feat: decode and re-encode video on the GPU where there is one

A 1080p film is decoded by whoever watches it and re-encoded by the node
when no browser can decode the source. Both were on the CPU, and on an
Atom or Celeron mini-PC neither reaches real time — which is what
`transcode_incompatible_video` exists to refuse. This adds the mechanism
that makes refusing it unnecessary.

Node — `hwaccel.py`: VA-API on Linux, Quick Sync or NVENC on Windows,
established by encoding 1080p and reading the file back with ffprobe.
Nothing is accepted that does not produce the exact profile and level
`stream_init` announces, since the client checks that string before it
trusts a byte: an encoder that wrote another level would make the node's
own codec string a lie, and ffmpeg takes `-level 4.1` and `-level 41`
from h264_qsv without saying which it understood. Three modes per
stream — hardware decode and encode, hardware encode alone, libx264 —
demoted per source codec, because a GPU that decodes HEVC may have no
decoder for MPEG-4 Part 2 and only asking it finds out. A mode that
fails is detected on an empty stdout before `stream_init` goes out, so
the viewer sees one working stream and never an error.

Client — Chromium ships VA-API off on Linux. It is enabled where a
render node and a driver are present, then verified through
`navigator.mediaCapabilities`: a no moves to the next GL backend on the
next launch and an exhausted list drops the switches, so a renamed
feature cannot pass for a feature that is on and `--ignore-gpu-blocklist`
cannot survive on a machine it did not help. Feature lists now merge
rather than overwrite — `appendSwitch` replaces the value, and a second
caller would have silently cancelled the mDNS switch aiortc depends on.

Packaging — the drivers are weak dependencies on all four formats, so a
machine without a GPU installs exactly as before. `dpkg -i` and
`rpm -ivh` ignore weak deps; `packaging/README.md` now says so. Windows
needs no driver: the bundled ffmpeg already carries h264_qsv and
h264_nvenc, and a re-pin that dropped them would cost every low-power
Windows node its hardware encoding silently.

AMD on Windows (AMF) and macOS (VideoToolbox) are named gaps, not
oversights: neither could be tried anywhere in this project, and both
re-encode in software as before.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 49 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py
index 2e7ea82..5862ac3 100644
--- a/packages/meshbay-hub/tests/test_desktop_shell.py
+++ b/packages/meshbay-hub/tests/test_desktop_shell.py
@@ -536,3 +536,52 @@ def test_the_tray_is_created_at_launch():
 
     assert bridge < launch, "ensureTray must come after registerBridge"
     assert launch < window, "the tray is created as part of startup"
+
+
+# ── Chromium's command line ─────────────────────────────────────────────────
+
+def test_no_feature_list_is_ever_written_directly():
+    """
+    `--enable-features` and `--disable-features` are one comma-joined list
+    each, and `appendSwitch` **replaces** the value rather than appending to
+    it. A second direct call therefore cancels the first with no error and
+    nothing in a log — the symptom is a feature that is simply not on, which
+    is how the mDNS switch below and the VA-API switches could silently
+    cancel each other. Every caller goes through `addFeatures`, which merges.
+    """
+    direct = re.findall(r"appendSwitch\(\s*['\"](?:enable|disable)-features",
+                        _main())
+    assert not direct, (
+        "a feature list is being written with appendSwitch directly; it "
+        "overwrites whatever another line already put there — use addFeatures")
+
+
+def test_the_mdns_concealment_is_still_disabled():
+    """Chromium's `.local` host candidates are dropped by aiortc, which has no
+    mDNS resolver: concealing the local IP removes the only LAN-routable
+    candidate rather than degrading it."""
+    assert "addFeatures('disable-features', ['WebRtcHideLocalIpsWithMdns'])" in _main()
+
+
+def test_hardware_video_decoding_is_asked_for_and_then_verified():
+    """
+    Turning VA-API on is half the job. Chromium renames these features across
+    releases and the client is rebuilt against the newest Electron every time,
+    so a name that stops matching must not pass for a feature that is on: the
+    result is measured through `navigator.mediaCapabilities` and remembered,
+    and `--ignore-gpu-blocklist` is dropped again on a machine where the
+    measurement never says hardware.
+    """
+    main = _main()
+    for feature in ("VaapiVideoDecodeLinuxGL", "AcceleratedVideoDecodeLinuxGL"):
+        assert feature in main, f"{feature} is no longer requested"
+    assert "ignore-gpu-blocklist" in main
+    assert "mediaCapabilities" in main and "powerEfficient" in main, (
+        "the switches are applied but nothing checks whether they worked")
+
+
+def test_hardware_decoding_can_be_turned_off_without_a_rebuild():
+    """A machine whose GL stack misbehaves in a way the measurement does not
+    catch needs an answer that is not "reinstall": config.json, the same file
+    every other client setting lives in."""
+    assert "config.videoAcceleration" in _main()