* server: generated video pipelines keep at most one raw frame queued
GetPipeline used plain `queue` elements, which buffer up to 1s / 200
buffers. When the encoder cannot keep up, frames pile up there and the
stream (and every reaction to input) falls behind by up to that much.
The queues now hold only the newest frame (leaky=downstream): a slow
encoder drops frames instead of adding latency.
Measured input-to-display latency (Alt+F2/Escape opens/closes a dialog,
time to the first changed received frame; xfce image built with ./build,
1920x1080, default VP8 pipeline, 30 trials per run, runs interleaved):
before p50/p90 ms after p50/p90 ms
no CPU limit 268/303, 188/225 183/217, 157/226
--cpus=1 270/422, 362/673 155/237, 200/428
fps unchanged without a limit (25), slightly higher with one (22.5 ->
23.5-24). Pipelines given as raw gst strings are unchanged.
Tests: TestVideoConfigGetPipelineQueues; client e2e on the built image.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* server: session ids no longer carry the login name verbatim
The multiuser and noauth providers built the session id as
"<username>-<token>". The v3 API addresses sessions and members by id
in the URL path (DELETE /api/sessions/{id}, POST /api/members/{id},
POST /api/room/control/give/{id}), so a login name like
"x/../../logout?" produced an id that sent an admin's unencoded
request to another endpoint, and even when the client encodes it, an
id with "/" never matches the chi route: such a member could not be
kicked, muted or banned.
utils.SafeID maps a name to letters and digits of any script plus
".", "_" and "-": every run of other characters becomes one "-",
leading and trailing "-" and "." are trimmed, the result is cut to 64
characters, and an empty result becomes "user". Nothing with a meaning
in a URL path survives; letters outside ASCII are kept so names such as
"Müller" stay recognisable (clients percent-encode ids in paths). Both
providers now use SafeID(username) + "-" + token; the profile name
keeps the name as typed, so nothing changes on screen.
The file and object providers use the username itself as the member
id. Members there are created explicitly by an admin, so
POST /api/members now rejects a name SafeID would change with a 400
instead of silently altering it. The oauth provider derives ids from
the IdP subject ("oauth:" + sub) and is unchanged.
Tests: TestSafeID (pkg/utils).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* server: chat plugin limits message length (chat.max_length)
The chat plugin accepted text of any size, over the websocket
(chat/message) and over REST (POST /api/chat), and broadcast it to
every session. The web client caps its input box at 512 characters,
but any client can send more, and one large message stalls every
viewer's renderer.
New option chat.max_length (default 512, counted in characters with
utf8.RuneCountInString, not bytes; 0 disables the limit). Both paths
go through one check: REST answers 400 with the length and the limit,
the websocket handler logs at warn level and drops the message, as it
already does for a sender without permission. The default never
rejects what the web client can type: its maxlength counts UTF-16
units, which is never fewer than runes.
Docs: plugins.md and release notes. help.txt/help.json list no plugin
options (no chat.*, filetransfer.*, openinapp.* entries), so nothing
was added there.
Tests: TestCheckLength (internal/plugins/chat).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* server: limit the size of websocket frames a client may send
There was no read limit on the websocket, so a client could push frames
of any size; they were read and decoded in full before a handler (such
as the chat length check) could reject them. Frames above 1 MiB now end
the connection, as gorilla's SetReadLimit does. The largest legitimate
messages, an SDP answer and pasted clipboard text, stay far below that.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* server: video RTP timestamps follow the time between captured frames
ximagesrc gives a frame it captures late a buffer duration of only the
time left until the next frame slot ("Frame duration is from now until
the next expected capture time"), and frames dropped before the encoder
leave gaps. pion advances the RTP clock by Sample.Duration, so whenever
the encoder falls behind, the stream's clock runs slower than real
time. Browsers grow their jitter buffer to make up for it and lip sync
drifts. This happens with any queue in front of the encoder.
Each video sample's duration is now the gap since the previous sample's
PTS. The gap is known only when the next frame arrives, so it is
applied one frame late; the clock itself stays right. The sink also
counts frames in neko_capture_streamsink_frames: a rate below the
configured fps means the encoder falls behind.
Measured on the firefox image built with ./build, 1080p25 VP8, the
container limited to 0.5 CPU: RTP clock 0.2-0.9x real time before,
1.00x after; browser video jitter buffer 0.24-1.9 s before, 60-220 ms
after; audio up to 0.4 s (default queue) or 0.74 s (one-frame leaky
queue) ahead of the video before, within -70..+150 ms after.
Tests: TestSampleDuration; go test -race ./internal/capture.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
when NEKO_CAPTURE_VIDEO_PIPELINES is set without capture.video.ids the
VideoIDs list stayed empty, so capture.Video().IDs() returned [] and the
first websocket signal request crashed the whole server with
"index out of range [0] with length 0" in signalRequest.
now we fill VideoIDs from the configured pipeline keys (sorted by id)
whenever no ids are set explicitly, and signalRequest returns a plain
error instead of panicking when there is no video stream at all.
added tests for the config loader, the capture manager and the signal
handler so this path stays covered.
* oauth: bind state to browser session
Bind each authorization state to a short-lived HttpOnly cookie so callback URLs cannot create sessions in browsers that did not initiate login.
Use per-state cookie names to preserve concurrent flows and reject callback origins that cannot receive the host-only cookie.
* oauth: preserve explicit proxy redirects
Keep browser-state binding usable when TLS terminates before Neko while still rejecting callback hosts that cannot receive the login cookie.
* fix(capture): accept a bare pipeline string in video pipelines entries
NEKO_CAPTURE_VIDEO_PIPELINES expects every entry to be a full pipeline config
object, but the singular capture.video.pipeline option trains people to write
the whole pipeline as a plain string, so a dict like {"high": "ximagesrc ...
! appsink"} failed to unmarshal, the error got reduced to a warn and neko fell
back to the default vp8 pipeline silently, also overriding a directly set
video codec
the json string hook decodes the env value into a generic map, so the shorthand
is restored in the mapstructure chain: a string value for an entry now becomes
VideoConfig{GstPipeline: ...}, the same shape the single pipeline option
produces, object entries are untouched
the new config test drives the production env flow (Init + Set) and fails on
master with the same two warnings the reporter saw
Fixes#689
* feat(capture): add shorthand support for pipeline entries as plain strings.
---------
Co-authored-by: Miroslav Šedivý <sedivy.miro@gmail.com>
* feat(capture): toggle mouse pointer via capture.video.show_pointer
- config: register capture.video.show_pointer config option
- config: default pointer to visible (ShowPointer: true) on the
hardcoded fallback pipeline, override applies only when the flag is
explicitly set, so per-pipeline YAML overrides stay untouched
- compose: document NEKO_CAPTURE_VIDEO_SHOW_POINTER example
* fix(capture): apply show_pointer to all pipelines
- capture: thread capture.video.show_pointer into broadcast and
screencast gstreamer pipelines, previously hardcoded show-pointer=true
and silently ignored the flag
- config: resolve capture.video.show_pointer once into
Capture.VideoShowPointer so all pipeline builders share one value
- docs: document capture.video.show_pointer in configuration/capture.md,
including its reach into broadcast and screencast, and regenerate
help.txt/help.json
- compose: drop stray commented-out example, default compose file is
not meant to list every option
* This is a no-op with the default configuration: when only a single video pipeline is configured, there is nothing for the stream selector to switch to. The change only has an effect when the operator configures multiple pipelines and enables the bandwidth estimator.
* fix(session): guard against nil WebRTC peer in profileChanged"
---------
Co-authored-by: alvarorichard <alvarorichard@tuta.io>
we used to have file neko.yaml with default configuration, but if we would add neko.yml the default configuration would still be read. so instead, default configuartion was moved to the sever itself and no file is distributed with it by defautl.
* feat: add openinapp plugin to open chat links in shared neko instance
* lint.
* feat(openinapp): implement open link handler and route for opening links.
* feat(openinapp): switched to http backend and removed example in docker-compose.yaml
* lint.
---------
Co-authored-by: Miroslav Šedivý <sedivy.miro@gmail.com>
* fix(filetransfer): remove auth.AdminsOnly middleware wrapper from routes
* fix(filetransfer): add config option to allow non-admin users to download and upload files.
* fix(filetransfer): implement user permissions for file download and upload in client.
---------
Co-authored-by: Miroslav Šedivý <sedivy.miro@gmail.com>
GDK3 (used by Firefox/Camoufox) selects XI2 for the seat keyboard at
startup and ignores core-protocol KeyPress events. XTestFakeKeyEvent
produces core events, so typed characters from the Neko viewer silently
never reach Firefox.
Fix: discover the "Virtual core XTEST keyboard" XInput1 device at
startup, cache it, and dispatch key events via XTestFakeDeviceKeyEvent
which goes through the XI path. Falls back to the old core XTest path
if the device isn't found.
Requires -lXi (libxi-dev at build, libxi6 at runtime).
* Add H265 support
Adds H265 as a selectable video codec with software (x265enc), VAAPI
(vah265enc), and NVENC (nvh265enc) pipeline paths in both the legacy
pipeline builder and the RTPCodec definition.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Replace legacy vaapih264enc with vah264enc
The gstreamer-vaapi plugin suite (vaapih264enc) is superseded by the va
plugin (vah264enc) in gst-plugins-bad. Switch to it and update the
parameters accordingly: CBR instead of VBR for lower-latency streaming,
key-int-max instead of keyframe-period, and target-usage instead of
quality-level.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Unify keyframe interval to 60 frames for NVENC H264/H265 encoder paths
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: reduce audio jitter buffer latency
- Release listenersMu before dispatching samples to listeners
- Buffer Track.sample channel (size 2) with non-blocking WriteSample
- Buffer pipeline.sample channel (size 4) to unblock GStreamer thread
- Add leaky=downstream max-size-buffers=5 to audio queue to prevent burst accumulation
- Set sync=false on appsink to deliver buffers immediately without clock wait
These changes break the backpressure chain that caused the GStreamer
streaming thread to stall. When the Go scheduler has a hiccup, buffered
frames were delivered in a burst, causing the browser audio jitter buffer
to grow to ~10 seconds over time.
Fixes: #598
* fix: log message when dropping samples due to full track channel
* feat(client): add microphone passthrough button to controls toolbar
Add mic toggle button to the bottom controls bar that enables users to
share their local microphone with the remote neko session via WebRTC.
The server already supports microphone capture (capture.microphone.enabled)
but the legacy client had no UI to trigger getUserMedia and send an audio
track to the peer connection.
Changes:
- base.ts: Add enableMicrophone/disableMicrophone methods that call
getUserMedia and addTrack/removeTrack on the RTCPeerConnection.
Mic is cleaned up automatically on disconnect.
- controls.vue: Add mic button (fa-microphone/fa-microphone-slash) between
play/pause and volume controls with tooltip and error handling.
- en-us.ts: Add i18n strings for mic tooltips and error dialog.
* if the error is not io.EOF, log it. Otherwise, it's a normal closure of the track.
* tie microphone to active host and auto-disable on control loss
---------
Co-authored-by: h1n054ur <admin@haniumer.com>
Co-authored-by: Miroslav Šedivý <sedivy.miro@gmail.com>
we always keep running the last clipboard function as that is supposed to contain the clipboard data being pasted. as soon as a new one is spawn, the old one is stutdown.
SamAcctX
Abdellatif Anaflous
Seungwon Lee
a
Miroslav Šedivý
@刘羡鱼
KЯØNE
ycsi
Paul Troeger
Ruben Vereecken
Budovi
Hani
LDwise