replicas-computer 0.2.14 → 0.3.0

package/dist/index.js

@@ -998,13 +998,13 @@ async function computerRecordStartCommand(path, options) {
   if (existsSync3(RECORD_PID_FILE)) {
     const pid = parseInt(readFileSync3(RECORD_PID_FILE, "utf8").trim(), 10);
     if (Number.isFinite(pid)) {
-      let alive2 = false;
+      let alive3 = false;
       try {
         process.kill(pid, 0);
-        alive2 = true;
+        alive3 = true;
       } catch {
       }
-      if (alive2) fail(`recording already in progress (pid ${pid}). run \`replicas computer record stop\` first.`);
+      if (alive3) fail(`recording already in progress (pid ${pid}). run \`replicas computer record stop\` first.`);
     }
   }
   const target = resolvePath(path);
@@ -1064,13 +1064,13 @@ async function computerRecordStartCommand(path, options) {
     }
     await sleep(100);
   }
-  let alive = false;
+  let alive2 = false;
   try {
     process.kill(child.pid, 0);
-    alive = true;
+    alive2 = true;
   } catch {
   }
-  if (alive) fail("ffmpeg is running but did not produce recording output within 5 seconds; run `replicas computer record stop` to finalize or retry");
+  if (alive2) fail("ffmpeg is running but did not produce recording output within 5 seconds; run `replicas computer record stop` to finalize or retry");
   clearRecordingState();
   rmSync3(rawTarget, { force: true });
   fail("ffmpeg exited before screen recording became ready");
@@ -1084,17 +1084,17 @@ async function computerRecordStopCommand() {
       process.kill(pid, "SIGINT");
     } catch {
     }
-    let alive = true;
+    let alive2 = true;
     for (let i = 0; i < 150; i++) {
       try {
         process.kill(pid, 0);
       } catch {
-        alive = false;
+        alive2 = false;
         break;
       }
       await sleep(200);
     }
-    if (alive) fail(`ffmpeg did not finalize recording within 30 seconds (pid ${pid})`);
+    if (alive2) fail(`ffmpeg did not finalize recording within 30 seconds (pid ${pid})`);
   }
   if (existsSync3(RECORD_PATH_FILE)) {
     const target = readFileSync3(RECORD_PATH_FILE, "utf8").trim();
@@ -1116,6 +1116,82 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/lib/chrome-session.ts
+async function openChromeSession(webSocketDebuggerUrl) {
+  const socket = new WebSocket(webSocketDebuggerUrl);
+  const pending = /* @__PURE__ */ new Map();
+  let nextId = 1;
+  let closed = false;
+  const fail2 = (error) => {
+    if (closed) return;
+    closed = true;
+    for (const request of pending.values()) {
+      clearTimeout(request.timeout);
+      request.reject(error);
+    }
+    pending.clear();
+    socket.close();
+  };
+  socket.addEventListener("message", (event) => {
+    const data = typeof event.data === "string" ? event.data : Buffer.isBuffer(event.data) ? event.data.toString("utf8") : Buffer.from(event.data).toString("utf8");
+    let message;
+    try {
+      message = JSON.parse(data);
+    } catch (error) {
+      fail2(new Error(`Chrome DevTools returned invalid WebSocket JSON: ${error instanceof Error ? error.message : String(error)}`));
+      return;
+    }
+    if (!isRecord(message)) return;
+    if (typeof message.id !== "number") return;
+    const request = pending.get(message.id);
+    if (!request) return;
+    clearTimeout(request.timeout);
+    pending.delete(message.id);
+    const detail = isRecord(message.error) && typeof message.error.message === "string" ? message.error.message : void 0;
+    request.resolve(message.error ? { error: { message: detail } } : { result: isRecord(message.result) ? message.result : {} });
+  });
+  socket.addEventListener("error", () => fail2(new Error("Chrome DevTools WebSocket failed")));
+  socket.addEventListener("close", () => fail2(new Error("Chrome DevTools WebSocket closed unexpectedly")));
+  await new Promise((resolve4, reject) => {
+    const timeout = setTimeout(() => {
+      socket.close();
+      reject(new Error("Chrome DevTools connection timed out"));
+    }, 1e4);
+    socket.addEventListener("open", () => {
+      clearTimeout(timeout);
+      resolve4();
+    }, { once: true });
+    socket.addEventListener("error", () => {
+      clearTimeout(timeout);
+      reject(new Error("Chrome DevTools connection failed"));
+    }, { once: true });
+  });
+  return {
+    send: ({ method, params }) => new Promise((resolve4, reject) => {
+      if (socket.readyState !== WebSocket.OPEN) {
+        reject(new Error("Chrome DevTools connection is not open"));
+        return;
+      }
+      const id = nextId++;
+      const timeout = setTimeout(() => {
+        pending.delete(id);
+        reject(new Error(`Chrome DevTools ${method} timed out`));
+      }, 1e4);
+      pending.set(id, { resolve: resolve4, reject, timeout });
+      socket.send(JSON.stringify({ id, method, params }));
+    }),
+    close: () => fail2(new Error("Chrome DevTools connection closed"))
+  };
+}
+async function withChromeSession(webSocketDebuggerUrl, callback) {
+  const session = await openChromeSession(webSocketDebuggerUrl);
+  try {
+    return await callback(session);
+  } finally {
+    session.close();
+  }
+}
+
 // src/commands/browser.ts
 async function fetchChromeJson(path) {
   let res;
@@ -1174,72 +1250,6 @@ var VISIBLE_JS = `
 async function sendChromeSessionCommand(session, method, params) {
   return chromeResult(await session.send({ method, params }), method);
 }
-async function withChromeSession(webSocketDebuggerUrl, callback) {
-  return await new Promise((resolve4, reject) => {
-    const ws = new WebSocket(webSocketDebuggerUrl);
-    const pending = /* @__PURE__ */ new Map();
-    let nextId = 1;
-    let settled = false;
-    const failSession = (error) => {
-      if (settled) return;
-      settled = true;
-      for (const request of pending.values()) {
-        clearTimeout(request.timeout);
-        request.reject(error);
-      }
-      pending.clear();
-      ws.close();
-      reject(error);
-    };
-    const finishSession = (value) => {
-      if (settled) return;
-      settled = true;
-      for (const request of pending.values()) clearTimeout(request.timeout);
-      pending.clear();
-      ws.close();
-      resolve4(value);
-    };
-    const session = {
-      send: ({ method, params }) => new Promise((resolveCommand, rejectCommand) => {
-        const id = nextId++;
-        const timeout = setTimeout(() => {
-          pending.delete(id);
-          rejectCommand(new Error(`Chrome DevTools ${method} timed out`));
-        }, 1e4);
-        pending.set(id, { method, resolve: resolveCommand, reject: rejectCommand, timeout });
-        ws.send(JSON.stringify({ id, method, params }));
-      })
-    };
-    ws.addEventListener("open", async () => {
-      try {
-        finishSession(await callback(session));
-      } catch (error) {
-        failSession(error instanceof Error ? error : new Error(String(error)));
-      }
-    });
-    ws.addEventListener("message", (event) => {
-      const data = typeof event.data === "string" ? event.data : Buffer.isBuffer(event.data) ? event.data.toString("utf8") : Buffer.from(event.data).toString("utf8");
-      let message;
-      try {
-        message = JSON.parse(data);
-      } catch (error) {
-        failSession(new Error(`Chrome DevTools returned invalid WebSocket JSON: ${error instanceof Error ? error.message : String(error)}`));
-        return;
-      }
-      if (!isRecord(message) || typeof message.id !== "number") return;
-      const request = pending.get(message.id);
-      if (!request) return;
-      clearTimeout(request.timeout);
-      pending.delete(message.id);
-      const detail = isRecord(message.error) && typeof message.error.message === "string" ? message.error.message : void 0;
-      request.resolve(message.error ? { error: { message: detail } } : { result: isRecord(message.result) ? message.result : {} });
-    });
-    ws.addEventListener("error", () => failSession(new Error("Chrome DevTools WebSocket failed")));
-    ws.addEventListener("close", () => {
-      if (!settled) failSession(new Error("Chrome DevTools WebSocket closed unexpectedly"));
-    });
-  });
-}
 async function sendChromeCommands(webSocketDebuggerUrl, commands) {
   return await withChromeSession(webSocketDebuggerUrl, async (session) => await Promise.all(commands.map((command) => session.send(command))));
 }
@@ -2927,7 +2937,7 @@ async function computerStatusCommand() {
 }
 
 // src/version.ts
-var COMPUTER_USE_VERSION = "0.2.14";
+var COMPUTER_USE_VERSION = "0.3.0";
 var COMPUTER_USE_PROTOCOL_VERSION = 1;
 
 // src/program.ts
@@ -3167,16 +3177,385 @@ async function runComputerClient(argv) {
 }
 
 // src/media-server.ts
-import { spawn as spawn4 } from "child_process";
-import { createSocket } from "dgram";
-import { createReadStream, existsSync as existsSync6, statSync as statSync2 } from "fs";
+import { spawn as spawn5 } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { createReadStream, existsSync as existsSync6, readdirSync, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
 import { createServer as createServer2 } from "http";
-import { availableParallelism } from "os";
+import { availableParallelism, loadavg } from "os";
 import { dirname as dirname6, extname, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 
-// src/input-bridge.ts
+// ../shared/src/runtime-env.ts
+function parsePosixEnvFile(content) {
+  const result = {};
+  let pos = 0;
+  while (pos < content.length) {
+    let lineStart;
+    if (pos === 0 || content[pos - 1] === "\n") {
+      lineStart = pos;
+    } else {
+      const nl2 = content.indexOf("\n", pos);
+      if (nl2 === -1) break;
+      lineStart = nl2 + 1;
+    }
+    if (!content.startsWith("export ", lineStart)) {
+      const nl2 = content.indexOf("\n", lineStart);
+      if (nl2 === -1) break;
+      pos = nl2 + 1;
+      continue;
+    }
+    const nameStart = lineStart + "export ".length;
+    const eqIdx = content.indexOf("=", nameStart);
+    if (eqIdx === -1) break;
+    const name = content.slice(nameStart, eqIdx).trim();
+    let cursor = eqIdx + 1;
+    if (content[cursor] !== "'") {
+      const nl2 = content.indexOf("\n", cursor);
+      pos = nl2 === -1 ? content.length : nl2 + 1;
+      continue;
+    }
+    cursor += 1;
+    let value = "";
+    let closed = false;
+    while (cursor < content.length) {
+      const ch = content[cursor];
+      if (ch === "'") {
+        if (content.startsWith("\\''", cursor + 1)) {
+          value += "'";
+          cursor += 4;
+          continue;
+        }
+        cursor += 1;
+        closed = true;
+        break;
+      }
+      value += ch;
+      cursor += 1;
+    }
+    if (closed && name) {
+      result[name] = value;
+    }
+    const nl = content.indexOf("\n", cursor);
+    pos = nl === -1 ? content.length : nl + 1;
+  }
+  return result;
+}
+
+// src/media-server.ts
+import WebSocket2, { WebSocketServer } from "ws";
+
+// src/encoder.ts
 import { spawn as spawn3 } from "child_process";
+import { createSocket } from "dgram";
+
+// src/rtp.ts
+var RTP_HEADER_BYTES = 12;
+var NAL_IDR = 5;
+var NAL_SPS = 7;
+var NAL_STAP_A = 24;
+var NAL_FU_A = 28;
+var nalType = (byte) => byte & 31;
+var headerBytesOf = (packet) => RTP_HEADER_BYTES + (packet[0] & 15) * 4;
+var joinable = (nal) => nal === NAL_IDR || nal === NAL_SPS;
+var isRtp = (data) => data.length >= RTP_HEADER_BYTES && data[0] >> 6 === 2 && (data[1] < 192 || data[1] > 223);
+var rtpPayload = (packet) => packet.subarray(headerBytesOf(packet));
+function aggregatedNals(payload) {
+  const nals = [];
+  let offset = 1;
+  while (offset < payload.length) {
+    if (offset + 2 > payload.length) return { nals, damaged: true };
+    const size = payload[offset] * 256 + payload[offset + 1];
+    offset += 2;
+    if (!size || offset + size > payload.length) return { nals, damaged: true };
+    nals.push(payload.subarray(offset, offset + size));
+    offset += size;
+  }
+  return { nals, damaged: nals.length === 0 };
+}
+var fragmentHeader = (payload) => ({
+  type: nalType(payload[1]),
+  start: Boolean(payload[1] & 128),
+  end: Boolean(payload[1] & 64)
+});
+function isKeyframeStart(payload) {
+  if (payload.length === 0) return false;
+  const type = nalType(payload[0]);
+  if (type === NAL_FU_A) {
+    if (payload.length < 2) return false;
+    const fragment = fragmentHeader(payload);
+    return fragment.start && joinable(fragment.type);
+  }
+  if (type === NAL_STAP_A) return aggregatedNals(payload).nals.some((nal) => joinable(nalType(nal[0])));
+  return joinable(type);
+}
+var RtpSplicer = class {
+  generation = -1;
+  seqOffset = 0;
+  timestampOffset = 0;
+  lastSeq = -1;
+  lastTimestamp = 0;
+  splice(packet, generation, timestampStep) {
+    const seq = packet.readUInt16BE(2);
+    const timestamp = packet.readUInt32BE(4);
+    if (generation !== this.generation) {
+      if (this.lastSeq >= 0) {
+        this.seqOffset = this.lastSeq + 1 - seq & 65535;
+        this.timestampOffset = this.lastTimestamp + timestampStep - timestamp >>> 0;
+      }
+      this.generation = generation;
+    }
+    this.lastSeq = seq + this.seqOffset & 65535;
+    this.lastTimestamp = timestamp + this.timestampOffset >>> 0;
+    packet.writeUInt16BE(this.lastSeq, 2);
+    packet.writeUInt32BE(this.lastTimestamp, 4);
+  }
+};
+function withPlayoutDelay(packet, id) {
+  if (packet[0] & 16) return packet;
+  const header = headerBytesOf(packet);
+  const out = Buffer.allocUnsafe(packet.length + 8);
+  packet.copy(out, 0, 0, header);
+  out[0] |= 16;
+  out.writeUInt32BE(3202220033, header);
+  out[header + 4] = id << 4 | 2;
+  out[header + 5] = 0;
+  out[header + 6] = 0;
+  out[header + 7] = 0;
+  packet.copy(out, header + 8, header);
+  return out;
+}
+function parseRtpPacket(data) {
+  if (!isRtp(data)) return null;
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  const padding = Boolean(data[0] & 32);
+  const extension = Boolean(data[0] & 16);
+  let offset = headerBytesOf(data);
+  if (offset > data.length) return null;
+  if (extension) {
+    if (offset + 4 > data.length) return null;
+    offset += 4 + view.getUint16(offset + 2) * 4;
+  }
+  const end = data.length - (padding ? data[data.length - 1] : 0);
+  if (offset >= end) return null;
+  return {
+    marker: Boolean(data[1] & 128),
+    payload: data.subarray(offset, end),
+    sequence: view.getUint16(2),
+    timestamp: view.getUint32(4)
+  };
+}
+var RtpClock = class {
+  constructor(rate) {
+    this.rate = rate;
+  }
+  rate;
+  base;
+  last;
+  wraps = 0;
+  microseconds(timestamp) {
+    if (this.last !== void 0 && timestamp < this.last && this.last - timestamp > 2147483648) this.wraps += 1;
+    this.last = timestamp;
+    const extended = timestamp + this.wraps * 4294967296;
+    this.base ??= extended;
+    return Math.round((extended - this.base) * 1e6 / this.rate);
+  }
+};
+var startCode = new Uint8Array([0, 0, 0, 1]);
+var H264RtpAssembler = class {
+  clock = new RtpClock(9e4);
+  chunks = [];
+  key = false;
+  timestamp;
+  sequence;
+  fragmentType;
+  damaged = false;
+  clearFrame() {
+    this.chunks = [];
+    this.key = false;
+    this.timestamp = void 0;
+    this.sequence = void 0;
+    this.fragmentType = void 0;
+    this.damaged = false;
+  }
+  push(packet) {
+    if (this.timestamp !== void 0 && packet.timestamp !== this.timestamp) {
+      this.clearFrame();
+    }
+    this.timestamp ??= packet.timestamp;
+    if (this.sequence !== void 0 && packet.sequence !== (this.sequence + 1) % 65536) this.damaged = true;
+    this.sequence = packet.sequence;
+    const type = nalType(packet.payload[0]);
+    if (this.damaged) {
+    } else if (type > 0 && type < NAL_STAP_A && this.fragmentType === void 0) {
+      this.chunks.push(startCode, packet.payload);
+      this.key ||= type === NAL_IDR;
+    } else if (type === NAL_STAP_A && this.fragmentType === void 0) {
+      const { nals, damaged } = aggregatedNals(packet.payload);
+      for (const nal of nals) {
+        this.chunks.push(startCode, nal);
+        this.key ||= nalType(nal[0]) === NAL_IDR;
+      }
+      this.damaged = damaged;
+    } else if (type === NAL_FU_A && packet.payload.length >= 3) {
+      const fragment = fragmentHeader(packet.payload);
+      if (fragment.start && !fragment.end && this.fragmentType === void 0) {
+        this.fragmentType = fragment.type;
+        this.chunks.push(startCode, new Uint8Array([packet.payload[0] & 224 | fragment.type]));
+        this.key ||= fragment.type === NAL_IDR;
+      } else if (!fragment.start && this.fragmentType === fragment.type) {
+        if (fragment.end) this.fragmentType = void 0;
+      } else {
+        this.damaged = true;
+      }
+      if (!this.damaged) this.chunks.push(packet.payload.subarray(2));
+    } else this.damaged = true;
+    if (!packet.marker) return null;
+    if (this.damaged || this.fragmentType !== void 0 || this.chunks.length === 0) {
+      this.clearFrame();
+      return null;
+    }
+    const length = this.chunks.reduce((total, chunk) => total + chunk.length, 0);
+    const data = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of this.chunks) {
+      data.set(chunk, offset);
+      offset += chunk.length;
+    }
+    const frame = { data, key: this.key, timestamp: this.clock.microseconds(packet.timestamp) };
+    this.clearFrame();
+    return frame;
+  }
+};
+
+// src/encoder.ts
+var alive = (child) => child.exitCode === null && child.signalCode === null;
+var bindUdp = () => new Promise((resolveSocket, reject) => {
+  const socket = createSocket("udp4");
+  socket.once("error", reject);
+  socket.bind(0, "127.0.0.1", () => {
+    socket.off("error", reject);
+    socket.setRecvBufferSize(4 * 1024 * 1024);
+    resolveSocket(socket);
+  });
+});
+function superviseEncoder(options) {
+  let active;
+  let candidate;
+  let nextId = 0;
+  let wanted = false;
+  let restart;
+  let candidateDeadline;
+  let chain = Promise.resolve();
+  const log = (message) => process.stderr.write(`[desktop-stream] ${options.label} ${message}
+`);
+  const retire = (generation) => {
+    if (!generation) return;
+    generation.live = false;
+    if (!alive(generation.child)) {
+      generation.socket.close();
+      return;
+    }
+    generation.child.kill("SIGTERM");
+    const force = setTimeout(() => alive(generation.child) && generation.child.kill("SIGKILL"), 2e3);
+    force.unref();
+    generation.child.once("exit", () => {
+      clearTimeout(force);
+      generation.socket.close();
+    });
+  };
+  const spawnGeneration = async () => {
+    const socket = await bindUdp();
+    const warmupFrames = active ? options.warmupFrames ?? 0 : 0;
+    const args = options.args(socket.address().port, warmupFrames);
+    const child = spawn3("ffmpeg", args, { env: options.env, stdio: ["ignore", "ignore", "pipe"] });
+    child.stderr?.on("data", (chunk) => process.stderr.write(`[desktop-stream] ${chunk}`));
+    const generation = { id: ++nextId, child, socket, live: true, startedAt: Date.now(), warmupFrames };
+    socket.on("message", (data) => {
+      if (!generation.live || !isRtp(data)) return;
+      if (generation === candidate) {
+        if (generation.warmupFrames > 0) {
+          if (data[1] & 128) generation.warmupFrames -= 1;
+          return;
+        }
+        if (!options.joinable(data)) return;
+        clearTimeout(candidateDeadline);
+        candidate = void 0;
+        retire(active);
+        active = generation;
+      } else if (generation !== active) return;
+      options.onPacket(data, generation.id);
+    });
+    child.once("exit", (code, signal) => {
+      if (generation === candidate) {
+        clearTimeout(candidateDeadline);
+        candidate = void 0;
+        retire(generation);
+        log(`replacement exited (${signal || code}); keeping the current encoder`);
+        if (!active && wanted) restart = setTimeout(() => void start(), 500);
+        return;
+      }
+      if (generation !== active) return;
+      retire(generation);
+      active = void 0;
+      if (!wanted) return;
+      log(`encoder exited (${signal || code}); restarting`);
+      restart = setTimeout(() => void start(), 500);
+    });
+    return generation;
+  };
+  const enqueue = (task) => {
+    chain = chain.then(task).catch((error) => {
+      log(error instanceof Error ? error.message : String(error));
+    });
+    return chain;
+  };
+  const start = () => enqueue(async () => {
+    wanted = true;
+    clearTimeout(restart);
+    if (active || candidate) return;
+    active = await spawnGeneration();
+  });
+  const replace = () => enqueue(async () => {
+    if (!wanted) return;
+    if (!active) {
+      active = await spawnGeneration();
+      return;
+    }
+    clearTimeout(candidateDeadline);
+    retire(candidate);
+    const started = await spawnGeneration();
+    candidate = started;
+    candidateDeadline = setTimeout(() => {
+      if (candidate !== started) return;
+      candidate = void 0;
+      retire(started);
+      log("replacement produced no keyframe; keeping the current encoder");
+      if (!active && wanted) restart = setTimeout(() => void start(), 500);
+    }, 4e3);
+  });
+  const stop = () => enqueue(async () => {
+    wanted = false;
+    clearTimeout(restart);
+    clearTimeout(candidateDeadline);
+    retire(candidate);
+    retire(active);
+    candidate = void 0;
+    active = void 0;
+  });
+  return {
+    start,
+    replace,
+    stop,
+    running: () => Boolean(active && alive(active.child)),
+    replacing: () => Boolean(candidate),
+    generation: () => active?.id ?? 0,
+    pid: () => active?.child.pid ?? 0,
+    activeForMs: () => active ? Date.now() - active.startedAt : Number.POSITIVE_INFINITY
+  };
+}
+
+// src/input-bridge.ts
+import { spawn as spawn4 } from "child_process";
 var namedKeys = {
   AltLeft: "Alt_L",
   AltRight: "Alt_R",
@@ -3232,15 +3611,45 @@ var InputBridge = class {
   height;
   process;
   pointer;
+  closed = false;
   pointerFlush;
+  positionSequence = -1;
+  actionId = 0;
+  latestPosition;
   pressedButtons = /* @__PURE__ */ new Set();
   pressedKeys = /* @__PURE__ */ new Set();
   close() {
+    if (this.closed) return;
+    this.closed = true;
     this.release();
-    this.process?.kill("SIGTERM");
+    const child = this.process;
     this.process = void 0;
+    if (!child) return;
+    child.stdin.end();
+    const timeout = setTimeout(() => child.kill("SIGKILL"), 1e3);
+    timeout.unref();
+    child.once("exit", () => clearTimeout(timeout));
   }
   handle(message) {
+    if (this.closed) return;
+    if ("actionId" in message && message.actionId !== void 0) {
+      if (message.actionId !== this.actionId + 1) return;
+      this.actionId = message.actionId;
+    }
+    const sequence = "sequence" in message ? message.sequence : void 0;
+    const stale = sequence !== void 0 && sequence <= this.positionSequence;
+    if (stale && message.type === "pointer") return;
+    if (sequence !== void 0 && !stale) {
+      this.positionSequence = sequence;
+      if ("x" in message) this.latestPosition = this.coordinates(message.x, message.y);
+    }
+    this.apply(message);
+    if (stale && (message.type === "button" || message.type === "wheel" || message.type === "release") && this.latestPosition) {
+      this.pointer = this.latestPosition;
+      this.flushPointer(true);
+    }
+  }
+  apply(message) {
     if (message.type === "pointer") {
       this.pointer = this.coordinates(message.x, message.y);
       this.pointerFlush ??= setImmediate(() => this.flushPointer());
@@ -3248,7 +3657,7 @@ var InputBridge = class {
     }
     if (message.type === "button") {
       this.pointer = this.coordinates(message.x, message.y);
-      this.flushPointer();
+      this.flushPointer(true);
       const button = message.button === 0 ? 1 : message.button === 1 ? 2 : message.button === 2 ? 3 : 0;
       if (!button) return;
       if (message.down) {
@@ -3263,7 +3672,7 @@ var InputBridge = class {
     }
     if (message.type === "wheel") {
       this.pointer = this.coordinates(message.x, message.y);
-      this.flushPointer();
+      this.flushPointer(true);
       const vertical = Math.min(4, Math.max(1, Math.round(Math.abs(message.deltaY) / 80)));
       const horizontal = Math.min(4, Math.max(1, Math.round(Math.abs(message.deltaX) / 80)));
       if (Math.abs(message.deltaY) >= Math.abs(message.deltaX) && message.deltaY) {
@@ -3303,16 +3712,16 @@ var InputBridge = class {
       y: Math.round(Math.min(1, Math.max(0, y)) * (this.height - 1))
     };
   }
-  flushPointer() {
+  flushPointer(force = false) {
     if (this.pointerFlush) clearImmediate(this.pointerFlush);
     this.pointerFlush = void 0;
-    if (!this.pointer) return;
+    if (!this.pointer || !force && this.process?.stdin.writableNeedDrain) return;
     this.write(`mousemove ${this.pointer.x} ${this.pointer.y}`);
     this.pointer = void 0;
   }
   write(command) {
     if (!this.process || this.process.exitCode !== null || this.process.stdin.destroyed) {
-      const child = spawn3("xte", [], {
+      const child = spawn4("xte", [], {
         env: { ...process.env, DISPLAY: this.display },
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -3320,6 +3729,7 @@ var InputBridge = class {
       child.stderr.resume();
       child.stdin.on("error", () => {
       });
+      child.stdin.on("drain", () => this.flushPointer());
       child.once("exit", () => {
         if (this.process === child) this.process = void 0;
       });
@@ -3330,158 +3740,495 @@ var InputBridge = class {
   }
 };
 
-// src/media-protocol.ts
-var STREAM_PROTOCOL_VERSION = 1;
-var MEDIA_PACKET_HEADER_BYTES = 12;
-
-// src/rtp.ts
-function parseRtpPacket(data) {
-  if (data.length < 12 || data[0] >> 6 !== 2) return null;
-  if (data[1] >= 192 && data[1] <= 223) return null;
-  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
-  const padding = Boolean(data[0] & 32);
-  const extension = Boolean(data[0] & 16);
-  let offset = 12 + (data[0] & 15) * 4;
-  if (offset > data.length) return null;
-  if (extension) {
-    if (offset + 4 > data.length) return null;
-    offset += 4 + view.getUint16(offset + 2) * 4;
+// src/input-validation.ts
+var finite = (value) => typeof value === "number" && Number.isFinite(value);
+var optionalFinite = (value) => value === void 0 || finite(value);
+function validInput(value) {
+  if (!isRecord(value) || typeof value.type !== "string") return false;
+  if (value.sequence !== void 0 && (!finite(value.sequence) || !Number.isSafeInteger(value.sequence) || value.sequence < 0)) return false;
+  if (value.actionId !== void 0 && (!finite(value.actionId) || !Number.isSafeInteger(value.actionId) || value.actionId < 1)) return false;
+  switch (value.type) {
+    case "release":
+    case "keyframe":
+      return true;
+    case "theme":
+      return value.theme === "light" || value.theme === "dark";
+    case "ping":
+    case "pong":
+      return finite(value.sentAt);
+    case "stats":
+      return finite(value.videoFps) && finite(value.audioPacketsPerSecond) && finite(value.decodeQueue) && finite(value.rttMs) && optionalFinite(value.lossPercent) && optionalFinite(value.nacks) && optionalFinite(value.freezes) && optionalFinite(value.videoPacketsPerSecond) && optionalFinite(value.jitterBufferMs) && optionalFinite(value.availableKbps) && optionalFinite(value.playbackDroppedPercent);
+    case "key":
+      return typeof value.code === "string" && value.code.length < 40 && typeof value.down === "boolean";
+    case "answer":
+      return typeof value.sdp === "string" && value.sdp.length < 65536;
+    case "candidate":
+      return typeof value.candidate === "string" && value.candidate.length < 1024 && typeof value.mid === "string" && value.mid.length < 16;
+    case "fallback":
+      return typeof value.reason === "string" && value.reason.length < 200;
+    case "pointer":
+      return finite(value.x) && finite(value.y);
+    case "button":
+      return finite(value.x) && finite(value.y) && finite(value.button) && typeof value.down === "boolean";
+    case "wheel":
+      return finite(value.x) && finite(value.y) && finite(value.deltaX) && finite(value.deltaY);
+    default:
+      return false;
   }
-  const end = data.length - (padding ? data[data.length - 1] : 0);
-  if (offset >= end) return null;
+}
+function parseInput(raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  return validInput(value) ? value : void 0;
+}
+
+// ../shared/src/desktop-stream.ts
+var DEFAULT_STREAM_REQUEST = {
+  transport: "webrtc",
+  profile: "balanced",
+  adaptive: true,
+  iceTransportPolicy: "all"
+};
+function parseStreamRequest(query, defaults = DEFAULT_STREAM_REQUEST) {
+  const transport = query.get("transport");
+  const profile = query.get("profile");
+  const adapt = query.get("adapt");
+  const ice = query.get("ice");
   return {
-    marker: Boolean(data[1] & 128),
-    payload: data.subarray(offset, end),
-    sequence: view.getUint16(2),
-    timestamp: view.getUint32(4)
+    transport: transport === "webrtc" || transport === "websocket" ? transport : defaults.transport,
+    profile: profile === "text" || profile === "balanced" ? profile : defaults.profile,
+    adaptive: adapt === "0" ? false : adapt === "1" ? true : defaults.adaptive,
+    iceTransportPolicy: ice === "relay" || ice === "all" ? ice : defaults.iceTransportPolicy
   };
 }
-var RtpClock = class {
-  constructor(rate) {
-    this.rate = rate;
+var H264_PROFILES = {
+  high444: { payloadType: 99, profileLevelId: "f4001f", codec: "avc1.F4002A", label: "High 4:4:4" },
+  high: { payloadType: 96, profileLevelId: "64001f", codec: "avc1.64002A", label: "High" },
+  main: { payloadType: 97, profileLevelId: "4d001f", codec: "avc1.4D002A", label: "Main" },
+  baseline: { payloadType: 98, profileLevelId: "42e01f", codec: "avc1.42E02A", label: "Baseline" }
+};
+var PROFILE_ORDER = ["high444", "high", "main", "baseline"];
+
+// src/media-protocol.ts
+var STREAM_PROTOCOL_VERSION = 3;
+var MEDIA_PACKET_HEADER_BYTES = 12;
+
+// src/pacer.ts
+import { performance } from "perf_hooks";
+var ringSize = 4096;
+var staleQueueMs = 150;
+var burstMs = 20;
+var repairShare = 0.3;
+var repairSpacingMs = 30;
+var repairMaxAgeMs = 1500;
+var repairMaxSequenceAge = 700;
+var sendMaxSequenceAge = 1e3;
+var duplicateMaxAgeMs = 40;
+var duplicateQueueLimit = 64;
+var duplicateShare = 1;
+var PacedSender = class {
+  constructor(budgetBps, send, keyframe, now = () => performance.now()) {
+    this.budgetBps = budgetBps;
+    this.send = send;
+    this.keyframe = keyframe;
+    this.now = now;
+    this.tokens = budgetBps / 8e3 * burstMs;
+    this.lastDrainAt = now();
+    this.sample = { at: this.lastDrainAt, sentBytes: 0 };
+  }
+  budgetBps;
+  send;
+  keyframe;
+  now;
+  tokens;
+  lastDrainAt;
+  timer;
+  media = [];
+  mediaBytes = 0;
+  sendingFrame = -1;
+  awaitingKeyframe = true;
+  lastStaleAt = Number.NEGATIVE_INFINITY;
+  repairs = [];
+  repairWindow = [];
+  duplicates = [];
+  mediaWindow = [];
+  duplicateWindow = [];
+  ring = new Array(ringSize);
+  seq = Math.floor(Math.random() * 65536);
+  lastKeyframe = { frameId: -1, at: 0 };
+  protectUntil = 0;
+  open = true;
+  counters = { staleEvents: 0, droppedFrames: 0, repairsSent: 0, repairsSkipped: 0, duplicatesSent: 0, sentBytes: 0 };
+  sample;
+  setBudget(bitsPerSecond) {
+    this.budgetBps = bitsPerSecond;
+    this.bound(this.now());
+  }
+  /** Duplicate protection is worth its bandwidth only while loss is hurting; it never displaces fresh media. */
+  protect(forMs) {
+    this.protectUntil = forMs > 0 ? this.now() + forMs : 0;
+    if (!forMs) this.duplicates.length = 0;
+  }
+  enqueue(packet, frameId, keyframe, last) {
+    if (!this.open) return;
+    if (keyframe) this.awaitingKeyframe = false;
+    else if (this.awaitingKeyframe) return;
+    this.media.push({ packet, frameId, keyframe, last });
+    this.mediaBytes += packet.length;
+    this.bound(this.now());
+    this.drain();
   }
-  rate;
-  base;
-  last;
-  wraps = 0;
-  origin = 0;
-  emitted = 0;
   /**
-   * A fresh encoder starts RTP timestamps from a new random base, so the
-   * timeline continues from the last value emitted rather than jumping
-   * backwards — decoders and the viewer's media element both require
-   * monotonic presentation timestamps.
+   * Answers a receiver NACK for the sequence numbers it reports missing. The
+   * send itself is deferred: this runs inside the native feedback callback,
+   * where a failed send would abort the process instead of throwing.
    */
-  reset() {
-    this.origin = this.emitted;
-    this.base = void 0;
-    this.last = void 0;
-    this.wraps = 0;
+  repair(sequences, rttMs) {
+    const now = this.now();
+    for (const seq of sequences) {
+      const sent = this.ring[seq % ringSize];
+      if (!sent || sent.seq !== seq || now - sent.sentAt > repairMaxAgeMs || now - sent.repairedAt < repairSpacingMs || (this.seq - seq & 65535) > repairMaxSequenceAge || sent.frameId < this.lastKeyframe.frameId && now - this.lastKeyframe.at > rttMs + 100 || this.repairs.includes(sent)) {
+        this.counters.repairsSkipped += 1;
+        continue;
+      }
+      this.repairs.push(sent);
+    }
+    if (this.repairs.length > 0) this.schedule(0);
   }
-  microseconds(timestamp) {
-    if (this.last !== void 0 && timestamp < this.last && this.last - timestamp > 2147483648) this.wraps += 1;
-    this.last = timestamp;
-    const extended = timestamp + this.wraps * 4294967296;
-    this.base ??= extended;
-    this.emitted = this.origin + Math.round((extended - this.base) * 1e6 / this.rate);
-    return this.emitted;
+  snapshot() {
+    const now = this.now();
+    const sentKbps = Math.round((this.counters.sentBytes - this.sample.sentBytes) * 8 / Math.max(1, now - this.sample.at));
+    this.sample = { at: now, sentBytes: this.counters.sentBytes };
+    return {
+      budgetKbps: Math.round(this.budgetBps / 1e3),
+      queueMs: Math.round(this.mediaBytes * 8e3 / this.budgetBps),
+      queuedPackets: this.media.length,
+      staleEvents: this.counters.staleEvents,
+      droppedFrames: this.counters.droppedFrames,
+      repairsSent: this.counters.repairsSent,
+      repairsSkipped: this.counters.repairsSkipped,
+      duplicatesSent: this.counters.duplicatesSent,
+      protecting: now < this.protectUntil,
+      sentKbps
+    };
   }
-};
-var startCode = new Uint8Array([0, 0, 0, 1]);
-var H264RtpAssembler = class {
-  clock = new RtpClock(9e4);
-  chunks = [];
-  key = false;
-  timestamp;
-  sequence;
-  fragmentType;
-  damaged = false;
-  clearFrame() {
-    this.chunks = [];
-    this.key = false;
-    this.timestamp = void 0;
-    this.sequence = void 0;
-    this.fragmentType = void 0;
-    this.damaged = false;
+  close() {
+    this.open = false;
+    clearTimeout(this.timer);
+    this.media.length = 0;
+    this.repairs.length = 0;
+    this.duplicates.length = 0;
   }
-  reset() {
-    this.clock.reset();
-    this.clearFrame();
+  /**
+   * Cuts a stale queue back to what a decoder can still use. Frames before the
+   * first queued keyframe are worthless once one is coming; without one, every
+   * unsent delta frame goes and deltas keep going until the encoder answers the
+   * keyframe request. The frame being transmitted always completes.
+   */
+  bound(now) {
+    if (this.mediaBytes * 8e3 / this.budgetBps <= staleQueueMs) return;
+    const keyframeAt = this.media.findIndex((entry) => entry.keyframe);
+    const dropped = /* @__PURE__ */ new Set();
+    const kept = [];
+    this.media.forEach((entry, index) => {
+      if (entry.frameId === this.sendingFrame || (keyframeAt >= 0 ? index >= keyframeAt : entry.keyframe)) kept.push(entry);
+      else dropped.add(entry.frameId);
+    });
+    if (dropped.size === 0) return;
+    this.media.length = 0;
+    this.media.push(...kept);
+    this.mediaBytes = kept.reduce((total, entry) => total + entry.packet.length, 0);
+    this.counters.droppedFrames += dropped.size;
+    this.counters.staleEvents += 1;
+    if (keyframeAt >= 0) return;
+    this.awaitingKeyframe = true;
+    if (now - this.lastStaleAt < 500) return;
+    this.lastStaleAt = now;
+    this.keyframe();
   }
-  push(packet) {
-    if (this.timestamp !== void 0 && packet.timestamp !== this.timestamp) {
-      this.clearFrame();
+  schedule(delayMs) {
+    this.timer ??= setTimeout(() => {
+      this.timer = void 0;
+      this.drain();
+    }, delayMs);
+  }
+  drain() {
+    if (!this.open) return;
+    const now = this.now();
+    const rate = this.budgetBps / 8e3;
+    this.tokens = Math.min(rate * burstMs, this.tokens + (now - this.lastDrainAt) * rate);
+    this.lastDrainAt = now;
+    for (let repair = this.repairs[0]; repair && this.tokens >= repair.packet.length; repair = this.repairs[0]) {
+      this.repairs.shift();
+      if (!this.repairAllowed(now, repair.packet.length) || (this.seq - repair.seq & 65535) > sendMaxSequenceAge) {
+        this.counters.repairsSkipped += 1;
+        continue;
+      }
+      repair.repairedAt = now;
+      this.repairWindow.push({ at: now, bytes: repair.packet.length });
+      this.transmit(repair.packet);
+      this.counters.repairsSent += 1;
     }
-    this.timestamp ??= packet.timestamp;
-    if (this.sequence !== void 0 && packet.sequence !== (this.sequence + 1) % 65536) this.damaged = true;
-    this.sequence = packet.sequence;
-    const type = packet.payload[0] & 31;
-    if (this.damaged) {
-    } else if (type > 0 && type < 24 && this.fragmentType === void 0) {
-      this.chunks.push(startCode, packet.payload);
-      this.key ||= type === 5;
-    } else if (type === 24 && this.fragmentType === void 0) {
-      let offset2 = 1;
-      let nals = 0;
-      while (offset2 < packet.payload.length) {
-        if (offset2 + 2 > packet.payload.length) {
-          this.damaged = true;
-          break;
-        }
-        const size = packet.payload[offset2] * 256 + packet.payload[offset2 + 1];
-        offset2 += 2;
-        if (!size || offset2 + size > packet.payload.length) {
-          this.damaged = true;
-          break;
-        }
-        const nal = packet.payload.subarray(offset2, offset2 + size);
-        this.chunks.push(startCode, nal);
-        this.key ||= (nal[0] & 31) === 5;
-        offset2 += size;
-        nals += 1;
+    for (let next = this.media[0]; next && this.tokens >= next.packet.length; next = this.media[0]) {
+      this.media.shift();
+      this.mediaBytes -= next.packet.length;
+      this.dispatch(next, now);
+    }
+    while (this.media.length === 0) {
+      const copy = this.duplicates[0];
+      if (!copy || this.tokens < copy.packet.length) break;
+      if (now - copy.sentAt <= duplicateMaxAgeMs && !this.duplicateAllowed(now, copy.packet.length)) break;
+      this.duplicates.shift();
+      if (now - copy.sentAt > duplicateMaxAgeMs || (this.seq - copy.seq & 65535) > sendMaxSequenceAge) continue;
+      this.duplicateWindow.push({ at: now, bytes: copy.packet.length });
+      this.transmit(copy.packet);
+      this.counters.duplicatesSent += 1;
+    }
+    const head = this.repairs[0] ?? this.media[0] ?? this.duplicates[0];
+    if (head) this.schedule(Math.max(1, Math.ceil((head.packet.length - this.tokens) / rate)));
+  }
+  dispatch(entry, now) {
+    const packet = Buffer.from(entry.packet);
+    const seq = this.seq;
+    this.seq = seq + 1 & 65535;
+    packet.writeUInt16BE(seq, 2);
+    const sent = { seq, packet, frameId: entry.frameId, sentAt: now, repairedAt: Number.NEGATIVE_INFINITY };
+    this.ring[seq % ringSize] = sent;
+    this.sendingFrame = entry.last ? -1 : entry.frameId;
+    if (entry.keyframe && this.lastKeyframe.frameId !== entry.frameId) this.lastKeyframe = { frameId: entry.frameId, at: now };
+    this.transmit(packet);
+    while (this.mediaWindow.length > 0 && now - this.mediaWindow[0].at > 1e3) this.mediaWindow.shift();
+    this.mediaWindow.push({ at: now, bytes: packet.length });
+    if (now >= this.protectUntil) return;
+    if (this.duplicates.length >= duplicateQueueLimit) this.duplicates.shift();
+    this.duplicates.push(sent);
+  }
+  duplicateAllowed(now, bytes) {
+    for (const window of [this.mediaWindow, this.duplicateWindow]) while (window.length > 0 && now - window[0].at > 1e3) window.shift();
+    const media = this.mediaWindow.reduce((total, entry) => total + entry.bytes, 0);
+    return this.duplicateWindow.reduce((total, entry) => total + entry.bytes, bytes) <= media * duplicateShare;
+  }
+  repairAllowed(now, bytes) {
+    while (this.repairWindow.length > 0 && now - this.repairWindow[0].at > 1e3) this.repairWindow.shift();
+    return this.repairWindow.reduce((total, entry) => total + entry.bytes, bytes) <= this.budgetBps / 8 * repairShare;
+  }
+  transmit(packet) {
+    this.tokens -= packet.length;
+    this.counters.sentBytes += packet.length;
+    this.send(packet);
+  }
+};
+
+// src/rtcp.ts
+var RTPFB = 205;
+var PSFB = 206;
+function parseRtcpFeedback(packet, mediaSsrc) {
+  const feedback = { pli: false, nacks: [] };
+  let offset = 0;
+  while (offset + 4 <= packet.length) {
+    const size = (packet.readUInt16BE(offset + 2) + 1) * 4;
+    if (packet[offset] >> 6 !== 2 || offset + size > packet.length) return null;
+    let end = offset + size;
+    if (packet[offset] & 32) {
+      const padding = packet[end - 1];
+      if (!padding || padding > size - 4 || end !== packet.length) return null;
+      end -= padding;
+    }
+    const format2 = packet[offset] & 31;
+    const type = packet[offset + 1];
+    if (type === PSFB && format2 === 1 && end - offset >= 12 && packet.readUInt32BE(offset + 8) === mediaSsrc) feedback.pli = true;
+    else if (type === RTPFB && format2 === 1 && end - offset >= 16 && packet.readUInt32BE(offset + 8) === mediaSsrc) {
+      for (let item = offset + 12; item + 4 <= end; item += 4) {
+        const pid = packet.readUInt16BE(item);
+        const blp = packet.readUInt16BE(item + 2);
+        feedback.nacks.push(pid);
+        for (let bit = 0; bit < 16; bit += 1) if (blp & 1 << bit) feedback.nacks.push(pid + bit + 1 & 65535);
       }
-      if (!nals) this.damaged = true;
-    } else if (type === 28 && packet.payload.length >= 3) {
-      const fragmentType = packet.payload[1] & 31;
-      const start = Boolean(packet.payload[1] & 128);
-      const end = Boolean(packet.payload[1] & 64);
-      if (start && !end && this.fragmentType === void 0) {
-        this.fragmentType = fragmentType;
-        this.chunks.push(startCode, new Uint8Array([packet.payload[0] & 224 | fragmentType]));
-        this.key ||= fragmentType === 5;
-      } else if (!start && this.fragmentType === fragmentType) {
-        if (end) this.fragmentType = void 0;
-      } else {
-        this.damaged = true;
+    } else if (type === PSFB && format2 === 15 && end - offset >= 20 && packet.toString("latin1", offset + 12, offset + 16) === "REMB") {
+      const exponent = packet[offset + 17] >> 2;
+      const mantissa = (packet[offset + 17] & 3) << 16 | packet[offset + 18] << 8 | packet[offset + 19];
+      feedback.rembBps = mantissa * 2 ** exponent;
+    }
+    offset += size;
+  }
+  return offset === packet.length ? feedback : null;
+}
+
+// src/webrtc.ts
+var OPUS_PAYLOAD_TYPE = 111;
+var VIDEO_SSRC = 1382387713;
+var AUDIO_SSRC = 1382387714;
+var PLAYOUT_DELAY_ID = 6;
+var playoutDelayUri = "http://www.webrtc.org/experiments/rtp-hdrext/playout-delay";
+var ndc;
+async function loadWebRtc() {
+  try {
+    ndc = (await import("node-datachannel")).default;
+    ndc.initLogger("Error", (level, message) => process.stderr.write(`[desktop-stream] webrtc ${level.toLowerCase()}: ${message}
+`));
+    return true;
+  } catch (error) {
+    process.stderr.write(`[desktop-stream] WebRTC unavailable, streaming over the socket only: ${error instanceof Error ? error.message : String(error)}
+`);
+    return false;
+  }
+}
+var cleanupWebRtc = () => ndc?.cleanup();
+function parseIceServers(spec) {
+  const native = (spec ?? "stun:stun.l.google.com:19302").split(",").map((server) => server.trim()).filter(Boolean);
+  const browser = native.map((url) => {
+    const match = url.match(/^(turns?):([^:@]+):(.+)@([^@]+)$/);
+    return match ? { urls: `${match[1]}:${match[4]}`, username: match[2], credential: match[3] } : { urls: url };
+  });
+  return { native, browser };
+}
+var WebRtcViewer = class {
+  constructor(options, handlers) {
+    this.handlers = handlers;
+    if (!ndc) throw new Error("WebRTC is not loaded");
+    this.peer = new ndc.PeerConnection("viewer", {
+      iceServers: options.iceServers,
+      iceTransportPolicy: options.iceTransportPolicy,
+      disableAutoNegotiation: true,
+      ...options.portRange ? { portRangeBegin: options.portRange.begin, portRangeEnd: options.portRange.end } : {}
+    });
+    const video = new ndc.Video("0", "SendOnly");
+    for (const { payloadType, profileLevelId } of Object.values(H264_PROFILES)) {
+      video.addH264Codec(payloadType, `profile-level-id=${profileLevelId};packetization-mode=1;level-asymmetry-allowed=1`);
+    }
+    video.addSSRC(VIDEO_SSRC, "replicas-video", "replicas-desktop", "video");
+    video.parseSdpLine(`a=extmap:${PLAYOUT_DELAY_ID} ${playoutDelayUri}`);
+    this.video = this.peer.addTrack(video);
+    this.pacer = new PacedSender(options.budgetBps, (packet) => this.transmit(this.video, packet), () => handlers.keyframe("stale"));
+    this.video.onMessage((raw) => {
+      if (this.connected && typeof raw !== "string") this.onFeedback(raw);
+    });
+    const audio = new ndc.Audio("1", "SendOnly");
+    audio.addOpusCodec(OPUS_PAYLOAD_TYPE, "minptime=10;useinbandfec=1");
+    audio.addSSRC(AUDIO_SSRC, "replicas-audio", "replicas-desktop", "audio");
+    this.audio = this.peer.addTrack(audio);
+    this.channels = [this.peer.createDataChannel("input"), this.peer.createDataChannel("pointer", { unordered: true, maxRetransmits: 0 })];
+    for (const resource of [this.video, this.audio, ...this.channels]) resource.onClosed(() => {
+    });
+    for (const channel of this.channels) {
+      channel.onMessage((raw) => {
+        const message = typeof raw === "string" ? parseInput(raw) : void 0;
+        if (message) handlers.message(message, (reply) => void (channel.isOpen() && channel.sendMessage(JSON.stringify(reply))));
+      });
+    }
+    this.peer.onLocalDescription((sdp) => handlers.offer(sdp));
+    this.peer.onLocalCandidate((candidate, mid) => handlers.candidate(candidate, mid));
+    this.peer.onStateChange((state) => {
+      this.connected = !this.closed && state === "connected";
+      if (this.connected) handlers.connected();
+      else if (!this.closed && (state === "disconnected" || state === "failed" || state === "closed")) handlers.disconnected(state);
+    });
+    this.peer.setLocalDescription();
+  }
+  handlers;
+  peer;
+  video;
+  audio;
+  channels;
+  pacer;
+  profiles = /* @__PURE__ */ new Set();
+  connected = false;
+  closed = false;
+  remb;
+  answer(sdp) {
+    const section = sdp.split(/^m=/m).find((part) => part.startsWith("video")) ?? "";
+    for (const profile of PROFILE_ORDER) {
+      if (new RegExp(`^a=rtpmap:${H264_PROFILES[profile].payloadType} H264/90000`, "m").test(section)) this.profiles.add(profile);
+    }
+    this.peer.setRemoteDescription(sdp, "answer");
+  }
+  candidate(candidate, mid) {
+    this.peer.addRemoteCandidate(candidate, mid);
+  }
+  setBudget(bitsPerSecond) {
+    this.pacer.setBudget(bitsPerSecond);
+  }
+  protect(forMs) {
+    this.pacer.protect(forMs);
+  }
+  enqueueVideo(packet, frameId, keyframe, last) {
+    if (this.connected && this.video.isOpen()) this.pacer.enqueue(packet, frameId, keyframe, last);
+  }
+  sendAudio(packet) {
+    if (this.connected && this.audio.isOpen()) this.transmit(this.audio, packet);
+  }
+  snapshot() {
+    return { ...this.pacer.snapshot(), rembKbps: this.remb === void 0 ? null : Math.round(this.remb / 1e3) };
+  }
+  get rttMs() {
+    const rtt = this.connected ? this.peer.rtt() : -1;
+    return rtt > 0 ? rtt : null;
+  }
+  get path() {
+    const pair = this.connected ? this.peer.getSelectedCandidatePair() : null;
+    return pair ? `${pair.local.type}/${pair.remote.type} ${pair.remote.transportType.toLowerCase()}` : null;
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.connected = false;
+    this.pacer.close();
+    for (const resource of [...this.channels, this.video, this.audio, this.peer]) {
+      try {
+        resource.close();
+      } catch {
       }
-      if (!this.damaged) this.chunks.push(packet.payload.subarray(2));
-    } else this.damaged = true;
-    if (!packet.marker) return null;
-    if (this.damaged || this.fragmentType !== void 0 || this.chunks.length === 0) {
-      this.clearFrame();
-      return null;
     }
-    const length = this.chunks.reduce((total, chunk) => total + chunk.length, 0);
-    const data = new Uint8Array(length);
-    let offset = 0;
-    for (const chunk of this.chunks) {
-      data.set(chunk, offset);
-      offset += chunk.length;
+  }
+  onFeedback(raw) {
+    const feedback = parseRtcpFeedback(raw, VIDEO_SSRC);
+    if (!feedback) return;
+    if (feedback.pli) this.handlers.keyframe("pli");
+    if (feedback.rembBps !== void 0) {
+      this.remb = feedback.rembBps;
+      this.handlers.remb(feedback.rembBps);
+    }
+    if (feedback.nacks.length > 0) this.pacer.repair(feedback.nacks, this.rttMs ?? 100);
+  }
+  sendFailures = 0;
+  // Sends run from pacer timers, where a thrown error would take the whole
+  // stream server down. Native closure racing the isOpen check is expected;
+  // anything else is logged a few times and the packet is dropped.
+  transmit(track, packet) {
+    try {
+      track.sendMessageBinary(packet);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (/closed|not open/i.test(message) || this.sendFailures++ >= 5) return;
+      process.stderr.write(`[desktop-stream] webrtc send failed: ${message}
+`);
     }
-    const frame = { data, key: this.key, timestamp: this.clock.microseconds(packet.timestamp) };
-    this.clearFrame();
-    return frame;
   }
 };
 
 // src/media-server.ts
-import WebSocket2, { WebSocketServer } from "ws";
 var width = Number.parseInt(process.env.REPLICAS_DESKTOP_WIDTH || String(DESKTOP_VIEWER_WIDTH), 10);
 var height = Number.parseInt(process.env.REPLICAS_DESKTOP_HEIGHT || String(DESKTOP_VIEWER_HEIGHT), 10);
-var cores = availableParallelism();
+var basePreset = availableParallelism() >= 4 ? "superfast" : "ultrafast";
 var fps = Number.parseInt(process.env.REPLICAS_DESKTOP_STREAM_FPS || "", 10) || 60;
-var x264Preset = cores >= 4 ? "superfast" : "ultrafast";
 var port = Number.parseInt(process.env.REPLICAS_DESKTOP_STREAM_PORT || String(DESKTOP_STREAM_PORT), 10);
+var display = process.env.REPLICAS_DESKTOP_DISPLAY?.replace(/^([^:])/, ":$1") || ":99";
+var webrtcEnabled = process.env.REPLICAS_DESKTOP_STREAM_WEBRTC !== "0";
+var runtimeEnvFile = process.env.REPLICAS_RUNTIME_ENV_FILE || "/home/user/.replicas/runtime-env.sh";
+var colorMode = process.env.REPLICAS_DESKTOP_STREAM_COLOR === "legacy" ? "legacy" : "bt709";
+var defaultRequest = parseStreamRequest(new URLSearchParams({
+  transport: process.env.REPLICAS_DESKTOP_STREAM_TRANSPORT ?? "",
+  profile: process.env.REPLICAS_DESKTOP_STREAM_PROFILE ?? "",
+  adapt: process.env.REPLICAS_DESKTOP_STREAM_ADAPTIVE ?? ""
+}));
+var icePorts = (() => {
+  const match = process.env.REPLICAS_DESKTOP_STREAM_ICE_PORTS?.match(/^(\d+)-(\d+)$/);
+  return match ? { begin: Number(match[1]), end: Number(match[2]) } : void 0;
+})();
 var configuredTopKbps = (() => {
   const raw = process.env.REPLICAS_DESKTOP_STREAM_VIDEO_BITRATE?.trim();
   const match = raw?.match(/^(\d+(?:\.\d+)?)([MmKk]?)$/);
@@ -3489,32 +4236,25 @@ var configuredTopKbps = (() => {
   const value = Number.parseFloat(match[1]);
   return Math.max(1, Math.round(match[2].toLowerCase() === "m" ? value * 1e3 : value));
 })();
-var qualityLadder = [
-  { fps, kbps: configuredTopKbps, crf: 18 },
-  { fps: Math.max(1, Math.round(fps / 2)), kbps: 6e3, crf: 20 },
-  { fps: Math.max(1, Math.round(fps / 2)), kbps: 3e3, crf: 23 },
-  { fps: Math.max(1, Math.round(fps / 4)), kbps: 1200, crf: 26 }
-];
-var keyframeMs = 250;
-var probeIntervalMs = 250;
+var profiles = {
+  balanced: { crf: 14, chromaQpOffset: 0 },
+  text: { crf: 10, chromaQpOffset: -6 }
+};
+var rungCaps = [configuredTopKbps, 12e3, 8e3, 5e3, 3e3, 1500].map((kbps) => Math.min(kbps, configuredTopKbps));
+var qualityLadder = (profile) => rungCaps.map((kbps, index) => ({ kbps, crf: profiles[profile].crf + 2 * index, keyframeMs: index >= 4 ? 2e3 : 1e3 }));
+var fullChromaMinKbps = 8e3;
+var fallbackKeyframeMs = 250;
+var webrtcStartupRung = 2;
+var vbvMs = 100;
 var targetBacklogMs = 120;
 var congestedBacklogMs = 250;
 var congestedDecodeQueue = 3;
 var fallbackBufferedBytes = 512 * 1024;
 var maximumBufferedBytes = 4 * 1024 * 1024;
-var display = process.env.REPLICAS_DESKTOP_DISPLAY?.replace(/^([^:])/, ":$1") || ":99";
-var videoCodec = "avc1.42E02A";
-var config = {
-  type: "config",
-  protocolVersion: STREAM_PROTOCOL_VERSION,
-  width,
-  height,
-  fps,
-  videoCodec,
-  audioCodec: "opus",
-  audioSampleRate: 48e3,
-  audioChannels: 2
-};
+var probeIntervalMs = 250;
+var telemetryIntervalMs = 500;
+var budgetFactor = 1.25;
+var protectMs = 1e4;
 var packageRoot = resolve2(dirname6(fileURLToPath(import.meta.url)), "..");
 var webroot = process.env.REPLICAS_DESKTOP_STREAM_WEBROOT || resolve2(packageRoot, "assets", "desktop");
 var contentTypes = {
@@ -3524,17 +4264,6 @@ var contentTypes = {
   ".svg": "image/svg+xml",
   ".woff2": "font/woff2"
 };
-function bindUdp() {
-  return new Promise((resolveSocket, reject) => {
-    const socket = createSocket("udp4");
-    socket.once("error", reject);
-    socket.bind(0, "127.0.0.1", () => {
-      socket.off("error", reject);
-      socket.setRecvBufferSize(4 * 1024 * 1024);
-      resolveSocket(socket);
-    });
-  });
-}
 function mediaPacket(kind, timestamp, payload) {
   const header = Buffer.alloc(MEDIA_PACKET_HEADER_BYTES);
   header[0] = kind;
@@ -3542,17 +4271,13 @@ function mediaPacket(kind, timestamp, payload) {
   header.writeBigUInt64BE(BigInt(Math.max(0, timestamp)), 4);
   return Buffer.concat([header, payload]);
 }
-function validInput(value) {
-  if (!value || typeof value !== "object" || !("type" in value) || typeof value.type !== "string") return false;
-  if (value.type === "release") return true;
-  if (value.type === "theme") return "theme" in value && (value.theme === "light" || value.theme === "dark");
-  if (value.type === "stats") return "videoFps" in value && typeof value.videoFps === "number" && Number.isFinite(value.videoFps) && "audioPacketsPerSecond" in value && typeof value.audioPacketsPerSecond === "number" && Number.isFinite(value.audioPacketsPerSecond) && "decodeQueue" in value && typeof value.decodeQueue === "number" && Number.isFinite(value.decodeQueue) && "rttMs" in value && typeof value.rttMs === "number" && Number.isFinite(value.rttMs);
-  if (value.type === "ping" || value.type === "pong") return "sentAt" in value && typeof value.sentAt === "number";
-  if (value.type === "key") return "code" in value && typeof value.code === "string" && value.code.length < 40 && "down" in value && typeof value.down === "boolean";
-  if (!("x" in value) || !("y" in value) || typeof value.x !== "number" || typeof value.y !== "number") return false;
-  if (value.type === "pointer") return true;
-  if (value.type === "button") return "button" in value && typeof value.button === "number" && "down" in value && typeof value.down === "boolean";
-  return value.type === "wheel" && "deltaX" in value && typeof value.deltaX === "number" && "deltaY" in value && typeof value.deltaY === "number";
+function currentIceServers() {
+  let spec = process.env.REPLICAS_DESKTOP_STREAM_ICE_SERVERS;
+  try {
+    spec = parsePosixEnvFile(readFileSync6(runtimeEnvFile, "utf8")).REPLICAS_DESKTOP_STREAM_ICE_SERVERS ?? spec;
+  } catch {
+  }
+  return parseIceServers(spec);
 }
 var appliedTheme;
 var pendingTheme;
@@ -3571,142 +4296,270 @@ function drainDesktopTheme() {
     if (applied) appliedTheme = theme;
     drainDesktopTheme();
   };
-  const child = spawn4("bash", [SERVICES_SCRIPT, "--theme", theme], { detached: true, stdio: "ignore" });
+  const child = spawn5("bash", [SERVICES_SCRIPT, "--theme", theme], { detached: true, stdio: "ignore" });
   child.unref();
   child.once("exit", (code) => finish(code === 0));
   child.once("error", () => finish(false));
 }
+function processCpuMs(pid) {
+  if (!pid) return 0;
+  try {
+    const stat = readFileSync6(`/proc/${pid}/stat`, "utf8");
+    const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+    return (Number(fields[11]) + Number(fields[12])) * 10;
+  } catch {
+    return 0;
+  }
+}
 async function runMediaServer() {
   if (![width, height, fps, port].every((value) => Number.isInteger(value) && value > 0)) throw new Error("Invalid desktop stream dimensions, frame rate, or port");
-  const videoSocket = await bindUdp();
-  const audioSocket = await bindUdp();
-  const videoPort = videoSocket.address().port;
-  const audioPort = audioSocket.address().port;
+  const webrtc = webrtcEnabled && await loadWebRtc();
+  const viewers = /* @__PURE__ */ new Map();
   const videoAssembler = new H264RtpAssembler();
   const audioClock = new RtpClock(48e3);
-  const clients = /* @__PURE__ */ new Map();
-  let encoderStop;
+  const videoSplicer = new RtpSplicer();
+  const audioSplicer = new RtpSplicer();
+  let activeProfile = "balanced";
+  let adaptive = true;
   let rung = 0;
   let descents = 0;
   let congestedSeconds = 0;
   let comfortableSeconds = 0;
+  let cleanTransportSeconds = 0;
+  let lastDescentAt = 0;
+  let lastAscentAt = 0;
+  let blockedRung = -1;
+  let blockedUntil = 0;
+  let preset = basePreset;
+  let starvedSeconds = 0;
+  let encoderHealthyTicks = 0;
+  let presetHealthySeconds = 0;
+  let framesAtTick = 0;
+  let bytesAtTick = 0;
+  let videoKbps = 0;
+  const recentVideoKbps = [];
+  let encoderFps = 0;
+  let videoWanted = false;
+  let encoderSignature = "";
+  let encoderStop;
+  let joinKeyframe;
   let lastVideoAt = 0;
+  let lastKeyframeAt = 0;
+  let lastSwapAt = 0;
   let lastAudioAt = 0;
   let videoFrames = 0;
+  let videoKeyframes = 0;
   let audioPackets = 0;
   let videoBytes = 0;
   let audioBytes = 0;
-  const queueMs = (state) => {
-    if (!state.probeAnswered) return 0;
-    const outstanding = state.probeSentAt ? Date.now() - state.probeSentAt : 0;
-    return Math.max(0, Math.max(state.probeAckedMs, outstanding) - state.baselineMs);
+  const ladder = () => qualityLadder(activeProfile);
+  const socketViewers = () => [...viewers.values()].filter((viewer) => viewer.fallback);
+  const profile = () => {
+    const requires420 = ladder()[rung].kbps < fullChromaMinKbps || socketViewers().length > 0;
+    const accepted = [...viewers.values()].flatMap((viewer) => viewer.rtc && viewer.rtc.profiles.size ? [viewer.rtc.profiles] : []);
+    if (accepted.length === 0) return "main";
+    return PROFILE_ORDER.find((candidate) => (!requires420 || candidate !== "high444") && accepted.every((set) => set.has(candidate))) ?? "baseline";
   };
-  const broadcast = (packet, keyframe = false) => {
-    for (const [client, state] of clients) {
-      if (client.readyState !== WebSocket2.OPEN) continue;
-      if (client.bufferedAmount > maximumBufferedBytes) {
-        client.close(1013, "stream client is too slow");
+  const encoderParams = () => {
+    const quality = ladder()[rung];
+    const sockets = socketViewers().length > 0;
+    const keyframeMs = sockets ? Math.min(quality.keyframeMs, fallbackKeyframeMs) : quality.keyframeMs;
+    const videoProfile = profile();
+    const intraRefresh = !sockets;
+    const pixelFormat = videoProfile === "high444" ? "yuv444p" : "yuv420p";
+    return {
+      quality,
+      preset,
+      profile: videoProfile,
+      keyframeMs,
+      intraRefresh,
+      pixelFormat,
+      chromaQpOffset: profiles[activeProfile].chromaQpOffset,
+      signature: `rung ${rung} \xB7 ${activeProfile} crf ${quality.crf} \xB7 ${preset} \xB7 ${videoProfile} \xB7 keyframe ${keyframeMs}ms${intraRefresh ? " refresh" : ""}`
+    };
+  };
+  const budgetBps = () => ladder()[rung].kbps * 1e3 * budgetFactor;
+  const queueMs = (viewer) => {
+    if (!viewer.probeAnswered) return 0;
+    const outstanding = viewer.probeSentAt ? Date.now() - viewer.probeSentAt : 0;
+    return Math.max(0, Math.max(viewer.probeAckedMs, outstanding) - viewer.baselineMs);
+  };
+  const broadcast = (packet, keyframe2 = false) => {
+    for (const viewer of viewers.values()) {
+      const { socket } = viewer;
+      if (!viewer.fallback || socket.readyState !== WebSocket2.OPEN) continue;
+      if (socket.bufferedAmount > maximumBufferedBytes) {
+        socket.close(1013, "stream client is too slow");
         continue;
       }
-      if (!keyframe && (state.waitingForKeyframe || queueMs(state) > targetBacklogMs || client.bufferedAmount > fallbackBufferedBytes)) {
-        state.waitingForKeyframe = true;
+      if (!keyframe2 && (viewer.waitingForKeyframe || queueMs(viewer) > targetBacklogMs || socket.bufferedAmount > fallbackBufferedBytes)) {
+        viewer.waitingForKeyframe = true;
         continue;
       }
-      if (keyframe) state.waitingForKeyframe = false;
-      client.send(packet, { binary: true });
+      if (keyframe2) viewer.waitingForKeyframe = false;
+      socket.send(packet, { binary: true });
     }
   };
-  videoSocket.on("message", (data) => {
-    const rtp = parseRtpPacket(data);
-    if (!rtp) return;
-    const frame = videoAssembler.push(rtp);
-    if (!frame) return;
+  let frameId = 0;
+  let frameStart = true;
+  let keyframe = false;
+  let videoGeneration = 0;
+  const onVideoPacket = (packet, generation) => {
     lastVideoAt = Date.now();
-    videoFrames += 1;
-    videoBytes += frame.data.byteLength;
-    const packet = mediaPacket(frame.key ? 1 /* VideoKey */ : 2 /* VideoDelta */, frame.timestamp, frame.data);
-    broadcast(packet, frame.key);
-  });
-  audioSocket.on("message", (data) => {
-    const rtp = parseRtpPacket(data);
-    if (!rtp) return;
+    videoBytes += packet.length;
+    if (generation !== videoGeneration) {
+      if (videoGeneration && !frameStart) frameId += 1;
+      videoGeneration = generation;
+      frameStart = true;
+    }
+    if (frameStart) {
+      keyframe = isKeyframeStart(rtpPayload(packet));
+      if (keyframe) {
+        lastKeyframeAt = lastVideoAt;
+        videoKeyframes += 1;
+      }
+    }
+    const last = Boolean(packet[1] & 128);
+    videoSplicer.splice(packet, generation, Math.round(9e4 / fps));
+    let rtp;
+    let sockets = false;
+    for (const viewer of viewers.values()) {
+      if (viewer.fallback) sockets = true;
+      else viewer.rtc?.enqueueVideo(rtp ??= withPlayoutDelay(packet, PLAYOUT_DELAY_ID), frameId, keyframe, last);
+    }
+    frameStart = last;
+    if (last) {
+      videoFrames += 1;
+      frameId += 1;
+    }
+    if (!sockets) return;
+    const parsed = parseRtpPacket(packet);
+    const frame = parsed && videoAssembler.push(parsed);
+    if (frame) broadcast(mediaPacket(frame.key ? 1 /* VideoKey */ : 2 /* VideoDelta */, frame.timestamp, frame.data), frame.key);
+  };
+  const onAudioPacket = (packet, generation) => {
     lastAudioAt = Date.now();
+    audioBytes += packet.length;
     audioPackets += 1;
-    audioBytes += rtp.payload.byteLength;
-    broadcast(mediaPacket(3 /* Audio */, audioClock.microseconds(rtp.timestamp), rtp.payload));
-  });
-  const superviseEncoder = (label, prepare, buildArgs, niceness = 0) => {
-    let child;
-    let retiring;
-    let restart;
-    let intent = 0;
-    const alive = (process2) => Boolean(process2 && process2.exitCode === null && process2.signalCode === null);
-    const start = () => {
-      clearTimeout(encoderStop);
-      if (alive(child)) return;
-      if (retiring) return;
-      clearTimeout(restart);
-      prepare();
-      const argv = niceness > 0 ? ["nice", "-n", String(niceness), "ffmpeg", ...buildArgs()] : ["ffmpeg", ...buildArgs()];
-      const spawned = spawn4(argv[0], argv.slice(1), { env: { ...process.env, DISPLAY: display }, stdio: ["ignore", "ignore", "pipe"] });
-      spawned.stderr?.on("data", (chunk) => process.stderr.write(`[desktop-stream] ${chunk}`));
-      child = spawned;
-      spawned.once("exit", (code, signal) => {
-        if (child !== spawned) return;
-        child = void 0;
-        if (clients.size === 0) return;
-        process.stderr.write(`[desktop-stream] ${label} encoder exited (${signal || code}); restarting
-`);
-        restart = setTimeout(start, 500);
-      });
-    };
-    return {
-      start,
-      running: () => alive(child),
-      stop: () => {
-        intent += 1;
-        clearTimeout(restart);
-        child?.kill("SIGTERM");
-        retiring?.kill("SIGKILL");
-        child = void 0;
-        retiring = void 0;
-      },
-      replace: () => {
-        const issued = intent += 1;
-        clearTimeout(restart);
-        const previous = child ?? retiring;
-        child = void 0;
-        retiring = void 0;
-        if (!alive(previous)) {
-          start();
-          return;
-        }
-        retiring = previous;
-        let settled = false;
-        const resume = () => {
-          if (settled) return;
-          settled = true;
-          clearTimeout(forceExit);
-          clearTimeout(abandonWait);
-          if (intent !== issued) return;
-          retiring = void 0;
-          if (clients.size === 0) return;
-          start();
-        };
-        const forceExit = setTimeout(() => previous.kill("SIGKILL"), 2e3);
-        const abandonWait = setTimeout(resume, 4e3);
-        previous.once("exit", resume);
-        previous.kill("SIGTERM");
-      }
-    };
+    audioSplicer.splice(packet, generation, 960);
+    let sockets = false;
+    for (const viewer of viewers.values()) {
+      if (viewer.fallback) sockets = true;
+      else viewer.rtc?.sendAudio(packet);
+    }
+    if (!sockets) return;
+    const parsed = parseRtpPacket(packet);
+    if (parsed) broadcast(mediaPacket(3 /* Audio */, audioClock.microseconds(parsed.timestamp), parsed.payload));
   };
-  const videoEncoder = superviseEncoder("video", () => {
-    videoAssembler.reset();
-    for (const state of clients.values()) state.waitingForKeyframe = true;
-  }, () => {
-    const quality = qualityLadder[rung];
-    const keyframeInterval = Math.max(1, Math.round(quality.fps * keyframeMs / 1e3));
-    return [
+  const env = { ...process.env, DISPLAY: display };
+  const videoEncoder = superviseEncoder({
+    label: "video",
+    // Initial encoder work can leave its first image older than the outgoing stream.
+    warmupFrames: 2,
+    env,
+    onPacket: onVideoPacket,
+    joinable: (packet) => isKeyframeStart(rtpPayload(packet)),
+    args: (udpPort, warmupFrames) => {
+      const { quality, keyframeMs, profile: videoProfile, intraRefresh, pixelFormat, chromaQpOffset } = encoderParams();
+      const keyframeInterval = Math.max(1, Math.round(fps * keyframeMs / 1e3));
+      const filters = [
+        // Skip rapid catch-up captures after a stall; reset after backward clock adjustments.
+        `select='isnan(prev_selected_t)+lt(t,prev_selected_t)+gte(t-prev_selected_t,${0.5 / fps})'`,
+        colorMode === "bt709" ? `scale=out_color_matrix=bt709:out_range=tv,format=${pixelFormat}` : `format=${pixelFormat}`
+      ];
+      const x264 = [
+        "repeat-headers=1",
+        "sliced-threads=1",
+        "slices=4",
+        `keyint=${keyframeInterval}`,
+        `min-keyint=${keyframeInterval}`,
+        "scenecut=0",
+        `chroma-qp-offset=${chromaQpOffset}`,
+        ...intraRefresh ? ["intra-refresh=1"] : []
+      ];
+      return [
+        "-hide_banner",
+        "-loglevel",
+        "warning",
+        "-fflags",
+        "nobuffer",
+        "-flags",
+        "low_delay",
+        "-probesize",
+        "32",
+        "-analyzeduration",
+        "0",
+        // Raw 1080p frames are 8MB each; a shallow capture queue bounds memory
+        // and prevents stalled encoding from retaining seconds of stale frames.
+        "-thread_queue_size",
+        "1",
+        "-f",
+        "x11grab",
+        "-draw_mouse",
+        "0",
+        "-framerate",
+        String(fps),
+        "-video_size",
+        `${width}x${height}`,
+        "-use_wallclock_as_timestamps",
+        "1",
+        "-i",
+        `${display}.0`,
+        "-vf",
+        filters.join(","),
+        ...warmupFrames ? ["-force_key_frames", `expr:eq(n,${warmupFrames})`, "-forced-idr", "1"] : [],
+        "-an",
+        "-c:v",
+        "libx264",
+        "-preset",
+        preset,
+        "-tune",
+        "zerolatency",
+        "-threads",
+        String(Math.min(4, availableParallelism())),
+        "-profile:v",
+        videoProfile,
+        "-level:v",
+        "4.2",
+        "-pix_fmt",
+        pixelFormat,
+        ...colorMode === "bt709" ? ["-color_primaries", "bt709", "-color_trc", "bt709", "-colorspace", "bt709", "-color_range", "tv"] : [],
+        "-bf",
+        "0",
+        "-g",
+        String(keyframeInterval),
+        "-keyint_min",
+        String(keyframeInterval),
+        "-sc_threshold",
+        "0",
+        "-crf",
+        String(quality.crf),
+        "-maxrate",
+        `${quality.kbps}k`,
+        "-bufsize",
+        `${Math.round(quality.kbps * Math.min(keyframeMs, vbvMs) / 1e3)}k`,
+        "-x264-params",
+        x264.join(":"),
+        "-fps_mode",
+        "passthrough",
+        "-flush_packets",
+        "1",
+        "-f",
+        "rtp",
+        "-payload_type",
+        String(H264_PROFILES[videoProfile].payloadType),
+        "-ssrc",
+        String(VIDEO_SSRC),
+        `rtp://127.0.0.1:${udpPort}?pkt_size=1200&connect=1&rtcpport=${udpPort}`
+      ];
+    }
+  });
+  const audioEncoder = superviseEncoder({
+    label: "audio",
+    env,
+    onPacket: onAudioPacket,
+    joinable: () => true,
+    args: (udpPort) => [
       "-hide_banner",
       "-loglevel",
       "warning",
@@ -3721,172 +4574,431 @@ async function runMediaServer() {
       "-thread_queue_size",
       "1024",
       "-f",
-      "x11grab",
-      "-draw_mouse",
-      "0",
-      "-framerate",
-      String(quality.fps),
-      "-video_size",
-      `${width}x${height}`,
+      "pulse",
+      "-fragment_size",
+      "2048",
       "-use_wallclock_as_timestamps",
       "1",
       "-i",
-      `${display}.0`,
-      "-an",
-      "-c:v",
-      "libx264",
-      "-preset",
-      x264Preset,
-      "-tune",
-      "zerolatency",
-      "-profile:v",
-      "baseline",
-      "-level:v",
-      "4.2",
-      "-pix_fmt",
-      "yuv420p",
-      "-bf",
-      "0",
-      "-g",
-      String(keyframeInterval),
-      "-keyint_min",
-      String(keyframeInterval),
-      "-sc_threshold",
-      "0",
-      "-crf",
-      String(quality.crf),
-      "-maxrate",
-      `${quality.kbps}k`,
-      "-bufsize",
-      `${Math.round(quality.kbps * keyframeMs / 1e3)}k`,
-      "-x264-params",
-      `repeat-headers=1:sliced-threads=1:slices=4:keyint=${keyframeInterval}:min-keyint=${keyframeInterval}:scenecut=0`,
-      "-fps_mode",
-      "passthrough",
+      process.env.REPLICAS_DESKTOP_STREAM_AUDIO_SOURCE || "default",
+      "-vn",
+      "-af",
+      "aresample=async=1:first_pts=0",
+      "-c:a",
+      "libopus",
+      "-application",
+      "lowdelay",
+      "-frame_duration",
+      "20",
+      "-b:a",
+      "128k",
+      "-ar",
+      "48000",
+      "-ac",
+      "2",
       "-flush_packets",
       "1",
       "-f",
       "rtp",
       "-payload_type",
-      "96",
-      `rtp://127.0.0.1:${videoPort}?pkt_size=1200&connect=1&rtcpport=${videoPort}`
-    ];
-  }, 10);
-  const audioEncoder = superviseEncoder("audio", () => audioClock.reset(), () => [
-    "-hide_banner",
-    "-loglevel",
-    "warning",
-    "-fflags",
-    "nobuffer",
-    "-flags",
-    "low_delay",
-    "-probesize",
-    "32",
-    "-analyzeduration",
-    "0",
-    "-thread_queue_size",
-    "1024",
-    "-f",
-    "pulse",
-    "-fragment_size",
-    "2048",
-    "-use_wallclock_as_timestamps",
-    "1",
-    "-i",
-    process.env.REPLICAS_DESKTOP_STREAM_AUDIO_SOURCE || "default",
-    "-vn",
-    "-af",
-    "aresample=async=1:first_pts=0",
-    "-c:a",
-    "libopus",
-    "-application",
-    "lowdelay",
-    "-frame_duration",
-    "20",
-    "-b:a",
-    "128k",
-    "-ar",
-    "48000",
-    "-ac",
-    "2",
-    "-flush_packets",
-    "1",
-    "-f",
-    "rtp",
-    "-payload_type",
-    "111",
-    `rtp://127.0.0.1:${audioPort}?pkt_size=1200&connect=1&rtcpport=${audioPort}`
-  ]);
-  const startEncoders = () => {
-    videoEncoder.start();
-    audioEncoder.start();
+      String(OPUS_PAYLOAD_TYPE),
+      "-ssrc",
+      String(AUDIO_SSRC),
+      `rtp://127.0.0.1:${udpPort}?pkt_size=1200&connect=1&rtcpport=${udpPort}`
+    ]
+  });
+  const ensureEncoders = () => {
+    clearTimeout(encoderStop);
+    void audioEncoder.start();
+    const { signature } = encoderParams();
+    if (!videoWanted) {
+      videoWanted = true;
+      encoderSignature = signature;
+      void videoEncoder.start();
+      return false;
+    }
+    if (signature === encoderSignature) return false;
+    encoderSignature = signature;
+    lastSwapAt = Date.now();
+    process.stderr.write(`[desktop-stream] encoder \u2192 ${signature}
+`);
+    void videoEncoder.replace();
+    return true;
+  };
+  const syncEncoder = () => videoWanted && viewers.size > 0 && ensureEncoders();
+  const stopEncodersSoon = () => {
+    clearTimeout(encoderStop);
+    encoderStop = setTimeout(() => {
+      if (viewers.size > 0) return;
+      videoWanted = false;
+      void videoEncoder.stop();
+      void audioEncoder.stop();
+    }, 5e3);
   };
   const setRung = (next) => {
     if (next === rung) return;
-    if (next > rung) descents += 1;
+    const now = Date.now();
+    if (next > rung) {
+      if (now - lastDescentAt > 1e4) descents += 1;
+      lastDescentAt = now;
+      if (now - lastAscentAt < 15e3) {
+        blockedRung = rung;
+        blockedUntil = now + 12e4;
+      }
+    } else lastAscentAt = now;
     rung = next;
+    cleanTransportSeconds = 0;
     congestedSeconds = 0;
     comfortableSeconds = 0;
-    process.stderr.write(`[desktop-stream] quality rung ${rung} (${qualityLadder[rung].fps} fps, ${qualityLadder[rung].kbps}k)
-`);
-    videoEncoder.replace();
+    for (const viewer of viewers.values()) viewer.rtc?.setBudget(budgetBps());
+    syncEncoder();
   };
-  const stopEncodersSoon = () => {
-    clearTimeout(encoderStop);
-    encoderStop = setTimeout(() => {
-      if (clients.size > 0) return;
-      videoEncoder.stop();
-      audioEncoder.stop();
-    }, 5e3);
+  const resetLadder = (request) => {
+    rung = request.transport === "webrtc" && request.adaptive ? webrtcStartupRung : 0;
+    cleanTransportSeconds = 0;
+    descents = 0;
+    lastDescentAt = 0;
+    lastAscentAt = 0;
+    congestedSeconds = 0;
+    comfortableSeconds = 0;
+    blockedRung = -1;
+    blockedUntil = 0;
+  };
+  const stableRttWindows = /* @__PURE__ */ new WeakMap();
+  const freshRemb = (viewer, now) => viewer.remb && now - viewer.remb.at < 2e3 ? viewer.remb.kbps : void 0;
+  const rembBelowSent = (viewer, now) => {
+    const remb = freshRemb(viewer, now);
+    const sent = Math.min(...recentVideoKbps);
+    return remb !== void 0 && sent > 500 && remb < sent * 0.9;
+  };
+  const struggling = (viewer, stats) => {
+    const stableSince = stableRttWindows.get(viewer)?.since;
+    return viewer.fallback ? queueMs(viewer) > congestedBacklogMs || stats.decodeQueue > congestedDecodeQueue : stats.rttMs > viewer.rtcBaselineMs + 40 && (stableSince === void 0 || Date.now() - stableSince < 2e3) || stats.videoFps < fps * 0.6 && viewer.lowFpsReports >= 2 || (stats.lossPercent ?? 0) > 3 || (stats.jitterBufferMs ?? 0) > 80 || rembBelowSent(viewer, Date.now());
+  };
+  const lowFpsObservationAt = /* @__PURE__ */ new WeakMap();
+  const severe = (viewer, stats) => !viewer.fallback && ((stats.lossPercent ?? 0) > 10 || stats.videoFps < fps * 0.25 && viewer.lowFpsReports >= 2);
+  let lastSevereDescentAt = 0;
+  const descendSevere = (now) => {
+    comfortableSeconds = 0;
+    congestedSeconds = 0;
+    if (!adaptive || now - lastSevereDescentAt < 1e3) return;
+    lastSevereDescentAt = now;
+    const estimates = [...viewers.values()].flatMap((viewer) => {
+      const reported = viewer.stats && now - viewer.stats.at < 750 ? viewer.stats.availableKbps ?? 0 : 0;
+      const remb = rembBelowSent(viewer, now) ? freshRemb(viewer, now) ?? 0 : 0;
+      return [...reported > 0 ? [reported] : [], ...remb > 0 ? [remb] : []];
+    });
+    const rungs = ladder();
+    const estimatedRung = estimates.length ? rungs.findIndex((quality) => quality.kbps <= Math.min(...estimates) * 0.8) : rung + 2;
+    setRung(Math.min(rungs.length - 1, Math.max(rung + 2, estimatedRung < 0 ? rungs.length - 1 : estimatedRung)));
   };
-  const probe = setInterval(() => {
-    for (const [client, state] of clients) {
-      if (client.readyState !== WebSocket2.OPEN || state.probeSentAt) continue;
-      state.probeSentAt = Date.now();
-      client.send(JSON.stringify({ type: "ping", sentAt: state.probeSentAt }));
-    }
-  }, probeIntervalMs);
-  probe.unref();
   const control = setInterval(() => {
-    const states = [...clients.values()];
-    if (states.length === 0) return;
-    const struggling = states.filter((state) => queueMs(state) > congestedBacklogMs || (state.stats?.decodeQueue ?? 0) > congestedDecodeQueue).length;
-    if (struggling === states.length) {
+    encoderFps = videoFrames - framesAtTick;
+    framesAtTick = videoFrames;
+    videoKbps = Math.round((videoBytes - bytesAtTick) * 8 / 1e3);
+    bytesAtTick = videoBytes;
+    if (recentVideoKbps.push(videoKbps) > 3) recentVideoKbps.shift();
+    if (viewers.size === 0) return;
+    if (videoEncoder.running() && encoderFps < fps * 0.9) {
+      cleanTransportSeconds = 0;
+      congestedSeconds = 0;
+      comfortableSeconds = 0;
+      presetHealthySeconds = 0;
+      encoderHealthyTicks = 0;
+      starvedSeconds += 1;
+      if (starvedSeconds >= 5 && preset !== "ultrafast") {
+        preset = "ultrafast";
+        syncEncoder();
+      }
+      return;
+    }
+    starvedSeconds = 0;
+    encoderHealthyTicks += 1;
+    if (encoderHealthyTicks < 3) return;
+    if (preset !== basePreset && ++presetHealthySeconds >= 120) {
+      preset = basePreset;
+      syncEncoder();
+    }
+    if (!adaptive) {
+      if (rung !== 0) setRung(0);
+      return;
+    }
+    const now = Date.now();
+    const reporting = [...viewers.values()].filter((viewer) => viewer.stats !== void 0 && viewer.stats.videoPacketsPerSecond !== 0 && now - viewer.stats.at < 3e3 && now - viewer.connectedAt > 2500);
+    cleanTransportSeconds = reporting.length === viewers.size && reporting.length > 0 && reporting.every((viewer) => !viewer.fallback && viewer.stats.rttMs <= viewer.rtcBaselineMs + 20 && (viewer.stats.lossPercent ?? 0) === 0 && (viewer.stats.nacks ?? 0) === 0 && (viewer.stats.jitterBufferMs ?? 0) <= 20 && viewer.stats.videoFps >= fps * 0.95) ? cleanTransportSeconds + 1 : 0;
+    if (reporting.length > 0 && reporting.every((viewer) => severe(viewer, viewer.stats))) {
+      descendSevere(now);
+      return;
+    }
+    const votes = reporting.flatMap((viewer) => viewer.everHealthy || now - viewer.connectedAt > 15e3 ? [struggling(viewer, viewer.stats)] : []);
+    if (votes.length === 0) return;
+    const strugglers = votes.filter(Boolean).length;
+    if (strugglers === votes.length) {
       comfortableSeconds = 0;
       congestedSeconds += 1;
-      if (congestedSeconds >= 2) setRung(Math.min(qualityLadder.length - 1, rung + 1));
+      if (congestedSeconds >= 2) setRung(Math.min(ladder().length - 1, rung + 1));
       return;
     }
-    congestedSeconds = 0;
-    if (struggling > 0) {
+    if (strugglers > 0) {
+      congestedSeconds = 0;
+      comfortableSeconds = 0;
+      return;
+    }
+    congestedSeconds = Math.max(0, congestedSeconds - 0.5);
+    if (descents === 0 && reporting.some((viewer) => !viewer.fallback && (viewer.stats.rttMs > viewer.rtcBaselineMs + 20 || (viewer.stats.playbackDroppedPercent ?? 0) > 5 && cleanTransportSeconds < 15))) {
       comfortableSeconds = 0;
       return;
     }
     comfortableSeconds += 1;
-    if (comfortableSeconds >= Math.min(300, 15 * 2 ** descents)) setRung(Math.max(0, rung - 1));
+    const startupSeconds = reporting.every((viewer) => !viewer.fallback) ? 2 : 3;
+    const recoverySeconds = lastAscentAt > lastDescentAt && cleanTransportSeconds >= 15 ? 15 : Math.min(60, 15 * 2 ** Math.min(descents, 2));
+    if (comfortableSeconds < (descents === 0 ? startupSeconds : recoverySeconds)) return;
+    const target = Math.max(0, rung - 1);
+    if (target === blockedRung && now < blockedUntil) return;
+    setRung(target);
   }, 1e3);
   control.unref();
+  const probe = setInterval(() => {
+    for (const viewer of socketViewers()) {
+      if (viewer.socket.readyState !== WebSocket2.OPEN || viewer.probeSentAt) continue;
+      viewer.probeSentAt = Date.now();
+      viewer.socket.send(JSON.stringify({ type: "ping", sentAt: viewer.probeSentAt }));
+    }
+  }, probeIntervalMs);
+  probe.unref();
+  let cpuSample = { at: Date.now(), server: process.cpuUsage(), encoder: processCpuMs(videoEncoder.pid()) };
+  let cpu = { serverPercent: 0, encoderPercent: 0 };
+  const telemetry = setInterval(() => {
+    if (viewers.size === 0) return;
+    const now = Date.now();
+    const server = process.cpuUsage();
+    const encoder = processCpuMs(videoEncoder.pid());
+    const elapsed = Math.max(1, now - cpuSample.at);
+    cpu = {
+      serverPercent: Math.round((server.user + server.system - cpuSample.server.user - cpuSample.server.system) / 10 / elapsed),
+      encoderPercent: Math.max(0, Math.round((encoder - cpuSample.encoder) * 100 / elapsed))
+    };
+    cpuSample = { at: now, server, encoder };
+    const { quality, profile: videoProfile, pixelFormat } = encoderParams();
+    for (const viewer of viewers.values()) {
+      if (viewer.socket.readyState !== WebSocket2.OPEN) continue;
+      const pacer = viewer.rtc?.snapshot();
+      const message = {
+        type: "telemetry",
+        encoder: {
+          profile: activeProfile,
+          codecProfile: videoProfile,
+          pixelFormat,
+          color: colorMode,
+          rung,
+          rungs: ladder().length,
+          kbpsCap: quality.kbps,
+          crf: quality.crf,
+          preset,
+          fps: encoderFps,
+          kbps: videoKbps,
+          adaptive
+        },
+        cpu: { ...cpu, load: Math.round(loadavg()[0] * 100) / 100, cores: availableParallelism() },
+        viewer: {
+          budgetKbps: pacer?.budgetKbps ?? 0,
+          queueMs: pacer?.queueMs ?? Math.round(queueMs(viewer)),
+          queuedPackets: pacer?.queuedPackets ?? 0,
+          staleEvents: pacer?.staleEvents ?? 0,
+          droppedFrames: pacer?.droppedFrames ?? 0,
+          repairsSent: pacer?.repairsSent ?? 0,
+          repairsSkipped: pacer?.repairsSkipped ?? 0,
+          duplicatesSent: pacer?.duplicatesSent ?? 0,
+          protecting: pacer?.protecting ?? false,
+          rembKbps: pacer?.rembKbps ?? null,
+          sentKbps: pacer?.sentKbps ?? 0
+        }
+      };
+      viewer.socket.send(JSON.stringify(message));
+    }
+  }, telemetryIntervalMs);
+  telemetry.unref();
+  const requestKeyframe = (joinedAt, requestingViewer) => {
+    const now = Date.now();
+    if (!videoWanted || viewers.size === 0 || videoEncoder.replacing() || lastKeyframeAt < now - videoEncoder.activeForMs() || joinedAt !== void 0 && lastKeyframeAt > joinedAt) return;
+    const startup = requestingViewer && !requestingViewer.hasDecodedFrame && now - requestingViewer.connectedAt < 1e4;
+    const wait = (joinedAt === void 0 ? startup ? 500 : 2e3 : 350) - (now - lastSwapAt);
+    if (wait > 0) {
+      if (joinedAt !== void 0) {
+        clearTimeout(joinKeyframe);
+        joinKeyframe = setTimeout(() => requestKeyframe(joinedAt), wait);
+      }
+      return;
+    }
+    if (!startup && encoderParams().keyframeMs - (now - lastKeyframeAt) <= 350) return;
+    lastSwapAt = now;
+    void videoEncoder.replace();
+  };
+  const enterFallback = (viewer, reason) => {
+    if (viewer.fallback) return;
+    viewer.fallback = true;
+    viewer.waitingForKeyframe = true;
+    viewer.input.release();
+    viewer.rtc?.close();
+    viewer.rtc = void 0;
+    process.stderr.write(`[desktop-stream] viewer streaming over the socket: ${reason}
+`);
+    if (!syncEncoder()) requestKeyframe();
+  };
+  const optional = (value, max) => value === void 0 ? void 0 : clamp(value, 0, max);
+  const handleMessage = (viewer, message, reply) => {
+    switch (message.type) {
+      case "ping":
+        reply({ type: "pong", sentAt: message.sentAt });
+        return;
+      case "pong":
+        if (!viewer.probeSentAt || message.sentAt !== viewer.probeSentAt) return;
+        viewer.probeAckedMs = Date.now() - viewer.probeSentAt;
+        viewer.probeSentAt = 0;
+        viewer.probeAnswered = true;
+        viewer.baselineMs = Math.min(viewer.baselineMs, viewer.probeAckedMs);
+        return;
+      case "stats": {
+        if (message.sequence !== void 0 && message.sequence <= (viewer.stats?.sequence ?? -1)) return;
+        viewer.stats = {
+          at: Date.now(),
+          sequence: message.sequence ?? viewer.stats?.sequence,
+          videoFps: clamp(message.videoFps, 0, 1e3),
+          videoPacketsPerSecond: optional(message.videoPacketsPerSecond, 1e6),
+          audioPacketsPerSecond: clamp(message.audioPacketsPerSecond, 0, 1e3),
+          decodeQueue: clamp(message.decodeQueue, 0, 1e3),
+          rttMs: clamp(message.rttMs, 0, 6e5),
+          lossPercent: optional(message.lossPercent, 100),
+          nacks: optional(message.nacks, 1e5),
+          freezes: optional(message.freezes, 1e3),
+          jitterBufferMs: optional(message.jitterBufferMs, 6e4),
+          availableKbps: optional(message.availableKbps, 1e6),
+          playbackDroppedPercent: optional(message.playbackDroppedPercent, 100)
+        };
+        const now = viewer.stats.at;
+        if (viewer.stats.videoFps >= fps * 0.6 || viewer.stats.videoPacketsPerSecond === 0) {
+          viewer.lowFpsReports = 0;
+          lowFpsObservationAt.delete(viewer);
+        } else if (now - (lowFpsObservationAt.get(viewer) ?? 0) >= 1e3) {
+          viewer.lowFpsReports = Math.min(2, viewer.lowFpsReports + 1);
+          lowFpsObservationAt.set(viewer, now);
+        }
+        if (!viewer.fallback && viewer.stats.rttMs > 0) viewer.rtcBaselineMs = Math.min(viewer.rtcBaselineMs, viewer.stats.rttMs);
+        const rtt = viewer.stats.rttMs;
+        let window = stableRttWindows.get(viewer);
+        const stableNetwork = !viewer.fallback && rtt > viewer.rtcBaselineMs + 20 && (viewer.stats.videoPacketsPerSecond ?? 0) > 0 && (viewer.stats.lossPercent ?? 0) <= 1 && (viewer.stats.jitterBufferMs ?? 0) <= 80;
+        if (stableNetwork && viewer.stats.videoFps >= fps * 0.9) {
+          if (!window || now - window.at > 3e3 || Math.max(window.max, rtt) - Math.min(window.min, rtt) > 20) {
+            window = { since: now, at: now, min: rtt, max: rtt };
+          }
+          window.at = now;
+          window.min = Math.min(window.min, rtt);
+          window.max = Math.max(window.max, rtt);
+          stableRttWindows.set(viewer, window);
+          if (now - window.since >= 1e4) {
+            viewer.rtcBaselineMs = window.min;
+            stableRttWindows.delete(viewer);
+          }
+        } else if (!stableNetwork || !window || now - window.at > 750 || viewer.stats.videoFps < fps * 0.6 || Math.max(window.max, rtt) - Math.min(window.min, rtt) > 20) {
+          stableRttWindows.delete(viewer);
+        } else {
+          window.min = Math.min(window.min, rtt);
+          window.max = Math.max(window.max, rtt);
+        }
+        if (viewer.rtc) {
+          const elevated = rtt > viewer.rtcBaselineMs + 20;
+          if (!elevated) viewer.elevated = void 0;
+          else if (!viewer.elevated || now - viewer.elevated.at > 750) viewer.elevated = { since: now, at: now };
+          else viewer.elevated.at = now;
+          if (rtt > viewer.rtcBaselineMs + 40 || viewer.elevated && now - viewer.elevated.since >= 500) {
+            viewer.rtc.protect(0);
+            viewer.protectBlockedUntil = now + 3e4;
+          } else if (now >= viewer.protectBlockedUntil && ((viewer.stats.nacks ?? 0) > 0 || (viewer.stats.lossPercent ?? 0) > 0)) {
+            viewer.rtc.protect(protectMs);
+          }
+        }
+        if (viewer.stats.videoFps > 0) viewer.hasDecodedFrame = true;
+        if (viewer.stats.videoFps >= fps * 0.8) viewer.everHealthy = true;
+        if (encoderHealthyTicks >= 3 && videoEncoder.running() && [...viewers.values()].every((v) => !v.fallback && v.stats && now - v.stats.at < 750 && now - v.connectedAt > 2500 && (v.stats.videoPacketsPerSecond ?? 0) > 0 && (v.stats.lossPercent ?? 0) > 10)) descendSevere(now);
+        return;
+      }
+      case "answer":
+        viewer.rtc?.answer(message.sdp);
+        syncEncoder();
+        return;
+      case "candidate":
+        viewer.rtc?.candidate(message.candidate, message.mid);
+        return;
+      case "fallback":
+        enterFallback(viewer, message.reason);
+        return;
+      case "keyframe":
+        if (!viewer.fallback) requestKeyframe(void 0, viewer);
+        return;
+      case "theme":
+        applyDesktopTheme(message.theme);
+        return;
+      default:
+        viewer.input.handle(message);
+    }
+  };
+  const config = {
+    type: "config",
+    protocolVersion: STREAM_PROTOCOL_VERSION,
+    inputRace: true,
+    width,
+    height,
+    fps,
+    audioCodec: "opus",
+    audioSampleRate: 48e3,
+    audioChannels: 2
+  };
   const httpServer = createServer2((request, response) => {
     const url = new URL(request.url || "/", "http://localhost");
     if (url.pathname === "/health") {
+      const all = [...viewers.values()];
+      const memory = process.memoryUsage();
+      const { keyframeMs, profile: videoProfile, pixelFormat, quality } = encoderParams();
       response.setHeader("content-type", "application/json");
       response.end(JSON.stringify({
-        clients: clients.size,
+        version: COMPUTER_USE_VERSION,
+        clients: viewers.size,
+        webrtc,
+        transports: all.map((viewer) => viewer.fallback ? "websocket" : viewer.rtc?.connected ? "webrtc" : "negotiating"),
+        requests: all.map((viewer) => viewer.request),
         encoder: videoEncoder.running(),
         audioEncoder: audioEncoder.running(),
+        generation: videoEncoder.generation(),
         lastVideoFrameMsAgo: lastVideoAt ? Date.now() - lastVideoAt : null,
         lastAudioPacketMsAgo: lastAudioAt ? Date.now() - lastAudioAt : null,
         videoFrames,
+        videoKeyframes,
         audioPackets,
         videoBytes,
         audioBytes,
-        clientStats: [...clients.values()].flatMap((client) => client.stats ? [client.stats] : []),
-        clientQueueMs: [...clients.values()].map((client) => Math.round(queueMs(client))),
-        clientBaselineMs: [...clients.values()].map((client) => Number.isFinite(client.baselineMs) ? Math.round(client.baselineMs) : null),
+        videoKbps,
+        encoderFps,
+        cpu,
+        clientStats: all.flatMap((viewer) => viewer.stats ? [viewer.stats] : []),
+        clientPacer: all.map((viewer) => viewer.rtc?.snapshot() ?? null),
+        clientRttMs: all.map((viewer) => viewer.rtc?.rttMs ?? viewer.stats?.rttMs ?? null),
+        clientPath: all.map((viewer) => viewer.rtc?.path ?? null),
+        clientQueueMs: all.map((viewer) => Math.round(queueMs(viewer))),
         qualityRung: rung,
+        adaptive,
+        streamProfile: activeProfile,
+        crf: quality.crf,
+        kbpsCap: quality.kbps,
+        preset,
+        profile: videoProfile,
+        pixelFormat,
+        color: colorMode,
+        keyframeMs,
+        rss: memory.rss,
+        heapUsed: memory.heapUsed,
         width,
         height,
-        fps: qualityLadder[rung].fps
+        fps
       }));
       return;
     }
@@ -3897,70 +5009,104 @@ async function runMediaServer() {
       response.end("Not found");
       return;
     }
+    response.setHeader("content-type", contentTypes[extname(path)] || "application/octet-stream");
     if (extname(path) === ".html") {
-      startEncoders();
-      if (clients.size === 0) stopEncodersSoon();
+      ensureEncoders();
+      if (viewers.size === 0) stopEncodersSoon();
+      response.setHeader("cache-control", "no-store");
+      const digest = createHash3("sha1");
+      for (const name of readdirSync(webroot).filter((file) => /\.(js|css)$/.test(file)).sort()) digest.update(readFileSync6(resolve2(webroot, name)));
+      response.end(readFileSync6(path, "utf8").replaceAll("__VERSION__", `${COMPUTER_USE_VERSION}-${digest.digest("hex").slice(0, 8)}`));
+      return;
     }
-    response.setHeader("cache-control", extname(path) === ".html" ? "no-store" : "private, max-age=3600");
-    response.setHeader("content-type", contentTypes[extname(path)] || "application/octet-stream");
+    response.setHeader("cache-control", "private, max-age=31536000, immutable");
     createReadStream(path).pipe(response);
   });
-  const webSocketServer = new WebSocketServer({ noServer: true, maxPayload: 16 * 1024 });
+  const webSocketServer = new WebSocketServer({ noServer: true, maxPayload: 64 * 1024 });
   httpServer.on("upgrade", (request, socket, head) => {
-    if (new URL(request.url || "/", "http://localhost").pathname !== "/stream") {
+    const url = new URL(request.url || "/", "http://localhost");
+    if (url.pathname !== "/stream") {
       socket.destroy();
       return;
     }
-    webSocketServer.handleUpgrade(request, socket, head, (client) => webSocketServer.emit("connection", client, request));
+    webSocketServer.handleUpgrade(request, socket, head, (client) => webSocketServer.emit("connection", client, parseStreamRequest(url.searchParams, defaultRequest)));
   });
-  webSocketServer.on("connection", (client) => {
-    clients.set(client, {
-      waitingForKeyframe: true,
+  webSocketServer.on("connection", (socket, request) => {
+    const viewer = {
+      socket,
       input: new InputBridge(display, width, height),
+      request,
+      fallback: false,
+      waitingForKeyframe: true,
+      everHealthy: false,
+      lowFpsReports: 0,
+      connectedAt: Date.now(),
       probeSentAt: 0,
       probeAckedMs: 0,
       probeAnswered: false,
-      baselineMs: Number.POSITIVE_INFINITY
-    });
-    client.send(JSON.stringify(config));
-    startEncoders();
-    client.on("message", (raw, binary) => {
-      if (binary) return;
-      let message;
+      baselineMs: Number.POSITIVE_INFINITY,
+      rtcBaselineMs: Number.POSITIVE_INFINITY,
+      protectBlockedUntil: 0
+    };
+    if (viewers.size === 0) resetLadder(request);
+    if (request.profile !== activeProfile || request.adaptive !== adaptive) {
+      process.stderr.write(`[desktop-stream] viewer requests ${request.profile} profile, ${request.adaptive ? "adaptive" : "pinned"} quality
+`);
+      activeProfile = request.profile;
+      adaptive = request.adaptive;
+      if (!adaptive) rung = 0;
+    }
+    viewers.set(socket, viewer);
+    const reply = (message) => {
+      if (socket.readyState === WebSocket2.OPEN) socket.send(JSON.stringify(message));
+    };
+    const offerWebRtc = webrtc && request.transport === "webrtc";
+    const ice = offerWebRtc ? currentIceServers() : void 0;
+    const fallbackProfile = profile() === "high444" ? "main" : profile();
+    const configMessage = { ...config, videoCodec: H264_PROFILES[fallbackProfile].codec, iceServers: ice?.browser, request };
+    reply(configMessage);
+    if (ice) {
       try {
-        message = JSON.parse(raw.toString());
-      } catch {
-        return;
+        viewer.rtc = new WebRtcViewer({ iceServers: ice.native, iceTransportPolicy: "all", portRange: icePorts, budgetBps: budgetBps() }, {
+          offer: (sdp) => reply({ type: "offer", sdp }),
+          candidate: (candidate, mid) => reply({ type: "candidate", candidate, mid }),
+          message: (message, answer) => handleMessage(viewer, message, answer),
+          keyframe: (reason) => {
+            if (reason === "stale") descendSevere(Date.now());
+            requestKeyframe(void 0, viewer);
+          },
+          remb: (bitsPerSecond) => {
+            viewer.remb = { kbps: bitsPerSecond / 1e3, at: Date.now() };
+          },
+          connected: () => requestKeyframe(Date.now()),
+          // A viewer that loses its peer cannot send the key-ups for whatever it
+          // was holding, and its socket may stay open for a long time yet.
+          disconnected: (state) => {
+            viewer.input.release();
+            if (state === "failed") reply({ type: "webrtc-failed" });
+          }
+        });
+      } catch (error) {
+        process.stderr.write(`[desktop-stream] could not create a peer connection: ${error instanceof Error ? error.message : String(error)}
+`);
       }
-      if (!validInput(message)) return;
-      if (message.type === "ping") client.send(JSON.stringify({ type: "pong", sentAt: message.sentAt }));
-      else if (message.type === "pong") {
-        const state = clients.get(client);
-        if (!state || message.sentAt !== state.probeSentAt) return;
-        state.probeAckedMs = Date.now() - state.probeSentAt;
-        state.probeSentAt = 0;
-        state.probeAnswered = true;
-        state.baselineMs = Math.min(state.baselineMs, state.probeAckedMs);
-      } else if (message.type === "stats") {
-        const state = clients.get(client);
-        if (!state) return;
-        state.stats = {
-          videoFps: clamp(message.videoFps, 0, 1e3),
-          audioPacketsPerSecond: clamp(message.audioPacketsPerSecond, 0, 1e3),
-          decodeQueue: clamp(message.decodeQueue, 0, 1e3),
-          rttMs: clamp(message.rttMs, 0, 6e5)
-        };
-      } else if (message.type === "theme") applyDesktopTheme(message.theme);
-      else clients.get(client)?.input.handle(message);
+    }
+    if (!viewer.rtc) enterFallback(viewer, offerWebRtc ? "webrtc unavailable" : "websocket requested");
+    ensureEncoders();
+    socket.on("message", (raw, binary) => {
+      if (binary) return;
+      const message = parseInput(raw.toString());
+      if (message) handleMessage(viewer, message, reply);
     });
-    client.once("close", () => {
-      clients.get(client)?.input.close();
-      clients.delete(client);
-      if (clients.size > 0) return;
-      rung = 0;
-      descents = 0;
-      congestedSeconds = 0;
-      comfortableSeconds = 0;
+    socket.once("close", () => {
+      viewer.rtc?.close();
+      viewer.input.close();
+      viewers.delete(socket);
+      if (viewers.size > 0) {
+        syncEncoder();
+        return;
+      }
+      clearTimeout(joinKeyframe);
       stopEncodersSoon();
     });
   });
@@ -3968,7 +5114,7 @@ async function runMediaServer() {
     httpServer.once("error", reject);
     httpServer.listen(port, "0.0.0.0", () => {
       httpServer.off("error", reject);
-      console.log(`replicas desktop stream listening on ${port}`);
+      console.log(`replicas desktop stream ${COMPUTER_USE_VERSION} listening on ${port} (${webrtc ? "webrtc + websocket" : "websocket only"}, default ${defaultRequest.transport}, ${colorMode} colour)`);
       resolveServer();
     });
   });
@@ -3979,17 +5125,21 @@ async function runMediaServer() {
       closing = true;
       clearInterval(probe);
       clearInterval(control);
+      clearInterval(telemetry);
       clearTimeout(encoderStop);
-      for (const [client, state] of clients) {
-        state.input.close();
-        client.close(1001, "server shutting down");
+      clearTimeout(joinKeyframe);
+      for (const viewer of viewers.values()) {
+        viewer.rtc?.close();
+        viewer.input.close();
+        viewer.socket.close(1001, "server shutting down");
       }
-      videoEncoder.stop();
-      audioEncoder.stop();
-      videoSocket.close();
-      audioSocket.close();
+      void videoEncoder.stop();
+      void audioEncoder.stop();
       webSocketServer.close();
-      httpServer.close(() => resolveShutdown());
+      httpServer.close(() => {
+        cleanupWebRtc();
+        resolveShutdown();
+      });
     };
     process.once("SIGTERM", close);
     process.once("SIGINT", close);
@@ -3998,7 +5148,7 @@ async function runMediaServer() {
 
 // src/setup.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { accessSync, chmodSync as chmodSync2, constants, cpSync, existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync, writeFileSync as writeFileSync5 } from "fs";
+import { accessSync, chmodSync as chmodSync2, constants, cpSync, existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync as readdirSync2, writeFileSync as writeFileSync5 } from "fs";
 import { dirname as dirname7, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var dependencies = [
@@ -4067,7 +5217,7 @@ function hasCommand(command) {
     }
   });
 }
-function setupComputer(options = {}) {
+async function setupComputer(options = {}) {
   const found = {};
   const missing = [];
   for (const [name, command] of dependencies) {
@@ -4088,6 +5238,14 @@ function setupComputer(options = {}) {
       console.log("\u2713 ffmpeg encoder libx264");
     }
   }
+  const webrtcVersion = await import("node-datachannel").then((module) => module.default.getLibraryVersion()).catch(() => null);
+  if (webrtcVersion) {
+    found["node-datachannel"] = `libdatachannel ${webrtcVersion}`;
+    console.log("\u2713 WebRTC (node-datachannel)");
+  } else {
+    missing.push("WebRTC native module (node-datachannel)");
+    console.error("\u2717 WebRTC (node-datachannel) failed to load");
+  }
   const noVncPackageRoot = dirname7(dirname7(fileURLToPath2(import.meta.resolve("@novnc/novnc"))));
   const noVncCore = resolve3(noVncPackageRoot, "core");
   const noVncVendor = resolve3(noVncPackageRoot, "vendor");
@@ -4113,7 +5271,7 @@ function setupComputer(options = {}) {
   cpSync(assets, "/usr/local/share/replicas/desktop", { recursive: true, force: true });
   const fontRoot = "/usr/local/share/fonts/replicas";
   mkdirSync6(fontRoot, { recursive: true });
-  for (const file of readdirSync(assets).filter((name) => name.endsWith(".ttf"))) cpSync(resolve3(assets, file), resolve3(fontRoot, file), { force: true });
+  for (const file of readdirSync2(assets).filter((name) => name.endsWith(".ttf"))) cpSync(resolve3(assets, file), resolve3(fontRoot, file), { force: true });
   spawnSync6("fc-cache", ["-f", fontRoot], { stdio: "ignore" });
   const viewerRoot = "/usr/local/share/replicas/desktop/novnc";
   mkdirSync6(viewerRoot, { recursive: true });
@@ -4164,7 +5322,7 @@ async function main() {
   if (argv[0] === "setup") {
     const unsupported = argv.slice(1).filter((arg) => arg !== "--check");
     if (unsupported.length > 0) throw new Error(`Unknown setup option: ${unsupported[0]}`);
-    setupComputer({ checkOnly: argv.includes("--check") });
+    await setupComputer({ checkOnly: argv.includes("--check") });
     return;
   }
   if (argv[0] === "daemon") {