@desklink/host 0.5.2 → 0.5.4

package/engine/src/keymap.rs

@@ -254,110 +254,3 @@ impl Layout {
         (plan, unreachable)
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_layout_that_comes_from_the_environment_is_the_one_compiled() {
-        let names = LayoutNames::from_lookup(|key| match key {
-            "XKB_DEFAULT_LAYOUT" => Some(String::from("de")),
-            _ => None,
-        });
-        assert_eq!(names.identity(), "de");
-
-        let layout = Layout::from_names(&names).expect("the German keymap should compile");
-        let (plan, unreachable) = layout.plan_text("z");
-        assert!(
-            unreachable.is_empty(),
-            "z should be reachable: {unreachable:?}"
-        );
-        // QWERTZ puts z where a US layout puts y, so the compiled keymap is the
-        // environment's, not the library default.
-        assert_eq!(plan[0][0].code, 21, "z must sit on the y key position");
-    }
-
-    #[test]
-    fn a_session_with_no_layout_variable_reports_the_library_default() {
-        assert_eq!(LayoutNames::from_lookup(|_| None).identity(), "us");
-    }
-
-    #[test]
-    fn a_character_is_planned_as_a_real_key_event_on_the_compiled_layout() {
-        let layout = Layout::from_names(&LayoutNames::from_lookup(|_| None))
-            .expect("a keymap should compile");
-        let (plan, unreachable) = layout.plan_text("aA.\n");
-        assert!(
-            unreachable.is_empty(),
-            "ASCII should be reachable: {unreachable:?}"
-        );
-        assert_eq!(plan.len(), 4);
-        assert!(!plan[0][0].shift, "lower-case a needs no shift");
-        assert!(
-            plan[1][0].shift,
-            "upper-case A needs shift on any normal layout"
-        );
-        assert_eq!(plan[0][0].code, plan[1][0].code, "both letters share a key");
-        // The plan is evdev, but the real injector expects Moonlight/VK codes.
-        // Passing Linux N (49) straight through instead presses VK_1.
-        let native: Vec<_> = plan
-            .iter()
-            .flatten()
-            .map(|stroke| crate::input::native_keycode(stroke.code).unwrap())
-            .collect();
-        assert_eq!(native, [0x41, 0x41, 0xBE, 0x0D]);
-        assert_eq!(
-            crate::input::native_keycode(plan[1][0].modifiers()[0]).unwrap(),
-            0x10
-        );
-        assert_eq!(
-            crate::input::native_keycode(modifier_key("Control").unwrap()).unwrap(),
-            0x11
-        );
-    }
-
-    #[test]
-    fn named_keys_and_modifiers_resolve_to_linux_key_codes() {
-        assert_eq!(named_key("Enter").unwrap().code, keycode::ENTER);
-        assert_eq!(named_key("ArrowLeft").unwrap().code, keycode::LEFT);
-        for (name, code) in [
-            ("Delete", keycode::DELETE), ("Home", keycode::HOME), ("End", keycode::END),
-            ("PageUp", keycode::PAGE_UP), ("PageDown", keycode::PAGE_DOWN),
-            ("F1", keycode::F1), ("F2", keycode::F2), ("F3", keycode::F3),
-            ("F4", keycode::F4), ("F5", keycode::F5), ("F6", keycode::F6),
-            ("F7", keycode::F7), ("F8", keycode::F8), ("F9", keycode::F9),
-            ("F10", keycode::F10), ("F11", keycode::F11), ("F12", keycode::F12),
-        ] {
-            assert_eq!(named_key(name).unwrap().code, code);
-            assert!(crate::input::native_keycode(code).is_ok(), "{name} must reach inputtino");
-        }
-        assert_eq!(modifier_key("Control"), Some(keycode::LEFT_CTRL));
-        assert_eq!(modifier_key("Alt"), Some(keycode::LEFT_ALT));
-        assert_eq!(modifier_key("Super"), Some(keycode::LEFT_META));
-        assert!(named_key("Frobnicate").is_none());
-        assert!(modifier_key("Hyper").is_none());
-    }
-
-    #[test]
-    fn text_this_layout_cannot_produce_is_reported_not_invented() {
-        let layout = Layout::from_environment().unwrap();
-        let (_, unreachable) = layout.plan_text("\u{1F600}");
-        assert_eq!(unreachable, "\u{1F600}");
-    }
-
-    #[test]
-    fn a_symbol_only_reachable_beyond_four_levels_is_refused() {
-        let names = LayoutNames::from_lookup(|key| match key {
-            "XKB_DEFAULT_LAYOUT" => Some(String::from("de")),
-            "XKB_DEFAULT_VARIANT" => Some(String::from("neo")),
-            _ => None,
-        });
-        let layout = Layout::from_names(&names).expect("the Neo keymap should compile");
-        assert!(
-            layout.keystroke_for_char('\u{a3}').is_none(),
-            "the pound sign sits on a level this engine cannot press"
-        );
-        assert!(layout.keystroke_for_char('6').is_some());
-    }
-}

package/engine/src/keymap_mac.rs

@@ -182,28 +182,3 @@ fn us_ansi_key(character: char) -> Option<(i16, bool)> {
         _ => return None,
     })
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn maps_common_ascii_to_ansi_virtual_keys() {
-        let layout = Layout::from_environment().unwrap();
-        let lower = layout.keystroke_for_char('a').unwrap();
-        let upper = layout.keystroke_for_char('A').unwrap();
-        assert_eq!(lower.code, 0);
-        assert_eq!(upper.code, lower.code);
-        assert!(upper.shift);
-        assert_eq!(layout.keystroke_for_char('!').unwrap().code, 18);
-        assert!(layout.keystroke_for_char('\u{1f600}').is_none());
-    }
-
-    #[test]
-    fn resolves_mac_named_keys_and_modifiers() {
-        assert_eq!(named_key("Return").unwrap().code, 36);
-        assert_eq!(named_key("ArrowLeft").unwrap().code, 123);
-        assert_eq!(modifier_key("Command"), Some(55));
-        assert!(named_key("Frobnicate").is_none());
-    }
-}

package/engine/src/mac.rs

@@ -717,31 +717,3 @@ pub fn run() -> i32 {
     }
     0
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[cfg(desklink_vpx)]
-    #[test]
-    fn session_capabilities_are_non_prompting_and_expose_mac_features() {
-        let value = crate::session::capabilities();
-        assert_eq!(value["protocol"], crate::protocol::PROTOCOL_VERSION);
-        assert_eq!(value["platform"], "macos");
-        assert_eq!(value["capture"]["mechanism"], "screencapturekit");
-        assert_eq!(value["encode"]["codecs"][0], "vp9", "VP9 is always offered");
-        // Every Mac this engine runs on has a hardware H.264 encoder.
-        assert_eq!(value["encode"]["codecs"][1], "h264");
-        assert_eq!(value["encode"]["h264"]["encoder"], "videotoolbox");
-        assert!(value["capture"]["displays"].is_array());
-        assert!(value["clipboard"]["read"].as_bool().unwrap());
-        assert!(matches!(
-            value["capture"]["grant"].as_str(),
-            Some("granted" | "missing-screen-recording")
-        ));
-        assert!(matches!(
-            value["input"]["grant"].as_str(),
-            Some("granted" | "missing-accessibility")
-        ));
-    }
-}

package/engine/src/main.rs

@@ -728,8 +728,9 @@ async fn dispatch(
             Ok(serde_json::json!({ "accepted": true }))
         }
         "session.restart_ice" => {
-            // The client asks; the engine offers. The fresh offer travels as a
-            // new `session.description` event and the client answers it as
+            // The client asks; the engine offers. The offer — fresh, or the
+            // still-pending one when restarts queue — travels as a new
+            // `session.description` event and the client answers it as
             // usual, so no new event shape is needed and the session,
             // generation and control channel survive.
             let session = require_session(current)?;

package/engine/src/peer.rs

@@ -1008,11 +1008,17 @@ impl VideoPeer {
         Ok(applied)
     }
 
-    /// Restart ICE on this peer: a fresh offer with a new ICE generation,
+    /// Restart ICE on this peer, reusing any unanswered local offer; otherwise
+    /// create a fresh offer with a new ICE generation,
     /// for the client to answer as usual. The engine stays the offerer, so
     /// this is the same local-offer path as the initial negotiation.
     pub async fn restart_ice(&self) -> Result<String> {
         use rtc::peer_connection::configuration::RTCOfferOptions;
+        // The stdio dispatcher serializes requests; overlapping carriers must
+        // answer this offer before another restart can turn over credentials.
+        if let Some(offer) = self.peer.pending_local_description().await {
+            return Ok(offer.sdp);
+        }
         let offer = self
             .peer
             .create_offer(Some(RTCOfferOptions {
@@ -1147,6 +1153,7 @@ fn lock<T>(mutex: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
 #[cfg(test)]
 pub(crate) mod tests {
     use super::*;
+    use webrtc::media_stream::track_remote::{TrackRemote, TrackRemoteEvent};
 
     #[test]
     fn a_standing_queue_is_measured_and_one_frames_burst_is_not() {
@@ -1583,6 +1590,229 @@ pub(crate) mod tests {
             .expect("the restart answer is accepted");
     }
 
+    /// A receiver peer that records when each inbound RTP packet arrives and
+    /// reports its own ICE candidates, so two peers can really connect.
+    struct MediaReceiver {
+        candidates: tokio::sync::mpsc::UnboundedSender<RTCIceCandidateInit>,
+        arrivals: Arc<Mutex<Vec<Instant>>>,
+        connected: Arc<AtomicBool>,
+    }
+
+    #[async_trait::async_trait]
+    impl PeerConnectionEventHandler for MediaReceiver {
+        async fn on_ice_candidate(&self, event: RTCPeerConnectionIceEvent) {
+            if let Ok(init) = event.candidate.to_json() {
+                let _ = self.candidates.send(init);
+            }
+        }
+
+        async fn on_connection_state_change(&self, state: RTCPeerConnectionState) {
+            self.connected.store(
+                matches!(state, RTCPeerConnectionState::Connected),
+                Ordering::SeqCst,
+            );
+        }
+
+        async fn on_track(&self, track: Arc<dyn TrackRemote>) {
+            let arrivals = Arc::clone(&self.arrivals);
+            tokio::spawn(async move {
+                while let Some(event) = track.poll().await {
+                    if matches!(event, TrackRemoteEvent::OnRtpPacket(_)) {
+                        arrivals.lock().unwrap().push(Instant::now());
+                    }
+                }
+            });
+        }
+    }
+
+    async fn media_receiver(receiver: Arc<MediaReceiver>) -> Arc<dyn PeerConnection> {
+        let mut media_engine = MediaEngine::default();
+        media_engine
+            .register_codec(vp9_codec(), RtpCodecKind::Video)
+            .expect("the codec registers");
+        let registry = register_default_interceptors(Registry::new(), &mut media_engine)
+            .expect("interceptors register");
+        let peer = PeerConnectionBuilder::<std::net::SocketAddr>::new()
+            .with_media_engine(media_engine)
+            .with_interceptor_registry(registry)
+            .with_runtime(default_runtime().expect("a runtime"))
+            .with_handler(receiver)
+            .with_udp_addrs(vec![std::net::SocketAddr::from(([0, 0, 0, 0], 0))])
+            .build()
+            .await
+            .expect("a receiving peer");
+        Arc::new(peer)
+    }
+
+    /// A restart offer/answer round must not interrupt media already flowing on
+    /// the selected pair: the picture keeps advancing (no gap over 200 ms) while
+    /// the old pair stays reachable, and the ICE generation still turns over.
+    #[tokio::test]
+    async fn a_restart_keeps_media_flowing_on_the_selected_pair_until_the_new_one_nominates() {
+        let (events, mut events_rx) = tokio::sync::mpsc::unbounded_channel();
+        let (engine, offer) = VideoPeer::offer(transport(), events, VideoCodec::Vp9)
+            .await
+            .expect("an offering peer");
+        let engine = Arc::new(engine);
+
+        let arrivals: Arc<Mutex<Vec<Instant>>> = Arc::new(Mutex::new(Vec::new()));
+        let connected = Arc::new(AtomicBool::new(false));
+        let (client_candidates_tx, mut client_candidates_rx) =
+            tokio::sync::mpsc::unbounded_channel();
+        let receiver = Arc::new(MediaReceiver {
+            candidates: client_candidates_tx,
+            arrivals: Arc::clone(&arrivals),
+            connected: Arc::clone(&connected),
+        });
+        let client = media_receiver(Arc::clone(&receiver)).await;
+
+        client
+            .set_remote_description(RTCSessionDescription::offer(offer.clone()).expect("an offer"))
+            .await
+            .expect("the offer applies");
+        let answer = client.create_answer(None).await.expect("an answer");
+        client
+            .set_local_description(answer.clone())
+            .await
+            .expect("a local answer");
+        engine
+            .accept_answer(answer.sdp.clone())
+            .await
+            .expect("the answer is accepted");
+
+        // The engine's candidates reach the client.
+        let client_for_engine_candidates = Arc::clone(&client);
+        tokio::spawn(async move {
+            while let Some(event) = events_rx.recv().await {
+                if let PeerEvent::Candidate {
+                    candidate,
+                    sdp_mid,
+                    sdp_m_line_index,
+                } = event
+                {
+                    let _ = client_for_engine_candidates
+                        .add_ice_candidate(RTCIceCandidateInit {
+                            candidate,
+                            sdp_mid,
+                            sdp_mline_index: sdp_m_line_index,
+                            username_fragment: None,
+                            url: None,
+                        })
+                        .await;
+                }
+            }
+        });
+        // The client's candidates reach the engine.
+        let engine_for_client_candidates = Arc::clone(&engine);
+        tokio::spawn(async move {
+            while let Some(init) = client_candidates_rx.recv().await {
+                let _ = engine_for_client_candidates
+                    .add_candidate(init.candidate, init.sdp_mid, init.sdp_mline_index)
+                    .await;
+            }
+        });
+
+        // Wait for the ICE path to come up on both ends.
+        let deadline = Instant::now() + Duration::from_secs(5);
+        while !(engine.is_connected() && connected.load(Ordering::SeqCst)) {
+            assert!(Instant::now() < deadline, "the peers never connected");
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+
+        // Any bytes the VP9 packetizer turns into one access unit.
+        let frame: Vec<u8> = (0..200u32).map(|i| (i % 251) as u8).collect();
+        let sending = Arc::new(AtomicBool::new(true));
+        let engine_for_sending = Arc::clone(&engine);
+        let sending_for_task = Arc::clone(&sending);
+        let frame_for_task = frame.clone();
+        tokio::spawn(async move {
+            while sending_for_task.load(Ordering::SeqCst) {
+                let _ = engine_for_sending
+                    .send_frame(&frame_for_task, true, Instant::now())
+                    .await;
+                tokio::time::sleep(Duration::from_millis(5)).await;
+            }
+        });
+
+        // Let the picture flow, then take a clean baseline.
+        tokio::time::sleep(Duration::from_millis(300)).await;
+        arrivals.lock().unwrap().clear();
+        tokio::time::sleep(Duration::from_millis(200)).await;
+        let flowing = arrivals.lock().unwrap().len();
+        assert!(
+            flowing >= 5,
+            "media was not flowing before the restart: {flowing} packets"
+        );
+
+        // The restart a client drives when its carrier comes back on a roam.
+        let restart = engine.restart_ice().await.expect("a restart offer");
+        let ufrag = |sdp: &str| {
+            sdp.lines()
+                .find_map(|line| line.strip_prefix("a=ice-ufrag:"))
+                .expect("ICE credentials")
+                .to_owned()
+        };
+        assert_ne!(
+            ufrag(&restart),
+            ufrag(&offer),
+            "the restart must turn the ICE generation over"
+        );
+
+        let restart_at = Instant::now();
+        arrivals.lock().unwrap().clear();
+
+        // The restart offer crosses the consumer's signaling channel before the
+        // client answers, and the engine applies the restart at
+        // `set_local_description` — inside `restart_ice` above, before the offer
+        // has even left. It must keep feeding media on the old pair for that
+        // whole round trip, not only until its own teardown. A real channel
+        // costs more than a loopback hop, so hold this window for the bar's
+        // length: a teardown shows up here, a preserved pair does not.
+        tokio::time::sleep(Duration::from_millis(300)).await;
+
+        client
+            .set_remote_description(RTCSessionDescription::offer(restart).expect("a restart offer"))
+            .await
+            .expect("the restart offer applies");
+        let reanswer = client.create_answer(None).await.expect("an answer");
+        client
+            .set_local_description(reanswer.clone())
+            .await
+            .expect("a local answer");
+        engine
+            .accept_answer(reanswer.sdp)
+            .await
+            .expect("the restart answer is accepted");
+
+        // Keep the picture advancing across and after the restart.
+        tokio::time::sleep(Duration::from_millis(800)).await;
+        sending.store(false, Ordering::SeqCst);
+
+        let stamps = arrivals.lock().unwrap().clone();
+        assert!(
+            !stamps.is_empty(),
+            "no media arrived at all after the restart"
+        );
+        let mut previous = restart_at;
+        let mut worst = Duration::ZERO;
+        for stamp in &stamps {
+            worst = worst.max(stamp.duration_since(previous));
+            previous = *stamp;
+        }
+        eprintln!(
+            "restart: {} packets after the offer, worst media gap {worst:?}",
+            stamps.len()
+        );
+        assert!(
+            worst < Duration::from_millis(200),
+            "media stalled for {worst:?} through the restart: {:?}",
+            stamps
+        );
+
+        engine.close().await;
+        let _ = client.close().await;
+    }
+
     #[tokio::test]
     async fn a_forwarded_client_is_offered_ice_over_tcp_on_the_loopback() {
         let offered = |loopback_tcp: bool| async move {

package/engine/src/portal.rs

@@ -142,21 +142,3 @@ fn choose_cursor_mode(available: BitFlags<CursorMode>) -> Result<CursorMode> {
         .find(|mode| available.contains(*mode))
         .context("cursor-unavailable: portal cannot leave the cursor out of capture")
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    #[test]
-    fn hidden_takes_any_cursor_free_mode_and_refuses_embedded_only_portals() {
-        assert_eq!(
-            choose_cursor_mode(CursorMode::Metadata | CursorMode::Hidden).unwrap(),
-            CursorMode::Hidden
-        );
-        assert_eq!(
-            choose_cursor_mode(CursorMode::Metadata.into()).unwrap(),
-            CursorMode::Metadata
-        );
-        let error = choose_cursor_mode(CursorMode::Embedded.into()).unwrap_err();
-        assert!(error.to_string().contains("cursor-unavailable:"));
-    }
-}

package/engine/src/protocol.rs

@@ -395,168 +395,6 @@ pub enum ControlReply<'a> {
     },
 }
 
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn cursor_option_defaults_and_refuses_unknown_modes() {
-        let default: OpenParams = serde_json::from_str("{}").unwrap();
-        assert_eq!(default.cursor, CursorMode::Embedded);
-        let hidden: OpenParams = serde_json::from_str(r#"{"cursor":"hidden"}"#).unwrap();
-        assert_eq!(hidden.cursor, CursorMode::Hidden);
-        assert!(serde_json::from_str::<OpenParams>(r#"{"cursor":"metadata"}"#).is_err());
-        assert!(serde_json::from_str::<OpenParams>(r#"{"cursor":false}"#).is_err());
-    }
-
-    #[test]
-    fn a_pointer_message_round_trips_with_its_sequence() {
-        let parsed: ControlMessage =
-            serde_json::from_str(r#"{"kind":"pointer","phase":"down","x":10,"y":20,"seq":3}"#)
-                .unwrap();
-        match parsed {
-            ControlMessage::Pointer {
-                phase,
-                x,
-                y,
-                seq,
-                button,
-            } => {
-                assert!(matches!(phase, PointerPhase::Down));
-                assert_eq!((x, y, seq, button), (10, 20, 3, 1));
-            }
-            other => panic!("wrong variant: {other:?}"),
-        }
-    }
-
-    #[test]
-    fn an_unknown_action_is_refused_rather_than_ignored() {
-        assert!(serde_json::from_str::<ControlMessage>(r#"{"kind":"teleport"}"#).is_err());
-    }
-
-    #[test]
-    fn display_source_round_trips_its_explicit_id() {
-        let request: SourceRequest = serde_json::from_value(serde_json::json!({
-            "kind": "display",
-            "display_id": 42
-        }))
-        .unwrap();
-        assert!(matches!(
-            request,
-            SourceRequest::Display {
-                display_id: Some(42)
-            }
-        ));
-    }
-
-    #[test]
-    fn an_encoded_source_names_its_codec_and_its_own_size() {
-        let request: SourceRequest = serde_json::from_value(serde_json::json!({
-            "kind": "encoded",
-            "codec": "h264",
-            "width": 486,
-            "height": 1080
-        }))
-        .unwrap();
-        assert!(matches!(
-            request,
-            SourceRequest::Encoded {
-                codec: EncodedCodec::H264,
-                width: 486,
-                height: 1080
-            }
-        ));
-    }
-
-    #[test]
-    fn an_unknown_encoded_codec_is_refused_rather_than_guessed() {
-        assert!(serde_json::from_value::<SourceRequest>(serde_json::json!({
-            "kind": "encoded",
-            "codec": "av1",
-            "width": 486,
-            "height": 1080
-        }))
-        .is_err());
-    }
-
-    #[test]
-    fn a_feed_request_is_one_access_unit_with_its_own_keyframe_flag() {
-        let params: FeedParams =
-            serde_json::from_str(r#"{"session_id":"s","keyframe":true,"data_b64":"AAAA"}"#)
-                .unwrap();
-        assert_eq!(params.session_id, "s");
-        assert!(params.keyframe, "a feed says whether its unit is an IDR");
-        assert_eq!(params.data_b64, "AAAA");
-        assert_eq!(params.access_unit().unwrap(), vec![0x00, 0x00, 0x00]);
-    }
-
-    #[test]
-    fn a_feed_request_that_is_not_base64_is_refused() {
-        let params = FeedParams {
-            session_id: String::from("s"),
-            keyframe: false,
-            data_b64: String::from("not base64!!"),
-        };
-        assert!(params.access_unit().is_err());
-    }
-
-    /// The reason this protocol carries bytes in base64 rather than adding a
-    /// second inherited fd: at 2 Mbit/s it costs a fraction of a per cent of a
-    /// core, against a whole second channel to keep ordered and bounded. The
-    /// bound below is deliberately loose — it is a sanity check on the order of
-    /// magnitude, not a benchmark, so it does not flake on a loaded machine.
-    #[test]
-    fn decoding_a_two_megabit_stream_is_nowhere_near_a_core() {
-        // One second of a 2 Mbit/s stream, in access units.
-        let unit: Vec<u8> = (0..8_000u32).map(|index| index as u8).collect();
-        let encoded = base64::Engine::encode(&base64::engine::general_purpose::STANDARD, &unit);
-        let params = FeedParams {
-            session_id: String::from("s"),
-            keyframe: false,
-            data_b64: encoded,
-        };
-        let started = std::time::Instant::now();
-        for _ in 0..(250_000 / unit.len()) {
-            assert_eq!(params.access_unit().unwrap().len(), unit.len());
-        }
-        let elapsed = started.elapsed();
-        assert!(
-            elapsed < std::time::Duration::from_millis(500),
-            "a second of 2 Mbit/s base64 took {elapsed:?}, which is far past 5 % of a core",
-        );
-        println!("a second of 2 Mbit/s stream decoded in {elapsed:?}");
-    }
-
-    #[test]
-    fn open_defaults_keep_the_desktops_own_pixels_up_to_4k() {
-        for payload in [
-            r#"{}"#,
-            r#"{"permissions":["view"]}"#,
-            r#"{"permissions":["view","unknown-legacy-scope"]}"#,
-        ] {
-            let _: OpenParams = serde_json::from_str(payload).unwrap();
-        }
-        let params: OpenParams =
-            serde_json::from_str(r#"{"permissions":["view","control"]}"#).unwrap();
-        assert_eq!(params.max_width, 3840);
-        assert_eq!(params.max_height, 2160);
-        assert_eq!(
-            params.bitrate_kbps, 0,
-            "the engine sizes the rate to the surface"
-        );
-        assert_eq!(params.max_fps, 60);
-        assert!(params.local_frames, "session.frame works unless turned off");
-        assert!(
-            !params.agent_indicator,
-            "human control has no overlay by default"
-        );
-        let agent: OpenParams =
-            serde_json::from_str(r#"{"permissions":["view","control"],"agent_indicator":true}"#)
-                .unwrap();
-        assert!(agent.agent_indicator);
-    }
-}
-
 /// Monotonic engine-process clock shared by local frame and cursor notices.
 pub fn timestamp_us(at: std::time::Instant) -> u64 {
     static EPOCH: std::sync::OnceLock<std::time::Instant> = std::sync::OnceLock::new();

package/engine/src/session.rs

@@ -1875,7 +1875,7 @@ impl Session {
             .ok_or_else(|| anyhow::anyhow!("no offer has been made for this session yet"))
     }
 
-    /// Restart ICE: a fresh offer on the same peer, announced as a new
+    /// Restart ICE: a pending or fresh offer on the same peer, announced as a new
     /// `session.description` event for the client to answer as usual.
     pub async fn restart_ice(&self) -> Result<()> {
         let offer = self.current_peer()?.restart_ice().await?;
@@ -4243,6 +4243,42 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn three_queued_ice_restarts_reemit_one_offer_and_accept_its_answer() {
+        let codec = crate::peer::tests::h264_receiver_codec();
+        let (peer, _) = crate::peer::tests::answered(vec![codec.clone()]).await;
+        let (events, mut received) = tokio_mpsc::unbounded_channel();
+        let (inner, _) = test_inner_with(events, peer, 64, 64);
+        let session = Session { inner };
+        let mut offers = Vec::new();
+        for _ in 0..3 {
+            session.restart_ice().await.expect("restart accepted");
+            match received.recv().await.expect("offer event").event {
+                SessionEvent::Description { sdp, .. } => offers.push(sdp),
+                _ => panic!("expected the pending offer"),
+            }
+        }
+        let ufrag = |sdp: &str| {
+            sdp.lines()
+                .find_map(|line| line.strip_prefix("a=ice-ufrag:"))
+                .expect("ICE credentials")
+                .to_owned()
+        };
+        assert!(offers.iter().all(|sdp| ufrag(sdp) == ufrag(&offers[0])));
+        let client = crate::peer::tests::answerer_with(&offers[0], vec![codec]).await;
+        let answer = client.create_answer(None).await.expect("client answer");
+        client
+            .set_local_description(answer.clone())
+            .await
+            .expect("local answer");
+        session
+            .accept_answer(answer.sdp)
+            .await
+            .expect("pending answer accepted");
+        client.close().await.expect("close client");
+        session.current_peer().unwrap().close().await;
+    }
+
     #[tokio::test]
     async fn a_lost_transport_releases_input_then_ends_the_session_without_sctp_close() {
         use webrtc::peer_connection::RTCPeerConnectionState as State;