Go Live: request window-scoped audio (windowAudio: window, Chrome 141+); keep the picker window-only

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CommunityDiscordMedia.md

@@ -185,7 +185,9 @@ Checklist:
 - [ ] Caddy: `forward_auth 127.0.0.1:9000 { uri /outpost.goauthentik.io/auth/caddy; copy_headers X-Authentik-Username X-Authentik-Groups … }`
       on `/`, `/dock*`, `/dump*`, `/sync*`; `reverse_proxy /outpost.goauthentik.io/* 127.0.0.1:9000`
 - [ ] copyparty: `idp-h-usr: X-Authentik-Username`, `idp-h-grp: X-Authentik-Groups`, `xff-src` = Caddy only;
-      volume accs become `r: @editors`, `rw: @editors` (finals), `rwmd: @admins`
+      volume accs become `r: @editors`, `rw: @editors` (finals), `rwmd: @media-admins` on every volume incl. trash
+      (new group `media-admins`; techy joins it via a Discord role in the roles→groups table or a manual add —
+      replaces today's workaround of logging in as the local `admin` account to modify streams/clips)
 - [ ] keep the local accounts in `copyparty.conf` until an `editors` Discord user has browsed and
       downloaded through the new path; then remove them (`configure.py` drops the editors section)
 - [ ] WebDAV: editor creates an app password in Authentik → mounts with Discord username + app password

README.md

@@ -205,7 +205,7 @@ asked by `configure.py --full`) can post when a stream starts.
    embedded outpost → group policy (e.g. everyone in the server, or `streamers`+`editors`+`admins`).
 3. Dev box: `./deployLive.sh` builds `live/` and copies `dist/` to `/srv/live` (Caddy serves it directly).
 
-**Go Live** button: broadcast a window from the browser (no OBS) as `<user>/HelmetCam-<date>` — key comes
+**Go Live** button (Chrome/Edge 141+ for window audio): broadcast a window from the browser (no OBS) as `<user>/HelmetCam-<date>` — key comes
 from `/me/stream-key` (dumpd reads `/etc/vanguard/streamers.json`, identity from the Authentik header), so a
 streamer's Authentik username must equal their MediaMTX name.
 

STATUS.md

@@ -30,8 +30,8 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea
 | Editor | Browse by streamer/title, scrub in browser, download originals, upload finals | copyparty `https://ovh1…/` | **local account** (to move to Discord) |
 | Editor | Mount the library as a drive | WebDAV, same URL | same |
 | Anyone in the Discord server | Watch recordings and clips by streamer and season | Jellyfin `https://watch.…/` | Discord (Authentik) |
-| Anyone in the Discord server | Watch live: all active streams in dockable windows, audio follows focus, per-window mute/volume | Live portal `https://live.…/` | Discord (Authentik, domain-level) — live, first real stream untested |
-| Streamer | **Go Live** from the browser: pick the WarDogs window (+audio), streams as `<user>/HelmetCam-<date>`; no OBS needed | Live portal → Go Live | Discord; key fetched for the logged-in user — awaiting MediaMTX port fix |
+| Anyone in the Discord server | Watch live: all active streams in dockable windows, audio follows focus, per-window mute/volume | Live portal `https://live.…/` | Discord (Authentik, domain-level) — live; viewer side not yet exercised during a stream |
+| Streamer | **Go Live** from the browser: pick the WarDogs window (+audio), streams as `<user>/HelmetCam-<date>`; no OBS needed | Live portal → Go Live | Discord; key fetched for the logged-in user — **verified end to end** (publish → `.live` → sweep → title folder) |
 | Devs | Host code, review, CI | Gitea `https://git.…/`, ssh 2222 | **local account** (Discord later) |
 | Bot dev | Push code, restart container, read logs; web UI at `https://bot.…/` | Gitea + compose; `bot/AGENT.md` | web UI behind Discord (Authentik), once its provider exists |
 | Admin | Add/remove streamers & editors, hostnames, bot token | `./configure.py` | ssh |
@@ -59,13 +59,14 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea
 | act_runner | CI jobs in Docker | **not registered** |
 | discord-bot | Python runtime, idles until `bot/app/main.py` exists | live, no code yet |
 | `bot.` host | bot web UI behind Authentik forward-auth; Caddy requires group `bot-users` (from a Discord role) | Caddy block live; **`bot` CNAME still points at the wrong IP; roles→groups policy pending** |
-| Live portal (`live/`, `live.` host) | React + dockview multi-stream viewer + browser Go Live (WHIP); MediaMTX HLS/WebRTC/API on loopback; dumpd `/me/stream-key` | page live behind Authentik (domain-level); **MediaMTX recreate with new ports pending** |
+| Live portal (`live/`, `live.` host) | React + dockview multi-stream viewer + browser Go Live (WHIP); MediaMTX HLS/WebRTC/API on loopback; dumpd `/me/stream-key` | live; Go Live verified |
 
 ## Unfinished, in rough priority
 
-1. **Recreate MediaMTX** with the corrected compose (loopback HLS/WebRTC/API ports) → portal list + Go Live work.
-1b. **`bot` CNAME** → `ovh1`; Authentik `discord-roles-to-groups` policy + `bot-users` group.
-1c. Confirm plugin 0.1.2 installed and runner registered (were in the same deploy block).
+1. **MediaMTX container recreate** for `TZ=America/New_York` (filenames were UTC-stamped) and `moq: no` — `docker compose up -d --force-recreate mediamtx` after the compose upload.
+1b. Authentik `discord-roles-to-groups` policy + `bot-users` group (`bot` CNAME now correct).
+1c. Confirm plugin 0.1.2 installed and runner registered.
+1d. Watch a real stream from a second browser: corner chip should say `webrtc`; confirm WarDogs audio came through.
 2. **Register the runner** (`./registerGiteaRunner.sh`).
 3. **`bot` CNAME + Authentik proxy provider** — first use of forward-auth; proves the pattern for copyparty.
 4. **copyparty behind Authentik** (group permissions, WebDAV via app passwords, then drop local accounts). The one change that can lock editors out; keep a local admin until a Discord editor has used the new path.
@@ -82,6 +83,8 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea
 ## Verified behaviours worth remembering
 - **Never scp generated configs** (`mediamtx.yml`, `copyparty.conf`, `Caddyfile`, `dump-users.txt`, `.env`): a template copy wiped all streamers once. They are gitignored now; `*.example.*` are reference only.
 - Caddy runs in a container: anything it serves from disk must be a mount (`/srv/live` was missing → 404).
+- The sweep's VFR check used a gawk-only function; Debian's mawk made it pass everything silently. Portable now.
+- A deploy block that is only half-run leaves old binaries in `/usr/local/bin`; `grep -c` the installed script before blaming logic.
 - MediaMTX stamps recording filenames in its container clock: without `TZ` it is UTC and the plugin reads names as Eastern (4 h off). `TZ=America/New_York` is set on the container.
 - MediaMTX 1.21 refuses to start without `webrtcAdditionalHosts` or `webrtcIPsFromInterfaces`; configure.py writes the public host in.
 - Jellyfin honours provider-supplied season numbers on a Shows library (day seasons appeared). Next check: Monday 04:10 ET should fold them into a week season.

live/README.md

@@ -22,6 +22,6 @@ Toolbar → **Go Live**: closes all viewer windows, fetches the logged-in user's
 `/me/stream-key` (dumpd, identity from Authentik's header), opens Chrome's window picker (windows only,
 audio requested), and publishes over WebRTC/WHIP to `<user>/HelmetCam-<date>` at ≤12 Mbps, H.264, up to
 1440p60. Recording, the "is live" post, the sweep and Jellyfin follow exactly as for an OBS stream.
-Window audio: Chrome on Windows. Linux/Mac: pick a tab or the whole screen for sound.
+Window audio: Chrome/Edge 141+ (`windowAudio: "window"`); older browsers share the window without sound.
 Requires the Authentik username to equal the MediaMTX streamer name (configure.py keeps them in sync via
 `/etc/vanguard/streamers.json`).

live/src/GoLive.jsx

@@ -66,8 +66,8 @@ export default function GoLive({ onExit }) {
             <input value={title} onChange={e => setTitle(e.target.value)} disabled={phase === 'capturing'} />
             <div className="hint">
               Click <b>Start</b>, then pick the <b>WarDogs</b> window in Chrome's dialog and tick <b>Share audio</b>.
-              Window audio works in Chrome on Windows; on Linux/Mac pick a tab or the whole screen for sound.
-              Capped at {MAX_KBPS / 1000} Mbps, up to 1440p60, H.264.
+              Window audio needs <b>Chrome or Edge 141 or newer</b> (chrome://version). Older browsers capture the window
+              without sound. Capped at {MAX_KBPS / 1000} Mbps, up to 1440p60, H.264.
             </div>
             {err && <div className="err">{err}</div>}
             <button className="primary" disabled={!key || phase === 'capturing'} onClick={start}>{phase === 'capturing' ? 'Waiting for the window picker…' : 'Start'}</button>

live/src/broadcast.js

@@ -10,14 +10,15 @@ export function defaultTitle(now = new Date()) {
 export const cleanTitle = t => t.trim().replace(/\s+/g, '-').replace(/[^A-Za-z0-9_.-]/g, '')
 
 export async function captureWindow() {
-  // Window-only picker with audio. Chrome on Windows captures that window's audio; elsewhere the user
-  // should pick a tab or the whole screen to get sound.
+  // Window-only picker with that window's own audio. Chrome/Edge 141+ honour windowAudio: "window"
+  // (only the shared window's sound); older Chrome offers no audio for a window at all.
   const constraints = {
     video: { displaySurface: 'window', frameRate: { ideal: 60, max: 60 }, width: { max: 2560 }, height: { max: 1440 } },
     audio: { echoCancellation: false, noiseSuppression: false, autoGainControl: false, sampleRate: 48000, channelCount: 2 },
-    systemAudio: 'include',
+    windowAudio: 'window',            // capture the picked window's audio (Chrome 141+)
+    systemAudio: 'exclude',
     selfBrowserSurface: 'exclude',
-    monitorTypeSurfaces: 'exclude',   // hide "Entire screen" so people pick the game window
+    monitorTypeSurfaces: 'exclude',   // hide "Entire screen": this is a single-window helmet cam
     surfaceSwitching: 'include',
     preferCurrentTab: false,
   }