buninu-browser 0.2.4 → 0.3.0

package/README.md

@@ -97,6 +97,23 @@ the rest is passed on:
 casty's and the engine's options:
 `--casty --help`, `--headless --help`.
 
+### Websites with self-signed certificates
+
+To browse a website with an untrusted self-signed HTTPS certificate, set
+`NODE_TLS_REJECT_UNAUTHORIZED=0` for that invocation:
+
+```sh
+env NODE_TLS_REJECT_UNAUTHORIZED=0 npx buninu-browser https://localhost:8443
+
+# From a local checkout
+env NODE_TLS_REJECT_UNAUTHORIZED=0 bun index.js https://localhost:8443
+```
+
+This disables TLS certificate verification for the process and inherited
+child processes, including requests to other sites. Use it only for trusted
+test sites; avoid exporting it globally. Without this variable, certificate
+verification remains enabled.
+
 ### Requirements
 
 - [Bun](https://bun.sh) 1.4.2 or
@@ -201,6 +218,12 @@ not start a browser process or CDP listener.
 
 ### Page sandbox
 
+Pages can copy text with `navigator.clipboard.writeText()` after a user click
+or key press on HTTPS (or localhost). The controller writes the clipboard,
+preferring `xclip -selection clipboard`, with platform clipboard commands as
+fallbacks. Clipboard command access stays outside the page sandbox; unavailable
+providers reject the promise instead of reporting a successful copy.
+
 Page JavaScript runs behind three layers:
 
 1. **SES and bindings.** The renderer calls `lockdown()`, and each document
@@ -231,7 +254,64 @@ threads:
 
 When idle, the main thread rasterizes a tile reaching half a viewport above
 and one viewport below the visible area, so the compositor can scroll
-without waiting. Screenshots are encoded with `Bun.Image`.
+without waiting. Standard screenshots are encoded with `Bun.Image`.
+
+Casty can negotiate raw RGBA/BGRA file screenshots with native bunterm. Raw
+pixels travel over the compositor's binary channel to the controller, which
+owns a private temporary directory and returns a versioned file descriptor
+through CDP. The renderer cannot create files: its seccomp policy is unchanged.
+Each delivery has a unique file, bounded to 16 outstanding files / 128 MiB;
+abandoned files expire on subsequent writes after 60 seconds, and closing the
+host removes the directory. Standard PNG/JPEG/WebP output and CLI screenshots
+retain their existing behavior. Casty falls back to its configured codec when
+raw transport is unsupported.
+
+Standard CDP `clip` rectangles also apply to raw captures. Fractional CSS
+width/height are retained until physical-pixel rounding, so a 1.75× viewport
+can deliver exactly 1918×1053 pixels. At `clip.scale: 1`, a full-width crop
+borrows a contiguous raster view instead of rescaling; encoded output uses
+the same crop. `Page.getLayoutMetrics` provides the viewport position so
+Casty can follow document scrolling.
+
+Casty also sends a private `clip` on `Page.startScreencast`. It takes precedence over fallback max limits and crops at native pixel density, without resizing. Width/height are CSS units; output pixels still follow device scale. This extension is not standard CDP.
+
+Casty 也會在 `Page.startScreencast` 傳入私有 `clip`；優先於相容用的 max 限制，以原像素密度裁切、不縮放。寬高是 CSS 單位，實體像素仍隨 device scale 換算。此擴充不是標準 CDP。
+
+標準 CDP `clip` 也適用於 raw 截圖；小數 CSS 尺寸保留到最後才換算成實體像素，
+避免字體大小改變後差一列而觸發 bunterm 縮放。`clip.scale: 1` 的全寬裁切
+直接借用連續像素，不重新縮放；Casty 透過 viewport 位置跟隨頁面捲動。
+
+Read-only captures interrupted by an origin renderer swap retry once against
+its replacement, after the new renderer has loaded its document. Scroll
+commands are never replayed, avoiding duplicate input.
+
+跨來源導航更換 renderer 時，唯讀截圖會等待新的 renderer 載入文件後重試一次；
+捲動命令不會重送，避免重複套用輸入。
+
+DOM-triggered rendering coalesces updates with a 16 ms minimum wait, increased
+to twice the last style/layout rebuild time for expensive documents. This is
+separate from Casty's screenshot interval and is not a 60 FPS guarantee:
+raster work and frame delivery still take time. More frequent updates can
+increase CPU usage on continuously animated pages.
+
+DOM 變更觸發的繪製會以至少 16 ms 等待合併更新；排版昂貴時則延長為上次
+樣式／排版重建耗時的兩倍。這與 Casty 的截圖間隔不同，也不保證 60 FPS；
+光柵繪製與畫面傳遞仍需時間，持續動畫的 CPU 用量可能增加。
+
+The compositor now connects to an authenticated, length-prefixed loopback
+socket before the sandbox is installed, instead of reading numeric fd 3.
+It connects directly to the controller, so a busy page main thread cannot
+block screenshot or scroll requests. This removes the previous Windows-only
+compositor disablement; the same tests can run on Windows, but this change
+has so far been executed on Linux only. No additional native library is used.
+
+原生 bunterm 可與 Casty 協商 RGBA／BGRA 原始像素檔案。renderer 經二進位通道
+交給 controller 寫檔，不放寬 seccomp；標準截圖與不支援 raw 的終端維持原路徑。
+compositor 改用沙箱啟用前建立、帶驗證的本機連線，不再依賴 fd 3，因此移除了
+Windows 專用的停用條件；目前已實測 Linux，Windows 仍待真機驗證。
+
+`bun tools/bench-raw-capture.js` measures changing-viewport capture delivery
+(including controller file writes for raw), not terminal FPS.
 
 `<video>` can decode and display MP4 video frames with basic playback and
 seeking. Video bytes are fetched through the controller; the renderer uses
@@ -342,6 +422,11 @@ rendered video position, and the output queue/latency for diagnosis.
 
 ### Diagnostics
 
+[`test/fixtures/browser-raw-demo.html`](test/fixtures/browser-raw-demo.html)
+is a self-contained animated page for checking rendering, scrolling, and links
+through Casty and bunterm. Serve it over a local HTTP server to reuse the visual
+demo; it does not require external assets.
+
 casty does not show the browser's stderr. Set `BUNINU_LOG=1` to also write
 it to `buninu-browser.log` in the working directory, or set
 `BUNINU_LOG=<path>` to choose the file. The log includes:

package/lib/clipboard.js

@@ -0,0 +1,22 @@
+// Host-side text clipboard. No shell interpolation; page bytes go only to stdin.
+export function clipboardCommands(platform = process.platform) {
+  return [
+    ['xclip','-selection','clipboard'],
+    ...(platform === 'win32' ? [['powershell.exe','-NoProfile','-NonInteractive','-Command',
+      '[Console]::InputEncoding = [System.Text.Encoding]::UTF8; Set-Clipboard -Value ([Console]::In.ReadToEnd())']]
+      : platform === 'darwin' ? [['pbcopy']] : [['wl-copy'],['termux-clipboard-set']]),
+  ];
+}
+export async function writeClipboard(text, {which = Bun.which, spawn = Bun.spawn, platform = process.platform} = {}) {
+  if(typeof text !== 'string' || Buffer.byteLength(text)>1024*1024)throw Error('Clipboard text exceeds limit');
+  for(const command of clipboardCommands(platform)) {
+    const executable=which(command[0]); if(!executable)continue;
+    let child,timer;
+    try {
+      child=spawn([executable,...command.slice(1)],{stdin:Buffer.from(text),stdout:'ignore',stderr:'ignore'});
+      timer=setTimeout(()=>child.kill(9),3000);
+      if(await child.exited === 0)return;
+    } catch {} finally {clearTimeout(timer);}
+  }
+  throw Error('No working clipboard command (xclip preferred)');
+}

package/lib/headless-shell.js

@@ -101,6 +101,7 @@ export async function createBrowser({
   let closed = false;
   // Settles when the first renderer shows about:blank (assigned below).
   let rendererReady = null;
+  const documentReady = new WeakMap();
   // Renderer-independent state replayed into every new renderer.
   const viewport = { width: 800, height: 600, deviceScaleFactor: 1 };
   let userAgent = webkit ? initialUserAgent : null;
@@ -231,6 +232,8 @@ export async function createBrowser({
     await next.start();
     await replayState((method, ...params) => next.call(method, ...params));
     const previous = current;
+    const ready=Promise.withResolvers();
+    documentReady.set(next,ready);
     current = next;
     currentKey = key;
     previous?.close();
@@ -305,7 +308,10 @@ export async function createBrowser({
       + `${document.url === url ? "" : ` -> ${document.url}`} in ${Math.round(fetched - started)}ms`);
     if (!invoke) await rendererReady;
     const host = invoke ? current : await rendererFor(document.url);
-    const generation = await (invoke ?? ((method, ...params) => host.call(method, ...params)))("loadDocument", document);
+    let generation;
+    try {
+      generation = await (invoke ?? ((method, ...params) => host.call(method, ...params)))("loadDocument", document);
+    } finally { documentReady.get(host)?.resolve(); }
     committed = { host, generation };
     for (const name of reachedLifecycle(host, generation)) notify(lifecycleListeners, name);
     writeLog("navigation", `${document.url}: first paint in ${Math.round(performance.now() - fetched)}ms`);
@@ -315,7 +321,20 @@ export async function createBrowser({
   // answered even while the renderer's main thread is busy.
   const composite = async (method, ...params) => {
     await rendererReady;
-    return current.composite(method, ...params);
+    // An origin change retires the old compositor. Read-only requests may
+    // follow that swap once; scrolling must never be applied twice.
+    const readOnly = method === "screenshot" || method === "scrollOffset";
+    for (let attempt=0; ; attempt++) {
+      const host=current;
+      await documentReady.get(host)?.promise;
+      if (closed) throw Error("Browser is closed");
+      try {
+        if (host !== current) throw Error("Capture superseded by navigation");
+        return await host.composite(method, ...params);
+      } catch (error) {
+        if (closed || !readOnly || host === current || attempt >= 1) throw error;
+      }
+    }
   };
 
   async function rememberScroll() {
@@ -405,9 +424,10 @@ export async function createBrowser({
       applyState("setInitScripts", () => [[...initScripts.values()]]);
     },
     screenshot: (options = {}) => composite("screenshot", {
-      format: options.format === "jpeg" || options.format === "webp" ? options.format : "png",
+      format: ["jpeg", "webp", "rgba", "bgra"].includes(options.format) ? options.format : "png",
       quality: Number.isFinite(options.quality) ? options.quality : 80,
       optimizeForSpeed: options.optimizeForSpeed === true,
+      clip: options.clip ? {...options.clip,x:options.clip.x/pageScale(),y:options.clip.y/pageScale(),width:options.clip.width/pageScale(),height:options.clip.height/pageScale()} : undefined,
     }),
     title: () => call("title"),
     /**
@@ -473,7 +493,12 @@ export async function createBrowser({
       return result === null ? null : { url: href, title: await call("title") };
     },
     evaluate: (expression) => call("evaluate", String(expression)),
-    cdp() {
+    async cdp(method) {
+      if(method==='Page.getLayoutMetrics') {
+        const offset=await composite('scrollOffset');
+        const visual={pageX:offset.x*pageScale(),pageY:offset.y*pageScale(),offsetX:0,offsetY:0,clientWidth:viewport.width,clientHeight:viewport.height,scale:1,zoom:1};
+        return {cssVisualViewport:visual,cssLayoutViewport:visual,visualViewport:visual,layoutViewport:visual};
+      }
       return {};
     },
   };
@@ -484,7 +509,8 @@ export async function createBrowser({
     const first = rendererFor("about:blank");
     prepareSpare();
     await first;
-    await current.call("loadDocument", { url: "about:blank" });
+    try { await current.call("loadDocument", { url: "about:blank" }); }
+    finally { documentReady.get(current)?.resolve(); }
   })();
   if (waitForRenderer) await rendererReady;
   else rendererReady.catch(() => {}); // the caller awaits `ready`

package/lib/paint/frame.js

@@ -15,10 +15,10 @@
  * modify them, including while an asynchronous image encoder is using them.
  * @returns {{ pixels: Uint8Array, width: number, height: number }}
  */
-export function cropViewport(tile, scrollX, scrollY, viewportWidth, viewportHeight) {
+export function cropViewport(tile, scrollX, scrollY, viewportWidth, viewportHeight, exact = false) {
   const scale = tile.scale;
-  const width = Math.max(1, Math.round(Math.floor(viewportWidth) * scale));
-  const height = Math.max(1, Math.round(Math.floor(viewportHeight) * scale));
+  const width = Math.max(1, Math.round((exact ? viewportWidth : Math.floor(viewportWidth)) * scale));
+  const height = Math.max(1, Math.round((exact ? viewportHeight : Math.floor(viewportHeight)) * scale));
   const offsetX = Math.round((scrollX - tile.x) * scale);
   const offsetY = Math.round((scrollY - tile.y) * scale);
   // Raster tiles are normally viewport-wide. A full-width crop is already
@@ -115,3 +115,35 @@ export function backgroundBytes(color) {
   if (!match) return [255, 255, 255, 255];
   return [Number(match[1]), Number(match[2]), Number(match[3]), Math.round(Number(match[4] ?? 1) * 255)];
 }
+
+/** Raw screenshot payload, owned independently of a recyclable raster tile. */
+export function rawFrame(pixels, width, height, format) {
+  if (!['rgba', 'bgra'].includes(format) || width * height > 16777216) throw Error('Invalid raw screenshot');
+  const data = new Uint8Array(pixels);
+  if (format === 'bgra') {
+    for (let i=0; i<data.length; i+=4) { const red=data[i]; data[i]=data[i+2]; data[i+2]=red; }
+  }
+  return {format, width, height, pixels:data};
+}
+
+// CDP clip coordinates are document CSS pixels, not viewport-relative pixels.
+export function captureViewport(tile, x, y, width, height, clip) {
+  if (!clip) return cropViewport(tile,x,y,width,height);
+  if (![clip.x,clip.y,clip.width,clip.height,clip.scale].every(Number.isFinite)
+      || clip.width<=0 || clip.height<=0 || clip.scale<=0 || clip.scale>8)
+    throw Error('Invalid screenshot clip');
+  const w=Math.max(1,Math.round(clip.width*tile.scale*clip.scale));
+  const h=Math.max(1,Math.round(clip.height*tile.scale*clip.scale));
+  const sourceW=Math.max(1,Math.round(clip.width*tile.scale));
+  const sourceH=Math.max(1,Math.round(clip.height*tile.scale));
+  if(Math.max(w,h,sourceW,sourceH)>8192 || w*h>16777216 || sourceW*sourceH>16777216)
+    throw Error('Invalid screenshot clip size');
+  const frame=cropViewport(tile,clip.x,clip.y,clip.width,clip.height,true);
+  if(clip.scale===1)return frame;
+  const pixels=new Uint8Array(w*h*4);
+  for(let row=0;row<h;row++)for(let col=0;col<w;col++) {
+    const from=(Math.min(frame.height-1,Math.floor(row/clip.scale))*frame.width+Math.min(frame.width-1,Math.floor(col/clip.scale)))*4;
+    pixels.set(frame.pixels.subarray(from,from+4),(row*w+col)*4);
+  }
+  return {pixels,width:w,height:h};
+}

package/lib/paint/raw-frames.js

@@ -0,0 +1,47 @@
+import {mkdtempSync,writeFileSync,readdirSync,statSync,unlinkSync,rmSync,realpathSync} from 'node:fs';
+import {join} from 'node:path';
+import {tmpdir} from 'node:os';
+
+// The producer owns the directory; Kitty t=t consumers unlink individual frames.
+// A worker borrows a directory owned by its parent, so terminating the worker
+// cannot skip cleanup. No pixel data is encoded into the CDP response.
+export class RawFrames {
+  constructor({directory,ownsDirectory=true}={}) {
+    this.externalDirectory=directory;this.ownsDirectory=ownsDirectory;
+    this.sequence=0;this.closed=false;
+    this.onExit=()=>this.close();
+  }
+  get directory() {
+    if(this.closed)throw Error('Raw frame store is closed');
+    if(!this.path){
+      this.path=this.externalDirectory ? this.externalDirectory() : realpathSync(mkdtempSync(join(tmpdir(),'tty-graphics-protocol-browser-')));
+      if(!this.path)throw Error('Missing raw frame directory');
+      if(this.ownsDirectory)process.once('exit',this.onExit);
+    }
+    return this.path;
+  }
+  write(bytes,width,height,format) {
+    if (!['rgba','bgra'].includes(format) || !Number.isInteger(width) || !Number.isInteger(height)
+        || width<1 || height<1 || width*height>16777216 || !(bytes instanceof Uint8Array)
+        || bytes.byteLength!==width*height*4) throw Error('Invalid raw frame');
+    const directory=this.directory;
+    let count=0,total=0;
+    for(const name of readdirSync(directory)){
+      const path=join(directory,name);
+      try{
+        const stat=statSync(path);
+        if(Date.now()-stat.mtimeMs>60000){unlinkSync(path);continue;}
+        count++;total+=stat.size;
+      }catch(error){if(error.code!=='ENOENT')throw error;}
+    }
+    if(count>=16||total+bytes.byteLength>128*1024*1024)throw Error('Raw frame consumer stalled');
+    const path=join(directory,`${++this.sequence}.${format}`);
+    writeFileSync(path,bytes,{flag:'wx',mode:0o600});
+    return JSON.stringify({version:1,transport:'file',path,width,height,stride:width*4,format,bytes:bytes.byteLength});
+  }
+  close(){
+    if(this.closed)return;this.closed=true;
+    process.removeListener('exit',this.onExit);
+    if(this.ownsDirectory&&this.path)rmSync(this.path,{recursive:true,force:true});
+  }
+}

package/lib/renderer/compositor-channel.js

@@ -0,0 +1,103 @@
+// Private loopback transport, connected before renderer seccomp. No inherited
+// numeric descriptors: node:net also supports Windows sockets.
+import {createServer, createConnection} from 'node:net';
+import {randomBytes} from 'node:crypto';
+const MAX_JSON = 96 * 1024 * 1024;
+const MAX_PIXELS = 64 * 1024 * 1024;
+const MAX_QUEUE = 128 * 1024 * 1024;
+
+// Length-prefixed JSON followed by optional binary pixels. Copy once into an
+// owned packet so a raster lease may be released before the socket drains.
+export function encodePacket(message, pixels = null) {
+  const json = Buffer.from(JSON.stringify(message));
+  const size = pixels?.byteLength ?? 0;
+  if (json.length > MAX_JSON || size > MAX_PIXELS || json.length + size > MAX_QUEUE) throw Error('Compositor packet too large');
+  const packet = Buffer.allocUnsafe(8 + json.length + size);
+  packet.writeUInt32LE(json.length, 0); packet.writeUInt32LE(size, 4);
+  packet.set(json, 8); if (size) packet.set(pixels, 8 + json.length);
+  return packet;
+}
+
+export class PacketReader {
+  constructor(receive, limit = MAX_QUEUE) { this.receive = receive; this.limit = limit; this.header = Buffer.alloc(8); this.used = 0; this.packet = null; }
+  push(chunk) {
+    let offset = 0;
+    while (offset < chunk.length) {
+      const target = this.packet ?? this.header;
+      const count = Math.min(target.length - this.used, chunk.length - offset);
+      target.set(chunk.subarray(offset, offset + count), this.used);
+      this.used += count; offset += count;
+      if (this.used !== target.length) continue;
+      this.used = 0;
+      if (!this.packet) {
+        this.jsonLength = this.header.readUInt32LE(0);
+        const binaryLength = this.header.readUInt32LE(4);
+        const total = this.jsonLength + binaryLength;
+        if (!this.jsonLength || this.jsonLength > MAX_JSON || binaryLength > MAX_PIXELS || total > this.limit) throw Error('Invalid compositor packet size');
+        this.packet = Buffer.allocUnsafe(total);
+      } else {
+        const packet = this.packet; this.packet = null;
+        const message = JSON.parse(packet.subarray(0, this.jsonLength).toString());
+        const pixels = packet.subarray(this.jsonLength);
+        this.receive(message, pixels);
+      }
+    }
+  }
+}
+
+function attach(socket, receive, closed, limit) {
+  socket.setNoDelay(true);
+  const reader = new PacketReader(receive, limit);
+  socket.on('data', chunk => { try { reader.push(chunk); } catch { socket.destroy(); } });
+  socket.on('error', () => {});
+  socket.once('close', closed);
+  return {
+    reader,
+    send(message, pixels) {
+      if (socket.destroyed) throw Error('Compositor channel closed');
+      const packet = encodePacket(message, pixels);
+      if (socket.writableLength + packet.length > MAX_QUEUE) { socket.destroy(); throw Error('Compositor channel backpressure limit'); }
+      socket.write(packet);
+    },
+    close() { socket.destroy(); },
+  };
+}
+
+export async function listenCompositor(receive, closed) {
+  const token = randomBytes(32).toString('hex');
+  const sockets = new Set(); let peer = null, ended = false;
+  const server = createServer(socket => {
+    if (ended || peer || sockets.size >= 4) { socket.destroy(); return; }
+    sockets.add(socket);
+    const timer = setTimeout(() => socket.destroy(), 3000);
+    const candidate = attach(socket, (message, pixels) => {
+      if (!peer) {
+        if (pixels.length || message?.type !== 'hello' || message.token !== token) { socket.destroy(); return; }
+        peer = candidate; clearTimeout(timer); candidate.reader.limit = MAX_QUEUE;
+        for (const other of sockets) if (other !== socket) other.destroy();
+        server.close(); candidate.send({type:'accepted'});
+      } else if (peer === candidate) receive(message, pixels);
+    }, () => { clearTimeout(timer); sockets.delete(socket); if (peer === candidate && !ended) closed(); }, 4096);
+  });
+  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+  return {
+    endpoint: {port:server.address().port, token},
+    send(message) { if (!peer || ended) throw Error('Compositor not connected'); peer.send(message); },
+    close() { ended = true; server.close(); for (const socket of sockets) socket.destroy(); },
+  };
+}
+
+export function connectCompositor(endpoint, receive, closed) {
+  return new Promise((resolve, reject) => {
+    const socket = createConnection({host:'127.0.0.1', port:endpoint.port});
+    let accepted = false;
+    const timer = setTimeout(() => socket.destroy(), 5000);
+    const peer = attach(socket, (message, pixels) => {
+      if (!accepted) {
+        if (message?.type !== 'accepted' || pixels.length) { socket.destroy(); return; }
+        accepted = true; clearTimeout(timer); resolve(peer);
+      } else receive(message, pixels);
+    }, () => { clearTimeout(timer); if (!accepted) reject(Error('Compositor connection failed')); else closed(); });
+    socket.once('connect', () => peer.send({type:'hello', token:endpoint.token}));
+  });
+}

package/lib/renderer/compositor.js

@@ -6,8 +6,8 @@
  * screenshots and scrolling on its own channel, so the page stays visible and
  * scrollable while the main thread works.
  *
- * Channel to the controller: fd 3, a socket shared with the controller,
- * newline-delimited JSON (it does not go through the main thread's IPC):
+ * Channel to the controller: authenticated loopback socket, with length-prefixed
+ * JSON and optional binary pixels (does not go through main-thread IPC):
  *   controller -> compositor  { id, method: "screenshot" | "scroll" | "scrollOffset", params }
  *                             (screenshot params: [{ format?: "png" | "jpeg" | "webp", quality? }])
  *   compositor -> controller  { id, result } | { id, error }
@@ -22,14 +22,13 @@
  * a fragment link, a key press or a new document.
  */
 import { ScrollViewport } from "../layout/scroll-viewport.js";
-import { cropViewport, encodeImage, encodeImageBase64 } from "../paint/frame.js";
+import { rawFrame, captureViewport, encodeImage, encodeImageBase64 } from "../paint/frame.js";
 import { FrameCaptureCache } from "../paint/frame-cache.js";
 import { FrameLeaseTracker } from "../paint/shared-frame-pool.js";
 import wasmpeg from "../../vendor/wasmpeg/src/js/index.js";
 import { VideoPresentation, compositeVideo } from "./video-presentation.js";
 
-const CHANNEL_FD = 3;
-const MAX_LINE_BYTES = 1024 * 1024;
+import {connectCompositor} from './compositor-channel.js';
 
 const viewport = new ScrollViewport(800, 600);
 let tile = null;
@@ -42,12 +41,18 @@ const video = new VideoPresentation(wasmpeg, () => {
   send({ type: "frame" });
 }, report => postMessage({ type: "video-report", ...report }));
 
-const channel = Bun.file(CHANNEL_FD).writer();
-
+let channel;
 function send(message) {
-  channel.write(`${JSON.stringify(message)}\n`);
-  channel.flush();
+  const result = message.result;
+  if (result?.pixels instanceof Uint8Array) {
+    const {pixels,...metadata} = result;
+    channel.send({...message,result:metadata},pixels);
+  } else channel.send(message);
 }
+const endpoint = await new Promise(resolve => {
+  self.onmessage = ({data}) => { if (data?.type === 'connect') resolve(data.endpoint); };
+});
+channel = await connectCompositor(endpoint, request => { void handleRequest(request); }, () => process.exit(1));
 
 self.onmessage = ({ data }) => {
   if (data?.type === "video-open") { void video.open(data); return; }
@@ -77,12 +82,19 @@ self.onmessage = ({ data }) => {
 };
 
 const methods = {
-  async screenshot({ format = "png", quality = 80, optimizeForSpeed = false } = {}) {
+  async screenshot({ format = "png", quality = 80, optimizeForSpeed = false, clip } = {}) {
     if (!tile) return "";
-    const key = `${frameSerial}:${viewport.x}:${viewport.y}:${format}:${quality}:${optimizeForSpeed}`;
+    if (format === 'rgba' || format === 'bgra') {
+      return frameLeases.capture(frame => {
+        const composited = frame.videoLayer?.id === video.config?.id ? compositeVideo(frame, video.frame) : frame;
+        const {pixels,width,height} = captureViewport(composited,viewport.x,viewport.y,viewport.width,viewport.height,clip);
+        return rawFrame(pixels,width,height,format);
+      });
+    }
+    const key = `${frameSerial}:${viewport.x}:${viewport.y}:${format}:${quality}:${optimizeForSpeed}:${JSON.stringify(clip)}`;
     return captures.get(key, () => frameLeases.capture(frame => {
       const composited = frame.videoLayer?.id === video.config?.id ? compositeVideo(frame, video.frame) : frame;
-      const { pixels, width, height } = cropViewport(composited, viewport.x, viewport.y, viewport.width, viewport.height);
+      const { pixels, width, height } = captureViewport(composited, viewport.x, viewport.y, viewport.width, viewport.height,clip);
       return encodeImageBase64(pixels, width, height, { format, quality, optimizeForSpeed });
     }));
   },
@@ -98,13 +110,7 @@ const methods = {
   },
 };
 
-async function handleLine(line) {
-  let request;
-  try {
-    request = JSON.parse(line);
-  } catch {
-    return;
-  }
+async function handleRequest(request) {
   if (request?.type === "audio-timing" && Number.isInteger(request.audioId)) {
     video.timing(request.audioId, request.seconds);
     return;
@@ -118,20 +124,6 @@ async function handleLine(line) {
   }
 }
 
-(async () => {
-  const decoder = new TextDecoder();
-  let pending = "";
-  for await (const chunk of Bun.file(CHANNEL_FD).stream()) {
-    pending += decoder.decode(chunk, { stream: true });
-    let newline;
-    while ((newline = pending.indexOf("\n")) >= 0) {
-      handleLine(pending.slice(0, newline));
-      pending = pending.slice(newline + 1);
-    }
-    if (pending.length > MAX_LINE_BYTES) pending = "";
-  }
-})();
-
 // Bun.Image initialises its codecs on first use; do that before the
 // renderer installs seccomp, which forbids opening files.
 await encodeImage(new Uint8Array(4), 1, 1);

package/lib/renderer/flags.js

@@ -1,7 +1,7 @@
 /** Command-line flags the controller passes to renderer processes. */
 import { CHROMIUM_VERSION } from "../user-agent.js";
 
-/** fd 3 is the controller's compositor channel; start the compositor Worker. */
+/** Start the compositor Worker with its pre-sandbox loopback channel. */
 export const COMPOSITOR_FLAG = "--compositor";
 
 /** BUNINU_VERIFY_STYLE: check every incremental restyle against a full one (development). */