Go to file

dailz 9a5b09cd7f fix(security): harden token file permissions (closes #2 )

- save_restore_token: use create_new(true) + mode(0o600) for exclusive
  atomic file creation, preventing symlink attacks and predictable
  temp file exploitation
- token_path: return Option, eliminate insecure /tmp fallback
- load_restore_token: reject insecure files (symlinks, wrong owner,
  group/world-readable permissions)
- Directory creation uses DirBuilderExt::mode(0o700) bypassing umask
- Added verify_secure_dir and ensure_secure_parent with full metadata
  validation (owner, permissions, symlink rejection)
- Added 11 regression tests covering all security scenarios

2026-06-06 11:05:00 +08:00

.sisyphus/evidence

chore: add .sisyphus/ to .gitignore, remove committed BUGS.md

2026-05-25 08:56:21 +08:00

docs/superpowers

fix: resolve 4 audit bugs (PTS, WlOutput, first_frame, DRM minor)

2026-04-06 16:25:02 +08:00

examples

fix(backend_detect): use raw zbus for portal check to avoid OnceLock connection poisoning

2026-05-27 22:07:11 +08:00

src

fix(security): harden token file permissions (closes #2 )

2026-06-06 11:05:00 +08:00

tests

feat: add KWin/KDE Plasma screen capture via xdg-desktop-portal ScreenCast + PipeWire

2026-05-11 08:49:08 +08:00

.gitignore

chore: add .sisyphus/ to .gitignore, remove committed BUGS.md

2026-05-25 08:56:21 +08:00

analysis.md

feat: Phase 1 MVP with audit fixes — Wayland screen capture + VAAPI encoding

2026-04-05 23:35:00 +08:00

build.rs

feat: Phase 1 MVP with audit fixes — Wayland screen capture + VAAPI encoding

2026-04-05 23:35:00 +08:00

Cargo.lock

fix(security): harden token file permissions (closes #2 )

2026-06-06 11:05:00 +08:00

Cargo.toml

fix(security): harden token file permissions (closes #2 )

2026-06-06 11:05:00 +08:00

README.md

feat: Phase 1 MVP with audit fixes — Wayland screen capture + VAAPI encoding

2026-04-05 23:35:00 +08:00

shell.nix

feat: Phase 1 MVP with audit fixes — Wayland screen capture + VAAPI encoding

2026-04-05 23:35:00 +08:00

README.md

wl-webrtc

Wayland screen capture and encoding tool.

Prerequisites

Rust toolchain (1.70+): rustup default stable
FFmpeg 6.0+ dev libraries with VAAPI support:
- Arch: pacman -S ffmpeg
- Ubuntu/Debian: apt install libavcodec-dev libavformat-dev libavutil-dev libswscale-dev libva-dev
- Fedora: dnf install ffmpeg-devel libva-devel
Wayland dev libraries:
- Arch: pacman -S wayland-protocols
- Ubuntu/Debian: apt install libwayland-dev wayland-protocols
- Fedora: dnf install wayland-devel wayland-protocols-devel
DRM dev libraries:
- Arch: pacman -S libdrm
- Ubuntu/Debian: apt install libdrm-dev
- Fedora: dnf install libdrm-devel

Build

cargo build --release

Run

# Basic capture to file
wl-webrtc --output output.mp4

# With custom FPS and bitrate
wl-webrtc --output output.mp4 --fps 60 --bitrate 8000000

# Specify DRM device for hardware encoding
wl-webrtc --output output.mp4 --drm-device /dev/dri/renderD128

# Verbose mode
wl-webrtc --output output.mp4 -v

CLI Arguments

Argument	Default	Description
`-o`, `--output`	(required)	Output file path (e.g., output.mp4)
`--output-name`	auto	Wayland output name to capture
`--fps`	30	Target frames per second
`--codec`	h264	Video codec (h264 only for MVP)
`--hw-accel`	vaapi	Hardware acceleration method
`--drm-device`	auto	DRM render device path
`--bitrate`	auto	Target bitrate in bps
`--gop-size`	auto	Group of Pictures size
`-v`, `--verbose`	false	Enable verbose logging
`--port`	0	WebTransport server port (unused in MVP)