Surface pixelpass screen-sharing from inside a peerspeak room. peerspeak owns
voice, pixelpass owns pixels — they're never Cargo deps of each other; the
contract is pixelpass's CLI flags + its `--output json` stdout stream.
Modelled on Discord: multiple simultaneous sharers, a 🔴 Live badge + 👁 Watch
on each sharing peer's card, and in-progress shares visible to late joiners.
- New `src/screenshare` module: pure `parse_pixelpass_event` seam + `pixelpass_path`
discovery (13 unit tests), async `spawn_host` (→ ticket) and `spawn_viewer`
(→ parse connected{url} → open mpv, vlc fallback). No new deps.
- Sharing rides presence: `PeerState.sharing: Option<ticket>` (serde-defaulted),
so the existing gossip re-announce delivers the offer to late joiners for free
and a PeerUpdated fires on start/stop — no separate gossip message needed.
- core: Start/Stop/ViewShare commands; host + viewer children tracked in the
session, killed on stop/leave (kill_on_drop backstop). Viewer limit left to
pixelpass's bandwidth-measured cap.
- UI: Share/Stop button (graceful "needs pixelpass" disabled state), Live badge
+ Watch on peer cards, Sharing badge on the self card. Verified by screenshot.
- config: optional `pixelpass_path` override (hand-editable).
Tests-green; the 2-machine gossip/remote path is not yet field-verified.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Approach B: peerspeak spawns pixelpass --host --output json, scrapes the
ticket from its JSON stdout, and distributes it over the existing gossip
plane as a ScreenShareOffer; peers get a one-click pixelpass viewer.
Mutually optional, runtime-only coupling -- neither tool is a Cargo
dependency of the other; the contract is pixelpass's CLI + JSON protocol.
Video-only, separate viewer window, PATH binary discovery. Not yet built.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Capability list of what PeerSpeak already does, companion to
ARCHITECTURE.md, so the feature surface doesn't have to be re-derived
from the code each session. Marks each row verified / tests-green /
plumbing, and collects the outstanding 2-machine field-test debt.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add three in-call room layouts — 3-Column (Participants | Chat | Controls),
Bottom Dock (Participants+Controls over a full-width Chat strip), and Drawer
(Participants | Controls with a collapsible Chat panel) — chosen via one
persisted RoomLayout config setting and applied live.
Picker UX: a square layout button (drawn LayoutIcon glyph) in the top bar of the
launch and in-call screens opens a popup gallery (dimmed click-to-dismiss
backdrop + centered panel) of clickable schematic thumbnails; the Settings screen
shows the same thumbnails inline (no button). Thumbnails are drawn with the
canvas widget (new LayoutThumb program — colored panel boxes, blue border on the
selected one), so no image-decoding dependency is added.
Each layout's panel boundaries are draggable (DividerKind gains Controls +
ChatDrawer for the 3-column right divider and the drawer's left edge; new
clamp_controls_width / clamp_chat_drawer_width, persisted + re-clamped on resize).
Participants width is shared across layouts but capped per layout at render time
so a fixed panel can't starve the Fill panel (e.g. a wide Participants width set
in the dock layout won't collapse Chat in 3-column or Controls in the drawer).
The Drawer layout adds a header chat-toggle. +1 clamp test (now 127 tests).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Remember last nickname: a new serde-default AppConfig.username field is
pre-filled into the launch-screen nickname field, and saved when a room is
joined or created (i.e. when the name is actually used), so it carries across
launches.
Sanitize chat: a pure sanitize_chat() drops control characters (ANSI escapes,
NUL, stray CR/LF/TAB), collapses whitespace runs to single spaces, trims, and
caps length (2000 chars). Applied to our outgoing text on submit AND to incoming
peer messages on receive — peer content is untrusted, so the sender's name and
text are both sanitized before display; empty-after-sanitize messages are
dropped. Unit tests for sanitize_chat (control/whitespace/unicode/empty + length
cap) and a config backward-compat assertion for username.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a reusable Divider canvas widget and place two in the room screen: a
vertical divider between the Participants and Controls panels (drag to resize
the Participants width) and a horizontal divider between the main row and the
Chat dock (drag to resize the dock height). The Participants panel and Chat dock
size from persisted config values; the Controls panel and main row fill the rest.
The widget reports drag motion as a pixel delta along its axis (mirroring the
GateMeter drag handling, so a drag continues past the thin strip). update()
applies the delta and clamps it: clamp_participants_width / clamp_chat_height
keep both sides of each divider above a minimum. Sizes are re-clamped on window
resize (window size tracked from window::Event::Resized) and clamped again on
load (a size saved under a different window could be out of range).
Persistence: participants_width / chat_height are new serde-default AppConfig
fields; the divider publishes PersistConfig on drag release so the final
position is written once (not per pixel). 3 clamp unit tests (incl. a tiny-window
degenerate case) + config backward-compat assertions for the new fields.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add room text chat riding the existing iroh-gossip topic (same layer as the
presence roster). New GossipMessage::Chat { name, text, ts }; the gossip loop
forwards it as RoomEvent::ChatMessage, core relays it to the UI as
UiEvent::ChatMessage, and RoomState::send_chat broadcasts an authored line
(display name from self-state, ms timestamp). CoreCommand::SendChat sends; our
own author is suppressed by the existing self-echo guard, so the UI echoes our
sent line locally instead.
UI: a full-width chat dock along the bottom of the room (the chosen layout) —
bottom-anchored scrollback with per-sender name colouring (green = you), an
input with Enter-to-send + a Send button, history capped at 300 lines. The room
window default grows to 900x760 so the dock doesn't squeeze the controls column.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Opt-in recording of the full call as you experienced it. New dep-free
src/audio/recorder.rs: a canonical mono S16LE WavWriter (header patched on
finalize) plus a Recorder that buffers your transmitted mic in a bounded FIFO
and sums it, sample-aligned, with each incoming-mix frame the playout mixer
produces. The two independently-clocked streams stay aligned via the FIFO
(capped at ~200ms so drift lag can't grow without bound); silent stretches
record the incoming mix alone. Dep-free UTC timestamp -> sortable filename.
Wiring: CoreCommand::SetRecording toggles an Arc<Mutex<Option<Recorder>>> gated
by an is_recording flag (so the capture/mixer hot paths only lock while actually
recording); capture pushes post-gate mic, the mixer writes the pre-deafen mix.
Recording finalizes on stop, room leave, and room switch. UI: a Record/Stop
button in the controls and a red "● REC m:ss" pill in the room header;
core-confirmed Recording{Started,Stopped} events drive the UI flag so a failed
start can't lie. Files land in ~/peerspeak-recordings/.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Ten more cases pinning the SoftLimiter contract (Gemini, senior-audited):
sustained-loud ceiling both polarities, out_gain participation (boost + atten),
instant-attack no-overshoot, release direction/monotonicity + gradualness,
cross-call state continuity (split == continuous), empty input, extreme
i32::MIN/MAX magnitudes, and bit-exact transparency just under the ceiling.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the mixer's per-sample hard clamp with a lossless i32 bus sum fed
through a feed-forward soft limiter (instant attack, ~120ms release). Below
the ceiling it's transparent and sample-exact; loud multi-peer moments are
ridden down to the ceiling instead of shattering into hard-clip distortion.
State carries across frames so a sustained-loud stretch doesn't re-attack
every 20ms frame. The master output gain now applies inside the limiter so a
boost past the ceiling is limited too.
mix_frames now returns the lossless i32 sum (saturation responsibility moved
to the limiter); its tests assert losslessness, and the new limiter module
carries the saturation/transparency/release guarantees.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add ARCHITECTURE.md Section 4 covering the jitter buffer's adaptive
playout delay: controller state/params, the grow/shrink/silence/overflow/
prime-timeout transitions, and a state diagram; note it in the Section 2
module map. Sections renumbered 4-7 -> 5-8 (no internal cross-refs).
Gemini-authored (junior) via the headless agy loop. Senior review caught +
fixed an inaccuracy: the original called the strategy "AIMD (multiplicative
decrease)" but the shrink is additive (-1, rate-limited by CLEAN_RUN_TO_SHRINK),
not multiplicative; reworded accordingly. Numbers fact-checked against
src/core/jitter.rs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two edge tests for the adaptive playout-delay controller:
- grown_target_requires_deeper_reprime: a disruption-grown target actually
gates the next re-prime (3 frames no longer enough once target is 4).
- overflow_resync_resets_clean_run: the MAX_BUFFERED overflow resync path
restarts the clean run.
Gemini-authored (junior), senior-reviewed against the real diff and
independently re-verified (cargo test --lib + clippy clean). Driven via the
headless agy --print --sandbox loop (resumed with --continue past the
orientation-tax timeout).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add two boundary assertions to format_duration_renders_mss_and_hmmss:
59s -> "0:59" (last second of m:ss form) and 3599s -> "59:59" (final
second before the output switches to h:mm:ss at 3600).
Gemini-authored (junior), senior-reviewed against the real diff and
independently re-verified (cargo test --lib + clippy clean). First task
driven through the headless `agy --print --sandbox` loop.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the fixed 3-frame (~60ms) playout delay with a feedback
controller that tunes depth to real network behavior, no wall clock
needed:
- Grow (+1 frame) on a late-arriving packet (one for a sequence already
played past) or a gap that forces Opus PLC — jitter beat the cushion.
- Shrink (-1 frame) after a long unbroken run of real frames — the link
is comfortably ahead. Fast grow, slow shrink (AIMD-style).
- Bounded to [2, 12] frames (40-240ms), well under MAX_BUFFERED_FRAMES.
- Benign silence (a talker pausing) emits none of these signals, so the
delay is untouched across quiet stretches — avoids the classic
"inflate delay because someone went quiet" bug.
- Prime-timeout safety net: since the mixer polls every ~20ms, prime
after ~500ms even under a grown target so a short utterance isn't held
forever and startup latency stays bounded.
No public API change; all logic stays in jitter.rs. Adds 8 unit tests
(grow/shrink, both bounds, silence-neutrality, prime timeout).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Covers the pure pw-cli parser seam: multi-node parse sorted by description
(non-audio dropped), Source=>input / Sink=>output, description-falls-back-
to-name, empty/non-audio inputs yield nothing, EOF-flush of the final block,
and incomplete blocks (no media.class) dropped. pw_cli tests 0 -> 6.
Implemented by Gemini per next-task.md; left uncommitted per the operating-
agreement default, reviewed against the real diff and re-verified (build +
clippy --all-targets + test all green) by the senior.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Splits the pw-cli output parsing out of enumerate_audio_devices into a pure
fn parse_pw_nodes(&str) -> Vec<AudioDevice> (with a push_device helper),
leaving only the subprocess call in enumerate_audio_devices. Behavior-
preserving — same id-block boundaries, Audio/* filter, Source=>input,
description-falls-back-to-name, and sort-by-description. Creates a testable
seam (the parsing had zero coverage). Build + clippy clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Enriches the in-room screen:
- Per-peer VU meters: a live level bar per peer card (reuses the per-peer
audio_levels stream), green while speaking, dim when idle/locally-muted.
- Your own mic meter on the self-card (reuses the in-call MicLevel), green
when transmitting, grey when muted or PTT-inactive.
- Per-peer local mute (🔊/🔇): silences a peer for you only — decoded so
their VU still moves, but not mixed. New CoreCommand::SetPeerMuted + a
locally_muted set in the core/mixer, distinct from per-peer volume.
- Header call-info: participant count + a live m:ss / h:mm:ss call timer
(dependency-free — rides the in-call event stream rather than a tick sub).
format_duration unit-tested. Build + clippy clean, 70 lib tests.
Field-verified on a real desktop<->dopedart call.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Covers the remaining state-transition edges: re-prime after an underrun goes
idle (must re-accumulate TARGET_DELAY_FRAMES, not resume on one packet),
duplicate-insert overwrite (no buffer growth), is_idle across fresh/buffering/
underrun, and overflow-resync when next_seq is already Some (playout head
snaps to the new front). Jitter tests 6 -> 10; test-only, no prod change.
Implemented by Gemini per next-task.md; left uncommitted per the operating-
agreement default, reviewed against the real diff and re-verified (build +
clippy --all-targets + test all green) by the senior.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds Discord-style app-internal gain controls under each device picker:
input volume scales the captured mic (applied before the meter/gate/encode,
so it also moves the mic meter), output volume scales the mixed playback
(on top of per-peer volumes). PeerSpeak-only — no system/other-app effect.
Both persist in config (input_volume/output_volume, serde default 1.0 for
backward compat) and read live by the audio loops via f32-bit atomics, so
they take effect mid-call. Sliders apply live on drag and save on release.
The standalone mic-test monitor applies the same input gain so the test
meter reflects it. Reuses the existing apply_volume helper (unity fast-path
+ i16 saturation).
Tests: config backward-compat + round-trip for the new fields (gain math
itself is covered by the existing apply_volume tests). 65 lib tests, clippy
clean. Field-verified: input slider moves the mic-test meter.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Covers the previously-untested branches of the NoiseGate envelope/timing:
frame_rms known values, empty-frame transmit-follows-state, disabled gate
parks the envelope open (no fade-in on re-enable), hold-window-then-release
ordering, sustained mid-level refreshes the hold, and a loud signal
re-opening a releasing gate. Gate tests 6 -> 12; test-only, no prod change.
Implemented by Gemini per next-task.md; reviewed against the real diff and
re-verified (build + clippy --all-targets + test all green) by the senior.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Extracts the peak-hold/throttle logic shared by the in-call capture thread
and run_mic_monitor into MicLevelMeter, and adds unit coverage:
- core: MicLevelMeter reports only after a full window, holds the window
peak, resets between windows, and reports zero for silence.
- app: GateMeter::x_to_threshold maps edges/midpoint correctly, clamps
out-of-bounds drags, and stays finite for a zero-width (pre-layout) bar.
9 new tests, all green; clippy clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds a mic input meter to Settings for gate calibration, replacing the
blind noise-gate slider with a unified Discord/OBS-style control: the bar
shows the live mic level and a draggable handle sets the gate threshold on
the same axis. Fill is green above the gate (transmitting), dim below it
(muted), with a live status word; the handle is bright red with a dark
edge so it stays legible when the green level sweeps past it.
Two level sources:
- In-call: the capture thread peak-holds the raw (pre-gate, pre-mute)
frame level and emits UiEvent::MicLevel ~10/sec.
- Off-call: a "Test mic" toggle runs CoreCommand::SetMicMonitor, spinning
up a standalone capture-only stream feeding run_mic_monitor. It shares
the backend's single capture stream, so Join tears it down first and
leaving Settings releases it; ignored while a session is active.
The gate handle drags live via NoiseGateDragging (no disk write per pixel)
and persists once on release via NoiseGateChanged. Meter axis is 0..0.3 so
a normal voice doesn't peg. Enables the iced "canvas" feature for the
custom GateMeter widget.
Build + clippy clean, tests pass. Field-verified on desktop.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Extend the mixer unit tests: pin apply_volume's as-i16 truncation-toward-zero
semantics (3*0.5 -> 1, -3*0.5 -> -1, not round-to-nearest), in-range amplify
without clamp, three-peer sum, mix_frames zero-padding when the output is
longer than every peer frame, and frame_level mid-range (constant 16384 ->
~0.5). Tests-only; no production change.
Implemented by Gemini (junior implementer), reviewed and verified by senior
(cargo build + clippy --all-targets + cargo test all green).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Pull the PeerConnecting/PeerConnected chime logic out of update()'s match
arms into two pure functions — reconnect_attempt_chime and reconnected_chime
— that own the connecting/ever_connected set transitions and return the
Option<Sound> to play, leaving the notify::play side effect in update.
Behavior-preserving; the full suite still passes.
Adds 4 #[cfg(test)] tests pinning the edge-trigger contract: a first dial is
silent, a reconnect attempt chimes exactly once and stays silent across the
supervisor's repeated redials, "reconnected" only fires after a prior link,
and a two-outage cycle chimes attempt->reconnected each time (per-outage, not
once-ever). Closes the last catalogued Tier B test gap.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add unit tests for the jitter buffer's untested pure logic: seq_before's
wrapping u32 comparison — basic ordering, the u32::MAX→0 forward wrap, and
the exact < (1<<31) half-range tipping point (0x7FFF_FFFF before, 0x8000_0000
not) — and insert's MAX_BUFFERED_FRAMES overflow path (caps depth, drops the
oldest frame, resyncs the playout head next_seq to the new front). Tests-only;
no production change.
Implemented by Gemini (junior implementer), reviewed and verified by senior
(cargo build + clippy --all-targets + cargo test all green).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Pull the audio mixer's inline math out of the async mixer-task closure into
three pure, testable functions — mix_frames (sample-by-sample sum with i16
saturation), apply_volume (per-peer scale + clamp, unity-skip fast path), and
frame_level (normalized RMS for the UI meter). Behavior-preserving: the loop
now calls them and the full suite still passes.
Adds 12 #[cfg(test)] unit tests, notably the saturation guards: a loud mix or
a volume boost clamps to i16::MAX/MIN rather than wrapping (a plain cast would
wrap a 2x-full-scale sum to a large negative value). Also covers sum, ragged
peer-frame lengths, no-peers silence, volume unity/zero/half, and RMS bounds.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add #[cfg(test)] coverage for the join-link codec and gossip wire format:
PeerSpeakTicket Display/FromStr round-trip and — the real gap —
malformed-input rejection (empty / non-base64 / valid-base64-non-JSON all
return NetError::InvalidTicket, never panic, since users paste untrusted
text here); PeerState serde round-trip; and GossipMessage::Leave /
Announce + GossipPayload round-trips. Tests-only; no production change.
Implemented by Gemini (junior implementer), reviewed and verified by senior
(cargo build + clippy --all-targets + cargo test all green).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add #[cfg(test)] coverage for src/codec/opus_impl.rs: encode→decode
round-trip shape + signal-energy survival, decoded duration follows the
packet, and the key regression guard — decode(None)/decode(Some(&[]))
conceals exactly frame_samples per channel (960 mono / 1920 stereo),
pinning the previously-fixed 120ms-burst PLC sizing bug. Tests-only; no
production behavior change.
Implemented by Gemini (junior implementer), reviewed and verified by senior
(cargo build + clippy --all-targets + cargo test all green).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
mollusk
