938 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
enricobuehler	d23bd9b0cf	fix(vdisplay/windows): DISPLAYCONFIG_PATH_SOURCE_INFO union field access ... modeInfoIdx lives in the Anonymous union (windows-rs), not directly on sourceInfo — set_virtual_primary_ccd now reads .Anonymous.modeInfoIdx. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 09:27:07 +00:00
enricobuehler	eda7cac78e	feat(vdisplay/windows): topology=primary — keep physicals active, virtual primary ... Implements the deferred Windows primary-only CCD (Stage 2). set_virtual_primary_ccd repositions the virtual output's source to (0,0) = primary and shifts the physical display(s) to its right, ALL kept active — one atomic CCD SetDisplayConfig (not GDI CDS_SET_PRIMARY, which storms MODE_CHANGE_IN_PROGRESS with another display live). The manager's should_isolate() becomes topology_action() (3-way): extend (skip), primary (set_virtual_primary_ccd), exclusive (isolate_displays_ccd). Restore-on-teardown covers both. Validates the user's two scenarios on a physical-monitor .173. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 09:17:41 +00:00
enricobuehler	d73951414c	feat(vdisplay): KWin per-slot output naming for persistent scaling (Stage 3) ... The KWin backend names its output Virtual-punktfunk-<id> from the client's stable identity slot, so KWin persists per-output config (scale/mode) by name in kwinoutputconfig.json and reapplies that client's scaling on reconnect — the KDE scaling ask. Also fixes the latent clash where two concurrent sessions both used Virtual-punktfunk (topology name-matching now uses the per-slot name). - identity::global() + resolve_slot(fp, mode, default) — the shared persisted map (Windows manager dropped its own field; both use the global — never same-process). Default identity is per-platform: PerClient on Windows, Shared on Linux, so unconfigured hosts keep today's behavior (Linux = single 'punktfunk' name). - KwinDisplay carries the client fp (set_client_identity), computes the per-slot name, threads it through the stream_virtual_output name + the topology helpers (set_custom_refresh / apply_virtual_primary[_only] / other_enabled_outputs). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 08:54:39 +00:00
enricobuehler	b150d79626	feat(vdisplay): platform-neutral identity map + per-client-mode (Stage 3) ... Generalize the Windows-only per-client stable-id map into vdisplay/identity.rs: - DisplayIdentityMap keyed on a composable string (identity_key: fingerprint, or fingerprint+resolution under per-client-mode); LRU at 15, persisted to display-identity.json (migrated from the legacy pf-vdisplay-identity.json). - Windows manager wired to it, picking the key from the identity policy. - Foundation for KWin per-slot output naming (persistent KDE scaling) — the KWin wiring is the next Stage-3 step (needs a KWin box). - Unit-tested (stable, per-client-mode split, LRU, key composition). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 08:40:18 +00:00
enricobuehler	cb7ddc0411	feat(vdisplay): topology decoupling — distinct primary level (Stage 2) ... The three topology levels become distinct behaviors (Stage 0 only did extend-vs-exclusive, faking primary): - vdisplay::effective_topology() -> the concrete level (console policy > legacy *_VIRTUAL_PRIMARY env > Auto default). Backends read it directly at create time; apply_session_env no longer writes the boolean env (one fewer connect- path env mutation). - Mutter: extend (no config), primary (virtual primary + physicals kept as secondaries — build_primary_keeping_physicals), exclusive (sole, physicals disabled). KWin: extend (no-op), primary (kscreen primary only), exclusive (primary + disable others). - Windows should_isolate treats primary as isolate (the primary-only CCD variant is a follow-up); wlroots exclusive + the physical-keep effect need a display-attached box (headless lab boxes can't observe primary vs exclusive). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 00:18:46 +00:00
enricobuehler	60816709c4	fix(vdisplay): call life.acquire() outside debug_assert (release no-op) ... The pooled entry's lifecycle transition was inside debug_assert_eq!, whose arguments don't evaluate in release builds — so acquire() never ran, the entry stayed Idle, and release saw Noop → immediate teardown (no keep-alive). Caught on-glass on the CachyOS box. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 23:45:36 +00:00
enricobuehler	783c52dfad	feat(vdisplay): Linux keep-alive pool — registry-owned display lifecycle (Stage 1b) ... The ownership split (design/display-management.md §3): the registry owns the per-session virtual-display lifecycle on Linux, so a display can outlive its session (keep-alive) and be reused on reconnect. - registry.rs: a Linux pool driven by the pure lifecycle machine. acquire() reuses a kept (lingering/pinned) display of the same backend+mode, else creates one and keeps the backend's keepalive so the compositor output (and its PipeWire node_id) survives the session. The session's capturer holds a gen-stamped DisplayLease instead of the real keepalive; its drop drives linger/teardown. Enabling fact: KWin/Mutter/gamescope put their node on the DEFAULT PipeWire daemon (remote_fd=None) — reconnect re-attaches by node_id, no fd re-open. wlroots (remote_fd=Some, xdpw portal) passes through unchanged (teardown-on-drop) pending the fresh-portal-capture re-attach. - Default (unconfigured) linger = Immediate → today's teardown-on-disconnect, so no behavior change without a keep-alive policy; concurrent sessions still each create their own output (reuse only matches LINGERING entries). - Wired build_pipeline (punktfunk1) + gamestream through registry::acquire; capture_virtual_output signature unchanged. Windows delegates to vd.create (the manager already leases) — unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 23:37:21 +00:00
enricobuehler	2dd17dda80	test(mgmt): display state/release endpoint smoke test ... Covers the idle path (empty /display/state + released:0 /display/release) on a unit-test host, exercising the wiring + auth without touching any global owner. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 21:27:52 +00:00
enricobuehler	87f0ce7997	feat(vdisplay): lifecycle state machine + display state/release API (Stage 1) ... Stage 1 of design/display-management.md — the lifecycle core + the display management surface: - vdisplay/lifecycle.rs: pure per-slot state machine (Idle/Active{refs}/ Lingering{until}/Pinned) with acquire/release/expiry/force-release transitions. No I/O, no OS types — the platform-neutral distillation of the Windows manager's model. Unit + a 200k-iteration seeded property walk (no leaks / double-frees / refcount underflow across arbitrary interleavings). - vdisplay/registry.rs: neutral snapshot/release facade over the per-OS lifecycle owners. Windows reads/controls the VirtualDisplayManager; Linux keep-alive (a per-session pool) lands in a following increment (needs GPU-box validation). - windows/manager.rs: additive snapshot() + force_release() (no behavior change to the on-glass-validated path). - mgmt: GET /api/v1/display/state (live/kept displays) + POST /api/v1/display/release (tear down lingering/pinned now; refuses active). OpenAPI regenerated. - web console: Virtual displays card gains a live-display list (polled) with per-row + release-all buttons and a linger countdown. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 20:32:03 +00:00
enricobuehler	bbd98241e4	feat(vdisplay): display-management policy surface (Stage 0) ... A user-configurable policy layer above the per-compositor VirtualDisplay backends: keep-alive, topology, conflict, identity, layout, max-displays — persisted to display-settings.json, editable from the web console, applied per connect. Design: design/display-management.md. Stage 0 stands up the surface and wires the two behaviors the existing code can already express — the Windows monitor linger duration and the "make the streamed output the sole desktop" topology — through it; every other option is stored + echoed but not yet enforced (later stages). An unconfigured host (no display-settings.json) keeps today's exact behavior. - vdisplay/policy.rs: pure DisplayPolicy + 5 presets + JSON store (gpu-settings pattern) + EffectivePolicy; 9 unit tests. - vdisplay.rs: resolve_topology(Auto); apply_session_env drives *_VIRTUAL_PRIMARY from the policy only when a settings file exists. - windows/manager.rs: linger_ms() + should_isolate() read the policy when configured. - mgmt: GET/PUT /api/v1/display/settings (bearer-only); PUT rejects keep_alive forever until the lifecycle stage. OpenAPI regenerated. - web console: Host → Virtual displays card (preset picker + custom fields); en+de. - docs-site: virtual-displays.md + configuration.md cross-links. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 19:44:18 +00:00
enricobuehler	202f40fd4e	chore(release): bump workspace version to 0.7.4 ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> v0.7.4	2026-07-04 17:46:34 +00:00
enricobuehler	8f90563ffd	docs: dedicated Arch Linux host+client guide ... Every other distro has a full Host Setup page; Arch only had table rows. Add docs/arch.md (signed pacman binary repo: key import + repo + install, GPU prereqs, service/linger, web console, client, PKGBUILD appendix), slot it into the nav after fedora-kde, and point the install/client tables at it. Update the client-install rows from 'from the PKGBUILD' to the binary repo now that it exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 17:37:01 +00:00
enricobuehler	2e6b822fd6	docs(ci/arch): correct the header's pacman setup (key import, not TrustAll) + note the trust root ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 17:19:28 +00:00
enricobuehler	f7c5314b5e	fix(packaging/arch): correct pacman setup — import the registry key, cache cargo git ... The Gitea Arch registry signs its DB + packages, so 'SigLevel = Optional TrustAll' fails non-interactively (pacman still needs the key to verify). Document the one-time pacman-key import instead; install is then signature-validated under pacman's default SigLevel (verified end-to-end: clean archlinux container -> repo sync -> install, 'Validated By: Signature'). Also cache /usr/local/cargo/git in arch.yml: the workspace pulls clients/windows' git-pinned windows-reactor/windows deps to resolve, cloning windows-rs (huge) every run otherwise — same registry+git cache deb.yml uses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 17:16:24 +00:00
enricobuehler	d6669fc3fb	fix(ci/arch): create CARGO_HOME before chown — actions/cache doesn't on a miss ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 17:03:46 +00:00
enricobuehler	e292084225	fix(ci/arch): install nodejs before actions/checkout — act_runner doesn't inject node ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 17:02:17 +00:00
enricobuehler	c758b0393a	docs: sysext + pacman repo are the Bazzite/Arch install paths ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 16:39:01 +00:00
enricobuehler	d6a659a1ee	feat(packaging/arch): distribute binary packages via the Gitea Arch registry ... New arch.yml builds the split PKGBUILD (host/client/web, PF_WITH_WEB=1) in an archlinux:base-devel container on every push and publishes to the pacman repos 'punktfunk' (tags) / 'punktfunk-canary' (main, X.Y.Z-0.<run#> — pkgrel allows only digits+dots, so the run number carries the ordering). Consumers add one pacman.conf section; no more build-it-yourself as the only Arch path. PKGBUILD: pkgver/pkgrel env-driven (PF_PKGVER/PF_PKGREL), source=() when PF_SRCDIR is set (a canary version has no tag to clone), stale NVENC-only header fixed, and options=('!lto' '!debug') — makepkg's lto option injects -flto=auto into CFLAGS, aws-lc-sys compiles its C with it, and rust's lld cannot read GCC LTO bitcode: 'undefined symbol: aws_lc_*' at link (reproduced minimally on Arch + rust 1.90). Full build + clean-container install smoke-tested locally (binaries run, payload + scriptlets intact). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 16:39:01 +00:00
enricobuehler	2190dad2ad	feat(packaging/bazzite): systemd-sysext replaces rpm-ostree layering as the primary install path ... Layering is a last resort per the Bazzite docs (slows every OS update, can block upgrades until removed); a sysext never enters an rpm-ostree transaction, survives OS updates, and installs/updates with no reboot — the mechanism Fedora Atomic ships via fedora-sysexts. - build-sysext.sh wraps the built host+web RPMs into punktfunk-<V-R>-x86-64.raw: /etc payload relocated to /usr/share/punktfunk/etc (a sysext carries only /usr), the punktfunk-sysext helper embedded, ID=fedora + VERSION_ID pinned (merges on Bazzite via ID_LIKE; REFUSED after a major rebase instead of running soname-broken binaries — both behaviors validated live on Bazzite 43). SELinux labels are baked in as squashfs pseudo-xattrs from matchpathcon: unlabeled files run fine for user units but system daemons are DENIED (udev couldn't read the gamepad rule under enforcing) — validated on-glass. Refuses duplicate input package names (a stale noarch punktfunk-web next to the x86_64 one built a chimera image with the dead node launcher once). - punktfunk-sysext.sh: install/update/status/remove against per-Fedora-major feeds (…/generic/punktfunk-sysext/f43[-canary]), SHA-256-verified, applies the udev/sysctl scriptlet work + /etc copies, prints the layering-migration hint. Live-validated on the .41 Bazzite box incl. service restart + web console. - publish-sysext-feed.sh + rpm.yml: build + publish the image per matrix leg (fedver 43/44), canary feeds pruned to 6, stable release assets attached. - update-punktfunk.sh warns when the sysext shadows a layered install. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 16:39:01 +00:00
enricobuehler	5b5ec15ead	fix(client-linux): GL presenter — eglCreateImageKHR takes EGLint attribs, not EGLAttrib ... The KHR variant reads 32-bit attrib pairs; the pointer-sized array fed it garbage and every plane import came back rejected (observed on-Deck; the new fallback ladder caught it and demoted to software exactly as designed). Also print the real EGL error enum instead of its discriminant. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 14:32:06 +00:00
enricobuehler	c9ff144492	Merge branch 'main' of git.unom.io:unom/punktfunk	2026-07-04 14:29:40 +00:00
enricobuehler	7930d2f0f4	fix(core): split WIRE_VERSION from ABI_VERSION — new clients locked out of every deployed host ... ABI_VERSION was doing double duty: the embeddable C surface AND the punktfunk/1 Hello/Welcome version that hosts equality-check. The WoL feature's v3 bump added a client-local FFI function without changing a single wire byte — and every new client started refusing against every deployed host ("ABI mismatch: client 3 host 2", observed live Deck → Bazzite). The wire now carries its own WIRE_VERSION (still 2); ABI_VERSION stays 3 for the C header and the mgmt API's informational field. Bump WIRE_VERSION only when the handshake/planes actually change incompatibly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 14:29:33 +00:00
enricobuehler	160b67d043	fix(apple/release): embed Developer ID provisioning profile in the DMG ... The notarized Developer ID .dmg was SIGKILLed at launch ("Launchd job spawn failed", POSIX errno 163) before main() ran: the sandboxed macOS app declares the MANAGED keychain-access-groups entitlement, which AMFI only honors when an embedded provisioning profile authorizes it. The DMG embedded none — App Sandbox and the network/device keys are self-asserted for Developer ID, but a keychain access group is not — so every launch was killed at spawn. Validly signed and notarized (Gatekeeper accepted it), which is why this looked like a mystery. ⌘R and the App Store build hid it: Xcode embeds a development / App Store profile; the raw-codesign DMG path did not, so "⌘R == DMG" never held for this entitlement. Embed a "Punktfunk macOS Developer ID" profile (Keychain Sharing) into Contents/embedded.provisionprofile before codesign so its entitlements authorize the access group, exactly like the App Store build's profile does. If the profile isn't installed on the runner, warn and strip keychain-access-groups instead so the app still launches via ClientIdentityStore's legacy file-keychain fallback — a missing/expired profile can never reship the errno-163 brick again. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> v0.7.3	2026-07-04 15:00:56 +02:00
enricobuehler	6c4ba77606	fix(wol): clippy + cfg-gate the Windows client module — main compiles again ... The Wake-on-LAN batch landed with lints that fail `clippy -D warnings` (doc continuation, char-array split, io::Error::other, redundant closure) and an ungated `mod wol;` in the Windows client, which pulls windows-only crates into the non-Windows stub build. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 12:02:45 +00:00
enricobuehler	eeee2782f5	Merge remote-tracking branch 'origin/main'	2026-07-04 12:00:18 +00:00
enricobuehler	b488bd1d99	feat(client-linux): in-process GL presenter — hardware decode ships on the Steam Deck ... VAAPI decode stays; what changes is who touches the YUV. The direct path hands the NV12 dmabuf (tiled AMD modifier since Mesa 25.1) to GdkDmabufTexture, and GTK's tiled-NV12 import renders corrupt/gray/washed-out on the Deck. Moonlight and mpv are clean on the same box because they import the dmabuf into their own EGL context and convert with their own shader — video_gl.rs is that architecture for the GTK client: per-plane EGLImages (R8 + GR88, modifier passed through) → our YUV→RGB shader (matrix/range from the stream's CICP signaling, unit-tested) → RGBA texture in a GdkGLContext-shared context → fence-synced GdkGLTexture. GTK composites plain RGBA; no YUV negotiation, no compositor CSC. The Deck's decoder default flips back to hardware (the software stopgap is gone); desktops keep the direct dmabuf path (offload/scan-out eligible). PUNKTFUNK_PRESENT=direct|gl overrides either way. New failure ladder: GL converter init failure or a convert-error streak raises a shared flag and the session pump demotes the decoder to software with a keyframe re-request — the same mechanism also closes the old silent-black-screen gap where a rejected dmabuf import had no recovery at all. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 12:00:18 +00:00
enricobuehler	7e6561aaa2	style: rustfmt the Wake-on-LAN modules ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 13:52:17 +02:00
enricobuehler	e9c5030190	feat(clients): Wake-on-LAN in apple/linux/windows/android/decky ... Each client learns a host's MAC from the mDNS `mac` TXT while it's awake, persists it on the saved-host record, and — when reconnecting to an offline host — sends a magic packet before connecting, plus an explicit "Wake host" action. Apple wraps the C-ABI; linux/windows call the core fn directly (linux also gains a --wake CLI mode); android via a new nativeWakeOnLan JNI export (the mDNS browse record gains a 7th mac field); decky shells out to the linux client's --wake before launching the stream. iOS/tvOS need the managed com.apple.developer.networking.multicast entitlement (pending Apple approval), so the wake path + UI are gated off via PunktfunkConnection.wakeOnLANAvailable and the entitlement is commented out — keeping iOS/tvOS releasable. MAC-learning stays active on every platform so it lights up the moment it's ungated. macOS works today. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 13:39:44 +02:00
enricobuehler	22c0d92f2e	feat(core,host): Wake-on-LAN sender + host MAC advertisement ... Add a runtime-free Wake-on-LAN sender in punktfunk-core (per-interface subnet-directed broadcast + 255.255.255.255 on ports 9/7, repeated, optional last-known-IP unicast) exposed both as a Rust fn and a punktfunk_wake_on_lan C-ABI (ABI v3), plus a parse_mac helper. The host enumerates its wake-capable NIC MAC(s) and advertises them in a new mDNS `mac` TXT record (routed NIC first), and best-effort detects & warns (never modifies) when the NIC isn't armed for WoL. MAC delivery is via the unauthenticated mDNS TXT rather than the connection handshake by design: a spoofed MAC only makes a wake fail (the packet is inert; the cert fingerprint still gates the connection), and it avoids threading through the hot connect path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 13:39:44 +02:00
enricobuehler	097cc6faf4	fix(apple/gamepad): deliver PS/Home + Share buttons on macOS ... macOS reserves the controller Home/PS and Share/Create buttons for its own system gestures and never delivers them to the app unless it declares the Game Controllers capability. Add GCSupportsControllerUserInteraction=YES to the macOS target only (iOS/tvOS rely on the focus engine, so it must not be in the shared plist), alongside the existing preferredSystemGestureState=.disabled. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 13:39:44 +02:00
enricobuehler	8b37badae4	docs(security): record measured WDA_EXCLUDEFROMCAPTURE behavior + capture-vs-viewer framing ... Tested on .173: a WDA_EXCLUDEFROMCAPTURE window (affinity readback 0x11, confirmed active) is pixel-identically visible in the punktfunk/1 stream across no-flag / flag-set / flag-cleared phases — the flag makes no difference to a present-tap capture. Replace the "untested, treat as expected" note in the IDD-push residual list with the measured result, and correct the framing: WDA visibility matches what a person at the screen sees (it exceeds an ordinary capture tool, not the physical viewer). Add the matching public-facing paragraph to the security page covering both asymmetries — WDA windows appear (same as a physical viewer), DRM video is blanked (less than a physical viewer) — tied back to the page's "a client sees what someone at the machine sees" model. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 11:16:18 +00:00
enricobuehler	90c2d8b3a0	fix(host): don't count punktfunk's own virtual Deck as a physical Steam controller ... The Steam-conflict gate scanned /sys/bus/hid/devices for non-virtual 28DE devices, but the usbip/gadget virtual Decks present a REAL USB device (vhci resolves through vhci_hcd, not /devices/virtual/) — so a just-ended session's pad still detaching, or a concurrent session's live one, read as "physical Steam controller attached" and degraded every back-to-back Deck session to DualSense (observed live on Bazzite). Exclude our pads by their PFDK… serial (HID_UNIQ), with the vhci_hcd path as belt and braces. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 11:14:24 +00:00
enricobuehler	853e7fe92f	fix(client-linux): Deck trackpad clicks — bind to the correct pad, stop riding the button plane ... SDL's Steam Deck mapping delivers the pad clicks as gamepad BUTTONS with no surface identity: the generic `touchpad` button is the LEFT pad's click and `misc2` the RIGHT's (SDL_gamepad_db.h `touchpad:b17,misc2:b16`). The client forwarded `touchpad` as wire BTN_TOUCHPAD — which the host maps to the RIGHT pad click (DualSense convention) — and dropped `misc2` entirely: a left-pad click registered on the right pad, a right-pad click nowhere, and the mis-routed state could stick. Clicks from a multi-touchpad pad now ride the rich plane as TouchpadEx with their surface, reusing the surface's live contact point (click buttons carry no position). forward_touch carries the held click through motion frames so a touch update can't clear a click mid-press, and the flush lifts held clicks on detach/pad-switch. A DualSense's single touchpad button stays on the button plane unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 11:08:44 +00:00
enricobuehler	df496776b0	fix(client-linux): Deck raw-pad capture — clear Steam's SDL device filter, honest degradation warning ... The Deck's built-in controller can never leave Steam Input ("Steam Controller" is always-required in the shortcut's matrix; Disable Steam Input only affects other controller brands), so the raw 28DE:1205 device is the only path to the trackpads/paddles/gyro. Steam hides it from SDL by launching shortcuts with SDL_GAMECONTROLLER_IGNORE_DEVICES naming every physical pad it virtualized — clear it (and _EXCEPT) at startup while single-threaded, logging what Steam set as field evidence. The post-attach warning now states the real condition (raw pad never enumerated; sticks + buttons still work) instead of advising a Steam Input toggle that doesn't exist for the built-in controller. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 10:06:48 +00:00
enricobuehler	5310176ab5	fix(client-linux,host): Deck video defaults to software decode + input-interception diagnostics ... Video (Deck): the VAAPI zero-copy path renders corrupt/gray/washed-out on the Deck — root-caused to Mesa >= 25.1 exporting radeonsi VCN decode surfaces TILED (the Flatpak runtime's Mesa 26 drives both the decoder and GTK's GL, and GTK's tiled-NV12 dmabuf import mishandles it; desktop Tier-1 validations ran distro Mesa with linear export). `auto` now resolves to software on a Deck (clean, correct-colour, easily handles 1280x800 HEVC); PUNKTFUNK_DECODER=vaapi still forces the hw path, with the descriptor modifier dump + GSK_RENDERER as the bisect levers. Also reserve extra_hw_frames=4 on the VAAPI decoder: the presenter pins mapped surfaces past receive_frame, and the fixed pool recycling a surface the renderer still samples is intermittent block corruption anywhere. Input (Deck): with Steam Input ON for Punktfunk, SDL sees only Steam's virtual X360 pad — the right trackpad arrives as a plain right stick and the left trackpad/paddles/gyro not at all, silently. The client now checks once the post-attach enumeration settles and raises a toast + warn naming the fix (disable Steam Input for the shortcut). The host logs a one-shot warning when InputPlumber is running (Bazzite default) since it can grab the virtual Deck pad and re-emit it under a different identity. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-04 09:56:06 +00:00
enricobuehler	76ff616dcf	fix(flatpak): drop --socket=pipewire (unknown to the builder) — keep the xdg-run bind ... The v0.7.2 flatpak build failed: `error: Unknown socket type pipewire` — this flatpak-builder toolchain (and the Deck's flatpak 1.16 override CLI) don't accept --socket=pipewire. --filesystem=xdg-run/pipewire-0 binds the same native socket and is the portable form already validated on-Deck (pipewire-0 appears in the sandbox, client audio node registers, no pw-connect error). Keep only that + --socket=pulseaudio. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 09:20:52 +00:00
enricobuehler	ac706ba839	chore(release): bump workspace version to 0.7.2 ... Ship the flatpak PipeWire-socket audio fix (94b5f48) to the stable channel — a tag is required (main pushes only publish the canary flatpak branch), and 0.7.1 stable users on the Deck have no client audio until this lands. Bump [workspace.package] + the 9 Cargo.lock workspace entries (CI builds --locked). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> v0.7.2	2026-07-04 08:59:26 +00:00
enricobuehler	94b5f48d0b	fix(flatpak): expose native PipeWire socket so client audio works ... The Linux client speaks the native PipeWire protocol (audio.rs `pw connect`), but the manifest granted only --socket=pulseaudio, so the sandbox had just `pulse/native` and no `pipewire-0`. Playback + mic both died with "pw connect (is PipeWire running in this session?)" — reproduced live on a Steam Deck in Gaming Mode (no client audio node ever appeared). Add --socket=pipewire (canonical) + --filesystem=xdg-run/pipewire-0 (portable bind of the same socket). Validated on-Deck via a `flatpak override --filesystem=xdg-run/pipewire-0`: pipewire-0 then appears in the sandbox and the client registers its "punktfunk-client" PipeWire node with no pw-connect error. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 08:59:11 +00:00
enricobuehler	139d032e55	docs(bazzite): fix the "rpm-ostree upgrade doesn't update punktfunk" trap ... `rpm-ostree upgrade` re-resolves layered packages only when the BASE image changes; on a frozen Bazzite base (pinned :stable tag / paused rebase) it reports "No updates available" and never bumps the layered punktfunk even when newer RPMs are live in the repo — observed on the .41 host stuck at 0.6.0 while 0.7.x sat in the registry. - Add packaging/bazzite/update-punktfunk.sh: detects the layered punktfunk packages, refreshes rpmmd, and forces a re-resolve via `rpm-ostree update --uninstall <pkg> --install <pkg>` (the one-transaction idiom that actually pulls a new layered version on a static base). - Document the trap + the fix in packaging/bazzite/README.md, including the channel gotcha: an enabled punktfunk-canary.repo (<next-minor>.0-0.ciN) outranks stable X.Y.Z-1, so the box silently tracks canary — enable one channel only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 08:38:52 +00:00
enricobuehler	caa7a1c735	chore(release): bump workspace version to 0.7.1 ... Cut 0.7.1 to test the GTK + Decky polish batch (57ae00a) on-device: the host-click / disconnect-chord / gray-screen-recovery / leak fixes on the Linux client, the Deck launcher perf profile, and the Decky pin/pairing fixes. The [workspace.package] version (inherited by every crate via version.workspace) is the release being cut; refresh the 9 workspace entries in Cargo.lock to match (CI builds --locked). Canary derives from the tag (scripts/ci/pf-version.sh), so cutting v0.7.1 auto-advances canary. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> v0.7.1	2026-07-04 07:47:58 +00:00
enricobuehler	13dc7fc49f	style(linux): rustfmt the keyframe-recovery throttle line ... Wrap the `last_kf_req.is_none_or(...)` guard to satisfy `cargo fmt --all --check` (CI Format step). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 07:47:16 +00:00
enricobuehler	57ae00a9c8	fix(clients): GTK + Decky polish batch from live Deck/Windows testing ... GTK Linux client: - hosts/library: clicking a card was dead — the handler was on FlowBoxChild::activate (never emitted on click); bridge child-activated → child.activate() on the FlowBox (ui_hosts, ui_library). - stream: the Ctrl+Alt+Shift+D/Q/S chords (and all key forwarding) were dropped because the key controller sat on the overlay, which loses focus to the header back button after nav.push+fullscreen — move it to the window and remove it on teardown. - video: a mid-session VAAPI decode error rebuilt a software decoder but never requested a keyframe, so under the infinite GOP the picture stayed gray/frozen forever. Request an IDR on any VAAPI error, keep the hardware decoder, and demote to software only after repeated failures. - stream: fix a per-session Capture↔overlay reference cycle that leaked the overlay subtree + the Arc<NativeClient> on every session end — hold the overlay weakly. - stream: accumulate the fractional wheel remainder so precision-scroll (Deck trackpad / hi-res wheels) sub-unit deltas aren't dropped. - gamepad library: keep the launcher smooth on the Deck — freeze the aurora and trim the visible card range (fewer 3D offscreen passes) on low-power. - gamepad: log full pad identity (vid:pid:name:type:virtual) on attach to diagnose an empty controller list on the Deck. - cli: --connect host:<badport> silently did nothing; default to 9777 + warn. - css: add the missing .pf-neutral pill rule; fix the clipped most-recent accent (inset outline instead of a corner-clipped box-shadow bar). Decky plugin: - surface the on-screen library browser: label the host-row Games button. - fix silent pin data-loss — the detached Games modal captured a frozen pins array, so pinning a second game clobbered the first; mirror pins in a ref and track the modal's pinned ids locally for a live label. - route pair-required hosts through the pairing modal from the fullscreen Stream button (parity with the QAM panel). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 07:37:04 +00:00
enricobuehler	882a3d57f6	chore(release): bump workspace version to 0.7.0 ... The [workspace.package] version (inherited by every crate via version.workspace) is the release being cut. Refresh the 9 workspace entries in Cargo.lock to match (CI builds --locked). Canary derives from the tag now (scripts/ci/pf-version.sh), so no canary-base edit is needed — cutting v0.7.0 auto-advances canary to 0.8.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> v0.7.0	2026-07-03 22:45:45 +00:00
enricobuehler	fa28fa19a0	Merge remote-tracking branch 'origin/main'	2026-07-03 22:41:42 +00:00
enricobuehler	42595b5558	fix(flatpak): keep both channels in the OSTree summary (fixes stable "No such ref") ... The surfaced install command flatpak install --user https://flatpak.unom.io/io.unom.Punktfunk.flatpakref failed with "No such ref 'app/io.unom.Punktfunk/x86_64/stable'". The stable commit's objects are on the server, but the repo *summary* (what flatpak reads to resolve refs) listed only canary. Root cause: each CI run builds a fresh SINGLE-branch local OSTree repo, build-update-repo regenerates the summary from that one branch, and rsync uploads it without --delete. Objects for both channels accumulate, but the summary is overwritten every run and only names that run's branch. Canary runs on every main push, stable only on tags — so a tag published stable, then the next canary push clobbered the summary back to canary-only. Fix: seed the local repo from the live server (rsync repo/ DOWN) before the build, so it carries every published branch; the build only adds this run's commit and the regenerated+signed summary keeps both channels. Single shared repo kept (no URL/Caddyfile change; existing installs fixed transparently). Adds a refs log after build-update-repo as a clobber tripwire. Also adopts scripts/ci/pf-version.sh for the canary base (see previous commit). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-03 22:40:35 +00:00
enricobuehler	4de543c146	ci(release): derive canary version from git tags (single source of truth) ... Every release workflow hardcoded a canary base version (0.5.0 in Apple/Android/rpm/flatpak/deb, 0.3 in windows-msix/windows-host/decky) that had to be hand-bumped on each stable release and wasn't. With stable at v0.6.0, every canary was a version *behind* stable — e.g. the Apple canary showed up on TestFlight as 0.5.0 while 0.6.0 was already published. Add scripts/ci/pf-version.{sh,ps1} (bash + pwsh twin) as the single source of truth: stable = the vX.Y.Z tag; canary = latest stable tag with minor+1, patch 0 (v0.6.0 -> 0.7.0), so canary is always exactly one minor ahead of the newest release with zero maintenance. Falls back to the workspace Cargo.toml version when no tag is fetchable. All workflows now eval/call it and format their own channel suffix off $PF_BASE; only the canary branch changed, stable branches and per-channel suffixes are untouched. channels.md drops the old manual "bump the canary base" release step. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-03 22:40:25 +00:00
enricobuehler	42d1c74663	fix(apple-client/audio): capture the right channel of a multi-channel mic + diagnostics ... The mic uplink handed the host pure digital silence on a multi-channel interface: AVAudioConverter's N→stereo downmix takes channels 0/1, but a pro interface puts the mic on ONE higher discrete channel. Fold the input to a mono bus ourselves instead — pick the mic's channel (or sum all) and resample that to the encoder's 48 kHz stereo, so the silent 0/1 downmix never happens. - New "Microphone channel" setting (macOS): Auto (sum every channel — a lone hot mic passes at full level) or pin 1-based channel N. Picker appears only for multi-channel devices, driven by the device's input channel count. - Diagnostics that make this class of failure self-naming next session: log the actual live capture device + format + fold mode, warn on a silent UID fallback, and a one-shot silence tripwire on the EXTRACTED signal (WARN on 10 s of zeros, else peak dBFS). - foldToMono extracted as a pure, unit-tested helper (pin / sum-clamp x interleaved / deinterleaved / mono / out-of-range). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-04 00:36:35 +02:00
enricobuehler	136f6e8f0e	feat(probe): --mic-burst — real-client mic pacing for jitter-buffer regression tests ... The steady 5 ms mic-test cadence never trips host-side buffering bugs: the WASAPI crackle (fixed in the previous commit) only reproduced under a real client's bursty input tap. --mic-burst paces the tone the same way (two 20 ms Opus packets every 40 ms), so recording the host mic and counting silence gaps regression-tests the jitter buffer headlessly. Validated against the fixed Windows host on the lab box: 15 s of bursty tone, zero mid-stream gaps >=3 ms (gaps confined to the first 40 ms priming window). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 22:35:49 +00:00
enricobuehler	00acf5e44e	fix(host/audio): WASAPI virtual mic — port the priming jitter buffer (crackling fix) ... Mac → Windows mic passthrough crackled heavily while the identical stream was clean on the Linux host. Cause: clients push mic audio in BURSTS on their own clock (the Mac input tap yields ~two 20 ms Opus packets every ~42 ms) while the WASAPI render loop pulled a block every ~10 ms device period and greedily drained whatever was queued, padding the rest with zeros — the queue sat near-empty and most periods inserted mid-stream silence. The Linux backend has absorbed this since day one with its priming jitter buffer; the WASAPI loop had none. Port the same semantics: emit silence until ~48 ms is buffered (covers the worst inter-burst gap), then play from the cushion (zero-filling only a momentary shortfall), re-prime only after a genuine full drain (client went quiet). Queue cap raised 80 → 120 ms for burst headroom; steady-state added latency ≈ the 48 ms cushion. Diagnosed live on .173: probe tone recording from CABLE Output proved the endpoint wiring, then the burst-vs-period math explained the crackle. Build-verified on Windows; on-glass listen pending. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 22:31:18 +00:00
enricobuehler	38078fe7ee	feat(linux-client): gamepad library launcher — console-style coverflow (--browse) ... A controller-driven, chrome-less library launcher for the Steam Deck flow (the Decky plugin's "Open library on screen" + pinned games, 8470419): `--browse host[:port]` opens a paired host's game library as a coverflow over a drifting aurora — A streams the focused title (the id rides the Hello), session end returns to the launcher, B quits back to Gaming Mode. `--connect` gains `--launch <id>` for direct-to-game starts; `--mgmt` overrides the library port. Scope is deliberately library-only: host selection/settings stay in the touch UI, pairing stays in the plugin (no dialog can map under gamescope — every state renders in-page). - gamepad.rs menu mode: the worker holds the active pad open while idle (WITHOUT the Valve HIDAPI drivers — Deck lizard mode survives) and translates it through a pure MenuNav state machine: edge-triggered buttons, held-state snapshot on entry/detach (the escape chord that ends a stream can't ghost-fire in the menu), 380/160 ms stick/dpad repeat, menu rumble ticks. Keyboard fallback (arrows/Enter/Esc) drives the same handler — fully usable with no pad, no host (PUNKTFUNK_FAKE_LIBRARY). - Coverflow: ±38° corridor-facing tilt under per-card perspective (gsk rotate_3d), dense overlapping side shelves with paint-order restacking (gtk::Fixed draws in child order), opaque card faces + a darkening veil for the recede (translucency would bleed the stack through). The strip lives in an External-policy ScrolledWindow because a bare gtk::Fixed measures its TRANSFORMED children and inflates the page min-width past the window. - Spring-driven motion: semi-implicit Euler in ≤8 ms substeps (a raw 50 ms frame leaves the stiff recoil spring ringing at ω·dt ≈ 1.2 — regression-tested), ζ≈0.85 cursor chase + ζ≈0.55 boundary wobble; velocity carries across retargets so held-repeat scrolling glides. - Shot scene `gamepad-library` (GTK animations force-disabled in shot mode — nav transitions froze mid-slide in headless captures); shared poster fetch extracted to library::spawn_art_fetch. Verified here: 21 unit tests (MenuNav, cursor stepping, spring convergence/stability), clippy -D warnings clean, screenshot scene pixel-checked, --browse smoke runs (fake-library + unpaired) on the headless session. On-Deck validation pending (virtual-pad input, lizard mode, rumble via Steam Input, full Decky→browse→stream→launcher loop). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-03 21:41:43 +00:00