@desklink/host 0.1.0 → 0.1.1

package/engine/src/capture.rs

@@ -5,7 +5,7 @@
 //! Everything PipeWire lives on this module's own thread because its objects are
 //! not `Send`; frames and state changes leave through channels.
 
-use crate::convert::{to_i420, I420};
+use crate::convert::{to_i420, PixelFormat, I420};
 use crate::portal::{PortalSession, SelectedSource};
 use anyhow::{Context, Result};
 use pipewire as pw;
@@ -16,18 +16,7 @@ use std::os::fd::OwnedFd;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::{mpsc, Arc, Mutex};
 use std::thread::JoinHandle;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize)]
-#[serde(rename_all = "snake_case")]
-pub enum PixelFormat {
-    Bgrx,
-    Rgbx,
-    Bgra,
-    Rgba,
-    Bgr,
-    Rgb,
-    Unsupported,
-}
+use std::time::{Duration, Instant};
 
 impl PixelFormat {
     fn from_spa(raw: u32) -> Self {
@@ -55,7 +44,7 @@ pub struct StreamGeometry {
     pub buffer_type: String,
 }
 
-pub type FrameSink = Box<dyn Fn(I420, u64) + Send + 'static>;
+pub type FrameSink = Box<dyn Fn(I420, u64, Vec<u8>) + Send + 'static>;
 
 /// A running capture. Dropping it quits the PipeWire loop and joins its thread.
 pub struct Capture {
@@ -206,6 +195,8 @@ pub fn start(
     encoded_height: usize,
     max_fps: u32,
     sink: FrameSink,
+    indicator_position: Option<Arc<Mutex<Option<(i64, i64)>>>>,
+    on_stop: Box<dyn Fn(String) + Send>,
 ) -> Result<Capture> {
     let PortalSession { fd, source, .. } = session;
     let geometry = Arc::new(Mutex::new(None));
@@ -230,6 +221,8 @@ pub fn start(
                     encoded_height,
                     max_fps,
                     sink,
+                    indicator_position,
+                    on_stop,
                     geometry,
                     frames,
                     dropped,
@@ -275,6 +268,8 @@ fn run_loop(
     encoded_height: usize,
     max_fps: u32,
     sink: FrameSink,
+    indicator_position: Option<Arc<Mutex<Option<(i64, i64)>>>>,
+    on_stop: Box<dyn Fn(String) + Send>,
     geometry: Arc<Mutex<Option<StreamGeometry>>>,
     frames: Arc<AtomicU64>,
     dropped: Arc<AtomicU64>,
@@ -309,6 +304,8 @@ fn run_loop(
         format: None,
         buffer_type: String::from("unknown"),
         sink,
+        on_stop,
+        mask: indicator_position.map(IndicatorMask::new),
         geometry,
         frames,
         dropped,
@@ -319,6 +316,14 @@ fn run_loop(
     let mut ready = Some(ready);
     let _listener = stream
         .add_local_listener_with_user_data(&mut state)
+        .state_changed({ let main_loop = main_loop.clone(); move |_, state, old, new| {
+            let reason = match new {
+                pw::stream::StreamState::Error(message) => Some(format!("PipeWire stream stopped: {message}")),
+                pw::stream::StreamState::Unconnected if old == pw::stream::StreamState::Streaming => Some(String::from("PipeWire stream disconnected")),
+                _ => None,
+            };
+            if let Some(reason) = reason { (state.on_stop)(reason); main_loop.quit(); }
+        } })
         .param_changed(|_, state, id, param| {
             if id != pw::spa::param::ParamType::Format.as_raw() {
                 return;
@@ -378,8 +383,31 @@ fn run_loop(
             // second time and hand the encoder a frame it refuses whenever the
             // stream's size differs from the one the portal reported.
             let seq = state.frames.load(Ordering::Relaxed);
-            match to_i420(chunk_bytes, w, h, stride, format, state.box_w, state.box_h) {
-                Some(i420) => {
+            let raw = crate::convert::to_bgrx(
+                chunk_bytes,
+                w,
+                h,
+                stride,
+                format,
+                state.box_w,
+                state.box_h,
+            );
+            if let Some(mut raw) = raw {
+                let frame = if let Some(mask) = state.mask.as_mut() {
+                    mask.apply(&mut raw, state.box_w, state.box_h, w, h);
+                    to_i420(
+                        &raw,
+                        state.box_w,
+                        state.box_h,
+                        state.box_w * 4,
+                        PixelFormat::Bgrx,
+                        state.box_w,
+                        state.box_h,
+                    )
+                } else {
+                    to_i420(chunk_bytes, w, h, stride, format, state.box_w, state.box_h)
+                };
+                if let Some(i420) = frame {
                     if state.geometry.lock().map(|g| g.is_none()).unwrap_or(false) {
                         if let Ok(mut g) = state.geometry.lock() {
                             *g = Some(StreamGeometry {
@@ -393,7 +421,7 @@ fn run_loop(
                         }
                     }
                     state.frames.fetch_add(1, Ordering::Relaxed);
-                    (state.sink)(i420, seq);
+                    (state.sink)(i420, seq, raw);
                     // The first frame the loop actually delivers is the only
                     // proof capture started; sending this when `run_loop`
                     // returns would be after the main loop quits, too late for
@@ -401,10 +429,11 @@ fn run_loop(
                     if let Some(sender) = ready.take() {
                         let _ = sender.send(Ok(()));
                     }
-                }
-                None => {
+                } else {
                     state.dropped.fetch_add(1, Ordering::Relaxed);
                 }
+            } else {
+                state.dropped.fetch_add(1, Ordering::Relaxed);
             }
         })
         .register()
@@ -432,12 +461,116 @@ fn run_loop(
     Ok(())
 }
 
+// The portal composites layer-shell into its pixels. Keep the last clean
+// backing for the helper's bounded circle and edge strips before diff/encode;
+// the center stays live so a click marker at the caret remains observable.
+struct IndicatorMask {
+    position: Arc<Mutex<Option<(i64, i64)>>>,
+    clean: Option<Vec<u8>>,
+    last: Option<(i64, i64)>,
+    from: Option<(i64, i64)>,
+    moved_at: Option<Instant>,
+}
+
+impl IndicatorMask {
+    fn new(position: Arc<Mutex<Option<(i64, i64)>>>) -> Self {
+        Self {
+            position,
+            clean: None,
+            last: None,
+            from: None,
+            moved_at: None,
+        }
+    }
+
+    fn apply(
+        &mut self,
+        raw: &mut [u8],
+        width: usize,
+        height: usize,
+        source_w: usize,
+        source_h: usize,
+    ) {
+        let position = self.position.lock().ok().and_then(|value| *value);
+        if position != self.last {
+            self.from = self.last;
+            self.last = position;
+            self.moved_at = Some(Instant::now());
+        }
+        if let Some(clean) = self.clean.as_ref().filter(|clean| clean.len() == raw.len()) {
+            let x = position.map_or(-1000, |point| point.0 * width as i64 / source_w as i64);
+            let y = position.map_or(-1000, |point| point.1 * height as i64 / source_h as i64);
+            let from = self
+                .from
+                .filter(|_| {
+                    self.moved_at
+                        .is_some_and(|at| at.elapsed() < Duration::from_millis(800))
+                })
+                .map(|point| {
+                    (
+                        point.0 * width as i64 / source_w as i64,
+                        point.1 * height as i64 / source_h as i64,
+                    )
+                });
+            let radius = (150 * width / source_w).max(55) as i64;
+            let edge = (20 * width / source_w)
+                .max(8)
+                .min(width / 2)
+                .min(height / 2);
+            for row in 0..height {
+                let start = row * width * 4;
+                if row < edge || row + edge >= height {
+                    raw[start..start + width * 4].copy_from_slice(&clean[start..start + width * 4]);
+                    continue;
+                }
+                raw[start..start + edge * 4].copy_from_slice(&clean[start..start + edge * 4]);
+                let end = start + width * 4;
+                raw[end - edge * 4..end].copy_from_slice(&clean[end - edge * 4..end]);
+                let start_y = from.map_or(y, |point| y.min(point.1));
+                let end_y = from.map_or(y, |point| y.max(point.1));
+                if (row as i64) < start_y - radius || (row as i64) > end_y + radius {
+                    continue;
+                }
+                let start_x = from.map_or(x, |point| x.min(point.0));
+                let end_x = from.map_or(x, |point| x.max(point.0));
+                for col in (start_x - radius).max(0) as usize
+                    ..=(end_x + radius).min(width as i64 - 1).max(0) as usize
+                {
+                    let dx = col as i64 - x;
+                    let dy = row as i64 - y;
+                    let distance = dx * dx + dy * dy;
+                    let along = from.is_some_and(|(fx, fy)| {
+                        let vx = x - fx;
+                        let vy = y - fy;
+                        let projection = ((col as i64 - fx) * vx + (row as i64 - fy) * vy)
+                            .clamp(0, vx * vx + vy * vy);
+                        let length = vx * vx + vy * vy;
+                        let (cx, cy) = if length == 0 {
+                            (x, y)
+                        } else {
+                            (fx + projection * vx / length, fy + projection * vy / length)
+                        };
+                        (col as i64 - cx).pow(2) + (row as i64 - cy).pow(2) <= radius * radius
+                    });
+                    if (distance <= radius * radius || along) && distance > 16 {
+                        let at = start + col * 4;
+                        raw[at..at + 4].copy_from_slice(&clean[at..at + 4]);
+                    }
+                }
+            }
+        }
+        self.clean = Some(raw.to_vec());
+    }
+}
+
 struct StreamState {
     box_w: usize,
     box_h: usize,
     format: Option<PixelFormat>,
     buffer_type: String,
     sink: FrameSink,
+    on_stop: Box<dyn Fn(String) + Send>,
+    mask: Option<IndicatorMask>,
     geometry: Arc<Mutex<Option<StreamGeometry>>>,
     frames: Arc<AtomicU64>,
     dropped: Arc<AtomicU64>,
@@ -453,6 +586,23 @@ mod tests {
     use super::*;
     use std::time::Duration;
 
+    #[test]
+    fn layer_mask_keeps_click_center_and_removes_ring_and_edge() {
+        let position = Arc::new(Mutex::new(Some((50, 50))));
+        let mut mask = IndicatorMask::new(position.clone());
+        mask.apply(&mut vec![1; 100 * 100 * 4], 100, 100, 100, 100);
+        let mut frame = vec![2; 100 * 100 * 4];
+        mask.apply(&mut frame, 100, 100, 100, 100);
+        assert_eq!(frame[(50 * 100 + 50) * 4], 2);
+        assert_eq!(frame[(50 * 100 + 60) * 4], 1);
+        assert_eq!(frame[0], 1);
+        *position.lock().unwrap() = Some((75, 50));
+        let mut moved = vec![3; 100 * 100 * 4];
+        mask.apply(&mut moved, 100, 100, 100, 100);
+        assert_eq!(moved[(50 * 100 + 60) * 4], 1, "eased path is masked");
+        assert_eq!(moved[(50 * 100 + 75) * 4], 3, "click center remains live");
+    }
+
     #[test]
     fn dropping_capture_stops_and_joins_its_live_pipewire_loop() {
         // Exercise the real event-loop/channel lifetime without a portal,

package/engine/src/capture_mac.rs

@@ -0,0 +1,145 @@
+use crate::convert::{to_bgrx, to_i420, PixelFormat, I420};
+use crate::portal::PortalSession;
+use anyhow::{bail, Result};
+use std::ffi::{c_char, c_void, CStr};
+use std::sync::Mutex;
+
+pub type FrameSink = Box<dyn Fn(I420, u64, Vec<u8>) + Send + 'static>;
+
+struct State {
+    sink: FrameSink,
+    sequence: u64,
+    width: usize,
+    height: usize,
+    status: Box<dyn Fn(bool, String) + Send>,
+}
+
+pub struct Capture {
+    handle: *mut c_void,
+    state: *mut Mutex<State>,
+}
+
+unsafe impl Send for Capture {}
+
+#[link(name = "dlmacstream", kind = "static")]
+unsafe extern "C" {
+    fn dl_mac_stream_start(
+        display_id: u32,
+        width: usize,
+        height: usize,
+        fps: u32,
+        indicator_pid: u32,
+        context: *mut c_void,
+        callback: extern "C" fn(*mut c_void, *const u8, usize, usize, usize, usize),
+        status: extern "C" fn(*mut c_void, *const c_char, bool),
+        error: *mut c_char,
+        capacity: usize,
+    ) -> *mut c_void;
+    fn dl_mac_stream_stop(handle: *mut c_void) -> bool;
+}
+
+extern "C" fn stream_status(context: *mut c_void, reason: *const c_char, running: bool) {
+    let state = unsafe { &*(context as *const Mutex<State>) };
+    if let Ok(state) = state.lock() {
+        let reason = if reason.is_null() { String::from("stream stopped") }
+            else { unsafe { CStr::from_ptr(reason) }.to_string_lossy().into_owned() };
+        (state.status)(running, reason);
+    }
+}
+
+extern "C" fn receive_frame(
+    context: *mut c_void,
+    pixels: *const u8,
+    length: usize,
+    source_width: usize,
+    source_height: usize,
+    stride: usize,
+) {
+    if pixels.is_null()
+        || source_width == 0
+        || source_height == 0
+        || stride
+            .checked_mul(source_height)
+            .is_none_or(|bytes| bytes > length)
+    {
+        return;
+    }
+    let state = unsafe { &*(context as *const Mutex<State>) };
+    let Ok(mut state) = state.lock() else { return };
+    let source = unsafe { std::slice::from_raw_parts(pixels, length) };
+    let raw = to_bgrx(
+        source,
+        source_width,
+        source_height,
+        stride,
+        PixelFormat::Bgra,
+        state.width,
+        state.height,
+    );
+    let frame = to_i420(
+        source,
+        source_width,
+        source_height,
+        stride,
+        PixelFormat::Bgra,
+        state.width,
+        state.height,
+    );
+    if let (Some(frame), Some(raw)) = (frame, raw) {
+        (state.sink)(frame, state.sequence, raw);
+        state.sequence += 1;
+    }
+}
+
+impl Drop for Capture {
+    fn drop(&mut self) {
+        unsafe {
+            if dl_mac_stream_stop(self.handle) {
+                drop(Box::from_raw(self.state));
+            } // A timed-out stop may still deliver a callback; leak the context instead of a UAF.
+        }
+    }
+}
+
+pub fn start(
+    session: PortalSession,
+    width: usize,
+    height: usize,
+    max_fps: u32,
+    sink: FrameSink,
+    indicator_pid: Option<u32>,
+    status: Box<dyn Fn(bool, String) + Send>,
+) -> Result<Capture> {
+    let state = Box::into_raw(Box::new(Mutex::new(State {
+        sink,
+        sequence: 0,
+        width,
+        height,
+        status,
+    })));
+    let mut error = [0i8; 512];
+    let handle = unsafe {
+        dl_mac_stream_start(
+            session.source.node_id,
+            width,
+            height,
+            max_fps,
+            indicator_pid.unwrap_or(0),
+            state.cast(),
+            receive_frame,
+            stream_status,
+            error.as_mut_ptr(),
+            error.len(),
+        )
+    };
+    if handle.is_null() {
+        unsafe {
+            drop(Box::from_raw(state));
+        }
+        bail!(
+            "ScreenCaptureKit stream: {}",
+            unsafe { CStr::from_ptr(error.as_ptr()) }.to_string_lossy()
+        );
+    }
+    Ok(Capture { handle, state })
+}

package/engine/src/clipboard_mac.rs

@@ -0,0 +1,182 @@
+use anyhow::{bail, Result};
+use std::ffi::{CStr, CString};
+use std::os::raw::{c_char, c_void};
+
+pub const MAX_CLIPBOARD_BYTES: usize = 262_144;
+
+#[link(name = "AppKit", kind = "framework")]
+unsafe extern "C" {
+    fn NSApplicationLoad() -> bool;
+}
+
+#[link(name = "objc")]
+unsafe extern "C" {
+    fn objc_getClass(name: *const c_char) -> *mut c_void;
+    fn sel_registerName(name: *const c_char) -> *mut c_void;
+    fn objc_msgSend();
+}
+
+#[link(name = "CoreFoundation", kind = "framework")]
+unsafe extern "C" {
+    fn CFRelease(value: *const c_void);
+}
+
+type Obj = *mut c_void;
+type Sel = *mut c_void;
+
+struct Pool(Obj);
+impl Pool {
+    fn new() -> Result<Self> {
+        let name = CString::new("NSAutoreleasePool").unwrap();
+        let class = unsafe { objc_getClass(name.as_ptr()) };
+        anyhow::ensure!(!class.is_null(), "AppKit autorelease pool is unavailable");
+        let allocated = send0(class, "alloc");
+        let pool = send0(allocated, "init");
+        anyhow::ensure!(!pool.is_null(), "could not create AppKit autorelease pool");
+        Ok(Self(pool))
+    }
+}
+impl Drop for Pool {
+    fn drop(&mut self) {
+        send0_void(self.0, "drain");
+    }
+}
+
+fn selector(name: &str) -> Sel {
+    let name = CString::new(name).expect("selector has no nul byte");
+    unsafe { sel_registerName(name.as_ptr()) }
+}
+
+fn send0(receiver: Obj, name: &str) -> Obj {
+    let function: unsafe extern "C" fn(Obj, Sel) -> Obj =
+        unsafe { std::mem::transmute(objc_msgSend as *const ()) };
+    unsafe { function(receiver, selector(name)) }
+}
+
+fn send0_void(receiver: Obj, name: &str) {
+    let function: unsafe extern "C" fn(Obj, Sel) =
+        unsafe { std::mem::transmute(objc_msgSend as *const ()) };
+    unsafe { function(receiver, selector(name)) }
+}
+
+fn send0_integer(receiver: Obj, name: &str) -> isize {
+    let function: unsafe extern "C" fn(Obj, Sel) -> isize =
+        unsafe { std::mem::transmute(objc_msgSend as *const ()) };
+    unsafe { function(receiver, selector(name)) }
+}
+
+fn send1_object(receiver: Obj, name: &str, argument: Obj) -> Obj {
+    let function: unsafe extern "C" fn(Obj, Sel, Obj) -> Obj =
+        unsafe { std::mem::transmute(objc_msgSend as *const ()) };
+    unsafe { function(receiver, selector(name), argument) }
+}
+
+fn send2_object(receiver: Obj, name: &str, first: Obj, second: Obj) -> bool {
+    let function: unsafe extern "C" fn(Obj, Sel, Obj, Obj) -> bool =
+        unsafe { std::mem::transmute(objc_msgSend as *const ()) };
+    unsafe { function(receiver, selector(name), first, second) }
+}
+
+fn pasteboard() -> Result<Obj> {
+    let _ = unsafe { NSApplicationLoad() };
+    let class_name = CString::new("NSPasteboard").unwrap();
+    let class = unsafe { objc_getClass(class_name.as_ptr()) };
+    anyhow::ensure!(!class.is_null(), "AppKit NSPasteboard is unavailable");
+    let board = send0(class, "generalPasteboard");
+    anyhow::ensure!(
+        !board.is_null(),
+        "macOS did not provide the general pasteboard"
+    );
+    Ok(board)
+}
+
+fn string_type() -> Result<Obj> {
+    let class_name = CString::new("NSString").unwrap();
+    let class = unsafe { objc_getClass(class_name.as_ptr()) };
+    let allocated = send0(class, "alloc");
+    let utf8 = CString::new("public.utf8-plain-text").unwrap();
+    let function: unsafe extern "C" fn(Obj, Sel, *const c_char) -> Obj =
+        unsafe { std::mem::transmute(objc_msgSend as *const ()) };
+    let value = unsafe { function(allocated, selector("initWithUTF8String:"), utf8.as_ptr()) };
+    anyhow::ensure!(!value.is_null(), "could not create pasteboard type");
+    Ok(value)
+}
+
+fn nsstring(text: &str) -> Result<Obj> {
+    let class_name = CString::new("NSString").unwrap();
+    let class = unsafe { objc_getClass(class_name.as_ptr()) };
+    let allocated = send0(class, "alloc");
+    let chars: Vec<u16> = text.encode_utf16().collect();
+    let function: unsafe extern "C" fn(Obj, Sel, *const u16, usize) -> Obj =
+        unsafe { std::mem::transmute(objc_msgSend as *const ()) };
+    let value = unsafe {
+        function(
+            allocated,
+            selector("initWithCharacters:length:"),
+            chars.as_ptr(),
+            chars.len(),
+        )
+    };
+    anyhow::ensure!(!value.is_null(), "could not create clipboard text");
+    Ok(value)
+}
+
+pub fn write(text: &str) -> Result<()> {
+    let _pool = Pool::new()?;
+    let board = pasteboard()?;
+    let kind = string_type()?;
+    anyhow::ensure!(
+        text.len() <= MAX_CLIPBOARD_BYTES,
+        "refusing to place {} bytes on the clipboard",
+        text.len()
+    );
+    let value = nsstring(text)?;
+    let _ = send0_integer(board, "clearContents");
+    let written = send2_object(board, "setString:forType:", value, kind);
+    unsafe {
+        CFRelease(value);
+        CFRelease(kind);
+    }
+    if !written {
+        bail!("NSPasteboard refused the text clipboard value");
+    }
+    Ok(())
+}
+
+pub fn read_or_explain() -> Result<(String, bool), String> {
+    let _pool = Pool::new().map_err(|error| format!("{error:#}"))?;
+    let board = pasteboard().map_err(|error| format!("{error:#}"))?;
+    let kind = string_type().map_err(|error| format!("{error:#}"))?;
+    let value = send1_object(board, "stringForType:", kind);
+    unsafe {
+        CFRelease(kind);
+    }
+    if value.is_null() {
+        return Ok((String::new(), false));
+    }
+    let length_fn: unsafe extern "C" fn(Obj, Sel) -> usize =
+        unsafe { std::mem::transmute(objc_msgSend as *const ()) };
+    let length = unsafe { length_fn(value, selector("length")) };
+    let mut truncated = length > MAX_CLIPBOARD_BYTES;
+    let text_value = if truncated {
+        let substring_fn: unsafe extern "C" fn(Obj, Sel, usize) -> Obj =
+            unsafe { std::mem::transmute(objc_msgSend as *const ()) };
+        unsafe { substring_fn(value, selector("substringToIndex:"), MAX_CLIPBOARD_BYTES) }
+    } else {
+        value
+    };
+    let utf8 = send0(text_value, "UTF8String").cast::<c_char>();
+    let text = if utf8.is_null() {
+        String::new()
+    } else {
+        unsafe { CStr::from_ptr(utf8) }
+            .to_string_lossy()
+            .into_owned()
+    };
+    let mut end = text.len().min(MAX_CLIPBOARD_BYTES);
+    truncated |= end < text.len();
+    while !text.is_char_boundary(end) {
+        end -= 1;
+    }
+    Ok((text[..end].to_owned(), truncated))
+}

package/engine/src/convert.rs

@@ -5,7 +5,17 @@
 //! downscale is the correct filter when the encoded surface is smaller than the
 //! source — it is the only one that does not alias the desktop's text.
 
-use crate::capture::PixelFormat;
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PixelFormat {
+    Bgrx,
+    Rgbx,
+    Bgra,
+    Rgba,
+    Bgr,
+    Rgb,
+    Unsupported,
+}
 
 /// A tightly packed I420 frame; the plane strides are the frame width/2 so the
 /// buffer is exactly what `vpx_image_t` wants when we hand libvpx three planes.
@@ -84,6 +94,39 @@ fn layout(format: PixelFormat) -> Option<(usize, [usize; 3])> {
     }
 }
 
+/// A tightly packed pre-encode BGRX frame for still observations. At native
+/// resolution this copies each source colour exactly; a smaller encode box
+/// necessarily samples down to the geometry input uses.
+pub fn to_bgrx(
+    src: &[u8],
+    src_w: usize,
+    src_h: usize,
+    stride: usize,
+    format: PixelFormat,
+    width: usize,
+    height: usize,
+) -> Option<Vec<u8>> {
+    let (bytes, rgb) = layout(format)?;
+    let mut out = Vec::with_capacity(width * height * 4);
+    if matches!(format, PixelFormat::Bgrx | PixelFormat::Bgra) && width == src_w && height == src_h
+    {
+        for row in 0..height {
+            out.extend_from_slice(src.get(row * stride..row * stride + width * 4)?);
+        }
+        return Some(out);
+    }
+    for y in 0..height {
+        for x in 0..width {
+            let sx = x * src_w / width;
+            let sy = y * src_h / height;
+            let at = sy * stride + sx * bytes;
+            let pixel = src.get(at..at + bytes)?;
+            out.extend_from_slice(&[pixel[rgb[2]], pixel[rgb[1]], pixel[rgb[0]], 255]);
+        }
+    }
+    Some(out)
+}
+
 /// How many threads convert one frame. A 4K desktop is 8 million pixels, which
 /// one core converts in tens of milliseconds, the whole budget of a frame; a few
 /// bands bring that under the encoder's own cost without taking the machine.
@@ -292,6 +335,19 @@ mod tests {
         assert_eq!((out.width, out.height), (1702, 1064));
     }
 
+    #[test]
+    fn still_pixels_keep_exact_source_colours_before_encoding() {
+        let src = [1, 2, 3, 0, 4, 5, 6, 0];
+        assert_eq!(
+            to_bgrx(&src, 2, 1, 8, PixelFormat::Bgrx, 2, 1).unwrap(),
+            src
+        );
+        assert_eq!(
+            to_bgrx(&src, 2, 1, 8, PixelFormat::Rgbx, 2, 1).unwrap(),
+            [3, 2, 1, 255, 6, 5, 4, 255]
+        );
+    }
+
     #[test]
     fn unsupported_format_is_reported_not_guessed() {
         assert!(to_i420(&vec![0u8; 64], 4, 4, 16, PixelFormat::Unsupported, 2, 2).is_none());