robopark 3.1.2 → 3.2.0

package/ui/standalone/public/install-robot-kiosk.sh

@@ -0,0 +1,242 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Serialize installs/restarts for this user. Re-running the curl command while a
+# previous verification loop is active used to launch a second kiosk publisher.
+lock_dir="${XDG_RUNTIME_DIR:-/tmp}/robopark-kiosk-${UID}.lock"
+if ! mkdir "$lock_dir" 2>/dev/null; then
+  echo "Another RoboPark kiosk install/restart is already running. Wait for it to finish, or stop that shell with Ctrl-C." >&2
+  exit 5
+fi
+trap 'rmdir "$lock_dir" 2>/dev/null || true' EXIT
+
+device_id="${1:-}"
+origin="${2:-https://robo2.tail45774e.ts.net:3543}"
+origin="${origin%/}"
+
+if [[ ! "$device_id" =~ ^[a-f0-9]{32}$ ]]; then
+  echo "Missing or invalid robot device ID" >&2
+  exit 2
+fi
+
+if [[ ! "$origin" =~ ^https://[A-Za-z0-9.-]+(:[0-9]+)?$ ]]; then
+  echo "Invalid HTTPS production origin: $origin" >&2
+  exit 2
+fi
+
+firefox_bin="$(command -v firefox || true)"
+if [[ -z "$firefox_bin" ]]; then
+  echo "Firefox is not installed" >&2
+  exit 1
+fi
+
+echo "Preflight: validating $device_id against $origin"
+registry="$(curl -fsSL --connect-timeout 5 --max-time 12 "$origin/robopark/api/devices")"
+if ! printf '%s' "$registry" | grep -q "\"$device_id\""; then
+  echo "Device ID is not registered on the V2 control center; production was not changed" >&2
+  exit 3
+fi
+
+distribution_dir="$(dirname "$(readlink -f "$firefox_bin")")/distribution"
+system_policy_dir="/etc/firefox/policies"
+tmp_policy="$(mktemp)"
+backup_dir="$HOME/.robopark-kiosk-backup"
+mkdir -p "$backup_dir"
+policy_path="$system_policy_dir/policies.json"
+service_path="$HOME/.config/systemd/user/robopark-kiosk.service"
+recovery_path="$HOME/.local/bin/robopark-media-recovery"
+recovery_service_path="$HOME/.config/systemd/user/robopark-media-recovery.service"
+[[ -f "$policy_path" ]] && sudo cp -f "$policy_path" "$backup_dir/policies.json" || true
+[[ -f "$service_path" ]] && cp -f "$service_path" "$backup_dir/robopark-kiosk.service" || true
+
+rollback() {
+  echo "V2 verification failed; restoring the previous production kiosk" >&2
+  if [[ -f "$backup_dir/policies.json" ]]; then sudo install -m 0644 "$backup_dir/policies.json" "$policy_path"; fi
+  if [[ -f "$backup_dir/robopark-kiosk.service" ]]; then cp -f "$backup_dir/robopark-kiosk.service" "$service_path"; fi
+  systemctl --user daemon-reload 2>/dev/null || true
+  systemctl --user restart robopark-kiosk.service 2>/dev/null || true
+}
+trap 'rm -f "$tmp_policy"; rmdir "$lock_dir" 2>/dev/null || true' EXIT
+
+cat >"$tmp_policy" <<JSON
+{
+  "policies": {
+    "Permissions": {
+      "Camera": { "Allow": ["$origin"], "BlockNewRequests": false, "Locked": true },
+      "Microphone": { "Allow": ["$origin"], "BlockNewRequests": false, "Locked": true },
+      "Autoplay": { "Allow": ["$origin"], "Default": "block-audio-video", "Locked": true }
+    },
+    "Preferences": {
+      "media.autoplay.default": { "Value": 0, "Status": "locked" },
+      "media.autoplay.blocking_policy": { "Value": 0, "Status": "locked" }
+    }
+  }
+}
+JSON
+
+sudo install -d -m 0755 "$system_policy_dir"
+sudo install -m 0644 "$tmp_policy" "$system_policy_dir/policies.json"
+# Traditional distro Firefox also reads its adjacent distribution directory.
+# Snap packages are read-only there, so failure is deliberately non-fatal.
+if sudo install -d -m 0755 "$distribution_dir" 2>/dev/null; then
+  sudo install -m 0644 "$tmp_policy" "$distribution_dir/policies.json" 2>/dev/null || true
+fi
+
+join_url="$origin/?device_id=$device_id&autostart=1&hardware_autobind=1"
+export DISPLAY="${DISPLAY:-:0}"
+export XAUTHORITY="${XAUTHORITY:-$HOME/.Xauthority}"
+
+# Bind playback at the PipeWire/Pulse layer. Browser setSinkId is retained as
+# a second guard, but unattended Firefox cannot reliably repair a stale HDMI
+# default on every Raspberry Pi image.
+if command -v pactl >/dev/null 2>&1; then
+  usb_sink="$(pactl list short sinks 2>/dev/null | awk 'BEGIN{IGNORECASE=1} /usb/{print $2; exit}')"
+  [[ -z "$usb_sink" ]] && usb_sink="$(pactl list short sinks 2>/dev/null | awk 'NR==1{print $2}')"
+  if [[ -n "$usb_sink" ]]; then
+    pactl set-default-sink "$usb_sink" || true
+    pactl set-sink-mute "$usb_sink" 0 || true
+    pactl set-sink-volume "$usb_sink" 100% || true
+    echo "Audio output bound through PulseAudio: $usb_sink"
+  fi
+elif command -v wpctl >/dev/null 2>&1; then
+  usb_sink_id="$(wpctl status -n 2>/dev/null | awk 'BEGIN{IGNORECASE=1; sinks=0} /Sinks:/{sinks=1;next} /Sources:/{sinks=0} sinks && /usb/{line=$0; sub(/^.*[[:space:]]/,"",line); if(match($0,/[0-9]+\./)){id=substr($0,RSTART,RLENGTH-1); print id; exit}}')"
+  if [[ -n "$usb_sink_id" ]]; then
+    wpctl set-default "$usb_sink_id" || true
+    wpctl set-mute "$usb_sink_id" 0 || true
+    wpctl set-volume "$usb_sink_id" 1.0 || true
+    echo "Audio output bound through PipeWire: $usb_sink_id"
+  fi
+fi
+
+mkdir -p "$HOME/.config/systemd/user"
+cat >"$HOME/.config/systemd/user/robopark-kiosk.service" <<UNIT
+[Unit]
+Description=RoboPark production kiosk
+After=graphical-session.target network-online.target
+Wants=network-online.target
+
+[Service]
+Environment=DISPLAY=${DISPLAY}
+Environment=XAUTHORITY=${XAUTHORITY}
+ExecStart=${firefox_bin} --kiosk ${join_url}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+UNIT
+
+# A small unprivileged control worker lets the central UI release media devices
+# held by duplicate browser/test processes. It deliberately never terminates
+# PipeWire, WirePlumber, PulseAudio, SSH, or unrelated system services.
+mkdir -p "$HOME/.local/bin" "$HOME/.local/state/robopark"
+cat >"$recovery_path" <<'RECOVERY'
+#!/usr/bin/env bash
+set -u
+device_id="$1"
+origin="${2%/}"
+state="$HOME/.local/state/robopark/kill-media-revision"
+while sleep 2; do
+  payload="$(curl -fsSL --connect-timeout 3 --max-time 6 "$origin/api/robopark/devices/$device_id/control" 2>/dev/null || true)"
+  revision="$(printf '%s' "$payload" | sed -n 's/.*"kill_competitors_revision"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p')"
+  [[ -z "$revision" ]] && continue
+  if [[ ! -f "$state" ]]; then printf '%s\n' "$revision" >"$state"; continue; fi
+  previous="$(cat "$state" 2>/dev/null || printf 0)"
+  [[ "$revision" -le "$previous" ]] && continue
+  printf '%s\n' "$revision" >"$state"
+  systemctl --user stop robopark-kiosk.service 2>/dev/null || true
+  systemctl --user kill --kill-who=all robopark-kiosk.service 2>/dev/null || true
+  pkill -TERM -f 'firefox[^ ]*.*robo2\.tail45774e\.ts\.net:(3443|3543)' 2>/dev/null || true
+  for name in firefox firefox-esr firefox-bin chromium chromium-browser ffmpeg gst-launch-1.0 cheese guvcview libcamera-vid libcamera-still rpicam-vid rpicam-still arecord speaker-test; do
+    pkill -TERM -x "$name" 2>/dev/null || true
+  done
+  sleep 2
+  for node in /dev/video0 /dev/video1; do
+    [[ -e "$node" ]] && fuser -k "$node" 2>/dev/null || true
+  done
+  systemctl --user start robopark-kiosk.service 2>/dev/null || true
+done
+RECOVERY
+chmod 0755 "$recovery_path"
+cat >"$recovery_service_path" <<UNIT
+[Unit]
+Description=RoboPark guarded media recovery worker
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+ExecStart=${recovery_path} ${device_id} ${origin}
+Restart=always
+RestartSec=3
+
+[Install]
+WantedBy=default.target
+UNIT
+systemctl --user daemon-reload || true
+systemctl --user enable robopark-kiosk.service || true
+systemctl --user enable --now robopark-media-recovery.service || true
+
+# Stop the managed cgroup first, then close only Firefox-family processes that
+# are attached to this RoboPark origin. `pkill -x firefox` misses firefox-esr
+# and firefox-bin on some Pi images, leaving duplicate LiveKit publishers.
+systemctl --user stop robopark-kiosk.service 2>/dev/null || true
+systemctl --user kill --kill-who=all robopark-kiosk.service 2>/dev/null || true
+pkill -TERM -f 'firefox[^ ]*.*robo2\.tail45774e\.ts\.net:3543' 2>/dev/null || true
+pkill -TERM -x firefox 2>/dev/null || true
+pkill -TERM -x firefox-esr 2>/dev/null || true
+pkill -TERM -x firefox-bin 2>/dev/null || true
+# Release stale user-level capture/playback clients before Firefox asks
+# PipeWire for the production devices. Never terminate PipeWire,
+# WirePlumber, PulseAudio, SSH, or unrelated services.
+for name in chromium chromium-browser ffmpeg gst-launch-1.0 cheese guvcview libcamera-vid libcamera-still rpicam-vid rpicam-still arecord speaker-test; do
+  pkill -TERM -x "$name" 2>/dev/null || true
+done
+for _ in 1 2 3 4 5; do
+  pgrep -u "$UID" -f 'firefox|firefox-esr|firefox-bin' >/dev/null || break
+  sleep 1
+done
+# Escalate only for this user's remaining Firefox family after the graceful
+# wait. A stale browser otherwise keeps the microphone/camera and LiveKit room.
+if pgrep -u "$UID" -f 'firefox|firefox-esr|firefox-bin' >/dev/null; then
+  pkill -KILL -u "$UID" -f 'firefox|firefox-esr|firefox-bin' 2>/dev/null || true
+  sleep 1
+fi
+# A crashed camera client can survive under a different executable name. Free
+# only the two conventional USB-camera nodes after graceful process cleanup;
+# do not touch /dev/snd because PipeWire legitimately owns those handles.
+if command -v fuser >/dev/null 2>&1; then
+  for node in /dev/video0 /dev/video1; do
+    [[ -e "$node" ]] && fuser -k "$node" 2>/dev/null || true
+  done
+  sleep 1
+fi
+
+if systemctl --user restart robopark-kiosk.service 2>/dev/null; then
+  echo "Persistent kiosk service started"
+else
+  nohup "$firefox_bin" --kiosk "$join_url" >"$HOME/robovoice-kiosk.log" 2>&1 &
+fi
+
+echo "Verifying V2 room join (allowing up to 120 seconds for Pi media initialization)..."
+verified=0
+for attempt in $(seq 1 60); do
+  robots="$(curl -fsSL --connect-timeout 3 --max-time 6 "$origin/robopark/api/robots" 2>/dev/null || true)"
+  # `status` may legitimately be `degraded` while audio and the voice worker
+  # are live (for example, a camera-less/blocked Vixen). Migration success is
+  # the physical kiosk connection, represented by connection_status=online.
+  if printf '%s' "$robots" | grep -q "\"id\":\"$device_id\"[^}]*\"connection_status\":\"online\""; then verified=1; break; fi
+  if (( attempt % 10 == 0 )); then
+    echo "Still waiting for $device_id ($((attempt * 2))s): Firefox may be completing microphone/camera initialization..."
+  fi
+  sleep 2
+done
+if [[ "$verified" != 1 ]]; then
+  echo "V2 did not observe the registered device after 120 seconds." >&2
+  systemctl --user status robopark-kiosk.service --no-pager -l >&2 || true
+  journalctl --user -u robopark-kiosk.service -n 40 --no-pager >&2 || true
+  rollback
+  exit 4
+fi
+
+echo "V2 migration verified: $join_url"
+echo "Rollback snapshot: $backup_dir"

package/ui/standalone/public/lk-logo-dark.svg

@@ -0,0 +1,18 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g clip-path="url(#clip0_646_420)">
+    <path d="M14.4004 9.59961H9.59962V14.4004H14.4004V9.59961Z" fill="#1fd5f9" />
+    <path d="M19.2011 4.80078H14.4004V9.60153H19.2011V4.80078Z" fill="#1fd5f9" />
+    <path d="M19.2011 14.4004H14.4004V19.2011H19.2011V14.4004Z" fill="#1fd5f9" />
+    <path d="M24 0H19.1992V4.80075H24V0Z" fill="#1fd5f9" />
+    <path d="M24 19.1992H19.1992V24H24V19.1992Z" fill="#1fd5f9" />
+    <path
+      d="M4.80075 19.1992V14.4004V9.59962V4.80075V0H0V4.80075V9.59962V14.4004V19.1992V24H4.80075H9.59963H14.4004V19.1992H9.59963H4.80075Z"
+      fill="white" />
+  </g>
+  <defs>
+    <clipPath id="clip0_646_420">
+      <rect width="24" height="24" fill="white" />
+    </clipPath>
+  </defs>
+</svg>
+  

package/ui/standalone/public/lk-logo.svg

@@ -0,0 +1,18 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g clip-path="url(#clip0_646_420)">
+    <path d="M14.4004 9.59961H9.59962V14.4004H14.4004V9.59961Z" fill="#002cf2" />
+    <path d="M19.2011 4.80078H14.4004V9.60153H19.2011V4.80078Z" fill="#002cf2" />
+    <path d="M19.2011 14.4004H14.4004V19.2011H19.2011V14.4004Z" fill="#002cf2" />
+    <path d="M24 0H19.1992V4.80075H24V0Z" fill="#002cf2" />
+    <path d="M24 19.1992H19.1992V24H24V19.1992Z" fill="#002cf2" />
+    <path
+      d="M4.80075 19.1992V14.4004V9.59962V4.80075V0H0V4.80075V9.59962V14.4004V19.1992V24H4.80075H9.59963H14.4004V19.1992H9.59963H4.80075Z"
+      fill="black" />
+  </g>
+  <defs>
+    <clipPath id="clip0_646_420">
+      <rect width="24" height="24" fill="white" />
+    </clipPath>
+  </defs>
+</svg>
+  

package/ui/standalone/public/lk-wordmark.svg

@@ -0,0 +1,12 @@
+<svg width="143" height="33" viewBox="0 0 143 33" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M5.47344 0.5H0.000244141V32.1311H19.8555V27.5113H5.47344V0.5Z" fill="white"/>
+<path d="M28.89 14.8997H23.5867V32.1294H28.89V14.8997Z" fill="white"/>
+<path d="M44.5022 31.5056L37.7567 9.69678H32.4534L39.5387 32.1303H49.4657L56.5511 9.69678H51.205L44.5022 31.5056Z" fill="white"/>
+<path d="M69.7073 9.19946C62.8334 9.19946 58.4639 14.0279 58.4639 20.8946C58.4639 27.7206 62.7063 32.6317 69.7073 32.6317C75.0521 32.6317 78.9132 30.3008 80.3554 25.5144H74.9627C74.1573 27.6786 72.671 28.9712 69.7438 28.9712C66.5195 28.9712 64.2718 26.765 63.8477 22.4378H80.7329C80.8136 21.8862 80.8557 21.3297 80.8588 20.7724C80.8601 13.7773 76.4478 9.19946 69.7073 9.19946ZM63.8892 18.8131C64.4417 14.7773 66.6051 12.8625 69.7073 12.8625C72.9731 12.8625 75.1792 15.2341 75.4347 18.8131H63.8892Z" fill="white"/>
+<path d="M111.871 0.5H104.998L91.6771 14.9841V0.5H86.2039V32.1311H91.6771V16.1495L106.356 32.1311H113.356L97.9985 15.4828L111.871 0.5Z" fill="white"/>
+<path d="M121.032 9.69678H115.729V26.9265H121.032V9.69678Z" fill="white"/>
+<path d="M23.5872 9.69678H18.2839V14.8993H23.5872V9.69678Z" fill="white"/>
+<path d="M126.337 26.9282H121.033V32.1307H126.337V26.9282Z" fill="white"/>
+<path d="M142.183 26.9282H136.88V32.1307H142.183V26.9282Z" fill="white"/>
+<path d="M142.182 14.9001V9.69759H136.879V0.5H131.576V9.69759H126.272V14.9001H131.576V26.9286H136.879V14.9001H142.182Z" fill="white"/>
+</svg>