Kyber 0.29.0 adds an agent and heartbeat mechanism to report host availability, token exchange and renewal for authenticated connections, and a kyber:// URL scheme to launch the desktop client from a link. These features prepare Kyber for compatibility with a future management portal.

Native WebSocket support is now available in the desktop client. The WebSocket implementation has also been refactored around a multi-backend architecture, sharing the transport abstraction between browser and native implementations.

The macOS server is now fully packaged, simplifying distribution and installation. This will allow us to release a fully operational, signed package soon.

x264 now supports 4:4:4 encoding, including through the avconv backend, preserving fine colour detail in text and desktop content. The previous automatic 1920-pixel downscaling has also been removed, allowing software encoding at the source resolution.

The avconv pipeline gains a GStreamer capture wrapper, alongside hardware-device selection, frame-handling and encoding-latency improvements. Together, these changes enable more targeted optimisation for Raspberry Pi and other embedded platforms.

Changelog​

• kymedia: Bump opus to 1.6.1
• Integrate kywebsocket
• kyclient: Integrate WebSocket into kymux backend
• kycontroller: Integrate WebSocket into kymux backend
• kyavservice: drop x264 force-cfr=0 workaround
• libavconv-rs: fix filtergraph heartbeat marker lost when no hook is set
• kyavservice/x264: Enable 4:4:4 support
• kyavservice/x264: Drop 1920 downscale, keep pix fmt conversion only
• kycontroller/tray: Stop repeating the same tray status log
• kymedia: fix build for gcc 16
• kymedia: Configure libavconv's FFmpeg log level via log4ky
• libkypc: Improve Worker drop behavior
• kymux: Make protocols generic
• kyctl: Complete control-plane struct share between host and client
• kyclient: Use log4ky's user scope for the Windows log directory
• kyavservice/libavconv: Forward DXGI cursor over KyberInputServer pipe
• kymedia: Integrate various libavconv fixes
• kyavservice: Treat custom video encoder config as overrides
• kyavservice/x264: Enable 4:4:4 support on avconv backend
• kyavservice/avconv: Pick the hw encode device per encoder, not grab backend
• kyavservice/avconv: Fix yuv444 & reduce amf encode latency to match txproto
• kycontroller: Release AV subscriptions synchronously on session teardown
• kyclient,kycontroller: Misc metrics fixups
• kyavservice: Add GStreamer grab backend
• kyclient: Exit cleanly when the controller has no displays
• kycontroller/auth/oidc: Add optional audience validation to OIDC config
• vlc: Make the "Video buffer" feature work with videotoolbox
• kyclient: Fix ownership of display event arrays
• kyavservice/avconv: Fall back to a nominal frame rate on the encoder
• kyavservice/avconv: Map DRM PRIME frames to VAAPI/QSV, download for x264
• kyavservice/vaapi: Fix encode crash on discrete GPU (Intel Arc) via XCB capture
• kyctl/kyclient: Rename ConnectFailedReason variants for consistency
• kyclient,kycontroller: Move to rustls-platform-verifier 0.7
• txproto: Expose filtergraph hardware-device injection
• kyutil,kynput,kyclient: Take the host log level in the log callbacks
• kyutil,kyctl: Add the kyhub heartbeat agent
• kywebsocket,kyclient: Add tungstenite driver and non-wasm websocket support
• (web) Integrate kywebsocket
• (web) kymux: Make protocols generic
• (web) kyctl: Complete control-plane struct share between host and client
• (web) jsapi: Report AudioContext state changes to the JS listener
• (web) Fix pointer lock not engaging in cursor-hidden games
• (web) kyclient,kycontroller: Misc metrics fixups

Kyber 0.28.0 adds macOS server support and a new avconv backend for the audio/video service. Linux capture gains Wayland display geometry discovery, while DRM device initialisation failures are now logged once per device instead of on every poll. The encoder setting in kyber_config.toml is now optional and defaults to NVENC.

Building on the live metrics introduced in 0.27.0, the web client now allows metrics to be downloaded at any time and buffers JSON writes to avoid losing metrics at high reporting rates. Both clients improve metrics handling by moving it out of the main loop, replacing assertions with warnings, and stopping unused metrics tasks after disconnection.

The desktop client now blocks clicks outside the video area and uses the new Kyber brand mark for its application icon. The server tray only reports a connected state once a streaming session is established, and its menu now shows the server version. Startup logs report the correct revisions, and the client gains a --version option to log its revision, making troubleshooting easier.

Internally, the transport layer gains cancellation-safe send and receive operations, shared serialisation code, and preallocated buffers for merging datagram segments. The input C API reduces its use of unsafe code and improves handling of null pointers. Logging is also unified around log4ky in the SDK and client.

Changelog​

• desktop: Update client app icon to new Kyber brand mark
• kymedia: generate vulkan.pc pkg-config file
• kyctl: Improve mutex handling
• kycontroller: Show connected in tray only after stream session
• kyctl: Refactors and improvements for kyclient
• kymux: Make ProtocolSend and ProtocolRecv cancel-safe
• kymux: Implement AsyncRead/AsyncWrite and factorize serialization
• libkypc: Refactor internals and API
• kyutil: Expose new named pipe API
• kymux: preallocate datagram segment merge buffers
• kynput: Remove a lot of unsafe from C API
• kynput: Use upstream keycode crate
• kyctl: Use upstream keycode
• txproto: bump for wayland display geometry discovery
• txproto/dxgi_cursor: retry pipe connection instead of dying on first failure
• txproto/drm: log card init failures once per device instead of every poll
• kymedia/watermark: make it an optional feature
• kyavservice: Make grab_backend more consistent with other fields
• kycom: Add a Serializable trait
• kyclient: Use existing runtime in main loop if possible
• kyctl: Use git cli instead of gix in vergen
• kymux: Move forwarding functions from kycom to kymux-utils
• kyclient: Avoid to route metrics in main loop
• kyclient/metrics: Replace asserts with warnings
• kyclient/metrics: Stop unused tasks after disconnect
• kyber_config.toml: encoder is now optional (defaults to nvenc)
• kycontroller: Correctly log git version in startup logs
• kyclient: Log correct kyclient revision
• kyclient: Add --version to log revision
• kynput/capi: use cbindgen to prefix type names
• kynput/capi: Improve robustness vs NULL pointer
• kycontroller: Show version in tray menu
• kyclient/capi: use cbindgen to prefix type names
• kyclient/capi: rename metrics types to camel case
• Add macOS server support
• kyvlcplayer: Pass -vv to VLC when KYBER_VLC_VERBOSE is set
• kycontroller: Disable intra_refresh when GopStream is requested
• kysdk: Integrate log4ky
• kyclient: Replace log4rs with log4ky
• kyclient: Block clicks outside video area
• avservice: Add avconv backend
• (web) kyctl: Refactors and improvements for kyclient
• (web) kymux: Make ProtocolSend and ProtocolRecv cancel-safe
• (web) kymux: Implement AsyncRead/AsyncWrite and factorize serialization
• (web) kynput: Use upstream keycode crate
• (web) kyctl: Use upstream keycode crate
• (web) kyclient: Use existing runtime in main loop if possible
• (web) kyclient: Avoid to route metrics in main loop
• (web) kyclient/metrics: Replace asserts with warnings
• (web) kyclient/metrics: Stop unused tasks after disconnect
• (web) ui: Allow metrics to be downloaded at any time
• (web) metrics: Buffer JSON writes to avoid dropping metrics at high rates

Kyber 0.27.0 brings OpenID Connect (OIDC) authentication to the web client, extending the identity-provider integration introduced for the server and desktop client in 0.26.0. The web client also gains live metrics and an automatic reconnection toggle in the connection UI. On the desktop side, automatic reconnection can now be enabled with the --auto-reconnect command-line flag.

Server configuration is more flexible, with additional ways to set controller parameters and a KYBER_CONFIG environment variable to override the configuration file used by kyservice, kycontroller, kyavserver, and kynputserver. Building on the X11 clipboard support added in the previous release, this release enables clipboard handling on the server side.

Several fixes improve startup and shutdown behaviour. The Windows service fixes an intermittent issue where Windows rejected controller startup, and the desktop client now exits when it receives a stopped event regardless of the reason. Child processes managed by libkypc are now automatically terminated when their handles are dropped. The media dependency build also moves to Meson.

Changelog​

• kycontroller: Implement kydup
• kymedia: Contrib build is now based on meson
• libkypc: automatically kill child on drop
• kynput/x11: Enable clipboard on server side
• libkynput/windows: Revert pass custom vendor_id/product_id to ViGEm virtual gamepads"
• kycontroller: Add more ways to set configuration parameters
• kyclient: Add --auto-reconnect CLI flag
• kyclient: Exit on Stopped event regardless of reason
• kyservice: Fix a random issue where kycontroller start was rejected by Windows
• Support KYBER_CONFIG to override the config file for kyservice, kycontroller, kyavserver, kynputserver
• (web) Add OIDC support
• (web) Add live metrics support
• (web) Add auto-reconnect toggle to connection UI

Clipboard handling takes a significant step forward in this release. Linux X11 hosts now support clipboard sharing, and Windows adds full HTML clipboard support alongside the plain-text clipboard introduced earlier. This means rich content — styled text, links, and formatted data — can now be copied and pasted across machines on Windows just as it would locally.

On the authentication front, Kyber now supports OpenID Connect (OIDC), giving teams and self-hosters the ability to integrate with existing identity providers such as Keycloak, Auth0, or any standards-compliant SSO system. Both the server and the desktop client support the full OIDC flow. The RTP streaming backend, which had silently stopped working after IPv6 support was added in 0.25.0, is now fixed.

The media pipeline receives a major upgrade with FFmpeg 8.1, bringing improved codec support and performance. AMD (AMF) and Linux VAAPI encoder settings are now correctly applied, resolving encoding quality and configuration issues. On Windows, Intel's HEVC 4:2:2 and 4:4:4 encoder has been replaced with the Microsoft equivalent, which is more broadly supported. Two new Linux screen capture backends — XCB and wlroots — are now available, expanding compatibility with different desktop environments.

The server's Windows system tray is now more resilient: tray icon initialization failures no longer crash the server, and the tray recovers automatically if the Windows taskbar is restarted. The service also stops its restart loop when it detects an invalid configuration rather than cycling indefinitely. The connected-client count shown in the tray is now correctly updated when sessions time out. The server watchdog process, previously always active, is now optional and can be disabled if not needed. On the web client side, the UI ships updated branding.

Changelog​

• kynput/x11: Add clipboard support
• libkynput/win32: Add HTML clipboard support
• controller/ws: Use kycom to interact with kyavserver and kynput
• kycontroller/win32: Make tray init non-fatal with TaskbarCreated recovery
• kyservice/win32: Stop restart loop on invalid config
• kycontroller: Update tray client count on session timeout
• kycontroller: make watchdog optional
• kymedia: Bump to ffmpeg 8.1
• kymedia: Correctly configure amf and vaapi encode settings
• kymedia/vlc: Replace Intel HEVC 422/444 support by the Microsoft one
• kymedia: Add "xcb" and "wlroots" grab_backend
• kycontroller: Add OIDC support
• desktop: Add OIDC support
• kycontroller: Fix RTP backend. Was broken since IPv6 support
• kynput: Export scancode conversion helpers for all platforms
• (web) ui: integrate new branding
• (web) kyctl: Extract AV players into separate crates

Kyber 0.25.0 adds IPv6 support across both the desktop and web clients, making it possible to connect over IPv6 networks and dual-stack environments without any extra configuration. The server now handles connections over IPv6 with the same reliability as before.

Linux gains a DRM/KMS screen capture backend in this release, complementing the existing X11 and NvFBC options and enabling capture directly at the display driver level — useful for setups without a traditional desktop environment. The Windows server now displays a system tray icon, giving quick visual feedback on the server's state. On Windows, display unplug events during an active streaming session are now handled correctly by the capture and encoding server, preventing crashes or hangs when a monitor is disconnected at runtime.

The command-line tool now surfaces control-plane connection errors clearly instead of silently failing, making troubleshooting easier. A bug where the server's configured public port was incorrectly cached and served stale values to clients has been fixed, as has a deadlock that could cause the login endpoint to block indefinitely under load. The web client adds HTTP timeouts to all outgoing requests, preventing hangs in degraded network conditions. JWT key generation is now available directly from the command-line tool, streamlining certificate and token management. The server's incoming connection handling is also more robust against edge cases in the QUIC transport accept loop. On Windows, keyboard setting changes are now monitored at runtime so input behaviour stays correct if the user adjusts keyboard settings while a session is active.

Changelog​

• kycontroller: Redirect /webclient to /webclient/
• kynput/win32: Monitor keyboard setting changes
• kyclient: Use rustls-platform-verifier
• kycontroller/win32: Add tray icon
• linux: Implement DRM/KMS grab
• kyavservice/dxgi: Correctly handle display unplug at runtime
• kyctl: Expose control plan connection error
• kyclient: Add HTTP timeout to all requests
• kycontroller: Fix public_port incorrectly cached in shared Kymux infrastructure
• kyctl/jwt-gen: Add key generation support
• kycontroller: Improve robustness of kymux incoming connection accept
• kycontroller: Fix /login blocking forever on mutex contention
• Add IPv6 support
• (web) Add IPv6 support
• (web) kyclient: Add HTTP timeout to all requests

This release introduces basic password authentication, allowing server administrators to require a password before clients can connect. For deployments that do not need token-based authentication at all, the JWT backend can now be disabled entirely, simplifying the security model for simpler setups.

Cross-origin protections in the server have been tightened, reducing the attack surface for browser-based deployments. The Intel Quick Sync (QSV) encoder initialization bug that prevented QSV encoding from starting in some configurations is fixed. Log verbosity can now be controlled with the KYBER_VERBOSE environment variable without editing configuration files, which helps with debugging in production environments. The QUIC transport layer has been updated to wtransport 0.7.0, replacing the previously pinned pre-release build. The clipboard is now size-limited on the input handling side, preventing unexpectedly large clipboard payloads from being forwarded across the connection.

On the web client, the sidebar is now scrollable, fixing layouts where many options were cut off. A button to send Ctrl+Alt+Del directly to the host has been added to the sidebar — useful for Windows remote desktop scenarios. The web client also gains the same basic password authentication support as the desktop client.

Changelog​

• Rename kysdk components
• Correctly place shebang in build scripts
• kyclient: Update VLC. Kymux branch is now based on 4962271021
• kycontroller: Correctly log toml parsing errors
• kymux: Update wtransport to official 0.7.0
• kynput: Limit clipboard size
• kycontroller: Improve cross origin protections
• Add basic authentication password support
• Allow to disable jwt backend
• kyavserver: Fix QSV acquisition
• kyavserver: set log level based on KYBER_VERBOSE environment variable
• (web) sidebar is now scrollable
• (web) sidebar: Add a button to send Ctrl+Alt+Del to the host
• (web) Add basic authentication password support

This release removes the --non-free flag from the FFmpeg build configuration, improving compatibility with open-source build pipelines and distributions that require fully open licensing. The desktop client gains additional TLS certificate verification options, giving users more control over how server certificates are validated — useful for self-signed certificates, private CA setups, or stricter security policies. The web client received internal repository restructuring with no user-facing changes.

Changelog​

• avserver/ffmpeg: Remove ffmpeg --non-free flag
• desktop: Add more TLS certificate verification options
• (web) Integrate new repository tree

Version 0.22.0 is one of the most feature-packed releases to date, adding automatic reconnection, multi-client support, watermarking, new capture backends, and a range of reliability improvements across the board.

Automatic reconnection is now built into both the desktop and web clients. When a connection drops unexpectedly, the client will attempt to reconnect transparently without requiring manual intervention. The web client exposes this through new reconnecting, reconnected, and reconnection_failed events, allowing web-based integrations to react accordingly. Multi-client support arrives on the server side: multiple clients can now connect to the same streaming session simultaneously, laying the groundwork for collaborative and monitoring use cases.

Two new capture backends have been added for Linux. NvFBC support enables high-performance, low-latency capture directly from NVIDIA GPUs, bypassing the compositor entirely. A watermark feature is available on Windows and Linux X11 with NVENC, allowing a visible overlay to be stamped on the captured stream — useful for content attribution or identifying source machines in multi-host setups.

On Windows, the capture and encoding server now prevents the display from sleeping when a frame acquisition timeout occurs, keeping the host awake during active sessions. Display hotplug events are now detected and handled at runtime, so connecting or disconnecting a monitor no longer requires a server restart. The x264 software encoder is now available on Windows as a fallback when hardware encoding is not available or desired. QUIC and WebTransport connections can now be handled simultaneously on the same server, improving compatibility with different client types. TLS certificate hashes are now verified by the client for QUIC connections, and TLS certificate paths have also been made configurable in the server configuration file. On Windows, multiple server instances can now run on the same machine without conflicting, and child processes are automatically cleaned up if the parent exits unexpectedly. The keyboard is grabbed in fullscreen mode on both Windows and Linux, ensuring key events are not intercepted by the local OS. The web client fixes scroll behaviour in Safari, resolves a configuration UI loading issue in Safari, and adds a gamepad blocklist option for filtering unwanted input devices.

Changelog​

• windows/linux: Grab keyboard when fullscreen is enabled
• desktop: Add automatic reconnection support
• libkypc/windows: Implement automatic child process cleanup
• windows: Allow to run multiple controller instances on the same machine
• vlc: Fix build issues for Windows cross build and iOS/visionOS build
• controller: make TLS certificate paths configurable
• avserver/win32: Prevent display sleep on frame acquisition timeout
• controller: QUIC and Webtransport connections can now be handled simultaneously
• libclient: Verify TLS certificate hash for QUIC connections
• Implement watermark feature. For Windows and Linux X11 + nvenc only
• linux: Implement NvFBC grab
• controller: Add basic multi-client support
• avserver/win32: Allow to use x264
• avserver/win32: Detect display hotplug
• (web) libkynput: Fix scroll behaviour in Safari
• (web) jsapi: Add gamepad blocklist support
• (web) ui: Vertically center canvas
• (web) Add automatic reconnection support with new events: reconnecting, reconnected, reconnection_failed
• (web) html: fix config ui loading in safari

⚠️ This patch regenerates the bundled TLS test certificates, which had expired. Both the desktop and web clients are affected. Update both the server and client to restore TLS connectivity if you use Kyber's built-in test certificates.

Changelog​

• tls: Regenerate test certificate
• (web) tls: Regenerate test certificate

This patch fixes a bug in cookie key generation for the authentication system introduced in 0.21.0, where session cookies could be generated with an incorrect key, causing authentication failures on reconnect.

Changelog​

• controller/auth: Correctly generate cookie key generation