rewritten as .mdx with per-platform Tabs (registered in mdx.tsx). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 16:34:43 +02:00
enricobuehler	d2daeacc60	fix(pyrowave): per-session raw-dmabuf zero-copy capture on the Linux NVIDIA host ... A PyroWave session on an NVIDIA-auto host was forced onto CPU-RGB capture (session_plan flipped gpu=false): Mutter blits tiled->LINEAR, we mmap + de-pad ~30 MB, the encoder re-uploads it - three full-frame CPU touches per frame at 5120x1440 while an HEVC session on the same box rides the tiled EGL/CUDA zero-copy. The dmabuf passthrough + Vulkan tiled import were already validated (8dc5d672) but only reachable via the global PUNKTFUNK_ENCODER=pyrowave lab policy. ZeroCopyPolicy gains pyrowave_session (from OutputFormat.pyrowave, i.e. the negotiated codec): the capturer skips the NVENC-only EGL->CUDA importer, takes the raw-dmabuf passthrough, and advertises the wavelet encoder's Vulkan-importable modifiers so Mutter+NVIDIA negotiates tiled zero-copy. The forced-CPU flip in session_plan is gone. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 16:25:00 +02:00
enricobuehler	2123e4e580	fix(host/rtsp): scope the HDR mut allow so Windows clippy stays green ... `let mut hdr` tripped -D unused_mut on Windows: the only reassignment is the GNOME colour-mode probe below it, which is #[cfg(target_os = "linux")]. Dropping `mut` would break the Linux build, so allow unused_mut on non-Linux only — the lint still fires on Linux if that probe is ever removed. Second Windows-only breakage in this release that the Linux CI cannot see (see also the ffmpeg_win swscale match): `cargo clippy --workspace` on the Linux runner never compiles cfg(windows) code, and the Windows job builds only punktfunk-host + punktfunk-tray. Verified: cargo clippy --release -p punktfunk-host --features nvenc,amf-qsv,qsv -- -D warnings on 192.168.1.173. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-19 10:36:32 +02:00
enricobuehler	a83acf3ee1	style(fmt): rustfmt the GNOME 50 HDR files under the pinned toolchain ... `feat(hdr): GNOME 50 HDR screencast capture` (0e977817) landed with rustfmt drift — six files were not clean under the pinned 1.96.0 toolchain, so `cargo fmt --all --check` (ci.yml "Format") is red on main. Pure whitespace/ wrapping from `cargo fmt --all`; no semantic change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-19 10:09:34 +02:00
enricobuehler	0e977817f9	feat(hdr): GNOME 50 HDR screencast capture + Linux Main10 encode ... GNOME 50 (Mutter MR 4928, PipeWire >= 1.6) added HDR screen sharing for monitor streams: 10-bit PQ formats (xRGB_210LE/xBGR_210LE) with MANDATORY BT.2020 + SMPTE-2084 colorimetry props, advertised while the mirrored monitor is in BT.2100 colour mode. Wire the Linux host into it end-to-end on the GameStream desktop-mirror path (PUNKTFUNK_VIDEO_SOURCE=portal): * pf-frame: PixelFormat::X2Rgb10/X2Bgr10 (DRM XR30/XB30; X2Bgr10 is the Windows Rgb10a2 layout) + fourccs. * pf-capture: want_hdr portal offer — HDR-only LINEAR-dmabuf pods with MANDATORY PQ/BT.2020 props (SHM excluded: Mutter's SHM record path paints 8-bit ARGB32 regardless of format; tiled excluded: the EGL de-tile blit is 8-bit RGBA8), negotiated-colorimetry parse, generic HDR10 hdr_meta(), packed-10-bit CPU cursor blend, a process-wide SDR downgrade latch on negotiation timeout, and a DisplayConfig BT.2100 colour-mode probe (gnome_hdr_monitor_active). * pf-encode: libav NVENC X2RGB10->P010 swscale (BT.2020 limited) -> HEVC Main10 / 10-bit AV1 with PQ VUI; VAAPI 10-bit on both paths (CPU P010 upload + dmabuf XR30 scale_vaapi p010/bt2020); can_encode_10bit now probes for real on Linux; 10-bit sessions route around the 8-bit-only Vulkan-video/direct-NVENC backends. * GameStream: host_hdr_capable() Linux arm, live monitor-HDR check at RTSP honor time, capturer-pool reuse keyed on HDR-ness, gs_bit_depth covers the new formats. New `punktfunk-host hdr-probe` diagnostic and a PUNKTFUNK_SPIKE_HDR spike lever. * Native plane stays honestly 8-bit via capturer_supports_hdr(): Mutter RecordVirtual streams are SDR-only upstream (GNOME 50 and 51-dev), so virtual-display sources cannot deliver HDR yet. Validated on the RTX 5070 Ti (GNOME 50.3 / PipeWire 1.6.8): the Main10 probes pass and the ignored nvenc_hdr10_smoke GPU test emits an IDR that ffprobe reads as Main 10 / yuv420p10le / bt2020nc / smpte2084 / limited. Live HDR capture negotiation still needs an HDR monitor on glass; VAAPI 10-bit needs the AMD box. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 09:30:55 +02:00
enricobuehler	75474dcc90	fix(pyrowave): guard 4:4:4 modes that overflow the rate controller's block index ... The vendored rate controller packs its wavelet block index into 16 bits (RDOperation.block_offset_saving), so a mode whose 32x32-block count exceeds u16::MAX wraps inside the controller and corrupts the bitstream — ~8K-class 4:4:4 territory. Compute the exact count (`block_count_32x32`, the counting walk of upstream init_block_meta, pinned against the validated Apple WaveletLayout) and expose `pyrowave_mode_fits_rdo`; the negotiator downgrades such a session to 4:2:0 before the Welcome (the honest-downgrade channel), and both encoders refuse outright if one slips through rather than emit a wrapped stream. Vendor patches: 0002-rdo-saving-clamp (analyze_rate_control.comp clamps the saving accumulation to the target, same overrun class as 0001; slangmosh.hpp regenerated), 0003-devel-encode-16bit-read (devel tool y4m 16-bit plane reads; tool-only, kept so the vendored source stays honest). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 01:16:51 +02:00
enricobuehler	dc20e4452e	fix(pyrowave): anchor frame-driven pacing to arrival, hold full framerate ... The frame-driven capture loop set its rate-limit floor (`earliest`) relative to `next`, which is re-based to the instant AFTER submit(). For an async encoder (NVENC) submit() returns in ~0, so that anchor is ~frame-arrival and the loop correctly waits for the next vsync — full framerate. But PyroWave's encode is SYNCHRONOUS (~2 ms inline in submit()), so the anchor lands ~2 ms late every frame: the loop misses the next arrival and samples one interval behind, making the period `interval + encode`. That capped a 240 Hz source at ~158 fps (and a 360 Hz request at ~200) with the link and the encoder both idle — no drops. Anchor the floor to this frame's arrival (`t_cap`) instead. The synchronous encode now overlaps the interval rather than stacking onto it; the ≥0.9×interval spacing from the last grab still caps the rate at ~1.11× target. No-op for async NVENC (t_cap ≈ post-submit there), which is why H.26x already held full rate. Measured on-glass (5120x1440@240, RTX 4090 host, macOS client): desktop now holds 240 fps. Also reduces latency (samples fresher frames). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 01:01:59 +02:00
enricobuehler	017b083e32	feat(library): serve provider entries' local art via the host art proxy ... A provider plugin that runs on the host (e.g. the Playnite sync plugin) can now reconcile cover art as an on-host FILE PATH instead of an inlined data URL. `GET /library` rewrites such local-file art into `/library/art/<id>/ <kind>` proxy URLs (the same relative-proxy shape Steam art already uses), and the art proxy serves the bytes from the stored path. Moonlight's /appasset proxy reads the local file too. This is what lets a large Playnite library sync with covers: the reconcile payload carries paths, not bytes, so it no longer blows past the mgmt API's request-body limit and scales to thousands of titles. Cross-platform; local-path detection is Windows-shaped (Playnite is Windows-only). Unit-tested (compiles + 5/5 art tests on Linux). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-19 00:53:40 +02:00
enricobuehler	9fe9c451dc	perf(pyrowave): pool encoder scratch buffers + fix client parser O(n²) — lift the 2.5 Gbps wall ... Real-world PyroWave streaming maxed ~2.5 Gbps with sagging fps while raw transport does 4.8. Root-caused to serial per-frame paths at BOTH ends (the transport was never the limit); this fixes the two dominant ones. Host (vendored shim, patch 0004): pyrowave_encoder_encode_gpu_synchronous allocated four Vulkan buffers (meta + bitstream, Device + CachedHost) on EVERY frame. At 240 fps with MB-scale bitstreams that per-frame allocator churn stalled the encode itself. Pool them on the encoder and reuse across frames (recreate only on a size grow); the sizes are session-fixed, so it is pure reuse after frame 1. On an RTX 4090 the 5120x1440 submit+fence-wait drops ~15 ms -> ~1 ms, i.e. the host serial ceiling goes 64 -> 1025 fps (444+HDR 44 -> 614). Safe under the synchronous encode model; re-validated by pyrowave_win_smoke (Windows) and pyrowave_smoke/_444 (Linux). Applies to both host encoder paths (they share the shim). Client (Apple Metal decoder): WaveletBitstream.parse reserved the payload buffer per packet (reserveCapacity(count + words), an exact realloc each of ~3000 packets/frame => O(n²)) and copied word-by-word. Reserve once up front and memcpy each packet's coefficients in one shot (all Apple platforms are little-endian, so the wire's LE u32s land verbatim; memcpy is alignment-free). 5.44 ms -> 0.055 ms per 1.44 MB frame (25x); byte-identical (parser unit tests + golden-frame PSNR unchanged). Also: - native.rs: PUNKTFUNK_PYROWAVE_MAX_MBPS caps PyroWave's open-loop Automatic bitrate pin for hosts on a constrained link (unset => no cap; an explicit client rate bypasses it). The pin is all-intra + ABR-off, so at a high pixel rate it can outrun the fabric (4:4:4+HDR 5120x1440@240 pins ~5.3 Gbps, over a 5 GbE link) and the overshoot just becomes loss. - pf-encode caps(): report the real opened chroma instead of a hardcoded 4:2:0 default, so a genuine 4:4:4 session no longer trips the spurious "encoder chroma disagrees with the negotiated Welcome" warn. Also fix a latent Windows reset() that rebuilt at 4:2:0 for a 4:4:4 session. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 19:09:23 +02:00
enricobuehler	b89dbfa979	feat(gamescope): end dedicated stream on Steam game exit + auto --steam ... Dedicated single-game sessions now end cleanly when the launched game quits, and Steam launches get gamescope's Steam integration without an operator env knob. End-on-exit: the existing APP_EXITED close only fired when gamescope's PipeWire node vanished, which never happens for Steam — the nested `steam` is the resident singleton client and stays up after a game quits, so gamescope (and its node) never die and the stream sat on a hidden Steam session forever. Add a Steam AppId reaper watcher (pf-vdisplay .../gamescope/discovery.rs): steam_appid_from_launch() parses steam://rungameid/<id>; wait_for_steam_game_exit() waits for the game to start (<=300s grace) then exit (3s confirm); steam_game_running() scans same-uid /proc for Steam's launch reaper matching both the `SteamLaunch` and `AppId=<id>` argv tokens (exact-match; reaper lifetime == game lifetime, so shader precompile can't false-trigger). The host spawns a pf1-gamewatch thread for nested Steam launches that closes the connection with APP_EXITED (launcher clients return to their library) and sets quit/stop; cancelled via stop if the session ends first. Non-Steam nested launches keep the node-death path (gamescope's child IS the game). Flags: auto-enable `--steam` whenever the launch is a Steam launch (was only the global PUNKTFUNK_GAMESCOPE_STEAM knob, default-off) — in-game overlay / Steam+X / gamepad-UI nav for Steam titles with no operator config. New opt-in PUNKTFUNK_GAMESCOPE_GRAB_CURSOR adds `--force-grab-cursor` for a real game launch (FPS mouselook); default OFF because it forces relative mode, which breaks absolute-pointer games/menus. Verified: fmt clean; clippy -D warnings clean on the three crates; pf-vdisplay 64/0 (incl. new steam-appid parse test); punktfunk-host builds + 186/0; reaper /proc detection smoke-tested (detect, exact non-match, gone-after-exit). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 16:24:34 +02:00
enricobuehler	5eb930e71d	feat(pyrowave): negotiation plumbing for 4:4:4 + HDR — thread chroma/depth/ColorInfo end to end ... Phase 1 of design/pyrowave-444-hdr.md. No behavior change yet: the handshake's 4:4:4 gate now admits PyroWave (probe = can_encode_444(codec), capture gate inherently satisfied — the wavelet path always ingests an RGB source and does its own CSC), but can_encode_444 stays false for PyroWave until the per-OS full-res-chroma CSC variants land (Phase 2 Linux, Phase 3 Windows), so every session still resolves 4:2:0/8-bit. - Both host encoders take the negotiated ChromaFormat (bail on 444 for now); the PUNKTFUNK_ENCODER=pyrowave lab override pins 4:2:0. - Bitrate: the automatic ~1.6 bpp pin resolves AFTER depth+chroma and scales x1.625 for 4:4:4 / x1.15 for 10-bit (factors from the Phase-0 fixture matrix); the mid-stream mode-switch re-resolve threads the session's values. - Client: PyroWaveDecoder builds its plane ring (full-res chroma when 444) and creates the upstream decoder from the negotiated chroma, keeps chroma fixed across mid-stream resizes, drops the even-dims requirement for 444, and returns the negotiated Welcome ColorInfo as the frame colour contract instead of hardcoded BT.709 (the wavelet bitstream has no VUI). Verified on .21 (RTX 5070 Ti): clippy -D warnings (host+client+encode), host 186 tests, client + pf-encode tests, fmt, and the pyrowave_smoke GPU round-trip through the patched vendored lib (97cf15e3). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-18 12:37:12 +02:00
enricobuehler	ebd9967547	feat(pyrowave): Windows host encoder — separate-plane zero-copy D3D11→Vulkan ... Wire PyroWave into the Windows host (design/pyrowave-windows-host-zerocopy.md). Before this a macOS client + Windows host that both selected PyroWave silently ran HEVC: the host never advertised CODEC_PYROWAVE and open_video_backend bailed. Approach (zero-copy, no GPU→CPU→GPU): pyrowave owns its own Vulkan device (create_device_by_compat, by render-GPU vendor/device-id — NOT LUID, invalid in Session 0). The capturer runs a BGRA→YUV BT.709-limited CSC (matching rgb2yuv.comp) into TWO SEPARATE shareable plane textures — full-res R8 Y + half-res R8G8 CbCr — which the encoder imports into pyrowave's device. Separate single/two-component textures import reliably on NVIDIA at any size; a single planar NV12 import does NOT (the vendored interop test: "only very specific resource sizes" — confirmed on-glass: 1024² fine, 720p/1080p/1440p garbage). A shared D3D11 fence, signalled after the CSC, is imported as a Vulkan timeline semaphore so the wavelet read is ordered after it. - pf-encode: enc/windows/pyrowave.rs (Encoder impl, two-plane import + Linux-style plane views); host_wire_caps advertises CODEC_PYROWAVE on Windows when the backend isn't Software; open_video_backend routes a negotiated PyroWave session first; pyrowave-sys on the Windows target; interop confirmed at open → clean HEVC fallback. - pf-encode: shared, unit-tested enc/pyrowave_wire.rs (single source of truth for the client-facing AU framing); Linux encoder uses it too. - pf-capture: dxgi.rs BgraToYuvPlanes CSC; idd_push.rs pyrowave mode — forces the virtual display SDR (the VideoProcessor can't ingest the FP16 HDR ring), a two-plane shareable out-ring, a shared fence passed every frame (so a rebuilt encoder re-imports it). Threaded via OutputFormat::pyrowave. - pf-frame: D3d11Frame::pyro carries the CbCr plane + fence; OutputFormat::pyrowave. Verified on .173 (RTX 4090): full-host build + clippy -D warnings (nvenc,amf-qsv) + fmt --all --check; pyrowave_wire unit tests; pyrowave_win_smoke GPU test round-trips distinct Y/Cb/Cr (100/180/60) exactly at 1024²/720p/1080p/1440p; Stage-0 interop validated in the real Session-0 service context on-glass. Deployed to the box. Owed: final on-glass picture/latency confirmation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 11:39:44 +02:00
enricobuehler	ec84b30eae	feat(plugins): console-hosted plugin UI surface (host registry + SDK servePluginUi + console proxy/nav) ... Implements planning/design/plugin-ui-surface.md (U1-U3): - host: in-memory lease-based plugin registry (mgmt/plugins.rs) — PUT/GET/DELETE /api/v1/plugins + GET /plugins/{id}/ui-credential; bearer+loopback only (not on the mTLS read-only allowlist); plugins.changed event; port-only registration (proxy always dials 127.0.0.1); secret never in the listing. - sdk: servePluginUi — loopback ephemeral bind + per-boot secret + constant-time check + /__health + static/SPA-fallback + register/renew(30s)/deregister via pf.request (skew-proof, D7). Example + tests. - console: /plugin-ui/{id}/** reverse proxy (server-side secret injection, cookie strip, SSE streaming, stale-secret 401-retry) + credential cache; BFF denylist for the credential endpoint; dynamic Plugins nav (desktop + mobile) fed by a polled list; iframe-in-shell page with health probe, offline card, open-in-tab, deep-link sync. Dev-mode /plugin-ui middleware in vite.config.ts. OpenAPI regen for the new endpoints follows in the next commit (built on Linux). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 09:48:37 +02:00
enricobuehler	bb755ef7d2	fix(gamestream): generate the RSA host identity via the rsa crate, not rcgen (ring can't RSA-keygen) ... The workspace went ring-only in 0.13.0 (aws-lc-sys breaks Windows CI), and `ring` can sign with an existing RSA key but cannot *generate* one — rcgen's ring backend returns `KeyGenerationUnavailable` for `generate_for(&PKCS_RSA_SHA256)`. So `ServerIdentity::{load_or_create, ephemeral}` panics with "rcgen RSA keygen / There is no support for generating keys for the given algorithm" on any host without an existing `cert.pem`. This is the shared trust root for both the GameStream TLS cert and the QUIC identity clients pin, so a *fresh* 0.13.0 install can't start the host at all (existing dev boxes survive only because they already have a cert on disk); in CI every test that builds a `ServerIdentity` (all of `mgmt::tests`, `gamestream::nvhttp`, and the `native::tests` synthetic host via `serve()`) failed — 30 failures from this one cause. Moonlight requires an RSA-2048 identity, so generate the key with the pure-Rust `rsa` crate (already a dependency for the pairing signer) and hand its PKCS#8 PEM to rcgen, whose ring backend *can* load and self-sign with an externally supplied RSA key (`from_pkcs8_pem_and_sign_algo` → `RsaKeyPair::from_pkcs8`). Return that same PEM so it stays byte-identical to what `from_pems` re-parses. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-18 01:59:28 +02:00
enricobuehler	11cca33300	fix(host/hooks): honor hand-edits to hooks.json without a restart ... docs/automation.md promises 'changes apply immediately, no restart' for BOTH config paths, but the store loaded hooks.json once (OnceLock) — only PUT /api/v1/hooks applied live, and a hand-edited file silently did nothing until the next host start. Since the file is the accessible path most users will take, make it real: get() re-stats the file per event (mtime + length) and re-reads it on change, with the same lenient contract as startup (missing = no hooks, invalid = disabled loudly). set() records the identity it wrote so the API path doesn't trigger a spurious reload. Validated live on the 0.13.0 host (.21): full connect/disconnect lifecycle fires exec hooks (client.*/session.*/stream.*) — the reload gap was found setting that test up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 23:53:25 +02:00
enricobuehler	17a262aace	fix(host/deps): ring-only crypto — drop aws-lc-sys (fails to build on the Windows CI) ... The Windows host clippy CI broke building aws-lc-sys 0.41.0 (a heavy C dep that cl.exe fails to compile on the runner). The host was the ONLY thing pulling it: its rcgen used features=["aws_lc_rs"], and bare `rustls`/`tokio-rustls` take the default (aws-lc-rs) backend, and gamestream/{mod,tls}.rs installed the aws_lc_rs crypto provider explicitly — a pre-existing deviation from the project's documented ring-only design (punktfunk-core + the client are ring). Align the host to ring: rcgen/rustls/tokio-rustls pinned to the `ring` feature (keeping tls12 for Moonlight/GameStream TLS-1.2 clients) and the two GameStream provider installs switched to `rustls::crypto::ring::default_provider()`. Both providers offer the same standard TLS 1.2/1.3 suites, so it's transparent to the TLS paths; aws-lc-sys/aws-lc-rs leave the tree entirely (`cargo tree -i aws-lc-sys` => no match). Not caused by the preceding log fix (that touched no crypto deps / the lock). Validated: cargo tree (aws-lc-sys gone, windows target, amf-qsv,qsv features) + .21 host clippy -D warnings (--features nvenc) clean. Owed: GameStream on-glass re-check with a real Moonlight client (low risk — same TLS suites, client is already ring).	2026-07-17 22:21:23 +02:00
enricobuehler	3584b47fb8	fix(host/log): drop the wasapi crate's once-a-second DEBUG device-poll from the logs ... The `wasapi` audio crate polls the default output device ~1×/s and `log::debug!`s it (`wasapi::api default device Ok(...)`), flooding host.log even at RUST_LOG=info: those `log`-crate records reach tracing through the tracing-log bridge, and at *filter* time they carry the bridge's "log" shim target, so neither a bare-info EnvFilter nor a `wasapi=warn` directive on the file layer matches them (the ring already drops them post-hoc via normalized_metadata + NOISY_DEBUG_TARGETS — the fmt layer filters pre-event and can't). Fix at the source: a shared `log_capture::install_global` replaces SubscriberInitExt::init in both init paths (service file log + interactive stderr) and inits the tracing-log bridge with `ignore_crate("wasapi")`, so the poll records are dropped before they ever become tracing events — both sinks go quiet, while every other log-crate dependency still reaches the console ring (bridge max-level stays DEBUG). `wasapi` also added to NOISY_DEBUG_TARGETS as belt-and-suspenders, and `log` moved dev-dep -> dep for LevelFilter. Validated: .21 clippy (host --features nvenc) clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 22:06:14 +02:00
enricobuehler	8e75f3d8bf	perf(latency): adaptive IDD pipeline depth — depth-1 default, escalate on contention ... From the 2026-07-17 on-glass finding (.173 RTX 4090): the IDD-push capturer's depth-2 pipeline measured ~13ms of glass-to-glass latency over depth-1 at 60fps (17ms → 4ms) — the AU is ready in µs but depth-2 holds it a whole frame interval unpolled while N+1 is submitted. Depth-2 only earns its keep under GPU contention (it overlaps the convert of N+1 with the encode of N, avoiding the depth-1 ~50fps collapse). So the native encode loop now runs depth-1 by default and escalates to the capturer's max ONLY when it can't hold cadence at depth-1 (a leaky-bucket over 'the frame's work overran its pacing deadline', with a startup warmup skip), then holds there for the session (no oscillation; de-escalation is a v2 item). PUNKTFUNK_IDD_ADAPTIVE=0 pins the capturer's full depth (pre-adaptive behaviour); no effect where the capturer's max is already 1 (every non-IDD backend). GameStream plane untouched. Pairs with the shipped REALTIME auto-gate (1bc156aa): uncontended sessions get the ~13ms latency cut, genuinely GPU-bound ones keep the depth-2 overlap AND the REALTIME priority. Validated: .21 clippy -D warnings (host --features nvenc). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 20:48:55 +02:00
enricobuehler	bbe4380b41	perf(latency): T1.1 frame-driven encode trigger + T1.4 time-based flush thresholds ... design/latency-reduction-2026-07.md tier 1, remaining halves: - T1.1: the native encode loop wakes on the capture's ACTUAL arrival instead of sampling at a free-running tick — deletes the sample-and-hold (~half a frame interval on average, a full one worst-case: ~8ms avg @60fps). New Capturer::supports_arrival_wait/wait_arrival pair (IDD-push waits its frame-ready event against the shared-header token; the PipeWire portal blocks its channel with a pending stash); backends without an arrival signal — and PUNKTFUNK_FRAME_DRIVEN=0 — keep the legacy tick bit-identically. A 0.9x-interval rate floor caps encode at ~1.11x target when the compositor outruns the session; a +0.5x-interval keepalive keeps static desktops re-encoding at 1.5x-interval cadence. Pacing deadlines re-anchor to the actual submit so they can't drift against the arrival clock. GameStream plane untouched. - T1.4: the jump-to-live detectors run on WALL-CLOCK now (STANDING_TIME / FLUSH_AFTER = 250ms) instead of 30-frame counts whose meaning scaled with fps (500ms @60 but 125ms @240 — and stretching further under T1.1's slower static-scene repeats). The queue trip also requires depth still >= high, so a hysteresis-band hover can't fire on elapsed time alone. Validated: .21 Linux 185 core + 177 host + pf-capture tests, clippy -D warnings; .133 Windows cargo check of pf-capture + punktfunk-host green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:31:49 +02:00
enricobuehler	aedee2a4e3	perf(latency): tier-0 attribution + tier-1 send-path levers from the latency plan ... design/latency-reduction-2026-07.md T0.1/T0.2/T1.2/T1.3: - T1.2 rate-capped front-loaded pacing: the paced overflow's budget is now min(0.9x slack, overflow wire time at ~3x the live encoder bitrate) (PUNKTFUNK_PACE_FACTOR, 0 = legacy deadline-only spread). A 300 KB-1 MB frame's tail leaves in ~2-5 ms instead of smearing across ~15 ms at 60 fps; GameStream schedule byte-identical (pins unchanged). - T1.3 data-first wire order: packetize emits every block's data shards before any parity (per-block parity pools keep all blocks' parity alive for the second pass), so lossless completion stops waiting behind the parity tail. EOF = last emitted packet; receiver already order-agnostic. - T0.1 staged 0xCF: HostTiming gains an append-extensible per-stage tail (queue/encode/pace us; seal+channel-wait derived as residual) - no cap bit needed, old peers read the 13-byte prefix. Joined client-side into Stats::host_{queue,encode,xfer,pace}_ms, the OSD detailed tier, and the probe's report. - T0.2 true on-glass present timing: VK_KHR_present_id/present_wait enabled when supported; a PresentTimer waiter thread resolves each present id to real visibility, replacing the submit-time display stamp (which undercounts by up to a refresh and hides a silent-FIFO standing queue). Validated on .21: core 185 + host 185 tests, pf-presenter 19, clippy -D warnings across all five touched crates; loss-harness recovery curve unchanged; C ABI harness round-trips. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 19:13:08 +02:00
enricobuehler	600693914f	fix(security): land the 2026-07 audit fixes — SSRF guards, roster lane, SYSTEM path hygiene ... The low/medium findings from the July host+Windows security review, as implemented in the audit session's working tree: - Webhooks and library-art fetches refuse loopback/link-local/metadata targets and no longer follow redirects (SSRF pivots from the privileged host process). - The paired-client rosters (/clients, /native/clients) move off the streaming-client auth lane — one paired device could enumerate every other device's name + fingerprint; only the bearer/loopback console keeps them. - Device-name sanitizing extends to bidi/format control characters (spoofable rendering) via the shared native_pairing::is_spoofy_char; stream-marker quoting uses the same set. - The SYSTEM service resolves powershell by its full System32 path — CreateProcess checks the launching EXE's own directory first, so a planted powershell.exe beside the host binary would have run as SYSTEM. - The pf-vdisplay driver's opt-in file log moves from world-writable C:\Users\Public to WUDFHost's own temp dir. - GameStream pairing sessions are single-use (removed whatever the outcome). - Uninstall also removes the pf_mouse driver-store entry (rider from the virtual-HID-mouse work). - openapi.json regenerated (hardened-config-dir doc wording). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 17:20:15 +02:00
enricobuehler	4d89dcd3d7	fix(audio/windows): explicit-endpoint capture, client-only playback, self-healing watchdog ... Root cause of the field report (Android client, Windows host: no audio until the user manually cycled Sound-output devices, then audio on BOTH PC and phone): the WASAPI loopback captured whatever the default render endpoint was at open time — not the wiring plan's chosen endpoint — the plan's IPolicyConfig default-set is warn-only and racy, and nothing reacted to mid-stream default-device changes. - Explicit-endpoint capture: the capture thread opens the plan's loopback_render by id, never "the default" (KEEP_DEFAULT preserves the old default-capturing behavior with the echo guard). - Client-only playback default: wiring_plan::plan(..., host_audio) prefers a silent sink (Steam Streaming Microphone render side — loopback-validated, silent on host) over real hardware, so stream audio plays on the client only; PUNKTFUNK_HOST_AUDIO=1 restores real-hw-first (audible on the host). The capture side auto-installs the Steam pair once per process when no silent sink exists; open() handshake timeout 3s -> 30s to cover it, and a handshake timeout now stops the detached thread (it used to run for the process lifetime with the default still parked). - Self-healing capture thread (wasapi_cap): outer capture_once loop (Assert|Follow) with a ~1s watchdog on the default render id. A user switch to a capturable endpoint is followed (their choice wins, audio on both); a switch to a dud (cable/SSS/mic target) re-asserts the plan; IPolicyConfig-denied converges to Follow instead of churning. Device errors reopen with 2s backoff; only the FIRST open failure is fatal. Zero-packets breadcrumb after 30s distinguishes broken-loopback from quiet-desktop. - Park/restore of the default playback device (audio_control): wire_now(set_playback) parks the default on the loopback sink only for the capture's lifetime (the mic pump passes false — it runs while the host is idle); crash marker audio-default.prev + recover_orphaned_default() at first wire; restore is skipped if the operator changed the default themselves. A mic-default hygiene pass keeps VB-Cable installs audible and never records the mic target as the restore target. - Session-end park_audio_capture(): Windows DROPS the capturer (thread join restores the default) instead of caching it; Linux keeps the parked PipeWire thread. Composes with the stream-sink idle() hook at all three park sites (idle is a no-op on Windows). Verified: Linux (.21) clippy -D warnings + 176 punktfunk-host tests green (incl. the new wiring-plan preference tests); Windows (.173) clippy with nvenc,amf-qsv --all-targets -D warnings green at this exact tree. On-glass winbox/Android validation still owed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 17:05:02 +02:00
enricobuehler	97c5778a36	merge(audio): land feat/linux-stream-sink — Linux host-owned stream sink ... Merges 44b71e74 (see its message for the full design: the "Punktfunk Stream Speaker" Audio/Sink claimed as the session's default output — the crackle root fix for hardware-sink churn — plus the core-error liveness fix and true 5.1/7.1 capture) across the W1–W8 refactor that landed since the branch forked: - punktfunk1.rs was split on main: the audio_thread idle()/drain() hunks are hand-ported into native/audio.rs (same three sites: reuse-drain comment, encoder-fail park, end-of-thread park). - pwinit moved to pf-capture (W6.2): the branch's crate::pwinit calls in pw_thread and stream_sink.rs become pf_capture::pwinit. - Kept main's log-tier demotions (stream-state + setup lines at debug) inside the restructured pw_thread. Resolution verified on Linux (home-worker-5): clippy -D warnings clean + 173 punktfunk-host tests green at the 691c064a-based equivalent ba5973a2; re-verified at this base before landing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 16:35:02 +02:00
enricobuehler	18a5d93ae3	fix(host): allow too_many_arguments on the two fns the v4 merge grew ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 16:09:57 +02:00
enricobuehler	09849906e9	Merge perf/first-frame-latency: driver proto v4 + first-frame/resize latency (P0-P2) ... Brings the first-frame-latency branch (P0.1 transition tracing, P1.1/P1.2 Welcome-time display prep, P2 in-place resize; pf-driver-proto v3 -> v4 with IOCTL_UPDATE_MODES) onto current main. The branch predates the W6.2/W7 splits, so git's rename detection carried most of it into the moved crates (pf-capture idd_push, pf-vdisplay manager/pf_vdisplay, pf-win-display, pf-driver-proto, the driver workspace) and the punktfunk1.rs remainder was re-homed by hand: - native/handshake.rs: welcome/start trace marks + the Welcome-time display prep spawn (the prep thread BECOMES the stream thread; hand-off via a SyncSender<SessionContext>). negotiate() gains bringup/quit/stop and returns the PrepHandle. - native.rs: bringup/resize_ms creation + the stop/quit flags hoisted BEFORE the handshake (the close watcher splits: flags pre-handshake, lifecycle events post-handshake where `hello` exists); punch_done stamp; the data plane adopts the prep thread's result or builds inline. - native/stream.rs: SessionContext/SendStats carry the trace; send_loop finishes it on the first video packet; the resize path gains the in-place fast path (try_inplace_resize) with the full rebuild as fallback, restructured so both share the post-rebuild bookkeeping; prepare_display/PreparedDisplay/ PrepHandle; build_pipeline(+retry) thread the stage marks. - session_status/mgmt: ttff_ms + last_resize_ms per session (union with the lifecycle-events fields main added to the same spots). - pf-capture: Capturer gains capture_target_id() + resize_output() defaults. - pf-vdisplay manager: perf's faster activation poll (60x50ms) + the settle floor before the PnP sweep, on main's knobs/no-trait shape. Also: packaging/windows/build-gamepad-drivers.ps1 is ASCII again (an em-dash from the pf-mouse work tripped windows-host.yml's locale-safety gate on main). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 16:08:16 +02:00
enricobuehler	2064c0780c	merge(core): reconcile the W7/W8 client refactor with origin's shared-clipboard feature ... origin/main landed the shared clipboard (design/clipboard-and-file-transfer.md) while this branch split quic/msgs.rs -> quic/{caps,control,...} and client.rs -> client/{mod,control,worker,pump,planes,...} (W7) and deleted the two monoliths. The feature had modified both deleted files, so its delta is re-applied onto the split instead of resurrecting the monoliths: - HOST_CAP_CLIPBOARD -> quic/caps.rs - MSG_CLIP_* / CLIP_* consts, the six Clip* structs, and their encode/decode impls -> quic/control.rs (beside the clock codecs) - CtrlRequest::{ClipControl,ClipOffer} + Negotiated.host_caps -> client/control.rs - WorkerArgs.{clip_event_tx,clip_cmd_rx} -> client/worker.rs - CLIP_EVENT_QUEUE -> client/planes.rs - NativeClient clip fields, the 7 clip_* / host_caps / next_clip methods, connect() channel wiring -> client/mod.rs - the control-task encode/decode arms and the clipboard-task spawn -> client/pump.rs Cargo.lock reconciled (adds pf-clipboard), punktfunk-host/Cargo.toml unions the W6 pf-* subsystem deps with pf-clipboard, and include/punktfunk_core.h is the cbindgen union (clipboard + rumble C-ABI). punktfunk-core builds --all-features and its 174 lib tests pass, including quic::tests::clip_loopback. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 15:38:11 +02:00
enricobuehler	391f8fb9f7	feat(clipboard): Linux + Windows host clipboard backends as the pf-clipboard crate (Phase 1 host + Phase 3) ... The host half of the shared clipboard (design/clipboard-and-file-transfer.md §4), ported from feat/shared-clipboard (6bd8c18b) into the post-W6 crate shape: the backends land as a pf-clipboard subsystem crate (the pf-inject/pf-capture pattern) instead of growing punktfunk-host back out, and the ~340-line punktfunk1.rs integration is re-implemented against the native.rs/control.rs split that replaced it. pf-clipboard: - host::wayland — ext-data-control-v1 (KWin / wlroots / Sway / Hyprland). - host::mutter — GNOME via Mutter's *direct* org.gnome.Mutter.RemoteDesktop clipboard (no data-control at any GNOME version; the xdg portal needs an interactive grant a headless host can't answer). - host::windows + host::winfmt — Win32 clipboard on a hidden message-loop window: WM_CLIPBOARDUPDATE listener + OLE delayed rendering (WM_RENDERFORMAT) for text / CF_HTML / RTF / PNG. - host::session — the backend-agnostic coordinator bridging HostClipboard to the QUIC clipboard plane (offers, fetch accept-loop, remote offers, pastes). - A portable facade (policy / enabled / cap_advertised / ClipCoordCmd / start / spawn_decline_loop) so the orchestrator compiles cfg-free on every platform; ClipCoordCmd moves into the crate (it was host-owned before). punktfunk-host glue: - handshake.rs advertises HOST_CAP_CLIPBOARD via pf_clipboard::cap_advertised. - serve_session starts the coordinator (gated on a real compositor — the synthetic source stays out of the session clipboard) and spawns the CLIP_FETCH_UNAVAILABLE decline loop when the policy is on but no backend bound. - control.rs gains the ClipControl/ClipOffer arms + the host-offer forward branch, and the e2e session test (cap advertise → ClipState ack with BACKEND_UNAVAILABLE → fetch decline) rides in native.rs's tests. Still opt-in default OFF (PUNKTFUNK_CLIPBOARD). Remaining: the macOS client (design §5) — then this becomes user-visible. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 13:02:20 +02:00
enricobuehler	27a5d8daac	refactor(host/W6.2): extract virtual-display orchestration into the pf-vdisplay crate ... vdisplay.rs + vdisplay/* (the per-compositor Linux backends — KWin zkde-screencast, wlroots swaymsg, Mutter RemoteDesktop, Hyprland — and the Windows IddCx/pf-vdisplay driver backend, behind one VirtualDisplay trait; the mode-conflict admission registry, the display policy/identity/custom-preset state, and the session-env / gamescope routing) move into crates/pf-vdisplay (plan §W6). The DDC/CI panel-power control (used only here) and the KWin zkde protocol XML move with it. This completes the host-crate decomposition: capture, encode, inject, and vdisplay are now four subsystem crates over the shared leaves, and punktfunk-host is the orchestrator (serve/supervisor + native + gamestream + mgmt). Coupling breaks (all down-only, cargo-tree acyclic): - capture::dxgi identity -> pf_frame::dxgi; win_display/monitor_devnode/ console_session_mismatch -> pf-win-display leaf; can_open_another_session -> pf-encode (the NVENC session-budget admission gate — acyclic peer edge). - The registry's DisplayCreated/DisplayReleased emits into the host SSE event bus invert to a leaf hook: pf-vdisplay emits a neutral DisplayEvent to a host-registered DISPLAY_EVENT_SINK, so it never reaches the orchestrator's events module. - The IddCx driver module is renamed pf_vdisplay -> driver (its old name collided with the crate name through the host's `mod vdisplay` shim glob). The host keeps `mod vdisplay { pub use pf_vdisplay::* }` so every crate::vdisplay::* path (serve/mgmt/native/the capture FrameChannelSender seam) is unchanged; the heavy deps (wayland/ashpd/tokio + the zkde protocol) moved with the crate. Co-authored: a fail-closed IOCTL-reply-length security fix (reject short/zeroed pf-vdisplay driver replies before trusting protocol_version/target_id/wudf_pid/luid, security-review 2026-07-17) rides this commit in the moved driver module. Verified: Linux clippy -D warnings (pf-vdisplay + host nvenc,vulkan-encode,pyrowave --all-targets) + pf-vdisplay 63/63 + host 167/167 tests; Windows clippy -D warnings (pf-vdisplay --all-targets + host nvenc,amf-qsv --all-targets) Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 12:14:08 +02:00
enricobuehler	f6c6e4e594	refactor(host/W6.2): extract the input-injection backends into the pf-inject crate ... inject.rs + inject/* (the per-OS injectors — wlroots virtual-input, KWin fake_input, libei/reis, gamescope-EI on Linux; SendInput on Windows — plus the virtual-gamepad HID stack: DualSense/DualShock4/Switch Pro/Steam Controller/Deck over uhid/usbip and the Windows UMDF drivers, the proto codecs, the injector service, and the uhid manager) move into crates/pf-inject behind the InputInjector trait (plan §W6). It consumes punktfunk_core::input (the neutral GamepadEvent/InputEvent vocabulary, moved to core in W5) + the pf-driver-proto wire contract, and reaches pf-capture only for the Windows gamepad-channel WUDFHost check + the resident-mouse compose-kick hook. The one inject->vdisplay coupling (the libei gamescope-EI backend needs the EIS relay socket path) is broken via a leaf: gamescope_ei_socket_file moves to pf-paths as the shared contract — the gamescope producer (host vdisplay) keeps its session-env-lock wrapper around it, the libei consumer (pf-inject) reads it directly post-retarget. The host keeps a `mod inject { pub use pf_inject::* }` shim so every crate::inject::* path (the native/gamestream input planes + devtest) is unchanged; the heavy input deps (wayland/reis/xkbcommon/usbip + the KWin fake-input protocol XML) moved with the crate. Verified: Linux clippy -D warnings (pf-inject + host nvenc,vulkan-encode,pyrowave --all-targets) + pf-inject 69/69 + host 230/230 tests; Windows clippy -D warnings (pf-inject --all-targets + host nvenc,amf-qsv --all-targets) Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 11:52:02 +02:00
enricobuehler	0992548de7	feat(host/windows): HID compose kick — wake and dirty the display through the virtual mouse (lid-closed first-frame fix) ... The final piece of the lid-closed field report (fixes 1-3: 3d9b3290; prerequisites: 85dd2bb0 pf-mouse, 845a9760 leaf primitives, 94ca4041 pf-capture hook): the IDD first-frame gate can only pass if DWM composes at least one frame, and a lid-closed/locked/idle machine is exactly the state Windows has decided not to compose in. The SendInput compose kick is conditional on this process's context — wrong session → wrong input queue; secure desktop → blocked; display powered off → no wake. A report from the resident pf-mouse HID device is REAL input to win32k: session-independent, secure-desktop-proof, wakes a powered-off display, counts as user presence. Parsec-class mechanism, and semantically honest — a remote user starting a stream IS a user arriving at this machine. - hid_kick(rect, bounds): newest-wins kick slot + condvar, serviced by the keeper thread that owns the ONE process-wide VirtualMouse (a second open() would squat the bootstrap mailbox). Not-ready (opt-out, driver missing, not yet attached) returns false → the capture crate falls back to SendInput. - perform_kick: park the pointer at the target display's center, dwell 35 ms (Stage-W3: DWM samples cursor position at the next vsync tick; the gaps also keep reports from coalescing in the driver's 8 ms timer), wiggle ~2 px, restore the saved position. Desktop→HID coordinates normalize against pf_win_display::desktop_bounds() (CCD union — correct from any session, unlike per-session GDI metrics). - ensure_resident registers the hook (pf_capture::HID_COMPOSE_KICK) — the one-way-edge inversion: pf-capture never reaches into inject. - keeper loop: condvar wait (250 ms tick) so a kick executes immediately, not at the next tick; publishes MOUSE_READY from driver_proto. Paired with pf-frame's DisplayWakeRequest (held by the capturer from before the first-frame gate): the power request keeps the display from going dark mid-session, the HID kick wakes it when it already is. Verified on winbox: combined-tree cargo check + clippy for punktfunk-host, pf-capture, pf-frame, pf-win-display all EXIT 0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 11:30:32 +02:00
enricobuehler	94ca4041ca	refactor(host/W6.2): extract the frame-capture backends into the pf-capture crate ... capture/linux (PipeWire portal) + capture/windows (IDD direct-push: dxgi mechanics, idd_push + submodules, synthetic_nv12) + pwinit move into crates/pf-capture behind the Capturer trait + synthetic sources (plan §W6). The crate speaks pf-frame (CapturedFrame/PixelFormat + the DXGI identity), pf-zerocopy (CUDA import), and the pf-win-display leaves, and NEVER pf-encode — the capture->encode edge is one-way. This completes the deliberate capture/encode crate split (the invasive path the plan had merged into one pf-media): capture and encode are now separate subsystem crates sharing only pf-frame. Four seams keep the capturer off the orchestrator: - VirtualOutput is EXPLODED into primitives (remote_fd/node_id/preferred_mode/ keepalive) by the host facade, so pf-capture never depends on the vdisplay type; - FrameChannelSender: the sealed-channel delivery is a Send+Sync closure the host facade builds from the pf-vdisplay control device + send_frame_channel IOCTL and hands in; ChannelBroker holds the closure instead of the control HANDLE (the whole-desktop handle-duplication security boundary is byte-for-byte unchanged); - console_session_mismatch + desktop_bounds live in pf-win-display (leaf peers); - pwinit moves here (audio caller -> pf_capture::pwinit). The host keeps capture.rs as a thin BRIDGE: it re-exports the vocabulary + capturer types (every crate::capture::* path is unchanged) and keeps open_portal_monitor / capture_virtual_output, which resolve the ZeroCopyPolicy + FrameChannelSender and call into pf-capture. verify_is_wudfhost + install_gpu_pref_hook are re-exported (the gamepad-channel bootstrap + the main.rs subcommand consume them). Co-developed: the resident-HID-mouse compose-kick hook (HID_COMPOSE_KICK + the HID-first cursor kick + _display_wake) rides this commit into pf-capture; the host mouse_windows registration side lands separately on top. Verified: Linux clippy -D warnings (pf-capture + host nvenc,vulkan-encode,pyrowave --all-targets) + host tests 299/299; Windows clippy -D warnings (pf-capture --all-targets + host nvenc,amf-qsv --all-targets) Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 11:28:56 +02:00
enricobuehler	85dd2bb077	feat(host/windows): resident virtual HID mouse (pf-mouse UMDF minidriver) ... Headless Windows hosts (no dongle) stream an INVISIBLE cursor: with no pointing device present win32k reports SM_MOUSEPRESENT=0 and DWM never composites a pointer into the pf-vdisplay frame, even though SendInput moves it. Keep ONE virtual HID mouse devnode alive for the host's lifetime — the Sunshine/Parsec-class fix, zero client changes. - pf-mouse: UMDF2 HID minidriver, one fixed identity (PF:MO 5046:4D4F, obviously virtual, nothing fingerprints it), one 8-byte input report (5 buttons + absolute 15-bit X/Y + wheel + AC-pan). Transport is the sealed pad channel verbatim (Global\pfmouse-boot-0 mailbox + unnamed MouseShm DATA section) so pf-umdf-util's audited layer serves it unchanged; report delivery is event-driven (idle = no HID traffic). - host: inject::mouse_windows — VirtualMouse (SwDeviceCreate'd devnode + channel), ensure_resident() keeper thread started by every InjectorService (process-wide, PUNKTFUNK_NO_VIRTUAL_MOUSE opts out), vmouse-spike on-glass validation (cursor sweep via HID reports). - proto: mouse module (magic, boot-name, identity, report layout, unit-tested input_report packing). - SwDeviceProfile grows container_tag so the mouse's ContainerId family (PFMO) never groups with a pad's (PFDS) in the Devices UI. - packaging: pf-mouse rides the gamepad-driver build + install pipeline (build-gamepad-drivers.ps1, windows-drivers.yml, driver install --gamepad picks up every staged .inf). On-glass validated on winbox: devnode + HID child bind, SM_MOUSEPRESENT=1 with no physical mouse, cursor sweeps via HID reports (vmouse-spike). This work was implemented in a parallel session; committed here as the build prerequisite for the HID compose kick that follows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 11:02:10 +02:00
enricobuehler	3d9b329084	fix(host): name the lid-closed/no-frames failure — display-write decode, console-session guard, driver-truth attach diagnostics ... Field report (Windows laptop, lid closed, Tailscale): v0.12.0's activation fix works — the pf-vdisplay target activates in ~200ms — but the session still dies at the first-frame gate: 'driver_status=1 but no frame published within 4s'. Triage showed three independent blind spots; this names all of them at their source instead of guessing downstream: - pf-win-display: decode ChangeDisplaySettingsExW failures (-1 FAILED — a display write rejected, the wrong/remote-session signature — vs -2 BADMODE, which the old 'mode not advertised?' text conflated), and WARN on every non-zero SetDisplayConfig rc in the CCD isolate even when verification passes vacuously (the lid-closed case: nothing else active, so the INFO swallowed rc=0x5 ERROR_ACCESS_DENIED while the load-bearing COMMIT_MODES → ASSIGN_SWAPCHAIN re-commit silently never applied). Access-denied rcs get the remedy appended (console session / installed service). - host: console-session guard (interactive::console_session_mismatch) — a host outside the active console session (a hand-launched host after an RDP round-trip) fails every display write, reads the wrong session's GDI view, and its SendInput compose kicks go nowhere. Named ERROR at vdisplay acquire + appended to the first-frame timeout, instead of the misleading generic failure. (The idd_push diagnosis half of this landed in 9a36ea21; this commit adds the proto helpers + session guard it references, healing the windows-cfg build.) - proto + driver: while OPENED, driver_status_detail now carries a live packed word (bit31 live-marker | offered 15-bit | mismatch-dropped 16-bit) maintained by the publisher, so the host's first-frame timeout can tell apart: never-attached (no swap-chain worker ran), attached-but-DWM-composed- zero-frames (undamaged/powered-off desktop, kicks blocked on the secure desktop), and composed-but-every-frame-mismatched (ring sized from a stale/ foreign-session GDI mode). Zero layout change, old drivers read as 'no detail'; unit-tested pack/unpack in pf-driver-proto. Verified on winbox: cargo check + clippy -p punktfunk-host -p pf-win-display -p pf-driver-proto EXIT 0, drivers ws cargo check -p pf-vdisplay EXIT 0 (Version_Number=10.0.26100.0), cargo fmt --all --check clean; pf-driver-proto tests 13/13 pass locally. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 10:47:47 +02:00
enricobuehler	9a36ea2132	refactor(host/W6.2): extract the video encode backends into the pf-encode crate ... encode.rs + encode/* (NVENC, VAAPI, native AMF, AMF/QSV ffmpeg, direct-SDK NVENC/CUDA, raw Vulkan-Video, PyroWave, openh264) move into crates/pf-encode behind one Encoder trait + open_video selector (plan §W6). The crate speaks the shared frame vocabulary (pf-frame: CapturedFrame/PixelFormat + the DXGI identity D3d11Frame/make_device) and pf-zerocopy (CUDA context/buffers), and NEVER pf-capture — the capture→encode edge is one-way (ZeroCopyPolicy, prior commit). Dep moves: the heavy encoder deps (ffmpeg-next, the NVENC SDK, openh264, pyrowave-sys) move from the host to pf-encode; the host's nvenc/amf-qsv/vulkan-encode/pyrowave features now FORWARD to pf-encode/*. The host keeps a mod-encode shim (pub use pf_encode) so every crate::encode::* path (negotiator + GameStream/native/mgmt planes) is unchanged. resolve_render_adapter_luid moves from the host's windows/win_adapter.rs into pf-gpu (both pf-encode and pf-capture need it as a peer of GPU selection); its 5 call sites (encode amf/nvenc, capture idd_push/synthetic_nv12, vdisplay manager) rewire to pf_gpu::resolve_render_adapter_luid and win_adapter.rs is deleted. pf-frame's make_device gains a # Safety section (public-unsafe-fn lint, latent since the pf-frame carve — a full-workspace -D warnings clippy catches it). Verified: Linux clippy -D warnings (pf-encode + host nvenc,vulkan-encode,pyrowave --all-targets) + 13/13 pf-encode + 299/299 host tests; Windows clippy -D warnings (pf-encode nvenc,amf-qsv --all-targets + host nvenc,amf-qsv --all-targets) Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 10:42:51 +02:00
enricobuehler	1de83ba51d	refactor(host/W6.2): make the Linux capture→encode edge one-way via ZeroCopyPolicy ... The PipeWire capture thread re-derived three encode-backend facts by calling encode::{linux_zero_copy_is_vaapi, resolved_backend_is_gpu, pyrowave_capture_modifiers} — a capture→encode back-reference that would force pf-capture to depend on pf-encode (and vice versa, since encode already speaks the frame vocabulary). Resolve them ONCE in the host capture facade (which may reach crate::encode) as a ZeroCopyPolicy { backend_is_vaapi, backend_is_gpu, pyrowave_modifiers } and thread it into PortalCapturer::open / from_virtual_output → spawn_pipewire → pipewire_thread. capture/linux/mod.rs now makes ZERO crate::encode calls — the edge is one-way (plan §2.4 / §W6), so pf-capture can be extracted depending only on pf-frame (not pf-encode). pyrowave_modifiers is computed by the facade whenever the encoder pref is pyrowave (which implies the VAAPI backend); the thread still consumes them only inside its existing vaapi_passthrough guard, so behavior is unchanged. Verified: Linux clippy -D warnings (host nvenc,vulkan-encode,pyrowave --all-targets); Windows clippy nvenc,amf-qsv --all-targets Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 10:20:17 +02:00
enricobuehler	ccc4b08d45	refactor(host/W6.2): extract the Windows display-topology cluster into the pf-win-display leaf crate ... windows/{win_display,monitor_devnode,display_events}.rs move into crates/pf-win-display: the CCD/GDI path-activation + mode-set + HDR advanced-colour + source-rect helpers, the PnP monitor-devnode enable/disable lever, and the WM_DISPLAYCHANGE / device-arrival watch. The coming pf-capture crate's IDD-push capturer consumes all three; the host's pf-vdisplay backend consumes win_display + monitor_devnode. A leaf lets both depend on them as a PEER instead of the capturer reaching back into the orchestrator (plan §W6). win_display's one external tie (crate::vdisplay::Mode) becomes the underlying punktfunk_core::Mode; the cluster is otherwise self-contained (pf-paths for the state file, serde_json for it, windows). pub(crate) items bump to pub at the boundary; win_display carries a module-level allow(missing_safety_doc) to keep the pre-carve behavior (the FFI helpers were pub(crate) unsafe fn with prose safety docs — the lint only fires once they're pub, and this is an internal publish=false leaf). The host imports the three modules at its crate root, so every crate::{win_display,monitor_devnode,display_events}::* path is unchanged. Verified: Linux clippy -D warnings (leaf empty + host nvenc,vulkan-encode,pyrowave --all-targets); Windows clippy -D warnings (pf-win-display --all-targets + host nvenc,amf-qsv --all-targets) Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 10:14:17 +02:00
enricobuehler	b168790e0a	refactor(host/W6.2): extract the shared frame/format vocabulary into the pf-frame leaf crate ... The captured-frame types both capture (producer) and encode (consumer) speak — PixelFormat, OutputFormat, CursorOverlay, CapturedFrame, FramePayload, DmabufFrame, drm_fourcc — move into crates/pf-frame, alongside the small pure helpers that ride the same seam: hdr (HDR static metadata / in-band SEI), metronome (the metronomic-stall detector), thread_qos (per-thread scheduling QoS), session_tuning (Windows process tuning), and the Windows DXGI capture IDENTITY (WinCaptureTarget, D3d11Frame, pack_luid, make_device + the GPU scheduling-priority hardening it applies) (plan §W6). This is the crate that breaks the capture<->encode cycle: FramePayload's GPU variants own their backends from BELOW (Cuda -> pf_zerocopy::DeviceBuffer, D3d11 -> dxgi::D3d11Frame), so encode can speak the vocabulary without a path to capture, and vice versa. The Windows DXGI identity moving here lets capture, encode, and pf-vdisplay share ONE WinCaptureTarget/device factory instead of the old capture<->encode<->vdisplay reach-in. The host keeps thin facades: capture.rs re-exports the vocabulary (crate::capture::{PixelFormat,…} unchanged); capture/windows/dxgi.rs keeps the win32u GPU-preference hook + HDR/video-engine converters + self-test and re-exports the identity; native.rs re-exports boost_thread_priority from pf_frame. crate::hdr/metronome/session_tuning callers rewired to pf_frame::*. metronome's Metronome::new gained a Default impl (new_without_default fires once the type is public across the crate boundary). Verified: Linux clippy -D warnings (pf-frame --all-targets + host nvenc,vulkan-encode,pyrowave --all-targets) + 9/9 pf-frame tests; Windows clippy nvenc,amf-qsv --all-targets Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 10:03:56 +02:00
enricobuehler	85bc5b9a3f	refactor(host/W6.2): extract the Linux zero-copy GPU plumbing into the pf-zerocopy leaf crate ... linux/zerocopy/* (CUDA context/buffers + EGL/Vulkan dmabuf import + the isolated import worker) and linux/dmabuf_fence.rs move wholesale into crates/pf-zerocopy, so the coming pf-frame vocabulary crate (FramePayload::Cuda owns a DeviceBuffer) and the pf-encode/pf-capture subsystem crates can reach the GPU plumbing without the host orchestrator in between (plan §W6). Content stays Linux-only; the crate compiles to an empty lib elsewhere, so dependents carry a plain dependency. drm_fourcc deliberately does NOT move: it consumes the frame vocabulary (PixelFormat), which sits ABOVE pf-zerocopy — it lives with capture for now and moves into pf-frame next. cuda's ffi re-export bumps pub(crate)->pub (the raw CUdeviceptr vocabulary is consumed across the crate boundary by the encode backends). A crate::zerocopy shim module keeps every existing path valid until capture/encode themselves move out. Verified: Linux clippy -D warnings (pf-zerocopy --all-targets + host nvenc,vulkan-encode,pyrowave --all-targets) + 17/17 pf-zerocopy tests + 321/321 host tests; Windows clippy nvenc,amf-qsv --all-targets Finished exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 09:41:15 +02:00
enricobuehler	6ea036766a	refactor(host/W6.1): extract GPU vendor/adapter detection into the pf-gpu leaf crate ... Fourth de-coupling for the host crate carve (plan §W6.1 leaf). gpu.rs (inventory, selection preference, active-session accounting — deps only pf-host-config + pf-paths, no subsystem refs) moves to a new pf-gpu leaf so pf-encode/pf-capture/pf-vdisplay can consult the selected GPU without an orchestrator edge. ~50 crate::gpu:: sites repoint to pf_gpu::; the ~30 pub(crate) items become pub (crate API). assign_ids gets a macOS-only allow(dead_code) (used only by the Linux/Windows enumerate arms). Verified: Linux (home-worker-5) clippy -p pf-gpu -p punktfunk-host --all-targets -D warnings + pf-gpu tests (12 pass); Windows (192.168.1.158) clippy --features nvenc,amf-qsv --all-targets green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 09:00:53 +02:00
enricobuehler	3495d189e1	refactor(host/W6.1): extract the config() global into the pf-host-config leaf crate ... Third de-coupling for the host crate carve (plan §W6.1 leaf). HostConfig + the config() OnceLock (config.rs, pure std, zero deps) move to a new pf-host-config leaf so every subsystem crate (pf-encode/pf-capture/pf-vdisplay/pf-gpu) can read process config WITHOUT depending on the orchestrator. 34 crate::config::config() call sites across 19 files repoint to pf_host_config::config(). thread_qos stays in the host for now (it calls session_tuning::on_hot_thread — its own leaf-ification rides the encode carve). Granular-crate decision (supersedes the plan's single pf-media): split capture/encode/ vdisplay into separate crates rather than one broad crate — the capture↔encode cycle is broken by a shared frame-types leaf, and vdisplay→encode (can_open_another_session) is a legal one-way edge since encode never references vdisplay. Verified: Linux (home-worker-5) clippy -p pf-host-config -p punktfunk-host --all-targets -D warnings; Windows (192.168.1.158) clippy --features nvenc,amf-qsv --all-targets green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 08:54:47 +02:00
enricobuehler	c42ce88921	refactor(host/W6.1): extract secret/config-dir helpers into the pf-paths leaf crate ... Second de-coupling for the host crate carve (plan §W6.1 leaf). config_dir / create_private_dir / write_secret_file (+ the Windows DACL helpers) were pub(crate) in the gamestream junk drawer, yet consumed by vdisplay, stats, gpu, library, mgmt_token, native_pairing and the Windows service — many of which become pf-media / pf-vdisplay, for which crate::gamestream would be an illegal upward edge. New leaf crate pf-paths (pure std + tracing) owns them; ~40 call sites across 14 files repoint to pf_paths::. gamestream keeps only its own concerns. Verified: Linux (home-worker-5) clippy -p pf-paths -p punktfunk-host --all-targets -D warnings + tests (347 pass, incl. secrets_are_written_owner_only); Windows (192.168.1.158) clippy --features nvenc,amf-qsv --all-targets green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 01:07:26 +02:00
enricobuehler	2e3208f75e	refactor(host/W6.0): drop gamestream BTN_* aliases; injectors read core directly ... Finishes the gamepad-vocabulary un-coupling (plan §W6.0): the Linux uinput button map now names BTN_* straight from punktfunk_core::input::gamepad instead of the crate::gamestream re-export aliases, so pf-inject will carry no edge into the gamestream junk drawer for gamepad constants. Removes the now-dead alias block; the wire-bit pinning test (gamepad_wire_bits_are_pinned) pins core directly (equally strong — core is the single source). gamestream keeps only the decode path, which imports the types from core. Verified: Linux (home-worker-5) clippy --all-targets -D warnings + gamepad tests green; Windows (192.168.1.158) clippy -p punktfunk-host --features nvenc,amf-qsv --all-targets green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 00:55:44 +02:00
enricobuehler	47587827ec	refactor(host/W6.0): hoist GamepadEvent/GamepadFrame to punktfunk_core::input ... First de-coupling for the host crate carve (plan §W6.0 / §2.4): the GameStream (Moonlight-plane) decoded controller types were defined in gamestream/gamepad.rs — the "junk drawer" — yet consumed 18× by the platform-neutral input injectors AND by the Moonlight decode path. Once inject becomes pf-inject, reaching them via crate::gamestream would be an illegal upward edge. Move the two types to core::input (below both planes; inject already depends on core) and repoint every consumer. Also consolidate the duplicated MAX_PADS onto the existing core::input::MAX_PADS. The gamestream BTN_* const aliases stay for now (separate follow-up); decode()/rumble/tests remain in the Moonlight plane, now importing the types from core. Verified: Linux (home-worker-5) clippy -p punktfunk-core -p punktfunk-host --all-targets -D warnings + gamepad tests green; Windows (192.168.1.158) clippy -p punktfunk-host --features nvenc,amf-qsv --all-targets green (the inject/windows/* consumers compile). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 00:49:38 +02:00
enricobuehler	f2a58f3a91	feat(host/library): external provider API — declarative reconcile (M4) ... External game-library providers become first-class (RFC §8): a plugin computes its desired title list and PUTs it — the host owns the diff. - CustomEntry gains `provider` + `external_id` (API-set only; never on manual entries). GameEntry surfaces `provider` for console attribution and the new `GET /library?provider=` filter. - PUT /api/v1/library/provider/{p}: atomic declarative reconcile keyed on the provider's `external_id` — host ids stay stable across syncs, orphans drop, manual entries and other providers are never touched, an empty array clears the set. Validated: provider id [a-z0-9._-] (`manual` reserved), unique non-empty external_ids. - DELETE /api/v1/library/provider/{p}: clean uninstall, returns the removed count. - Ownership is unambiguous both ways: manual CRUD now returns 409 for a provider-owned entry (MutateOutcome::ProviderOwned) instead of letting an edit be silently clobbered at the next sync. - library.changed now carries the mutating source (`manual` or the provider id) — hooks and the SDK filter on it. - Spec + SDK schemas regenerated; sdk/examples/provider-sync.ts is the provider-plugin skeleton. 347 host tests green (pure reconcile: stable ids, orphan drop, idempotence, bystanders untouched; name/payload validation; route 400s) + 11 SDK tests. Live-verified end to end THROUGH the SDK against a real host: sync → filtered list → manual-delete 409 → re-sync with stable id + orphan drop → uninstall (removed=2), with three library.changed(source=romm) events observed on the live stream. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-17 00:33:42 +02:00
enricobuehler	aaa3dcec32	refactor(host/W4): make the capture→encode edge one-way (OutputFormat back-ref) ... The capture.rs facade no longer re-derives the encode backend. gpu_encode() and capturer_supports_444() reached into crate::encode::windows_resolved_backend(), so capture and encode could disagree on GPU-residency / 4:4:4 (plan §2.4). Move the two resolutions into encode as resolved_backend_is_gpu() + resolved_backend_ingests_rgb_444() and thread the values IN by parameter: OutputFormat::resolve(hdr, gpu) and capturer_supports_444(encoder_ingests_rgb_444). Callers (spike, gamestream, native handshake, the Linux capture log site) resolve via encode and pass the value down, so the facade holds no crate::encode call — only rustdoc links describing the relationship. Completes task #8 of W4. Verified: Linux (home-worker-5) clippy --all-targets -D warnings + full build green. Windows (.173) verify owed — box was offline this session. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-16 23:59:41 +02:00
enricobuehler	991d28909b	refactor(host/W4): carve the off-thread InjectorService out of the inject facade ... Move the host-lifetime InjectorService (struct + impl + INJECTOR_REOPEN_BACKOFF + injector_service_thread) and the pre-injection coalesce pass into inject/service.rs, alongside the coalesce unit tests. libei_ei_source stays in the facade as an open() helper. Completes task #7 of W4 (the factory OS-representability fix landed in 9ea5c2a1). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-16 23:42:32 +02:00