Changelog

LuminalShine 26.05.0 Update Release Candidate 2

[!CAUTION]
LuminalShine now requires the Windows Credential Store and the Trusted Platform Module (TPM 2.0).

[!IMPORTANT]
This Release Candidate is being considered for the first Stable Release. Please report any issues you encounter so we can determine if this Release Candidate will be the first Stable Release.

General

• Argon2id KDF for admin credentials, replacing single-round SHA-256. Parameters: m=64 MiB, t=3, p=1, tuned for ~100 ms login latency. Versioned record format with transparent SHA-256 → Argon2id upgrade on the next successful login (5b3fa207).
• cred_store abstraction decouples credential storage from the file backend, enabling per-platform storage drivers (a7953f5a).
• Windows Credential Manager backend stores the credential blob in the per-machine vault (DPAPI-sealed under the SYSTEM master key, TPM-bound by default on Windows 11). One-shot migration from the legacy sunshine_credentials.json file, plus a "Reset Admin Credentials" card in Troubleshooting (2f61739b).
• Linux libsecret + macOS Keychain backends with silent file-backend fallback on Linux when the Secret Service is unreachable (eec5d7b9).
• TPM-bound credential sealing on Windows via the Microsoft Platform Crypto Provider — non-exportable RSA-2048 key wraps the AES-256-GCM credential key. Default ON; opt-out toggle in Settings → Files. An attacker who acquires the raw WCM bytes cannot decrypt them without the original TPM device (dc661c80).
• MSI uninstall clears the WCM entry + TPM key by default (KEEPADMINCREDENTIALS=1 opts out). New crypto::secure_wipe helper wipes intermediate plaintext credential buffers at every load/save/verify call site. Pairings live in sunshine_state.json and are preserved across every credential reset (f29b3564).
• Playnite auto-sync default flipped from ON to OFF — fresh installs no longer auto-publish a Playnite library without an explicit opt-in.
• Steam Library Integration: VDF parser + Steam path discovery + multi-file app loader. The Moonlight app list now merges apps.json + steam_apps.json + nonsg_apps.json in canonical display order: Desktop → Steam → user-added apps.json entries → Steam Games → Non-Steam Games (cddb4813).
• Steam library auto-sync scans every installed Steam game via appmanifest_*.acf across all Steam library folders, writes steam_apps.json, surfaces games in Moonlight under a dedicated "Steam Games" section. 30-second background polling means new installs appear automatically. Launch via steam://rungameid/<appid>. New "Steam Library" Settings tab placed above Playnite with master toggle, family-share inclusion sub-toggle, and a "Clear Steam Library Cache" Troubleshooting card. Default OFF (3942c19b).
• Non-Steam shortcuts auto-sync scans every Steam user's shortcuts.vdf (binary VDF parsing), surfaces "Add a Non-Steam Game" entries under a "Non-Steam Games" section. Independent toggle in the same Settings tab. Default OFF (ff87cfa1).
• AMD AMF capability probe + /api/health/amd-encoder endpoint. Native probe of amfrt64.dll reports per-codec hardware encoder instance counts so the UI can offer codec-specific options only when the active GPU actually supports them (654b6975).
• amd_split_encode config option exposed in the Settings UI with Auto / Enabled / Disabled modes — surfaces only when an AMD adapter is active (f4d963b6).
• AMD dual-VCN split frame encoding wired into the AV1 and HEVC AMF paths so RDNA 3 7900-series and RDNA 4 9070-series cards encode each frame on both hardware encoder instances in parallel; single-VCN parts silently fall back to single-tile (6b25f4bb).
• amd_split_encode default flipped to Auto so users on dual-VCN cards get the latency win without having to opt in (a1d396b7).
• DLSS / DLSS Frame Generation / DLAA detection at session start with a soft, one-shot informational tip when 4K HDR + NVENC + AI render modules are detected in the foreground game. Tone is helpful, not a warning (6239a62b).
• Log extraction enhancements for the Troubleshooting page — richer filtering and surfacing for diagnostic logs (d5c28cc5).
• PowerShell 5.1 minimum / PowerShell 7 recommended is now documented in the System Requirements table, with a link to Microsoft's official PowerShell 7 GitHub repo (2ff05a09).
• Release artifact naming standardised to LuminalShine_x64-*: LuminalShine_x64-installer.exe, LuminalShine_x64-portable.zip, LuminalShine_x64-debuginfo.7z. The raw MSI is built every run but stays in the CI artifact bundle rather than being attached to the public release page (15d11f53, 9ca08ccb).

Windows 11 General Availability

• SudoVDA recovery ladder (Phase 3 of the TDR remediation plan) — new in-place two-level recovery for SudoVDA when a GPU TDR wedges the display stack. Level 1 recycles the SudoVDA user handle (closeVDisplayDevice → initVDisplayDriver); Level 2 does a PnP disable + enable on the SudoVDA root device (root\sudomaker\sudovda), equivalent to the Device Manager right-click. Scoped to the SudoVDA HWID only; MTT VDD and other devices are never touched. New "Restart Virtual Display Driver" escape hatch added to the Troubleshooting page so users can fire Level 1 + Level 2 manually without waiting for the auto-recovery branch (84550135).

Windows 11 Insider Preview

• WDDM reset recovery (Phase 4 of the TDR remediation plan) — new Level 3 recovery via Ctrl+Win+Shift+B for when SudoVDA Level 1 + Level 2 cannot bring the display stack back, usually because the WDDM context itself is stuck mid-TDR-recovery rather than anything wrong with SudoVDA. SYSTEM-context callers cannot SendInput into the interactive session, so the keystroke is routed through display_settings_helper, which already runs in the user session. New IPC frame type WddmReset = 9, 15-minute per-process cooldown to prevent runaway escalation, sleeps 3 seconds for Windows to settle, then recycles the SudoVDA handle so the next AddVirtualDisplay opens a fresh kernel binding against the recovered display port. The auto-recovery ladder escalates Level 1 → 2 → 3; the manual "Restart Virtual Display Driver" button still tops out at Level 2 so the user's desktop never gets blanked without a less-disruptive remedy having been tried first (1eff52a3).
• Pre-flight D3D11 health check at session start (Phase 5 of the TDR remediation plan) — detects a stuck WDDM context before the first frame is captured and triggers the recovery ladder proactively instead of failing into a black stream (1eff52a3).

Hotfixes

• MSI installer: SudoVDA driver installation no longer silently fails on PowerShell 5.1-only hosts. The POWERSHELL_PATH MSI property defaulted to a literal [SystemFolder]\WindowsPowerShell\v1.0\powershell.exe placeholder that MSI's one-level property formatter never recursively expanded, causing every PS-launching deferred custom action — including the SudoVDA install.ps1 post-step and installer-migrations.ps1 — to spawn a path that didn't exist (0x80070002 ERROR_FILE_NOT_FOUND). Now resolved via two ordered SetProperty Type-51 immediate CAs that anchor PS 5.1 first, then override to PS 7 when detected. Affected installs can recover by running an MSI Repair after upgrading (87c262b1).
• Settings UI: log extraction grep / awk commands fixed for improved Troubleshooting log parsing on locales that previously produced truncated output (a1386cf6).
• Build: forward-declare check_content_type so the Windows test build compiles cleanly when the function is used before its definition in confighttp.cpp (f96b7e37).
• Build: sunshine_t aggregate initialiser converted to C++20 designated initialisers and OSSL_KDF_NAME_ARGON2ID replaced with its canonical string literal so the credential-hardening series compiles under the MSYS2 UCRT64 / clang 16.1 / gnu++23 toolchain used by the coverage CI (c4be3a43).
• Build: #include <cstdint> added to the src/steam/ TUs so the Steam Library Integration compiles on libstdc++ 16 (which does not transitively include <cstdint> via <algorithm> / <optional>). Non-WebRTC test-build -Wunused-* warnings silenced via [[maybe_unused]] (141fa1b7).

Automated release for 26.05.0-rc2.

Full Changelog: https://github.com/NortheBridge/luminalshine/compare/26.05.0-rc1…26.05.0-rc2

Original GitHub release

LuminalShine 26.05.0 Update Release Candidate 3 Hotfix 4

[!IMPORTANT]
LuminalShine 26.05.0 RC3 is a substantial release to prepare for Authenticode. Please be aware that there are changes such as installing to %ProgramFiles%\NortheBridge\LuminalShine and %ProgramData%\LuminalShine\.

[!CAUTION]
Changes in this release may break LuminalShine if it doesn't migrate properly. Re-run the installer if this happens in order to resolve the issue. If your issue isn't resolved, submit an issue for further guidance.

[!TIP]
LuminalShine Credentials, which are stored in the Windows Credential Manager via use of the TPM 2.0, seamlessly transition to the Authenticode version of LuminalShine. If you encounter a lockout from the Admin Interface, run "C:\Program Files\NortheBridge\LuminalShine" --reset-admin-credentials to reset the Admin Credentials to "First Run" state. You will not lose any device pairings or settings.

General

• The platform layer now exposes a dedicated log_dir() accessor parallel to appdata(). Today it forwards to the existing data directory on Linux and macOS, and resolves to a separate logs subtree on Windows. Cross-platform callers route through a single API so any future log-location change on other platforms is a one-line implementation flip.

Windows 11 General Availability

• Install location moved to C:\Program Files\NortheBridge\LuminalShine\. Previous installs at C:\Program Files\Sunshine\ are migrated transparently by MSI MajorUpgrade — service registration, firewall rules, Start Menu shortcuts, the Reconfigure shortcut, and the registry DisplayIcon all retarget without manual intervention. The NortheBridge\ parent directory is removed on uninstall if no other NortheBridge product owns it.
• Upgrade dialog now defaults to the new install path. A previously installed copy at C:\Program Files\Sunshine\ (or any other path containing \Sunshine\) is automatically relocated to C:\Program Files\NortheBridge\LuminalShine\ on upgrade. Both the interactive BrowseDlg suggestion and silent msiexec /quiet installs honor the new path, so the new binaries land at the new location without manual intervention. Custom install paths that do not contain \Sunshine\ are preserved as user choices.
• Pinned taskbar, desktop, and user-Start-Menu shortcuts are repointed during upgrade. A new Repoint-LegacyShortcuts step in the installer walks every user profile on the machine and rewrites any .lnk whose target path or filename referenced the prior install. Rewrites are best-effort and never block the upgrade.
• Logs split into %ProgramData%\LuminalShine\logs\ (sibling of the existing config\ directory). Existing *.log and rollover *.log.N / *.bak files migrate in place on first launch after upgrade. The in-app log viewer, log-export endpoint, and helper-log enumeration all follow the new root automatically.
• Executables renamed for brand consistency and to namespace generic tool names out of collisions with anything else on a user's PATH:
• sunshine.exe → luminalshine.exe
• sunshinesvc.exe → luminalshinesvc.exe
• sunshine_display_helper.exe → luminalshine_display_helper.exe
• sunshine_wgc_capture.exe → luminalshine_wgc_capture.exe
• dxgi-info.exe → luminalshine-dxgi-info.exe
• audio-info.exe → luminalshine-audio-info.exe
• playnite-launcher.exe → luminalshine-playnite-launcher.exe
• Windows service renamed from SunshineService to LuminalShineService. Autostart, service account, and ServiceInstall metadata are preserved across the rename; the prior sunshinesvc and SunshineService registrations are cleaned up automatically during upgrade.
• TPM-sealed admin credentials and paired-client list are unaffected by the rename. The Windows Credential Manager entry (LuminalShine/AdminCredentials) and the TPM-bound key (LuminalShineAdminCredentialsKey) were already brand-neutral; the ResetAdminCredentials action remains gated on NOT UPGRADINGPRODUCTCODE so the MajorUpgrade sequence never wipes the vault.
• New Start Menu shortcut: "Reset LuminalShine Admin Password". If the saved Web UI admin login ever ends up in an unauthenticable state, you can recover with one click: launch the shortcut, confirm the prompt, and your next visit to https://localhost:47990 will show a fresh first-time setup screen. Paired Moonlight clients, the apps list, and all other settings are preserved — only the admin login is reset.
• Service self-heal on unreadable admin credential. If the stored admin credential is ever found in a broken state (empty WCM blob, unparseable JSON, missing required fields), the service now logs a warning, erases the bad entry, and presents first-time setup on next browser visit instead of presenting an un-authenticable login form. TPM unseal failures are not auto-erased — those can be transient, and the new Reset Admin Password shortcut handles that case explicitly.
• Named system objects renamed so a LuminalShine install coexists cleanly on a host that also has an upstream Sunshine-family product running:
• Single-instance mutexes → Global\LuminalShineDisplayHelper / Local\LuminalShineDisplayHelper
• Display-helper IPC pipe → luminalshine_display_helper
• Display-event window class → LuminalShineDisplayEventWindow
• NVAPI per-app profile → LuminalShineStream (keyed on luminalshine.exe)
• Scheduled task author / trigger ID → LuminalShine Display Helper / LuminalShineDisplayHelperLogonTrigger
• Display-helper IPC pipe name is now a single shared constant in display_settings_client.h, eliminating the prior risk of client and server drifting apart when the literal was spelled independently on each side.
• Crash-dump bundle generation recognises both the new luminalshine_* filenames and the legacy sunshine_* filenames, so a bundle assembled immediately after upgrade still includes any pre-migration .dmp files that Windows hasn't aged out yet. The diagnostic log-collection helper now probes both the new NortheBridge\LuminalShine\config\logs\ install location and the legacy Sunshine\config\logs\ for older logs you may want to attach to a bug report.
• Log export and helper-log lookup walk both the new LuminalShine\ and legacy Sunshine\ per-user appdata subdirectories. Logs from helpers that ran before the rename remain discoverable.
• Display-helper process cleanup matches both new and legacy helper executable names. A stale pre-upgrade helper is terminated reliably before the new helper takes its single-instance mutex.
• Service launch path hardened. luminalshinesvc.exe now resolves the main host binary via an absolute path derived from its own module location, instead of relying on the SCM's current-working-directory inheritance. This removes an occasional silent launch failure observed on hosts where the service's effective CWD was not the install root.
• MSI process-kill list now covers both new and legacy executable names. Upgrades from a prior install and reinstalls on a host already running the new binaries both kill the right processes before file replacement, so neither path leaves files mapped through reboot.
• NVIDIA per-app driver profile is created/updated automatically on first launch as LuminalShineStream keyed on luminalshine.exe, carrying the same GPU power-mode behaviour as before. A pre-existing SunshineStream profile from a prior install becomes a cosmetic entry in NVIDIA Control Panel that no longer matches any running process and can be removed manually if desired.

Windows 11 Insider Preview

• No Insider-specific changes in this release. The general-availability migration applies identically on Insider Preview hosts, and the upgrade-time process-kill / display-helper-cleanup hardening above incidentally addresses several edge cases that surfaced most often on Insider builds.

Hotfixes

• MSI upgrade dialog defaulted to the legacy C:\Program Files\Sunshine\ path instead of the new NortheBridge\LuminalShine\ location. Root cause: WIXUI_INSTALLDIR makes Windows Installer persist the prior install's ARPINSTALLLOCATION across upgrades and AppSearch re-seeds INSTALL_ROOT from it, overriding CMake's new Directory-table default. Without an explicit override, both interactive BrowseDlg and silent msiexec /quiet upgrades would have laid the new binaries down at the legacy path — new brand, legacy location. Fixed with a Type-51 SetProperty that fires after AppSearch and only when INSTALL_ROOT still contains \Sunshine\, so fresh installs and post-26.05.1 upgrades remain no-ops.
• Bootstrapper UI default install path also showed the legacy C:\Program Files\Sunshine\ even on fresh installs. The bootstrapper resolved its default from a hardcoded \Sunshine constant that was missed in the rename, and pre-existing installs registered at the legacy path bled through into the BrowseDlg textbox. Now reflects the canonical NortheBridge\LuminalShine path; legacy-path detection mirrors the MSI SetProperty so the UI and the actual install behaviour converge.
• Web UI returned 404s on every asset; the encoder failed to start. The service binary, when launched by the Service Control Manager, inherited C:\Windows\System32 as its working directory. Relative asset paths (assets/web/index.html, assets/shaders/directx/*.hlsl, assets/desktop.png, etc.) resolved against System32 and were not found, producing a broken login form and a Platform-init failure with HRESULT 0x80070003. The main host now anchors its working directory to the executable's install root at startup before any relative-path lookup runs.
• Bootstrapper "Browse" button silently did nothing on hosts where the modern Windows shell folder picker (IFileOpenDialog) failed to instantiate — most commonly observed under certain RDP configurations and on hosts with non-standard COM registration. The button now falls back to the classic FolderBrowserDialog if the modern picker errors out, and surfaces a diagnostic dialog if both pickers fail rather than appearing dead.
• The --reset-admin-credentials CLI subcommand worked, but every shipped invocation of it didn't. The argument dispatcher only recognises subcommands prefixed with --, but the WiX uninstall action's ResetAdminCredentials custom action and the bundled documentation both invoked it as a bare reset-admin-credentials. As a result the manual-uninstall credential-clear path was a silent no-op in every release through 26.05.0-rc3.hfx3. Both invocations now route correctly through the dispatcher; the new Start Menu "Reset LuminalShine Admin Password" shortcut provides a discoverable in-product alternative to ever needing the CLI.

Automated release for 26.05.0-rc3.hfx4.

Contributors

• @NorthernLights

Full Changelog: https://github.com/NortheBridge/luminalshine/compare/26.05.0-rc2…26.05.0-rc3.hfx4

Original GitHub release

LuminalShine 26.05.0 Release Candidate 4 (RC4)

[!CAUTION]
This release ships CVE-2026-32253 / GHSA-ph75-mgxh-mv57 (Critical, CVSS 9.8) — an upstream cert-chain authentication bypass that allowed network-reachable attackers to impersonate paired Moonlight clients and reach /launch with input injection on a SYSTEM-level service. All LuminalShine hosts should upgrade immediately. See the Security section below for details. We have posted seperate Security Advisory as GHSA-8gq2-8vfv-fqx7

[!CAUTION]
This release ships GHSA-52q6-5x97-2747 (Moderate, CVSS 6.3) — The protection is incidental, not enforced. There is no <util:PermissionEx> in packaging/windows/wix/custom_actions.wxs, no SetNamedSecurityInfo call anywhere, and the code in src/config.cpp / src/file_handler.cpp creates the file with no security descriptor. Off-default conditions break it: OEM gold images with loosened ProgramData DACLs, plugins running as non-SYSTEM that pre-create the directory, manual user copies into ProgramData, etc. If write access ever exists, src/process.cpp reads cmd/elevated:truewith no integrity check and src/platform/windows/misc.cpp launches via CreateProcessAsUserW with the linked admin token → non-admin → Administrator EoP. All LuminalShine hosts should upgrade immediately. See the Security section below for details.

[!NOTE]
Existing installs migrate transparently. sunshine_credentials.json is renamed in place to luminalshine_credentials.json on first launch after upgrade, with the original archived as sunshine_credentials.json.deprecated-<UTC> for forensic recovery. Paired Moonlight clients, the Windows Credential Manager admin entry, and the apps list are unaffected.

General

• New: Session Details panel + Session History card. The Dashboard now records every streaming session you run. A new LuminalShineSessionMonitor Windows service captures per-session metadata (client, codec, resolution, FPS, bitrate, HDR / YUV4:4:4 flags) along with 1Hz host CPU + RAM samples, persists them under %ProgramData%\LuminalShine\sessions\, and serves them back to the Web UI. The Session History card on the Dashboard lists every recorded session (active sessions float to the top with a LIVE pulse; ended sessions follow in reverse chronological order). Clicking a row opens a right-edge slide-out drawer with live uPlot charts grouped under three tabs — Stream / Connection / Host — plus Disconnect, Export JSON, and Delete actions. The monitor service is independent from the streaming hot path: it runs in its own process with SYSTEM-only named-pipe ingest, a kernel-assigned ephemeral localhost port, and a fire-and-forget producer that can never block encoding or stream delivery.
• New: Per-session recording opt-out (Settings → Capture → session_monitor, default on). When off, the producer is muted but the sidecar service stays running, so toggling the setting back on resumes recording immediately.
• New: "Clear Session History" gesture on the Troubleshooting page. Wipes the on-disk archive while leaving the sidecar's in-memory ring buffer intact (so the Web UI repopulates from live state). The MSI uninstall now removes the session archive by default; opt-out via msiexec /x ... KEEPSESSIONDATA=1 for migration scenarios.
• TypeScript toolchain bump to TypeScript 6.0.3 and vue-tsc 3.3.1. No user-visible behavior change.
• README badges: release version, commits-since-release, GitHub downloads, code size, stars, license, and CI status are now surfaced at the top of the project README for repo navigation.

Windows 11 General Availability

• No GA-channel-specific items this release. GA hosts pick up everything in Security and Hotfixes below.

Windows 11 Insider Preview

• No Insider-Preview-specific items this release. Insider Preview Canary / Dev hosts pick up everything in Security and Hotfixes below.

Security

• CVE-2026-32253 / GHSA-ph75-mgxh-mv57 (Critical, CVSS 9.8) — fixed. Closes the upstream Sunshine cert-chain authentication bypass that let a network-reachable attacker present a self-signed leaf chained to a self-generated CA and be accepted as a paired Moonlight client. From there, the attacker could call /launch or /resume and stream — with input injection — under the SYSTEM service identity. Two layered changes ship:
• Removed the X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY fast-path in openssl_verify_cb, mirroring upstream Sunshine v2026.516.143833.
• Added a leaf-signature pin in the Moonlight HTTPS verify lambda: after the OpenSSL chain verifier accepts a peer, its leaf signature must also exactly match an entry in client_root.named_devices. Defense-in-depth — any future regression in the verify callback cannot grant access to an unpaired peer.
• Regression coverage added in tests/unit/test_cert_chain.cpp.
• ProgramData config-directory hardening. The files under %ProgramData%\LuminalShine\config\ (apps.json, sunshine.conf, the paired-clients store, the credentials file) include paths and command lines that the SYSTEM service trusts at CreateProcessAsUserW time. Default Windows ACL inheritance happens to keep Users non-writable on a vanilla install, but the protection was incidental rather than enforced. Layered defense now ships:
• PROTECTED DACL (SYSTEM and Administrators Full, Users Read+Execute) and a System mandatory integrity label are applied at every service start via SetNamedSecurityInfoW. Self-repairing — incorrect ACLs from OEM gold images, prior tooling, or BIOS-image deployments are corrected on the next service start.
• HMAC-SHA256 tamper detection on apps.json with a sidecar .sig file. The HMAC key is sealed via the TPM 2.0 (Microsoft Platform Crypto Provider KSP) when available, and falls back to DPAPI-LocalMachine otherwise. The active backend (tpm / dpapi-lm / unavailable) is logged once at startup. On HMAC mismatch the suspect file is renamed to <file>.tamper-<UTC> and the service seeds defaults rather than load attacker-supplied content.
• sunshine_credentials.json → luminalshine_credentials.json (flag-day rename) with one-shot in-place migration so existing installs never lose admin credentials. The original is archived as .deprecated-<UTC>.
• Per the threat-model review: no install-time TPM gate. DPAPI-LocalMachine fallback covers TPM-less hosts (BIOS-disabled TPM, vTPM-less VMs, Insider Preview registry-bypass installs) without weakening the security ceiling for the same-machine-tamper threat model.

Hotfixes

• No Hotfixes-specific items this release. Insider Preview Canary / Dev hosts pick up everything above.

Automated release for 26.05.0-rc4.

Full Changelog: https://github.com/NortheBridge/luminalshine/compare/26.05.0-rc3.hfx4…26.05.0-rc4

Original GitHub release