scrypted-kasa 1.2.3 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
    "name": "scrypted-kasa",
-   "version": "1.2.3",
+   "version": "1.3.0",
    "description": "TP-Link Kasa plugin for Scrypted — cameras (video, two-way audio, spotlight, siren, status LED), plugs/outlets, wall switches, dimmers, and smart bulbs (on/off, brightness, color, color temperature).",
    "author": "Sergey Vilgelm <sergey@vilgelm.com>",
    "license": "MIT",

package/src/camera/rtp.ts

@@ -0,0 +1,238 @@
+import { randomBytes } from 'crypto';
+
+// Native RTP packetization for H.264 (RFC 6184) and G.711 µ-law (RFC 3551). Replaces
+// the ffmpeg subprocess we used purely for codec-copy RTP packetization — the camera
+// already gives us H.264 + G.711, so spawning ffmpeg per stream just to wrap the bytes
+// in RTP headers was waste (one process, two pipes, two UDP socket pairs per camera).
+// This module produces the same wire format consumers already speak.
+
+const RTP_VERSION = 2;
+const RTP_HEADER_LEN = 12;
+export const PT_H264 = 96;
+export const PT_PCMU = 0;
+export const H264_CLOCK_HZ = 90000;
+export const G711_CLOCK_HZ = 8000;
+
+// RTCP Sender Report: 28 bytes, no report blocks (RC=0). RFC 3550 § 6.4.1.
+const RTCP_SR_LEN = 28;
+const RTCP_PT_SR = 200;
+// NTP epoch (1900-01-01) precedes Unix epoch (1970-01-01) by this many seconds.
+const NTP_UNIX_EPOCH_OFFSET_S = 2208988800;
+
+export interface NtpTime {
+    seconds: number;
+    fraction: number;
+}
+
+// Wall-clock as an NTP 64-bit fixed-point timestamp (32-bit seconds since 1900,
+// 32-bit fraction-of-second). Used in RTCP Sender Reports so receivers can map
+// each track's RTP timeline back to a common wall-clock — required for A/V sync
+// across two RTP streams that have independent random initial timestamps.
+export function nowNtp(): NtpTime {
+    const ms = Date.now();
+    const seconds = Math.floor(ms / 1000) + NTP_UNIX_EPOCH_OFFSET_S;
+    // 2^32 / 1000 = 4294967.296 — multiply ms-fraction by that to get the 32-bit
+    // fraction word. Math.floor (not round) so the result is always strictly less
+    // than 2^32; otherwise an unlucky float rounding to exactly 2^32 would wrap to
+    // 0 via `>>> 0` without carrying into `seconds`.
+    const fraction = Math.floor(((ms % 1000) / 1000) * 0x1_0000_0000);
+    return { seconds: seconds >>> 0, fraction: fraction >>> 0 };
+}
+
+function writeSenderReport(
+    ssrc: number,
+    ntp: NtpTime,
+    rtpTimestamp: number,
+    packetCount: number,
+    octetCount: number,
+): Buffer {
+    const buf = Buffer.allocUnsafe(RTCP_SR_LEN);
+    // V=2, P=0, RC=0 → 0b10_0_00000 = 0x80
+    buf[0] = RTP_VERSION << 6;
+    buf[1] = RTCP_PT_SR;
+    // Length in 32-bit words minus 1 → (28/4) - 1 = 6.
+    buf.writeUInt16BE(6, 2);
+    buf.writeUInt32BE(ssrc >>> 0, 4);
+    buf.writeUInt32BE(ntp.seconds >>> 0, 8);
+    buf.writeUInt32BE(ntp.fraction >>> 0, 12);
+    buf.writeUInt32BE(rtpTimestamp >>> 0, 16);
+    buf.writeUInt32BE(packetCount >>> 0, 20);
+    buf.writeUInt32BE(octetCount >>> 0, 24);
+    return buf;
+}
+
+// FU-A fragmentation cutoff. We serve via RTSP/TCP-interleaved (no MTU constraint),
+// but H.264 RTP receivers expect large NAL units to come as FU-A — fragmenting matches
+// the wire shape they would see from any standard RTSP server. 1400 keeps headroom
+// under a 1500-byte Ethernet MTU even though we never hit a real link.
+const RTP_PAYLOAD_MTU = 1400;
+// FU-A header overhead inside the RTP payload: 1 byte FU indicator + 1 byte FU header.
+const FU_A_HEADER_OVERHEAD = 2;
+
+// G.711 µ-law: 8 kHz mono, 1 byte per sample. 20 ms = 160 samples = 160 bytes per RTP
+// packet, the standard sizing in RFC 3551.
+const G711_SAMPLES_PER_PACKET = 160;
+
+function writeRtpHeader(
+    buf: Buffer,
+    payloadType: number,
+    seq: number,
+    timestamp: number,
+    ssrc: number,
+    marker: boolean,
+): void {
+    buf[0] = RTP_VERSION << 6;
+    buf[1] = (marker ? 0x80 : 0) | (payloadType & 0x7f);
+    buf.writeUInt16BE(seq & 0xffff, 2);
+    buf.writeUInt32BE(timestamp >>> 0, 4);
+    buf.writeUInt32BE(ssrc >>> 0, 8);
+}
+
+// Yields each NAL unit body (without the start code) found in an annex-b H.264 buffer.
+// Handles both 3-byte (00 00 01) and 4-byte (00 00 00 01) start codes.
+//
+// Single-pass via Buffer.indexOf — each byte is examined at most once, and the inner
+// scan is in native code (Boyer–Moore-ish), which matters for large IDR access units
+// containing many slice NALs (KC420WS IDRs run 80+ KB across dozens of slices).
+const NAL_START_CODE_3 = Buffer.from([0, 0, 1]);
+export function* annexbNalUnits(annexb: Buffer): IterableIterator<Buffer> {
+    const len = annexb.length;
+    // body offset of the currently-open NAL, or -1 until the first start code is seen.
+    let nalStart = -1;
+    let searchFrom = 0;
+    while (searchFrom < len) {
+        const hit = annexb.indexOf(NAL_START_CODE_3, searchFrom);
+        if (hit < 0) break;
+        // 4-byte form (00 00 00 01) shows up as a 3-byte hit one byte in; treat the
+        // leading 0 as part of the start code so the NAL we're closing ends just before
+        // the full 4-byte sequence.
+        const codeStart = hit > 0 && annexb[hit - 1] === 0 ? hit - 1 : hit;
+        if (nalStart >= 0 && codeStart > nalStart) {
+            // Skip empty NALs (back-to-back start codes) defensively — not valid in a
+            // well-formed bitstream but a malformed part shouldn't poison the stream.
+            yield annexb.subarray(nalStart, codeStart);
+        }
+        nalStart = hit + 3;
+        searchFrom = nalStart;
+    }
+    if (nalStart >= 0 && len > nalStart) yield annexb.subarray(nalStart, len);
+}
+
+export type RtpSink = (packet: Buffer) => void;
+
+// One packetizer per stream session — owns the seq counter and SSRC. RTP requires both
+// to be stable across all packets of a stream, with seq monotonically increasing.
+export class H264RtpPacketizer {
+    private seq: number;
+    private packetCount = 0;
+    private octetCount = 0;
+    private lastTimestamp = 0;
+    readonly ssrc: number;
+
+    constructor() {
+        this.seq = randomBytes(2).readUInt16BE(0);
+        this.ssrc = randomBytes(4).readUInt32BE(0);
+    }
+
+    // Emits RTP packets for one access unit. All packets share `timestamp` (90 kHz),
+    // and the marker bit is set on the last packet of the AU per RFC 6184 § 5.1. Caller
+    // typically passes one annex-b buffer per video part = one AU.
+    packetize(annexb: Buffer, timestamp: number, sink: RtpSink): void {
+        const nals: Buffer[] = [];
+        for (const nal of annexbNalUnits(annexb)) nals.push(nal);
+        if (nals.length === 0) return;
+
+        for (let i = 0; i < nals.length; i++) {
+            const nal = nals[i];
+            const isLastNal = i === nals.length - 1;
+
+            if (nal.length <= RTP_PAYLOAD_MTU) {
+                const pkt = Buffer.allocUnsafe(RTP_HEADER_LEN + nal.length);
+                writeRtpHeader(pkt, PT_H264, this.seq++, timestamp, this.ssrc, isLastNal);
+                nal.copy(pkt, RTP_HEADER_LEN);
+                sink(pkt);
+                this.packetCount++;
+                this.octetCount = (this.octetCount + nal.length) >>> 0;
+                continue;
+            }
+
+            // FU-A: split nal[0]'s F+NRI bits into the FU indicator (with type=28), and
+            // its 5-bit NAL type into the FU header along with start/end markers. The
+            // payload is nal.subarray(1) — the original NAL header byte is reconstructed
+            // by the receiver from FU indicator NRI + FU header type.
+            const nalHeader = nal[0];
+            const fuIndicator = (nalHeader & 0xe0) | 28;
+            const fuTypeBits = nalHeader & 0x1f;
+            const payload = nal.subarray(1);
+            const chunkSize = RTP_PAYLOAD_MTU - FU_A_HEADER_OVERHEAD;
+            let offset = 0;
+            while (offset < payload.length) {
+                const remaining = payload.length - offset;
+                const take = Math.min(chunkSize, remaining);
+                const isFirstFu = offset === 0;
+                const isLastFu = take === remaining;
+                const fuHeader = (isFirstFu ? 0x80 : 0) | (isLastFu ? 0x40 : 0) | fuTypeBits;
+                const pkt = Buffer.allocUnsafe(RTP_HEADER_LEN + FU_A_HEADER_OVERHEAD + take);
+                writeRtpHeader(pkt, PT_H264, this.seq++, timestamp, this.ssrc, isLastNal && isLastFu);
+                pkt[RTP_HEADER_LEN] = fuIndicator;
+                pkt[RTP_HEADER_LEN + 1] = fuHeader;
+                payload.copy(pkt, RTP_HEADER_LEN + FU_A_HEADER_OVERHEAD, offset, offset + take);
+                sink(pkt);
+                this.packetCount++;
+                this.octetCount = (this.octetCount + FU_A_HEADER_OVERHEAD + take) >>> 0;
+                offset += take;
+            }
+        }
+        this.lastTimestamp = timestamp >>> 0;
+    }
+
+    // Build an RTCP Sender Report describing the latest emission. `ntp` should be sampled
+    // close to the moment of the SR's wire emission so the NTP↔RTP timestamp pair stays
+    // accurate. Returns undefined when no packets have been emitted yet — receivers can
+    // tolerate a missing first SR, and emitting one with all zeros confuses jitter math.
+    senderReport(ntp: NtpTime): Buffer | undefined {
+        if (this.packetCount === 0) return;
+        return writeSenderReport(this.ssrc, ntp, this.lastTimestamp, this.packetCount, this.octetCount);
+    }
+}
+
+// G.711 µ-law packetizer — chunks a µ-law byte stream into 20 ms RTP packets. The caller
+// supplies the timestamp of the FIRST sample in `mulaw`; the packetizer advances by
+// sample count internally to keep packet-to-packet timing exact regardless of how the
+// camera batched samples into multipart parts. Returns the next-sample timestamp so the
+// caller can chain across parts if it wants sample-accurate timing.
+export class G711RtpPacketizer {
+    private seq: number;
+    private packetCount = 0;
+    private octetCount = 0;
+    private lastTimestamp = 0;
+    readonly ssrc: number;
+
+    constructor() {
+        this.seq = randomBytes(2).readUInt16BE(0);
+        this.ssrc = randomBytes(4).readUInt32BE(0);
+    }
+
+    packetize(mulaw: Buffer, timestampStart: number, sink: RtpSink): number {
+        let offset = 0;
+        let ts = timestampStart >>> 0;
+        while (offset < mulaw.length) {
+            const take = Math.min(G711_SAMPLES_PER_PACKET, mulaw.length - offset);
+            const pkt = Buffer.allocUnsafe(RTP_HEADER_LEN + take);
+            writeRtpHeader(pkt, PT_PCMU, this.seq++, ts, this.ssrc, false);
+            mulaw.copy(pkt, RTP_HEADER_LEN, offset, offset + take);
+            sink(pkt);
+            this.packetCount++;
+            this.octetCount = (this.octetCount + take) >>> 0;
+            this.lastTimestamp = ts;
+            ts = (ts + take) >>> 0;
+            offset += take;
+        }
+        return ts;
+    }
+
+    senderReport(ntp: NtpTime): Buffer | undefined {
+        if (this.packetCount === 0) return;
+        return writeSenderReport(this.ssrc, ntp, this.lastTimestamp, this.packetCount, this.octetCount);
+    }
+}

package/src/camera/rtsp.ts

@@ -35,6 +35,15 @@ interface RtspRequest {
 // TCP-interleaved transport only — that's what Scrypted's pipeline asks for by default and
 // it sidesteps every NAT/UDP-loss complication. We build the SDP upstream and just serve it
 // on DESCRIBE; we never parse one.
+// Hard cap on Node's userland write queue (`socket.bufferSize`). If the consumer falls
+// behind by more than this, we give up rather than letting RAM grow unbounded. 2 MB at
+// 4 Mbps video is ~4 s of data — past that, the stream is unrecoverable for live
+// consumption anyway, and most receivers would resync faster from a fresh PLAY than
+// from catching up to a stale backlog. Note: this is Node's queue, not the kernel TCP
+// send buffer (SO_SNDBUF) — the kernel buffer is bounded by net.ipv4.tcp_wmem and
+// applies backpressure via TCP window before this cap would ever be hit.
+const RTSP_WRITE_BUFFER_HARD_CAP = 2 * 1024 * 1024;
+
 export function handleRtspClient(client: net.Socket, opts: RtspHandlerOptions): void {
     const sessionId = randomBytes(8).toString('hex');
     let videoChannels: RtspChannelPair | undefined;
@@ -42,6 +51,13 @@ export function handleRtspClient(client: net.Socket, opts: RtspHandlerOptions):
     let buffered: Buffer = Buffer.alloc(0);
     let isPlaying = false;
     let teardownNotified = false;
+    // Drop sends while Node's userland write queue is back-pressured (client.write()
+    // returned false). Cleared on 'drain'. Without this, a slow consumer makes the queue
+    // grow unbounded — the live-video equivalent of bufferbloat.
+    let backpressured = false;
+    client.on('drain', () => {
+        backpressured = false;
+    });
 
     const notifyTeardown = () => {
         if (teardownNotified) return;
@@ -51,6 +67,22 @@ export function handleRtspClient(client: net.Socket, opts: RtspHandlerOptions):
 
     const send: RtspSendInterleaved = (channel, packet) => {
         if (client.destroyed) return false;
+        // Cap check runs BEFORE the backpressured early-return: a single write that
+        // pushes bufferSize over the cap will set backpressured=true on the way out, and
+        // without the cap check up here the next send would short-circuit on the
+        // backpressure flag and never observe the oversize backlog. With the cap check
+        // first, a permanently stuck consumer (paused but not closed) gets torn down on
+        // the next send instead of holding bytes resident forever.
+        if (client.bufferSize > RTSP_WRITE_BUFFER_HARD_CAP) {
+            opts.console.warn(
+                'rtsp: client write buffer exceeded',
+                RTSP_WRITE_BUFFER_HARD_CAP,
+                'bytes — destroying client',
+            );
+            client.destroy();
+            return false;
+        }
+        if (backpressured) return false;
         // Interleaved frame: '$' + 1-byte channel + 2-byte BE length + RTP packet bytes.
         // Header + body in one Buffer to avoid splitting writes (a small write between the
         // two would let an out-of-order chunk arrive in the middle of an interleaved frame).
@@ -64,7 +96,9 @@ export function handleRtspClient(client: net.Socket, opts: RtspHandlerOptions):
         // ERR_STREAM_DESTROYED. Catch it; the next packet's destroyed check will gate
         // further sends.
         try {
-            return client.write(out);
+            const ok = client.write(out);
+            if (!ok) backpressured = true;
+            return ok;
         } catch {
             return false;
         }

package/src/camera/stream.ts

@@ -1,17 +1,12 @@
-import child_process from 'child_process';
-import dgram from 'dgram';
-import { once } from 'events';
 import net from 'net';
-import { Writable } from 'stream';
 import { findSpsPps, KasaClient, KasaMimeG711U, KasaMimeVideo, KasaPart } from './api';
+import { G711_CLOCK_HZ, G711RtpPacketizer, H264_CLOCK_HZ, H264RtpPacketizer, nowNtp } from './rtp';
 import { handleRtspClient } from './rtsp';
 
-// Process-level cleanup registry. Scrypted runs plugins as worker threads, and child
-// processes spawned by a worker survive the worker's termination — they're owned by the
-// host Node process. So when our plugin gets unloaded (or even when the worker crashes),
-// any in-flight ffmpeg subprocess + kasa HTTPS connection would otherwise leak. We catch
-// that here: every spawnKasaStream and intercom-ffmpeg registers its kill function and
-// removes itself on normal teardown. On worker exit, the hook nukes anything still live.
+// Process-level cleanup registry. Scrypted runs plugins as worker threads; resources
+// owned by the host Node process (TCP servers, kasa HTTPS connections) survive worker
+// termination otherwise. Every spawnKasaStream registers its kill function and removes
+// itself on normal teardown. On worker exit, the hook nukes anything still live.
 const liveCleanups = new Set<() => void>();
 let exitHookInstalled = false;
 function installExitHook() {
@@ -47,7 +42,6 @@ const SPS_PPS_MAX_BUFFERED_BYTES = 32 * 1024 * 1024;
 
 export interface KasaStreamOptions {
     kasa: KasaClient;
-    ffmpegPath: string;
     console: Console;
     // Optional cached SPS/PPS from a previous session. When present we skip the
     // preScanSpsPps wait (which holds getVideoStream up to ~2s on KC420WS waiting for the
@@ -68,77 +62,6 @@ export interface KasaStreamHandle {
     exited: Promise<void>;
 }
 
-interface BoundUdp {
-    socket: dgram.Socket;
-    port: number;
-}
-
-interface UdpPair {
-    rtp: BoundUdp;
-    rtcp: BoundUdp;
-}
-
-// 1 MB UDP receive buffer — comfortably absorbs an IDR-frame burst on the localhost hop
-// from ffmpeg, which can be 100+ RTP packets arriving back-to-back. The default Linux
-// SO_RCVBUF (~200 KB) overflows on 1080p H.264 IDRs and drops fragments, surfacing as
-// "fua packet missing" in downstream consumers.
-const UDP_RECV_BUFFER_BYTES = 1024 * 1024;
-
-async function bindUdp(port: number = 0): Promise<BoundUdp> {
-    const sock = dgram.createSocket('udp4');
-    await new Promise<void>((resolve, reject) => {
-        const onError = (e: Error) => {
-            sock.removeListener('listening', onListen);
-            reject(e);
-        };
-        const onListen = () => {
-            sock.removeListener('error', onError);
-            resolve();
-        };
-        sock.once('error', onError);
-        sock.once('listening', onListen);
-        sock.bind(port, '127.0.0.1');
-    });
-    // setRecvBufferSize tries to bump SO_RCVBUF; the kernel caps it at net.core.rmem_max
-    // (often 200 KB on stock Linux, 2+ MB on most server distros). We don't fail if the
-    // bump is rejected — small buffer just means we may drop on big bursts.
-    try {
-        sock.setRecvBufferSize(UDP_RECV_BUFFER_BYTES);
-    } catch {
-        /* best-effort */
-    }
-    return { socket: sock, port: (sock.address() as { port: number }).port };
-}
-
-// Bind a (RTP, RTP+1) UDP pair so RTCP gets the conventional next port. ffmpeg's `-f rtp`
-// output assumes RTP+1 for RTCP unless rtcpport= overrides; binding the pair ourselves
-// keeps the wiring straightforward. Retry up to 10 times in case RTP+1 is already taken.
-async function bindUdpPair(): Promise<UdpPair> {
-    for (let attempt = 0; attempt < 10; attempt++) {
-        const rtp = await bindUdp();
-        try {
-            const rtcp = await bindUdp(rtp.port + 1);
-            return { rtp, rtcp };
-        } catch {
-            rtp.socket.close();
-        }
-    }
-    throw new Error('failed to bind sequential RTP/RTCP udp pair after 10 tries');
-}
-
-// Reserve a TCP port on localhost for the RTSP server. Brief TOCTOU window between close
-// and re-bind is accepted — nothing else snatches loopback ports in those few ms.
-async function reserveTcpPort(): Promise<number> {
-    return new Promise<number>((resolve, reject) => {
-        const probe = net.createServer();
-        probe.once('error', reject);
-        probe.listen(0, '127.0.0.1', () => {
-            const port = (probe.address() as net.AddressInfo).port;
-            probe.close(() => resolve(port));
-        });
-    });
-}
-
 // Build the SDP we serve on DESCRIBE. We embed sprop-parameter-sets so consumers can decode
 // without waiting for the next IDR — important for HomeKit's strict first-frame timeouts.
 function buildSdp(sps: Buffer, pps: Buffer): string {
@@ -183,68 +106,38 @@ async function preScanSpsPps(kasa: KasaClient): Promise<{ sps: Buffer; pps: Buff
     return { sps: found.sps!, pps: found.pps!, buffered };
 }
 
-// Replays the buffered parts captured during the SPS/PPS scan (so ffmpeg sees the
-// SPS+PPS+IDR sequence required to start decoding) then continues pumping live parts. We
-// honor backpressure: if ffmpeg falls behind (CPU spike, paused consumer, etc.), ignoring
-// drain would let Node's write buffer grow without bound. Awaiting drain throttles the
-// camera read loop instead — the camera's TCP receive window will fill up and the kernel
-// will pause it for us.
-async function pumpKasa(
-    kasa: KasaClient,
-    videoPipe: Writable,
-    audioPipe: Writable,
-    prebuffered: KasaPart[],
-): Promise<void> {
-    const writePart = async (part: KasaPart) => {
-        const pipe =
-            part.contentType === KasaMimeVideo ? videoPipe : part.contentType === KasaMimeG711U ? audioPipe : undefined;
-        if (!pipe || pipe.writableEnded || pipe.destroyed) return;
-        if (!pipe.write(part.body)) {
-            // Race 'drain' against teardown. If the pipe closes/errors before draining,
-            // 'drain' never fires and the pump would hang forever. AbortController removes
-            // the losing listeners after the race so frequent backpressure cycles don't
-            // accumulate listeners on the pipe.
-            const ac = new AbortController();
-            try {
-                await Promise.race([
-                    once(pipe, 'drain', { signal: ac.signal }).catch(() => {}),
-                    once(pipe, 'close', { signal: ac.signal }).catch(() => {}),
-                    once(pipe, 'error', { signal: ac.signal }).catch(() => {}),
-                ]);
-            } finally {
-                ac.abort();
-            }
-        }
-    };
+// Reserve a TCP port on localhost for the RTSP server. Brief TOCTOU window between close
+// and re-bind is accepted — nothing else snatches loopback ports in those few ms.
+async function reserveTcpPort(): Promise<number> {
+    return new Promise<number>((resolve, reject) => {
+        const probe = net.createServer();
+        probe.once('error', reject);
+        probe.listen(0, '127.0.0.1', () => {
+            const port = (probe.address() as net.AddressInfo).port;
+            probe.close(() => resolve(port));
+        });
+    });
+}
 
-    try {
-        for (const part of prebuffered) await writePart(part);
-        // Release prebuffered parts (up to a few hundred KB each) — they were captured
-        // during the SPS/PPS scan and are only needed for this single replay.
-        prebuffered.length = 0;
-        while (true) {
-            const part = await kasa.readPart();
-            await writePart(part);
-        }
-    } finally {
-        try {
-            videoPipe.end();
-        } catch {}
-        try {
-            audioPipe.end();
-        } catch {}
-    }
+// Compute an RTP timestamp at `clockHz` from a process.hrtime delta in nanoseconds.
+// 32-bit unsigned wrap is the RTP norm — receivers handle wrap.
+function nanosToRtp(deltaNs: bigint, clockHz: number): number {
+    // BigInt multiply keeps precision for clockHz=90000 over hours of streaming.
+    const ticks = (deltaNs * BigInt(clockHz)) / 1_000_000_000n;
+    return Number(ticks & 0xffffffffn) >>> 0;
 }
 
 // Orchestrates the kasa→consumer streaming pipeline:
-//   kasa multipart → ffmpeg pipe inputs (codec copy) → RTP UDP outputs
-//                  → minimal RTSP server forwards UDP RTP as TCP-interleaved frames
-//                  → consumer reads via rtsp:// URL
+//   kasa multipart → native RTP packetizer → RTSP TCP-interleaved frames → consumer
+//
+// No ffmpeg subprocess, no UDP loopback hop, no extra forwarder layer. The kasa parts
+// already carry the codecs we serve (annex-b H.264, G.711 µ-law); ffmpeg's only job in
+// the previous design was RTP packetization, which is well-defined enough to do directly.
 //
-// Returns a handle whose `kill()` tears down everything (kasa, ffmpeg, UDP sockets, TCP
-// server, active client) and whose `exited` promise resolves once that teardown is done.
+// Returns a handle whose `kill()` tears down everything (kasa, TCP server, active
+// client) and whose `exited` promise resolves once that teardown is done.
 export async function spawnKasaStream(opts: KasaStreamOptions): Promise<KasaStreamHandle> {
-    const { kasa, ffmpegPath, console, cachedSps, cachedPps, onFreshSpsPps } = opts;
+    const { kasa, console, cachedSps, cachedPps, onFreshSpsPps } = opts;
 
     // Fast path: caller supplied cached SPS/PPS from a previous session. Skip the scan and
     // start streaming live parts immediately — saves the ~1-2s preScanSpsPps wait on cold
@@ -263,8 +156,6 @@ export async function spawnKasaStream(opts: KasaStreamOptions): Promise<KasaStre
         (cachedSps[0] & 0x1f) === 7 &&
         (cachedPps[0] & 0x1f) === 8;
     if ((cachedSps || cachedPps) && !cacheValid) {
-        // Caller will overwrite the bad cache via onFreshSpsPps below once the slow path
-        // produces fresh values; nothing to do here beyond logging and falling through.
         console.warn('[kasa-stream] cached SPS/PPS failed validation; falling back to in-band scan');
     }
 
@@ -280,8 +171,6 @@ export async function spawnKasaStream(opts: KasaStreamOptions): Promise<KasaStre
         sps = scanned.sps;
         pps = scanned.pps;
         buffered = scanned.buffered;
-        // Persist for next time. Pass the original error object (not just .message) so
-        // stack/context survive — non-Error throws would lose everything otherwise.
         try {
             onFreshSpsPps?.(sps, pps);
         } catch (e) {
@@ -290,73 +179,30 @@ export async function spawnKasaStream(opts: KasaStreamOptions): Promise<KasaStre
     }
     const sdp = buildSdp(sps, pps);
 
-    const videoUdp = await bindUdpPair();
-    const audioUdp = await bindUdpPair();
+    // Packetizers carry seq + SSRC across the whole session.
+    const h264 = new H264RtpPacketizer();
+    const g711 = new G711RtpPacketizer();
 
-    // Two RTP outputs, one per track. `-vn`/`-an` per output filter the unwanted side
-    // rather than using `-map`. Explicit -payload_type lines pin the PTs to the values our
-    // SDP advertises (96 for H.264, 0 for PCMU) so a future ffmpeg default change can't
-    // silently break the SDP/stream contract.
-    // prettier-ignore
-    const args = [
-        '-hide_banner',
-        '-loglevel', 'error',
-        '-thread_queue_size', '1024',
-        '-f', 'h264',
-        '-i', 'pipe:3',
-        '-thread_queue_size', '1024',
-        '-f', 'mulaw',
-        '-ar', '8000',
-        '-ac', '1',
-        '-i', 'pipe:4',
-        '-vcodec', 'copy', '-an', '-dn', '-sn',
-        '-f', 'rtp',
-        '-payload_type', '96',
-        `rtp://127.0.0.1:${videoUdp.rtp.port}?rtcpport=${videoUdp.rtcp.port}`,
-        '-acodec', 'copy', '-vn', '-dn', '-sn',
-        '-f', 'rtp',
-        '-payload_type', '0',
-        `rtp://127.0.0.1:${audioUdp.rtp.port}?rtcpport=${audioUdp.rtcp.port}`,
-    ];
-
-    const cp = child_process.spawn(ffmpegPath, args, {
-        stdio: ['ignore', 'pipe', 'pipe', 'pipe', 'pipe'],
-    });
-    cp.stderr?.on('data', d => {
-        const text = d.toString().trim();
-        if (text) console.log('[kasa-ffmpeg]', text);
-    });
-
-    const videoPipe = cp.stdio[3] as Writable;
-    const audioPipe = cp.stdio[4] as Writable;
+    // Active forwarder — populated when the RTSP client PLAYs, cleared on teardown.
+    interface ActiveForwarder {
+        send: (channel: number, packet: Buffer) => boolean;
+        videoRtp: number;
+        videoRtcp: number;
+        audioRtp: number;
+        audioRtcp: number;
+    }
+    let active: ActiveForwarder | null = null;
 
-    // Attach 'error' listeners on both pipes IMMEDIATELY. When cleanupAll calls cp.kill,
-    // ffmpeg's stdio FDs close forcibly and any in-flight pump write throws ECONNRESET /
-    // EPIPE on the writable side. Without listeners, Node turns those into
-    // uncaughtException and crashes the whole plugin worker (taking down every camera).
-    // The `_e` arg is intentional — we just want the stream to be informed there's a
-    // listener.
-    videoPipe.on('error', _e => {
-        /* tear down via the kasa pump's own try/finally */
-    });
-    audioPipe.on('error', _e => {
-        /* tear down via the kasa pump's own try/finally */
-    });
+    let tcpServer: net.Server | undefined = undefined;
+    let activeClient: net.Socket | undefined = undefined;
+    let unregisterCleanup: (() => void) | undefined = undefined;
+    let rtcpInterval: NodeJS.Timeout | undefined = undefined;
 
     let resolveExited!: () => void;
     const exited = new Promise<void>(r => {
         resolveExited = r;
     });
 
-    // Forward-declare anything cleanupAll touches that's initialized later in the function.
-    // ffmpeg's `exit`/`error` events or a pump throw can fire cleanupAll while we're still
-    // awaiting `reserveTcpPort()` below — referencing TDZ const bindings here would throw
-    // an uncaught ReferenceError and skip the rest of teardown. Explicit `= undefined` so
-    // eslint's prefer-const sees the later reassignment.
-    let tcpServer: net.Server | undefined = undefined;
-    let activeClient: net.Socket | undefined = undefined;
-    let unregisterCleanup: (() => void) | undefined = undefined;
-
     let killed = false;
     const cleanupAll = () => {
         if (killed) return;
@@ -364,6 +210,10 @@ export async function spawnKasaStream(opts: KasaStreamOptions): Promise<KasaStre
         try {
             unregisterCleanup?.();
         } catch {}
+        if (rtcpInterval) {
+            clearInterval(rtcpInterval);
+            rtcpInterval = undefined;
+        }
         try {
             tcpServer?.close();
         } catch {}
@@ -373,70 +223,61 @@ export async function spawnKasaStream(opts: KasaStreamOptions): Promise<KasaStre
         try {
             kasa.destroy();
         } catch {}
-        try {
-            cp.kill('SIGKILL');
-        } catch {}
-        try {
-            videoUdp.rtp.socket.close();
-        } catch {}
-        try {
-            videoUdp.rtcp.socket.close();
-        } catch {}
-        try {
-            audioUdp.rtp.socket.close();
-        } catch {}
-        try {
-            audioUdp.rtcp.socket.close();
-        } catch {}
+        active = null;
         resolveExited();
     };
-    // Register with the process-level cleanup registry so worker termination kills the
-    // ffmpeg subprocess + closes the kasa connection even if our normal teardown path
-    // (release(), kill switch, ffmpeg exit) didn't run.
     unregisterCleanup = registerLiveCleanup(cleanupAll);
 
-    // ffmpeg exit (or spawn error) is itself a teardown trigger.
-    cp.once('exit', cleanupAll);
-    cp.once('error', cleanupAll);
+    // Pump kasa parts directly into the active forwarder. No intermediate process, pipe,
+    // or UDP hop. Drops parts until the RTSP client PLAYs (i.e. while `active` is null —
+    // start-up race only; we don't implement PAUSE semantics, since live consumers
+    // either keep playing or TEARDOWN). Backpressure: handled inside rtsp.ts `send` —
+    // drops while Node's userland write queue is full and tears down the client if the
+    // queued bytes cross a hard cap. From here we just call send and let it decide.
+    const pump = async () => {
+        const t0 = process.hrtime.bigint();
+        const replay = buffered;
+        buffered = [];
+        // Audio RTP timestamps must advance by sample count, not wall-clock — RTP
+        // receivers use the timestamp to drive playout, and any wall-clock-derived jitter
+        // would surface as audible discontinuities. Initialize once on first audio part
+        // (using elapsed time so audio and video share a roughly aligned origin), then
+        // chain via the packetizer's return value across every subsequent part.
+        let audioTs: number | undefined;
+        const handlePart = (part: KasaPart) => {
+            if (killed) return;
+            if (!active) return;
+            const fwd = active;
+            const elapsed = process.hrtime.bigint() - t0;
+            if (part.contentType === KasaMimeVideo) {
+                const ts = nanosToRtp(elapsed, H264_CLOCK_HZ);
+                h264.packetize(part.body, ts, pkt => {
+                    if (active === fwd) fwd.send(fwd.videoRtp, pkt);
+                });
+            } else if (part.contentType === KasaMimeG711U) {
+                if (audioTs === undefined) audioTs = nanosToRtp(elapsed, G711_CLOCK_HZ);
+                audioTs = g711.packetize(part.body, audioTs, pkt => {
+                    if (active === fwd) fwd.send(fwd.audioRtp, pkt);
+                });
+            }
+        };
 
-    // Pump kasa → ffmpeg pipes. If the pump throws (kasa stream ended/errored), tear down.
-    // We suppress the warn when `killed` is already set, because that means our own
-    // cleanupAll destroyed the kasa connection and the resulting "stream ended" throw is
-    // expected close-sequence noise, not a real error.
-    pumpKasa(kasa, videoPipe, audioPipe, buffered)
-        .catch(e => {
+        try {
+            for (const part of replay) handlePart(part);
+            // Release prebuffered parts (up to a few hundred KB each) — they were captured
+            // during the SPS/PPS scan and are only needed for this single replay.
+            replay.length = 0;
+            while (!killed) {
+                const part = await kasa.readPart();
+                handlePart(part);
+            }
+        } catch (e) {
             if (!killed) console.warn('[kasa-stream] pump error', (e as Error).message);
-        })
-        .finally(cleanupAll);
-
-    // Forwarding state — populated atomically when the RTSP client PLAYs, used by the
-    // always-attached UDP message handlers below. One reference instead of two so the
-    // handlers can't observe a half-set state under any scheduling.
-    interface ActiveForwarder {
-        send: (channel: number, packet: Buffer) => boolean;
-        videoRtp: number;
-        videoRtcp: number;
-        audioRtp: number;
-        audioRtcp: number;
-    }
-    let active: ActiveForwarder | null = null;
-
-    // Attach UDP listeners IMMEDIATELY (not on PLAY) so the kernel buffer gets drained as
-    // soon as ffmpeg starts producing packets. Without this, packets sent before the RTSP
-    // client connects pile up in SO_RCVBUF and either get dropped on overflow, or block
-    // libuv from polling the socket cleanly. Until `active` is set, we just discard.
-    videoUdp.rtp.socket.on('message', msg => {
-        if (active) active.send(active.videoRtp, msg);
-    });
-    videoUdp.rtcp.socket.on('message', msg => {
-        if (active) active.send(active.videoRtcp, msg);
-    });
-    audioUdp.rtp.socket.on('message', msg => {
-        if (active) active.send(active.audioRtp, msg);
-    });
-    audioUdp.rtcp.socket.on('message', msg => {
-        if (active) active.send(active.audioRtcp, msg);
-    });
+        } finally {
+            cleanupAll();
+        }
+    };
+    void pump();
 
     // Bind the RTSP listener last, after all the supporting pieces are in place.
     const rtspPort = await reserveTcpPort();
@@ -472,15 +313,27 @@ export async function spawnKasaStream(opts: KasaStreamOptions): Promise<KasaStre
                     audioRtp: channels.audio.rtp,
                     audioRtcp: channels.audio.rtcp,
                 };
+                // Periodic RTCP Sender Reports. Receivers map each track's RTP timeline
+                // to wall-clock NTP via SRs to keep audio/video in sync — the prior ffmpeg
+                // pipeline emitted them, so generating a minimal SR every 5 s keeps
+                // behavior parity. A single SR per track is ~28 B; cost is negligible.
+                rtcpInterval = setInterval(() => {
+                    if (!active || killed) return;
+                    const ntp = nowNtp();
+                    const vsr = h264.senderReport(ntp);
+                    if (vsr) active.send(active.videoRtcp, vsr);
+                    const asr = g711.senderReport(ntp);
+                    if (asr) active.send(active.audioRtcp, asr);
+                }, 5000);
             },
             onTeardown: cleanupAll,
         });
     });
 
     await new Promise<void>((resolve, reject) => {
-        tcpServer.once('error', reject);
-        tcpServer.listen(rtspPort, '127.0.0.1', () => {
-            tcpServer.removeListener('error', reject);
+        tcpServer!.once('error', reject);
+        tcpServer!.listen(rtspPort, '127.0.0.1', () => {
+            tcpServer!.removeListener('error', reject);
             resolve();
         });
     });

package/src/main.ts

@@ -421,8 +421,8 @@ class KasaCamera extends ScryptedDeviceBase implements VideoCamera, Settings, In
             password,
         });
 
-        // Single shared kill switch: any teardown source (kasa close, ffmpeg exit, RTSP
-        // client disconnect, pump error) resolves it, and every owned resource registers a
+        // Single shared kill switch: any teardown source (kasa close, RTSP client
+        // disconnect, pump error) resolves it, and every owned resource registers a
         // cleanup against it. spawnKasaStream owns the actual resource teardown; we just
         // surface the kill switch to settings-change handlers via activeStreamKills.
         const kill = new Deferred<void>();
@@ -431,7 +431,6 @@ class KasaCamera extends ScryptedDeviceBase implements VideoCamera, Settings, In
         kasa.body.on('close', () => kill.resolve());
         kasa.body.on('error', () => kill.resolve());
 
-        const ffmpegPath = await mediaManager.getFFmpegPath();
         // Read cached SPS/PPS from per-device storage. Lets spawnKasaStream skip the
         // ~1-2s preScanSpsPps wait on cold starts (HomeKit's perceived latency dominates
         // here). Cache survives plugin restarts. Stale-cache risk is bounded — in-band
@@ -446,7 +445,6 @@ class KasaCamera extends ScryptedDeviceBase implements VideoCamera, Settings, In
         try {
             stream = await spawnKasaStream({
                 kasa,
-                ffmpegPath,
                 console: this.console,
                 cachedSps,
                 cachedPps,
@@ -610,8 +608,8 @@ class KasaCamera extends ScryptedDeviceBase implements VideoCamera, Settings, In
     // and kasa HTTPS sockets running after the plugin is gone, since child_process is
     // owned by the host Node process, not the worker.
     release(): void {
-        // Each kill triggers cleanupAll inside spawnKasaStream — kills ffmpeg, destroys
-        // the kasa connection, closes UDP sockets and the local RTSP server.
+        // Each kill triggers cleanupAll inside spawnKasaStream — destroys the kasa
+        // connection and closes the local RTSP server.
         for (const kill of [...this.activeStreamKills]) kill.resolve();
         // Stop the intercom too if anything was active. stopIntercom is async only because
         // its signature is — the work it does is synchronous, so fire-and-forget is fine.