10 Commits

Include renames

Author	SHA1	Message	Date
enricobuehlerandClaude Fable 5	a420855b5a	feat(tray): the Windows tray dresses for Windows 11 and announces connects ... The menu was a stock Win32 popup: light-mode on a dark taskbar, DPI-virtualized (blurry on every scaled laptop), no icons. Now the process opts into the system dark mode via the uxtheme ordinals (135/136 - the same undocumented calls Explorer/PowerToys/Notepad++ make; menus never got a documented opt-in, and there is no WinUI tray API to move to), a PerMonitorV2 manifest makes menu and icon crisp, the multi-size .ico serves the DPI-correct frame, and items carry Segoe Fluent glyph bitmaps - with the UAC shield on the elevated service actions, per Explorer's convention. Rounded corners come free on Windows 11. Everything degrades gracefully: missing ordinals mean the classic light menu, a missing icon font means no glyphs. New: a connect toast on the idle-to-streaming edge - title "<device> connected" (from the summary's new client_name), body the mode ("Streaming 2560x1440 @ 120 fps") - via NIF_INFO, which Windows 11 renders as a native toast. The tray tags itself with the AUMID unom.punktfunk.tray and the installer registers it under Classes\AppUserModelId (DisplayName "Punktfunk" + the brand icon), so the toast is attributed to Punktfunk with the logo. Unregistered dev runs degrade to generic attribution, older hosts to a nameless title; a tray started mid-session never fires a stale toast. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-29 21:32:50 +02:00
enricobuehler	8a5a5edc37	fix(small crates): the proof lint now covers every first-party crate but one ... Six crates were still unguarded, and all six are OURS — none vendored: pf-console-ui, pf-gpu, punktfunk-tray, clients/windows, tools/display-disturb, wdk-probe. Two of them ship (the tray and the Windows client), so "small" was about item count, not exposure. Five are closed here. Only 17 of their 75 unsafe items actually lacked a proof — pf-gpu, punktfunk-tray and display-disturb were already fully documented and needed nothing but the deny, which is the good case: the convention was being followed, just not enforced. The 17 that were missing are the usual Win32/COM shapes, and two were worth stating properly. `clients/windows`'s `GetCurrentPackageFullName` is called with `len = 0` and no buffer — that is the documented identity PROBE, which writes nothing, and reading it as a normal query would be a mistake. `pf-console-ui`'s two `destroy_image_view` calls are the load-bearing ones: the comment above one already argued that in-flight sampling of that slot ended two presents ago (the ring alternates and the presenter waits its fence before each record), which is exactly the kind of reasoning a `// SAFETY:` should carry and it was sitting there unlabelled. Also fixes a real Windows-only clippy error this uncovered: `pf-gpu` had a `#[cfg(target_os = "windows")]` fn AFTER its `mod tests`, tripping `items_after_test_module`. It never fired on Linux (the item does not exist there) and no CI job clippies pf-gpu on Windows, so it sat unseen. Moved above the test module. Remaining: `wdk-probe` (26 items) alone, and only because it needs the WDK to build — .47 cannot, so nothing here can verify a deny on it. Verified: Linux .21 fmt + both CI clippy steps rc=0; Windows .47 the four Windows-relevant crates at `-D warnings` rc=0.	2026-07-29 08:48:42 +02:00
enricobuehlerandClaude Opus 5	3e7828522d	fix(tray): drop the conflicting-host warning — the tray is the wrong place for it ... The tray led its tooltip with "⚠ conflicting host: Sunshine" and (on Linux) went NeedsAttention for a Sunshine that was merely *installed* — never started, never listening, harmless. An always-on warning over a dormant package is a false alarm on every poll, and the tray is the wrong surface for a one-shot install-time observation anyway. Removes the `conflicts` field from the tray's `Summary`, the tooltip prefix, `has_conflicts()`, and the ksni attention branch that fed on it. The host still detects and reports conflicts where that belongs — the startup `punktfunk::detect` warning, the `detect-conflicts` subcommand, and the `/api/v1/local/summary` field, which the tray must (and does, per the new test) keep tolerating on the wire. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-25 20:53:44 +02:00
enricobuehlerandClaude Opus 5	d49f1bba49	fix(tray): count native sessions as streaming, and stop hiding "Open web console" ... The tray sat at "Idle" through an entire stream, and its Windows context menu could come up without its main action. Two separate causes. `GET /api/v1/local/summary` reported `video_streaming`/`audio_streaming` straight from `AppState.streaming` — flags only the GameStream media pipeline raises. The native punktfunk/1 plane is the DEFAULT (GameStream is opt-in) and never touches them, so every native session read as idle: idle icon, and a tooltip that printed that session's own resolution next to the word "idle" (the `session` field was already native-aware). This is the blind spot `/status` was fixed for — see the `session_status` module doc — which the summary kept. Both flags now OR in a live native session, and the tray additionally treats a reported session as streaming, so a new tray reads an older host correctly too. The menu built "Open web console" (and the pairing entry) only while a live loopback probe of the console had just succeeded. A console still starting, or an SSR render slower than the 2 s probe timeout, therefore deleted the tray's most-wanted action outright — indistinguishable from a tray that never had one, with left-clicking the icon as the only, undiscoverable, way in. The entry is now always present and the default item; a failed probe changes its label to "(not responding)" instead of hiding it, and takes two consecutive misses to say so, since one timeout is not "down". While here: a "Release kept display…" entry when displays are held (the summary field's own doc promised a one-click release that did not exist), and entries deep-link to /pairing and /displays instead of all landing on the dashboard. The Linux SNI menu mirrors all of it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-25 00:46:30 +02:00
enricobuehlerandClaude Opus 4.8	393b47a062	fix(tray): allow has_conflicts on non-Linux (Windows -D warnings dead-code) ... has_conflicts drives the Linux ksni backend's NeedsAttention state; the Windows tray surfaces the same conflict through the tooltip headline() (it has no distinct attention icon) and never calls the boolean, so `cargo clippy -p punktfunk-tray -- -D warnings` failed dead-code on Windows (windows-host.yml). Scope the allow to non-Linux rather than gate the shared API out. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-16 20:45:22 +02:00
enricobuehlerandClaude Opus 4.8	571e22bc0f	refactor(core): consolidate the fingerprint-pinning verifier into core::tls ... Per plan §2.5: the security-critical rustls fingerprint-pinning ServerCertVerifier was hand-rolled three times — quic/endpoint.rs (PinVerify), pf-client-core library.rs, punktfunk-tray status.rs — drifting copies on a trust boundary. Add one canonical punktfunk_core::tls::PinVerify (+ cert_fingerprint) behind a light `tls` feature (rustls + sha2 only, no QUIC runtime); `quic` now depends on it, and quic::endpoint re-exports cert_fingerprint so that path stays byte-stable (gamestream + pf-client-core reach it there). - core::tls::PinVerify: new(pin) for the HTTP clients, with_observed(pin, slot) for the QUIC TOFU connect. Behavior-identical to all three originals (pin-check + real CertificateVerify signature verification; only hashes the leaf when a pin or observed slot needs it). Two focused unit tests anchor the boundary. - quic/endpoint.rs: drop the private PinVerify, wire client_pinned through tls::PinVerify::with_observed. - pf-client-core library.rs + tray status.rs: use the shared verifier; tray also routes load_pin through core cert_fingerprint and drops its direct sha2 dep, gaining only the light core `tls` feature (still no host dep, no QUIC runtime). Verified on Linux (home-worker-5): clippy 0/0 for core(quic), core(tls), pf-client-core, tray, host(nvenc,vulkan-encode,pyrowave); core 153 lib tests + loopback 7/7 (pinned handshake) + c_abi round-trip green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-16 15:36:29 +02:00
enricobuehlerandClaude Fable 5	11045a0f70	chore: consolidate parallel-session WIP (HOLD — do not push) ... Local snapshot of intermingled in-flight work, committed to unblock the encode refactor (a clean ffmpeg_win.rs for the vbv-dedup follow-on). These hunks span the same files and can't be cleanly split here; the commit bundles three distinct workstreams that each belong in their own PR: - logging rework (~43 files: level re-tiering, structured fields, `?e`, hot-path flood latches) - conflicting-host detection (detect.rs + detect/{linux,windows}.rs + wiring in main.rs/mgmt.rs/Cargo.toml/docs/packaging) - standby-sink DWM-stall attribution (windows/display_events.rs + capture/ vdisplay wiring) NOT verified as a combination. NOT to be pushed until the refactor is done and these are re-verified and reorganized into their proper per-workstream PRs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-16 12:42:53 +02:00
enricobuehlerandClaude Opus 4.8	6bebe238fc	feat(tray): surface kept virtual displays in the tray tooltip ... Stage 8 polish. `GET /api/v1/local/summary` (the tray's loopback-only unauthenticated status source) gains `kept_displays` — the count of lingering/pinned virtual displays (held with no live session), over the already-validated `registry::snapshot()`. The tray shows it in the idle tooltip ("idle · 1 display kept"), so a user knows a display — and, under exclusive topology, their physical monitors — is being held (e.g. a gaming-rig `forever` pin). Release stays via the console: a state-changing release can't be an unauthenticated endpoint, and the non-elevated Windows tray can't read the SYSTEM-DACL'd mgmt token, so a tray release button isn't cleanly cross-platform. `#[serde(default)]` on the tray side keeps it compatible with an older host. Tray tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 17:54:44 +00:00
enricobuehlerandClaude Fable 5	6dd0a0edda	fix(tray): live-probe the web console instead of sniffing the install layout ... The "Open web console" entry was gated on {exe dir}\web\web-run.cmd (Windows) / the punktfunk-web unit file (Linux) — which misses consoles run from a repo checkout (the RTX box, caught on-glass) and shows a dead entry while an installed console is stopped. The poller now probes https://127.0.0.1:<web port>/ each cycle (any HTTP response = up, transport failure = down) and the menu follows live on both platforms. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 12:17:01 +00:00
enricobuehlerandClaude Fable 5	ebada804b6	feat(tray): system-tray status icon for the host (Windows + Linux) ... New crates/punktfunk-tray — a small per-user companion showing the host service state at a glance (running / stopped / starting / degraded / failed + the live session in the tooltip) with one-click actions: open web console, approve a pending pairing request, start/stop/restart, open logs. No more digging through logs to learn whether the service came back after a reboot or an update. Status is service-manager-FIRST (SCM / systemd user unit — a port squatter can never fake Running), then the new loopback-only unauthenticated GET /api/v1/local/summary (counts/booleans only; the mgmt token and cert.pem are SYSTEM/Admins-DACL'd on Windows, so a non-elevated tray cannot bearer-auth). Windows: windows_subsystem binary (a console exe in the Run key would flash a terminal at sign-in), Shell_NotifyIcon + hidden window, per-session single instance, TaskbarCreated re-add, --quit for the uninstaller; service actions elevate per click via ShellExecuteW "runas" onto the new `punktfunk-host service restart` (stop → wait Stopped → start). Linux: ksni/StatusNotifierItem over zbus, systemctl --user actions (no polkit), /etc/xdg/autostart entry whose --autostart self-gates to actual host users. Icons: scripts/gen-tray-icons.py (pure stdlib) renders the brand lens + status dot into committed .ico/hicolor assets; deb/rpm/arch ship binary+autostart+icons. Live-validated: Linux on the headless KDE session (SNI registration, state transitions, menu-driven start, dbusmenu layout); Windows on the RTX box (session-1 launch with no NIM_ADD failure, single instance, --quit, restart round-trip, summary loopback-200/LAN-401). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 12:09:35 +00:00