Breadway/bread-ecosystem
1
0
Fork 0
Code Issues 1 Pull requests 4 Projects Releases Packages Wiki Activity Actions

Compare commits

base: Breadway:main
Branches Tags
Breadway:main
Breadway:fix/branch-check-ci
Breadway:fix/per-monitor-colour-leaks
Breadway:fix/theme-load-coverage
Breadway:fix/gen-index-concurrent-publish
Breadway:v0.7.5
Breadway:v0.7.4
Breadway:v0.7.3
Breadway:v0.7.2
Breadway:v0.7.1
Breadway:beta-v0.4.0-beta.1
Breadway:v0.3.1
Breadway:v0.3.0
Breadway:v0.2.11
Breadway:v0.2.10
Breadway:v0.2.9
Breadway:v0.2.8
Breadway:v0.2.7
Breadway:v0.2.6
Breadway:v0.2.5
Breadway:v0.2.4
Breadway:v0.2.3
Breadway:v0.2.2
Breadway:v0.2.1
Breadway:v0.2.0
Breadway:v0.1.0
..
compare: Breadway:v0.2.10
Branches Tags
Breadway:fix/branch-check-ci
Breadway:fix/per-monitor-colour-leaks
Breadway:fix/theme-load-coverage
Breadway:fix/gen-index-concurrent-publish
Breadway:main
Breadway:v0.7.5
Breadway:v0.7.4
Breadway:v0.7.3
Breadway:v0.7.2
Breadway:v0.7.1
Breadway:beta-v0.4.0-beta.1
Breadway:v0.3.1
Breadway:v0.3.0
Breadway:v0.2.11
Breadway:v0.2.10
Breadway:v0.2.9
Breadway:v0.2.8
Breadway:v0.2.7
Breadway:v0.2.6
Breadway:v0.2.5
Breadway:v0.2.4
Breadway:v0.2.3
Breadway:v0.2.2
Breadway:v0.2.1
Breadway:v0.2.0
Breadway:v0.1.0

No commits in common. "main" and "v0.2.10" have entirely different histories.
main ... v0.2.10

114 changed files with 861 additions and 19991 deletions
Download patch file Download diff file Expand all files Collapse all files

99
.forgejo/workflows/dev-bakery.yml
View file

@ -1,99 +0,0 @@
name: dev bakery
# Publishes a dev-track build on every push to `main` (the trunk branch —
# there is no separate `dev` branch). See docs/release-channels.md for the
# release-track policy this is part of.
on:
push:
branches: ['main']
paths:
- 'bakery/**'
- 'bread-utils/**'
- 'Cargo.toml'
- 'Cargo.lock'
- '.forgejo/workflows/dev-bakery.yml'
jobs:
build:
runs-on: [self-hosted, hestia]
steps:
- name: checkout
run: |
set -euo pipefail
rm -rf src && mkdir src
git clone --branch main --depth 1 \
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
- name: build
run: cd src && cargo build --release --locked -p bakery
- name: test
run: cd src && cargo test --release --locked -p bakery
# Auto-bumps the patch version from Cargo.toml and appends a
# timestamp+sha dev suffix — no developer discipline required, and the
# result is visibly "ahead of" the last stable patch release while
# staying valid semver (comparable within the dev track by bakery's
# `is_newer`).
- name: compute dev version
run: |
set -euo pipefail
cd src
# Base the dev version off the latest published stable tag,
# not Cargo.toml — Cargo.toml can go stale relative to the last
# real release (seen in practice: breadbox/breadpad/breadcrumbs/
# breadpaper), which would make a dev build sort as OLDER than
# what's already installed and bakery would correctly refuse it.
LATEST_TAG="$(git ls-remote --tags --refs \
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
| awk -F/ '{print $NF}' | sed 's/^v//' | (grep -v -- '-' || true) | sort -V | tail -1)"
if [ -n "${LATEST_TAG}" ]; then
CUR="${LATEST_TAG}"
else
CUR="$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
fi
IFS='.' read -r MA MI PA <<< "${CUR}"
SHA="$(git rev-parse --short HEAD)"
TS="$(date -u +%Y%m%d%H%M%S)"
echo "VERSION=${MA}.${MI}.$((PA + 1))-dev.${TS}+${SHA}" >> "$GITHUB_ENV"
- name: prepare artifacts
run: |
set -euo pipefail
PKG_DIR="/srv/breadway-dl/dev/bakery/${VERSION}"
mkdir -p "${PKG_DIR}"
cp "src/target/release/bakery" "${PKG_DIR}/bakery-x86_64"
strip "${PKG_DIR}/bakery-x86_64"
sha256sum "${PKG_DIR}/bakery-x86_64" | awk '{print $1}' \
> "${PKG_DIR}/bakery-x86_64.sha256"
cp src/bakery.toml "${PKG_DIR}/bakery.toml"
ln -sfn "${VERSION}" "/srv/breadway-dl/dev/bakery/latest"
- name: sign dev binary
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
run: |
set -euo pipefail
PKG_DIR="/srv/breadway-dl/dev/bakery/${VERSION}"
if [ -n "${MINISIGN_SEC_KEY:-}" ]; then
minisign -W -S -s "${MINISIGN_SEC_KEY}" -m "${PKG_DIR}/bakery-x86_64" \
-x "${PKG_DIR}/bakery-x86_64.minisig" </dev/null
echo "signed bakery-x86_64"
else
echo "::warning::BAKERY_MINISIGN_SEC_KEY_PATH not set — shipping bakery-x86_64 UNSIGNED"
fi
# No GitHub Release upload step here, unlike release-bakery.yml — dev
# builds happen on every push and would spam a release per commit, so
# dl.breadway.dev/dev/ is the only distribution point for this track.
- name: regenerate dev index.json
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
TRACK: dev
run: |
set -euo pipefail
if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate dev index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the dev track)"
exit 1
fi
cd src && bash scripts/gen-index.sh

87
.forgejo/workflows/dev-bread-theme.yml
View file

@ -1,87 +0,0 @@
name: dev bread-theme
# Publishes a dev-track build on every push to `main` (the trunk branch —
# there is no separate `dev` branch). See docs/release-channels.md for the
# release-track policy this is part of.
on:
push:
branches: ['main']
paths:
- 'bread-theme/**'
- 'Cargo.toml'
- 'Cargo.lock'
- '.forgejo/workflows/dev-bread-theme.yml'
jobs:
build:
runs-on: [self-hosted, hestia]
steps:
- name: checkout
run: |
set -euo pipefail
rm -rf src && mkdir src
git clone --branch main --depth 1 \
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
- name: build
run: cd src && cargo build --release --locked -p bread-theme --bin bread-theme
- name: compute dev version
run: |
set -euo pipefail
cd src
# Base the dev version off the latest published stable tag,
# not Cargo.toml — Cargo.toml can go stale relative to the last
# real release (seen in practice: breadbox/breadpad/breadcrumbs/
# breadpaper), which would make a dev build sort as OLDER than
# what's already installed and bakery would correctly refuse it.
LATEST_TAG="$(git ls-remote --tags --refs \
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
| awk -F/ '{print $NF}' | sed 's/^v//' | (grep -v -- '-' || true) | sort -V | tail -1)"
if [ -n "${LATEST_TAG}" ]; then
CUR="${LATEST_TAG}"
else
CUR="$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
fi
IFS='.' read -r MA MI PA <<< "${CUR}"
SHA="$(git rev-parse --short HEAD)"
TS="$(date -u +%Y%m%d%H%M%S)"
echo "VERSION=${MA}.${MI}.$((PA + 1))-dev.${TS}+${SHA}" >> "$GITHUB_ENV"
- name: prepare artifacts
run: |
set -euo pipefail
PKG_DIR="/srv/breadway-dl/dev/bread-theme/${VERSION}"
mkdir -p "${PKG_DIR}"
cp "src/target/release/bread-theme" "${PKG_DIR}/bread-theme-x86_64"
strip "${PKG_DIR}/bread-theme-x86_64"
sha256sum "${PKG_DIR}/bread-theme-x86_64" | awk '{print $1}' \
> "${PKG_DIR}/bread-theme-x86_64.sha256"
cp src/bread-theme/bakery.toml "${PKG_DIR}/bakery.toml"
ln -sfn "${VERSION}" "/srv/breadway-dl/dev/bread-theme/latest"
- name: sign dev binary
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
run: |
set -euo pipefail
PKG_DIR="/srv/breadway-dl/dev/bread-theme/${VERSION}"
if [ -n "${MINISIGN_SEC_KEY:-}" ]; then
minisign -W -S -s "${MINISIGN_SEC_KEY}" -m "${PKG_DIR}/bread-theme-x86_64" \
-x "${PKG_DIR}/bread-theme-x86_64.minisig" </dev/null
echo "signed bread-theme-x86_64"
else
echo "::warning::BAKERY_MINISIGN_SEC_KEY_PATH not set — shipping bread-theme-x86_64 UNSIGNED"
fi
- name: regenerate dev index.json
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
TRACK: dev
run: |
set -euo pipefail
if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate dev index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the dev track)"
exit 1
fi
cd src && bash scripts/gen-index.sh

21
.forgejo/workflows/mirror.yml Normal file
View file

@ -0,0 +1,21 @@
name: Mirror to GitHub
on:
push:
branches: ['**']
tags: ['**']
jobs:
mirror:
runs-on: [self-hosted, hestia]
steps:
- name: Mirror to GitHub
run: |
set -euo pipefail
git clone --mirror "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" repo.git
cd repo.git
# Mirror only branches and tags (not refs/pull/*, which GitHub rejects);
# --prune deletes GitHub refs that no longer exist on Forgejo.
git push --prune \
"https://x-access-token:${{ secrets.MIRROR_TOKEN }}@github.com/Breadway/bread-ecosystem.git" \
'+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'

3
.forgejo/workflows/package.yml
View file

@ -6,9 +6,6 @@ on:
jobs:
package:
# PKGBUILD pkgver cannot contain `-`; skip RC tags the same way
# release-bakery.yml does.
if: ${{ !contains(github.ref_name, '-rc.') }}
runs-on: [self-hosted, hestia]
container:
image: archlinux:latest

73
.forgejo/workflows/rc-bakery.yml
View file

@ -1,73 +0,0 @@
name: beta (rc) bakery
# Publishes a beta-track build for any `vX.Y.Z-rc.N` prerelease tag pushed
# to `main` — there is no separate `beta` branch; "freezing" is just
# pausing pushes to main while an RC gets tested. See
# docs/release-channels.md for the release-track policy.
on:
push:
tags: ['v*']
# No paths: filter. Tag pushes compare against an unrelated commit and
# would skip the RC publish if bakery/** wasn't in that diff; the job
# `if: contains -rc.` is the real gate.
jobs:
build:
if: ${{ contains(github.ref_name, '-rc.') }}
runs-on: [self-hosted, hestia]
steps:
- name: checkout
run: |
set -euo pipefail
rm -rf src && mkdir src
git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
- name: build
run: cd src && cargo build --release --locked -p bakery
- name: test
run: cd src && cargo test --release --locked -p bakery
- name: prepare artifacts
run: |
set -euo pipefail
VERSION="${GITHUB_REF_NAME#v}"
echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
PKG_DIR="/srv/breadway-dl/beta/bakery/${VERSION}"
mkdir -p "${PKG_DIR}"
cp "src/target/release/bakery" "${PKG_DIR}/bakery-x86_64"
strip "${PKG_DIR}/bakery-x86_64"
sha256sum "${PKG_DIR}/bakery-x86_64" | awk '{print $1}' \
> "${PKG_DIR}/bakery-x86_64.sha256"
cp src/bakery.toml "${PKG_DIR}/bakery.toml"
ln -sfn "${VERSION}" "/srv/breadway-dl/beta/bakery/latest"
- name: sign beta binary
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
run: |
set -euo pipefail
PKG_DIR="/srv/breadway-dl/beta/bakery/${VERSION}"
if [ -n "${MINISIGN_SEC_KEY:-}" ]; then
minisign -W -S -s "${MINISIGN_SEC_KEY}" -m "${PKG_DIR}/bakery-x86_64" \
-x "${PKG_DIR}/bakery-x86_64.minisig" </dev/null
echo "signed bakery-x86_64"
else
echo "::warning::BAKERY_MINISIGN_SEC_KEY_PATH not set — shipping bakery-x86_64 UNSIGNED"
fi
# No GitHub Release upload step here, unlike release-bakery.yml — beta
# builds happen on every push while the branch is frozen for testing,
# so dl.breadway.dev/beta/ is the only distribution point for this track.
- name: regenerate beta index.json
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
TRACK: beta
run: |
set -euo pipefail
if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate beta index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the beta track)"
exit 1
fi
cd src && bash scripts/gen-index.sh

67
.forgejo/workflows/rc-bread-theme.yml
View file

@ -1,67 +0,0 @@
name: beta (rc) bread-theme
# Publishes a beta-track build for any `vX.Y.Z-rc.N` prerelease tag pushed
# to `main` — there is no separate `beta` branch; "freezing" is just
# pausing pushes to main while an RC gets tested. See
# docs/release-channels.md for the release-track policy.
on:
push:
tags: ['v*']
# No paths: filter. Tag pushes compare against an unrelated commit and
# would skip the RC publish if bread-theme/** wasn't in that diff; the
# job `if: contains -rc.` is the real gate.
jobs:
build:
if: ${{ contains(github.ref_name, '-rc.') }}
runs-on: [self-hosted, hestia]
steps:
- name: checkout
run: |
set -euo pipefail
rm -rf src && mkdir src
git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
- name: build
run: cd src && cargo build --release --locked -p bread-theme --bin bread-theme
- name: prepare artifacts
run: |
set -euo pipefail
VERSION="${GITHUB_REF_NAME#v}"
echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
PKG_DIR="/srv/breadway-dl/beta/bread-theme/${VERSION}"
mkdir -p "${PKG_DIR}"
cp "src/target/release/bread-theme" "${PKG_DIR}/bread-theme-x86_64"
strip "${PKG_DIR}/bread-theme-x86_64"
sha256sum "${PKG_DIR}/bread-theme-x86_64" | awk '{print $1}' \
> "${PKG_DIR}/bread-theme-x86_64.sha256"
cp src/bread-theme/bakery.toml "${PKG_DIR}/bakery.toml"
ln -sfn "${VERSION}" "/srv/breadway-dl/beta/bread-theme/latest"
- name: sign beta binary
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
run: |
set -euo pipefail
PKG_DIR="/srv/breadway-dl/beta/bread-theme/${VERSION}"
if [ -n "${MINISIGN_SEC_KEY:-}" ]; then
minisign -W -S -s "${MINISIGN_SEC_KEY}" -m "${PKG_DIR}/bread-theme-x86_64" \
-x "${PKG_DIR}/bread-theme-x86_64.minisig" </dev/null
echo "signed bread-theme-x86_64"
else
echo "::warning::BAKERY_MINISIGN_SEC_KEY_PATH not set — shipping bread-theme-x86_64 UNSIGNED"
fi
- name: regenerate beta index.json
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
TRACK: beta
run: |
set -euo pipefail
if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate beta index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the beta track)"
exit 1
fi
cd src && bash scripts/gen-index.sh

81
.forgejo/workflows/release-bakery.yml
View file

@ -1,81 +0,0 @@
name: release bakery
on:
push:
tags: ['v*']
jobs:
build:
if: ${{ !contains(github.ref_name, '-rc.') }}
runs-on: [self-hosted, hestia]
steps:
- name: checkout
run: |
set -euo pipefail
rm -rf src && mkdir src
git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
- name: build
run: cd src && cargo build --release --locked -p bakery
- name: test
run: cd src && cargo test --release --locked -p bakery
- name: prepare artifacts
run: |
set -euo pipefail
VERSION="${GITHUB_REF_NAME#v}"
PKG_DIR="/srv/breadway-dl/bakery/${VERSION}"
mkdir -p "${PKG_DIR}"
cp "src/target/release/bakery" "${PKG_DIR}/bakery-x86_64"
strip "${PKG_DIR}/bakery-x86_64"
sha256sum "${PKG_DIR}/bakery-x86_64" | awk '{print $1}' \
> "${PKG_DIR}/bakery-x86_64.sha256"
cp src/bakery.toml "${PKG_DIR}/bakery.toml"
ln -sfn "${VERSION}" "/srv/breadway-dl/bakery/latest"
# Signs the bakery binary itself with the shared bakery ecosystem signing
# key (same key that signs index.json and bread-theme — see
# release-bread-theme.yml). BAKERY_MINISIGN_SEC_KEY_PATH is a *path on
# this runner's disk* (hestia has persistent storage), not the key
# contents. Dormant (binary ships unsigned, as today) until that secret
# is provisioned.
- name: sign release binary
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
run: |
set -euo pipefail
VERSION="${GITHUB_REF_NAME#v}"
PKG_DIR="/srv/breadway-dl/bakery/${VERSION}"
if [ -n "${MINISIGN_SEC_KEY:-}" ]; then
minisign -W -S -s "${MINISIGN_SEC_KEY}" -m "${PKG_DIR}/bakery-x86_64" \
-x "${PKG_DIR}/bakery-x86_64.minisig" </dev/null
echo "signed bakery-x86_64"
else
echo "::warning::BAKERY_MINISIGN_SEC_KEY_PATH not set — shipping bakery-x86_64 UNSIGNED"
fi
- name: regenerate index.json
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
run: |
set -euo pipefail
if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate stable index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the stable track)"
exit 1
fi
cd src && bash scripts/gen-index.sh
- name: upload to GitHub Release
env:
GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
run: |
set -euo pipefail
VERSION="${GITHUB_REF_NAME#v}"
PKG_DIR="/srv/breadway-dl/bakery/${VERSION}"
gh release create "${GITHUB_REF_NAME}" --repo Breadway/bread-ecosystem \
--title "bakery ${GITHUB_REF_NAME}" --generate-notes 2>/dev/null || true
ASSETS="${PKG_DIR}/bakery-x86_64 ${PKG_DIR}/bakery-x86_64.sha256"
[ -f "${PKG_DIR}/bakery-x86_64.minisig" ] && ASSETS="${ASSETS} ${PKG_DIR}/bakery-x86_64.minisig"
gh release upload "${GITHUB_REF_NAME}" --repo Breadway/bread-ecosystem ${ASSETS} --clobber

79
.forgejo/workflows/release-bread-theme.yml
View file

@ -1,79 +0,0 @@
name: release bread-theme
on:
push:
tags: ['v*']
jobs:
build:
if: ${{ !contains(github.ref_name, '-rc.') }}
runs-on: [self-hosted, hestia]
steps:
- name: checkout
run: |
set -euo pipefail
rm -rf src && mkdir src
git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
"https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
- name: build
run: cd src && cargo build --release --locked -p bread-theme --bin bread-theme
- name: prepare artifacts
run: |
set -euo pipefail
VERSION="${GITHUB_REF_NAME#v}"
PKG_DIR="/srv/breadway-dl/bread-theme/${VERSION}"
mkdir -p "${PKG_DIR}"
cp "src/target/release/bread-theme" "${PKG_DIR}/bread-theme-x86_64"
strip "${PKG_DIR}/bread-theme-x86_64"
sha256sum "${PKG_DIR}/bread-theme-x86_64" | awk '{print $1}' \
> "${PKG_DIR}/bread-theme-x86_64.sha256"
cp src/bread-theme/bakery.toml "${PKG_DIR}/bakery.toml"
ln -sfn "${VERSION}" "/srv/breadway-dl/bread-theme/latest"
# Signs the bread-theme binary with the shared bakery ecosystem signing
# key (same key that signs index.json — get.sh / manifest.rs pin the
# matching public key). BAKERY_MINISIGN_SEC_KEY_PATH is a *path on this
# runner's disk* (hestia has persistent storage, unlike a fresh
# GitHub-hosted runner), not the key contents — see the handoff note
# in scripts/gen-index.sh. Dormant (binary ships unsigned, as today)
# until that secret is provisioned.
- name: sign release binary
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
run: |
set -euo pipefail
VERSION="${GITHUB_REF_NAME#v}"
PKG_DIR="/srv/breadway-dl/bread-theme/${VERSION}"
if [ -n "${MINISIGN_SEC_KEY:-}" ]; then
minisign -W -S -s "${MINISIGN_SEC_KEY}" -m "${PKG_DIR}/bread-theme-x86_64" \
-x "${PKG_DIR}/bread-theme-x86_64.minisig" </dev/null
echo "signed bread-theme-x86_64"
else
echo "::warning::BAKERY_MINISIGN_SEC_KEY_PATH not set — shipping bread-theme-x86_64 UNSIGNED"
fi
- name: regenerate index.json
env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
run: |
set -euo pipefail
if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate stable index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the stable track)"
exit 1
fi
cd src && bash scripts/gen-index.sh
- name: upload to GitHub Release
env:
GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
run: |
set -euo pipefail
VERSION="${GITHUB_REF_NAME#v}"
PKG_DIR="/srv/breadway-dl/bread-theme/${VERSION}"
gh release create "${GITHUB_REF_NAME}" --repo Breadway/bread-ecosystem \
--title "bread-ecosystem ${GITHUB_REF_NAME}" --generate-notes 2>/dev/null || true
ASSETS="${PKG_DIR}/bread-theme-x86_64 ${PKG_DIR}/bread-theme-x86_64.sha256"
[ -f "${PKG_DIR}/bread-theme-x86_64.minisig" ] && ASSETS="${ASSETS} ${PKG_DIR}/bread-theme-x86_64.minisig"
gh release upload "${GITHUB_REF_NAME}" --repo Breadway/bread-ecosystem ${ASSETS} --clobber

53
.github/workflows/release.yml vendored Normal file
View file

@ -0,0 +1,53 @@
name: release
on:
push:
tags: ["v*"]
permissions:
contents: write
env:
DL_DIR: /srv/breadway-dl
jobs:
build:
runs-on: [self-hosted, hestia]
steps:
- uses: actions/checkout@v4
- name: build
run: cargo build --release --locked -p bakery
- name: test
run: cargo test --locked --workspace
- name: prepare artifacts
run: |
VERSION="${GITHUB_REF_NAME#v}"
PKG_DIR="${DL_DIR}/bakery/${VERSION}"
mkdir -p "${PKG_DIR}"
cp target/release/bakery "${PKG_DIR}/bakery-x86_64"
strip "${PKG_DIR}/bakery-x86_64"
sha256sum "${PKG_DIR}/bakery-x86_64" | awk '{print $1}' \
> "${PKG_DIR}/bakery-x86_64.sha256"
cp bakery.toml "${PKG_DIR}/bakery.toml"
ln -sfn "${VERSION}" "${DL_DIR}/bakery/latest"
- name: regenerate index.json
run: bash "${GITHUB_WORKSPACE}/scripts/gen-index.sh"
- name: upload to GitHub Release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
VERSION="${GITHUB_REF_NAME#v}"
PKG_DIR="${DL_DIR}/bakery/${VERSION}"
gh release create "${GITHUB_REF_NAME}" \
--title "bakery v${VERSION}" --generate-notes 2>/dev/null || true
gh release upload "${GITHUB_REF_NAME}" \
"${PKG_DIR}/bakery-x86_64" \
"${PKG_DIR}/bakery-x86_64.sha256" \
--clobber

12
.gitignore vendored
View file

@ -1,13 +1 @@
/target/
# minisign secret keys must never be committed — the bakery/index signing
# key lives outside this repo entirely (see scripts/gen-index.sh /
# scripts/get.sh for how it's consumed via MINISIGN_SEC_KEY).
*.minisign-sec
minisign.key
# Local tool caches — not build output, never belongs in the repo.
# (breadbar already excludes graphify-out; this repo did not, and 111k lines
# of it were swept in by a `git add -A`.)
graphify-out/
.grok/

24
AGENTS.md
View file

@ -1,24 +0,0 @@
# AGENTS.md — Repo hygiene
Scope: this file covers *repo hygiene* — branching, remotes, CI, cleanup. It is not project documentation.
Follow [`CONTRIBUTING.md`](CONTRIBUTING.md) for any git, branch, or release work. Channel/track policy lives in [`docs/release-channels.md`](docs/release-channels.md). The product list is [`registry/bread-ecosystem.toml`](registry/bread-ecosystem.toml) — regenerate the README table with `scripts/gen-readme-products.sh` after editing it. Don't invent a second long-lived branch; there is only `main`. Bakery's package version **must** match `[workspace.package] version` in the root `Cargo.toml` at tag time (`bakery --version` is compiled from that field; `bakery list` reports the git tag) — never push a `v*` tag without bumping Cargo.toml to the same `X.Y.Z`.
## Remotes
- `origin` — Forgejo (`git.breadway.dev` via Hestia, SSH) — authoritative.
- `github` — GitHub mirror. Push both when publishing.
## CI
- `.forgejo/workflows/package.yml`, `release-bakery.yml`, `release-bread-theme.yml` all trigger on `push: tags: ['v*']`, gated to skip any tag containing `-rc.` — pushing to `main` doesn't run these. Tag a release to trigger packaging.
- `dev-bakery.yml` / `dev-bread-theme.yml` trigger on `push: branches: ['main']`; `rc-bakery.yml` / `rc-bread-theme.yml` trigger on `push: tags: ['v*']` gated to *only* run for `-rc.` tags — both auto-publish a signed, auto-versioned build to `dl.breadway.dev/{dev,beta}/`. See `docs/release-channels.md` for the full track (stable/beta/dev) policy.
- No build/lint/test CI runs on ordinary commits or PRs to `main` beyond the dev-track workflow above — there's no separate lint/PR-check pipeline.
## Cleanup
- Delete feature/fix branches (local + remote) once merged. Check with `git branch --merged main`.
- A `fix/audit-findings` branch and a merged `copilot/create-readme-md` branch (both local and on `origin`/`github`) were found stale and fully merged here on 2026-07-21 and removed.
## Don't
- Don't embed credentials in remote URLs — SSH or a credential helper only.
- Don't flip bakery's default install prefix. System prefix (`/usr/local` via
`/etc/bakery/config.toml` or `BAKERY_PREFIX`) is for BOS; hermes and
`get.sh` stay on `~/.local`. See [`bakery/README.md`](bakery/README.md).

28
BREAD_DESIGN_SYSTEM.md
View file

@ -48,27 +48,16 @@ Establish a visual hierarchy with consistent rounding:
## Color System
All projects use **pywal dynamic theming** for accents, layered on a **fixed BOS
dark base** — background, surface, overlay, and foreground never come from
pywal, only the accent slots (color1–6) track the current wallpaper:
All projects use **pywal dynamic theming** with **Catppuccin Mocha** as the fallback palette:
- **Background**: `#0c0c0c` (fixed)
- **Foreground**: `#e8e8e8` (fixed)
- **Surface**: `#1a1a1a` (fixed, `color0`)
- **Overlay**: `#d8d8d8` (fixed, `color7`)
- **Accent**: Dynamic (from pywal `color4`), with curated bread-toned defaults
before any wallpaper has been set
Without pinning bg/surface/overlay, a light or muddy-toned wallpaper makes
pywal hand back a light or off-hue background, and every bread GUI's panels
inherit it — see `bread-theme/src/palette.rs` for the implementation.
- **Background**: `#1e1e2e` (Catppuccin)
- **Foreground**: `#cdd6f4` (Catppuccin)
- **Surface**: `#181825` (Catppuccin)
- **Accent**: Dynamic (from pywal)
Color palette slots (via wal):
- color0–color7: ANSI colors (0 and 7 fixed, 1–6 pywal-derived)
- color0–color7: ANSI colors
- Semantic: red, green, yellow, blue, pink, teal
- Computed ink: `on-bg`, `on-surface`, `on-accent`, `on-red`, `on-overlay` —
black or white text, whichever is legible against that background (see
`bread_theme::ink_on`)
## Component Standards
@ -115,9 +104,8 @@ add only app-specific rules:
hardcoded Nord palette; migrated to the shared stylesheet).
- **breadcrumbs** — CLI tool; ANSI colours only, no GUI styling.
> Palette note: background/surface/overlay/foreground are a fixed BOS dark
> base, never pywal-derived; only the accent slots (color1–6) track the
> current wallpaper via pywal.
> Palette note: the fallback is Catppuccin Mocha, but installs (e.g. BOS) drive
> the real palette from pywal — BOS ships a black-base palette.
## Future Consistency Checks

120
CONTRIBUTING.md
View file

@ -1,120 +0,0 @@
# Contributing
This repo is a Cargo workspace. Bakery-channel products shipped from here
are `bakery` (the ecosystem package manager) and `bread-theme` (the shared
theming crate). Shared crates that sibling apps pin — not bakery packages
of their own — are `bread-utils`, `bread-app`, `bread-onnx`,
`bread-screenshots`, and `bread-capture`. `bread-polkit` is an in-tree
session agent: it has `bread-polkit/bakery.toml` so it *can* be published,
but it is not in `registry/bread-ecosystem.toml` (unpublished — not on
the bakery index, not on the BOS ISO). Other ecosystem products
(`bread`, `breadbar`, `breadbox`, …) live in their own repos under
`Breadway/` but follow the same workflow described here. The product list
is `registry/bread-ecosystem.toml`. New GTK tools should depend on
`bread-app` instead of copying another app's bootstrap.
## Branches
There is one long-lived branch: **`main`**. All day-to-day work lands here.
Every push to `main` automatically builds and publishes a **dev-track**
build for both products (see Tracks below) — use this to test your change
in a real install before cutting anything more formal.
New work — features and bug fixes alike — goes on a short-lived branch:
```
feature/<short-name>
fix/<issue-number-or-short-name>
```
Branch off `main`, open a PR/push back into `main` when ready. Short-lived
branches get deleted on merge — they never accumulate the kind of drift a
second long-lived branch does.
## The release cycle
There's no separate `beta` or release branch — "stable" and "beta" are both
just **tags** on `main`, not branches that need to be kept in sync:
1. Work accumulates on `main` via `feature/x` / `fix/x` branches. Each push
auto-publishes a dev build for both `bakery` and `bread-theme` — install
with `bakery track set dev` and `bakery update --all`, then fix anything
broken with another push.
2. When you want to stabilize before a real release, tag a release
candidate: `git tag vX.Y.Z-rc.1 && git push origin vX.Y.Z-rc.1` (push to
both remotes). That tag alone triggers a beta-track build —
"freezing" is just pausing pushes to `main` while you test it, not a
branch operation. Cut `-rc.2`, `-rc.3`, etc. for further fixes.
3. Once an RC has gone without issues, tag the real release:
`git tag vX.Y.Z && git push origin vX.Y.Z` — that's what triggers the
signed stable release build.
**Version honesty**: bakery's compiled `--version` is
`[workspace.package] version` in the root `Cargo.toml`. The bakery
package version in the index (what `bakery list` shows) is the git tag.
Those must match at tag time — bump `workspace.package.version` to
`X.Y.Z` *before* pushing `vX.Y.Z` or `vX.Y.Z-rc.N`. Never jump a tag
(e.g. `v0.3.1` → `v0.7.1`) without that Cargo.toml bump; the resulting
binary will report the old workspace version while the index claims the
new tag.
**Note**: `bakery` and `bread-theme` share the same `v*` tag pattern
(both `release-bakery.yml` and `release-bread-theme.yml` trigger on
`tags: ['v*']`, pre-existing behavior this doc isn't changing) — a single
tag push builds and publishes a release for *both* products at once. If
you ever need to release one independently of the other, that's a real gap
worth fixing in the workflow files themselves, not something to work around
by hand.
## Tracks, from a user's perspective
```
bakery track show # what you're currently on (defaults to stable)
bakery track set dev # or beta, or stable
bakery update --all # pull the latest build on your current track
```
| Track | What it is | Published from |
|--------|-----------|-----------------|
| `stable` | The last tagged release | a `vX.Y.Z` tag |
| `beta` | Latest release candidate | a `vX.Y.Z-rc.N` tag |
| `dev` | Bleeding edge | `main`, on every push |
Dev versions are auto-computed (`X.Y.Z-dev.<timestamp>+<sha>`) from the
latest published stable tag, so they always sort as newer than what you
have installed — no manual version bumping needed. Beta versions are just
the RC tag itself (already valid semver, already sorts below the real
release it's a candidate for).
## Local development
```sh
cargo build --release -p bakery
cargo test --release -p bakery
```
`bakery`, `bread-theme`, `bread-utils`, `bread-app`, `bread-polkit`,
`bread-onnx`, `bread-screenshots`, and `bread-capture` are all workspace
members. Run the same commands with `-p bread-theme --bin bread-theme`
for that crate, `-p bread-utils --features bread-client` for the IPC
client, or `-p bread-app --features bread-client` for the GTK bootstrap
helpers.
## CI
- `dev-bakery.yml` / `dev-bread-theme.yml` — triggered on push to `main`.
- `rc-bakery.yml` / `rc-bread-theme.yml` — triggered on any `vX.Y.Z-rc.N`
tag push.
- `release-bakery.yml` / `release-bread-theme.yml` — triggered on any other
`v*` tag push, cuts the actual stable release.
- `package.yml` — publishes `bakery` to the `[breadway]` pacman repo, also
tag-triggered.
All CI runs on a self-hosted runner; nothing runs automatically on plain
commits or PRs beyond the track builds above. See
[`docs/release-channels.md`](docs/release-channels.md) for the full policy,
including how a new product gets wired onto these tracks.
## Questions
Open an issue on this repo's Forgejo tracker.

1799
Cargo.lock generated
View file

File diff suppressed because it is too large Load diff

9
Cargo.toml
View file

@ -1,12 +1,12 @@
[workspace]
members = ["bakery", "bread-theme", "bread-utils", "bread-onnx", "bread-screenshots", "bread-capture", "bread-app", "bread-polkit", "bread-launcher"]
members = ["bakery", "bread-theme"]
resolver = "2"
[workspace.package]
version = "0.7.5"
version = "0.2.3"
edition = "2021"
license = "MIT"
authors = ["Breadway <plasticbread849@gmail.com>"]
authors = ["Breadway <rileyhorsham@gmail.com>"]
[workspace.dependencies]
anyhow = "1"
@ -19,9 +19,6 @@ sha2 = "0.10"
hex = "0.4"
clap = { version = "4", features = ["derive", "env"] }
chrono = "0.4"
minisign-verify = "0.2"
tracing = "0.1"
semver = "1"
[profile.release]
lto = "thin"

21
LICENSE
View file

@ -1,21 +0,0 @@
MIT License
Copyright (c) 2026 Breadway
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

151
README.md
View file

@ -4,36 +4,19 @@ A collection of Rust tools for the Linux desktop (Hyprland / Wayland / Arch).
Install any product with a single command — no Rust toolchain required.
```sh
curl -fsSL https://get.breadway.dev | sh
curl https://breadway.dev/get | sh
bakery install breadbar
```
## Products
The table below is generated from [`registry/bread-ecosystem.toml`](registry/bread-ecosystem.toml). Regenerate with `scripts/gen-readme-products.sh`.
<!-- gen-readme-products:start -->
| Package | Description |
|---------|-------------|
| `bakery` | Bread ecosystem package manager |
| `bread-theme` | Shared pywal-accented, fixed-dark-base theming CLI for the bread ecosystem |
| `bread` | Reactive automation daemon and CLI for Linux desktops |
| `breadbar` | Minimal status bar and notification daemon for Hyprland |
| `breadbox` | App launcher for Hyprland / Wayland |
| `breadcrumbs` | Profile-aware Wi-Fi state machine with Tailscale integration |
| `breadpad` | Quick-capture scratchpad and note viewer with AI classification |
| `breadpaper` | Wallpaper manager for the bread desktop |
| `breadmon` | Terminal UI monitor manager for Hyprland |
| `breadsearch` | Semantic system-wide search for BOS |
| `breadclip` | Wayland clipboard history manager for Hyprland |
| `breadshot` | Screenshot utility for the bread ecosystem |
| `bos-settings` | System settings app for Bread OS |
| `breadhelp` | Onboarding and help center for Bread OS |
| `breadcast` | Cast your screen to any Chromecast/Google TV or DLNA renderer — daemon + GTK4 popup — Bakery product; not included in the BOS ISO |
| `breadarr` | Single-daemon Sonarr+Radarr+Prowlarr replacement — release watching, matching, grabbing, importing, and a terminal UI, no web UI — Homelab, not shipped on BOS |
<!-- gen-readme-products:end -->
| `bread` | Reactive automation daemon (`breadd`) + CLI — Lua scripting over Hyprland, udev, power, network, and Bluetooth events |
| `breadbar` | GTK4 status bar (workspaces, clock, CPU/RAM/battery/WiFi/Bluetooth) and D-Bus notification daemon for Hyprland |
| `breadbox` | GTK4 fuzzy app launcher for Hyprland with context-aware sorting; ships an icon-sync daemon (`breadbox-sync`) |
| `breadcrumbs` | Profile-aware Wi-Fi state machine with Tailscale exit-node management and a self-healing watch daemon |
| `breadpad` | Quick-capture scratchpad popup with AI-powered note classification, reminders, recurrence, and a full note viewer (`breadman`) |
## Recommended keybinds
@ -52,31 +35,17 @@ to keys.
## Theming
All GUI products (breadbar, breadbox, breadpad) share one stylesheet via
`bread-theme`. Background, surface, overlay, and foreground are always BOS's
fixed dark values; only the accent colors are read from the pywal palette in
`~/.cache/wal/colors.json`. When that file is absent, the accents fall back
to BOS's curated bread-toned defaults (not Catppuccin Mocha). The stylesheet
is written to `$XDG_RUNTIME_DIR/bread/theme.css`; running apps watch that
file and recolour live when it changes. Per-app CSS overrides live at
`~/.config/<app>/style.css`.
All GUIs share one look via `bread-theme`. The `bread-theme` CLI renders the
component stylesheet from your pywal palette (Catppuccin Mocha fallback) to
`$XDG_RUNTIME_DIR/bread/theme.css`; every app loads that file and **live-reloads**
it, so changing your wallpaper recolours the whole ecosystem with no rebuilds:
```sh
wal -i ~/Pictures/wall.png # regenerate pywal palette
bread-theme generate # render the shared stylesheet (run from a wal hook)
```
`bread-theme` subcommands:
| Subcommand | Description |
|------------|-------------|
| `generate` | Render the current palette and write the shared stylesheet (default) |
| `reload` | Same as `generate`; use after a palette change to trigger live recolour in running apps |
| `path` | Print the stylesheet path |
| `print` | Render the stylesheet to stdout without writing |
The shared theming logic lives in the `bread-theme` crate in this repo. See
[`BREAD_DESIGN_SYSTEM.md`](BREAD_DESIGN_SYSTEM.md) for the design tokens (fonts,
See [`BREAD_DESIGN_SYSTEM.md`](BREAD_DESIGN_SYSTEM.md) for the tokens (fonts,
spacing, radii, colour roles) the stylesheet is built from.
## Installing bakery
@ -84,7 +53,9 @@ spacing, radii, colour roles) the stylesheet is built from.
`bakery` is the package manager for the ecosystem. Install it with the bootstrap script:
```sh
curl -fsSL https://get.breadway.dev | sh
curl https://breadway.dev/get | sh
# or
curl -sSfL https://get.breadway.dev | sh
```
The script downloads the prebuilt `bakery` binary to `~/.local/bin/bakery` and prints a note if that directory isn't on your `PATH` yet.
@ -106,26 +77,6 @@ bakery remove <pkg> # remove a package (data files are never deleted)
`bakery install` runs `doctor` first and bails with a clear message if any system dependency is missing. Binaries land in `~/.local/bin` (override with `BAKERY_BIN_DIR`).
## System prefix (BOS)
Default install root is `~/.local`. BOS sets a system prefix so bakery-managed
desktop apps live on the `@` root subvolume and ride along with
snapper/grub-btrfs snapshots:
```toml
# /etc/bakery/config.toml
prefix = "/usr/local"
```
`BAKERY_PREFIX` overrides the config file. A non-home prefix installs bins to
`$prefix/bin`, share/data/desktop/licenses to `$prefix/share/...`, and systemd
user units to `/usr/lib/systemd/user`. Per-user state (`installed.json`,
update backups) stays in `~/.local/state/bakery`. Writes that need root use
`sudo -n`, then `pkexec`. `bakery doctor` prints the active prefix.
Hermes and `get.sh` are unchanged — they keep the user-local default. See
[`bakery/README.md`](bakery/README.md).
## System dependencies by product
`bakery doctor` checks these automatically before any install. Required deps block installation; optional deps generate a warning but never block.
@ -141,68 +92,32 @@ Hermes and `get.sh` are unchanged — they keep the user-local default. See
Install all required deps with `sudo pacman -S <packages>`. Use `pacman -Q <pkg>` to check whether any are already present.
## Theming
All GUI products (breadbar, breadbox, breadpad) read pywal colors from
`~/.cache/wal/colors.json` and fall back to Catppuccin Mocha when that file
is absent. Per-app CSS overrides live at `~/.config/<app>/style.css`.
The shared theming logic lives in the `bread-theme` crate in this repo.
## Workspace
This repo is a Cargo workspace. Bakery-channel products shipped from here
are `bakery` and `bread-theme`; the other members are shared crates sibling
apps pin, or in-tree tools that are not bakery packages of their own.
This repo is a Cargo workspace:
```
bread-ecosystem/
├── bakery/ # package manager binary
├── bread-theme/ # shared pywal + fixed-dark-base theming crate
├── bread-utils/ # shared plumbing (Hyprland IPC, singleton, XDG, BreadClient, …)
├── bread-app/ # GTK bootstrap new tools should use (app id, singleton, overlay, command listen)
├── bread-polkit/ # themed PolicyKit agent (bakery.toml present; unpublished)
├── bread-onnx/ # shared ONNX runtime helpers
├── bread-screenshots/ # grim capture primitive used by app `--screenshot` modes
├── bread-capture/ # orchestrator that drives those `--screenshot` modes
├── registry/ # bread-ecosystem.toml — product registry
├── bakery/ # package manager binary
├── bread-theme/ # shared pywal + Catppuccin theming crate
├── registry/ # bread-ecosystem.toml — product registry
└── scripts/
├── get.sh # curl | sh bootstrap
├── gen-index.sh # generates dl.breadway.dev/index.json from release artifacts
└── gen-readme-products.sh # rewrites the Products table from the registry
```
### New GTK tools
Do not copy another app's `main.rs`. Depend on `bread-app`:
- `bread_app::application_id` / `try_acquire` / `toggle_or_kill` for the
`com.breadway.*` application id and single-instance lock
- feature `gtk` re-exports `bread_utils::gtk_popup` (layer-shell overlay)
- feature `bread-client` for `listen_commands` on `bread.command.<app>.**`
See the `bread-app` crate docs. Existing apps are not migrated in this
tree; `bread-polkit` is the first in-tree consumer.
### bread-polkit
A session PolicyKit authentication agent (password prompt, cancel,
identity). Not a wrapper around `polkit-gnome`. `bread-polkit/bakery.toml`
exists so it can be published via bakery; it is not in
`registry/bread-ecosystem.toml` and is therefore unpublished — not on the
bakery index and not on the BOS ISO lockfile.
```sh
cargo run -p bread-polkit
```
Autostart — pick one:
```sh
cp bread-polkit/contrib/bread-polkit.desktop ~/.config/autostart/
```
```
# hyprland.conf
exec-once = bread-polkit
├── get.sh # curl | sh bootstrap
└── gen-index.sh # generates dl.breadway.dev/index.json from release artifacts
```
## Release pipeline
Each product repo (`Breadway/bread`, `Breadway/breadbar`, …) has
`.forgejo/workflows/release-*.yml` that triggers on `v*` tags. The workflow
Each product repo (`Breadway/bread`, `Breadway/breadbar`, …) has a
`.github/workflows/release.yml` that triggers on `v*` tags. The workflow
runs on a self-hosted runner on hestia, builds a stripped x86_64 binary,
deposits it at `dl.breadway.dev/<pkg>/<version>/`, updates `index.json`,
and mirrors the binary to GitHub Releases as a fallback.
@ -210,12 +125,6 @@ and mirrors the binary to GitHub Releases as a fallback.
`bakery` always tries `dl.breadway.dev` first and transparently falls back
to the GitHub Release URL recorded in the manifest.
Beyond stable releases, most products also publish **dev** and **beta**
tracks — continuous builds off `main` (dev) and `vX.Y.Z-rc.N` tags (beta).
See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the branch/release workflow and
[`docs/release-channels.md`](docs/release-channels.md) for the full track
policy. Switch tracks with `bakery track set <stable|beta|dev>`.
### Release artifact contract
Each product's `release.yml` **must** upload the following files alongside

9
bakery/Cargo.toml
View file

@ -5,7 +5,7 @@ edition.workspace = true
license.workspace = true
authors.workspace = true
description = "Package manager for the bread ecosystem"
repository = "https://git.breadway.dev/Breadway/bread-ecosystem"
repository = "https://github.com/Breadway/bread-ecosystem"
[dependencies]
anyhow = { workspace = true }
@ -17,10 +17,7 @@ ureq = { workspace = true }
sha2 = { workspace = true }
hex = { workspace = true }
clap = { workspace = true }
clap_complete = "4"
chrono = { workspace = true }
minisign-verify = { workspace = true }
semver = { workspace = true }
bread-utils = { path = "../bread-utils" }
fs4 = { version = "0.8", features = ["sync"] }
[dev-dependencies]
tempfile = "3"

30
bakery/README.md
View file

@ -1,30 +0,0 @@
# bakery
Package manager for the bread ecosystem. Usage lives in the
[repo README](../README.md).
## Install prefix
Default root is `~/.local` (bins in `~/.local/bin`, data in
`~/.local/share`). That is the hermes / `get.sh` path and must stay the
default.
BOS sets a system prefix so bakery-managed desktop apps live on the `@`
root subvolume and are included in snapper/grub-btrfs snapshots:
```toml
# /etc/bakery/config.toml
prefix = "/usr/local"
```
`BAKERY_PREFIX` overrides the config file. A non-home prefix installs:
| Thing | Path |
|-------|------|
| bins | `$prefix/bin` |
| share / desktop / licenses / data | `$prefix/share/...` |
| systemd user units | `/usr/lib/systemd/user` |
Per-user state (`installed.json` and pre-update backups) stays in
`~/.local/state/bakery`. Writes that need root use `sudo -n`, then
`pkexec`. `bakery doctor` prints the active prefix.

141
bakery/src/doctor.rs
View file

@ -1,4 +1,3 @@
use crate::ui;
use anyhow::Result;
use std::process::Command;
@ -11,48 +10,18 @@ pub struct DepReport {
pub fn check_deps(required: &[String], optional: &[String]) -> Result<DepReport> {
Ok(DepReport {
missing: required
.iter()
.filter(|d| !dep_present(d))
.cloned()
.collect(),
warnings: optional
.iter()
.filter(|d| !dep_present(d))
.cloned()
.collect(),
missing: required.iter().filter(|d| !dep_present(d)).cloned().collect(),
warnings: optional.iter().filter(|d| !dep_present(d)).cloned().collect(),
})
}
/// Arch package name -> Debian/Ubuntu package name, for the few cases where
/// they differ *and* the Debian package's own binaries don't share a name
/// with either package (so `path_has` can't bridge the gap the way it
/// already does for e.g. `ffmpeg`/`openssl`, whose package name matches
/// their own binary name on both distros). `system_deps` in `bakery.toml`
/// is always written as the Arch name — this is what makes that same
/// declaration also resolve correctly on a Debian-family bakery host like
/// hestia.
const ARCH_TO_DEBIAN_PKG: &[(&str, &str)] = &[("mkvtoolnix-cli", "mkvtoolnix")];
fn debian_name(pkg: &str) -> &str {
ARCH_TO_DEBIAN_PKG
.iter()
.find(|(arch, _)| *arch == pkg)
.map(|(_, debian)| *debian)
.unwrap_or(pkg)
}
fn dep_present(pkg: &str) -> bool {
// Primary: `pacman -Q` uses the exact Arch package name — no name mapping needed.
if pacman_installed(pkg) {
return true;
}
// Fallback for environments without pacman: native PATH search then pkg-config.
if path_has(pkg) || pkg_config_exists(pkg) {
return true;
}
// Further fallback for Debian/Ubuntu hosts: dpkg, via the name map above.
dpkg_installed(debian_name(pkg))
path_has(pkg) || pkg_config_exists(pkg)
}
fn pacman_installed(pkg: &str) -> bool {
@ -63,17 +32,6 @@ fn pacman_installed(pkg: &str) -> bool {
.unwrap_or(false)
}
fn dpkg_installed(pkg: &str) -> bool {
Command::new("dpkg-query")
.args(["-W", "-f=${Status}", pkg])
.output()
.map(|o| {
o.status.success()
&& String::from_utf8_lossy(&o.stdout).contains("install ok installed")
})
.unwrap_or(false)
}
/// Check PATH without shelling out to `which` (avoids the external dependency).
fn path_has(bin: &str) -> bool {
std::env::var_os("PATH")
@ -90,75 +48,34 @@ fn pkg_config_exists(lib: &str) -> bool {
.unwrap_or(false)
}
/// Builds the "install with: ..." hint for a list of missing Arch package
/// names, picking the command for whichever package manager is actually on
/// this host — `sudo pacman -S ...` is meaningless advice on a Debian-family
/// bakery host like hestia, which has neither `pacman` nor the Arch names.
pub fn install_hint(missing: &[String]) -> String {
if path_has("pacman") {
format!("sudo pacman -S {}", missing.join(" "))
} else if path_has("apt") {
let names: Vec<&str> = missing.iter().map(|p| debian_name(p)).collect();
format!("sudo apt install {}", names.join(" "))
} else {
format!("install: {}", missing.join(", "))
}
}
/// Print a formatted doctor report for a package's system deps.
/// Returns true if all *required* deps are satisfied.
pub fn report(
package_name: &str,
required: &[String],
optional: &[String],
name_width: usize,
) -> bool {
pub fn report(package_name: &str, required: &[String], optional: &[String]) -> bool {
if required.is_empty() && optional.is_empty() {
ui::check_row(true, package_name, name_width, "no system deps required");
println!(" {package_name}: no system deps required");
return true;
}
match check_deps(required, optional) {
Err(e) => {
ui::check_row(
false,
package_name,
name_width,
&format!("error running doctor: {e}"),
);
eprintln!(" error running doctor for {package_name}: {e}");
false
}
Ok(rep) => {
for warn in &rep.warnings {
eprintln!(
" {}",
ui::style(
&format!(
"{package_name}: optional dep not found: {warn} \
(install for full functionality)"
),
ui::YELLOW
)
" {package_name}: optional dep not found: {warn} \
(install for full functionality)"
);
}
if rep.missing.is_empty() {
ui::check_row(
true,
package_name,
name_width,
"all required system deps satisfied",
);
println!(" {package_name}: all required system deps satisfied");
true
} else {
ui::check_row(
false,
package_name,
name_width,
&format!("missing: {}", rep.missing.join(", ")),
);
eprintln!(
" {}",
ui::dim(&format!("install with: {}", install_hint(&rep.missing)))
" {package_name}: missing system deps: {}",
rep.missing.join(", ")
);
eprintln!(" install with: sudo pacman -S {}", rep.missing.join(" "));
false
}
}
@ -188,38 +105,24 @@ mod tests {
assert!(path_has("sh"));
}
#[test]
fn debian_name_maps_known_alias() {
assert_eq!(debian_name("mkvtoolnix-cli"), "mkvtoolnix");
}
#[test]
fn debian_name_passes_through_unmapped() {
assert_eq!(debian_name("ffmpeg"), "ffmpeg");
}
// This test only runs on systems with dpkg (Debian/Ubuntu).
#[test]
#[ignore]
fn dpkg_finds_dpkg_itself() {
assert!(dpkg_installed("dpkg"));
}
#[test]
fn dpkg_missing_package_not_present() {
assert!(!dpkg_installed("this-package-does-not-exist-xyzzy42"));
}
#[test]
fn missing_required_dep_detected() {
let rep = check_deps(&["this-package-does-not-exist-xyzzy42".to_string()], &[]).unwrap();
let rep = check_deps(
&["this-package-does-not-exist-xyzzy42".to_string()],
&[],
)
.unwrap();
assert_eq!(rep.missing.len(), 1);
assert!(rep.warnings.is_empty());
}
#[test]
fn missing_optional_dep_becomes_warning_not_error() {
let rep = check_deps(&[], &["this-package-does-not-exist-xyzzy42".to_string()]).unwrap();
let rep = check_deps(
&[],
&["this-package-does-not-exist-xyzzy42".to_string()],
)
.unwrap();
assert!(rep.missing.is_empty());
assert_eq!(rep.warnings.len(), 1);
}

54
bakery/src/download.rs
View file

@ -3,38 +3,36 @@ use sha2::{Digest, Sha256};
use std::path::Path;
use crate::manifest::{fetch_binary, Binary};
use crate::ui;
/// Download a binary, verify its SHA-256, then atomically write it into
/// place (fsynced, temp-in-same-dir-with-unique-name then rename — see
/// `bread_utils::atomic`). Bails before touching `dest` if the checksum
/// fails. Returns the verified hex sha256 so callers (`install::
/// install_package`) can record it for `bakery verify` without hashing the
/// bytes a second time — `verify_sha256` already confirmed `bytes` matches
/// `binary.sha256`, so that's the value to return.
pub fn fetch_and_place(binary: &Binary, dest: &Path) -> Result<String> {
ui::step("downloading", &binary.name);
/// Download a binary to a temp path, verify its SHA-256, then atomically move
/// it into place. Bails before touching `dest` if the checksum fails.
pub fn fetch_and_place(binary: &Binary, dest: &Path) -> Result<()> {
println!(" downloading {}…", binary.name);
let bytes = fetch_binary(&binary.dl_url, &binary.github_url)
.with_context(|| format!("downloading {}", binary.name))?;
verify_sha256(&bytes, &binary.sha256)
.with_context(|| format!("checksum mismatch for {}", binary.name))?;
crate::prefix::write_bytes(dest, &bytes, 0o755)
.with_context(|| format!("placing binary at {}", dest.display()))?;
ui::step("placed", &dest.display().to_string());
Ok(binary.sha256.clone())
if let Some(dir) = dest.parent() {
std::fs::create_dir_all(dir)?;
}
let tmp = dest.with_extension("tmp");
std::fs::write(&tmp, &bytes).context("writing binary to tmp")?;
#[cfg(unix)]
{
use std::os::unix::fs::PermissionsExt;
std::fs::set_permissions(&tmp, std::fs::Permissions::from_mode(0o755))?;
}
std::fs::rename(&tmp, dest).context("placing binary")?;
println!(" installed {}", dest.display());
Ok(())
}
/// Verify that `bytes` hashes to `expected_hex` under SHA-256.
///
/// Shared by every artifact download path — binaries (via
/// [`fetch_and_place`]), and config-example / systemd-unit downloads in
/// `install.rs` — so all downloaded artifacts get the same integrity check.
pub fn verify_sha256(bytes: &[u8], expected_hex: &str) -> Result<()> {
if expected_hex.is_empty() {
bail!("index entry has no sha256 recorded — refusing to trust an unverifiable download");
}
fn verify_sha256(bytes: &[u8], expected_hex: &str) -> Result<()> {
let mut hasher = Sha256::new();
hasher.update(bytes);
let actual = hex::encode(hasher.finalize());
@ -77,14 +75,4 @@ mod tests {
let hash = sha256_hex(bytes);
assert!(verify_sha256(bytes, &hash).is_ok());
}
#[test]
fn verify_missing_sha256_gives_a_clear_error() {
// gen-index.sh emits an empty sha256 string when a .sha256 sidecar
// is missing — must not fall through to the generic mismatch
// message ("expected: \n actual: <hex>"), which is confusing about
// what actually went wrong.
let err = verify_sha256(b"anything", "").unwrap_err();
assert!(err.to_string().contains("no sha256 recorded"));
}
}

1092
bakery/src/install.rs
View file

File diff suppressed because it is too large Load diff

1062
bakery/src/main.rs
View file

File diff suppressed because it is too large Load diff

381
bakery/src/manifest.rs
View file

@ -1,65 +1,11 @@
use crate::track::Track;
use anyhow::{bail, Context, Result};
use minisign_verify::{PublicKey, Signature};
use serde::{Deserialize, Serialize};
use std::path::{Path, PathBuf};
use std::path::PathBuf;
use std::time::{Duration, SystemTime};
const DEFAULT_BASE_URL: &str = "https://dl.breadway.dev";
const PRIMARY_URL: &str = "https://dl.breadway.dev/index.json";
const CACHE_MAX_AGE: Duration = Duration::from_secs(24 * 3600);
/// The `https://dl.breadway.dev` base can be overridden for local/staging
/// testing (e.g. serving a fake index from `python3 -m http.server`) without
/// rebuilding bakery — same pattern as `main.rs`'s `BAKERY_BIN_DIR` override.
fn base_url() -> String {
std::env::var("BAKERY_INDEX_BASE_URL").unwrap_or_else(|_| DEFAULT_BASE_URL.to_string())
}
/// Index URL for `track`. `Stable` keeps the exact pre-track path
/// (`{base}/index.json`) so existing infra and warm caches are unaffected;
/// `Beta`/`Dev` live under a track-prefixed subpath.
fn primary_url(track: Track) -> String {
match track {
Track::Stable => format!("{}/index.json", base_url()),
Track::Beta | Track::Dev => format!("{}/{}/index.json", base_url(), track.as_str()),
}
}
fn sig_url(track: Track) -> String {
format!("{}.minisig", primary_url(track))
}
/// The bakery index-signing public key.
///
/// The matching secret key is used offline (never on this machine, never in
/// this repo) to sign `index.json` with `minisign` as part of publishing a
/// new index — see `scripts/gen-index.sh`. Every fetch of `index.json`, and
/// every load of the on-disk cache, must verify against this key before the
/// bytes are trusted or parsed. This is the single control point: the
/// per-artifact `sha256` fields and `post_install` hook strings all live
/// inside `index.json` itself, so a valid signature transitively covers them.
const PUBKEY: &str = "RWTBR8w/IJ+jaylOv80b52DzekKbSR2CvOVGvzB0ipGBaMhJPAOiEWq8";
/// Verify `bytes` against `sig_text` (the contents of an `index.json.minisig`
/// file) using the pinned [`PUBKEY`]. Returns an error on any failure —
/// missing/malformed signature, wrong key, or a hash mismatch.
fn verify_index_signature(bytes: &[u8], sig_text: &str) -> Result<()> {
verify_against_key(bytes, sig_text, PUBKEY)
}
/// Verify `bytes` against a minisign `sig_text` using an arbitrary base64
/// public key. Split out from [`verify_index_signature`] purely so tests can
/// exercise the verification logic with a throwaway keypair instead of the
/// real production key.
fn verify_against_key(bytes: &[u8], sig_text: &str, pubkey_b64: &str) -> Result<()> {
let public_key = PublicKey::from_base64(pubkey_b64).context("public key is malformed")?;
let signature =
Signature::decode(sig_text).context("index.json.minisig is malformed or unreadable")?;
public_key
.verify(bytes, &signature, false)
.context("index.json failed signature verification against the pinned bakery key")
}
#[derive(Debug, Clone, Deserialize, Serialize)]
pub struct Binary {
pub name: String,
@ -72,10 +18,6 @@ pub struct Binary {
pub struct Service {
pub unit: String,
pub enable: bool,
/// SHA-256 of the unit file artifact. Required to verify the download in
/// `install::install_service`, same as binaries; `index.json` carries it
/// (and is itself minisign-signed, which is what makes it trustworthy).
pub sha256: String,
}
#[derive(Debug, Clone, Deserialize, Serialize)]
@ -83,10 +25,6 @@ pub struct ConfigScaffold {
pub dir: String,
/// Example config filename, relative to the release artifact directory.
pub example: Option<String>,
/// SHA-256 of the example config artifact, when `example` is set.
/// Verified in `install::scaffold_config` the same way binaries are.
#[serde(default)]
pub example_sha256: Option<String>,
}
#[derive(Debug, Clone, Deserialize, Serialize)]
@ -106,30 +44,6 @@ pub struct Package {
pub config: Option<ConfigScaffold>,
#[serde(default)]
pub post_install: Vec<String>,
/// License artifact filename (e.g. "LICENSE"), installed to
/// `$prefix/share/licenses/<name>/LICENSE` (`~/.local/share/...` by
/// default) — the bakery equivalent of a PKGBUILD's `package()` step.
#[serde(default)]
pub license_file: Option<String>,
#[serde(default)]
pub license_file_sha256: Option<String>,
/// Desktop entry artifact filename (e.g. "breadhelp.desktop"),
/// installed to `$prefix/share/applications/<name>.desktop` so the
/// app shows up in any XDG-compliant launcher.
#[serde(default)]
pub desktop_file: Option<String>,
#[serde(default)]
pub desktop_file_sha256: Option<String>,
/// Data archive artifact filename (e.g. "content.tar.gz") — a `.tar.gz`
/// in the release dir, extracted to `$prefix/share/<name>/` on
/// install. For arbitrary data a package needs at runtime beyond a
/// config example (e.g. breadhelp's guide content), where a single
/// downloadable file + `tar` extraction is simpler than teaching
/// bakery to mirror a whole directory tree file-by-file.
#[serde(default)]
pub data_archive: Option<String>,
#[serde(default)]
pub data_archive_sha256: Option<String>,
}
impl Package {
@ -164,110 +78,47 @@ impl Index {
}
}
/// Load the manifest for `track`, using the on-disk cache when it is fresh
/// enough. Always fetches if `force_refresh` is true.
///
/// Every path — fresh fetch or cached read — verifies the minisign
/// signature over the raw `index.json` bytes before the JSON is parsed or
/// trusted. A signature failure on a freshly fetched index is always a hard
/// error. A signature failure on the *cached* copy is treated as a
/// (possibly tampered, possibly just stale-format) cache and triggers one
/// re-fetch from the network rather than bricking the CLI outright; if the
/// freshly fetched copy also fails to verify, that's a hard error.
pub fn load(force_refresh: bool, track: Track) -> Result<Index> {
let cache_path = cache_path(track);
let sig_cache_path = sig_cache_path(&cache_path);
/// Load the manifest, using the on-disk cache when it is fresh enough.
/// Always fetches if `force_refresh` is true.
pub fn load(force_refresh: bool) -> Result<Index> {
let cache_path = cache_path();
if !force_refresh && cache_is_fresh(&cache_path) {
match read_and_verify_cache(&cache_path, &sig_cache_path, track) {
Ok(index) => return Ok(index),
Err(err) => {
eprintln!(" warning: cached index.json failed verification ({err}), re-fetching…");
}
}
let text = std::fs::read_to_string(&cache_path).context("reading cached index")?;
return serde_json::from_str(&text).context("parsing cached index");
}
match fetch_and_cache(&cache_path, &sig_cache_path, track) {
Ok(index) => Ok(index),
Err(fetch_err) => {
// A network error shouldn't be a hard failure when a valid
// signed cache is sitting right there on disk, even if it's
// stale (or freshness was never checked because force_refresh
// was set) — fall back to it rather than bricking the CLI.
match read_and_verify_cache(&cache_path, &sig_cache_path, track) {
Ok(index) => {
eprintln!(
" warning: could not refresh {track} index ({fetch_err}) — \
using possibly-stale cached index"
);
Ok(index)
}
Err(_) => Err(fetch_err),
}
}
}
fetch_and_cache(&cache_path)
}
fn read_and_verify_cache(cache_path: &Path, sig_cache_path: &Path, track: Track) -> Result<Index> {
let bytes = std::fs::read(cache_path).context("reading cached index")?;
let sig_text = std::fs::read_to_string(sig_cache_path)
.context("reading cached index.json.minisig (cache predates signing support)")?;
verify_index_signature(&bytes, &sig_text)
.with_context(|| format!("cached {track} index failed signature verification"))?;
serde_json::from_slice(&bytes).context("parsing cached index")
}
fn cache_is_fresh(path: &Path) -> bool {
fn cache_is_fresh(path: &PathBuf) -> bool {
std::fs::metadata(path)
.and_then(|m| m.modified())
.map(|t| SystemTime::now().duration_since(t).unwrap_or(CACHE_MAX_AGE) < CACHE_MAX_AGE)
.unwrap_or(false)
}
fn fetch_and_cache(cache_path: &Path, sig_cache_path: &Path, track: Track) -> Result<Index> {
let bytes = fetch_bytes(&primary_url(track)).with_context(|| {
format!(
"fetching {track} index — has a {track} build been published yet? \
run 'bakery track set stable' to switch back"
)
})?;
let sig_text = fetch_text(&sig_url(track)).context(
"fetching index.json.minisig — the index must be signed before it can be trusted",
)?;
verify_index_signature(&bytes, &sig_text)
.with_context(|| format!("freshly fetched {track} index failed signature verification"))?;
bread_utils::atomic::write_atomic_bytes(cache_path, &bytes, None)
.with_context(|| format!("writing cached {track} index"))?;
bread_utils::atomic::write_atomic_bytes(sig_cache_path, sig_text.as_bytes(), None)
.with_context(|| format!("writing cached {track} index signature"))?;
serde_json::from_slice(&bytes).context("parsing index.json")
}
fn sig_cache_path(cache_path: &Path) -> PathBuf {
let mut name = cache_path.file_name().unwrap_or_default().to_os_string();
name.push(".minisig");
cache_path.with_file_name(name)
fn fetch_and_cache(cache_path: &PathBuf) -> Result<Index> {
let text = fetch_text(PRIMARY_URL)?;
if let Some(dir) = cache_path.parent() {
std::fs::create_dir_all(dir)?;
}
std::fs::write(cache_path, &text)?;
serde_json::from_str(&text).context("parsing index.json")
}
fn fetch_text(url: &str) -> Result<String> {
let bytes = fetch_bytes(url)?;
String::from_utf8(bytes).context("response is not valid UTF-8")
ureq::get(url)
.call()
.map_err(|e| anyhow::anyhow!("{e}"))?
.into_string()
.context("reading response body")
}
/// Cache filename for `track`. `Stable` keeps the pre-track filename
/// (`index.json`) so an existing warm cache survives an upgrade to a
/// track-aware bakery; `Beta`/`Dev` get their own sibling files so switching
/// tracks doesn't clobber each other's cache.
pub fn cache_path(track: Track) -> PathBuf {
let file_name = match track {
Track::Stable => "index.json".to_string(),
Track::Beta | Track::Dev => format!("index-{}.json", track.as_str()),
};
pub fn cache_path() -> PathBuf {
dirs::cache_dir()
.unwrap_or_else(|| PathBuf::from("~/.cache"))
.join("bakery")
.join(file_name)
.join("bakery/index.json")
}
/// Download a binary blob from `primary_url`, falling back to `fallback_url`
@ -277,192 +128,26 @@ pub fn fetch_binary(primary_url: &str, fallback_url: &str) -> Result<Vec<u8>> {
Ok(bytes) => Ok(bytes),
Err(primary_err) => {
eprintln!(
" {}",
crate::ui::note(&format!(
"primary URL failed ({primary_err}), trying GitHub fallback…"
))
" primary URL failed ({}), trying GitHub fallback…",
primary_err
);
fetch_bytes(fallback_url).context("both primary and GitHub fallback failed")
}
}
}
/// Comfortably above any real bakery artifact — caps how much of a response
/// gets buffered into memory before any trust check runs on it.
const MAX_RESPONSE_BYTES: u64 = 256 * 1024 * 1024;
/// How often (at most) the `\r`-overwritten progress line refreshes — a
/// LAN-speed download can push way more than one chunk per 100ms, and
/// printing on every chunk would flood the terminal instead of reassuring it.
const PROGRESS_THROTTLE: Duration = Duration::from_millis(100);
const CHUNK_SIZE: usize = 64 * 1024;
fn fetch_bytes(url: &str) -> Result<Vec<u8>> {
use std::io::{IsTerminal, Read};
let resp = ureq::get(url).call().map_err(|e| anyhow::anyhow!("{e}"))?;
use std::io::Read;
let resp = ureq::get(url)
.call()
.map_err(|e| anyhow::anyhow!("{e}"))?;
let status = resp.status();
if status != 200 {
bail!("HTTP {status} from {url}");
}
// Progress feedback only when there's a Content-Length to show progress
// against and stderr is an actual terminal — a multi-MB binary with no
// feedback at all looks like a hang, but piped/CI output shouldn't get
// `\r` noise. A manual chunked read loop (instead of one `read_to_end`)
// is what makes printing partway through the download possible, without
// pulling in a progress-bar crate for what's meant to just be reassurance.
let content_length: Option<u64> = resp.header("Content-Length").and_then(|v| v.parse().ok());
// Progress is reassurance for multi-MB binaries. A 4 KB index fetch
// drawing a 100% / 0.0 MB bar is noise, not feedback.
const MIN_PROGRESS_BYTES: u64 = 256 * 1024;
let show_progress =
content_length.is_some_and(|n| n >= MIN_PROGRESS_BYTES) && std::io::stderr().is_terminal();
let mut buf = Vec::new();
let mut reader = resp.into_reader();
let mut chunk = [0u8; CHUNK_SIZE];
let mut last_print = std::time::Instant::now();
loop {
let n = reader.read(&mut chunk).context("reading response")?;
if n == 0 {
break;
}
buf.extend_from_slice(&chunk[..n]);
if buf.len() as u64 > MAX_RESPONSE_BYTES {
bail!("response from {url} exceeds the {MAX_RESPONSE_BYTES}-byte limit");
}
if show_progress && last_print.elapsed() >= PROGRESS_THROTTLE {
crate::ui::print_progress(buf.len() as u64, content_length.unwrap());
last_print = std::time::Instant::now();
}
}
if show_progress {
crate::ui::print_progress(buf.len() as u64, content_length.unwrap());
crate::ui::finish_progress();
}
resp.into_reader()
.read_to_end(&mut buf)
.context("reading response")?;
Ok(buf)
}
#[cfg(test)]
mod tests {
use super::*;
// A throwaway test-only minisign keypair, generated solely to produce
// these fixtures (`minisign -G` then `minisign -S`). It has no
// relationship to the real bakery signing key (PUBKEY above) and the
// matching secret key was discarded — these are just fixed vectors to
// exercise the verification code path deterministically.
const TEST_PUBKEY: &str = "RWQTYQi9Fe4trQDQmbb9txWDxzUIPYs57J//A5wG9BHcZXgC8YP0Cf59";
const TEST_DATA: &[u8] = b"{\"hello\":\"world\"}\n";
const TEST_SIG: &str = "untrusted comment: signature from minisign secret key\n\
RUQTYQi9Fe4trXY/WBxk++476WhTqtVd3hlNWQj5h5DF8keP8sEJn22LDG2hloNgJesXt6HsTQs9uktayRVp/HB4XfC6e+rhYAs=\n\
trusted comment: timestamp:1784230084\tfile:test-data.json\thashed\n\
znmVfINB4jFDR2a4wuY8rOKlUBeSDOFjMkHYDXV3vxvAjK+r4V12ae9ZRQkfVtQ1YIEmFXbnJfbxywg+NR/1AA==\n";
#[test]
fn valid_signature_verifies() {
verify_against_key(TEST_DATA, TEST_SIG, TEST_PUBKEY)
.expect("known-good signature must verify");
}
#[test]
fn tampered_bytes_fail_verification() {
let tampered = b"{\"hello\":\"world!\"}\n".to_vec();
assert!(verify_against_key(&tampered, TEST_SIG, TEST_PUBKEY).is_err());
}
#[test]
fn wrong_key_fails_verification() {
// PUBKEY is the real production key — unrelated to the throwaway
// TEST_PUBKEY the fixture was signed with, so it must not verify.
assert!(verify_against_key(TEST_DATA, TEST_SIG, PUBKEY).is_err());
}
#[test]
fn malformed_signature_text_errors_cleanly() {
assert!(verify_against_key(TEST_DATA, "not a real signature", TEST_PUBKEY).is_err());
}
#[test]
fn production_pubkey_constant_is_well_formed() {
// Guards against a future typo/truncation in the hardcoded PUBKEY —
// it must at least parse as a valid minisign public key.
PublicKey::from_base64(PUBKEY).expect("PUBKEY must be a valid minisign public key");
}
#[test]
fn stable_cache_path_matches_pre_track_filename() {
// Must stay exactly "index.json" so an existing warm cache from a
// pre-track bakery binary is still used after an upgrade.
assert_eq!(cache_path(Track::Stable).file_name().unwrap(), "index.json");
}
#[test]
fn beta_and_dev_cache_paths_are_distinct_siblings() {
let stable = cache_path(Track::Stable);
let beta = cache_path(Track::Beta);
let dev = cache_path(Track::Dev);
assert_ne!(stable, beta);
assert_ne!(stable, dev);
assert_ne!(beta, dev);
assert_eq!(beta.parent(), stable.parent());
assert_eq!(dev.parent(), stable.parent());
}
#[test]
fn stable_url_has_no_track_prefix() {
assert_eq!(
primary_url(Track::Stable),
format!("{}/index.json", base_url())
);
}
#[test]
fn beta_and_dev_urls_are_track_prefixed() {
assert_eq!(
primary_url(Track::Beta),
format!("{}/beta/index.json", base_url())
);
assert_eq!(
primary_url(Track::Dev),
format!("{}/dev/index.json", base_url())
);
}
fn minimal_package_json() -> &'static str {
r#"{
"name": "breadhelp",
"description": "test",
"version": "1.0.0",
"binaries": [],
"config": null
}"#
}
#[test]
fn license_and_desktop_fields_default_to_none_on_old_shape_json() {
// Simulates an index.json produced before license_file/desktop_file
// existed — must not fail to parse.
let pkg: Package = serde_json::from_str(minimal_package_json()).unwrap();
assert!(pkg.license_file.is_none());
assert!(pkg.license_file_sha256.is_none());
assert!(pkg.desktop_file.is_none());
assert!(pkg.desktop_file_sha256.is_none());
}
#[test]
fn license_and_desktop_fields_roundtrip() {
let mut pkg: Package = serde_json::from_str(minimal_package_json()).unwrap();
pkg.license_file = Some("LICENSE".to_string());
pkg.license_file_sha256 = Some("abc123".to_string());
pkg.desktop_file = Some("breadhelp.desktop".to_string());
pkg.desktop_file_sha256 = Some("def456".to_string());
let json = serde_json::to_string(&pkg).unwrap();
let restored: Package = serde_json::from_str(&json).unwrap();
assert_eq!(restored.license_file.as_deref(), Some("LICENSE"));
assert_eq!(restored.license_file_sha256.as_deref(), Some("abc123"));
assert_eq!(restored.desktop_file.as_deref(), Some("breadhelp.desktop"));
assert_eq!(restored.desktop_file_sha256.as_deref(), Some("def456"));
}
}

546
bakery/src/prefix.rs
View file

@ -1,546 +0,0 @@
//! Install prefix: default `~/.local`, or a system root for BOS.
//!
//! Hermes and `get.sh` keep the user-local default. BOS sets
//! `prefix = "/usr/local"` in `/etc/bakery/config.toml` (or `BAKERY_PREFIX`)
//! so bakery-managed desktop apps live on the `@` root subvolume and ride
//! along with snapper/grub-btrfs snapshots. Per-user state stays under
//! `~/.local/state/bakery` either way — bakery still records what *this*
//! user asked for; the prefix only changes where bits land on disk.
//!
//! Writes that hit `EACCES` use `sudo -n` first, then `pkexec` if a
//! graphical session is available. Interactive `sudo` (password on stdin)
//! is never used — a GUI hook must not block on a TTY prompt.
use anyhow::{bail, Context, Result};
use serde::Deserialize;
use std::ffi::OsStr;
use std::io::{self, Write};
use std::path::{Path, PathBuf};
use std::process::{Command, Stdio};
/// Default user-local prefix when no config/env override is set.
const DEFAULT_USER_PREFIX: &str = ".local";
/// System-wide user units, used when the prefix is not under `$HOME`.
const SYSTEM_USER_UNIT_DIR: &str = "/usr/lib/systemd/user";
const SYSTEM_CONFIG_PATH: &str = "/etc/bakery/config.toml";
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Layout {
pub prefix: PathBuf,
pub bin_dir: PathBuf,
pub share_dir: PathBuf,
pub systemd_user_dir: PathBuf,
/// True when `prefix` is not under the user's home directory.
pub is_system: bool,
}
impl Layout {
pub fn kind_label(&self) -> &'static str {
if self.is_system {
"system"
} else {
"user"
}
}
/// Map a (possibly custom) prefix onto bin/share/unit paths.
/// `bin_override` is `--bin-dir` / `BAKERY_BIN_DIR` and wins for bins only.
pub fn from_prefix(prefix: &Path, bin_override: Option<PathBuf>) -> Self {
let prefix = normalize_prefix_path(prefix);
let is_system = is_system_prefix(&prefix);
let bin_dir = bin_override.unwrap_or_else(|| prefix.join("bin"));
let share_dir = prefix.join("share");
let systemd_user_dir = if is_system {
PathBuf::from(SYSTEM_USER_UNIT_DIR)
} else {
user_systemd_dir()
};
Self {
prefix,
bin_dir,
share_dir,
systemd_user_dir,
is_system,
}
}
/// Historical default: `~/.local` bins, XDG data dir for share,
/// `~/.config/systemd/user` for units. Used when neither `BAKERY_PREFIX`
/// nor `/etc/bakery/config.toml` sets a prefix — hermes / get.sh.
pub fn user_default(bin_override: Option<PathBuf>) -> Self {
let prefix = default_user_prefix();
let bin_dir = bin_override.unwrap_or_else(|| prefix.join("bin"));
let share_dir = dirs::data_dir().unwrap_or_else(|| prefix.join("share"));
Self {
prefix,
bin_dir,
share_dir,
systemd_user_dir: user_systemd_dir(),
is_system: false,
}
}
}
/// Resolve the active layout. `BAKERY_PREFIX` wins over `/etc/bakery/config.toml`;
/// neither set keeps the `~/.local` default. `bin_override` is the existing
/// `--bin-dir` / `BAKERY_BIN_DIR` knob.
pub fn resolve(bin_override: Option<PathBuf>) -> Layout {
let env = std::env::var("BAKERY_PREFIX").ok();
resolve_from(env.as_deref(), Path::new(SYSTEM_CONFIG_PATH), bin_override)
}
/// Same as [`resolve`] with the env value and config path injected, so
/// tests don't have to mutate process-global env or touch `/etc`.
pub fn resolve_from(
env_prefix: Option<&str>,
config_path: &Path,
bin_override: Option<PathBuf>,
) -> Layout {
match configured_prefix_from(env_prefix, config_path) {
Some(prefix) => Layout::from_prefix(&prefix, bin_override),
None => Layout::user_default(bin_override),
}
}
pub fn configured_prefix_from(env_prefix: Option<&str>, config_path: &Path) -> Option<PathBuf> {
if let Some(raw) = env_prefix {
let trimmed = raw.trim();
if !trimmed.is_empty() {
return Some(normalize_prefix(trimmed));
}
}
load_config_prefix(config_path)
}
#[derive(Debug, Default, Deserialize)]
struct BakeryConfig {
prefix: Option<String>,
}
/// Reads `prefix = "..."` from a bakery config file. Missing file or empty
/// key → `None` (caller falls back to the user-local default). A file that
/// exists but fails to parse is warned about, not treated as fatal — a typo
/// in `/etc/bakery/config.toml` must not take down `bakery list`.
pub fn load_config_prefix(path: &Path) -> Option<PathBuf> {
if !path.exists() {
return None;
}
let text = match std::fs::read_to_string(path) {
Ok(t) => t,
Err(e) => {
eprintln!(
" {}",
crate::ui::warn(&format!("could not read {}: {e}", path.display()))
);
return None;
}
};
match toml::from_str::<BakeryConfig>(&text) {
Ok(cfg) => cfg
.prefix
.as_deref()
.map(str::trim)
.filter(|p| !p.is_empty())
.map(normalize_prefix),
Err(e) => {
eprintln!(
" {}",
crate::ui::warn(&format!("could not parse {}: {e}", path.display()))
);
None
}
}
}
fn default_user_prefix() -> PathBuf {
home_dir().join(DEFAULT_USER_PREFIX)
}
fn home_dir() -> PathBuf {
dirs::home_dir().unwrap_or_else(|| PathBuf::from("~"))
}
fn user_systemd_dir() -> PathBuf {
dirs::config_dir()
.unwrap_or_else(|| home_dir().join(".config"))
.join("systemd/user")
}
fn is_system_prefix(prefix: &Path) -> bool {
match dirs::home_dir() {
Some(home) => !prefix.starts_with(&home),
None => true,
}
}
fn normalize_prefix(raw: &str) -> PathBuf {
normalize_prefix_path(&expand_tilde(raw))
}
fn normalize_prefix_path(path: &Path) -> PathBuf {
if path.is_absolute() {
path.to_path_buf()
} else {
std::env::current_dir()
.unwrap_or_else(|_| PathBuf::from("."))
.join(path)
}
}
fn expand_tilde(path: &str) -> PathBuf {
if path == "~" {
home_dir()
} else if let Some(rest) = path.strip_prefix("~/") {
home_dir().join(rest)
} else {
PathBuf::from(path)
}
}
fn is_permission_denied(err: &io::Error) -> bool {
err.kind() == io::ErrorKind::PermissionDenied
}
pub fn privilege_denied_msg(dest: &Path) -> String {
format!(
"permission denied writing {} — need root for this prefix. \
bakery tried `sudo -n` then `pkexec`; neither succeeded. \
Run from a root shell, grant passwordless sudo -n for install/rm/tar, \
or install a polkit rule. bakery will not prompt for a sudo password.",
dest.display()
)
}
fn has_graphical_session() -> bool {
std::env::var_os("WAYLAND_DISPLAY").is_some() || std::env::var_os("DISPLAY").is_some()
}
/// Write `bytes` to `dest`, creating parent dirs. Escalates on `EACCES`.
pub fn write_bytes(dest: &Path, bytes: &[u8], mode: u32) -> Result<()> {
match bread_utils::atomic::write_atomic_bytes(dest, bytes, Some(mode)) {
Ok(()) => Ok(()),
Err(e) if is_permission_denied(&e) => write_bytes_privileged(dest, bytes, mode),
Err(e) => Err(e).with_context(|| format!("writing {}", dest.display())),
}
}
fn write_bytes_privileged(dest: &Path, bytes: &[u8], mode: u32) -> Result<()> {
let mut tmp =
tempfile::NamedTempFile::new().context("creating temp file for privileged write")?;
tmp.write_all(bytes)
.and_then(|_| tmp.flush())
.and_then(|_| tmp.as_file().sync_all())
.context("writing temp file for privileged write")?;
let mode_str = format!("{mode:o}");
run_privileged(
Path::new("/usr/bin/install"),
&[
OsStr::new("-D"),
OsStr::new("-m"),
OsStr::new(&mode_str),
tmp.path().as_os_str(),
dest.as_os_str(),
],
dest,
)
}
pub fn create_dir_all(path: &Path) -> Result<()> {
match std::fs::create_dir_all(path) {
Ok(()) => Ok(()),
Err(e) if is_permission_denied(&e) => run_privileged(
Path::new("/usr/bin/install"),
&[
OsStr::new("-d"),
OsStr::new("-m"),
OsStr::new("755"),
path.as_os_str(),
],
path,
),
Err(e) => Err(e).with_context(|| format!("creating directory {}", path.display())),
}
}
pub fn remove_file(path: &Path) -> Result<()> {
match std::fs::remove_file(path) {
Ok(()) => Ok(()),
Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(()),
Err(e) if is_permission_denied(&e) => run_privileged(
Path::new("/usr/bin/rm"),
&[OsStr::new("-f"), path.as_os_str()],
path,
),
Err(e) => Err(e).with_context(|| format!("removing {}", path.display())),
}
}
pub fn remove_dir_all(path: &Path) -> Result<()> {
match std::fs::remove_dir_all(path) {
Ok(()) => Ok(()),
Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(()),
Err(e) if is_permission_denied(&e) => run_privileged(
Path::new("/usr/bin/rm"),
&[OsStr::new("-rf"), path.as_os_str()],
path,
),
Err(e) => Err(e).with_context(|| format!("removing {}", path.display())),
}
}
/// Extract `archive` (a `.tar.gz`) into `dest_dir`. Escalates the `tar`
/// invocation when `dest_dir` is not writable by this user — typical for
/// `$prefix/share/<pkg>` under `/usr/local`.
pub fn extract_tar_gz(archive: &Path, dest_dir: &Path) -> Result<()> {
create_dir_all(dest_dir)?;
if dir_writable_by_self(dest_dir) {
let status = Command::new("tar")
.args([
"xzf",
&archive.to_string_lossy(),
"--no-same-owner",
"--no-same-permissions",
"-C",
])
.arg(dest_dir)
.status()
.with_context(|| format!("running tar to extract {}", archive.display()))?;
if !status.success() {
bail!("tar exited with {status} extracting {}", archive.display());
}
return Ok(());
}
run_privileged(
Path::new("/usr/bin/tar"),
&[
OsStr::new("xzf"),
archive.as_os_str(),
OsStr::new("--no-same-owner"),
OsStr::new("--no-same-permissions"),
OsStr::new("-C"),
dest_dir.as_os_str(),
],
dest_dir,
)
}
fn dir_writable_by_self(dir: &Path) -> bool {
tempfile::Builder::new()
.prefix(".bakery-wprobe-")
.tempfile_in(dir)
.is_ok()
}
fn run_privileged(program: &Path, args: &[&OsStr], dest: &Path) -> Result<()> {
// `sudo -n` never prompts; stdin is null so a misconfigured sudoers
// can't fall through to a password read on a GUI hook's non-tty stdin.
let sudo = Command::new("sudo")
.arg("-n")
.arg(program)
.args(args)
.stdin(Stdio::null())
.status();
if matches!(sudo, Ok(status) if status.success()) {
return Ok(());
}
// pkexec pops a polkit dialog — only useful with a display, and the
// one acceptable password prompt (GUI, not a stolen sudo TTY).
if has_graphical_session() {
let pk = Command::new("pkexec").arg(program).args(args).status();
if matches!(pk, Ok(status) if status.success()) {
return Ok(());
}
}
bail!("{}", privilege_denied_msg(dest))
}
#[cfg(test)]
mod tests {
use super::*;
use std::fs;
use tempfile::tempdir;
#[test]
fn user_default_is_not_system_and_uses_local_bin() {
let layout = Layout::user_default(None);
assert!(!layout.is_system);
assert_eq!(layout.prefix, default_user_prefix());
assert_eq!(layout.bin_dir, default_user_prefix().join("bin"));
assert_eq!(layout.kind_label(), "user");
assert!(layout.systemd_user_dir.ends_with(Path::new("systemd/user")));
assert_ne!(layout.systemd_user_dir, PathBuf::from(SYSTEM_USER_UNIT_DIR));
}
#[test]
fn user_default_honors_bin_override() {
let layout = Layout::user_default(Some(PathBuf::from("/tmp/custom-bins")));
assert_eq!(layout.bin_dir, PathBuf::from("/tmp/custom-bins"));
assert!(!layout.is_system);
assert_eq!(layout.prefix, default_user_prefix());
}
#[test]
fn usr_local_is_system_layout() {
let layout = Layout::from_prefix(Path::new("/usr/local"), None);
assert!(layout.is_system);
assert_eq!(layout.prefix, PathBuf::from("/usr/local"));
assert_eq!(layout.bin_dir, PathBuf::from("/usr/local/bin"));
assert_eq!(layout.share_dir, PathBuf::from("/usr/local/share"));
assert_eq!(layout.systemd_user_dir, PathBuf::from(SYSTEM_USER_UNIT_DIR));
assert_eq!(layout.kind_label(), "system");
}
#[test]
fn custom_home_prefix_is_not_system() {
let home = dirs::home_dir().expect("home dir");
let prefix = home.join("apps");
let layout = Layout::from_prefix(&prefix, None);
assert!(!layout.is_system);
assert_eq!(layout.bin_dir, prefix.join("bin"));
assert_eq!(layout.share_dir, prefix.join("share"));
assert_ne!(layout.systemd_user_dir, PathBuf::from(SYSTEM_USER_UNIT_DIR));
}
#[test]
fn temp_prefix_maps_bin_and_share_under_prefix() {
let dir = tempdir().unwrap();
let layout = Layout::from_prefix(dir.path(), None);
assert_eq!(layout.bin_dir, dir.path().join("bin"));
assert_eq!(layout.share_dir, dir.path().join("share"));
// /tmp is not under $HOME, so this is a system-shaped prefix —
// units would go to /usr/lib/systemd/user. Writes still try
// unprivileged first, so tests can use a temp prefix without sudo.
assert!(layout.is_system);
assert_eq!(layout.systemd_user_dir, PathBuf::from(SYSTEM_USER_UNIT_DIR));
}
#[test]
fn bin_override_does_not_move_share_or_units() {
let layout = Layout::from_prefix(
Path::new("/usr/local"),
Some(PathBuf::from("/opt/override/bin")),
);
assert_eq!(layout.bin_dir, PathBuf::from("/opt/override/bin"));
assert_eq!(layout.share_dir, PathBuf::from("/usr/local/share"));
assert_eq!(layout.systemd_user_dir, PathBuf::from(SYSTEM_USER_UNIT_DIR));
}
#[test]
fn load_config_prefix_reads_value() {
let dir = tempdir().unwrap();
let path = dir.path().join("config.toml");
fs::write(&path, "prefix = \"/usr/local\"\n").unwrap();
assert_eq!(load_config_prefix(&path), Some(PathBuf::from("/usr/local")));
}
#[test]
fn load_config_prefix_expands_tilde() {
let dir = tempdir().unwrap();
let path = dir.path().join("config.toml");
fs::write(&path, "prefix = \"~/.local\"\n").unwrap();
assert_eq!(load_config_prefix(&path), Some(default_user_prefix()));
}
#[test]
fn load_config_prefix_missing_file_is_none() {
assert_eq!(
load_config_prefix(Path::new("/no/such/bakery-config.toml")),
None
);
}
#[test]
fn load_config_prefix_ignores_empty_value() {
let dir = tempdir().unwrap();
let path = dir.path().join("config.toml");
fs::write(&path, "prefix = \"\"\n").unwrap();
assert_eq!(load_config_prefix(&path), None);
}
#[test]
fn load_config_prefix_malformed_is_none() {
let dir = tempdir().unwrap();
let path = dir.path().join("config.toml");
fs::write(&path, "prefix = [\n").unwrap();
assert_eq!(load_config_prefix(&path), None);
}
#[test]
fn env_prefix_wins_over_config() {
let dir = tempdir().unwrap();
let path = dir.path().join("config.toml");
fs::write(&path, "prefix = \"/usr/local\"\n").unwrap();
let layout = resolve_from(Some("/opt/bread"), &path, None);
assert_eq!(layout.prefix, PathBuf::from("/opt/bread"));
assert_eq!(layout.bin_dir, PathBuf::from("/opt/bread/bin"));
assert!(layout.is_system);
}
#[test]
fn empty_env_falls_through_to_config() {
let dir = tempdir().unwrap();
let path = dir.path().join("config.toml");
fs::write(&path, "prefix = \"/usr/local\"\n").unwrap();
let layout = resolve_from(Some(" "), &path, None);
assert_eq!(layout.prefix, PathBuf::from("/usr/local"));
}
#[test]
fn no_env_no_config_is_user_default() {
let dir = tempdir().unwrap();
let path = dir.path().join("missing.toml");
let layout = resolve_from(None, &path, None);
assert_eq!(layout, Layout::user_default(None));
}
#[test]
fn write_bytes_to_writable_temp_prefix_needs_no_root() {
let dir = tempdir().unwrap();
let dest = dir.path().join("bin").join("foo");
write_bytes(&dest, b"hello", 0o755).unwrap();
assert_eq!(fs::read(&dest).unwrap(), b"hello");
#[cfg(unix)]
{
use std::os::unix::fs::PermissionsExt;
assert_eq!(
fs::metadata(&dest).unwrap().permissions().mode() & 0o777,
0o755
);
}
}
#[test]
fn create_and_remove_under_temp_prefix() {
let dir = tempdir().unwrap();
let nested = dir.path().join("share/licenses/pkg");
create_dir_all(&nested).unwrap();
assert!(nested.is_dir());
let file = nested.join("LICENSE");
write_bytes(&file, b"MIT\n", 0o644).unwrap();
remove_file(&file).unwrap();
assert!(!file.exists());
remove_dir_all(&dir.path().join("share")).unwrap();
assert!(!dir.path().join("share").exists());
}
#[test]
fn privilege_denied_msg_names_the_dest() {
let msg = privilege_denied_msg(Path::new("/usr/local/bin/breadd"));
assert!(msg.contains("/usr/local/bin/breadd"));
assert!(msg.contains("sudo -n"));
assert!(msg.contains("pkexec"));
assert!(msg.contains("will not prompt"));
}
#[test]
fn is_system_prefix_classifies_home_and_usr() {
let home = dirs::home_dir().expect("home dir");
assert!(!is_system_prefix(&home.join(".local")));
assert!(is_system_prefix(Path::new("/usr/local")));
assert!(is_system_prefix(Path::new("/opt/bread")));
}
}

185
bakery/src/state.rs
View file

@ -1,6 +1,4 @@
use crate::track::Track;
use anyhow::{Context, Result};
use fs4::FileExt;
use serde::{Deserialize, Serialize};
use std::collections::HashMap;
use std::path::PathBuf;
@ -12,34 +10,10 @@ pub struct InstalledPackage {
pub binaries: Vec<String>,
pub services: Vec<String>,
pub installed_at: String,
// `#[serde(default)]` so an installed.json written before per-package
// track tracking existed still deserializes — defaults to Stable, same
// convention as `State.track` above.
#[serde(default)]
pub track: Track,
/// The version this package was upgraded from, if any — `bakery
/// rollback` uses this to find the matching local backup dir. `None` on
/// a fresh first-time install. `#[serde(default)]` for the same
/// old-shape-json reason as `track` above.
#[serde(default)]
pub previous_version: Option<String>,
/// SHA-256 (hex) of each installed binary, captured at install time.
/// `bakery verify` recomputes these from disk and compares against this
/// recorded value rather than a fresh index lookup — the index only
/// carries the checksum for whatever the *current latest* release is,
/// which may not match what's actually installed. Empty on installs
/// that predate this field.
#[serde(default)]
pub binary_sha256: HashMap<String, String>,
}
#[derive(Debug, Default, Deserialize, Serialize)]
pub struct State {
// `#[serde(default)]` lets an installed.json written by a pre-track
// bakery binary deserialize straight into Track::Stable with no
// migration step.
#[serde(default)]
pub track: Track,
pub packages: HashMap<String, InstalledPackage>,
}
@ -55,36 +29,16 @@ impl State {
pub fn save(&self) -> Result<()> {
let path = state_path();
let text = serde_json::to_string_pretty(self)?;
bread_utils::atomic::write_atomic(&path, &text, None).context("writing installed.json")
}
/// Runs `f` against a freshly-loaded `State` while holding an exclusive
/// lock on a sibling `installed.json.lock` file, saving the result if `f`
/// succeeds. Without this, two concurrent `bakery` invocations each
/// load-mutate-save `installed.json` independently and the second save
/// silently drops the first's change — the lock serializes the whole
/// read-modify-write instead of just the final write.
pub fn with_lock<T>(f: impl FnOnce(&mut State) -> Result<T>) -> Result<T> {
let lock_path = PathBuf::from(format!("{}.lock", state_path().display()));
if let Some(dir) = lock_path.parent() {
if let Some(dir) = path.parent() {
std::fs::create_dir_all(dir)?;
}
let lock_file = std::fs::OpenOptions::new()
.create(true)
.write(true)
.truncate(false)
.open(&lock_path)
.context("opening installed.json.lock")?;
lock_file
.lock_exclusive()
.context("locking installed.json.lock")?;
let mut state = Self::load()?;
let result = f(&mut state)?;
state.save()?;
// Lock releases when `lock_file` drops at end of scope.
Ok(result)
let text = serde_json::to_string_pretty(self)?;
// Write to a temp file then rename for atomicity — avoids a torn write
// if the process is killed mid-save.
let tmp = path.with_extension("tmp");
std::fs::write(&tmp, &text).context("writing installed.json.tmp")?;
std::fs::rename(&tmp, &path).context("atomically replacing installed.json")?;
Ok(())
}
pub fn is_installed(&self, name: &str) -> bool {
@ -98,40 +52,16 @@ impl State {
pub fn remove(&mut self, name: &str) -> Option<InstalledPackage> {
self.packages.remove(name)
}
pub fn set_track(&mut self, track: Track) {
self.track = track;
}
}
fn state_base_dir() -> PathBuf {
dirs::state_dir().unwrap_or_else(|| {
dirs::home_dir()
.unwrap_or_else(|| PathBuf::from("~"))
.join(".local/state")
})
}
fn state_path() -> PathBuf {
bakery_state_dir().join("installed.json")
}
/// Per-user bakery state dir (`~/.local/state/bakery`). Independent of the
/// install prefix — system-prefix installs still record what this user asked for.
pub fn bakery_state_dir() -> PathBuf {
state_base_dir().join("bakery")
}
/// Local backup dir for `pkg_name`'s `version` binaries, populated by
/// `install::install_package` right before an update overwrites the
/// previous binaries and consumed by `bakery rollback`. See
/// `install::backup_current_binary`'s doc comment for why this is a local
/// snapshot rather than a re-fetch of the old version from the server.
pub fn backup_dir(pkg_name: &str, version: &str) -> PathBuf {
state_base_dir()
.join("bakery/backups")
.join(pkg_name)
.join(version)
dirs::state_dir()
.unwrap_or_else(|| {
dirs::home_dir()
.unwrap_or_else(|| PathBuf::from("~"))
.join(".local/state")
})
.join("bakery/installed.json")
}
#[cfg(test)]
@ -145,9 +75,6 @@ mod tests {
binaries: vec![],
services: vec![],
installed_at: "2026-01-01T00:00:00Z".to_string(),
track: Track::Stable,
previous_version: None,
binary_sha256: HashMap::new(),
}
}
@ -174,23 +101,6 @@ mod tests {
assert!(state.remove("nope").is_none());
}
#[test]
fn track_defaults_to_stable_on_old_shape_json() {
// Simulates installed.json written before the track field existed.
let old_shape = r#"{"packages":{}}"#;
let state: State = serde_json::from_str(old_shape).unwrap();
assert_eq!(state.track, Track::Stable);
}
#[test]
fn set_track_updates_and_roundtrips() {
let mut state = State::default();
state.set_track(Track::Dev);
let json = serde_json::to_string(&state).unwrap();
let restored: State = serde_json::from_str(&json).unwrap();
assert_eq!(restored.track, Track::Dev);
}
#[test]
fn json_roundtrip() {
let mut state = State::default();
@ -200,76 +110,11 @@ mod tests {
binaries: vec!["bar".to_string()],
services: vec!["bar.service".to_string()],
installed_at: "2026-06-01T00:00:00Z".to_string(),
track: Track::Beta,
previous_version: Some("1.0.0".to_string()),
binary_sha256: HashMap::from([("bar".to_string(), "abc123".to_string())]),
});
let json = serde_json::to_string(&state).unwrap();
let restored: State = serde_json::from_str(&json).unwrap();
assert!(restored.is_installed("bar"));
assert_eq!(restored.packages["bar"].version, "2.0.0");
assert_eq!(restored.packages["bar"].services, ["bar.service"]);
assert_eq!(restored.packages["bar"].track, Track::Beta);
assert_eq!(
restored.packages["bar"].previous_version.as_deref(),
Some("1.0.0")
);
assert_eq!(restored.packages["bar"].binary_sha256["bar"], "abc123");
}
#[test]
fn installed_package_track_defaults_to_stable_on_old_shape_json() {
// Simulates an installed.json entry written before per-package track
// tracking existed.
let old_shape = r#"{"name":"foo","version":"1.0.0","binaries":[],"services":[],"installed_at":"2026-01-01T00:00:00Z"}"#;
let installed: InstalledPackage = serde_json::from_str(old_shape).unwrap();
assert_eq!(installed.track, Track::Stable);
}
#[test]
fn installed_package_previous_version_and_binary_sha256_default_on_old_shape_json() {
// Simulates an installed.json entry written before rollback/verify
// support existed.
let old_shape = r#"{"name":"foo","version":"1.0.0","binaries":[],"services":[],"installed_at":"2026-01-01T00:00:00Z","track":"stable"}"#;
let installed: InstalledPackage = serde_json::from_str(old_shape).unwrap();
assert!(installed.previous_version.is_none());
assert!(installed.binary_sha256.is_empty());
}
#[test]
fn bakery_state_dir_is_under_state_home_and_independent_of_prefix() {
let dir = bakery_state_dir();
assert!(dir.ends_with("bakery"));
// Must not follow BAKERY_PREFIX — state is always per-user.
assert!(!dir.starts_with("/usr/local"));
}
#[test]
fn backup_dir_is_distinct_per_package_and_version() {
let a = backup_dir("bakery", "0.3.1");
let b = backup_dir("bakery", "0.3.2");
let c = backup_dir("breadhelp", "0.3.1");
assert_ne!(a, b);
assert_ne!(a, c);
assert!(a.ends_with("bakery/backups/bakery/0.3.1"));
}
#[test]
fn with_lock_persists_mutation_across_reload() {
let dir = tempfile::tempdir().unwrap();
// SAFETY (test-only): temporarily redirects the state dir env var so
// this test doesn't touch the real ~/.local/state/bakery/installed.json.
std::env::set_var("XDG_STATE_HOME", dir.path());
State::with_lock(|state| {
state.record(pkg("foo", "1.0.0"));
Ok(())
})
.unwrap();
let reloaded = State::load().unwrap();
assert!(reloaded.is_installed("foo"));
std::env::remove_var("XDG_STATE_HOME");
}
}

85
bakery/src/track.rs
View file

@ -1,85 +0,0 @@
use clap::ValueEnum;
use serde::{Deserialize, Serialize};
use std::fmt;
use std::str::FromStr;
/// Which build of a package bakery follows: the tagged stable release, a
/// deliberately-promoted beta, or the continuously-published `dev` branch
/// build. Not to be confused with the *distribution* channel (bakery vs.
/// pacman) documented in `docs/release-channels.md` — that's an orthogonal,
/// pre-existing use of the word "channel", which is why this is called a
/// "track" instead.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Deserialize, Serialize, ValueEnum)]
#[serde(rename_all = "lowercase")]
pub enum Track {
#[default]
Stable,
Beta,
Dev,
}
impl Track {
pub fn as_str(&self) -> &'static str {
match self {
Track::Stable => "stable",
Track::Beta => "beta",
Track::Dev => "dev",
}
}
}
impl fmt::Display for Track {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
f.write_str(self.as_str())
}
}
impl FromStr for Track {
type Err = String;
fn from_str(s: &str) -> Result<Self, Self::Err> {
match s.to_lowercase().as_str() {
"stable" => Ok(Track::Stable),
"beta" => Ok(Track::Beta),
"dev" => Ok(Track::Dev),
other => Err(format!("unknown track '{other}' — expected stable, beta, or dev")),
}
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn default_is_stable() {
assert_eq!(Track::default(), Track::Stable);
}
#[test]
fn display_roundtrips_through_from_str() {
for track in [Track::Stable, Track::Beta, Track::Dev] {
let s = track.to_string();
assert_eq!(s.parse::<Track>().unwrap(), track);
}
}
#[test]
fn from_str_is_case_insensitive() {
assert_eq!("DEV".parse::<Track>().unwrap(), Track::Dev);
assert_eq!("Beta".parse::<Track>().unwrap(), Track::Beta);
}
#[test]
fn from_str_rejects_unknown() {
assert!("nightly".parse::<Track>().is_err());
}
#[test]
fn json_roundtrip_uses_lowercase() {
let json = serde_json::to_string(&Track::Dev).unwrap();
assert_eq!(json, "\"dev\"");
let back: Track = serde_json::from_str(&json).unwrap();
assert_eq!(back, Track::Dev);
}
}

457
bakery/src/ui.rs
View file

@ -1,457 +0,0 @@
use crate::track::Track;
use clap::builder::styling::{AnsiColor, Effects, Styles};
use std::io::{IsTerminal, Write};
pub const RESET: &str = "\x1b[0m";
pub const BOLD: &str = "\x1b[1m";
pub const DIM: &str = "\x1b[2m";
pub const RED: &str = "\x1b[31m";
pub const GREEN: &str = "\x1b[32m";
pub const YELLOW: &str = "\x1b[33m";
pub const CYAN: &str = "\x1b[36m";
pub const MAGENTA: &str = "\x1b[35m";
pub const BOLD_CYAN: &str = "\x1b[1;36m";
/// Clap help styling — same cyan headers / green literals / dim placeholders
/// as the rest of bakery, so `bakery --help` doesn't look like a different
/// program from `bakery list`.
pub const CLAP_STYLES: Styles = Styles::styled()
.header(AnsiColor::Cyan.on_default().effects(Effects::BOLD))
.usage(AnsiColor::Cyan.on_default().effects(Effects::BOLD))
.literal(AnsiColor::Green.on_default().effects(Effects::BOLD))
.placeholder(AnsiColor::BrightBlack.on_default())
.error(AnsiColor::Red.on_default().effects(Effects::BOLD))
.valid(AnsiColor::Green.on_default().effects(Effects::BOLD))
.invalid(AnsiColor::Yellow.on_default().effects(Effects::BOLD));
/// Colors are on only when stdout is a real terminal and `NO_COLOR` isn't
/// set — the ecosystem's existing CLI (breadcrumbs) hardcodes ANSI
/// unconditionally, which leaks escape codes into piped/logged output; this
/// is the hardening fix for that gap.
pub fn colors_enabled() -> bool {
std::env::var_os("NO_COLOR").is_none() && std::io::stdout().is_terminal()
}
pub fn colors_enabled_err() -> bool {
std::env::var_os("NO_COLOR").is_none() && std::io::stderr().is_terminal()
}
pub fn style(s: &str, code: &str) -> String {
paint(s, code, colors_enabled())
}
fn style_err(s: &str, code: &str) -> String {
paint(s, code, colors_enabled_err())
}
fn paint(s: &str, code: &str, on: bool) -> String {
if on {
format!("{code}{s}{RESET}")
} else {
s.to_string()
}
}
pub fn bold(s: &str) -> String {
style(s, BOLD)
}
pub fn dim(s: &str) -> String {
style(s, DIM)
}
/// `" [beta]"` / `" [dev]"`, colored — empty string for `Stable` so the
/// common-case output is unchanged.
#[allow(dead_code)]
pub fn track_badge(track: Track) -> String {
let tag = track_tag(track);
if tag.is_empty() {
tag
} else {
format!(" {tag}")
}
}
/// `[beta]` / `[dev]` with no leading space; empty for `Stable`.
pub fn track_tag(track: Track) -> String {
match track {
Track::Stable => String::new(),
Track::Beta => style("[beta]", YELLOW),
Track::Dev => style("[dev]", MAGENTA),
}
}
pub fn ok(s: &str) -> String {
style(&format!("✓ {s}"), GREEN)
}
pub fn fail(s: &str) -> String {
style(&format!("✗ {s}"), RED)
}
/// Neutral "nothing to do" glyph, dim rather than green — for steady-state
/// noise like "already at latest" in `bakery update --all`, where most
/// packages hit this every run. Reusing GREEN there drowns out the
/// packages that actually changed, and meaning shouldn't depend on color
/// alone (an unusual terminal palette can make BOLD/GREEN/DIM look similar),
/// so this also carries its own glyph the way `ok`/`fail` do.
pub fn unchanged(s: &str) -> String {
style(&format!("· {s}"), DIM)
}
pub fn warn(s: &str) -> String {
style(&format!("warning: {s}"), YELLOW)
}
pub fn note(s: &str) -> String {
style(&format!("note: {s}"), DIM)
}
/// Cyan verb + bold name + dim version — the install/update/remove banner.
pub fn action(verb: &str, name: &str, version: Option<&str>) {
let mut line = format!("{} {}", style(verb, BOLD_CYAN), style(name, BOLD));
if let Some(v) = version {
line.push_str(" ");
line.push_str(&style(v, DIM));
}
println!("{line}");
}
/// Section title plus dim meta (`Packages 16 · 15 installed`).
pub fn heading(title: &str, parts: &[&str]) {
let mut line = style(title, BOLD_CYAN);
let visible: Vec<&str> = parts.iter().copied().filter(|p| !p.is_empty()).collect();
for (i, part) in visible.iter().enumerate() {
line.push_str(" ");
if i > 0 {
line.push_str(&style("·", DIM));
line.push_str(" ");
}
line.push_str(part);
}
println!("{line}");
println!();
}
pub fn summary(parts: &[&str]) {
let visible: Vec<&str> = parts.iter().copied().filter(|p| !p.is_empty()).collect();
if visible.is_empty() {
return;
}
println!();
println!("{}", style(&visible.join(" · "), BOLD));
}
/// Left-aligned verb column so install chatter (`downloading` / `placed` /
/// `unit`) lines up instead of drifting with the verb length.
pub fn step(verb: &str, detail: &str) {
println!(" {:<12} {}", dim(verb), detail);
}
pub fn kv(key: &str, value: &str) {
println!(" {:<12} {}", dim(key), value);
}
pub fn check_row(ok_flag: bool, name: &str, name_width: usize, message: &str) {
let glyph = if ok_flag {
style("✓", GREEN)
} else {
style("✗", RED)
};
println!(" {glyph} {:<name_width$} {message}", name);
}
pub fn unknown_row(name: &str, name_width: usize, message: &str) {
println!(
" {} {:<name_width$} {}",
style("?", DIM),
name,
dim(message)
);
}
pub struct CatalogRow {
pub name: String,
pub version: String,
pub installed: bool,
/// Wrapped onto following lines (descriptions).
pub detail: String,
/// Same-line suffix after the version (short dates). Empty for catalog
/// views that already use `detail`.
pub aside: String,
}
/// Two-line catalog: status glyph + aligned name/version, then a hanging
/// description (or date) wrapped to the terminal width. Column widths are
/// computed from the row set so long `-dev.` versions no longer smash the
/// old `{: <10}` pad.
pub fn print_catalog(rows: &[CatalogRow]) {
for line in format_catalog(rows, term_width()) {
println!("{line}");
}
}
pub fn format_catalog(rows: &[CatalogRow], width: usize) -> Vec<String> {
if rows.is_empty() {
return Vec::new();
}
let name_w = rows.iter().map(|r| r.name.len()).max().unwrap_or(0);
let indent = 5; // " ✓ " / " "
let detail_width = width.saturating_sub(indent).max(24);
let mut lines = Vec::new();
for row in rows {
let glyph = if row.installed {
style("✓", GREEN)
} else {
" ".to_string()
};
let name = style(&format!("{:<name_w$}", row.name), BOLD);
let version = style(&row.version, DIM);
let mut line = format!(" {glyph} {name} {version}");
if !row.aside.is_empty() {
line.push_str(" ");
line.push_str(&dim(&row.aside));
}
lines.push(line);
if !row.detail.is_empty() {
for wrapped in wrap_words(&row.detail, detail_width) {
lines.push(format!(" {}", dim(&wrapped)));
}
}
}
lines
}
pub fn wrap_words(text: &str, width: usize) -> Vec<String> {
if width == 0 {
return vec![text.to_string()];
}
let mut lines = Vec::new();
let mut cur = String::new();
for word in text.split_whitespace() {
if cur.is_empty() {
cur = word.to_string();
} else if cur.len() + 1 + word.len() <= width {
cur.push(' ');
cur.push_str(word);
} else {
lines.push(std::mem::take(&mut cur));
cur = word.to_string();
}
}
if !cur.is_empty() {
lines.push(cur);
}
lines
}
pub fn short_date(rfc3339: &str) -> String {
chrono::DateTime::parse_from_rfc3339(rfc3339)
.map(|dt| dt.format("%Y-%m-%d").to_string())
.unwrap_or_else(|_| rfc3339.to_string())
}
pub fn name_width<S: AsRef<str>>(names: impl IntoIterator<Item = S>) -> usize {
names
.into_iter()
.map(|s| s.as_ref().len())
.max()
.unwrap_or(0)
}
/// `\r`-overwritten download bar on stderr. Pads to a stable width so a
/// shorter later frame doesn't leave leftover characters from a longer one.
pub fn print_progress(downloaded: u64, total: u64) {
let width = term_width().clamp(40, 72);
let line = progress_line(downloaded, total, 20);
let padded = fit_width(&line, width);
eprint!("\r{padded}");
let _ = std::io::stderr().flush();
}
pub fn finish_progress() {
eprintln!();
}
pub fn progress_line(downloaded: u64, total: u64, bar_width: usize) -> String {
let dl = downloaded as f64 / 1_048_576.0;
let tot = total as f64 / 1_048_576.0;
let frac = if total == 0 {
0.0
} else {
(downloaded as f64 / total as f64).clamp(0.0, 1.0)
};
let filled = ((bar_width as f64) * frac).round() as usize;
let filled = filled.min(bar_width);
let bar = format!("{}{}", "█".repeat(filled), "░".repeat(bar_width - filled));
let pct = (frac * 100.0).round() as u32;
format!(
" ⇣ {} {:>3}% {:.1}/{:.1} MB",
style_err(&bar, CYAN),
pct,
dl,
tot
)
}
fn fit_width(s: &str, width: usize) -> String {
let visible = visible_len(s);
if visible >= width {
return s.to_string();
}
format!("{s}{}", " ".repeat(width - visible))
}
fn visible_len(s: &str) -> usize {
let mut n = 0;
let mut chars = s.chars().peekable();
while let Some(c) = chars.next() {
if c == '\u{1b}' {
if chars.peek() == Some(&'[') {
chars.next();
for next in chars.by_ref() {
if next.is_ascii_alphabetic() {
break;
}
}
}
continue;
}
n += 1;
}
n
}
pub fn term_width() -> usize {
if let Ok(w) = std::env::var("COLUMNS") {
if let Ok(n) = w.parse::<usize>() {
if n >= 40 {
return n;
}
}
}
ioctl_width().filter(|&n| n >= 40).unwrap_or(80)
}
#[cfg(unix)]
fn ioctl_width() -> Option<usize> {
use std::os::fd::AsRawFd;
#[repr(C)]
struct WinSize {
row: u16,
col: u16,
x: u16,
y: u16,
}
unsafe extern "C" {
fn ioctl(fd: i32, request: u64, argp: *mut WinSize) -> i32;
}
let mut ws = WinSize {
row: 0,
col: 0,
x: 0,
y: 0,
};
// TIOCGWINSZ on Linux.
let fd = std::io::stdout().as_raw_fd();
let ret = unsafe { ioctl(fd, 0x5413, &mut ws) };
if ret == 0 && ws.col > 0 {
Some(ws.col as usize)
} else {
None
}
}
#[cfg(not(unix))]
fn ioctl_width() -> Option<usize> {
None
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn stable_badge_is_empty() {
assert_eq!(track_badge(Track::Stable), "");
}
#[test]
fn dev_badge_is_nonempty() {
assert!(!track_badge(Track::Dev).is_empty());
}
#[test]
fn unchanged_carries_a_distinct_glyph_from_ok_and_fail() {
// Meaning must survive even with colors stripped (NO_COLOR, or a
// terminal palette that makes ANSI codes look alike) — so the glyph
// itself has to differ, not just the color.
assert!(unchanged("foo").contains('·'));
assert!(!ok("foo").contains('·'));
assert!(!fail("foo").contains('·'));
}
#[test]
fn catalog_aligns_names_and_versions() {
let lines = format_catalog(
&[
CatalogRow {
name: "bakery".into(),
version: "0.7.2-dev.20260815142350+30517f1".into(),
installed: true,
detail: "Package manager".into(),
aside: String::new(),
},
CatalogRow {
name: "breadarr".into(),
version: "0.1.2".into(),
installed: false,
detail: "Homelab arr stack".into(),
aside: String::new(),
},
],
80,
);
assert_eq!(lines.len(), 4);
assert!(lines[0].contains("bakery"));
assert!(lines[0].contains("0.7.2-dev.20260815142350+30517f1"));
assert!(lines[1].contains("Package manager"));
// Shorter version is padded so the columns stay a block, not a
// ragged list — the long bakery version used to overflow `{: <10}`.
// Compare display columns, not byte offsets: the installed glyph
// is a 3-byte checkmark sitting in a 1-column slot.
let bakery_col = visible_len(&lines[0][..lines[0].find("0.7.2-dev").unwrap()]);
let breadarr_col = visible_len(&lines[2][..lines[2].find("0.1.2").unwrap()]);
assert_eq!(bakery_col, breadarr_col);
}
#[test]
fn wrap_words_breaks_on_width() {
let lines = wrap_words("one two three four", 9);
assert_eq!(lines, vec!["one two", "three", "four"]);
}
#[test]
fn progress_line_has_bar_and_percent() {
let line = progress_line(1_048_576, 2_097_152, 10);
assert!(line.contains('█'));
assert!(line.contains('░'));
assert!(line.contains("50%"));
assert!(line.contains("1.0/2.0 MB"));
}
#[test]
fn visible_len_ignores_ansi() {
assert_eq!(visible_len("hello"), 5);
assert_eq!(visible_len(&format!("{CYAN}hello{RESET}")), 5);
}
#[test]
fn short_date_from_rfc3339() {
assert_eq!(short_date("2026-08-15T14:23:50+00:00"), "2026-08-15");
}
}

20
bread-app/Cargo.toml
View file

@ -1,20 +0,0 @@
[package]
name = "bread-app"
version.workspace = true
edition.workspace = true
license.workspace = true
authors.workspace = true
description = "GTK application bootstrap for bread desktop tools: app id, singleton, optional overlay popup, and command listen loop"
repository = "https://git.breadway.dev/Breadway/bread-ecosystem"
keywords = ["gtk4", "wayland", "hyprland"]
[dependencies]
bread-utils = { path = "../bread-utils" }
[features]
# Layer-shell overlay helper (`gtk_popup`). Matches `bread-utils/gtk` so a
# consumer that only wants app-id / singleton helpers does not pull GTK4.
gtk = ["bread-utils/gtk"]
# `BreadClient` listen loop on `bread.command.<app>.**`. Matches
# `bread-utils/bread-client`.
bread-client = ["bread-utils/bread-client"]

121
bread-app/src/command.rs
View file

@ -1,121 +0,0 @@
//! Command-bus helpers for `bread.command.<app>.**`.
//!
//! The `command_id` here is the breadd sibling-app id (`clip`, `box`,
//! `shot`) — often shorter than the GTK / singleton name (`breadclip`).
use crate::id::{parse_app_name, InvalidAppId};
use bread_utils::bread_client::{BreadClient, BreadEvent, Subscription};
/// Same charset as [`parse_app_name`]: a single command-bus segment.
pub fn parse_command_id(command_id: &str) -> Result<&str, InvalidAppId> {
parse_app_name(command_id)
}
/// Subscribe glob: `bread.command.<app>.**`.
pub fn command_pattern(command_id: &str) -> Result<String, InvalidAppId> {
let id = parse_command_id(command_id)?;
Ok(format!("bread.command.{id}.**"))
}
/// The verb segment of `bread.command.<app>.<verb>` (and extra trailing
/// segments, if any). `None` when the event is not addressed to
/// `command_id` or the verb is missing.
///
/// Extra dotted remainder (`bread.command.clip.stack.clear`) yields the
/// first remaining segment (`stack`) — a verb is one segment, matching
/// [`BreadClient::command`].
pub fn command_verb<'a>(event: &'a str, command_id: &str) -> Option<&'a str> {
if command_id.is_empty() {
return None;
}
let prefix = format!("bread.command.{command_id}.");
let rest = event.strip_prefix(&prefix)?;
let verb = rest.split('.').next()?;
if verb.is_empty() {
None
} else {
Some(verb)
}
}
/// Subscribe to `bread.command.<command_id>.**` and invoke `on_verb` with
/// the parsed verb plus the raw event.
///
/// Fail-silent: constructing the client and holding the subscription never
/// requires breadd to be running. Drop the returned [`Subscription`] (or
/// call [`Subscription::stop`]) to end the loop.
pub fn listen_commands<F>(command_id: &str, on_verb: F) -> Result<Subscription, InvalidAppId>
where
F: Fn(&str, BreadEvent) + Send + 'static,
{
let id = parse_command_id(command_id)?.to_string();
let client = BreadClient::connect(id.clone());
let pattern = format!("bread.command.{id}.**");
Ok(client.subscribe(pattern, move |event| {
let Some(verb) = command_verb(&event.event, &id).map(str::to_owned) else {
return;
};
on_verb(&verb, event);
}))
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn command_pattern_uses_double_star() {
assert_eq!(command_pattern("clip").unwrap(), "bread.command.clip.**");
assert_eq!(command_pattern("shot").unwrap(), "bread.command.shot.**");
}
#[test]
fn command_pattern_rejects_invalid_id() {
assert!(command_pattern("").is_err());
assert!(command_pattern("clip.clear").is_err());
}
#[test]
fn command_verb_strips_app_prefix() {
assert_eq!(
command_verb("bread.command.clip.clear", "clip"),
Some("clear")
);
assert_eq!(
command_verb("bread.command.shot.region", "shot"),
Some("region")
);
assert_eq!(
command_verb("bread.command.shot.annotate", "shot"),
Some("annotate")
);
}
#[test]
fn command_verb_takes_first_segment_only() {
assert_eq!(
command_verb("bread.command.clip.stack.clear", "clip"),
Some("stack")
);
}
#[test]
fn command_verb_rejects_other_apps_and_missing_verb() {
assert_eq!(command_verb("bread.command.clip.clear", "shot"), None);
assert_eq!(command_verb("bread.command.clip", "clip"), None);
assert_eq!(command_verb("bread.command.clip.", "clip"), None);
assert_eq!(command_verb("bread.clip.copied", "clip"), None);
assert_eq!(command_verb("bread.command.clip.clear", ""), None);
}
#[test]
fn listen_commands_rejects_invalid_id() {
assert!(listen_commands("", |_, _| {}).is_err());
}
#[test]
fn listen_commands_stop_joins_without_a_daemon() {
let sub = listen_commands("clip", |_, _| {}).unwrap();
sub.stop();
}
}

145
bread-app/src/id.rs
View file

@ -1,145 +0,0 @@
//! App-id helpers shared by GTK tools and the singleton lock.
//!
//! The process / pid-file name (`breadbox`, `bread-polkit`) is also the
//! last segment of the GApplication id (`com.breadway.breadbox`). That is
//! *not* always the breadd command-bus id (`box`, `clip`) — see
//! [`crate::command_verb`] under feature `bread-client`.
use std::io;
use crate::singleton::{self, Acquire, Toggle};
/// Why [`parse_app_name`] / [`application_id`] rejected a string.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct InvalidAppId {
/// The rejected input, owned so the error is `'static`.
pub name: String,
/// Short reason suitable for an `io::Error` / clap message.
pub reason: &'static str,
}
impl std::fmt::Display for InvalidAppId {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
write!(f, "invalid app id '{}': {}", self.name, self.reason)
}
}
impl std::error::Error for InvalidAppId {}
/// Accept a process / GTK application name (`breadbox`, `bread-polkit`).
///
/// Rules match a GApplication id *element*: non-empty, ASCII letter first,
/// then ASCII alphanumeric / `-` / `_`. Dots are rejected so the name can
/// sit in `com.breadway.<name>` without creating extra segments.
pub fn parse_app_name(name: &str) -> Result<&str, InvalidAppId> {
if name.is_empty() {
return Err(InvalidAppId {
name: name.to_string(),
reason: "must not be empty",
});
}
let mut chars = name.chars();
let first = chars.next().expect("non-empty");
if !first.is_ascii_alphabetic() {
return Err(InvalidAppId {
name: name.to_string(),
reason: "must start with an ASCII letter",
});
}
if !chars.all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_') {
return Err(InvalidAppId {
name: name.to_string(),
reason: "only ASCII letters, digits, '-' and '_' are allowed",
});
}
Ok(name)
}
/// Reverse-DNS GApplication id: `com.breadway.<name>`.
pub fn application_id(app_name: &str) -> Result<String, InvalidAppId> {
let name = parse_app_name(app_name)?;
Ok(format!("com.breadway.{name}"))
}
/// [`singleton::try_acquire`] after [`parse_app_name`].
///
/// Invalid names become [`io::ErrorKind::InvalidInput`] and never touch
/// the pid file.
pub fn try_acquire(app_name: &str) -> io::Result<Acquire> {
let name =
parse_app_name(app_name).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
singleton::try_acquire(name)
}
/// [`singleton::toggle_or_kill`] after [`parse_app_name`].
pub fn toggle_or_kill(app_name: &str) -> io::Result<Toggle> {
let name =
parse_app_name(app_name).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
singleton::toggle_or_kill(name)
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn parse_app_name_accepts_existing_tool_names() {
for name in ["breadbox", "breadclip", "bread-polkit", "breadcast"] {
assert_eq!(parse_app_name(name), Ok(name));
}
}
#[test]
fn parse_app_name_rejects_empty_dot_and_leading_digit() {
assert!(parse_app_name("").is_err());
assert!(parse_app_name("bread.box").is_err());
assert!(parse_app_name("1box").is_err());
assert!(parse_app_name("-box").is_err());
assert!(parse_app_name("bread box").is_err());
}
#[test]
fn application_id_uses_com_breadway_prefix() {
assert_eq!(application_id("breadbox").unwrap(), "com.breadway.breadbox");
assert_eq!(
application_id("bread-polkit").unwrap(),
"com.breadway.bread-polkit"
);
}
#[test]
fn application_id_rejects_invalid_name() {
assert!(application_id("").is_err());
assert!(application_id("bread.box").is_err());
}
#[test]
fn try_acquire_rejects_invalid_name_before_lock() {
match try_acquire("") {
Err(err) => assert_eq!(err.kind(), io::ErrorKind::InvalidInput),
Ok(_) => panic!("empty name must not acquire a lock"),
}
match try_acquire("bread.box") {
Err(err) => assert_eq!(err.kind(), io::ErrorKind::InvalidInput),
Ok(_) => panic!("dotted name must not acquire a lock"),
}
}
#[test]
fn try_acquire_accepts_valid_name() {
let name = format!("bread-app-id-test-{}", std::process::id());
match try_acquire(&name).unwrap() {
Acquire::Acquired(_guard) => {}
Acquire::HeldByOther(_) => panic!("expected first acquire to succeed"),
}
}
#[test]
fn toggle_or_kill_starts_when_nothing_else_is_running() {
let name = format!("bread-app-toggle-test-{}", std::process::id());
match toggle_or_kill(&name).unwrap() {
Toggle::Started(_guard) => {}
Toggle::KilledExisting => panic!("expected to start as the first instance"),
}
}
}

67
bread-app/src/lib.rs
View file

@ -1,67 +0,0 @@
//! GTK application bootstrap for bread desktop tools.
//!
//! New GTK tools should depend on this crate instead of copying a sixth
//! `main.rs` that wires a `com.breadway.*` application id, a
//! [`bread_utils::singleton`] lock, a layer-shell overlay, and a
//! `bread.command.<app>.**` listen loop.
//!
//! # What this is
//!
//! The pieces every bread GTK binary already copies:
//!
//! - [`application_id`] / [`parse_app_name`] — reverse-DNS id
//! (`com.breadway.breadbox`) and the same name used for the singleton
//! pid file.
//! - [`try_acquire`] / [`toggle_or_kill`] — [`bread_utils::singleton`]
//! wrappers that reject an invalid name before touching the lock.
//! - feature `gtk` — re-exports [`gtk_popup`] (`bread_utils::gtk_popup`)
//! for the full-screen overlay breadbox / breadclip / breadcast start
//! from.
//! - feature `bread-client` — [`listen_commands`] plus [`command_verb`] /
//! [`command_pattern`] so a tool can honor `bread.command.<app>.**`
//! without re-deriving the prefix strip.
//!
//! This crate does **not** migrate existing apps. Callers still own their
//! widgets, CSS, and clap. Screenshot / `--screenshot` helpers stay in
//! [`bread_utils::screenshot_cli`].
//!
//! # Example
//!
//! ```ignore
//! let _guard = match bread_app::try_acquire("breadbox")? {
//! bread_app::singleton::Acquire::Acquired(g) => g,
//! bread_app::singleton::Acquire::HeldByOther(_) => return Ok(()),
//! };
//! let app = gtk4::Application::builder()
//! .application_id(&bread_app::application_id("breadbox")?)
//! .build();
//!
//! #[cfg(feature = "gtk")]
//! app.connect_activate(|app| {
//! let window = bread_app::gtk_popup::new_overlay_window(app, "breadbox");
//! window.present();
//! });
//!
//! #[cfg(feature = "bread-client")]
//! let _commands = bread_app::listen_commands("box", |verb, event| {
//! // verb is the single segment after `bread.command.box.`
//! let _ = (verb, event);
//! })?;
//! ```
pub use bread_utils::singleton;
#[cfg(feature = "gtk")]
pub use bread_utils::gtk_popup;
mod id;
pub use id::{application_id, parse_app_name, toggle_or_kill, try_acquire, InvalidAppId};
#[cfg(feature = "bread-client")]
mod command;
#[cfg(feature = "bread-client")]
pub use bread_utils::bread_client::{BreadClient, BreadEvent, Subscription};
#[cfg(feature = "bread-client")]
pub use command::{command_pattern, command_verb, listen_commands, parse_command_id};

21
bread-capture/Cargo.toml
View file

@ -1,21 +0,0 @@
[package]
name = "bread-capture"
version.workspace = true
edition.workspace = true
license.workspace = true
authors.workspace = true
description = "Orchestrator for the bread ecosystem's UI screenshot tooling: drives each app's --screenshot mode and collects the resulting PNGs"
repository = "https://git.breadway.dev/Breadway/bread-ecosystem"
keywords = ["screenshot", "ci", "tooling"]
[[bin]]
name = "bread-capture"
path = "src/main.rs"
[dependencies]
bread-utils = { path = "../bread-utils" }
clap = { workspace = true }
anyhow = { workspace = true }
# Generates the isolated capture canvas's rainbow-gradient background — see
# isolation.rs. png-only: no decoding, no other format support needed.
image = { version = "0.25", default-features = false, features = ["png"] }

233
bread-capture/src/isolation.rs
View file

@ -1,233 +0,0 @@
//! Runs each capture target inside a headless Sway instance instead of the
//! operator's live desktop, so nothing on their screen (other windows, a
//! differently-themed real bar, whatever's behind a popover) can leak into a
//! capture, and the capture never flashes across their desktop either.
//!
//! This replaced an earlier nested-Hyprland approach (see git history for
//! `feature/capture-isolation` if you want the gory details). That worked,
//! but Hyprland's own backend library (Aquamarine) has no genuinely headless
//! mode when a live session already holds the seat — the only path was
//! nesting a full second Hyprland as an ordinary Wayland *client* of the
//! outer session, which meant: the outer compositor deciding the nested
//! window's pixel size (so every capture needed an outer-session
//! float+resize dispatch), the outer compositor throttling frame callbacks
//! for occluded surfaces (so the nested window also had to be *focused*, or
//! `grim` run inside it hung forever waiting on a frame that never came),
//! and — the thing that ultimately motivated dropping this approach — no way
//! to fully suppress the brief real, visible flash of that window on the
//! operator's actual screen (Lua-config Hyprland has no `keyword`-based
//! pre-emptive windowrule injection, and parking it on an untoggled special
//! workspace produced broken, half-rendered captures instead).
//!
//! wlroots (which Sway, not Hyprland, is built directly on) has a real
//! headless backend: `WLR_BACKENDS=headless` skips DRM and Wayland-client
//! backends entirely and synthesizes a virtual output with no seat/DRM-master
//! claim at all — no fight with logind over the live session's seat, and no
//! window anywhere, nested or otherwise, for the operator to ever see. Empirically
//! confirmed on this machine: zero visible footprint, `zwlr_layer_shell_v1`
//! and `zwlr_screencopy_manager_v1` both present (so a layer-shell bar and
//! `grim` both work), and a manual `grim` capture against it completes
//! instantly with no focus/occlusion dance required.
//!
//! One consequence of not nesting inside Hyprland at all: breadbar's
//! workspace list (`src/bar/workspaces.rs`, via the `hyprland` crate) talks
//! to whatever `HYPRLAND_INSTANCE_SIGNATURE` points at. Left alone, that
//! still points at the operator's real, live Hyprland instance — a data leak
//! into an otherwise-isolated capture (real workspace names/count showing up
//! in a bar screenshot that's supposed to be clean). Sway has no equivalent
//! IPC this needs to keep working, so [`Isolation::start`] unsets it;
//! breadbar already has to tolerate a missing/dead Hyprland connection
//! gracefully (it survives Hyprland restarting), so this just exercises that
//! same fallback path instead of a real error case.
//!
//! The background is a generated rainbow gradient, not a flat colour —
//! deliberately: a solid fill can't tell you whether a window that's
//! *supposed* to be translucent (breadbox/breadclip/breadsearch's
//! full-screen overlay windows, breadbar's notification/OSD surfaces) is
//! actually compositing as translucent, since a flat colour showing through
//! a flat colour still just looks flat. A continuously-varying gradient
//! makes any real transparency immediately obvious (multiple hues bleed
//! through) and any accidentally-opaque surface just as obvious (it blocks
//! the gradient out entirely, a flat rectangle where there should be colour
//! variation).
use anyhow::{bail, Context, Result};
use std::collections::HashSet;
use std::path::{Path, PathBuf};
use std::process::{Child, Command, Stdio};
use std::time::{Duration, Instant};
const DISCOVERY_TIMEOUT: Duration = Duration::from_secs(5);
pub struct Isolation {
child: Child,
pub wayland_display: String,
config_path: PathBuf,
background_path: PathBuf,
runtime_dir: PathBuf,
}
impl Isolation {
/// Spawn the headless instance sized to `width`x`height`, and set
/// `WAYLAND_DISPLAY` on *this* process's own environment (and unset
/// `HYPRLAND_INSTANCE_SIGNATURE`) so every subsequent
/// `bread_utils::proc::run` spawn (the target app, and in turn its own
/// `grim` calls) inherits them and lands inside the isolated instance.
pub fn start(width: u32, height: u32) -> Result<Self> {
let runtime_dir = PathBuf::from(
std::env::var("XDG_RUNTIME_DIR").unwrap_or_else(|_| "/run/user/1000".to_string()),
);
let background_path = write_rainbow_background(width, height)?;
let config_path = write_headless_config(width, height, &background_path)?;
let before_sockets: HashSet<String> = dir_names(&runtime_dir)
.into_iter()
.filter(|n| is_wayland_socket_name(n))
.collect();
let child = Command::new("sway")
.arg("-c")
.arg(&config_path)
.env("WLR_BACKENDS", "headless")
.env("XDG_RUNTIME_DIR", &runtime_dir)
.env_remove("WAYLAND_DISPLAY")
.stdout(Stdio::null())
.stderr(Stdio::null())
.spawn()
.context("spawning headless sway")?;
let mut isolation = Isolation {
child,
wayland_display: String::new(),
config_path,
background_path,
runtime_dir: runtime_dir.clone(),
};
match poll_for_new(&runtime_dir, &before_sockets, DISCOVERY_TIMEOUT, is_wayland_socket_name)
.context("waiting for headless sway's Wayland socket to appear")
{
Ok(name) => isolation.wayland_display = name,
Err(e) => {
// Best-effort teardown of the half-started instance before
// propagating — the normal Drop impl still runs too, but
// doing it here as well means a failure this early doesn't
// depend on isolation ever being bound to a variable that
// outlives this function.
let _ = isolation.child.kill();
let _ = isolation.child.wait();
return Err(e);
}
}
std::env::set_var("WAYLAND_DISPLAY", &isolation.wayland_display);
std::env::remove_var("HYPRLAND_INSTANCE_SIGNATURE");
Ok(isolation)
}
}
impl Drop for Isolation {
fn drop(&mut self) {
let _ = self.child.kill();
let _ = self.child.wait();
let _ = std::fs::remove_file(&self.config_path);
let _ = std::fs::remove_file(&self.background_path);
// Killing sway doesn't unlink the socket it bound — confirmed
// empirically, a killed instance leaves both files behind — so
// without this, every capture run permanently orphans a
// `wayland-N`/`wayland-N.lock` pair in the runtime dir.
if !self.wayland_display.is_empty() {
let _ = std::fs::remove_file(self.runtime_dir.join(&self.wayland_display));
let _ = std::fs::remove_file(self.runtime_dir.join(format!("{}.lock", self.wayland_display)));
}
}
}
fn write_headless_config(width: u32, height: u32, background_path: &Path) -> Result<PathBuf> {
let path = std::env::temp_dir().join(format!("bread-capture-sway-{}.conf", std::process::id()));
let bg = background_path.display();
let contents = format!(
"output HEADLESS-1 resolution {width}x{height}\n\
output HEADLESS-1 bg {bg} stretch\n"
);
std::fs::write(&path, contents).with_context(|| format!("writing {}", path.display()))?;
Ok(path)
}
/// Renders a diagonal rainbow (full hue sweep, both x and y contribute) to a
/// PNG at exactly `width`x`height`, for use as the isolated canvas's
/// background — see the module doc for why a gradient instead of a flat
/// colour. Diagonal rather than a simple left-to-right sweep so a capture
/// showing color variation isn't just luck-of-the-x-position: a purely
/// horizontal gradient would still make a tall, narrow surface look like a
/// near-flat single hue.
fn write_rainbow_background(width: u32, height: u32) -> Result<PathBuf> {
let path = std::env::temp_dir().join(format!("bread-capture-bg-{}.png", std::process::id()));
let mut img = image::RgbImage::new(width.max(1), height.max(1));
let denom = (width + height).max(1) as f32;
for y in 0..img.height() {
for x in 0..img.width() {
let hue = ((x + y) as f32 / denom) * 360.0;
img.put_pixel(x, y, image::Rgb(hsv_to_rgb(hue, 0.85, 0.95)));
}
}
img.save(&path).with_context(|| format!("writing {}", path.display()))?;
Ok(path)
}
/// Standard HSV -> RGB conversion. `h` in degrees [0, 360), `s`/`v` in [0, 1].
fn hsv_to_rgb(h: f32, s: f32, v: f32) -> [u8; 3] {
let c = v * s;
let h_prime = (h / 60.0) % 6.0;
let x = c * (1.0 - (h_prime % 2.0 - 1.0).abs());
let m = v - c;
let (r1, g1, b1) = match h_prime as u32 {
0 => (c, x, 0.0),
1 => (x, c, 0.0),
2 => (0.0, c, x),
3 => (0.0, x, c),
4 => (x, 0.0, c),
_ => (c, 0.0, x),
};
[
((r1 + m) * 255.0).round() as u8,
((g1 + m) * 255.0).round() as u8,
((b1 + m) * 255.0).round() as u8,
]
}
fn dir_names(path: &Path) -> HashSet<String> {
std::fs::read_dir(path)
.into_iter()
.flatten()
.filter_map(|e| e.ok())
.map(|e| e.file_name().to_string_lossy().into_owned())
.collect()
}
fn is_wayland_socket_name(name: &str) -> bool {
name.strip_prefix("wayland-")
.is_some_and(|rest| !rest.is_empty() && rest.bytes().all(|b| b.is_ascii_digit()))
}
fn poll_for_new(
dir: &Path,
before: &HashSet<String>,
timeout: Duration,
relevant: impl Fn(&str) -> bool,
) -> Result<String> {
let start = Instant::now();
loop {
let after = dir_names(dir);
if let Some(name) = after.iter().find(|n| relevant(n) && !before.contains(*n)) {
return Ok(name.clone());
}
if start.elapsed() > timeout {
bail!(
"timed out after {timeout:?} waiting for a new entry in {}",
dir.display()
);
}
std::thread::sleep(Duration::from_millis(100));
}
}

262
bread-capture/src/main.rs
View file

@ -1,262 +0,0 @@
//! Orchestrator for the bread ecosystem's UI screenshot tooling.
//!
//! Drives each target app's `--screenshot <view> --output <path>` mode (see
//! `bread-screenshots` for what that mode does inside the app) and reports
//! pass/fail per view/app. Plain `bread-capture` with no flags captures
//! every known app's every view in one run — each app's binary is resolved
//! by its own bare name via `$PATH`, same as running it directly by name
//! would. `--app <name>` restricts to one app; `--app-path <path>`
//! overrides where its binary is found (and, without `--app`, also selects
//! which app by its file stem — so `--app-path ./target/release/breadbox`
//! alone still works); `--view <name>` further restricts to one view. The
//! view list for each app is looked up from [`TARGETS`] below. Each app
//! gets its own subdirectory under `--out-dir` (`<out-dir>/<app>/<view>.png`)
//! — no versioned `screenshots/vX.Y.Z/latest` structure or manifest file
//! yet, since that's still not earning its complexity over a handful of
//! apps.
//!
//! By default every capture runs inside a throwaway headless Sway instance
//! (see [`isolation`]) rather than the operator's live desktop, so another
//! window (or their own differently-themed real bar) can't leak into a
//! capture. `--no-isolate` skips that and captures directly against whatever
//! session bread-capture itself is running in — useful for debugging the
//! capture sequence itself, since you can then actually watch it happen.
mod isolation;
use anyhow::{bail, Result};
use clap::Parser;
use std::path::PathBuf;
use std::process::ExitCode;
use std::time::Duration;
const CAPTURE_TIMEOUT: Duration = Duration::from_secs(10);
/// Per-app (view name, output filename) lists. Keyed by the app's binary
/// name — see `--app-name`. Filenames are plain (no app prefix): each app
/// gets its own subdirectory under `--out-dir` (`<out-dir>/<app>/<file>`),
/// so the prefix would just be redundant with the folder name.
const TARGETS: &[(&str, &[(&str, &str)])] = &[
(
"breadbar",
&[
("bar", "bar.png"),
("control-panel", "control-panel.png"),
("connectivity-wifi", "connectivity-wifi.png"),
("connectivity-bluetooth", "connectivity-bluetooth.png"),
("media-popover", "media-popover.png"),
("notification", "notification.png"),
("notification-critical", "notification-critical.png"),
("osd-volume", "osd-volume.png"),
("osd-brightness", "osd-brightness.png"),
("wifi-add-dialog", "wifi-add-dialog.png"),
// Theme 04/spotlight's embedded capsule (only rendered under
// `BREAD_SHELL_THEME=spotlight` — every other theme's [bar.slots]
// never places launcher_entry/launcher_results anywhere).
("capsule-collapsed", "capsule-collapsed.png"),
("capsule-expanded", "capsule-expanded.png"),
// Phase 6c: query sections (idle "Recent"/"Apps" headers) and
// the `=` calc mode — see breadbar's own `screenshot::KNOWN_VIEWS`
// doc comment for why the search-state width/radius change
// (item E) doesn't need a view of its own.
("capsule-sections", "capsule-sections.png"),
("capsule-calc", "capsule-calc.png"),
],
),
("breadbox", &[("launcher", "launcher.png")]),
("breadclip", &[("history", "history.png")]),
("breadsearch", &[("search", "search.png")]),
(
"breadpad",
&[
("popup", "popup.png"),
("reminder", "reminder.png"),
("reminder-snooze", "reminder-snooze.png"),
],
),
(
"breadhelp",
&[
("home", "home.png"),
("learn", "learn.png"),
("ask", "ask.png"),
("troubleshoot-wizard", "troubleshoot-wizard.png"),
],
),
(
"breadman",
&[
("all", "all.png"),
("upcoming", "upcoming.png"),
("todo", "todo.png"),
("reminder", "reminder.png"),
("idea", "idea.png"),
("note", "note.png"),
("question", "question.png"),
("archive", "archive.png"),
("settings", "settings.png"),
("errors", "errors.png"),
("editor", "editor.png"),
("new-note", "new-note.png"),
],
),
(
"bos-settings",
&[
("network", "network.png"),
("breadcrumbs", "breadcrumbs.png"),
("bluetooth", "bluetooth.png"),
("firewall", "firewall.png"),
("sound", "sound.png"),
("power", "power.png"),
("datetime", "datetime.png"),
("hyprland", "hyprland.png"),
("keybinds", "keybinds.png"),
("autostart", "autostart.png"),
("users", "users.png"),
("appearance", "appearance.png"),
("breadpaper", "breadpaper.png"),
("breadbar", "breadbar.png"),
("breadbox", "breadbox.png"),
("breadclip", "breadclip.png"),
("breadpad", "breadpad.png"),
("breadsearch", "breadsearch.png"),
("bread", "bread.png"),
("packages", "packages.png"),
("aur", "aur.png"),
("firmware", "firmware.png"),
("snapshots", "snapshots.png"),
("about", "about.png"),
],
),
];
#[derive(Parser)]
struct Cli {
/// Restrict to one app (see `TARGETS` for known names). Omit to capture
/// every known app's every view in one run.
#[arg(long)]
app: Option<String>,
/// Path to that app's binary (resolved via $PATH if not a path).
/// Without `--app`, this also selects *which* app by its file stem
/// (e.g. `./target/release/breadbox` -> `breadbox`) — so a single-app
/// run never needs both flags. Ignored (with a warning) if given
/// together with a multi-app run (no `--app`, and the path isn't
/// resolvable to exactly one app).
#[arg(long)]
app_path: Option<String>,
/// Restrict to one view within the selected app(s) (see each app's
/// entry in `TARGETS` for known view names). Apps that don't have a
/// view by this name are skipped, not treated as an error, since a
/// multi-app run's view names naturally don't all overlap.
#[arg(long)]
view: Option<String>,
/// Directory to write captured PNGs into.
#[arg(long, default_value = "./screenshots")]
out_dir: PathBuf,
/// Capture directly against the current session instead of a headless,
/// throwaway Sway instance. Off by default so captures can't pick up
/// whatever else is on the operator's desktop.
#[arg(long)]
no_isolate: bool,
/// Width of the isolated session's capture canvas.
#[arg(long, default_value_t = 1920)]
isolate_width: u32,
/// Height of the isolated session's capture canvas.
#[arg(long, default_value_t = 1080)]
isolate_height: u32,
}
fn known_app_names() -> String {
TARGETS.iter().map(|(n, _)| *n).collect::<Vec<_>>().join(", ")
}
/// (app_name, binary_path, views) per selected app.
type SelectedTarget = (&'static str, String, &'static [(&'static str, &'static str)]);
/// Resolves which `TARGETS` entries this run covers, and the binary path
/// to use for each.
fn selected_targets(cli: &Cli) -> Result<Vec<SelectedTarget>> {
if let Some(app) = &cli.app {
let Some((name, views)) = TARGETS.iter().find(|(n, _)| n == app) else {
bail!("no known view list for app '{app}' (known: {})", known_app_names());
};
let path = cli.app_path.clone().unwrap_or_else(|| name.to_string());
return Ok(vec![(name, path, views)]);
}
if let Some(path) = &cli.app_path {
let stem = PathBuf::from(path)
.file_stem()
.map(|s| s.to_string_lossy().into_owned())
.unwrap_or_else(|| path.clone());
let Some((name, views)) = TARGETS.iter().find(|(n, _)| *n == stem) else {
bail!("no known view list for app '{stem}' (known: {})", known_app_names());
};
return Ok(vec![(name, path.clone(), views)]);
}
// No --app / --app-path at all: every known app, resolved by its own
// bare name via $PATH.
Ok(TARGETS.iter().map(|(name, views)| (*name, name.to_string(), *views)).collect())
}
fn main() -> Result<ExitCode> {
let cli = Cli::parse();
let targets = selected_targets(&cli)?;
if let Some(view) = &cli.view {
if !targets.iter().any(|(_, _, views)| views.iter().any(|(v, _)| v == view)) {
bail!("view '{view}' doesn't match any selected app's views");
}
}
// Bound, not dropped-and-discarded: `_isolation`'s teardown (kill the
// compositor, remove its socket/config) must run via Drop regardless of
// how this function returns below — returning an ExitCode rather than
// calling `std::process::exit` (which skips destructors entirely) is
// what makes that true on the failure path too.
let _isolation = if cli.no_isolate {
None
} else {
Some(isolation::Isolation::start(cli.isolate_width, cli.isolate_height)?)
};
let width_str = cli.isolate_width.to_string();
let height_str = cli.isolate_height.to_string();
let mut failed = false;
for (app_name, app_path, views) in &targets {
for (view, filename) in *views {
if cli.view.as_deref().is_some_and(|v| v != *view) {
continue;
}
let out_path = cli.out_dir.join(app_name).join(filename);
let out_str = out_path.to_string_lossy();
let result = bread_utils::proc::run(
app_path,
&[
"--screenshot", view,
"--output", &out_str,
"--width", &width_str,
"--height", &height_str,
],
CAPTURE_TIMEOUT,
);
if result.success {
println!("ok {app_name}/{view} -> {}", out_path.display());
} else {
failed = true;
println!("FAIL {app_name}/{view}: {}", result.stderr.trim());
}
}
}
Ok(if failed { ExitCode::FAILURE } else { ExitCode::SUCCESS })
}

26
bread-launcher/Cargo.toml
View file

@ -1,26 +0,0 @@
[package]
name = "bread-launcher"
version.workspace = true
edition.workspace = true
license.workspace = true
authors.workspace = true
description = "Headless app-launcher core (desktop-entry discovery, fuzzy matching/ranking, launch history, launching) plus an optional GTK4 results-list widget — the shared logic behind breadbox's overlay window and breadbar's embedded capsule"
repository = "https://git.breadway.dev/Breadway/bread-ecosystem"
keywords = ["launcher", "desktop-entry", "gtk4", "wayland"]
[dependencies]
serde_json = { workspace = true }
# `do_launch`/`emit_launched` publish a `bread.<app>.launched` event over
# breadd's IPC socket after a successful spawn, fire-and-forget — this was
# already breadbox's behaviour (`BreadClient::emit` never blocks or errors
# the launching caller), just relocated. Not optional: launching is core,
# headless functionality, unlike the GTK widget below.
bread-utils = { path = "../bread-utils", features = ["bread-client"] }
gtk4 = { version = "0.11", features = ["v4_12"], optional = true }
[features]
# Enable the GTK4 results-list widget (`gtk` module): row building, fuzzy
# filtering, match/history sorting, and keyboard-style selection movement.
# Optional so a headless consumer of the matching/ranking/launch core (or a
# future non-GTK host) doesn't have to pull in GTK4.
gtk = ["dep:gtk4"]

151
bread-launcher/src/desktop.rs
View file

@ -1,151 +0,0 @@
use std::{
fs::{self, File},
io::{BufRead, BufReader},
path::{Path, PathBuf},
};
use crate::paths::app_dirs;
#[derive(Debug, Clone)]
pub struct DesktopEntry {
/// Desktop file id (the `.desktop` filename, e.g. `firefox.desktop`).
/// Empty only if the path had no file name; callers fall back to `exec`.
pub id: String,
pub name: String,
pub exec: String,
pub icon_name: String,
pub icon_path: Option<PathBuf>, // resolved by caller from manifest
pub categories: Vec<String>,
pub wm_class: Option<String>,
pub terminal: bool,
}
pub fn strip_exec_codes(exec: &str) -> String {
let mut out = String::with_capacity(exec.len());
let mut chars = exec.chars().peekable();
while let Some(c) = chars.next() {
if c == '%' {
match chars.peek().copied() {
Some('%') => {
chars.next();
out.push('%');
}
Some(n) if n.is_ascii_alphabetic() => {
chars.next();
}
_ => out.push(c),
}
} else {
out.push(c);
}
}
out
}
/// Returns `None` for entries that should not be shown (hidden, NoDisplay, non-Application type).
pub fn parse_desktop(path: &Path) -> Option<DesktopEntry> {
let file = File::open(path).ok()?;
let mut in_entry = false;
let mut name: Option<String> = None;
let mut exec: Option<String> = None;
let mut icon: Option<String> = None;
let mut categories: Option<String> = None;
let mut wm_class: Option<String> = None;
let mut app_type: Option<String> = None;
let mut no_display = false;
let mut hidden = false;
let mut terminal = false;
for line in BufReader::new(file).lines() {
let Ok(raw) = line else { continue };
let s = raw.trim();
if s.starts_with('#') || s.is_empty() {
continue;
}
if s.starts_with('[') {
in_entry = s == "[Desktop Entry]";
continue;
}
if !in_entry {
continue;
}
if let Some(v) = s.strip_prefix("Name=") {
name.get_or_insert_with(|| v.to_string());
} else if let Some(v) = s.strip_prefix("Exec=") {
exec.get_or_insert_with(|| v.to_string());
} else if let Some(v) = s.strip_prefix("Icon=") {
icon.get_or_insert_with(|| v.to_string());
} else if let Some(v) = s.strip_prefix("Categories=") {
categories.get_or_insert_with(|| v.to_string());
} else if let Some(v) = s.strip_prefix("StartupWMClass=") {
wm_class.get_or_insert_with(|| v.to_string());
} else if let Some(v) = s.strip_prefix("Type=") {
app_type.get_or_insert_with(|| v.to_string());
} else if let Some(v) = s.strip_prefix("NoDisplay=") {
no_display = v == "true";
} else if let Some(v) = s.strip_prefix("Hidden=") {
hidden = v == "true";
} else if let Some(v) = s.strip_prefix("Terminal=") {
terminal = v == "true" || v == "1";
}
}
if no_display || hidden {
return None;
}
if app_type.as_deref() != Some("Application") {
return None;
}
let name = name?.trim().to_string();
let exec = strip_exec_codes(exec?.trim()).trim().to_string();
if name.is_empty() || exec.is_empty() {
return None;
}
let icon_name = icon.unwrap_or_default().trim().to_string();
let cats = categories
.unwrap_or_default()
.split(';')
.filter(|s| !s.is_empty())
.map(|s| s.to_string())
.collect();
let id = path
.file_name()
.map(|n| n.to_string_lossy().into_owned())
.filter(|s| !s.is_empty())
.unwrap_or_default();
Some(DesktopEntry {
id,
name,
exec,
icon_name,
icon_path: None,
categories: cats,
wm_class: wm_class.map(|s| s.trim().to_string()).filter(|s| !s.is_empty()),
terminal,
})
}
/// Walk all configured application directories and return deduplicated entries.
/// Entries from later directories (user-local) override those from earlier ones.
pub fn load_all_desktop_entries() -> Vec<DesktopEntry> {
let mut seen: std::collections::HashMap<String, DesktopEntry> = std::collections::HashMap::new();
for dir in app_dirs() {
let Ok(entries) = fs::read_dir(&dir) else { continue };
for entry in entries.flatten() {
let path = entry.path();
if path.extension().and_then(|e| e.to_str()) != Some("desktop") {
continue;
}
let key = entry.file_name().to_string_lossy().into_owned();
if let Some(app) = parse_desktop(&path) {
seen.insert(key, app);
}
}
}
seen.into_values().collect()
}

297
bread-launcher/src/gtk.rs
View file

@ -1,297 +0,0 @@
//! GTK4 results-list widget: the "row-building half" of what used to be
//! breadbox's `run_ui` (`THEME_SYSTEM_PLAN.md` §3) — desktop-entry rows,
//! fuzzy filtering, match/history sorting, and keyboard-style selection
//! movement, packaged as [`ResultsList`] so any host window can embed it.
//! breadbox wraps it in a full-screen overlay window today; breadbar's
//! embedded capsule (a later phase) puts the same widget in its drawer slot.
use std::{cell::RefCell, path::Path, rc::Rc};
use gtk4::{
gdk, gio,
pango::EllipsizeMode,
prelude::*,
Align, Box as GBox, Image, Label, ListBox, ListBoxRow, Orientation, PolicyType,
ScrolledWindow, SelectionMode,
};
use crate::desktop::DesktopEntry;
use crate::history::LaunchHistory;
use crate::matching::{fuzzy_matches, fuzzy_score, split_sections};
fn make_icon(icon_name: &str, icon_path: Option<&Path>, icon_px: i32) -> Image {
// Try loading from resolved cached path via gio::File
if let Some(path) = icon_path {
let gio_file = gio::File::for_path(path);
if let Ok(texture) = gdk::Texture::from_file(&gio_file) {
let img = Image::new();
img.set_paintable(Some(&texture));
img.set_pixel_size(icon_px);
return img;
}
}
// Fall back to GTK icon theme lookup by name
let name = if icon_name.is_empty() {
"application-x-executable"
} else {
icon_name
};
let img = Image::from_icon_name(name);
img.set_pixel_size(icon_px);
img
}
fn build_row(entry: &DesktopEntry, idx: u32, icon_px: i32) -> ListBoxRow {
let row = ListBoxRow::new();
let hbox = GBox::new(Orientation::Horizontal, 0);
hbox.set_margin_start(6);
hbox.set_margin_end(6);
hbox.set_valign(Align::Center);
let icon = make_icon(&entry.icon_name, entry.icon_path.as_deref(), icon_px);
hbox.append(&icon);
let name_lbl = Label::new(Some(&entry.name));
name_lbl.add_css_class("app-name");
name_lbl.set_xalign(0.0);
name_lbl.set_hexpand(true);
name_lbl.set_ellipsize(EllipsizeMode::End);
hbox.append(&name_lbl);
if let Some(ref wm) = entry.wm_class {
let wm_lbl = Label::new(Some(wm));
wm_lbl.add_css_class("app-muted");
wm_lbl.set_xalign(1.0);
hbox.append(&wm_lbl);
}
row.set_child(Some(&hbox));
unsafe { row.set_data("entry", entry.clone()) };
unsafe { row.set_data("initial_order", idx) };
row
}
/// A non-selectable, non-activatable "Recent"/"Apps" label row (plan phase
/// 6c, `[launcher].sections`) — deliberately carries no `"entry"` row data,
/// which is exactly what [`row_entry`] (and everything downstream of it:
/// `set_query`'s filter, `select_next`/`select_prev`'s traversal) already
/// uses to tell a header apart from a real app row.
fn build_header_row(label: &str, idx: u32) -> ListBoxRow {
let row = ListBoxRow::new();
row.set_selectable(false);
row.set_activatable(false);
row.add_css_class("bread-drawer-section-header");
let lbl = Label::new(Some(label));
lbl.add_css_class("section-header-label");
lbl.set_xalign(0.0);
row.set_child(Some(&lbl));
unsafe { row.set_data("initial_order", idx) };
row
}
/// Reads the [`DesktopEntry`] a row was built from — e.g. from a
/// `ListBox::connect_row_activated` handler, which hands back a row
/// reference rather than going through [`ResultsList::selected_entry`].
pub fn row_entry(row: &ListBoxRow) -> Option<DesktopEntry> {
unsafe { row.data::<DesktopEntry>("entry").map(|p| p.as_ref().clone()) }
}
/// A scrollable, filterable, rankable list of desktop-entry rows — the
/// widget breadbox's overlay wraps today and breadbar's capsule will embed
/// next (`THEME_SYSTEM_PLAN.md` §7). A host drives it through
/// [`set_query`](Self::set_query) (wire to a search entry's `changed`
/// signal), [`select_next`](Self::select_next)/[`select_prev`](Self::select_prev)
/// (wire to arrow keys), and reads the current pick via
/// [`selected_entry`](Self::selected_entry) — `list`/`scroller` are exposed
/// directly for anything else a host needs (e.g. `connect_row_activated`
/// for click-to-launch, or placing `scroller` in a slot).
#[derive(Clone)]
pub struct ResultsList {
pub scroller: ScrolledWindow,
pub list: ListBox,
query: Rc<RefCell<String>>,
history: Rc<RefCell<LaunchHistory>>,
}
impl ResultsList {
/// Builds one row per entry (in `entries`' given order — that order is
/// also the fallback sort when the query is empty) and wires up sorting
/// against `history`'s launch counts.
///
/// `sections` (`[launcher].sections`, plan phase 6c): when true, the
/// idle (empty-query) view groups `entries` into "Recent"/"Apps"
/// [`build_header_row`]s via [`split_sections`] instead of one flat
/// list. Sections disappear the moment a query is typed — `set_query`
/// falls back to the same flat fuzzy-ranked list either way — so this
/// only changes the initial build order and the header rows' presence,
/// never the (unchanged) search behaviour. `false` reproduces the
/// exact pre-phase-6c flat list breadbox's own overlay still uses.
pub fn new(
entries: &[DesktopEntry],
icon_px: i32,
history: Rc<RefCell<LaunchHistory>>,
sections: bool,
) -> Self {
let list = ListBox::new();
list.set_selection_mode(SelectionMode::Browse);
let mut idx = 0u32;
if sections {
let (recent, apps) = split_sections(entries.to_vec(), &history.borrow());
if !recent.is_empty() {
list.append(&build_header_row("Recent", idx));
idx += 1;
for entry in &recent {
list.append(&build_row(entry, idx, icon_px));
idx += 1;
}
}
if !apps.is_empty() {
list.append(&build_header_row("Apps", idx));
idx += 1;
for entry in &apps {
list.append(&build_row(entry, idx, icon_px));
idx += 1;
}
}
} else {
for entry in entries {
list.append(&build_row(entry, idx, icon_px));
idx += 1;
}
}
let query: Rc<RefCell<String>> = Rc::new(RefCell::new(String::new()));
{
let query = Rc::clone(&query);
let history = Rc::clone(&history);
list.set_sort_func(move |row_a, row_b| {
let query = query.borrow();
if query.is_empty() {
let oa = unsafe {
row_a.data::<u32>("initial_order").map_or(u32::MAX, |p| *p.as_ref())
};
let ob = unsafe {
row_b.data::<u32>("initial_order").map_or(u32::MAX, |p| *p.as_ref())
};
return oa.cmp(&ob).into();
}
// A header row carries no "entry" data — sort it after any
// real row rather than treating the comparison as `Equal`,
// though `set_query` also hides every header outright once
// a query is non-empty, so this only matters for the
// underlying (invisible) list order, never what's shown.
match (row_entry(row_a), row_entry(row_b)) {
(Some(ea), Some(eb)) => {
let sa = fuzzy_score(&query, &ea);
let sb = fuzzy_score(&query, &eb);
let history = history.borrow();
let ca = history.count(&ea.name);
let cb = history.count(&eb.name);
sa.cmp(&sb)
.then(cb.cmp(&ca))
.then(ea.name.to_lowercase().cmp(&eb.name.to_lowercase()))
.into()
}
(None, Some(_)) => std::cmp::Ordering::Greater.into(),
(Some(_), None) => std::cmp::Ordering::Less.into(),
(None, None) => std::cmp::Ordering::Equal.into(),
}
});
}
let first_real = (0i32..)
.map_while(|i| list.row_at_index(i))
.find(|r| row_entry(r).is_some());
if let Some(first) = first_real {
list.select_row(Some(&first));
}
let scroller = ScrolledWindow::new();
scroller.set_policy(PolicyType::Never, PolicyType::Automatic);
scroller.set_max_content_height(480);
scroller.set_propagate_natural_height(true);
scroller.set_child(Some(&list));
ResultsList { scroller, list, query, history }
}
/// Re-filters (fuzzy match against name, `wm_class`, and `exec`) and
/// re-sorts by `query`, then selects the first visible row. A header
/// row (see [`build_header_row`]) only ever shows in the idle
/// (empty-query) browse view — it has no name/`wm_class`/`exec` of its
/// own to filter against.
pub fn set_query(&self, query: &str) {
*self.query.borrow_mut() = query.to_string();
let mut i = 0i32;
while let Some(row) = self.list.row_at_index(i) {
let vis = match row_entry(&row) {
Some(e) => {
fuzzy_matches(query, &e.name)
|| e.wm_class.as_deref().is_some_and(|w| fuzzy_matches(query, w))
|| fuzzy_matches(query, &e.exec)
}
None => query.is_empty(),
};
row.set_visible(vis);
i += 1;
}
self.list.invalidate_sort();
let first_vis = (0i32..)
.map_while(|j| self.list.row_at_index(j))
.find(|r| r.is_visible() && row_entry(r).is_some());
self.list.select_row(first_vis.as_ref());
}
pub fn selected_entry(&self) -> Option<DesktopEntry> {
self.list.selected_row().and_then(|r| row_entry(&r))
}
/// Moves the selection to the next visible row, if any. Skips header
/// rows even though they may be visible (the idle browse view) —
/// `set_selectable(false)` alone doesn't stop a programmatic
/// `select_row` call from landing on one.
pub fn select_next(&self) {
let cur = self.list.selected_row().map(|r| r.index()).unwrap_or(-1);
let mut i = cur + 1;
loop {
match self.list.row_at_index(i) {
Some(r) if r.is_visible() && row_entry(&r).is_some() => {
self.list.select_row(Some(&r));
break;
}
Some(_) => i += 1,
None => break,
}
}
}
/// Moves the selection to the previous visible row, if any. See
/// [`select_next`](Self::select_next) on skipping header rows.
pub fn select_prev(&self) {
let cur = self.list.selected_row().map(|r| r.index()).unwrap_or(0);
let mut i = cur - 1;
loop {
if i < 0 {
break;
}
match self.list.row_at_index(i) {
Some(r) if r.is_visible() && row_entry(&r).is_some() => {
self.list.select_row(Some(&r));
break;
}
Some(_) => i -= 1,
None => break,
}
}
}
/// Records `entry` as launched in the shared history and persists it.
/// Call before actually launching (matching breadbox's original
/// increment-then-launch ordering) — history and launching are separate
/// concerns, so this doesn't call [`crate::do_launch`] itself.
pub fn record_launch(&self, entry: &DesktopEntry) {
self.history.borrow_mut().increment(&entry.name);
self.history.borrow().save();
}
}

126
bread-launcher/src/history.rs
View file

@ -1,126 +0,0 @@
use std::{collections::HashMap, fs, path::PathBuf};
pub struct LaunchHistory {
counts: HashMap<String, u32>,
path: PathBuf,
}
impl LaunchHistory {
/// `app` picks the cache subdirectory (see [`crate::cache_dir`]) the
/// history file lives in.
pub fn load(app: &str) -> Self {
let path = crate::paths::cache_dir(app).join("history.json");
let counts = fs::read_to_string(&path)
.ok()
.and_then(|s| serde_json::from_str(&s).ok())
.unwrap_or_default();
LaunchHistory { counts, path }
}
pub fn count(&self, name: &str) -> u32 {
self.counts.get(name).copied().unwrap_or(0)
}
pub fn increment(&mut self, name: &str) {
*self.counts.entry(name.to_string()).or_insert(0) += 1;
}
/// Writes `counts` to `path` as JSON. Best-effort — a broken cache dir
/// (missing parent, full disk, permissions) must not stop the caller
/// from launching anything, so this never returns an error — but it now
/// logs one on failure rather than swallowing it silently. Shared by two
/// hosts (breadbox's overlay and breadbar's embedded capsule, both keyed
/// under [`crate::LAUNCHER_APP`]), so a save failure here silently stops
/// ranking history for both.
pub fn save(&self) {
match serde_json::to_string(&self.counts) {
Ok(json) => {
if let Err(err) = fs::write(&self.path, json) {
eprintln!(
"bread-launcher: failed to save launch history to {}: {err}",
self.path.display()
);
}
}
Err(err) => {
eprintln!("bread-launcher: failed to serialize launch history: {err}");
}
}
}
/// In-memory history with no backing file — [`save`](Self::save) fails
/// (an empty `path` is not writable) and now logs that failure to
/// stderr rather than swallowing it, same as any other broken-path
/// case. Lets a test (or a future in-memory host) control counts
/// directly instead of writing through `~/.cache/<app>/history.json`.
#[cfg(test)]
pub(crate) fn from_counts(counts: HashMap<String, u32>) -> Self {
LaunchHistory {
counts,
path: PathBuf::new(),
}
}
}
#[cfg(test)]
mod tests {
use super::*;
fn temp_history_path(name: &str) -> PathBuf {
let dir = std::env::temp_dir().join(format!(
"bread-launcher-history-test-{}-{name}-{}",
std::process::id(),
std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
.unwrap_or_default()
.as_nanos()
));
std::fs::create_dir_all(&dir).unwrap();
dir.join("history.json")
}
#[test]
fn save_then_load_round_trips_counts() {
let path = temp_history_path("roundtrip");
let mut history = LaunchHistory {
counts: HashMap::new(),
path: path.clone(),
};
history.increment("firefox.desktop");
history.increment("firefox.desktop");
history.increment("kitty.desktop");
history.save();
let text = std::fs::read_to_string(&path).expect("save should have written the file");
let counts: HashMap<String, u32> = serde_json::from_str(&text).unwrap();
assert_eq!(counts.get("firefox.desktop"), Some(&2));
assert_eq!(counts.get("kitty.desktop"), Some(&1));
// load() from the same path should see the same counts.
let reloaded = LaunchHistory {
counts: serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap(),
path: path.clone(),
};
assert_eq!(reloaded.count("firefox.desktop"), 2);
let _ = std::fs::remove_dir_all(path.parent().unwrap());
}
/// `save()` on an unwritable path (e.g. the parent directory doesn't
/// exist, or `path` is empty) must not panic — it's best-effort, called
/// from a launcher's shutdown path where a hard failure would be worse
/// than a lost history entry. This exercises exactly the failure branch
/// the `eprintln!` above was added for; there is no return value to
/// assert on, so "did not panic" is the contract under test.
#[test]
fn save_to_a_broken_path_does_not_panic() {
let history = LaunchHistory::from_counts(HashMap::from([("x".to_string(), 1)]));
history.save();
let history = LaunchHistory {
counts: HashMap::new(),
path: PathBuf::from("/nonexistent-dir/definitely-not-there/history.json"),
};
history.save();
}
}

26
bread-launcher/src/icon.rs
View file

@ -1,26 +0,0 @@
use std::{fs, path::PathBuf};
pub struct IconCache {
pub dir: PathBuf,
}
impl IconCache {
/// `app` picks the cache subdirectory (see [`crate::cache_dir`]) — pass
/// the same name across a process's calls so `path_for` and
/// `manifest_path` agree on where icons live.
pub fn new(app: &str) -> Self {
IconCache { dir: crate::paths::cache_dir(app).join("icons") }
}
pub fn path_for(&self, icon_name: &str) -> PathBuf {
self.dir.join(format!("{}.png", icon_name))
}
pub fn manifest_path(app: &str) -> PathBuf {
crate::paths::cache_dir(app).join("manifest.json")
}
pub fn ensure_dir(&self) -> std::io::Result<()> {
fs::create_dir_all(&self.dir)
}
}

141
bread-launcher/src/launch.rs
View file

@ -1,141 +0,0 @@
use std::{
env,
path::Path,
process::{Command, Stdio},
};
use bread_utils::bread_client::BreadClient;
use crate::desktop::DesktopEntry;
fn pick_terminal() -> String {
if let Ok(t) = env::var("TERMINAL") {
if !t.is_empty() {
return t;
}
}
let path_var = env::var("PATH").unwrap_or_default();
for t in ["foot", "kitty", "alacritty", "wezterm", "ghostty", "xterm"] {
if path_var.split(':').any(|d| Path::new(d).join(t).exists()) {
return t.to_string();
}
}
"xterm".to_string()
}
/// Spawns `entry`'s command (through a terminal if `entry.terminal` is set)
/// and, on a successful spawn, publishes `event` via [`emit_launched`].
///
/// `app_id` here is the caller's **bread event-namespace id** (e.g.
/// `"box"` for breadbox) — NOT [`crate::LAUNCHER_APP`] (`"breadbox"`).
/// Those are two different identities that happen to look similar:
/// `LAUNCHER_APP` only picks the shared cache/history directory (see its own
/// doc comment), while `app_id` here is threaded straight into
/// `BreadClient::connect(app_id)` and must be the caller's own namespace, or
/// `BreadClient::emit`'s `validate_app_namespace` check
/// (`event.starts_with("bread.{app_id}.")`) rejects `event` and drops it
/// with only an eprintln — passing `LAUNCHER_APP` here by mistake is exactly
/// that bug. breadbox passes its own `"box"` (see breadbox's `APP_ID`) so
/// its events publish as `bread.box.*`, matching [`emit_launched`]'s doc
/// example below.
pub fn do_launch(entry: &DesktopEntry, app_id: &str, event: &str) {
let cmd = entry.exec.trim();
let spawned = if entry.terminal {
let term = pick_terminal();
Command::new(&term)
.args(["-e", "bash", "-c", cmd])
.stdin(Stdio::null())
.stdout(Stdio::null())
.stderr(Stdio::null())
.spawn()
} else {
Command::new("bash")
.args(["-c", cmd])
.stdin(Stdio::null())
.stdout(Stdio::null())
.stderr(Stdio::null())
.spawn()
};
if spawned.is_ok() {
emit_launched(entry, app_id, event);
}
}
/// Publishes `event` under `app_id`'s bread namespace after a successful
/// spawn — e.g. breadbox calls this with `app_id = "box"` and
/// `event = "bread.box.launched"`, its own namespace. Fire-and-forget and
/// non-fatal (`BreadClient::emit` never blocks or errors this caller) —
/// breadd being absent must never affect launching itself. `app_id` must be
/// the caller's *own* namespace id, not [`crate::LAUNCHER_APP`] — see
/// [`do_launch`]'s doc comment for why those are different identities and
/// what happens if they're confused.
pub fn emit_launched(entry: &DesktopEntry, app_id: &str, event: &str) {
let id = if entry.id.is_empty() {
entry.exec.as_str()
} else {
entry.id.as_str()
};
BreadClient::connect(app_id).emit(
event,
serde_json::json!({ "id": id, "name": entry.name }),
);
}
#[cfg(test)]
mod tests {
use super::*;
/// Mirrors `bread_shared::apps::validate_app_namespace` exactly
/// (`event.starts_with(&format!("bread.{app}."))`) without pulling in
/// that crate here — this is the one check that decides whether
/// [`emit_launched`]'s event actually gets published.
fn passes_namespace_check(app_id: &str, event: &str) -> bool {
event.starts_with(&format!("bread.{app_id}."))
}
#[test]
fn documented_app_id_and_event_pair_passes_the_namespace_check() {
// breadbox's real call site (breadbox/breadbox/src/main.rs):
// APP_ID = "box", LAUNCHED_EVENT = "bread.box.launched".
assert!(
passes_namespace_check("box", "bread.box.launched"),
"do_launch/emit_launched's own doc example must actually pass \
BreadClient::emit's namespace check"
);
}
#[test]
fn launcher_app_is_not_a_valid_app_id_for_the_documented_event() {
// The historical bug this doc fix guards against: passing
// `LAUNCHER_APP` ("breadbox", the cache/history identity) as
// `app_id` instead of the caller's own namespace id ("box") would
// silently drop `bread.box.launched` — event.starts_with(
// "bread.breadbox.") is false for "bread.box.launched".
assert!(
!passes_namespace_check(crate::LAUNCHER_APP, "bread.box.launched"),
"LAUNCHER_APP must NOT satisfy the namespace check for the \
documented event — if this ever passes, do_launch's doc comment \
warning about confusing the two identities is wrong"
);
}
#[test]
fn emit_launched_does_not_panic_when_breadd_is_unreachable() {
// No daemon is running in a test environment — emit_launched (and
// the BreadClient::emit it wraps) must degrade silently rather than
// panicking or blocking, for both a valid and a namespace-violating
// app_id.
let entry = DesktopEntry {
id: "firefox.desktop".to_string(),
name: "Firefox".to_string(),
exec: "firefox".to_string(),
icon_name: String::new(),
icon_path: None,
categories: vec![],
wm_class: None,
terminal: false,
};
emit_launched(&entry, "box", "bread.box.launched");
emit_launched(&entry, crate::LAUNCHER_APP, "bread.box.launched");
}
}

63
bread-launcher/src/lib.rs
View file

@ -1,63 +0,0 @@
//! Headless app-launcher core — desktop-entry discovery, fuzzy matching and
//! ranking, launch history, and process launching — plus an optional GTK4
//! results-list widget behind the `gtk` feature.
//!
//! Lives in `bread-ecosystem`, not an app repo, so breadbar (which must not
//! depend on an app repo) can embed the same launcher logic breadbox's
//! overlay window already wraps: one implementation, two hosts
//! (`THEME_SYSTEM_PLAN.md` §3, §7).
//!
//! Every path/cache/history entry point here takes an explicit `app: &str`
//! rather than hardcoding an app name, so more than one host can use this
//! crate without colliding — see [`cache_dir`]/[`config_dir`]. [`LAUNCHER_APP`]
//! is the one identity every *launcher* host (as opposed to some unrelated
//! future consumer of `cache_dir`/`config_dir`) should actually pass — see
//! its own doc comment for why.
mod desktop;
mod history;
mod icon;
mod launch;
mod matching;
mod paths;
mod query;
#[cfg(feature = "gtk")]
pub mod gtk;
pub use desktop::{load_all_desktop_entries, parse_desktop, strip_exec_codes, DesktopEntry};
pub use history::LaunchHistory;
pub use icon::IconCache;
pub use launch::{do_launch, emit_launched};
pub use matching::{
fuzzy_matches, fuzzy_score, load_sorted_entries, matches_term, priority_rank, split_sections,
};
pub use paths::{app_dirs, cache_dir, config_dir, home_dir};
pub use query::{builtin_commands, eval_calc, filter_commands, parse_query, Command, ParsedQuery, QueryKind};
/// The launcher's one shared identity, passed to [`cache_dir`]/[`config_dir`]/
/// [`IconCache::new`]/[`LaunchHistory::load`] by every host that embeds this
/// crate — breadbox's overlay window AND breadbar's embedded capsule
/// (theme 04/spotlight) alike.
///
/// This is deliberate, not a leftover of breadbox being first: theme 04's
/// whole premise is that breadbar's capsule IS the launcher wearing a
/// different shell, not a second launcher with its own history
/// (`THEME_SYSTEM_PLAN.md` §7). If each host passed its own binary name here,
/// the same physical launcher would rank a user's apps differently
/// depending on which theme happened to be active — the icon cache and
/// "most launched" ordering would silently fork in two. Sharing this
/// constant is what keeps them one launcher.
///
/// Do not pass a bare `"breadbox"` string literal at a call site instead of
/// this constant — that reads exactly like an unfixed bug (breadbar naming
/// another app's identity) and invites a later "fix" that would quietly
/// break the shared history this constant exists to guarantee.
///
/// **Not** the `app_id` for [`do_launch`]/[`emit_launched`]: those publish
/// bread-bus events, which must be namespaced under the caller's *own*
/// identity (breadbox's is `"box"`, not `"breadbox"`) or
/// `BreadClient::emit`'s namespace check silently drops them. This constant
/// is scoped to the cache/history path family only — see [`do_launch`]'s
/// doc comment for the concrete failure mode if the two get swapped.
pub const LAUNCHER_APP: &str = "breadbox";

387
bread-launcher/src/matching.rs
View file

@ -1,387 +0,0 @@
use std::{collections::HashMap, path::PathBuf};
use crate::desktop::{load_all_desktop_entries, DesktopEntry};
use crate::history::LaunchHistory;
// ---- Fuzzy matching (query filter) ------------------------------------------
/// Subsequence match used to *filter* rows as the user types: every char of
/// `pattern`, in order, must appear somewhere in `text` (case-insensitive).
/// Looser than [`fuzzy_score`], which ranks the rows that pass this filter.
pub fn fuzzy_matches(pattern: &str, text: &str) -> bool {
if pattern.is_empty() {
return true;
}
let mut chars = text.chars();
for pc in pattern.chars() {
let pl = pc.to_lowercase().next().unwrap_or(pc);
if !chars
.by_ref()
.any(|tc| tc.to_lowercase().next().unwrap_or(tc) == pl)
{
return false;
}
}
true
}
/// Ranks how well `query` matches `entry` — lower is better. Exact match (by
/// name or `wm_class`) sorts first, then name-prefix, then name-contains,
/// then `wm_class`-prefix/contains, then everything else that still passed
/// [`fuzzy_matches`] (a subsequence match with no stronger relationship).
pub fn fuzzy_score(query: &str, entry: &DesktopEntry) -> u32 {
let q = query.to_lowercase();
let name = entry.name.to_lowercase();
let wm = entry.wm_class.as_deref().unwrap_or("").to_lowercase();
if name == q || wm == q {
return 0;
}
if name.starts_with(&q) {
return 1;
}
if name.contains(&q) {
return 2;
}
if wm.starts_with(&q) || wm.contains(&q) {
return 3;
}
4 // subsequence match
}
// ---- Priority ranking (empty-query ordering) --------------------------------
/// Whole-word / exact match of `term` within `field` (both lowercase). Avoids
/// "code" matching "vscodium" while still matching "Code", "code-oss", and
/// "Visual Studio Code".
pub fn matches_term(field: &str, term: &str) -> bool {
if term.is_empty() || field.is_empty() {
return false;
}
if field == term {
return true;
}
let bytes = field.as_bytes();
let tlen = term.len();
let mut start = 0;
while let Some(pos) = field[start..].find(term) {
let i = start + pos;
let before_ok = i == 0 || !bytes[i - 1].is_ascii_alphanumeric();
let after = i + tlen;
let after_ok = after >= bytes.len() || !bytes[after].is_ascii_alphanumeric();
if before_ok && after_ok {
return true;
}
// Advance past the WHOLE match, not one byte past its start. Both `i`
// (a match start) and `i + tlen` (its end) are guaranteed char
// boundaries; `i + 1` is not, so a multi-byte term that failed the
// word-boundary check left `start` inside a character and the next
// `field[start..]` slice panicked outright. `matches_term("café", "é")`
// reproduced it: "byte index 4 is not a char boundary". Reached via
// priority_rank over real .desktop `Name=` values, so any non-ASCII
// app name could crash the launcher's sort.
start = i + tlen;
if start >= field.len() {
break;
}
}
false
}
/// Position of `entry` in the (already-lowercased) `priority` list, matched
/// against either its name or `wm_class`. `None` if `entry` isn't named
/// there at all.
pub fn priority_rank(entry: &DesktopEntry, priority_lower: &[String]) -> Option<usize> {
let name_l = entry.name.to_lowercase();
let wm_l = entry.wm_class.as_deref().unwrap_or("").to_lowercase();
priority_lower
.iter()
.position(|p| matches_term(&name_l, p) || matches_term(&wm_l, p))
}
/// Loads every known desktop entry, resolves each one's icon path from
/// `manifest`, and sorts them: entries named in `priority` come first (in
/// that order), then everything else by most-launched (via `history`), then
/// alphabetically.
pub fn load_sorted_entries(
manifest: &HashMap<String, PathBuf>,
priority: &[String],
history: &LaunchHistory,
) -> Vec<DesktopEntry> {
let mut entries = load_all_desktop_entries();
// Populate icon_path from manifest
for entry in &mut entries {
if let Some(path) = manifest.get(&entry.icon_name) {
if path.exists() {
entry.icon_path = Some(path.clone());
}
}
}
let priority_lower: Vec<String> = priority.iter().map(|s| s.to_lowercase()).collect();
entries.sort_by(|a, b| {
let ai = priority_rank(a, &priority_lower);
let bi = priority_rank(b, &priority_lower);
match (ai, bi) {
(Some(i), Some(j)) => i.cmp(&j),
(Some(_), None) => std::cmp::Ordering::Less,
(None, Some(_)) => std::cmp::Ordering::Greater,
(None, None) => {
// Most-launched first, then alphabetical
history
.count(&b.name)
.cmp(&history.count(&a.name))
.then(a.name.to_lowercase().cmp(&b.name.to_lowercase()))
}
}
});
entries
}
/// The demo's own cap (`BOS.pushRecent`'s `.slice(0, 4)`) on how many
/// entries the "Recent" section shows.
pub const MAX_RECENT: usize = 4;
/// Splits `entries` (already ordered by [`load_sorted_entries`]) into a
/// "recent" section — the entries `history` has any launch count for, most-
/// launched first, capped at [`MAX_RECENT`] — and an "apps" section: every
/// other entry, in its existing relative order. No new tracking beyond
/// `LaunchHistory`'s existing counts (THEME_SYSTEM_PLAN.md phase 6c task
/// notes: "`LaunchHistory` already tracks counts for a recents list").
///
/// Only meaningful when `entries` has no priority-ranked prefix (breadbar's
/// capsule calls [`load_sorted_entries`] with an empty `priority` list) —
/// with a non-empty priority list, priority-ranked entries still sort first
/// and would be treated as "apps" here even if launched often, since this
/// function has no way to tell "sorted first because launched a lot" from
/// "sorted first because priority-ranked" apart from the count itself.
pub fn split_sections(
entries: Vec<DesktopEntry>,
history: &LaunchHistory,
) -> (Vec<DesktopEntry>, Vec<DesktopEntry>) {
let mut recent = Vec::new();
let mut apps = Vec::new();
for entry in entries {
if recent.len() < MAX_RECENT && history.count(&entry.name) > 0 {
recent.push(entry);
} else {
apps.push(entry);
}
}
(recent, apps)
}
#[cfg(test)]
mod tests {
#[test]
fn multibyte_term_that_fails_word_boundary_does_not_panic() {
// "é" occurs in "café" but is preceded by an alphanumeric, so the
// whole-word check fails and the scan must continue — landing mid
// character before the fix.
assert!(!super::matches_term("café", "é"));
assert!(!super::matches_term("naïve café", "ï"));
}
#[test]
fn multibyte_whole_word_still_matches() {
assert!(super::matches_term("café bar", "café"));
assert!(super::matches_term("día", "día"));
}
use super::*;
fn entry(name: &str, wm_class: Option<&str>) -> DesktopEntry {
DesktopEntry {
id: format!("{name}.desktop"),
name: name.to_string(),
exec: "true".to_string(),
icon_name: String::new(),
icon_path: None,
categories: Vec::new(),
wm_class: wm_class.map(|s| s.to_string()),
terminal: false,
}
}
// ---- fuzzy_matches -------------------------------------------------
#[test]
fn fuzzy_matches_empty_pattern_matches_anything() {
assert!(fuzzy_matches("", "Firefox"));
assert!(fuzzy_matches("", ""));
}
#[test]
fn fuzzy_matches_in_order_subsequence() {
assert!(fuzzy_matches("ffx", "Firefox"));
assert!(fuzzy_matches("frfx", "Firefox"));
}
#[test]
fn fuzzy_matches_is_case_insensitive() {
assert!(fuzzy_matches("FIREFOX", "firefox"));
assert!(fuzzy_matches("firefox", "FireFox"));
}
#[test]
fn fuzzy_matches_rejects_out_of_order() {
assert!(!fuzzy_matches("xfr", "Firefox"));
}
#[test]
fn fuzzy_matches_rejects_missing_chars() {
assert!(!fuzzy_matches("firefoxx", "Firefox"));
}
// ---- fuzzy_score -----------------------------------------------------
#[test]
fn fuzzy_score_exact_name_match_is_best() {
let e = entry("Firefox", None);
assert_eq!(fuzzy_score("firefox", &e), 0);
}
#[test]
fn fuzzy_score_exact_wm_class_match_is_best() {
let e = entry("Firefox Web Browser", Some("firefox"));
assert_eq!(fuzzy_score("firefox", &e), 0);
}
#[test]
fn fuzzy_score_name_prefix_beats_name_contains() {
let prefix = entry("Firefox", None);
let contains = entry("GNU IceCat (Firefox fork)", None);
assert_eq!(fuzzy_score("fire", &prefix), 1);
assert_eq!(fuzzy_score("fire", &contains), 2);
assert!(fuzzy_score("fire", &prefix) < fuzzy_score("fire", &contains));
}
#[test]
fn fuzzy_score_wm_class_beats_pure_subsequence() {
let wm_hit = entry("Web Browser", Some("firefox"));
let subseq_only = entry("Fine Iris Reflex Editor for XML", None);
assert_eq!(fuzzy_score("fire", &wm_hit), 3);
assert_eq!(fuzzy_score("fire", &subseq_only), 4);
}
// ---- matches_term ------------------------------------------------------
#[test]
fn matches_term_exact_field_matches() {
assert!(matches_term("code", "code"));
}
#[test]
fn matches_term_whole_word_within_longer_field() {
assert!(matches_term("visual studio code", "code"));
}
#[test]
fn matches_term_rejects_substring_of_a_larger_word() {
// "code" must not match inside "vscodium" — this is the whole
// reason matches_term exists instead of a plain `contains`.
assert!(!matches_term("vscodium", "code"));
}
#[test]
fn matches_term_matches_hyphenated_variant() {
assert!(matches_term("code-oss", "code"));
}
#[test]
fn matches_term_empty_term_or_field_never_matches() {
assert!(!matches_term("code", ""));
assert!(!matches_term("", "code"));
}
// ---- priority_rank -----------------------------------------------------
#[test]
fn priority_rank_matches_by_name() {
let e = entry("Firefox", None);
let priority = vec!["firefox".to_string(), "code".to_string()];
assert_eq!(priority_rank(&e, &priority), Some(0));
}
#[test]
fn priority_rank_matches_by_wm_class() {
let e = entry("Web Browser", Some("firefox"));
let priority = vec!["code".to_string(), "firefox".to_string()];
assert_eq!(priority_rank(&e, &priority), Some(1));
}
#[test]
fn priority_rank_none_when_unlisted() {
let e = entry("Nautilus", None);
let priority = vec!["firefox".to_string()];
assert_eq!(priority_rank(&e, &priority), None);
}
#[test]
fn priority_rank_does_not_match_substring_of_a_word() {
let e = entry("VSCodium", None);
let priority = vec!["code".to_string()];
assert_eq!(priority_rank(&e, &priority), None);
}
// ---- split_sections --------------------------------------------------
#[test]
fn split_sections_no_history_is_all_apps() {
let entries = vec![entry("Firefox", None), entry("GoLand", None)];
let history = LaunchHistory::from_counts(HashMap::new());
let (recent, apps) = split_sections(entries, &history);
assert!(recent.is_empty());
assert_eq!(apps.len(), 2);
}
#[test]
fn split_sections_launched_entries_go_to_recent() {
let entries = vec![
entry("Firefox", None),
entry("GoLand", None),
entry("Steam", None),
];
let mut counts = HashMap::new();
counts.insert("Firefox".to_string(), 5);
let history = LaunchHistory::from_counts(counts);
let (recent, apps) = split_sections(entries, &history);
assert_eq!(recent.iter().map(|e| &e.name).collect::<Vec<_>>(), vec!["Firefox"]);
assert_eq!(
apps.iter().map(|e| &e.name).collect::<Vec<_>>(),
vec!["GoLand", "Steam"]
);
}
#[test]
fn split_sections_caps_recent_at_max() {
let entries: Vec<DesktopEntry> = (0..(MAX_RECENT + 2))
.map(|i| entry(&format!("App{i}"), None))
.collect();
let counts = entries
.iter()
.map(|e| (e.name.clone(), 1))
.collect::<HashMap<_, _>>();
let history = LaunchHistory::from_counts(counts);
let (recent, apps) = split_sections(entries, &history);
assert_eq!(recent.len(), MAX_RECENT);
assert_eq!(apps.len(), 2);
}
#[test]
fn split_sections_preserves_relative_order_within_each_group() {
let mut counts = HashMap::new();
counts.insert("A".to_string(), 1);
counts.insert("C".to_string(), 3);
let history = LaunchHistory::from_counts(counts);
// load_sorted_entries would already have ordered these by count
// desc before calling split_sections; split_sections itself just
// partitions in whatever order it's handed, so feed it pre-sorted.
let pre_sorted = vec![entry("C", None), entry("A", None), entry("B", None)];
let (recent, apps) = split_sections(pre_sorted, &history);
assert_eq!(recent.iter().map(|e| &e.name).collect::<Vec<_>>(), vec!["C", "A"]);
assert_eq!(apps.iter().map(|e| &e.name).collect::<Vec<_>>(), vec!["B"]);
}
}

50
bread-launcher/src/paths.rs
View file

@ -1,50 +0,0 @@
use std::{env, path::PathBuf};
// ---- XDG path helpers -------------------------------------------------------
pub fn home_dir() -> PathBuf {
PathBuf::from(env::var("HOME").unwrap_or_else(|_| "/tmp".into()))
}
/// `$XDG_CACHE_HOME/<app>` (or `~/.cache/<app>`). `app` is the caller's own
/// name in this scheme — e.g. breadbox passes `"breadbox"` to keep using the
/// on-disk layout it always has; a future host picks its own.
pub fn cache_dir(app: &str) -> PathBuf {
env::var("XDG_CACHE_HOME")
.map(PathBuf::from)
.unwrap_or_else(|_| home_dir().join(".cache"))
.join(app)
}
/// `$XDG_CONFIG_HOME/<app>` (or `~/.config/<app>`). See [`cache_dir`].
pub fn config_dir(app: &str) -> PathBuf {
env::var("XDG_CONFIG_HOME")
.map(PathBuf::from)
.unwrap_or_else(|_| home_dir().join(".config"))
.join(app)
}
/// The `applications/` directories a `.desktop` file may live in, per the
/// XDG base-directory spec (system-wide first, user-local last so later
/// entries can override earlier ones on lookup by filename).
pub fn app_dirs() -> Vec<PathBuf> {
let home = home_dir();
let mut dirs = vec![PathBuf::from("/usr/share/applications")];
let xdg_data_dirs =
env::var("XDG_DATA_DIRS").unwrap_or_else(|_| "/usr/local/share:/usr/share".into());
for d in xdg_data_dirs.split(':') {
let p = PathBuf::from(d).join("applications");
if p != dirs[0] {
dirs.push(p);
}
}
dirs.push(
env::var("XDG_DATA_HOME")
.map(PathBuf::from)
.unwrap_or_else(|_| home.join(".local/share"))
.join("applications"),
);
dirs
}

391
bread-launcher/src/query.rs
View file

@ -1,391 +0,0 @@
//! Query modes (`04-spotlight.html`'s `BOS.parseQuery`/`BOS.evalCalc`/
//! `BOS.COMMANDS`, THEME_SYSTEM_PLAN.md phase 6c): a leading `=`/`>`/`.`
//! switches the launcher from filtering apps to evaluating an arithmetic
//! expression, listing bread commands, or treating the rest of the query as
//! a URL to open. Pure/headless — no GTK here — so both breadbar's embedded
//! capsule and (per the module doc comment on `crate`) breadbox's own
//! overlay window can adopt the same parsing/eval/filter logic. A host is
//! expected to gate which prefixes it actually acts on against its theme's
//! `[launcher].modes` list — this module recognizes all four kinds
//! unconditionally and leaves that gating to the caller.
use crate::matching::fuzzy_matches;
/// Which of the four query modes a raw entry-text string names, per its
/// leading character (mirrors `BOS.parseQuery`).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum QueryKind {
/// No recognized prefix — the ordinary app-filter query.
Apps,
/// Leading `=` — the rest is an arithmetic expression for [`eval_calc`].
Calc,
/// Leading `>` — the rest filters [`builtin_commands`].
Cmd,
/// Leading `.` — the rest is a URL to open.
Url,
}
/// A parsed query: which mode it names, and the text after the prefix
/// character (empty string for a bare `=`/`>`/`.` with nothing typed yet).
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ParsedQuery {
pub kind: QueryKind,
pub value: String,
}
/// Splits `raw` on its leading mode character, if any. Mirrors
/// `BOS.parseQuery` exactly: only the FIRST character is checked, and it is
/// stripped along with any immediately-following whitespace.
pub fn parse_query(raw: &str) -> ParsedQuery {
let (kind, rest) = if let Some(rest) = raw.strip_prefix('=') {
(QueryKind::Calc, rest)
} else if let Some(rest) = raw.strip_prefix('>') {
(QueryKind::Cmd, rest)
} else if let Some(rest) = raw.strip_prefix('.') {
(QueryKind::Url, rest)
} else {
(QueryKind::Apps, raw)
};
ParsedQuery {
kind,
value: rest.trim().to_string(),
}
}
// ---- Calc ---------------------------------------------------------------
/// Evaluates `expr` as a small four-function arithmetic expression
/// (`+ - * / ( )`, decimal literals, unary minus) and formats the result
/// the same way `BOS.evalCalc` does: rounded to 8 decimal places, an
/// integer result prints with no trailing `.0`, a non-finite result prints
/// "∞", an expression containing anything outside `[0-9.\s+\-*/()]`
/// returns "bad expr", and anything else that fails to parse or evaluate
/// (unbalanced parens, division producing NaN, trailing garbage) returns
/// "err". `None` only for an empty/whitespace-only expression — the
/// caller's "nothing typed after `=` yet" case, which has no result to
/// show at all (the demo's own `if (!expr) return null;`).
pub fn eval_calc(expr: &str) -> Option<String> {
let expr = expr.trim();
if expr.is_empty() {
return None;
}
if !expr.chars().all(|c| c.is_ascii_digit() || " .+-*/()".contains(c)) {
return Some("bad expr".to_string());
}
let mut p = CalcParser {
bytes: expr.as_bytes(),
pos: 0,
};
let result = p.parse_expr().filter(|_| p.skip_ws() == p.bytes.len());
Some(match result {
Some(n) if !n.is_finite() => "∞".to_string(),
Some(n) => format_calc_result(n),
None => "err".to_string(),
})
}
/// Rounds to 8 decimal places and formats without a trailing `.0` for whole
/// numbers — `String(Math.round(n * 1e8) / 1e8)` in JS, `{}` on `f64`
/// already behaves the same way in Rust (`format!("{}", 4.0_f64)` == "4").
fn format_calc_result(n: f64) -> String {
let rounded = (n * 1e8).round() / 1e8;
// Avoid printing "-0" for a result that rounds to negative zero.
let rounded = if rounded == 0.0 { 0.0 } else { rounded };
format!("{rounded}")
}
/// Minimal recursive-descent parser: `expr := term (('+'|'-') term)*`,
/// `term := factor (('*'|'/') factor)*`, `factor := '-' factor | number |
/// '(' expr ')'`. Byte-indexed since the character set is already
/// restricted to ASCII by [`eval_calc`]'s pre-check.
struct CalcParser<'a> {
bytes: &'a [u8],
pos: usize,
}
impl<'a> CalcParser<'a> {
fn skip_ws(&mut self) -> usize {
while self.pos < self.bytes.len() && self.bytes[self.pos] == b' ' {
self.pos += 1;
}
self.pos
}
fn peek(&mut self) -> Option<u8> {
self.skip_ws();
self.bytes.get(self.pos).copied()
}
fn parse_expr(&mut self) -> Option<f64> {
let mut val = self.parse_term()?;
loop {
match self.peek() {
Some(b'+') => {
self.pos += 1;
val += self.parse_term()?;
}
Some(b'-') => {
self.pos += 1;
val -= self.parse_term()?;
}
_ => break,
}
}
Some(val)
}
fn parse_term(&mut self) -> Option<f64> {
let mut val = self.parse_factor()?;
loop {
match self.peek() {
Some(b'*') => {
self.pos += 1;
val *= self.parse_factor()?;
}
Some(b'/') => {
self.pos += 1;
val /= self.parse_factor()?;
}
_ => break,
}
}
Some(val)
}
fn parse_factor(&mut self) -> Option<f64> {
match self.peek()? {
b'-' => {
self.pos += 1;
Some(-self.parse_factor()?)
}
b'+' => {
self.pos += 1;
self.parse_factor()
}
b'(' => {
self.pos += 1;
let val = self.parse_expr()?;
if self.peek() == Some(b')') {
self.pos += 1;
Some(val)
} else {
None
}
}
c if c.is_ascii_digit() || c == b'.' => self.parse_number(),
_ => None,
}
}
fn parse_number(&mut self) -> Option<f64> {
self.skip_ws();
let start = self.pos;
let mut seen_dot = false;
let mut seen_digit = false;
while let Some(&c) = self.bytes.get(self.pos) {
if c.is_ascii_digit() {
seen_digit = true;
self.pos += 1;
} else if c == b'.' && !seen_dot {
seen_dot = true;
self.pos += 1;
} else {
break;
}
}
if !seen_digit {
return None;
}
std::str::from_utf8(&self.bytes[start..self.pos])
.ok()
.and_then(|s| s.parse::<f64>().ok())
}
}
// ---- Commands -------------------------------------------------------------
/// One `>`-mode command palette entry: a display `name` and the shell
/// command it runs (via `bash -c`, same spawn convention [`crate::do_launch`]
/// already uses for a desktop entry's `Exec=` line).
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Command {
pub id: &'static str,
pub name: &'static str,
pub exec: &'static str,
}
/// A small, real bread-ecosystem command palette — deliberately not the
/// demo's placeholder set (`Lock session`/`Open settings`/`Test
/// notification` map to nothing real in this codebase). `loginctl
/// lock-session` and `bread reload` are both already-documented, safe,
/// no-argument commands (see the bread CLI reference / systemd-logind).
pub fn builtin_commands() -> &'static [Command] {
&[
Command {
id: "lock",
name: "Lock session",
exec: "loginctl lock-session",
},
Command {
id: "reload-breadd",
name: "Reload breadd",
exec: "bread reload",
},
]
}
/// Fuzzy-filters `commands` by `query` against each command's `name` (same
/// subsequence match [`crate::fuzzy_matches`] uses for app rows) — an empty
/// query matches everything, same as the app list's own empty-query case.
pub fn filter_commands(query: &str, commands: &[Command]) -> Vec<Command> {
commands
.iter()
.filter(|c| fuzzy_matches(query, c.name))
.cloned()
.collect()
}
#[cfg(test)]
mod tests {
use super::*;
// ---- parse_query -------------------------------------------------
#[test]
fn parse_query_bare_text_is_apps() {
let p = parse_query("firefox");
assert_eq!(p.kind, QueryKind::Apps);
assert_eq!(p.value, "firefox");
}
#[test]
fn parse_query_empty_is_apps() {
let p = parse_query("");
assert_eq!(p.kind, QueryKind::Apps);
assert_eq!(p.value, "");
}
#[test]
fn parse_query_equals_is_calc() {
let p = parse_query("=2+2");
assert_eq!(p.kind, QueryKind::Calc);
assert_eq!(p.value, "2+2");
}
#[test]
fn parse_query_gt_is_cmd() {
let p = parse_query(">lock");
assert_eq!(p.kind, QueryKind::Cmd);
assert_eq!(p.value, "lock");
}
#[test]
fn parse_query_dot_is_url() {
let p = parse_query(".breadway.dev");
assert_eq!(p.kind, QueryKind::Url);
assert_eq!(p.value, "breadway.dev");
}
#[test]
fn parse_query_strips_leading_whitespace_after_prefix() {
let p = parse_query("= 2 + 2 ");
assert_eq!(p.kind, QueryKind::Calc);
assert_eq!(p.value, "2 + 2");
}
#[test]
fn parse_query_bare_prefix_has_empty_value() {
assert_eq!(parse_query("=").value, "");
assert_eq!(parse_query(">").value, "");
assert_eq!(parse_query(".").value, "");
}
// ---- eval_calc -----------------------------------------------------
#[test]
fn eval_calc_empty_expr_is_none() {
assert_eq!(eval_calc(""), None);
assert_eq!(eval_calc(" "), None);
}
#[test]
fn eval_calc_simple_addition() {
assert_eq!(eval_calc("2+2"), Some("4".to_string()));
}
#[test]
fn eval_calc_precedence() {
assert_eq!(eval_calc("2+3*4"), Some("14".to_string()));
}
#[test]
fn eval_calc_parens() {
assert_eq!(eval_calc("(2+3)*4"), Some("20".to_string()));
}
#[test]
fn eval_calc_unary_minus() {
assert_eq!(eval_calc("-5+2"), Some("-3".to_string()));
}
#[test]
fn eval_calc_decimals_round_to_8_places() {
assert_eq!(eval_calc("0.1+0.2"), Some("0.3".to_string()));
}
#[test]
fn eval_calc_division_by_zero_is_infinity_symbol() {
assert_eq!(eval_calc("1/0"), Some("∞".to_string()));
}
#[test]
fn eval_calc_bad_chars_is_bad_expr() {
assert_eq!(eval_calc("2+alert(1)"), Some("bad expr".to_string()));
assert_eq!(eval_calc("rm -rf /"), Some("bad expr".to_string()));
}
#[test]
fn eval_calc_unbalanced_parens_is_err() {
assert_eq!(eval_calc("(2+3"), Some("err".to_string()));
}
#[test]
fn eval_calc_trailing_garbage_is_err() {
assert_eq!(eval_calc("2+3)"), Some("err".to_string()));
}
#[test]
fn eval_calc_double_operator_is_err() {
assert_eq!(eval_calc("2++"), Some("err".to_string()));
}
#[test]
fn eval_calc_whitespace_is_tolerated() {
assert_eq!(eval_calc(" 2 + 2 "), Some("4".to_string()));
}
// ---- commands --------------------------------------------------------
#[test]
fn builtin_commands_are_non_empty() {
assert!(!builtin_commands().is_empty());
}
#[test]
fn filter_commands_empty_query_matches_all() {
let all = builtin_commands();
assert_eq!(filter_commands("", all).len(), all.len());
}
#[test]
fn filter_commands_filters_by_name_subsequence() {
let matches = filter_commands("lock", builtin_commands());
assert!(matches.iter().any(|c| c.id == "lock"));
assert!(!matches.iter().any(|c| c.id == "reload-breadd"));
}
#[test]
fn filter_commands_no_match_is_empty() {
assert!(filter_commands("zzzznotacommand", builtin_commands()).is_empty());
}
}

43
bread-onnx/Cargo.toml
View file

@ -1,43 +0,0 @@
[package]
name = "bread-onnx"
version.workspace = true
edition.workspace = true
license.workspace = true
authors.workspace = true
description = "Shared ONNX Runtime plumbing for the bread ecosystem: session building, execution-provider fallback with loud diagnostics, embedding-pipeline tensor math, and verified model downloads"
repository = "https://git.breadway.dev/Breadway/bread-ecosystem"
keywords = ["onnx", "onnxruntime", "ml", "embeddings"]
[dependencies]
bread-utils = { path = "../bread-utils" }
# Left at default-features = false, with no api-XX/download-binaries/
# load-dynamic/tls-native features of our own: those choices (how each app
# obtains/links its onnxruntime .so, and which ONNX Runtime C API version to
# bind) are consumer-build-environment decisions that stay in each app's own
# Cargo.toml (breadarr, breadmill, and breadpad already each pin different
# ones). Cargo's feature unification means this crate's minimal declaration
# just rides along with whatever the consuming app already selected.
ort = { version = "2.0.0-rc.12", default-features = false, features = ["std", "tracing"] }
# Default features left on (unlike `ort` above) — breadarr and breadmill
# both already build against plain default-featured tokenizers; only
# breadpad customizes this (http, fancy-regex), and Cargo's feature
# unification only ever adds features on top of this minimal baseline, so
# breadpad's own selection still applies in its own build.
tokenizers = "0.23"
tracing = { workspace = true }
ureq = { workspace = true }
sha2 = { workspace = true }
hex = { workspace = true }
anyhow = { workspace = true }
[dev-dependencies]
tempfile = "3"
# Dev-dependency features unify into this crate's own test/bench builds
# only, never into downstream consumers (they aren't part of the dependency
# graph a consuming app resolves) — so this doesn't compromise the
# consumer-chooses-the-backend policy above. Without it, `cargo test` here
# fails at link time (undefined OrtGetApiBase) because nothing in this
# workspace supplies a backend; none of bread-onnx's own unit tests open a
# real ONNX session, so `load-dynamic` (dlopen at runtime, no static link)
# is enough to satisfy the linker.
ort = { version = "2.0.0-rc.12", default-features = false, features = ["std", "tracing", "load-dynamic", "api-24"] }

112
bread-onnx/src/download.rs
View file

@ -1,112 +0,0 @@
//! Model download + integrity checking.
//!
//! `breadarrd/src/matcher/mod.rs::download` (async, `reqwest`) and
//! `breadmill/src/main.rs::download_if_missing` (sync, `ureq`) independently
//! implement "download to a temp file, then rename over the destination"
//! for fetching an ONNX model/tokenizer if it isn't already present —
//! genuinely duplicated intent, different HTTP clients. Neither verifies
//! the download's integrity beyond "the response wasn't empty". This module
//! is a fresh, shared implementation (sync, `ureq` — matching this
//! workspace's existing `bakery` convention for downloads) that adds an
//! optional SHA-256 check, built on [`bread_utils::atomic::write_atomic_bytes`]
//! for the same crash-safety property both originals already had.
//!
//! `breadarrd`'s async caller should wrap a call to [`ensure_file`] in
//! `tokio::task::spawn_blocking` rather than block its async runtime
//! directly — see that crate's migration for the concrete pattern.
use std::io::Read;
use std::path::{Path, PathBuf};
use sha2::{Digest, Sha256};
/// Download `url` to `dest` if `dest` doesn't already exist. If
/// `expected_sha256` is given, verifies the downloaded bytes against it
/// (case-insensitive hex) before the atomic rename and returns an error on
/// mismatch — the temp file is discarded, `dest` is left untouched. An
/// already-present `dest` is trusted as-is and not re-verified (matches
/// both original implementations' "if it exists, skip" behavior; re-hashing
/// a ~90MB+ model file on every startup would be wasted work for the common
/// case of a stable, previously-verified file).
pub fn ensure_file(url: &str, dest: &Path, expected_sha256: Option<&str>) -> anyhow::Result<PathBuf> {
if dest.exists() {
return Ok(dest.to_path_buf());
}
tracing::info!("bread-onnx: downloading {url} -> {}", dest.display());
let agent = ureq::AgentBuilder::new()
.timeout(std::time::Duration::from_secs(300))
.build();
let response = agent
.get(url)
.call()
.map_err(|e| anyhow::anyhow!("failed to download {url}: {e}"))?;
let mut bytes = Vec::new();
response
.into_reader()
.read_to_end(&mut bytes)
.map_err(|e| anyhow::anyhow!("failed to read response body from {url}: {e}"))?;
if bytes.is_empty() {
anyhow::bail!("empty download from {url}");
}
if let Some(expected) = expected_sha256 {
let actual = sha256_hex(&bytes);
if !actual.eq_ignore_ascii_case(expected) {
anyhow::bail!(
"checksum mismatch for {url}: expected {expected}, got {actual} — refusing to install"
);
}
tracing::info!("bread-onnx: verified sha256 for {}", dest.display());
}
if let Some(parent) = dest.parent() {
std::fs::create_dir_all(parent)?;
}
bread_utils::atomic::write_atomic_bytes(dest, &bytes, None)
.map_err(|e| anyhow::anyhow!("failed to write {}: {e}", dest.display()))?;
tracing::info!(
"bread-onnx: saved {} ({:.1} MB)",
dest.display(),
bytes.len() as f64 / 1_048_576.0
);
Ok(dest.to_path_buf())
}
pub fn sha256_hex(data: &[u8]) -> String {
let mut hasher = Sha256::new();
hasher.update(data);
hex::encode(hasher.finalize())
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn sha256_hex_matches_known_vector() {
// sha256("") — well-known empty-input digest.
assert_eq!(
sha256_hex(b""),
"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
);
}
#[test]
fn ensure_file_skips_download_when_already_present() {
let dir = std::env::temp_dir().join(format!("bread-onnx-download-test-{}", std::process::id()));
std::fs::create_dir_all(&dir).unwrap();
let dest = dir.join("model.onnx");
std::fs::write(&dest, b"already here").unwrap();
// A bogus URL would fail if actually requested — success here proves
// the existing-file short-circuit fired instead of dialing out.
let result = ensure_file("http://127.0.0.1:1/unreachable", &dest, None);
assert!(result.is_ok());
assert_eq!(std::fs::read(&dest).unwrap(), b"already here");
let _ = std::fs::remove_dir_all(&dir);
}
}

220
bread-onnx/src/embedding.rs
View file

@ -1,220 +0,0 @@
//! Shared BERT-family embedding pipeline: tokenize → build `input_ids`/
//! `attention_mask`/`token_type_ids` tensors → run → mean-pool the
//! non-padded positions of `last_hidden_state` → L2-normalize → clamp/pad to
//! a configured output dimension.
//!
//! This is extracted from two independently-written but essentially
//! byte-identical implementations:
//! - `breadarrd/src/matcher/embed.rs::OrtEmbedder::embed` (lines 45-111) and
//! its `l2_normalize` (lines 114-121)
//! - `breadmill/src/embed.rs::OrtEmbedder::embed_with_prefix` (lines 65-153)
//! and its `l2_normalize` (lines 156-163)
//!
//! Both truncate to a max sequence length, build the same three `i64`
//! tensors, run the same `input_ids`/`attention_mask`/`token_type_ids` →
//! `last_hidden_state` shape contract, mean-pool over `actual_seq.min(mask.len())`
//! positions (both already independently arrived at the same `.min()` guard
//! for execution providers that pad the output sequence dimension), and
//! L2-normalize with the same `1e-10` epsilon. `breadmill`'s only real
//! difference is prepending a document/query prefix string before
//! tokenizing, which stays the caller's responsibility here — pass the
//! already-prefixed text to [`EmbeddingSession::embed`].
use std::path::Path;
use ort::session::builder::GraphOptimizationLevel;
use ort::session::Session;
use ort::value::Tensor;
use tokenizers::Tokenizer;
use crate::provider::Provider;
use crate::session::build_session;
pub struct EmbeddingSession {
session: Session,
tokenizer: Tokenizer,
dim: usize,
max_seq_len: usize,
}
impl EmbeddingSession {
/// Load a BERT-family embedding model + tokenizer, selecting execution
/// providers via [`build_session`]. `dim` is the output embedding
/// dimension (results are truncated/zero-padded to it — matches how
/// both original implementations handled a model whose `dim` config
/// might not exactly match `last_hidden_state`'s actual width). `max_seq_len`
/// caps tokenized input length before inference (truncating, not
/// erroring) to bound attention memory on pathological inputs.
pub fn load(
model_path: &Path,
tokenizer_path: &Path,
dim: usize,
max_seq_len: usize,
providers: &[Provider],
) -> anyhow::Result<Self> {
let session = build_session(model_path, GraphOptimizationLevel::Level3, providers)?;
let tokenizer = Tokenizer::from_file(tokenizer_path)
.map_err(|e| anyhow::anyhow!("failed to load tokenizer: {e}"))?;
Ok(Self { session, tokenizer, dim, max_seq_len })
}
/// Embed `text` (already prefixed by the caller, if the model expects a
/// document/query prefix). Returns an L2-normalized vector of length
/// `dim`.
pub fn embed(&mut self, text: &str) -> anyhow::Result<Vec<f32>> {
let encoding = self
.tokenizer
.encode(text, true)
.map_err(|e| anyhow::anyhow!("tokenization failed: {e}"))?;
let mut ids: Vec<i64> = encoding.get_ids().iter().map(|&x| x as i64).collect();
let mut mask: Vec<i64> = encoding.get_attention_mask().iter().map(|&x| x as i64).collect();
let mut type_ids: Vec<i64> = encoding.get_type_ids().iter().map(|&x| x as i64).collect();
ids.truncate(self.max_seq_len);
mask.truncate(self.max_seq_len);
type_ids.truncate(self.max_seq_len);
let seq_len = ids.len() as i64;
let id_tensor = Tensor::<i64>::from_array((vec![1i64, seq_len], ids))
.map_err(|e| anyhow::anyhow!("failed to build input_ids tensor: {e}"))?;
let mask_tensor = Tensor::<i64>::from_array((vec![1i64, seq_len], mask.clone()))
.map_err(|e| anyhow::anyhow!("failed to build attention_mask tensor: {e}"))?;
let type_tensor = Tensor::<i64>::from_array((vec![1i64, seq_len], type_ids))
.map_err(|e| anyhow::anyhow!("failed to build token_type_ids tensor: {e}"))?;
let outputs = self
.session
.run(ort::inputs! {
"input_ids" => id_tensor,
"attention_mask" => mask_tensor,
"token_type_ids" => type_tensor,
})
.map_err(|e| anyhow::anyhow!("ort inference failed: {e}"))?;
let (shape, data) = outputs["last_hidden_state"]
.try_extract_tensor::<f32>()
.map_err(|e| anyhow::anyhow!("failed to extract last_hidden_state: {e}"))?;
let actual_seq = shape[1] as usize;
let actual_dim = shape[2] as usize;
Ok(mean_pool_normalize(data, &mask, actual_seq, actual_dim, self.dim))
}
}
/// Mean-pool `data` (flattened `[1, actual_seq, actual_dim]`) over the
/// positions `mask` marks as non-padding, L2-normalize the result, then
/// clamp/zero-pad to `target_dim`. `actual_seq.min(mask.len())` guards
/// against execution providers (MIGraphX observed doing this) that pad the
/// output sequence dimension for kernel efficiency, making `actual_seq`
/// exceed the caller's own `mask` length.
fn mean_pool_normalize(data: &[f32], mask: &[i64], actual_seq: usize, actual_dim: usize, target_dim: usize) -> Vec<f32> {
let mut result = vec![0.0f32; actual_dim];
let mut count = 0usize;
for t in 0..actual_seq.min(mask.len()) {
if mask[t] > 0 {
for d in 0..actual_dim {
result[d] += data[t * actual_dim + d];
}
count += 1;
}
}
if count > 0 {
for x in &mut result {
*x /= count as f32;
}
}
l2_normalize(&mut result);
result.truncate(target_dim);
while result.len() < target_dim {
result.push(0.0);
}
result
}
fn l2_normalize(v: &mut [f32]) {
let norm: f32 = v.iter().map(|x| x * x).sum::<f32>().sqrt();
if norm > 1e-10 {
for x in v.iter_mut() {
*x /= norm;
}
}
}
pub fn cosine_similarity(a: &[f32], b: &[f32]) -> f32 {
a.iter().zip(b).map(|(x, y)| x * y).sum()
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn l2_normalize_produces_unit_vector() {
let mut v = vec![3.0, 4.0];
l2_normalize(&mut v);
let norm: f32 = v.iter().map(|x| x * x).sum::<f32>().sqrt();
assert!((norm - 1.0).abs() < 1e-6);
}
#[test]
fn l2_normalize_leaves_zero_vector_untouched() {
let mut v = vec![0.0, 0.0, 0.0];
l2_normalize(&mut v);
assert_eq!(v, vec![0.0, 0.0, 0.0]);
}
#[test]
fn cosine_similarity_of_identical_unit_vectors_is_one() {
let mut v = vec![1.0, 2.0, 3.0];
l2_normalize(&mut v);
let sim = cosine_similarity(&v, &v);
assert!((sim - 1.0).abs() < 1e-6);
}
#[test]
fn cosine_similarity_of_orthogonal_vectors_is_zero() {
let a = vec![1.0, 0.0];
let b = vec![0.0, 1.0];
assert!(cosine_similarity(&a, &b).abs() < 1e-6);
}
#[test]
fn mean_pool_ignores_padded_positions() {
// actual_dim = 2, 3 positions: two real tokens + one padded (mask=0)
let data = vec![
1.0, 1.0, // t0: real
9.0, 9.0, // t1: padded, should be ignored
3.0, 3.0, // t2: real
];
let mask = vec![1, 0, 1];
let pooled = mean_pool_normalize(&data, &mask, 3, 2, 2);
// Mean of (1,1) and (3,3) is (2,2), normalized to unit length.
let expected_norm = (2.0f32 * 2.0 + 2.0 * 2.0).sqrt();
assert!((pooled[0] - 2.0 / expected_norm).abs() < 1e-5);
assert!((pooled[1] - 2.0 / expected_norm).abs() < 1e-5);
}
#[test]
fn mean_pool_clamps_actual_seq_to_mask_len_for_padded_ep_output() {
// Regression guard for the MIGraphX-padded-output-sequence case both
// original implementations independently guarded against: actual_seq
// (4) exceeds mask.len() (2) — must not index out of the mask.
let data = vec![1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0];
let mask = vec![1, 1];
let pooled = mean_pool_normalize(&data, &mask, 4, 2, 2);
assert!(pooled.iter().all(|x| x.is_finite()));
}
#[test]
fn mean_pool_pads_short_result_to_target_dim() {
let data = vec![1.0, 1.0];
let mask = vec![1];
let pooled = mean_pool_normalize(&data, &mask, 1, 1, 4);
assert_eq!(pooled.len(), 4);
assert_eq!(pooled[2], 0.0);
assert_eq!(pooled[3], 0.0);
}
}

32
bread-onnx/src/lib.rs
View file

@ -1,32 +0,0 @@
//! Shared ONNX Runtime plumbing for the bread ecosystem.
//!
//! Extracted from breadarr, breadsearch, and breadpad during the
//! 2026-07-16 ecosystem-wide utility audit — see each module's doc comment
//! for the original file:line duplication it replaces.
//!
//! **Important**: [`session::build_session`] logs execution-provider
//! selection via the `tracing` crate, but does *not* initialize a
//! subscriber itself. Without one, ONNX Runtime's own "successfully
//! registered `XExecutionProvider`" log line (and this crate's own
//! selection logging) go nowhere — which is exactly how a GPU execution
//! provider can silently no-op back to CPU with zero visible error (see
//! [`provider`]'s doc comment for the concrete history behind this). All
//! three current consumers already call `tracing_subscriber::fmt().init()`
//! (or an `EnvFilter`-configured equivalent) at startup; any new consumer
//! must do the same before calling [`session::build_session`].
//!
//! - [`provider`] — the [`provider::Provider`] enum and the
//! MIGraphX-not-ROCm default rationale.
//! - [`session`] — session construction with EP fallback + loud logging.
//! - [`embedding`] — the shared tokenize → tensor → mean-pool → normalize
//! pipeline for BERT-family embedding models.
//! - [`download`] — model download with atomic write + optional SHA-256
//! integrity check.
pub mod download;
pub mod embedding;
pub mod provider;
pub mod session;
pub use provider::Provider;
pub use session::build_session;

152
bread-onnx/src/provider.rs
View file

@ -1,152 +0,0 @@
//! Execution-provider selection.
//!
//! This crate defaults AMD iGPU acceleration to
//! [`ort::ep::MIGraphX`](ort::ep::MIGraphX), *not*
//! [`ort::ep::ROCm`](ort::ep::ROCm), on purpose. `breadpad-shared/src/
//! classifier.rs::try_load_session` used the classic `ROCMExecutionProvider`
//! and — per the hard-won lesson recorded in this machine's own operator
//! notes (`breadsearch-gpu-backends`, from `breadsearch`'s own history) —
//! that EP silently no-ops on this class of system and falls back to CPU
//! with zero visible error: distro ROCm ONNX Runtime builds (e.g. Arch's
//! `onnxruntime-rocm`) are commonly compiled with `--use_migraphx`, not
//! `--use_rocm`, so `ROCMExecutionProvider` never actually registers, and
//! nothing surfaces that fact unless a `tracing` subscriber is initialized
//! to catch ONNX Runtime's own EP-registration log line. `breadmill/src/
//! embed.rs::rocm_session` already got this right; this module promotes
//! that provider choice (and the loud logging around it) to the shared
//! crate so it can't silently regress in any consumer again.
use std::path::PathBuf;
/// A requested execution provider, in the shared vocabulary consumers use.
/// Convert to an `ort` dispatch entry with [`Provider::to_dispatch`].
#[derive(Debug, Clone)]
pub enum Provider {
Cpu,
/// AMD iGPU/dGPU via MIGraphX (ROCm-backed onnxruntime builds). See this
/// module's doc comment for why this — not `ROCm` — is the correct
/// choice on this class of system.
MiGraphX { device_id: i32 },
/// NVIDIA GPU via CUDA.
Cuda { device_id: i32 },
/// Intel iGPU/dGPU (Arc) via OpenVINO. `cache_dir` stores OpenVINO's
/// compiled-model blobs between runs.
OpenVino { device_type: String, cache_dir: PathBuf },
/// AMD XDNA NPU via the VitisAI execution provider (Ryzen AI SDK).
/// `cache_dir` stores the compiled NPU model between runs.
Vitis {
config_file: PathBuf,
cache_dir: PathBuf,
cache_key: String,
},
}
impl Provider {
pub fn name(&self) -> &'static str {
match self {
Provider::Cpu => "CPU",
Provider::MiGraphX { .. } => "MIGraphX (AMD iGPU/dGPU)",
Provider::Cuda { .. } => "CUDA (NVIDIA GPU)",
Provider::OpenVino { .. } => "OpenVINO (Intel iGPU/dGPU)",
Provider::Vitis { .. } => "VitisAI (AMD XDNA NPU)",
}
}
/// The literal execution-provider name ONNX Runtime's own log line
/// reports on successful registration (e.g. `"Successfully registered
/// \`MIGraphXExecutionProvider\`"`) — used to build the loud log hint in
/// [`crate::session::build_session`].
fn ort_registration_name(&self) -> &'static str {
match self {
Provider::Cpu => "CPUExecutionProvider",
Provider::MiGraphX { .. } => "MIGraphXExecutionProvider",
Provider::Cuda { .. } => "CUDAExecutionProvider",
Provider::OpenVino { .. } => "OpenVINOExecutionProvider",
Provider::Vitis { .. } => "VitisAIExecutionProvider",
}
}
pub(crate) fn to_dispatch(&self) -> anyhow::Result<ort::ep::ExecutionProviderDispatch> {
Ok(match self {
Provider::Cpu => ort::ep::CPU::default().build(),
Provider::MiGraphX { device_id } => {
ensure_migraphx_cache_path_default()?;
ort::ep::MIGraphX::default().with_device_id(*device_id).build()
}
Provider::Cuda { device_id } => {
ort::ep::CUDA::default().with_device_id(*device_id).build()
}
Provider::OpenVino { device_type, cache_dir } => {
std::fs::create_dir_all(cache_dir)?;
ort::ep::OpenVINO::default()
.with_device_type(device_type.clone())
.with_cache_dir(cache_dir.to_string_lossy())
.build()
}
Provider::Vitis { config_file, cache_dir, cache_key } => {
std::fs::create_dir_all(cache_dir)?;
ort::ep::Vitis::default()
.with_config_file(config_file.to_string_lossy())
.with_cache_dir(cache_dir.to_string_lossy())
.with_cache_key(cache_key.clone())
.build()
}
})
}
/// Log a loud, consistent "using X" line plus (for non-CPU providers) a
/// reminder of exactly what to grep ONNX Runtime's own log output for —
/// this is the "at minimum log EP registration success/failure loudly
/// by default" half of the fix, independent of whether the caller has
/// wired up `tracing_subscriber` (all three current consumers already
/// do, at their own startup).
pub(crate) fn log_selection(&self) {
tracing::info!("bread-onnx: requesting {} execution provider", self.name());
if !matches!(self, Provider::Cpu) {
tracing::info!(
"bread-onnx: check ONNX Runtime's own log output for \"Successfully registered \
`{}`\" — if it's missing, the ONNX Runtime build in use wasn't compiled/shipped \
with this provider and inference silently fell back to CPU. This line only \
appears if a `tracing` subscriber is initialized.",
self.ort_registration_name()
);
}
}
}
/// MIGraphX has no Rust-level "cache directory" builder (unlike OpenVINO/
/// Vitis above) — it's controlled purely by the `ORT_MIGRAPHX_MODEL_CACHE_PATH`
/// environment variable, read by the underlying MIGraphX library at EP-
/// registration time. Left unset, MIGraphX still *works*, but recompiles
/// every kernel from scratch on every single session build — no persistence
/// between runs, or even between two sessions in the same process. Found via
/// this pass's own migration: `breadmill`'s packaged systemd unit already
/// sets this explicitly (`packaging/breadmill.service`), but nothing
/// enforced any other consumer doing the same, and `breadpad` (which had no
/// systemd unit or cache path at all) hit exactly this — every
/// `Classifier::load` call during its own test suite recompiled from a cold
/// cache, visible as repeated `migraphx_save: Error: ... write_buffer:
/// Failure opening file: ""/<hash>.mxr` log lines (an empty path prefix,
/// i.e. the env var was never set) and multi-minute test runs.
///
/// This sets a sensible shared default (`~/.cache/bread-onnx/migraphx`) if
/// the caller hasn't already set one — so every consumer gets kernel-cache
/// persistence for free instead of only the ones that remembered to
/// configure it themselves.
fn ensure_migraphx_cache_path_default() -> anyhow::Result<()> {
if std::env::var_os("ORT_MIGRAPHX_MODEL_CACHE_PATH").is_some() {
return Ok(());
}
let dir = bread_utils::xdg::cache_dir("bread-onnx").join("migraphx");
std::fs::create_dir_all(&dir)?;
tracing::info!(
"bread-onnx: ORT_MIGRAPHX_MODEL_CACHE_PATH not set; defaulting to {} \
so MIGraphX kernel compiles persist across runs",
dir.display()
);
// SAFETY: this runs before any session build spawns worker threads that
// might read the environment concurrently — same caveat as any
// `set_var` call, documented here rather than papered over.
unsafe { std::env::set_var("ORT_MIGRAPHX_MODEL_CACHE_PATH", &dir) };
Ok(())
}

49
bread-onnx/src/session.rs
View file

@ -1,49 +0,0 @@
//! Session construction with execution-provider fallback.
//!
//! Builds one `ort::session::Session` whose execution-provider dispatch
//! list is exactly `providers` (in order) with an implicit `CPU` appended
//! if the caller didn't already include one — ONNX Runtime tries each
//! listed EP per-node and falls through the list on failure, so this
//! mirrors (and replaces) the identical `.with_execution_providers([primary,
//! CPU])` pattern already proven out in `breadmill/src/embed.rs::rocm_session`
//! /`cuda_session`/`openvino_session`/`npu_session`.
use std::path::Path;
use ort::session::builder::GraphOptimizationLevel;
use ort::session::Session;
use crate::provider::Provider;
/// Build a session, trying each of `providers` in order (ONNX Runtime falls
/// through per-node on registration failure) with a trailing `CPU` fallback
/// implicitly appended if not already present. Always logs which provider
/// was requested — see [`Provider::log_selection`] — regardless of whether
/// `tracing_subscriber` is initialized, so at minimum the *attempt* is
/// visible even without wired-up logging; the actual per-EP success/failure
/// detail only surfaces once a subscriber is listening.
pub fn build_session(
model_path: &Path,
opt_level: GraphOptimizationLevel,
providers: &[Provider],
) -> anyhow::Result<Session> {
let mut dispatch = Vec::with_capacity(providers.len() + 1);
for p in providers {
p.log_selection();
dispatch.push(p.to_dispatch()?);
}
if !providers.iter().any(|p| matches!(p, Provider::Cpu)) {
dispatch.push(Provider::Cpu.to_dispatch()?);
}
let mut builder = Session::builder()
.map_err(|e| anyhow::anyhow!("failed to create ort session builder: {e}"))?
.with_optimization_level(opt_level)
.map_err(|e| anyhow::anyhow!("failed to set optimization level: {e}"))?
.with_execution_providers(dispatch)
.map_err(|e| anyhow::anyhow!("failed to configure execution providers: {e}"))?;
builder
.commit_from_file(model_path)
.map_err(|e| anyhow::anyhow!("failed to load model from {}: {e}", model_path.display()))
}

27
bread-polkit/Cargo.toml
View file

@ -1,27 +0,0 @@
[package]
name = "bread-polkit"
version.workspace = true
edition.workspace = true
license.workspace = true
authors.workspace = true
description = "Themed PolicyKit authentication agent for the bread desktop"
repository = "https://git.breadway.dev/Breadway/bread-ecosystem"
keywords = ["polkit", "gtk4", "wayland"]
[lib]
path = "src/lib.rs"
[[bin]]
name = "bread-polkit"
path = "src/main.rs"
[dependencies]
anyhow = { workspace = true }
bread-app = { path = "../bread-app", features = ["gtk"] }
bread-theme = { path = "../bread-theme", features = ["gtk"] }
gtk4 = { version = "0.11", features = ["v4_12"] }
serde = { workspace = true }
tokio = { version = "1", features = ["rt", "net", "sync", "time", "macros", "io-util", "process"] }
tracing = { workspace = true }
tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt", "env-filter", "std"] }
zbus = { version = "5", default-features = false, features = ["tokio"] }

11
bread-polkit/bakery.toml
View file

@ -1,11 +0,0 @@
name = "bread-polkit"
description = "Themed PolicyKit authentication agent for the bread desktop"
binaries = ["bread-polkit"]
system_deps = ["gtk4", "gtk4-layer-shell", "polkit"]
optional_system_deps = ["hyprland"]
bread_deps = []
license_file = "LICENSE"
desktop_file = "bread-polkit.desktop"
[install]
post_install = []

12
bread-polkit/contrib/bread-polkit.desktop
View file

@ -1,12 +0,0 @@
[Desktop Entry]
Type=Application
Name=Bread PolicyKit Agent
Comment=Themed PolicyKit authentication agent for the bread desktop
Exec=bread-polkit
Icon=dialog-password
Terminal=false
Categories=System;Security;
StartupNotify=false
X-GNOME-Autostart-Phase=Initialization
X-GNOME-AutoRestart=true
X-GNOME-Autostart-Notify=false

10
bread-polkit/contrib/hyprland.conf
View file

@ -1,10 +0,0 @@
# bread-polkit — add to hyprland.conf
#
# Session authentication agent. Copy contrib/bread-polkit.desktop to
# ~/.config/autostart/ instead if you prefer XDG autostart.
exec-once = bread-polkit
# Optional: blur the overlay panel (namespace is bread-polkit).
layerrule = blur, bread-polkit
layerrule = ignorezero, bread-polkit

370
bread-polkit/src/agent.rs
View file

@ -1,370 +0,0 @@
//! Session-bus registration and the PolicyKit1 AuthenticationAgent.
use std::collections::HashMap;
use std::sync::{Arc, OnceLock};
use anyhow::{Context, Result};
use gtk4::glib;
use gtk4::prelude::*;
use serde::{Deserialize, Serialize};
use tokio::sync::{mpsc, Mutex};
use zbus::zvariant::{OwnedValue, Type, Value};
use zbus::{connection, interface, proxy, DBusError};
use bread_polkit::helper::{discover_transport, Transport};
use bread_polkit::identity::{current_uid, pick_user, read_passwd, users_from_uids, UnixUser};
use bread_polkit::session::session_id;
use crate::auth::{self, Outcome};
use crate::ui::{self, Prompt};
pub const OBJECT_PATH: &str = "/com/breadway/PolicyKit1/AuthenticationAgent";
/// Reply from the GTK prompt.
#[derive(Debug)]
pub enum UserAction {
Submit { username: String, password: String },
Cancel,
}
#[derive(Debug, DBusError)]
#[zbus(prefix = "org.freedesktop.PolicyKit1.Error")]
enum AgentError {
#[zbus(error)]
ZBus(zbus::Error),
Failed(String),
Cancelled(String),
}
#[derive(Debug, Deserialize, Serialize, Type)]
struct Identity {
kind: String,
details: HashMap<String, OwnedValue>,
}
#[derive(Debug, Clone, Deserialize, Serialize, Type)]
struct Subject {
kind: String,
details: HashMap<String, OwnedValue>,
}
#[proxy(
interface = "org.freedesktop.PolicyKit1.Authority",
default_service = "org.freedesktop.PolicyKit1",
default_path = "/org/freedesktop/PolicyKit1/Authority"
)]
trait Authority {
fn register_authentication_agent(
&self,
subject: &Subject,
locale: &str,
object_path: &str,
) -> zbus::Result<()>;
fn unregister_authentication_agent(
&self,
subject: &Subject,
object_path: &str,
) -> zbus::Result<()>;
}
struct Agent {
transport: Transport,
pending: Arc<Mutex<Option<mpsc::Sender<UserAction>>>>,
}
#[interface(name = "org.freedesktop.PolicyKit1.AuthenticationAgent")]
impl Agent {
async fn begin_authentication(
&mut self,
action_id: String,
message: String,
_icon_name: String,
_details: HashMap<String, String>,
cookie: String,
identities: Vec<Identity>,
) -> Result<(), AgentError> {
tracing::info!(%action_id, %cookie, "BeginAuthentication");
let users = unix_users(&identities);
let username = pick_user(&users, current_uid())
.map(|u| u.name.clone())
.ok_or_else(|| AgentError::Failed("no unix-user identity".into()))?;
let allowed_users: Vec<String> = users.iter().map(|u| u.name.clone()).collect();
let (tx, mut rx) = mpsc::channel(4);
*self.pending.lock().await = Some(tx.clone());
let prompt = Prompt {
cookie: cookie.clone(),
message: message.clone(),
action_id: action_id.clone(),
username: username.clone(),
reply: tx,
};
invoke_ui(move || {
if let Some(app) = running_app() {
ui::show_prompt(&app, prompt);
}
});
let result = self.drive_prompt(&cookie, &username, &allowed_users, &mut rx).await;
*self.pending.lock().await = None;
let cookie_close = cookie.clone();
invoke_ui(move || ui::close_prompt(&cookie_close));
result
}
async fn cancel_authentication(&self, cookie: String) {
tracing::info!(%cookie, "CancelAuthentication");
if let Some(tx) = self.pending.lock().await.as_ref() {
let _ = tx.try_send(UserAction::Cancel);
}
invoke_ui(move || ui::close_prompt(&cookie));
}
}
impl Agent {
async fn drive_prompt(
&self,
cookie: &str,
default_user: &str,
allowed_users: &[String],
rx: &mut mpsc::Receiver<UserAction>,
) -> Result<(), AgentError> {
loop {
match rx.recv().await {
None => {
return Err(AgentError::Cancelled("authentication prompt closed".into()));
}
Some(UserAction::Cancel) => {
return Err(AgentError::Cancelled("user cancelled".into()));
}
Some(UserAction::Submit { username, password }) => {
// The username field is user-editable; only accept it when
// it's one of the identities polkit offered (empty falls
// back to the prefilled user). Anything else is rejected
// and the prompt re-shown rather than starting a PAM
// conversation for an account the request never offered.
let Some(user) = resolve_user(default_user, allowed_users, &username) else {
let cookie = cookie.to_string();
invoke_ui(move || ui::show_retry(&cookie, INVALID_USER_MESSAGE));
continue;
};
match auth::authenticate(&self.transport, &user, cookie, &password).await {
Ok(Outcome::Success) => return Ok(()),
Ok(Outcome::Failure { message }) => {
let text = message
.unwrap_or_else(|| auth::default_failure_message().to_string());
let cookie = cookie.to_string();
invoke_ui(move || ui::show_retry(&cookie, &text));
}
Err(e) => {
tracing::warn!("helper: {e:#}");
let text = e.to_string();
let cookie = cookie.to_string();
invoke_ui(move || ui::show_retry(&cookie, &text));
}
}
}
}
}
}
}
const INVALID_USER_MESSAGE: &str =
"That user is not one of the identities this request offered — use the prefilled user.";
/// Choose the username to authenticate as from the prompt input.
///
/// Empty input falls back to `default`. Non-empty input must be one of
/// `allowed` — the `unix-user` identities polkit actually offered in
/// `BeginAuthentication` — otherwise it returns `None`. Without this, a
/// request scoped to specific accounts (say, `root` only) could have its
/// editable username field redirected to an arbitrary local user, kicking
/// off a PAM conversation for an account the request never offered.
/// (`auth::authenticate`'s PAM result still has to clear polkit's own
/// authorization, but this closes the obvious foot-gun at the agent — the
/// one place the identity list is actually known.)
fn resolve_user(default: &str, allowed: &[String], input: &str) -> Option<String> {
if input.is_empty() {
return Some(default.to_string());
}
if allowed.iter().any(|u| u.as_str() == input) {
return Some(input.to_string());
}
None
}
fn unix_users(identities: &[Identity]) -> Vec<UnixUser> {
let mut uids = Vec::new();
for identity in identities {
if identity.kind != "unix-user" {
continue;
}
if let Some(uid) = uid_from_details(&identity.details) {
uids.push(uid);
}
}
users_from_uids(&uids, &read_passwd())
}
fn uid_from_details(details: &HashMap<String, OwnedValue>) -> Option<u32> {
let value = details.get("uid")?;
u32::try_from(value).ok().or_else(|| {
i32::try_from(value)
.ok()
.and_then(|n| u32::try_from(n).ok())
})
}
fn running_app() -> Option<gtk4::Application> {
gtk4::gio::Application::default().and_then(|app| app.downcast::<gtk4::Application>().ok())
}
/// GTK thread-default context, captured in [`spawn`] so the dbus thread
/// can `invoke` onto the UI thread instead of its own empty context.
static GTK_CTX: OnceLock<glib::MainContext> = OnceLock::new();
fn invoke_ui(f: impl FnOnce() + Send + 'static) {
let ctx = GTK_CTX
.get()
.cloned()
.unwrap_or_else(glib::MainContext::default);
ctx.invoke(f);
}
fn unix_session_subject(id: &str) -> Result<Subject> {
let value = Value::from(id.to_string());
let owned = OwnedValue::try_from(value).context("session-id variant")?;
let mut details = HashMap::new();
details.insert("session-id".into(), owned);
Ok(Subject {
kind: "unix-session".into(),
details,
})
}
/// Spawn the system-bus agent on a background thread. Returns once the
/// thread has been started; registration errors quit the GTK app.
///
/// Must be called from the GTK thread so the main context we capture is
/// the one driving the password prompt.
pub fn spawn() -> Result<()> {
let _ = GTK_CTX.set(glib::MainContext::default());
std::thread::Builder::new()
.name("bread-polkit-dbus".into())
.spawn(move || {
let rt = match tokio::runtime::Builder::new_current_thread()
.enable_all()
.build()
{
Ok(rt) => rt,
Err(e) => {
invoke_ui(move || {
eprintln!("bread-polkit: tokio runtime failed: {e}");
if let Some(app) = running_app() {
app.quit();
}
});
return;
}
};
rt.block_on(async move {
if let Err(e) = run().await {
eprintln!("bread-polkit: {e:#}");
invoke_ui(|| {
if let Some(app) = running_app() {
app.quit();
}
});
}
});
})
.context("spawn dbus thread")?;
Ok(())
}
async fn run() -> Result<()> {
let transport = discover_transport().context(
"no polkit helper: expected /run/polkit/agent-helper.socket \
or /usr/lib/polkit-1/polkit-agent-helper-1",
)?;
tracing::info!(?transport, "using polkit helper");
let session = session_id().context(
"no session id (XDG_SESSION_ID / /proc/self/sessionid); \
cannot register a session authentication agent",
)?;
let subject = unix_session_subject(&session)?;
let locale = std::env::var("LANG").unwrap_or_else(|_| "C".into());
let agent = Agent {
transport,
pending: Arc::new(Mutex::new(None)),
};
let connection = connection::Builder::system()?
.serve_at(OBJECT_PATH, agent)?
.build()
.await
.context("system bus")?;
let authority = AuthorityProxy::new(&connection)
.await
.context("PolicyKit1 authority proxy")?;
authority
.register_authentication_agent(&subject, &locale, OBJECT_PATH)
.await
.context("RegisterAuthenticationAgent")?;
tracing::info!(%session, "registered as PolicyKit authentication agent");
std::future::pending::<()>().await;
#[allow(unreachable_code)]
{
let _ = authority
.unregister_authentication_agent(&subject, OBJECT_PATH)
.await;
Ok(())
}
}
#[cfg(test)]
mod tests {
use super::*;
fn allowed() -> Vec<String> {
vec!["root".to_string(), "1000".to_string()]
}
#[test]
fn resolve_user_falls_back_to_default_on_empty_input() {
assert_eq!(
resolve_user("root", &allowed(), ""),
Some("root".to_string())
);
}
#[test]
fn resolve_user_accepts_an_offered_identity() {
assert_eq!(
resolve_user("root", &allowed(), "1000"),
Some("1000".to_string())
);
}
#[test]
fn resolve_user_rejects_a_user_polkit_did_not_offer() {
assert_eq!(resolve_user("root", &allowed(), "alice"), None);
assert_eq!(resolve_user("root", &allowed(), "daemon"), None);
}
#[test]
fn resolve_user_is_case_exact() {
// Usernames are case-significant; "ROOT" is a different principle
// than the offered "root", so it must be rejected.
assert_eq!(resolve_user("root", &allowed(), "ROOT"), None);
}
}

109
bread-polkit/src/auth.rs
View file

@ -1,109 +0,0 @@
//! PAM conversation with the polkit agent helper.
use std::process::Stdio;
use anyhow::{Context, Result};
use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
use tokio::net::UnixStream;
use tokio::process::Command;
use bread_polkit::helper::{parse_helper_line, HelperLine, Transport};
/// Outcome of one helper conversation.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum Outcome {
Success,
Failure { message: Option<String> },
}
/// Handshake + PAM loop for one password attempt.
pub async fn authenticate(
transport: &Transport,
username: &str,
cookie: &str,
password: &str,
) -> Result<Outcome> {
match transport {
Transport::Socket(path) => {
let mut stream = UnixStream::connect(path)
.await
.with_context(|| format!("connect {}", path.display()))?;
stream.write_all(username.as_bytes()).await?;
stream.write_all(b"\n").await?;
stream.write_all(cookie.as_bytes()).await?;
stream.write_all(b"\n").await?;
let (reader, writer) = stream.into_split();
converse(BufReader::new(reader), writer, password).await
}
Transport::Exec(path) => {
let mut child = Command::new(path)
.arg(username)
.env("LC_ALL", "C")
.stdin(Stdio::piped())
.stdout(Stdio::piped())
.stderr(Stdio::null())
.spawn()
.with_context(|| format!("spawn {}", path.display()))?;
let mut stdin = child.stdin.take().context("polkit helper has no stdin")?;
let stdout = child.stdout.take().context("polkit helper has no stdout")?;
stdin.write_all(cookie.as_bytes()).await?;
stdin.write_all(b"\n").await?;
let outcome = converse(BufReader::new(stdout), stdin, password).await;
let _ = child.wait().await;
outcome
}
}
}
async fn converse<R, W>(mut reader: BufReader<R>, mut writer: W, password: &str) -> Result<Outcome>
where
R: tokio::io::AsyncRead + Unpin,
W: tokio::io::AsyncWrite + Unpin,
{
let mut last_info: Option<String> = None;
let mut line = String::new();
loop {
line.clear();
let n = reader.read_line(&mut line).await?;
if n == 0 {
return Ok(Outcome::Failure {
message: last_info.take(),
});
}
match parse_helper_line(&line) {
HelperLine::PromptEchoOff(_) => {
writer.write_all(password.as_bytes()).await?;
writer.write_all(b"\n").await?;
writer.flush().await?;
}
HelperLine::PromptEchoOn(_) => {
// Visible prompt (username, etc.) — we already sent the
// identity in the handshake. An empty line is safer than
// echoing the password.
writer.write_all(b"\n").await?;
writer.flush().await?;
}
HelperLine::ErrorMsg(msg) | HelperLine::TextInfo(msg) => {
if !msg.is_empty() {
last_info = Some(msg);
}
}
HelperLine::Success => return Ok(Outcome::Success),
HelperLine::Failure => {
return Ok(Outcome::Failure {
message: last_info.take(),
});
}
HelperLine::Other(other) => {
if !other.is_empty() {
tracing::debug!("helper: {other}");
}
}
}
}
}
/// Shared default when the helper gives no `PAM_*` text on failure.
pub fn default_failure_message() -> &'static str {
"Authentication failed. Try again."
}

205
bread-polkit/src/helper.rs
View file

@ -1,205 +0,0 @@
//! `polkit-agent-helper-1` transport and PAM line parser.
//!
//! Arch polkit 127+ talks over `/run/polkit/agent-helper.socket`. Older
//! builds still spawn the setuid helper at
//! `/usr/lib/polkit-1/polkit-agent-helper-1`. Prefer the socket when it
//! exists.
use std::path::{Path, PathBuf};
/// How this agent will talk to polkit's helper.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum Transport {
/// systemd socket-activated helper (polkit 127+).
Socket(PathBuf),
/// Legacy setuid helper binary.
Exec(PathBuf),
}
const SOCKET_CANDIDATES: &[&str] = &["/run/polkit/agent-helper.socket"];
const HELPER_CANDIDATES: &[&str] = &[
"/usr/lib/polkit-1/polkit-agent-helper-1",
"/usr/libexec/polkit-1/polkit-agent-helper-1",
];
/// One stdout line from the helper after the cookie handshake.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum HelperLine {
PromptEchoOff(String),
PromptEchoOn(String),
ErrorMsg(String),
TextInfo(String),
Success,
Failure,
Other(String),
}
/// Pick a live transport: `BREAD_POLKIT_SOCKET` / `BREAD_POLKIT_HELPER`
/// if set and present, otherwise the first existing well-known path.
pub fn discover_transport() -> Option<Transport> {
discover_transport_from(
std::env::var_os("BREAD_POLKIT_SOCKET")
.map(PathBuf::from)
.as_deref(),
std::env::var_os("BREAD_POLKIT_HELPER")
.map(PathBuf::from)
.as_deref(),
SOCKET_CANDIDATES,
HELPER_CANDIDATES,
|p| p.exists(),
)
}
/// Testable discovery: `exists` is injected so unit tests do not need a
/// real `/run/polkit` socket.
pub fn discover_transport_from(
socket_override: Option<&Path>,
helper_override: Option<&Path>,
sockets: &[&str],
helpers: &[&str],
exists: impl Fn(&Path) -> bool,
) -> Option<Transport> {
if let Some(path) = socket_override {
if exists(path) {
return Some(Transport::Socket(path.to_path_buf()));
}
}
for candidate in sockets {
let path = Path::new(candidate);
if exists(path) {
return Some(Transport::Socket(path.to_path_buf()));
}
}
if let Some(path) = helper_override {
if exists(path) {
return Some(Transport::Exec(path.to_path_buf()));
}
}
for candidate in helpers {
let path = Path::new(candidate);
if exists(path) {
return Some(Transport::Exec(path.to_path_buf()));
}
}
None
}
/// Parse one helper protocol line. Prefix match is case-sensitive and
/// matches polkit's own `PAM_*` / `SUCCESS` / `FAILURE` tokens.
pub fn parse_helper_line(line: &str) -> HelperLine {
let line = line.trim_end_matches(['\r', '\n']);
if line == "SUCCESS" || line.starts_with("SUCCESS") {
return HelperLine::Success;
}
if line == "FAILURE" || line.starts_with("FAILURE") {
return HelperLine::Failure;
}
if let Some(rest) = line.strip_prefix("PAM_PROMPT_ECHO_OFF") {
return HelperLine::PromptEchoOff(rest.trim().to_string());
}
if let Some(rest) = line.strip_prefix("PAM_PROMPT_ECHO_ON") {
return HelperLine::PromptEchoOn(rest.trim().to_string());
}
if let Some(rest) = line.strip_prefix("PAM_ERROR_MSG") {
return HelperLine::ErrorMsg(rest.trim().to_string());
}
if let Some(rest) = line.strip_prefix("PAM_TEXT_INFO") {
return HelperLine::TextInfo(rest.trim().to_string());
}
HelperLine::Other(line.to_string())
}
#[cfg(test)]
mod tests {
use super::*;
use std::collections::HashSet;
use std::path::PathBuf;
#[test]
fn parse_helper_line_known_tokens() {
assert_eq!(parse_helper_line("SUCCESS"), HelperLine::Success);
assert_eq!(parse_helper_line("SUCCESS\n"), HelperLine::Success);
assert_eq!(parse_helper_line("FAILURE"), HelperLine::Failure);
assert_eq!(
parse_helper_line("PAM_PROMPT_ECHO_OFF Password:"),
HelperLine::PromptEchoOff("Password:".into())
);
assert_eq!(
parse_helper_line("PAM_PROMPT_ECHO_OFF"),
HelperLine::PromptEchoOff(String::new())
);
assert_eq!(
parse_helper_line("PAM_PROMPT_ECHO_ON login:"),
HelperLine::PromptEchoOn("login:".into())
);
assert_eq!(
parse_helper_line("PAM_ERROR_MSG Authentication failure"),
HelperLine::ErrorMsg("Authentication failure".into())
);
assert_eq!(
parse_helper_line("PAM_TEXT_INFO Account locked"),
HelperLine::TextInfo("Account locked".into())
);
assert_eq!(
parse_helper_line("garbage"),
HelperLine::Other("garbage".into())
);
}
#[test]
fn discover_prefers_socket_over_exec() {
let present: HashSet<PathBuf> = [
"/run/polkit/agent-helper.socket",
"/usr/lib/polkit-1/polkit-agent-helper-1",
]
.into_iter()
.map(PathBuf::from)
.collect();
let got = discover_transport_from(None, None, SOCKET_CANDIDATES, HELPER_CANDIDATES, |p| {
present.contains(p)
});
assert_eq!(
got,
Some(Transport::Socket(PathBuf::from(
"/run/polkit/agent-helper.socket"
)))
);
}
#[test]
fn discover_falls_back_to_helper_binary() {
let present: HashSet<PathBuf> = ["/usr/lib/polkit-1/polkit-agent-helper-1"]
.into_iter()
.map(PathBuf::from)
.collect();
let got = discover_transport_from(None, None, SOCKET_CANDIDATES, HELPER_CANDIDATES, |p| {
present.contains(p)
});
assert_eq!(
got,
Some(Transport::Exec(PathBuf::from(
"/usr/lib/polkit-1/polkit-agent-helper-1"
)))
);
}
#[test]
fn discover_override_socket_wins_when_present() {
let override_path = Path::new("/tmp/bread-polkit-test.sock");
let got = discover_transport_from(
Some(override_path),
None,
SOCKET_CANDIDATES,
HELPER_CANDIDATES,
|p| p == override_path,
);
assert_eq!(got, Some(Transport::Socket(override_path.to_path_buf())));
}
#[test]
fn discover_none_when_nothing_exists() {
let got =
discover_transport_from(None, None, SOCKET_CANDIDATES, HELPER_CANDIDATES, |_| false);
assert_eq!(got, None);
}
}

128
bread-polkit/src/identity.rs
View file

@ -1,128 +0,0 @@
//! Unix-user identities from a PolicyKit `BeginAuthentication` call.
/// A `unix-user` identity the agent can authenticate as.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct UnixUser {
pub uid: u32,
pub name: String,
}
/// Look up `uid` in a passwd-file dump (`name:x:uid:...` lines).
pub fn name_for_uid(uid: u32, passwd: &str) -> Option<String> {
for line in passwd.lines() {
if line.starts_with('#') {
continue;
}
let mut parts = line.split(':');
let name = parts.next()?;
let _pw = parts.next()?;
let id = parts.next()?.parse::<u32>().ok()?;
if id == uid && !name.is_empty() {
return Some(name.to_string());
}
}
None
}
/// Resolve each uid to a [`UnixUser`], falling back to `uid N` when
/// `/etc/passwd` has no name.
pub fn users_from_uids(uids: &[u32], passwd: &str) -> Vec<UnixUser> {
uids.iter()
.copied()
.map(|uid| UnixUser {
uid,
name: name_for_uid(uid, passwd).unwrap_or_else(|| format!("uid {uid}")),
})
.collect()
}
/// Prefer the process's own uid when it is in `users`, otherwise the first.
pub fn pick_user(users: &[UnixUser], current_uid: Option<u32>) -> Option<&UnixUser> {
if let Some(uid) = current_uid {
if let Some(user) = users.iter().find(|u| u.uid == uid) {
return Some(user);
}
}
users.first()
}
/// Real uid from a `/proc/self/status` dump (`Uid:\t<real> ...`).
pub fn uid_from_status(status: &str) -> Option<u32> {
for line in status.lines() {
let Some(rest) = line.strip_prefix("Uid:") else {
continue;
};
return rest.split_whitespace().next()?.parse().ok();
}
None
}
/// Current real uid, or `None` if `/proc/self/status` is unreadable.
pub fn current_uid() -> Option<u32> {
let status = std::fs::read_to_string("/proc/self/status").ok()?;
uid_from_status(&status)
}
/// Contents of `/etc/passwd`, or empty if unreadable.
pub fn read_passwd() -> String {
std::fs::read_to_string("/etc/passwd").unwrap_or_default()
}
#[cfg(test)]
mod tests {
use super::*;
const PASSWD: &str = "\
# comment
root:x:0:0:root:/root:/bin/sh
alice:x:1000:1000:Alice:/home/alice:/bin/zsh
bob:x:1001:1001:Bob:/home/bob:/bin/bash
";
#[test]
fn name_for_uid_reads_passwd_lines() {
assert_eq!(name_for_uid(0, PASSWD).as_deref(), Some("root"));
assert_eq!(name_for_uid(1000, PASSWD).as_deref(), Some("alice"));
assert_eq!(name_for_uid(99, PASSWD), None);
}
#[test]
fn users_from_uids_falls_back_to_uid_label() {
let users = users_from_uids(&[1000, 42], PASSWD);
assert_eq!(
users,
vec![
UnixUser {
uid: 1000,
name: "alice".into()
},
UnixUser {
uid: 42,
name: "uid 42".into()
},
]
);
}
#[test]
fn pick_user_prefers_current_uid() {
let users = users_from_uids(&[0, 1000], PASSWD);
let picked = pick_user(&users, Some(1000)).unwrap();
assert_eq!(picked.name, "alice");
}
#[test]
fn pick_user_falls_back_to_first() {
let users = users_from_uids(&[0, 1000], PASSWD);
let picked = pick_user(&users, Some(7)).unwrap();
assert_eq!(picked.name, "root");
assert!(pick_user(&[], Some(1000)).is_none());
}
#[test]
fn uid_from_status_reads_real_uid() {
let status = "Name:\tbread-polkit\nUid:\t1000\t1000\t1000\t1000\n";
assert_eq!(uid_from_status(status), Some(1000));
assert_eq!(uid_from_status("Name:\tfoo\n"), None);
}
}

10
bread-polkit/src/lib.rs
View file

@ -1,10 +0,0 @@
//! Non-GTK PolicyKit helper logic for `bread-polkit`.
//!
//! The binary (`bread-polkit`) registers as a session authentication
//! agent and shows a themed password prompt. This library is the
//! transport / identity / session parsing that can be unit-tested
//! without a display.
pub mod helper;
pub mod identity;
pub mod session;

99
bread-polkit/src/main.rs
View file

@ -1,99 +0,0 @@
//! bread-polkit — themed PolicyKit authentication agent.
//!
//! Registers on the `org.freedesktop.PolicyKit1.AuthenticationAgent`
//! interface and shows a bread-theme GTK4 password prompt. This is an
//! agent, not a wrapper that execs `polkit-gnome`.
//!
//! Autostart: copy `contrib/bread-polkit.desktop` to
//! `~/.config/autostart/`, or add `exec-once = bread-polkit` to Hyprland.
mod agent;
mod auth;
mod ui;
use bread_app::singleton::Acquire;
use gtk4::prelude::*;
const APP_NAME: &str = "bread-polkit";
fn main() {
let arg = std::env::args().nth(1);
match arg.as_deref() {
Some("-h") | Some("--help") => {
print_help();
return;
}
Some("-V") | Some("--version") => {
println!("bread-polkit {}", env!("CARGO_PKG_VERSION"));
return;
}
Some(other) => {
eprintln!("bread-polkit: unknown argument '{other}'");
print_help();
std::process::exit(2);
}
None => {}
}
tracing_subscriber::fmt()
.with_env_filter(
tracing_subscriber::EnvFilter::try_from_default_env()
.unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
)
.with_target(false)
.init();
let _guard = match bread_app::try_acquire(APP_NAME) {
Ok(Acquire::Acquired(g)) => Some(g),
Ok(Acquire::HeldByOther(pid)) => {
eprintln!("bread-polkit: already running (pid {pid:?})");
std::process::exit(0);
}
Err(e) => {
// Don't keep running without the single-instance lock: a second
// copy would attempt to `serve_at` the same PolicyKit agent
// object path on the system bus, and a password prompt held by a
// process whose lock couldn't be taken is ambiguous state. Fail
// fast and let a wrapper/autostart retry.
eprintln!("bread-polkit: singleton lock unavailable ({e}); exiting");
std::process::exit(1);
}
};
let app_id = bread_app::application_id(APP_NAME).expect("static app name");
let app = gtk4::Application::builder().application_id(&app_id).build();
app.connect_activate(|app| {
bread_theme::gtk::apply_shared();
bread_theme::gtk::apply_app_css(ui::app_css);
// No window until polkit asks; hold so GApplication stays alive.
std::mem::forget(app.hold());
if let Err(e) = agent::spawn() {
eprintln!("bread-polkit: {e:#}");
app.quit();
}
});
app.run();
}
fn print_help() {
print!(
"\
bread-polkit — themed PolicyKit authentication agent
Usage:
bread-polkit
bread-polkit --help
bread-polkit --version
Autostart (pick one):
cp contrib/bread-polkit.desktop ~/.config/autostart/
exec-once = bread-polkit # Hyprland
The agent talks to the polkit1 AuthenticationAgent API and prompts for
a password. It does not exec polkit-gnome. Not a bakery product; not
on the BOS ISO lockfile.
"
);
}

49
bread-polkit/src/session.rs
View file

@ -1,49 +0,0 @@
//! Session subject for `RegisterAuthenticationAgent`.
/// Logind session id from `XDG_SESSION_ID`, falling back to
/// `/proc/self/sessionid` when the kernel has one.
pub fn session_id() -> Option<String> {
let xdg = std::env::var("XDG_SESSION_ID").ok();
let proc = std::fs::read_to_string("/proc/self/sessionid").ok();
session_id_from(xdg.as_deref(), proc.as_deref())
}
/// `None` when both sources are empty or the kernel reports the
/// unsigned `-1` sentinel (`4294967295`) meaning "no session".
pub fn session_id_from(xdg: Option<&str>, proc_sessionid: Option<&str>) -> Option<String> {
if let Some(id) = xdg.map(str::trim).filter(|s| !s.is_empty()) {
return Some(id.to_string());
}
let raw = proc_sessionid?.trim();
if raw.is_empty() || raw == "4294967295" {
return None;
}
Some(raw.to_string())
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn prefers_xdg_session_id() {
assert_eq!(session_id_from(Some("3"), Some("7")).as_deref(), Some("3"));
assert_eq!(
session_id_from(Some(" 3 "), Some("7")).as_deref(),
Some("3")
);
}
#[test]
fn falls_back_to_proc_sessionid() {
assert_eq!(session_id_from(Some(""), Some("7")).as_deref(), Some("7"));
assert_eq!(session_id_from(None, Some("7\n")).as_deref(), Some("7"));
}
#[test]
fn rejects_unset_kernel_session() {
assert_eq!(session_id_from(None, Some("4294967295")), None);
assert_eq!(session_id_from(Some(""), Some("")), None);
assert_eq!(session_id_from(None, None), None);
}
}

286
bread-polkit/src/ui.rs
View file

@ -1,286 +0,0 @@
//! GTK4 password prompt, themed with bread-theme.
use std::cell::RefCell;
use std::rc::Rc;
use gtk4::gdk::Key;
use gtk4::glib::{self, Propagation};
use gtk4::prelude::*;
use gtk4::{
Align, Application, ApplicationWindow, Box as GBox, Button, Entry, EventControllerKey, Label,
Orientation,
};
use bread_theme::tokens;
use crate::agent::UserAction;
const PANEL_WIDTH: i32 = 400;
struct Active {
cookie: String,
window: ApplicationWindow,
password: Entry,
error: Label,
reply: tokio::sync::mpsc::Sender<UserAction>,
username: String,
}
thread_local! {
static ACTIVE: RefCell<Option<Active>> = const { RefCell::new(None) };
}
/// App-specific rules layered on the shared bread-theme stylesheet.
pub fn app_css() -> String {
format!(
".polkit-panel {{\
background-color: @surface; color: @on-surface;\
border-radius: {r}px; padding: {pad}px;\
min-width: {w}px;\
}}\n\
.polkit-title {{ font-size: 1.4em; font-weight: bold; }}\n\
.polkit-message {{ opacity: 0.85; }}\n\
.polkit-identity {{ opacity: 0.7; font-size: {sec}px; }}\n\
.polkit-error {{ color: @on-red; }}\n\
.polkit-buttons {{ padding-top: {sm}px; }}\n",
r = tokens::RADIUS_PRIMARY,
pad = tokens::SPACE_XL,
w = PANEL_WIDTH,
sec = tokens::FONT_SIZE_SECONDARY,
sm = tokens::SPACE_SM,
)
}
pub struct Prompt {
pub cookie: String,
pub message: String,
pub action_id: String,
pub username: String,
pub reply: tokio::sync::mpsc::Sender<UserAction>,
}
/// Show (or replace) the password overlay for this cookie.
pub fn show_prompt(app: &Application, prompt: Prompt) {
close_if_other_cookie(&prompt.cookie);
if ACTIVE.with(|a| {
a.borrow()
.as_ref()
.is_some_and(|active| active.cookie == prompt.cookie)
}) {
present_existing(&prompt);
return;
}
let window = bread_app::gtk_popup::new_overlay_window(app, "bread-polkit");
let panel = GBox::new(Orientation::Vertical, tokens::SPACE_MD as i32);
panel.add_css_class("polkit-panel");
panel.add_css_class("card");
panel.set_halign(Align::Center);
panel.set_valign(Align::Center);
panel.set_size_request(PANEL_WIDTH, -1);
let title = Label::new(Some("Authentication required"));
title.add_css_class("polkit-title");
title.add_css_class("page-title");
title.set_halign(Align::Start);
title.set_wrap(true);
panel.append(&title);
let message = if prompt.message.trim().is_empty() {
prompt.action_id.clone()
} else {
prompt.message.clone()
};
let msg = Label::new(Some(&message));
msg.add_css_class("polkit-message");
msg.set_halign(Align::Start);
msg.set_wrap(true);
msg.set_xalign(0.0);
panel.append(&msg);
if !prompt.username.is_empty() {
let identity = Label::new(Some(&format!("Authenticating as {}", prompt.username)));
identity.add_css_class("polkit-identity");
identity.add_css_class("dim-label");
identity.set_halign(Align::Start);
panel.append(&identity);
}
let error = Label::new(None);
error.add_css_class("polkit-error");
error.set_halign(Align::Start);
error.set_wrap(true);
error.set_visible(false);
panel.append(&error);
let password = Entry::builder()
.visibility(false)
.input_purpose(gtk4::InputPurpose::Password)
.placeholder_text("Password")
.hexpand(true)
.build();
panel.append(&password);
let buttons = GBox::new(Orientation::Horizontal, tokens::SPACE_SM as i32);
buttons.add_css_class("polkit-buttons");
buttons.set_halign(Align::End);
let cancel = Button::with_label("Cancel");
cancel.add_css_class("flat");
let confirm = Button::with_label("Authenticate");
confirm.add_css_class("suggested-action");
buttons.append(&cancel);
buttons.append(&confirm);
panel.append(&buttons);
window.set_child(Some(&panel));
bread_theme::gtk::bind_window_auto_with_app_css(&window, |_| app_css());
let reply = prompt.reply.clone();
let cookie = prompt.cookie.clone();
let username = prompt.username.clone();
let submit = {
let password = password.clone();
let reply = reply.clone();
let username = username.clone();
Rc::new(move || {
let secret = password.text().to_string();
password.set_text("");
let _ = reply.try_send(UserAction::Submit {
username: username.clone(),
password: secret,
});
})
};
let cancel_fn = {
let reply = reply.clone();
let window = window.clone();
Rc::new(move || {
let _ = reply.try_send(UserAction::Cancel);
window.close();
ACTIVE.with(|a| a.replace(None));
})
};
confirm.connect_clicked({
let submit = submit.clone();
move |_| submit()
});
password.connect_activate({
let submit = submit.clone();
move |_| submit()
});
cancel.connect_clicked({
let cancel_fn = cancel_fn.clone();
move |_| cancel_fn()
});
let keys = EventControllerKey::new();
keys.connect_key_pressed({
let cancel_fn = cancel_fn.clone();
move |_, key, _, _| {
if key == Key::Escape {
cancel_fn();
Propagation::Stop
} else {
Propagation::Proceed
}
}
});
window.add_controller(keys);
bread_app::gtk_popup::close_on_outside_click(&window, &panel, {
let cancel_fn = cancel_fn.clone();
move || cancel_fn()
});
window.connect_close_request({
let reply = reply.clone();
move |_| {
let closing_ours = ACTIVE.with(|a| {
a.borrow()
.as_ref()
.is_some_and(|active| active.cookie == cookie)
});
if closing_ours {
let _ = reply.try_send(UserAction::Cancel);
ACTIVE.with(|a| a.replace(None));
}
glib::Propagation::Proceed
}
});
ACTIVE.with(|a| {
*a.borrow_mut() = Some(Active {
cookie: prompt.cookie,
window: window.clone(),
password: password.clone(),
error,
reply,
username,
});
});
window.present();
password.grab_focus();
}
fn present_existing(prompt: &Prompt) {
ACTIVE.with(|a| {
if let Some(active) = a.borrow_mut().as_mut() {
active.reply = prompt.reply.clone();
active.username = prompt.username.clone();
active.error.set_visible(false);
active.password.set_text("");
active.window.present();
active.password.grab_focus();
}
});
}
/// Show a retry message on the open dialog for `cookie`.
pub fn show_retry(cookie: &str, message: &str) {
ACTIVE.with(|a| {
let mut guard = a.borrow_mut();
let Some(active) = guard.as_mut() else {
return;
};
if active.cookie != cookie {
return;
}
active.error.set_label(message);
active.error.set_visible(true);
active.password.set_text("");
active.window.present();
active.password.grab_focus();
});
}
/// Close the dialog if it is still showing `cookie`.
pub fn close_prompt(cookie: &str) {
ACTIVE.with(|a| {
let Some(active) = a.borrow_mut().take() else {
return;
};
if active.cookie == cookie {
active.window.close();
} else {
*a.borrow_mut() = Some(active);
}
});
}
fn close_if_other_cookie(cookie: &str) {
ACTIVE.with(|a| {
let Some(active) = a.borrow_mut().take() else {
return;
};
if active.cookie == cookie {
*a.borrow_mut() = Some(active);
} else {
active.window.close();
}
});
}

14
bread-screenshots/Cargo.toml
View file

@ -1,14 +0,0 @@
[package]
name = "bread-screenshots"
version.workspace = true
edition.workspace = true
license.workspace = true
authors.workspace = true
description = "Shared capture plumbing for the bread ecosystem's UI screenshot tooling: layer-surface and output geometry via Hyprland IPC, capture via grim"
repository = "https://git.breadway.dev/Breadway/bread-ecosystem"
keywords = ["hyprland", "wayland", "screenshot", "grim"]
[dependencies]
bread-utils = { path = "../bread-utils" }
anyhow = { workspace = true }
tracing = { workspace = true }

30
bread-screenshots/src/lib.rs
View file

@ -1,30 +0,0 @@
//! Capture primitive for the bread ecosystem's UI screenshot tooling (see
//! `bread-capture`, the orchestrator that drives this crate's consumers).
//!
//! Deliberately compositor-agnostic: no Hyprland IPC, no layer/output
//! lookup. `bread-capture` runs every target app inside an isolated,
//! headless compositor instance of a known, fixed size (see its
//! `isolation` module), so the caller already knows exactly what region to
//! grab — there's nothing to query.
use anyhow::{bail, Context, Result};
use std::path::Path;
use std::time::Duration;
const GRIM_TIMEOUT: Duration = Duration::from_secs(5);
/// Capture a `w`x`h` region at `(x, y)` (compositor-global coordinates) to
/// `out` via `grim -g`.
pub fn capture_region(x: i32, y: i32, w: i32, h: i32, out: &Path) -> Result<()> {
if let Some(parent) = out.parent() {
std::fs::create_dir_all(parent)
.with_context(|| format!("creating {}", parent.display()))?;
}
let out_str = out.to_str().context("output path is not valid UTF-8")?;
let geometry = format!("{x},{y} {w}x{h}");
let result = bread_utils::proc::run("grim", &["-g", &geometry, out_str], GRIM_TIMEOUT);
if !result.success {
bail!("grim failed for geometry {geometry}: {}", result.stderr.trim());
}
Ok(())
}

45
bread-theme/CHANGELOG.md
View file

@ -1,48 +1,11 @@
# bread-theme changelog
## 0.7.4
Per-output (per-monitor) theming. Session-global `theme.css` remains the
fallback / focused-monitor sheet; each Hyprland/GDK connector can now have
its own palette and stylesheet. BOS still keeps bg/surface/overlay/fg
fixed — only color1–6 come from the wallpaper.
On disk under `$XDG_RUNTIME_DIR/bread/` (same fallback as `shared_css_path`):
- `palettes/<sanitized-output>.json` — accents only (round-trips through
`from_wal_json` / a color1–6 object; never persists pywal's light bg)
- `themes/<sanitized-output>.css` — `stylesheet()` for that palette
New lib API:
- `themes_dir`, `palettes_dir`, `output_css_path`, `output_palette_path`,
`sanitize_output`
- `load_palette_for`, `write_output_palette`, `write_output_css`,
`write_shared_css_from`
- `palette_from_image` (isolated `wal -i`, does not touch `~/.cache/wal`),
`generate_output`, `palette_from_json`
- `stylesheet_resolved` — inlines `@accent` / `@on-bg` / … to hex so GTK's
display-global `@define-color` cannot leak the wrong monitor's accent
GTK (`gtk` feature): `bind_window`, `bind_window_with_app_css`,
`output_for_widget`, `bind_window_auto`, `bind_window_auto_with_app_css`.
Widget-scoped providers at `USER - 10` so they beat `apply_shared` but
lose to user CSS. Existing `apply_shared` / `apply_app_css` /
`apply_css` / `apply_user_css` are unchanged.
CLI: `bread-theme generate-output <OUTPUT> --image <PATH> | --from-json
<FILE> [--shared]`. Does not write `theme.css` unless `--shared`.
## Coordinated bump policy
`bread-theme` is consumed by `breadbar`, `breadbox`, `breadpad`, and the other
GTK bread apps as a pinned git dependency. A breaking change to `Palette`,
`css_vars`, or the `gtk` feature API requires dependents to bump their
`Cargo.toml` git tag and cut a release together. Note the impact in this file
before tagging.
**0.7.4** adds per-output bind APIs (`bind_window*`, `load_palette_for`,
`generate_output`). Apps that call those must pin `tag = "v0.7.4"`.
`bread-theme` is consumed by `breadbar`, `breadbox`, and `breadpad` as a pinned
git dependency. A breaking change to `Palette`, `css_vars`, or the `gtk` feature
API requires all three dependents to bump their `Cargo.toml` git tag and cut a
release together. Note the impact in this file before tagging.
---

22
bread-theme/Cargo.toml
View file

@ -4,38 +4,20 @@ version.workspace = true
edition.workspace = true
license.workspace = true
authors.workspace = true
description = "Shared pywal-accented, fixed-dark-base theming crate for the bread ecosystem"
repository = "https://git.breadway.dev/Breadway/bread-ecosystem"
description = "Shared pywal + Catppuccin theming crate for the bread ecosystem"
repository = "https://github.com/Breadway/bread-ecosystem"
keywords = ["theming", "pywal", "gtk4", "wayland"]
[dependencies]
serde = { workspace = true }
serde_json = { workspace = true }
dirs = { workspace = true }
# bread_theme::shell manifest parsing (theme.toml) — gtk-free, so `bread`
# (daemon) and `breadcrumbs` (CLI) can validate a theme without linking GTK.
toml = { workspace = true }
anyhow = { workspace = true }
tracing = { workspace = true }
gtk4 = { version = "0.11", features = ["v4_12"], optional = true }
# Rust bindings for libadwaita (GNOME's widget library on top of GTK4) — the
# actual source of the modern GNOME look (grouped preference rows, real
# toggle/spin rows, view switchers), not just a CSS reskin of plain GTK4
# widgets. `v1_7` for ToggleGroup (used for tab-row-style pickers); the
# system library only needs to be >= that (this machine has 1.9.2).
libadwaita = { version = "0.9", features = ["v1_7"], optional = true }
[features]
# Enable GTK4 CSS provider helpers (breadbar, breadbox, breadpad use this).
# bread (daemon) and breadcrumbs (CLI) depend on this crate without the feature.
gtk = ["dep:gtk4"]
# Composite libadwaita-based widgets (bread_theme::adw) — separate from `gtk`
# because libadwaita's own top-level window chrome (AdwApplicationWindow)
# isn't compatible with gtk4-layer-shell surfaces, so the five layer-shell
# apps (breadbar, breadbox, breadclip, breadsearch, breadpad) only want
# plain CSS, not this. Apps with an ordinary top-level window (breadman,
# breadhelp) want both.
adw = ["gtk", "dep:libadwaita"]
# The generator CLI. It only touches the gtk-free lib API (render + write), so
# it builds without the gtk feature and stays light.

117
bread-theme/assets/shell/daylight/daylight.css
View file

@ -1,117 +0,0 @@
/* CSS template for the daylight builtin (bread-theme/src/shell/builtin.rs).
* Same scope and substitution rules as its three siblings: only the
* window/workspace/clock chrome the manifest's own concepts model, `{name}`
* tokens substituted, `@name` palette references passed through untouched.
* Declared-but-not-yet-consumed in production, same as every sibling
* template — see `ShellTheme::css`'s doc comment for why (breadbar hand-
* rolls its own CSS in `breadbar::theme::load_css` instead of calling this
* method). Exercised by this crate's own tests.
*
* Source: bos-ui-demos/proposed/daylight.html's <style> block.
*
* Unlike its three siblings, this template hardcodes which of `@bg`/`@on-bg`
* plays "paper surface" versus "ink" directly (`@on-bg` as the fill, `@bg`
* as the text) rather than branching on `{light}` at substitution time —
* `Tokens::substitute` only does `{name}` replacement, not conditionals, and
* this template is Daylight's alone, so there is nothing to branch FOR here.
* `breadbar::theme::load_css` is the one place that genuinely needs to pick
* between the two directions at runtime (it renders all four themes from
* one function) — see its own `panel`/`ink` locals and Tokens::light's doc
* comment for the general mechanism this template only needs one side of.
*/
window.breadbar {
background-color: transparent;
border: none;
box-shadow: none;
color: @bg;
}
window.breadbar > box > centerbox { padding: 0 14px; }
window.breadbar button { min-height: 0; min-width: 0; }
/* The three detached pills (axis 3, segmented) — see
* breadbar::theme::load_css's `.bar-segment` rule for the identical
* production version of this block.
*/
.bar-segment {
background-color: alpha(@on-bg, {bg_alpha});
border: 1px solid alpha(@bg, 0.10);
border-radius: {radius_bar}px;
box-shadow: 0 2px 10px alpha(@bg, 0.13);
}
.workspace-trail {
background-image: linear-gradient(90deg, @{accent_from}, @{accent_to});
background-color: @{accent_from};
border-radius: {radius_sm}px;
}
.workspace-btn {
background: transparent;
opacity: 0.36;
color: @bg;
border-radius: {radius_sm}px;
border: none;
outline: none;
box-shadow: none;
min-width: 28px;
min-height: {chip_height}px;
margin: 0;
padding: 0 7px;
font-size: 22px;
font-weight: bold;
transition: opacity 0.22s {spring_settle}, background-color 0.22s {spring_settle};
}
.workspace-btn:hover { opacity: 0.85; background: alpha(@bg, 0.08); }
.workspace-btn.occupied { opacity: 0.78; }
.workspace-btn.active { background: transparent; color: @on-accent; opacity: 1; }
.workspace-btn.active:hover { background: transparent; }
.clock-plain { padding: 0 4px; }
.clock-plain-time {
font-size: {font_size_base}px;
font-weight: 600;
letter-spacing: 0.04em;
}
.date-label {
font-size: 12px;
opacity: 0.48;
font-weight: 400;
letter-spacing: 0.04em;
}
/* Warm amber equaliser — the second accent (axis 1's colour-mapping note):
* distinct from the teal workspace-trail accent above.
*/
.media-eq-bar {
background-color: @{accent2};
}
/* Light-theme overrides of the notification/OSD surfaces — the demo's own
* `.notifs`/`.note`/`.osd` block, which explicitly replaces shared.css's
* dark defaults. `@on-bg` (paper) / `@bg` (ink), not `@bg` (glass) / `@on-bg`
* (light ink) the way every sibling theme's identical rule reads — this is
* the one deliberate inversion this template makes relative to its
* siblings, and it is exactly what `{light}` conditions in the shared Rust
* implementation (breadbar::theme::load_css). See axis 1 in the task
* report for the full inventory this one inversion stands in for.
*/
window.breadbar-osd {
background-color: alpha(@on-bg, {bg_alpha});
color: @bg;
border-radius: {radius_pill}px;
border: 1px solid alpha(@bg, 0.10);
box-shadow: 0 8px 22px alpha(@bg, 0.16);
}
window.breadbar-panel {
background-color: alpha(@on-bg, {bg_alpha});
color: @bg;
border-radius: {radius_card}px;
border: 1px solid alpha(@bg, 0.10);
}
window.breadbar-dismiss {
background-color: alpha(#000000, 0.02);
}
.bread-widget-slot { margin-right: {pad}px; }

281
bread-theme/assets/shell/daylight/theme.toml
View file

@ -1,281 +0,0 @@
# The fourth compiled-in builtin (bread-theme/src/shell/builtin.rs), demo
# "Daylight" in bos-ui-demos/proposed/daylight.html — a bottom-anchored dock
# split into three DETACHED pills (workspaces | clock+media | stats)
# floating on an otherwise fully transparent bar, ink-on-paper: near-opaque
# white surfaces, soft drop shadows (blur is OFF — see [compositor] below),
# deep teal accent, warm amber equaliser. This is the first built-in that is
# LIGHT, the first anchored BOTTOM, the first SEGMENTED (three pills instead
# of one bar surface), and the first with blur deliberately disabled — see
# the task report for what each of those four axes required.
#
# Values are taken from bos-ui-demos/proposed/daylight.html's <style> block;
# where the demo is silent (satellite offsets, bar-adjacent chip sizing)
# this file re-derives from the dock's own edge, same method every sibling
# theme.toml already documents.
#
# Font (Outfit is not installed on the dev machine, same gap liquid-motion/
# spotlight already have — renders in fallback until ttf-outfit is
# installed) and colour (the demo's #2f6d7a teal / #c2683c amber are *flat*
# accents — mapped to this palette's `teal` / `yellow` tokens, see [tokens]'s
# own note — never a literal hex value, or pywal theming breaks).
name = "Daylight"
id = "daylight"
[tokens]
font_family = "Outfit, sans-serif"
font_fallback = "sans-serif"
font_size_base = 14
# `.bar-segment`'s radius (see `bar_border = "segmented"` below) — the
# window itself (`window.breadbar`) draws no radius at all, since it draws
# no fill/border either. Demo: `.seg { border-radius: 14px }`.
radius_bar = 14
# Notification/history card radius. Demo has no explicit `.note` radius of
# its own (its override block only touches background/border/shadow/colour
# — see shared.css's `.note { border-radius: 12px }` default) — 14px keeps
# it a close, deliberate match to this theme's own popover/segment radius
# instead of inheriting an unrelated demo's 12px.
radius_card = 14
# Chip/workspace-pill radius. Demo: `.chip`/`.wp`/`.trail` all draw a 9px
# pill (concentric inside the 14px segment with a 7px inset, per the demo's
# own comment next to `.chip`).
radius_sm = 9
radius_pill = 999
# Demo: `.pop { padding: 13px }`.
pad = 13
# `.bar-segment` fill alpha — demo: `.seg { background: rgba(255,255,255,.94) }`,
# a near-OPAQUE paper pill, not liquid-motion/glass-workbench's translucent
# glass (0.72). Also reused for the notification/OSD/panel surfaces below
# (the same `bg_alpha` token every sibling theme already reuses for more
# than just the bar).
bg_alpha = 0.94
# The demo defines both curves distinctly (`--spring`/`--settle`), like
# liquid-motion — not glass-workbench/spotlight's single shared curve.
spring = "cubic-bezier(0.22, 1.35, 0.36, 1)"
spring_settle = "cubic-bezier(0.22, 1.2, 0.36, 1)"
# Palette token NAMES, not hex — #2f6d7a is this palette's `teal`. Equal
# from/to because the demo's workspace-trail fill is flat
# (`.trail { background: var(--accent) }`), not a gradient — same reasoning
# as glass-workbench/spotlight's own flat accents. accent_from IS read (the
# Trail gradient's start stop, and now — this theme is the reason — its end
# stop too, see accent_to's own doc comment in types.rs).
accent_from = "teal"
accent_to = "teal"
# A SECOND accent, independent of accent_from/accent_to: the demo's media
# equaliser bars are warm amber (`--accent2: #c2683c`), not the workspace
# trail's deep teal — one accent value can no longer describe both, which is
# why this key exists at all (see Tokens::accent2's doc comment). Mapped to
# `yellow` (pywal ANSI color3): the demo's amber reads warmer/more orange
# than a pure hue, and `yellow` is the only remaining named accent slot not
# already claimed by `accent`/`teal`/`green`/`pink` across the four built-in
# themes that reads plausibly warm regardless of wallpaper. Consumed by
# breadbar::theme::load_css's `.media-eq-bar` rule.
accent2 = "yellow"
# Demo: `.chip { height: 26px }` / `.wp { height: 26px }` on the 40px dock —
# the same 26px liquid-motion's own Trail-style bar already uses (see
# `breadbar::theme::approved_chip_height`, which is what actually governs
# this in practice — see that function's own note on why this token is
# otherwise a restated truth, not a live input).
chip_height = 26
# No single demo number for bar-icon glyph size (the demo's `.gl` box is
# 16x16, but that is the icon's *swatch*, not the glyph-drawing size other
# themes' icon_px models) — chosen proportionally between liquid-motion's
# 24px (44px bar) and glass-workbench's 18px (36px bar) for this theme's
# 40px dock.
icon_px = 20
# THE axis-3 (segmented) knob: `window.breadbar` itself gets no fill/
# border/radius at all (drawn fully transparent); the bar's three slot-group
# containers each get their own `.bar-segment` pill surface instead. See
# Tokens::bar_border's doc comment and breadbar::theme::load_css's
# `segmented` local for exactly what this changes.
bar_border = "segmented"
# THE axis-1 (light) knob — see Tokens::light's doc comment for why this
# exists and exactly what it swaps. Every dark-assuming hardcode this flag
# fixes is listed in the task report.
light = true
[bar.window]
# THE axis-2 (bottom-anchored) knob. Full-bleed left/right (`window.
# breadbar`'s own bounds touch both screen edges, like every sibling
# theme's top-anchored bar), with `bottom_margin` floating it 12px off the
# bottom edge — the demo's own `.dock { left: 0; right: 0; bottom: 12px }`.
# The 14px horizontal inset the demo's `.dock` draws via CSS `padding`
# (not a window margin) is reproduced the same way: see `centerbox_padding`
# in breadbar::theme::load_css, keyed off `bar_border == "segmented"`
# exactly like glass-workbench's flush bar already keys its own padding off
# `bar_border == "bottom"`.
anchors = ["bottom", "left", "right"]
width = "fill"
height = 40
margin = { top = 0, left = 0, right = 0, bottom = 12 }
exclusive = "auto"
keyboard = "none"
layer = "top"
[bar.slots]
# Same widget-alias shape as liquid-motion (plan §11 phase 1's fixed
# interleave points), even though the demo itself shows no extra Lua
# widget — so a widget requesting one of these placements has a home under
# Daylight too, the same reasoning spotlight's own `widget:left_of_stats`
# documents for its slimmer slot set.
left = ["workspaces", "widget:right_of_workspaces"]
centre = ["media", "widget:left_of_clock", "clock", "widget:right_of_clock"]
right = ["widget:left_of_stats", "volume", "wifi", "battery", "control"]
drawer = []
[modules.workspaces]
style = "trail"
show_empty = true
[modules.clock]
# Demo: one time label + one date label (`.clock`/`.date`), not liquid-
# motion's per-digit flip — same reasoning as glass-workbench's own "plain"
# choice.
style = "plain"
format = "%H:%M"
show_date = true
[launcher]
mode = "overlay"
# Demo: `.bx { width: min(430px, 90%) }`.
width = 430
# NOTE — known gap, see task report: `breadbox` (the process that actually
# reads this field) is not one of this task's two repos, and `Launcher` has
# no "anchor from bottom" concept at all — `top` is unconditionally a
# distance from the TOP of the screen in every existing consumer. The demo's
# launcher rises from just above the dock (`.bx { bottom: 62px }`), which
# this schema/consumer pairing cannot express without a breadbox-side change
# this task cannot make. 55% is a best-effort placement (roughly the lower
# half of the screen, not flush against either edge) documented here as a
# stopgap, not a real fix.
top = "55%"
# Demo: `.bx { border-radius: 18px }`.
radius = 18
# Demo: `.bx .ico { width: 26px; height: 26px }`.
icon_px = 26
# Demo's rows all fade/slide in together with a small per-index stagger
# (`animation-delay: min(i,10)*20ms`) — closest existing `row_anim` value is
# glass-workbench's "stagger" (the CSS classes it reuses are already 28ms
# apart, not 20ms, but this schema has no numeric stagger-interval knob of
# its own to match the demo's exactly).
row_anim = "stagger"
# Demo: a plain 1px hairline under the search field
# (`.bx .q { border-bottom: 1px solid rgba(26,29,34,.09) }`), not liquid-
# motion's gradient rule.
rule = "hairline"
footer = "count_apps"
sections = true
# Demo supports all four query prefixes (bare/`=`/`>`/`.`), same as
# spotlight — its `<script>` reuses the identical shared.js query parser.
modes = ["apps", "calc", "cmd", "url"]
# `.bx .r { border-radius: 10px; margin: 0 7px; padding: 9px 11px }`
row_radius = 10
row_inset = 7
row_padding_v = 9
row_padding_h = 11
# `.bx .ico { border-radius: 8px }` (paired with icon_px = 26 above)
icon_radius = 8
# `.bx .q { padding: 15px 17px; font-size: 15px }`
search_font_size = 15
search_padding_v = 15
search_padding_h = 17
# Demo: `.bx { background: var(--paper) }` — fully OPAQUE white, not
# liquid-motion/glass-workbench's translucent glass. 0.97, not a bare 1.0,
# to read as a deliberate "near-opaque paper" choice rather than a rounding
# accident, matching this theme's own `bg_alpha`/pill-surface language.
panel_alpha = 0.97
# Demo: `.bx .r.sel { background: rgba(47,109,122,.15) }` — teal at 15%.
selection_alpha = 0.15
# Keyed by layer-shell namespace, matching [compositor.*] below.
#
# `bottom_right`, not `top_right`: THE OTHER axis-2 gap this theme exposed
# and fixed. Every sibling theme's bar sits at the TOP, so `top_right`
# always put breadbar-notif/breadbar-panel naturally close to the bar; a
# bottom-anchored dock has nothing in the original three-shape anchor set
# that keeps its satellites near it. `bottom_right` is a new fourth anchor
# shape (bread-theme/src/shell/manifest.rs + breadbar/src/surface.rs),
# validated the same "typo'd key is a hard error" way as its siblings.
# `offset` is `[right, bottom]`, mirroring `top_right`'s `[right, top]`
# convention. This bar's own bottom edge sits at margin.bottom(12) +
# height(40) = 52px, so 64 (52 + a 12px gap, the same gap-beyond-the-bar-
# edge relationship every sibling theme's own top_right offset already
# uses) keeps the popup just clear of the dock.
[surfaces."breadbar-notif"]
anchor = "bottom_right"
offset = [16, 64]
# 320, not the demo's own shared.css `.notifs { width: 250px }` — every
# sibling theme's breadbar-notif width already follows breadbar's real
# `set_default_width(320)` live-toast constant instead of the demo markup's
# arbitrary number (see liquid-motion/theme.toml's own note on this), and
# this theme follows that same real-app-fidelity precedent rather than the
# demo's number.
width = 320
layer = "overlay"
[surfaces."breadbar-osd"]
# Demo: `.osd { bottom: 64px }` — independent of `anchor`, this already
# matches the notif/panel offset above (both landed on 64 from the same
# "12px clear of the dock's 52px edge" reasoning, coincidentally the same
# number as the notif/panel `offset[1]`).
anchor = "bottom_centre"
offset = 64
width = 180
layer = "overlay"
[surfaces."breadbar-panel"]
anchor = "bottom_right"
offset = [16, 64]
width = "auto"
layer = "overlay"
[surfaces."breadbar-dismiss"]
# THE THIRD axis-2 consequence: `fill`'s `offset` was single-value
# (top-margin-only) before this theme — a bottom-anchored bar needs the
# scrim's GAP at the BOTTOM instead, so `breadbar/src/surface.rs::apply`'s
# "fill" arm now reads a `[top, bottom]` pair (falling back to `[value, 0]`
# for every existing single-value theme, so liquid-motion/glass-workbench/
# spotlight are unaffected). `0` here means the scrim covers all the way to
# the true top of the screen (nothing to clear up there); `52` is this bar's
# own edge (margin.bottom(12) + height(40)), leaving the dock's own
# footprint click-through the way every sibling theme's single top offset
# already leaves its own bar's footprint alone.
anchor = "fill"
offset = [0, 52]
width = "fill"
layer = "overlay"
# Appearance-only, never placement/workspace/focus (plan §12 Layer B
# boundary). THE axis-4 knob: `blur = false` everywhere, and `blur_popups`
# dropped too — the demo draws depth with `box-shadow`, not
# `backdrop-filter`, and per the task brief this also sidesteps the
# shadow-halo trap a blurred `ignore_alpha` surface has (fixed in breadbox
# by removing the shadow entirely — see that fix's history) since there is
# no blur here for a shadow to get caught inside. No `ignore_alpha`
# anywhere below either: that key only means anything to a BLURRED surface,
# and setting it on an unblurred one would be exactly the kind of
# never-consumed key this project's rules forbid.
[compositor."breadbar"]
blur = false
blur_popups = false
animation = "slide bottom"
[compositor."breadbar-osd"]
blur = false
animation = "slide bottom"
[compositor."breadbar-notif"]
blur = false
animation = "slide right"
[compositor."breadbar-panel"]
blur = false
animation = "slide right"
[compositor."breadbar-dismiss"]
no_anim = true
[compositor."breadbox"]
blur = false
# No `css = "..."` overlay — compiled-in builtin, same as its three siblings.

86
bread-theme/assets/shell/glass-workbench/glass-workbench.css
View file

@ -1,86 +0,0 @@
/* CSS template for the glass-workbench builtin (bread-theme/src/shell/
* builtin.rs). Same scope and substitution rules as liquid-motion.css: only
* the window/workspace/clock chrome the manifest's own concepts model, `{name}`
* tokens substituted, `@name` palette references passed through untouched.
*
* Source: bos-ui-demos/02-glass-workbench.html's <style> block. No
* per-digit flip (this theme has no `.clock-digit` markup at all — plain
* style is a date label + one time label) and no gradient trail (pill style
* never makes `.workspace-trail` visible — see breadbar's
* `WorkspaceTrail::place`/`stretch`, which this theme's slot config simply
* never calls).
*/
window.breadbar {
background-color: alpha(@bg, {bg_alpha});
color: @on-bg;
border-radius: {radius_bar}px;
border: none;
border-bottom: 1px solid alpha(@on-bg, 0.07);
}
window.breadbar > centerbox { padding: 0 {pad}px; }
window.breadbar button { min-height: 0; min-width: 0; }
/* Pill workspaces: solid accent fill when active, dimmed when empty — no
* trail overlay is ever shown (place()/stretch() are never called for this
* style), so `.workspace-trail` itself needs no rule here.
*/
.workspace-btn {
background: transparent;
opacity: 1;
color: alpha(@on-bg, 0.4);
border-radius: {radius_sm}px;
border: none;
outline: none;
box-shadow: none;
min-width: 22px;
min-height: {chip_height}px;
margin: 0;
padding: 0 6px;
font-size: 12px;
font-weight: 600;
transition: background-color 0.22s {spring_settle}, color 0.22s {spring_settle},
opacity 0.22s {spring_settle};
}
.workspace-btn:hover { background: alpha(@on-bg, 0.08); }
.workspace-btn.occupied { color: alpha(@on-bg, 0.8); }
.workspace-btn:not(.occupied):not(.active) { opacity: 0.35; }
.workspace-btn.active {
background: @{accent_from};
color: @on-accent;
opacity: 1;
}
.workspace-btn.active:hover { background: @{accent_from}; }
.clock-plain { padding: 0 4px; }
.clock-plain-time {
font-size: {font_size_base}px;
font-weight: 600;
letter-spacing: 0.04em;
}
.date-label {
font-size: 12px;
opacity: 0.48;
font-weight: 400;
letter-spacing: 0.04em;
}
window.breadbar-osd {
background-color: alpha(@bg, 0.72);
color: @on-bg;
border-radius: {radius_pill}px;
border: 1px solid alpha(@on-bg, 0.10);
}
window.breadbar-panel {
background-color: alpha(@bg, 0.86);
color: @on-bg;
border-radius: {radius_card}px;
border: 1px solid alpha(@on-bg, 0.12);
}
window.breadbar-dismiss {
background-color: alpha(#000000, 0.02);
}
.bread-widget-slot { margin-right: {pad}px; }

198
bread-theme/assets/shell/glass-workbench/theme.toml
View file

@ -1,198 +0,0 @@
# The second compiled-in builtin (bread-theme/src/shell/builtin.rs), demo 02
# in THEME_SYSTEM_PLAN.md — "Glass Workbench": a flush edge-to-edge bar with
# plain pill workspaces, a plain date+time clock, and cpu/ram chips instead
# of the media widget liquid-motion carries. Values are taken from
# bos-ui-demos/02-glass-workbench.html's <style> block; where the demo is
# silent on a number (bar-adjacent chip sizing, satellite offsets) this file
# scales liquid-motion's own numbers down by the same 36/44 bar-height ratio
# rather than inventing something unrelated to either source.
#
# Unlike liquid-motion, this builtin has no "as the code exists today" tether
# — it is new, so demo fidelity is the only source of truth. See Phase 5's
# task notes for the two exceptions: font (IBM Plex Sans is not installed on
# the dev machine, so this renders in fallback until the user installs
# ttf-ibm-plex — this now matters for real: breadbox's launcher panel
# consumes font_family/font_fallback below, see [tokens]'s own note) and
# colour (the demo's #7a9a88 sage is a *flat* accent, so it maps to the
# palette's `green` token for both accent_from and accent_to — never a
# literal hex value, or pywal theming breaks).
name = "Glass Workbench"
id = "glass-workbench"
[tokens]
# font_family/font_fallback/font_size_base are consumed by breadbox's
# launcher panel only (breadbox::main::build_css's entry.search/row rules —
# see Tokens::font_family's doc comment for the exact scope); breadbar's
# bar/chip/clock text still comes from bread_theme::stylesheet()'s own
# hardcoded FONT_FAMILY constant, unaffected by this key.
font_family = "IBM Plex Sans"
font_fallback = "Inter, Noto Sans, sans-serif"
font_size_base = 13
radius_bar = 0
radius_card = 10
radius_sm = 6
radius_pill = 999
pad = 12
bg_alpha = 0.72
# The demo defines exactly one easing curve (`--spring: cubic-bezier(.22,
# 1.2, .36, 1)`), not liquid-motion's overshoot/settle pair — there's no
# digit-flip or trail-stretch here to want a bounce for. Both `spring` and
# `spring_settle` point at the demo's one curve rather than inventing a
# second value the demo never specifies.
spring = "cubic-bezier(0.22, 1.2, 0.36, 1)"
spring_settle = "cubic-bezier(0.22, 1.2, 0.36, 1)"
# Palette token NAMES, not hex — #7a9a88 is this palette's `green`. Equal
# from/to because the demo's accent is flat, not a gradient. accent_from IS
# read (Pill-style workspace fill, theme.rs); accent_to is declared-but-
# not-yet-consumed regardless of style — nothing reads it outside the
# breadbar Trail gradient this theme doesn't use, and even Trail hardcodes
# its own literal gradient rather than substituting it. See
# Tokens::accent_to's doc comment.
accent_from = "green"
accent_to = "green"
# Demo: `.ws button { height: 20px }`. Liquid-motion's chip_height (32) is
# tied to its 44px island; 20px is the demo's own number for this bar's
# workspace pills, and is reused for the bar's other small chips (cpu/ram/
# wifi/battery/control) so they all sit at the same height on the thinner
# 36px flush bar.
chip_height = 22
# No demo number for bar-icon size; scaled from liquid-motion's 24px by the
# same 36/44 bar-height ratio liquid-motion itself uses for its 44px bar.
icon_px = 18
# Flush edge-to-edge bar: a full border would draw a stray line along the
# top/side screen edges a floating island doesn't have to worry about. See
# Tokens::bar_border's doc comment.
bar_border = "bottom"
[bar.window]
anchors = ["top", "left", "right"]
width = "fill"
height = 36
margin = { top = 0, left = 0, right = 0 }
exclusive = "auto"
keyboard = "none"
layer = "top"
[bar.slots]
# No media module — demo 02 has no media widget at all (plan §1 table).
# breadbar must tolerate the omission: `media_widget` is still built and
# registered under the "media" module name (main.rs), it just never appears
# in any of this theme's slot lists, so it's never appended anywhere.
left = ["workspaces"]
centre = ["clock"]
right = ["cpu", "ram", "wifi", "battery", "control"]
drawer = []
[modules.workspaces]
style = "pill"
show_empty = true
[modules.clock]
style = "plain"
format = "%H:%M"
show_date = true
[launcher]
# Glass Workbench — dense and technical, the deliberate opposite of Liquid
# Motion's soft/roomy numbers: a tight panel radius, snug row insets/padding,
# small 22px icons, a flat (no section headers) list, and a denser accent
# selection fill. Spec: bos-ui-demos/proposed/glass-workbench.html's `.bx`
# block. breadbox reads every key below now; see main.rs's build_css.
mode = "overlay"
width = 560
top = "64px"
radius = 10
icon_px = 22
row_anim = "stagger"
rule = "hairline"
footer = "count_results"
sections = false
modes = ["apps"]
# `.bx .r { border-radius: 6px; margin: 0 6px; padding: 8px 10px }`
row_radius = 6
row_inset = 6
row_padding_v = 8
row_padding_h = 10
# `.bx .ico { border-radius: 5px }` (paired with icon_px = 22 above)
icon_radius = 5
# `.bx .q { padding: 12px 15px; font-size: 14px }`
search_font_size = 14
search_padding_v = 12
search_padding_h = 15
# `.bx .r.sel { background: rgba(accent, .28) }`
# Panel opacity, separate from tokens.bg_alpha (the bar). Matches the
# approved reference: demo `.bx.gw{background:rgba(16,20,18,.95)}`. breadbox hardcoded 0.60, which washed the
# panel out over a bright wallpaper.
panel_alpha = 0.95
selection_alpha = 0.28
# Same four satellite namespaces as liquid-motion, keyed identically so the
# two manifests validate against the same [compositor.*] keyspace. Offsets
# are liquid-motion's own numbers re-derived from this bar's actual edge
# instead of the island's: liquid-motion's bar bottom edge sits at
# margin.top(12) + height(44) = 56px, and its breadbar-notif/-panel top
# offset (64) is that plus an 8px gap, while breadbar-dismiss (56) sits
# flush against it with no gap. This bar's edge is margin.top(0) +
# height(36) = 36px, so the same two relationships give 44 (36 + 8) and 36.
[surfaces."breadbar-notif"]
anchor = "top_right"
offset = [16, 44]
width = 320
layer = "overlay"
[surfaces."breadbar-osd"]
# Independent of bar height (an OSD pill near the bottom of the screen) —
# unchanged from liquid-motion.
anchor = "bottom_centre"
offset = 80
width = 180
layer = "overlay"
[surfaces."breadbar-panel"]
anchor = "top_right"
offset = [16, 44]
width = "auto"
layer = "overlay"
[surfaces."breadbar-dismiss"]
anchor = "fill"
offset = 36
width = "fill"
layer = "overlay"
# Appearance-only, never placement/workspace/focus (plan §12 Layer B
# boundary) — identical to liquid-motion's rules. Blur *strength* is global
# (plan §9 known limit), so this theme cannot independently match the demo's
# per-surface blur radii (20px bar / 16px launcher / 22px popovers / 6px
# window borders); only on/off, ignore_alpha and slide direction are
# per-namespace knobs this system actually has.
[compositor."breadbar"]
blur = true
ignore_alpha = 0.2
blur_popups = true
animation = "slide top"
[compositor."breadbar-osd"]
blur = true
ignore_alpha = 0.2
animation = "slide bottom"
[compositor."breadbar-notif"]
blur = true
ignore_alpha = 0.2
animation = "slide right"
[compositor."breadbar-panel"]
blur = true
ignore_alpha = 0.2
animation = "slide right"
[compositor."breadbar-dismiss"]
no_anim = true
[compositor."breadbox"]
blur = true
ignore_alpha = 0.2
# No `css = "..."` overlay — compiled-in builtin, same as liquid-motion.

104
bread-theme/assets/shell/liquid-motion/liquid-motion.css
View file

@ -1,104 +0,0 @@
/* CSS template for the liquid-motion builtin (bread-theme/src/shell/builtin.rs).
*
* Curly-brace placeholders like {radius_bar} or {spring} are substituted
* from [tokens] by ShellTheme::css / Tokens::substitute; @-prefixed palette
* references (@accent, @on-bg, ...) pass through untouched, exactly like
* `bread_theme::stylesheet()` — GTK's own @define-color mechanism resolves
* them when the CSS provider is attached to a display/output.
*
* Scope: this is the window/workspace/clock chrome the manifest's own
* concepts (bar.window, modules.workspaces, modules.clock) actually model —
* not a byte-for-byte copy of breadbar/src/theme.rs::load_css's full ~250
* lines (notification cards, wifi popover, control panel, media widget, ...).
* Those stay hand-written in breadbar for now; migrating them behind this
* same token-substitution mechanism is Phase 2/3 work (plan §6), once
* breadbar actually consumes ShellTheme and can verify pixel parity itself
* via --screenshot. Phase 1's job is the mechanism, exercised end-to-end
* here with a representative slice, not the full port.
*/
@keyframes row-in {
from { opacity: 0; margin-top: 8px; }
to { opacity: 1; margin-top: 0; }
}
@keyframes digit-flip {
from { opacity: 0; margin-top: 7px; }
to { opacity: 1; margin-top: 0; }
}
window.breadbar {
background-color: alpha(@bg, {bg_alpha});
color: @on-bg;
border-radius: {radius_bar}px;
border: 1px solid alpha(@on-bg, 0.08);
}
window.breadbar > centerbox { padding: 0 8px 0 6px; }
window.breadbar button { min-height: 0; min-width: 0; }
.workspace-trail {
background-image: linear-gradient(90deg, @{accent_from}, @{accent_to});
background-color: @{accent_from};
border-radius: {radius_card}px;
}
.workspace-btn {
background: transparent;
opacity: 0.36;
color: @on-bg;
border-radius: {radius_card}px;
border: none;
outline: none;
box-shadow: none;
min-width: 28px;
min-height: {chip_height}px;
margin: 0;
padding: 0 7px;
font-size: 22px;
font-weight: bold;
transition: opacity 0.22s {spring_settle}, background-color 0.22s {spring_settle};
}
.workspace-btn:hover { opacity: 0.85; background: alpha(@on-bg, 0.08); }
.workspace-btn.occupied { opacity: 0.78; }
.workspace-btn.active { background: transparent; color: @on-accent; opacity: 1; }
.workspace-btn.active:hover { background: transparent; }
.workspace-btn.ws-in { animation: row-in 0.32s {spring_settle} both; }
.clock-box { padding: 0 4px; }
.clock-label {
font-size: 24px;
font-weight: bold;
letter-spacing: 0.04em;
min-height: 0;
padding: 0;
margin-top: 3px;
}
.clock-digit {
font-size: 24px;
font-weight: bold;
letter-spacing: 0.04em;
min-width: 15px;
min-height: 0;
padding: 0;
margin: 0;
}
.clock-colon { min-width: 10px; opacity: 0.7; }
.clock-digit.flip { animation: digit-flip 0.45s {spring} both; }
window.breadbar-osd {
background-color: alpha(@bg, 0.70);
color: @on-bg;
border-radius: {radius_pill}px;
border: 1px solid alpha(@on-bg, 0.10);
}
window.breadbar-panel {
background-color: alpha(@bg, {bg_alpha});
color: @on-bg;
border-radius: 14px;
border: 1px solid alpha(@on-bg, 0.12);
}
window.breadbar-dismiss {
background-color: alpha(#000000, 0.02);
}
.bread-widget-slot { margin-right: {pad}px; }

204
bread-theme/assets/shell/liquid-motion/theme.toml
View file

@ -1,204 +0,0 @@
# The compiled-in builtin theme (bread-theme/src/shell/builtin.rs). The bar
# side (workspaces/clock/chips/satellites) describes breadbar AS IT EXISTS
# TODAY, not the 01-liquid-motion.html demo — where the two disagree (bar
# side margin, the two easing curves), this file follows the current Rust
# source, since Phase 2's acceptance test is pixel-identical rendering
# against today's bar. The `[launcher]` table is the one exception: it now
# follows bos-ui-demos/proposed/liquid-motion.html's `.bx` block (the
# launcher-core redesign's spec) rather than breadbox's old, pre-redesign
# hardcoded CSS — see that section's own note.
#
# Sources: breadbar/src/main.rs:16-22 (BAR_* / CHIP_HEIGHT / ICON_PX consts),
# breadbar/src/theme.rs (load_css's radius/pad/spring locals and the actual
# CSS selectors), breadbar/src/{panel,osd}.rs and
# breadbar/src/notifications/{popup,history}.rs (satellite window anchors,
# margins, namespaces), bos-ui-demos/proposed/liquid-motion.html (launcher),
# ~/.config/hypr/scripts/ui/rules.lua (compositor rules).
name = "Liquid Motion"
id = "liquid-motion"
[tokens]
# font_family/font_fallback are now consumed, but only by breadbox's launcher
# panel (breadbox::main::build_css's entry.search/row font-family) — see
# Tokens::font_family's doc comment for the exact scope. breadbar's bar/chip/
# clock text still comes from bread_theme::stylesheet()'s own hardcoded
# FONT_FAMILY constant, unaffected by this key. font_size_base is likewise
# now consumed for the launcher's row font-size only.
font_family = "Outfit, sans-serif"
font_fallback = "sans-serif"
font_size_base = 14
radius_bar = 16
radius_card = 12
radius_sm = 9
# Not in the plan's §4 schema list, but a named local in theme.rs::load_css
# alongside radius_bar/radius_card/radius_sm (`radius_pill = "999px"`) — the
# OSD pill's corner radius.
radius_pill = 999
pad = 12
bg_alpha = 0.72
# Two curves theme.rs actually uses, not one: `spring` is the overshoot/bounce
# curve (clock flips, pop-ins, the workspace caret draw); `spring_settle` is
# the flatter curve used for hovers and workspace/stat-pair transitions. The
# plan's §4 example names only `spring`.
spring = "cubic-bezier(0.22, 1.35, 0.36, 1)"
spring_settle = "cubic-bezier(0.22, 1.2, 0.36, 1)"
# "accent" flows through as @accent (the workspace-trail gradient's start);
# these are palette token NAMES, not hex - pywal still drives colour.
# Declared-but-not-yet-consumed (accent_to only): breadbar's Trail-style CSS
# hardcodes the literal gradient `linear-gradient(90deg, @accent, @teal)`
# instead of substituting these two tokens (it never calls
# ShellTheme::css(), the only thing that does the substitution) — this
# theme's "teal" is what the demo intends, not what actually renders if a
# future theme changed it. See Tokens::accent_to's doc comment.
accent_from = "accent"
accent_to = "teal"
# Not in the plan's §4 schema list, but breadbar::CHIP_HEIGHT / ::ICON_PX
# today.
chip_height = 26
icon_px = 24
[bar.window]
anchors = ["top", "left", "right"]
width = "fill"
height = 44
# No `bottom` set here (or by either sibling builtin) — it's accepted by the
# schema but breadbar never applies it (no set_margin(Edge::Bottom, ...)
# call exists). See Margin::bottom's doc comment before relying on it.
margin = { top = 12, left = 16, right = 16 }
exclusive = "auto"
# breadbar never calls gtk4-layer-shell's set_keyboard_mode today, which
# defaults to KeyboardMode::None — spelled out explicitly here rather than
# left to omit-means-default, since "the shell must never fail to start
# because a theme file is malformed" cuts both ways: an explicit builtin
# value can't silently drift if the crate's own Default ever changes.
keyboard = "none"
layer = "top"
[bar.slots]
# The `widget:*` entries reproduce breadbar's pre-Phase-3b fixed Lua-widget
# interleave exactly (main.rs's now-removed widget_right_of_workspaces /
# widget_left_of_clock / widget_right_of_clock / widget_left_of_stats), so
# this manifest still renders pixel-identically to today's bar. `tray`
# deliberately has NO slot entry anywhere — it lives in the control-panel
# popover, not the bar, and is keyed directly by breadbar regardless of
# `[bar.slots]`.
left = ["workspaces", "widget:right_of_workspaces"]
centre = ["media", "widget:left_of_clock", "clock", "widget:right_of_clock"]
right = ["widget:left_of_stats", "volume", "wifi", "battery", "control"]
drawer = []
[modules.workspaces]
style = "trail"
show_empty = true
[modules.clock]
style = "flip"
# Declared-but-not-yet-consumed under style = "flip": bar::clock::time()
# hardcodes a 24h HH:MM layout regardless of `format`; only style = "plain"
# ever calls formatted(&format). Set here to state the layout this clock
# actually draws, not because anything reads it. Same for show_date — only
# ever attached to the Plain style's box.
format = "%H:%M"
show_date = false
[launcher]
# Liquid Motion / Glass Workbench redesign (bos-ui-demos/proposed/
# liquid-motion.html's `.bx` block is the spec): soft and roomy — a big
# panel radius, generous row insets/padding, 28px icons, section headers,
# and a translucent (not solid) accent selection fill. breadbox reads every
# key below now; see main.rs's build_css for the consuming CSS.
mode = "overlay"
width = 600
top = "120px"
radius = 20
icon_px = 28
row_anim = "flip"
rule = "gradient"
footer = "count_apps"
sections = true
modes = ["apps"]
# `.bx .r { border-radius: 12px; margin: 0 8px; padding: 10px 12px }`
row_radius = 12
row_inset = 8
row_padding_v = 10
row_padding_h = 12
# `.bx .ico { border-radius: 9px }` (paired with icon_px = 28 above)
icon_radius = 9
# `.bx .q { padding: 16px 18px; font-size: 16px }`
search_font_size = 16
search_padding_v = 16
search_padding_h = 18
# `.bx .r.sel { background: rgba(accent, .22) }`
# Panel opacity, separate from tokens.bg_alpha (the bar). Matches the
# approved reference: demo `.bx.lm{background:rgba(21,14,23,.93)}`. breadbox hardcoded 0.60, which washed the
# panel out over a bright wallpaper.
panel_alpha = 0.93
selection_alpha = 0.22
# Keyed by layer-shell namespace, matching [compositor.*] below, so the two
# tables share one keyspace and can be validated against each other.
# breadbar-notif's popup toast uses set_default_width(320) (its history
# sibling on the same namespace uses 360 — 320 is the live-toast surface, the
# one this positions). breadbar-panel sets no window width at all: its
# popovers size from their own CSS (.control-panel-inner / .wifi-popover-inner
# min-width), which is why its width is "auto" rather than a number.
[surfaces."breadbar-notif"]
anchor = "top_right"
offset = [16, 64]
width = 320
layer = "overlay"
[surfaces."breadbar-osd"]
anchor = "bottom_centre"
offset = 80
width = 180
layer = "overlay"
[surfaces."breadbar-panel"]
anchor = "top_right"
offset = [16, 64]
width = "auto"
layer = "overlay"
[surfaces."breadbar-dismiss"]
# Anchored to all four edges (a fullscreen click-away scrim) with only a top
# margin, so it starts below the bar rather than covering it.
anchor = "fill"
offset = 56
width = "fill"
layer = "overlay"
# Faithful to scripts/ui/rules.lua's five breadbar namespaces + breadbox.
[compositor."breadbar"]
blur = true
ignore_alpha = 0.2
blur_popups = true
animation = "slide top"
[compositor."breadbar-osd"]
blur = true
ignore_alpha = 0.2
animation = "slide bottom"
[compositor."breadbar-notif"]
blur = true
ignore_alpha = 0.2
animation = "slide right"
[compositor."breadbar-panel"]
blur = true
ignore_alpha = 0.2
animation = "slide right"
[compositor."breadbar-dismiss"]
no_anim = true
[compositor."breadbox"]
blur = true
ignore_alpha = 0.2
# No `css = "..."` overlay: the builtin is compiled in via `include_str!`
# and has no on-disk directory to resolve a relative overlay path against.
# `extra.css` is for user/system themes, which do have one — see
# `resolve_theme` in mod.rs.

73
bread-theme/assets/shell/spotlight/spotlight.css
View file

@ -1,73 +0,0 @@
/* CSS template for the spotlight builtin (bread-theme/src/shell/builtin.rs).
* Same scope and substitution rules as liquid-motion.css/glass-workbench.css:
* only the window/workspace/clock chrome the manifest's own concepts model.
*
* NOTE (unlike its two siblings): breadbar does not actually call
* `ShellTheme::css()` today — its live stylesheet is the hand-written,
* token-driven `breadbar::theme::load_css()`, which is where the capsule's
* real chrome (dots, `.launcher-entry`, `.bread-drawer`/results rows) lives.
* This file exists so the manifest's own template mechanism stays exercised
* for all three builtins equally (and so a future `bread-theme` CLI/test
* that DOES call `.css()` sees a real spotlight template) — see
* `ShellTheme::css`'s own doc comment for why that gap between "what the
* manifest models" and "what breadbar actually renders" is pre-existing,
* not new to this file.
*
* Source: bos-ui-demos/04-spotlight.html's <style> block. No trail overlay
* (dots never call `WorkspaceTrail::place`/`stretch`, same as pill) and no
* per-digit flip (`style = "none"` — no clock label markup at all).
*/
window.breadbar {
background-color: alpha(@bg, {bg_alpha});
color: @on-bg;
border-radius: {radius_bar}px;
border: 1px solid alpha(@on-bg, 0.08);
}
window.breadbar > box > centerbox { padding: 0 {pad}px; }
window.breadbar button { min-height: 0; min-width: 0; }
/* Dots: colour/opacity/radius only — width is per-instance data
* (`modules.workspaces.dot_widths`), set directly via `set_size_request` in
* Rust (`bar::workspaces::make_dot_button`), since GTK CSS has no
* per-instance variable width the way the demo's `[data-n]` attribute
* selectors do.
*/
.workspace-dot {
background-color: alpha(@on-bg, 0.35);
border-radius: {radius_pill}px;
border: none;
outline: none;
box-shadow: none;
min-height: 6px;
margin: 0;
padding: 0;
transition: background-color 0.25s {spring_settle}, opacity 0.25s {spring_settle};
}
.workspace-dot:hover { background-color: alpha(@on-bg, 0.55); }
.workspace-dot:not(.occupied):not(.active) { opacity: 0.35; }
.workspace-dot.active {
background-color: @{accent_from};
opacity: 1;
}
.workspace-dot.active:hover { background-color: @{accent_from}; }
window.breadbar-osd {
background-color: alpha(@bg, 0.72);
color: @on-bg;
border-radius: {radius_pill}px;
border: 1px solid alpha(@on-bg, 0.10);
}
window.breadbar-panel {
background-color: alpha(@bg, 0.86);
color: @on-bg;
border-radius: {radius_card}px;
border: 1px solid alpha(@on-bg, 0.12);
}
window.breadbar-dismiss {
background-color: alpha(#000000, 0.02);
}
.bread-widget-slot { margin-right: {pad}px; }

213
bread-theme/assets/shell/spotlight/theme.toml
View file

@ -1,213 +0,0 @@
# The third compiled-in builtin (bread-theme/src/shell/builtin.rs), demo 04
# in THEME_SYSTEM_PLAN.md — "Spotlight": breadbar's bar IS the launcher, a
# centred capsule that expands into results (plan §7). Values are taken from
# bos-ui-demos/04-spotlight.html's <style> block; where the demo is silent
# (satellite offsets, bar-adjacent chip sizing) this file re-derives from the
# capsule's own top edge the same way glass-workbench re-derives from its
# flush bar's edge — see that file's header comment for the method.
#
# Two exceptions, same shape as glass-workbench's: font (Outfit is not
# installed on the dev machine, so this renders in fallback until the user
# installs ttf-outfit — same gap liquid-motion already has) and colour (the
# demo's #e87898 pink is a *flat* accent — `--accent` doubling as both the
# capsule's dot fill and its only gradient stop — so it maps to the
# palette's `pink` token for both accent_from and accent_to, never a literal
# hex value).
#
# Phase 6c (this pass): query modes (`=` calc, `>` command, `.` url) and
# result sections ("recent"/"apps") are now implemented — `modes` lists all
# four and `sections` is `true`. The demo's `.searching .capsule` state
# (480px -> 520px width, 22px -> 20px radius) is modeled via two new
# `[launcher]` keys, `search_width`/`search_radius`, read only by
# `LauncherMode::Embedded` hosts (breadbar's capsule; unread by breadbox's
# overlay window, which stays `mode = "overlay"`).
name = "Spotlight"
id = "spotlight"
[tokens]
# Declared-but-not-yet-consumed: see liquid-motion/theme.toml's identical
# note next to these three keys — neither breadbar nor breadbox reads them.
font_family = "Outfit"
font_fallback = "Varela Round, sans-serif"
font_size_base = 13
radius_bar = 22
radius_card = 12
radius_sm = 8
radius_pill = 999
pad = 14
# Demo: `background: color-mix(in oklab, var(--glass) 82%, transparent)`.
bg_alpha = 0.82
# The demo's one curve (`--spring: cubic-bezier(.22,1.35,.36,1)`) — the same
# overshoot liquid-motion calls `spring`. No separate flatter "settle" curve
# is defined in 04's stylesheet, so both accessors point at it, same
# reasoning as glass-workbench's single-curve tokens.
spring = "cubic-bezier(0.22, 1.35, 0.36, 1)"
spring_settle = "cubic-bezier(0.22, 1.35, 0.36, 1)"
# Palette token NAMES, not hex — #e87898 is this palette's `pink`. Equal
# from/to because the demo's accent here is flat, not liquid-motion's
# accent→teal gradient. accent_from IS read (the dots' active fill,
# theme.rs); accent_to is declared-but-not-yet-consumed, same as every
# other theme's — see Tokens::accent_to's doc comment.
accent_from = "pink"
accent_to = "pink"
# Demo: `.barrow { height: 36px }` with no separate workspace-chip height —
# the dots (`.dots button`) are sized entirely by `dot_widths` below, not by
# chip_height, but this token still feeds any other chip-shaped element
# (e.g. a future result-row affordance) at the bar's own row height.
chip_height = 22
# Demo: `.ico { width: 30px; height: 30px }` for a result row's icon
# swatch — the icon glyph itself sits inside that box with implicit
# padding, so the icon_px passed to bread-launcher's `ResultsList` is sized
# a little under the swatch box, same margin glass-workbench leaves between
# its 18px icon_px and larger chip_height.
icon_px = 22
# Floating centred capsule, full rounded border on every edge — same
# reasoning as liquid-motion's island, not glass-workbench's flush bar.
bar_border = "full"
[bar.window]
# Anchored top ONLY: gtk4-layer-shell centres a surface anchored to
# neither left nor right (THEME_SYSTEM_PLAN.md §7) — this is what makes the
# capsule float centred instead of spanning the screen width.
anchors = ["top"]
width = 480
height = 36
margin = { top = 16 }
# No exclusive zone: tiled clients run full-height behind the capsule,
# unlike Island/Edge's reserved strip — the capsule floats over content.
exclusive = "none"
# Hands keyboard focus over only while `launcher_entry` holds it (plan §7)
# — Island/Edge themes keep "none", unchanged.
keyboard = "on_demand"
layer = "top"
[bar.slots]
left = ["workspaces"]
centre = ["launcher_entry"]
# `widget:left_of_stats` (Phase 6c decision, see task notes): a Lua widget
# that requests this same placement (`bread-shared`'s `WidgetPlacement::
# LeftOfStats`, e.g. a real user's `git-branch-widget.lua`) would otherwise
# be silently undeliverable under spotlight — no `[bar.slots]` entry named
# any `widget:*` key at all, so `reconcile_widgets` drops it every time
# (quietly, since the Phase 6b fix, but still dropped). Deliberately just
# this one alias, not all five liquid-motion carries: spotlight has no
# clock module to anchor `left_of_clock`/`right_of_clock` against and no
# workspace-adjacent affordance next to its compact dots, so adding those
# would clutter a launcher-focused capsule with slots nothing here asks
# for. `left_of_stats` sits right where `battery` already does, matching
# liquid-motion's own ordering (`widget:left_of_stats` before its module).
right = ["widget:left_of_stats", "battery"]
drawer = ["launcher_results"]
[modules.workspaces]
style = "dots"
show_empty = true
# 0/1/2/3-or-more open windows → dot width in px
# (`04-spotlight.html`'s `.dots button[data-n="N"]` rules).
dot_widths = [8, 13, 17, 22]
[modules.clock]
# No clock label at all — `launcher_entry`'s placeholder IS the clock
# (`04-spotlight.html`: `q.placeholder = t` in `clock()`, replaced by the
# search prompt only once focused/open).
style = "none"
# Declared-but-not-yet-consumed under style = "none": no clock module is
# built at all, so there's no format/date to apply this to — see
# ClockModule::format's doc comment. Kept for the same "state actual design
# intent" reason as liquid-motion's Flip-style note.
format = "%H:%M"
show_date = false
placeholder_clock = true
[launcher]
mode = "embedded"
# Unread by an embedded launcher (breadbar's launcher_entry/launcher_results
# read [bar.window].width and this table's radius/icon_px instead of
# width/top — those two fields exist only for LauncherMode::Overlay, which
# breadbox's own window still uses). Kept at the bar's own width/22px radius
# for consistency with a reader who expects [launcher] to describe the
# launcher's shape regardless of mode.
width = 480
top = "16px"
radius = 22
icon_px = 22
row_anim = "none"
rule = "none"
footer = "count_apps"
# Phase 6c: "recent" / "apps" headers in the idle (empty-query) drawer view
# — `bread_launcher::split_sections` groups the same already-loaded/sorted
# entries `LaunchHistory`'s counts already rank, no new tracking needed.
sections = true
# `04-spotlight.html`'s three prefixes: `=` calc, `>` command, `.` url —
# `bread_launcher::parse_query`/`eval_calc`/`filter_commands` implement the
# pure logic; breadbar's capsule wiring (main.rs) gates on this list so an
# unlisted prefix character just falls through to a literal "apps" query.
modes = ["apps", "calc", "cmd", "url"]
# `04-spotlight.html`: `.searching .capsule { width: 520px; border-radius:
# 20px }` vs the idle 480px/22px above — animated via
# `bread_theme::anim::spring_to` (width) and a `.searching` CSS class
# (radius) in breadbar's capsule wiring.
search_width = 520
search_radius = 20
# Same five satellite namespaces as liquid-motion/glass-workbench, keyed
# identically. This bar's edge sits at margin.top(16) + height(36) = 52px —
# re-deriving glass-workbench's own edge+8/edge relationship (44 = 36+8,
# 36 = 36) against 52 gives 60 (52+8) and 52.
[surfaces."breadbar-notif"]
anchor = "top_right"
offset = [16, 60]
width = 320
layer = "overlay"
[surfaces."breadbar-osd"]
# Independent of bar height — unchanged from liquid-motion/glass-workbench.
anchor = "bottom_centre"
offset = 80
width = 180
layer = "overlay"
[surfaces."breadbar-panel"]
anchor = "top_right"
offset = [16, 60]
width = "auto"
layer = "overlay"
[surfaces."breadbar-dismiss"]
anchor = "fill"
offset = 52
width = "fill"
layer = "overlay"
# Appearance-only, identical in shape to liquid-motion/glass-workbench's
# rules — blur strength is still global (plan §9 known limit).
[compositor."breadbar"]
blur = true
ignore_alpha = 0.18
blur_popups = true
animation = "slide top"
[compositor."breadbar-osd"]
blur = true
ignore_alpha = 0.2
animation = "slide bottom"
[compositor."breadbar-notif"]
blur = true
ignore_alpha = 0.2
animation = "slide right"
[compositor."breadbar-panel"]
blur = true
ignore_alpha = 0.2
animation = "slide right"
[compositor."breadbar-dismiss"]
no_anim = true
[compositor."breadbox"]
blur = true
ignore_alpha = 0.2
# No `css = "..."` overlay — compiled-in builtin, same as its two siblings.

11
bread-theme/bakery.toml
View file

@ -1,11 +0,0 @@
name = "bread-theme"
description = "Shared pywal-accented, fixed-dark-base theming CLI for the bread ecosystem — generates the shared GTK4 stylesheet every bread app loads"
binaries = ["bread-theme"]
system_deps = []
optional_system_deps = ["python-pywal"]
bread_deps = []
[install]
post_install = [
"bread-theme generate || true",
]

78
bread-theme/src/adw.rs
View file

@ -1,78 +0,0 @@
//! Composite libadwaita widgets for the bread ecosystem's design system —
//! the actual mechanism (real GNOME-style widgets, not more hand-rolled CSS)
//! behind why bos-settings' sidebar/section/toggle rows read as more polished
//! than the plain-GTK4 apps'. An app calls these instead of assembling boxes
//! and labels and raw widgets from scratch each time, so spacing/sizing/
//! grouping decisions get made once, correctly, here — not re-derived per
//! screen.
//!
//! Not usable from the five `gtk4-layer-shell` apps (breadbar, breadbox,
//! breadclip, breadsearch, breadpad): `AdwApplicationWindow`'s own chrome
//! isn't compatible with a layer-shell surface, and these helpers assume an
//! ordinary top-level window. Apps with a plain top-level window (breadman,
//! breadhelp) can use the full set.
use libadwaita as adw;
use adw::prelude::*;
/// Call once at startup, before building any widgets from this module —
/// initializes libadwaita's style manager and forces dark mode regardless of
/// the system GTK theme preference. bread-theme's whole design is a *fixed*
/// dark base (only the accent tracks pywal — see `palette::FIXED_BACKGROUND`
/// etc.) so an app respecting a light system preference here would silently
/// break that contract the moment someone's GNOME settings say "light".
pub fn init() {
adw::init().expect("failed to initialize libadwaita");
adw::StyleManager::default().set_color_scheme(adw::ColorScheme::ForceDark);
}
/// A titled, optionally-described group of setting rows — the
/// title-then-description-then-rows rhythm bos-settings already uses per
/// section, now available to native GTK4/relm4 apps instead of a hand-rolled
/// vbox with a bold label glued to the top.
pub fn preferences_group(title: &str, description: Option<&str>) -> adw::PreferencesGroup {
let group = adw::PreferencesGroup::builder().title(title).build();
if let Some(desc) = description {
group.set_description(Some(desc));
}
group
}
/// A single on/off setting row with a correctly-sized, correctly-positioned
/// switch — the direct fix for the ~1400px-wide stretched-switch bug
/// (breadman/settings had no intrinsic width on its hand-rolled switch, so
/// it filled the row like a progress bar).
pub fn toggle_row(title: &str, subtitle: Option<&str>, active: bool) -> adw::SwitchRow {
let row = adw::SwitchRow::builder().title(title).active(active).build();
if let Some(sub) = subtitle {
row.set_subtitle(sub);
}
row
}
/// A single numeric setting row (spin button docked to its own label,
/// instead of stranded ~1300px away at the window's far edge).
pub fn spin_row(title: &str, subtitle: Option<&str>, adjustment: &gtk4::Adjustment) -> adw::SpinRow {
let row = adw::SpinRow::builder().title(title).adjustment(adjustment).build();
if let Some(sub) = subtitle {
row.set_subtitle(sub);
}
row
}
/// A general label(+subtitle) row with room for a trailing widget
/// (`row.add_suffix(&widget)`) — for settings that don't fit switch/spin
/// (text entries, buttons, dropdowns, a raw value display).
pub fn action_row(title: &str, subtitle: Option<&str>) -> adw::ActionRow {
let row = adw::ActionRow::builder().title(title).build();
if let Some(sub) = subtitle {
row.set_subtitle(sub);
}
row
}
/// A page of one or more `preferences_group`s, with correct margins and
/// scroll handling — the top-level content container for a settings screen.
pub fn preferences_page() -> adw::PreferencesPage {
adw::PreferencesPage::new()
}

142
bread-theme/src/anim.rs
View file

@ -1,142 +0,0 @@
//! `anim::spring_to` — THEME_SYSTEM_PLAN.md §7/§8: GTK4 has no CSS
//! width/height transition on a widget or a layer-shell surface (unlike the
//! demos' `transition: width .45s var(--spring)` /
//! `transition: max-height .4s var(--spring)`), so a size change that wants
//! to animate has to interpolate a plain integer over the frame clock
//! instead and re-apply it (`set_size_request`, `set_default_width`, ...)
//! every frame.
//!
//! This is the same house technique `breadbar::bar::workspaces::WorkspaceTrail`
//! already uses for the workspace trail's stretch/snap (a local, un-exported
//! `ease`/`ease_overshoot` pair driven by `add_tick_callback` and
//! `Instant::elapsed`) — lifted here, generalized to a plain `i32 -> i32`
//! interpolation with a caller-supplied frame callback, so theme 04's
//! capsule-drawer expand/collapse (and any future popover that wants the
//! same effect) doesn't have to reimplement it.
use gtk4::glib::ControlFlow;
use gtk4::prelude::*;
/// Approximates `cubic-bezier(0.22, 1.35, 0.36, 1)` — the overshoot/"spring"
/// curve every builtin theme's `tokens.spring` names (`Tokens::spring`'s own
/// default). Not a literal bezier solve (same approximation
/// `bar::workspaces::ease_overshoot` uses) — exact enough that the eye can't
/// tell it apart from the real curve at animation speeds.
fn spring_ease(t: f64) -> f64 {
let t = t.clamp(0.0, 1.0);
let c = 1.35;
let t1 = t - 1.0;
1.0 + t1 * t1 * ((c + 1.0) * t1 + c)
}
/// One frame's worth of `spring_to`'s interpolation math — split out from
/// the tick callback below purely so it has a name a unit test can call
/// directly instead of re-deriving the same arithmetic.
///
/// `spring_ease` is a backOut curve that legitimately overshoots past 1.0
/// (peaks ~1.065) partway through the run — fine for a growing animation
/// (`to` > `from`), but on a *shrink* (`from` > `to`, e.g. a drawer
/// collapsing to 0) that overshoot drives the raw interpolated value BELOW
/// `to`, which can go negative for a size request and trip GTK's
/// `height >= -1` assertion. Clamping here, once, protects every caller
/// automatically instead of relying on each call site to remember
/// `h.max(0)` — this already bit breadbar once (see
/// `breadbar::main::animate_drawer_height`'s own clamp, now
/// redundant-but-harmless defense in depth on top of this).
fn frame_value(from: i32, to: i32, t: f64) -> i32 {
let eased = spring_ease(t);
let value = from as f64 + (to - from) as f64 * eased;
let lo = from.min(to) as f64;
let hi = from.max(to) as f64;
value.clamp(lo, hi).round() as i32
}
/// Interpolates from `from` to `to` over `duration_ms`, calling `on_frame`
/// with each intermediate value (and, on the final tick, the exact `to` —
/// never an off-by-rounding near-miss) via `widget`'s frame clock.
///
/// Returns the [`gtk4::TickCallbackId`] so a caller that might need to
/// interrupt an in-flight run (e.g. the drawer re-opening before its close
/// animation finished) can `.remove()` it early; a run left to finish on its
/// own needs no cleanup — the callback self-terminates by returning
/// [`ControlFlow::Break`] once `duration_ms` has elapsed, same as
/// `WorkspaceTrail`'s own tick callbacks.
pub fn spring_to(
widget: &impl IsA<gtk4::Widget>,
from: i32,
to: i32,
duration_ms: f64,
on_frame: impl FnMut(i32) + 'static,
) -> gtk4::TickCallbackId {
let started = std::time::Instant::now();
// `add_tick_callback` requires `Fn`, not `FnMut` — the caller's frame
// closure almost always needs to mutate captured state (a widget's size
// request, an `Rc<Cell<..>>` flag), so it's boxed behind a `RefCell`
// here rather than pushing `Cell`/`RefCell` plumbing onto every call
// site (every current and future caller wants `FnMut`, none want `Fn`).
let on_frame = std::cell::RefCell::new(on_frame);
widget.add_tick_callback(move |_, _| {
let elapsed = started.elapsed().as_secs_f64() * 1000.0;
let mut on_frame = on_frame.borrow_mut();
if elapsed >= duration_ms {
on_frame(to);
return ControlFlow::Break;
}
on_frame(frame_value(from, to, elapsed / duration_ms));
ControlFlow::Continue
})
}
#[cfg(test)]
mod tests {
use super::*;
/// Samples [`frame_value`] — the exact function `spring_to`'s tick
/// callback calls every frame — across the full `t` timeline at fine
/// granularity, bypassing the real frame clock (which needs a running
/// main loop the test environment doesn't have).
fn sample_all_frames(from: i32, to: i32) -> Vec<i32> {
let steps = 2000;
(0..=steps)
.map(|i| frame_value(from, to, i as f64 / steps as f64))
.collect()
}
#[test]
fn spring_ease_overshoots_past_one_for_a_backout_curve() {
// Sanity check on the premise: without a clamp, a shrink would
// legitimately go negative around this point in the curve.
assert!(spring_ease(0.8) > 1.0, "expected overshoot past 1.0");
}
#[test]
fn shrink_never_emits_a_value_outside_the_from_to_range() {
// from > to (a drawer collapsing to 0) is exactly the case the
// unclamped overshoot could drive negative.
for value in sample_all_frames(480, 0) {
assert!(
(0..=480).contains(&value),
"shrink emitted {value}, outside [0, 480]"
);
}
}
#[test]
fn grow_never_emits_a_value_outside_the_from_to_range() {
for value in sample_all_frames(0, 480) {
assert!(
(0..=480).contains(&value),
"grow emitted {value}, outside [0, 480]"
);
}
}
#[test]
fn zero_span_never_clamps_outside_the_single_point() {
// from == to: lo == hi == that point for every t, including past
// the overshoot peak.
for value in sample_all_frames(120, 120) {
assert_eq!(value, 120);
}
}
}

193
bread-theme/src/bin/bread-theme.rs
View file

@ -9,10 +9,6 @@
//! # signal every running bread GUI to recolour
//! bread-theme path # print the stylesheet path
//! bread-theme print # render to stdout (no write)
//! bread-theme generate-output <OUTPUT> --image <PATH> [--shared]
//! bread-theme generate-output <OUTPUT> --from-json <PATH> [--shared]
//! bread-theme layerrules # write the active theme's [compositor] table
//! # to ~/.config/hypr/layerrules.json (plan §9)
use std::process::ExitCode;
@ -29,179 +25,6 @@ fn write_and_report(verb: &str) -> ExitCode {
}
}
fn print_help_to(mut w: impl std::io::Write) {
let _ = write!(
&mut w,
"bread-theme — shared stylesheet generator\n\n\
USAGE:\n\
\x20 bread-theme [generate|reload|path|print|layerrules]\n\
\x20 bread-theme generate-output <OUTPUT> --image <PATH> [--shared]\n\
\x20 bread-theme generate-output <OUTPUT> --from-json <WAL-OR-PALETTE.json> [--shared]\n\n\
generate render the pywal palette to the shared stylesheet (default)\n\
reload re-render and signal running bread GUIs to recolour live\n\
path print the stylesheet path ({})\n\
print render to stdout without writing\n\
generate-output write palettes/<OUTPUT>.json and themes/<OUTPUT>.css\n\
\x20 --image isolated `wal -i` (does not touch ~/.cache/wal)\n\
\x20 --from-json wal colors.json or a color1-6 object\n\
\x20 --shared also write the session-global theme.css\n\
layerrules write the active shell theme's [compositor] table to\n\
\x20 {} —\n\
\x20 scripts/ui/rules.lua reads it for per-namespace blur/\n\
\x20 animation, falling back to its hardcoded rules if this\n\
\x20 is missing or malformed",
bread_theme::shared_css_path().display(),
bread_theme::layerrules_path().display()
);
}
/// Usage/help text. Explicitly requested help (`--help`/`-h`) goes to
/// **stdout** so it can be piped/grepped; the same text on an error path
/// (e.g. `generate-output` with no args) goes to stderr via
/// [`print_help_err`].
fn print_help() {
print_help_to(std::io::stdout());
}
fn print_help_err() {
print_help_to(std::io::stderr());
}
fn generate_output_cmd() -> ExitCode {
let args: Vec<String> = std::env::args().skip(2).collect();
if args.iter().any(|a| matches!(a.as_str(), "-h" | "--help" | "help")) {
print_help();
return ExitCode::SUCCESS;
}
if args.is_empty() {
// Missing arguments is an error, not a help request — usage goes to
// stderr.
print_help_err();
return ExitCode::FAILURE;
}
let output = args[0].as_str();
if output.starts_with('-') {
eprintln!("bread-theme: generate-output requires an OUTPUT name (got '{output}')");
return ExitCode::FAILURE;
}
let mut image: Option<&str> = None;
let mut from_json: Option<&str> = None;
let mut shared = false;
let mut i = 1;
while i < args.len() {
match args[i].as_str() {
"--shared" => shared = true,
"--image" => {
i += 1;
match args.get(i) {
Some(p) => image = Some(p.as_str()),
None => {
eprintln!("bread-theme: --image requires a path");
return ExitCode::FAILURE;
}
}
}
"--from-json" => {
i += 1;
match args.get(i) {
Some(p) => from_json = Some(p.as_str()),
None => {
eprintln!("bread-theme: --from-json requires a path");
return ExitCode::FAILURE;
}
}
}
other => {
eprintln!("bread-theme: unknown generate-output flag '{other}'");
return ExitCode::FAILURE;
}
}
i += 1;
}
match (image, from_json) {
(Some(_), Some(_)) => {
eprintln!("bread-theme: pass only one of --image or --from-json");
ExitCode::FAILURE
}
(None, None) => {
eprintln!("bread-theme: generate-output needs --image <PATH> or --from-json <PATH>");
ExitCode::FAILURE
}
(Some(path), None) => {
match bread_theme::generate_output(output, std::path::Path::new(path)) {
Ok(css) => finish_generate_output(output, css, shared),
Err(e) => {
eprintln!("bread-theme: generate-output failed: {e}");
ExitCode::FAILURE
}
}
}
(None, Some(path)) => match write_output_from_json(output, path, shared) {
Ok(()) => ExitCode::SUCCESS,
Err(e) => {
eprintln!("bread-theme: generate-output failed: {e}");
ExitCode::FAILURE
}
},
}
}
fn write_output_from_json(output: &str, json_path: &str, shared: bool) -> std::io::Result<()> {
let json = std::fs::read_to_string(json_path)?;
let palette = bread_theme::palette_from_json(&json).ok_or_else(|| {
std::io::Error::new(
std::io::ErrorKind::InvalidData,
format!("could not parse palette JSON: {json_path}"),
)
})?;
let pal_path = bread_theme::write_output_palette(output, &palette)?;
let css_path = bread_theme::write_output_css(output, &palette)?;
eprintln!(
"bread-theme: wrote {} and {}",
pal_path.display(),
css_path.display()
);
if shared {
let shared_path = bread_theme::write_shared_css_from(&palette)?;
eprintln!("bread-theme: wrote shared {}", shared_path.display());
}
Ok(())
}
fn finish_generate_output(output: &str, css: std::path::PathBuf, shared: bool) -> ExitCode {
eprintln!("bread-theme: wrote {}", css.display());
if shared {
match bread_theme::write_shared_css_from(&bread_theme::load_palette_for(output)) {
Ok(path) => {
eprintln!("bread-theme: wrote shared {}", path.display());
ExitCode::SUCCESS
}
Err(e) => {
eprintln!("bread-theme: failed to write shared stylesheet: {e}");
ExitCode::FAILURE
}
}
} else {
ExitCode::SUCCESS
}
}
fn layerrules_cmd() -> ExitCode {
match bread_theme::write_layerrules_active() {
Ok(path) => {
eprintln!("bread-theme: wrote {}", path.display());
ExitCode::SUCCESS
}
Err(e) => {
eprintln!("bread-theme: failed to write layer rules: {e}");
ExitCode::FAILURE
}
}
}
fn main() -> ExitCode {
let cmd = std::env::args().nth(1).unwrap_or_else(|| "generate".into());
match cmd.as_str() {
@ -219,16 +42,20 @@ fn main() -> ExitCode {
// the file monitor in every running bread GUI, so they all re-read the
// palette and recolour live — shared widgets *and* each app's own rules.
"reload" => write_and_report("reloaded"),
"generate-output" => generate_output_cmd(),
"layerrules" => layerrules_cmd(),
"-h" | "--help" | "help" => {
print_help();
eprintln!(
"bread-theme — shared stylesheet generator\n\n\
USAGE:\n bread-theme [generate|reload|path|print]\n\n\
generate render the pywal palette to the shared stylesheet (default)\n\
reload re-render and signal running bread GUIs to recolour live\n\
path print the stylesheet path ({})\n\
print render to stdout without writing",
bread_theme::shared_css_path().display()
);
ExitCode::SUCCESS
}
other => {
eprintln!(
"bread-theme: unknown command '{other}' (try generate|reload|path|print|generate-output|layerrules)"
);
eprintln!("bread-theme: unknown command '{other}' (try generate|reload|path|print)");
ExitCode::FAILURE
}
}

356
bread-theme/src/gtk.rs
View file

@ -1,22 +1,8 @@
use gtk4::gdk::prelude::*;
use gtk4::gio;
use gtk4::glib::object::ObjectType;
use gtk4::prelude::*;
use gtk4::CssProvider;
use std::cell::RefCell;
use std::collections::{HashMap, HashSet};
use std::path::Path;
use std::rc::Rc;
use crate::Palette;
/// Per-widget app-CSS builder: given the resolved palette for the widget's
/// monitor, produce the app stylesheet to layer on top of the theme CSS.
type AppCssBuilder = Rc<dyn Fn(&Palette) -> String>;
/// Above APPLICATION (600) so we beat [`apply_shared`], below USER (800)
/// so `apply_user_css` still wins.
const BIND_PRIORITY: u32 = gtk4::STYLE_PROVIDER_PRIORITY_USER - 10;
thread_local! {
static SHARED_PROVIDER: RefCell<Option<CssProvider>> = const { RefCell::new(None) };
@ -28,7 +14,8 @@ thread_local! {
}
fn reload_shared() {
let css = std::fs::read_to_string(crate::shared_css_path()).unwrap_or_else(|_| crate::render());
let css = std::fs::read_to_string(crate::shared_css_path())
.unwrap_or_else(|_| crate::render());
SHARED_PROVIDER.with(|cell| apply_css(&css, cell));
}
@ -127,345 +114,6 @@ pub fn apply_css(css: &str, provider: &RefCell<Option<CssProvider>>) {
}
}
/// A filter/tag chip using the shared `.chip` stylesheet rule (an
/// `@overlay`-filled pill, `@accent`-filled when the `active` CSS class is
/// set) instead of a fresh literal color — this is the fix for the same
/// component drifting to three different fills across breadclip (grey),
/// breadpad, and breadman (both cream), none of which agreed with each
/// other or with the shared token.
pub fn chip(label: &str) -> gtk4::Button {
gtk4::Button::builder()
.label(label)
.css_classes(["chip"])
.build()
}
/// Toggles a chip's (or any widget's) `active` CSS class — the `.chip.active`
/// stylesheet rule fills it with the accent instead of the neutral overlay.
/// Wiring *when* a chip becomes active (single-select filter, multi-select
/// tags, etc.) is genuinely per-app, so that stays the caller's job; this is
/// just the one-line visual toggle every case needs.
pub fn set_chip_active(chip: &impl IsA<gtk4::Widget>, active: bool) {
if active {
chip.add_css_class("active");
} else {
chip.remove_css_class("active");
}
}
/// Gdk connector for the monitor currently showing this widget, if any.
pub fn output_for_widget(widget: &impl IsA<gtk4::Widget>) -> Option<String> {
let widget = widget.as_ref();
let native = widget.native()?;
let surface = NativeExt::surface(&native)?;
let monitor = widget.display().monitor_at_surface(&surface)?;
monitor.connector().map(|c| c.to_string())
}
struct WidgetBind {
output: String,
theme: CssProvider,
app: Option<CssProvider>,
app_build: Option<AppCssBuilder>,
/// Keep the directory monitor + child model alive for this widget.
_watch: Option<gio::ListModel>,
}
thread_local! {
static BINDS: RefCell<HashMap<usize, WidgetBind>> = RefCell::new(HashMap::new());
static THEMES_MONITOR: RefCell<Option<gio::FileMonitor>> = const { RefCell::new(None) };
static DESTROY_HOOKED: RefCell<HashSet<usize>> = RefCell::new(HashSet::new());
static AUTO_HOOKED: RefCell<HashSet<usize>> = RefCell::new(HashSet::new());
static ENTER_HOOKED: RefCell<HashSet<usize>> = RefCell::new(HashSet::new());
}
fn widget_key(widget: &gtk4::Widget) -> usize {
widget.as_ptr() as usize
}
#[allow(deprecated)]
fn add_widget_provider(widget: &gtk4::Widget, provider: &CssProvider, prio: u32) {
widget.style_context().add_provider(provider, prio);
}
/// Same `CssProvider` on the widget and its current descendants so component
/// rules actually reach buttons/labels (a style-context provider is not
/// inherited by children).
fn attach_tree(widget: &gtk4::Widget, theme: &CssProvider, app: Option<&CssProvider>) {
add_widget_provider(widget, theme, BIND_PRIORITY);
if let Some(app) = app {
add_widget_provider(widget, app, BIND_PRIORITY + 1);
}
let mut child = widget.first_child();
while let Some(c) = child {
attach_tree(&c, theme, app);
child = c.next_sibling();
}
}
fn ensure_destroy_cleanup(widget: &gtk4::Widget) {
let key = widget_key(widget);
let inserted = DESTROY_HOOKED.with(|s| s.borrow_mut().insert(key));
if !inserted {
return;
}
widget.connect_destroy(move |w| {
let key = widget_key(w);
BINDS.with(|b| {
b.borrow_mut().remove(&key);
});
DESTROY_HOOKED.with(|s| {
s.borrow_mut().remove(&key);
});
AUTO_HOOKED.with(|s| {
s.borrow_mut().remove(&key);
});
});
}
fn ensure_themes_watch() {
THEMES_MONITOR.with(|cell| {
if cell.borrow().is_some() {
return;
}
let dir = crate::themes_dir();
let _ = std::fs::create_dir_all(&dir);
let monitor = gio::File::for_path(&dir)
.monitor_directory(gio::FileMonitorFlags::WATCH_MOVES, gio::Cancellable::NONE)
.ok();
if let Some(ref m) = monitor {
m.connect_changed(move |_, file, other, _event| {
let path = file.path().or_else(|| other.and_then(|f| f.path()));
let Some(path) = path else {
return;
};
if path.extension().and_then(|e| e.to_str()) != Some("css") {
return;
}
let Some(stem) = path.file_stem().and_then(|s| s.to_str()) else {
return;
};
reload_binds_for_sanitized(stem);
});
}
*cell.borrow_mut() = monitor;
});
}
fn reload_binds_for_sanitized(sanitized: &str) {
BINDS.with(|binds| {
for bind in binds.borrow_mut().values_mut() {
if crate::sanitize_output(&bind.output) != sanitized {
continue;
}
let palette = crate::load_palette_for(&bind.output);
bind.theme
.load_from_string(&crate::stylesheet_resolved(&palette));
if let (Some(build), Some(provider)) = (&bind.app_build, &bind.app) {
provider.load_from_string(&crate::resolve_color_names(&build(&palette), &palette));
}
}
});
}
fn watch_root_children(widget: &gtk4::Widget) -> gio::ListModel {
let model = widget.observe_children();
let root = widget.downgrade();
model.connect_items_changed(move |_, _, _, _| {
let Some(root) = root.upgrade() else {
return;
};
let key = widget_key(&root);
BINDS.with(|binds| {
if let Some(bind) = binds.borrow().get(&key) {
attach_tree(&root, &bind.theme, bind.app.as_ref());
}
});
});
model
}
fn bind_window_inner(
widget: &gtk4::Widget,
output: &str,
app_build: Option<AppCssBuilder>,
) {
let key = widget_key(widget);
let palette = crate::load_palette_for(output);
let theme_css = crate::stylesheet_resolved(&palette);
let app_css = app_build
.as_ref()
.map(|build| crate::resolve_color_names(&build(&palette), &palette));
BINDS.with(|binds| {
let mut map = binds.borrow_mut();
if let Some(existing) = map.get_mut(&key) {
existing.output = output.to_string();
existing.theme.load_from_string(&theme_css);
existing.app_build = app_build.clone();
match (&app_css, existing.app.as_ref()) {
(Some(css), Some(p)) => p.load_from_string(css),
(Some(css), None) => {
let p = CssProvider::new();
p.load_from_string(css);
add_widget_provider(widget, &p, BIND_PRIORITY + 1);
existing.app = Some(p);
}
(None, Some(p)) => p.load_from_string(""),
(None, None) => {}
}
attach_tree(widget, &existing.theme, existing.app.as_ref());
return;
}
let theme = CssProvider::new();
theme.load_from_string(&theme_css);
add_widget_provider(widget, &theme, BIND_PRIORITY);
let app = app_css.map(|css| {
let p = CssProvider::new();
p.load_from_string(&css);
add_widget_provider(widget, &p, BIND_PRIORITY + 1);
p
});
attach_tree(widget, &theme, app.as_ref());
let child_model = watch_root_children(widget);
map.insert(
key,
WidgetBind {
output: output.to_string(),
theme,
app,
app_build,
_watch: Some(child_model),
},
);
});
ensure_destroy_cleanup(widget);
ensure_themes_watch();
ensure_map_reattach(widget);
}
fn ensure_map_reattach(widget: &gtk4::Widget) {
// `connect_map` once per widget — re-bind already lives in BINDS.
thread_local! {
static MAP_HOOKED: RefCell<HashSet<usize>> = RefCell::new(HashSet::new());
}
let key = widget_key(widget);
let inserted = MAP_HOOKED.with(|s| s.borrow_mut().insert(key));
if !inserted {
return;
}
widget.connect_map(|w| {
BINDS.with(|binds| {
if let Some(bind) = binds.borrow().get(&widget_key(w)) {
attach_tree(w, &bind.theme, bind.app.as_ref());
}
});
});
widget.connect_destroy(move |_| {
MAP_HOOKED.with(|s| {
s.borrow_mut().remove(&key);
});
});
}
/// Attach a widget-level `CssProvider` with
/// `stylesheet_resolved(load_palette_for(output))` above APPLICATION so it
/// beats [`apply_shared`] for this widget tree. User CSS still wins.
/// Calling again on the same widget replaces the provider; it does not stack.
pub fn bind_window(widget: &impl IsA<gtk4::Widget>, output: &str) {
bind_window_inner(widget.as_ref(), output, None);
}
/// [`bind_window`], then also apply `build(&palette)` on the same widget.
/// App CSS may still use `@accent` etc.; those names are inlined against
/// the same palette before loading.
pub fn bind_window_with_app_css<F>(widget: &impl IsA<gtk4::Widget>, output: &str, build: F)
where
F: Fn(&Palette) -> String + 'static,
{
bind_window_inner(widget.as_ref(), output, Some(Rc::new(build)));
}
fn attach_enter_monitor(widget: &gtk4::Widget, build: Option<AppCssBuilder>) {
let Some(native) = widget.native() else {
return;
};
let Some(surface) = NativeExt::surface(&native) else {
return;
};
let surf_key = surface.as_ptr() as usize;
let already = ENTER_HOOKED.with(|s| !s.borrow_mut().insert(surf_key));
if already {
return;
}
let widget = widget.clone();
surface.connect_enter_monitor(move |_, monitor| {
let Some(conn) = monitor.connector() else {
return;
};
bind_window_inner(&widget, conn.as_str(), build.clone());
});
}
fn bind_auto(native: &gtk4::Native, build: Option<AppCssBuilder>) {
let widget = native.upcast_ref::<gtk4::Widget>().clone();
let apply = {
let widget = widget.clone();
let build = build.clone();
Rc::new(move || {
if let Some(output) = output_for_widget(&widget) {
bind_window_inner(&widget, &output, build.clone());
}
})
};
apply();
let key = widget_key(&widget);
let inserted = AUTO_HOOKED.with(|s| s.borrow_mut().insert(key));
if inserted {
widget.connect_realize({
let apply = apply.clone();
let widget = widget.clone();
let build = build.clone();
move |_| {
apply();
attach_enter_monitor(&widget, build.clone());
}
});
widget.connect_map({
let apply = apply.clone();
move |_| apply()
});
ensure_destroy_cleanup(&widget);
}
if widget.is_realized() {
attach_enter_monitor(&widget, build);
}
}
/// Realize + `GdkSurface::enter-monitor`: rebind when the window moves
/// outputs. If the connector is unknown, leave unbound (display fallback)
/// rather than guessing the wrong monitor.
pub fn bind_window_auto(window: &impl IsA<gtk4::Native>) {
bind_auto(window.as_ref(), None);
}
/// [`bind_window_auto`] plus per-output app CSS, resolved to hex.
pub fn bind_window_auto_with_app_css<F>(window: &impl IsA<gtk4::Native>, build: F)
where
F: Fn(&Palette) -> String + 'static,
{
bind_auto(window.as_ref(), Some(Rc::new(build)));
}
/// Apply a user CSS override file at USER priority. Clears the provider if the
/// file is absent so stale overrides don't persist across SIGHUP reloads.
pub fn apply_user_css(path: &Path, provider: &RefCell<Option<CssProvider>>) {

211
bread-theme/src/layerrules.rs
View file

@ -1,211 +0,0 @@
//! Generates `~/.config/hypr/layerrules.json` from the active shell theme's
//! `[compositor]` table (`THEME_SYSTEM_PLAN.md` §9). `scripts/ui/rules.lua`
//! reads this file and emits `hl.layer_rule` calls from it, keeping its own
//! hardcoded rules as a pcall-guarded fallback for when this file is missing
//! or malformed — so generation here never has to be perfect, only present.
//!
//! Scope (plan §9's appearance/placement boundary): a theme's `[compositor]`
//! table owns per-namespace *appearance* only — blur, ignore_alpha,
//! blur_popups, animation, no_anim (the [`crate::shell::LayerRule`] field
//! set). It never owns placement, workspace-assignment, or focus rules —
//! those stay Lua-side user policy (`rules.lua`'s `hl.window_rule` calls)
//! that this generator does not touch.
use std::path::PathBuf;
use crate::shell::ShellTheme;
fn config_home() -> PathBuf {
// XDG spec: `XDG_CONFIG_HOME` is only honored when it's an *absolute*
// path; a relative value must be ignored (matches `bread_utils::xdg`).
if let Ok(v) = std::env::var("XDG_CONFIG_HOME") {
let p = PathBuf::from(&v);
if p.is_absolute() {
return p;
}
}
dirs::home_dir()
.unwrap_or_else(|| PathBuf::from("."))
.join(".config")
}
/// `~/.config/hypr/layerrules.json` (or under `$XDG_CONFIG_HOME` if set) —
/// alongside `binds.json`, `settings.json`, `monitors.json`, and
/// `autostart.json`, the established flat-JSON-under-`hypr/` convention
/// those files already use (see `~/.config/hypr/scripts/input/binds.lua` for
/// the read side of that pattern, which `scripts/ui/rules.lua` now mirrors).
pub fn layerrules_path() -> PathBuf {
config_home().join("hypr").join("layerrules.json")
}
/// Render `theme`'s `[compositor]` table as the JSON object
/// `scripts/ui/rules.lua` expects: keyed by layer-shell namespace (e.g.
/// `"breadbar"`, `"breadbox"`), each value the namespace's
/// [`crate::shell::LayerRule`] fields. `compositor_rules()` returns a
/// `BTreeMap`, so namespace order is stable (alphabetical) across runs and a
/// rewritten file diffs cleanly.
pub fn layerrules_json(theme: &ShellTheme) -> String {
serde_json::to_string_pretty(theme.compositor_rules())
.expect("LayerRule serialization is infallible (no maps/floats that can fail)")
}
/// [`layerrules_json`] + atomic write (tmp + rename), the same durability
/// [`crate::write_shared_css_from`] uses so a reload can never observe a
/// half-written file.
pub fn write_layerrules(theme: &ShellTheme) -> std::io::Result<PathBuf> {
let path = layerrules_path();
let json = layerrules_json(theme);
crate::output::atomic_write(&path, &json)?;
Ok(path)
}
/// [`write_layerrules`] from the active theme ([`crate::shell::load`], which
/// never fails — a broken active theme falls back to the builtin). Used by
/// the `bread-theme layerrules` CLI subcommand.
pub fn write_layerrules_active() -> std::io::Result<PathBuf> {
write_layerrules(&crate::shell::load())
}
#[cfg(test)]
mod tests {
use super::*;
use std::path::Path;
fn lock_xdg() -> std::sync::MutexGuard<'static, ()> {
// Shared with `shell::tests::isolated_xdg`, which also mutates
// XDG_CONFIG_HOME — must be the *same* lock, not a look-alike one,
// or the two modules' parallel tests race each other's env var
// reads (see `crate::test_support`'s doc comment).
crate::test_support::XDG_CONFIG_HOME_LOCK
.lock()
.unwrap_or_else(|e| e.into_inner())
}
fn with_config_home<T>(f: impl FnOnce(&Path) -> T) -> T {
let _lock = lock_xdg();
let dir = std::env::temp_dir().join(format!(
"bread-theme-layerrules-test-{}-{}",
std::process::id(),
std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
.unwrap_or_default()
.as_nanos()
));
std::fs::create_dir_all(&dir).unwrap();
let old = std::env::var("XDG_CONFIG_HOME").ok();
std::env::set_var("XDG_CONFIG_HOME", &dir);
let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| f(&dir)));
match old {
Some(v) => std::env::set_var("XDG_CONFIG_HOME", v),
None => std::env::remove_var("XDG_CONFIG_HOME"),
}
let _ = std::fs::remove_dir_all(&dir);
match result {
Ok(v) => v,
Err(e) => std::panic::resume_unwind(e),
}
}
#[test]
fn layerrules_path_sits_under_config_hypr() {
with_config_home(|dir| {
assert_eq!(layerrules_path(), dir.join("hypr").join("layerrules.json"));
});
}
/// True if any file under `dir` has a name containing `.tmp.` (a
/// leftover from `output::atomic_write`'s pid-suffixed temp files).
fn has_leftover_tmp(dir: &Path) -> bool {
fn walk(p: &Path) -> bool {
let Ok(entries) = std::fs::read_dir(p) else {
return false;
};
for entry in entries.flatten() {
let path = entry.path();
if path.is_dir() {
if walk(&path) {
return true;
}
} else if path
.file_name()
.and_then(|n| n.to_str())
.is_some_and(|n| n.contains(".tmp."))
{
return true;
}
}
false
}
walk(dir)
}
/// `load_named("liquid-motion")` resolves through discovery (user dir,
/// then system dir, then the compiled-in builtin) — isolate
/// `XDG_CONFIG_HOME` to an empty dir so this can't pick up a real
/// `~/.config/bread/themes/liquid-motion/theme.toml` override and land
/// on a different `[compositor]` table than the builtin's.
fn builtin_theme() -> ShellTheme {
with_config_home(|_| crate::shell::load_named("liquid-motion").unwrap())
}
#[test]
fn layerrules_json_covers_all_six_builtin_namespaces() {
let theme = builtin_theme();
let json = layerrules_json(&theme);
let value: serde_json::Value = serde_json::from_str(&json).unwrap();
let obj = value.as_object().expect("top-level object");
for ns in [
"breadbar",
"breadbar-osd",
"breadbar-notif",
"breadbar-panel",
"breadbar-dismiss",
"breadbox",
] {
assert!(obj.contains_key(ns), "missing namespace {ns} in JSON");
}
}
#[test]
fn layerrules_json_shape_matches_breadbar_rule() {
let theme = builtin_theme();
let json = layerrules_json(&theme);
let value: serde_json::Value = serde_json::from_str(&json).unwrap();
let bar = &value["breadbar"];
assert_eq!(bar["blur"], true);
assert_eq!(bar["ignore_alpha"], 0.2);
assert_eq!(bar["blur_popups"], true);
assert_eq!(bar["animation"], "slide top");
// no_anim is a plain bool (not Option), so it's always present, even
// when false — unlike ignore_alpha/animation which are omitted.
assert_eq!(bar["no_anim"], false);
let dismiss = &value["breadbar-dismiss"];
assert_eq!(dismiss["no_anim"], true);
// ignore_alpha/animation are unset for breadbar-dismiss, so the
// skip_serializing_if omits them entirely rather than writing null.
assert!(dismiss.get("ignore_alpha").is_none());
assert!(dismiss.get("animation").is_none());
}
#[test]
fn write_layerrules_active_writes_atomically_and_is_reloadable() {
with_config_home(|dir| {
let path = write_layerrules_active().unwrap();
assert_eq!(path, dir.join("hypr").join("layerrules.json"));
assert!(path.is_file());
// No leftover .tmp file after the atomic rename.
assert!(!has_leftover_tmp(dir));
let contents = std::fs::read_to_string(&path).unwrap();
let value: serde_json::Value = serde_json::from_str(&contents).unwrap();
assert!(value.as_object().unwrap().contains_key("breadbox"));
// Rewriting (theme switch, pywal hook, etc.) must not fail or
// leave a stale temp file behind.
let path2 = write_layerrules_active().unwrap();
assert_eq!(path, path2);
assert!(!has_leftover_tmp(dir));
});
}
}

455
bread-theme/src/lib.rs
View file

@ -1,35 +1,9 @@
#[cfg(feature = "adw")]
pub mod adw;
#[cfg(feature = "gtk")]
pub mod anim;
pub mod palette;
#[cfg(feature = "gtk")]
pub mod gtk;
mod layerrules;
mod output;
pub mod palette;
pub mod shell;
pub use layerrules::{layerrules_json, layerrules_path, write_layerrules, write_layerrules_active};
pub use output::{
generate_output, load_palette_for, output_css_path, output_palette_path, palette_from_image,
palette_from_json, palettes_dir, sanitize_output, themes_dir, write_output_css,
write_output_palette, write_shared_css_from,
};
pub use palette::{load_palette, Palette};
/// Env-var locks shared by any test module that mutates process-global
/// state (`std::env::set_var`) — `cargo test` runs a crate's tests in
/// parallel by default, so every module touching the *same* env var must
/// serialize through the *same* lock or their mutations race each other's
/// reads. `bread_theme::output`'s own `XDG_ENV_LOCK` guards `XDG_RUNTIME_DIR`
/// specifically and stays where it is; `XDG_CONFIG_HOME_LOCK` here is the
/// one shared by `shell::tests` and `layerrules::tests`, which both point
/// `XDG_CONFIG_HOME` at an isolated temp dir.
#[cfg(test)]
pub(crate) mod test_support {
pub(crate) static XDG_CONFIG_HOME_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
}
/// Design tokens from BREAD_DESIGN_SYSTEM.md.
pub mod tokens {
pub const FONT_FAMILY: &str = "Varela Round, sans-serif";
@ -50,31 +24,32 @@ pub mod tokens {
pub const RADIUS_PILL: u16 = 999;
}
/// CSS `font-family` list: quote the named face, leave the generic fallback
/// unquoted. Wrapping [`tokens::FONT_FAMILY`] in one pair of quotes would
/// make a single family named "Varela Round, sans-serif" and drop sans-serif.
fn css_font_family() -> &'static str {
"'Varela Round', sans-serif"
}
/// Emit the `@define-color` block that all bread apps use, plus the shared
/// font rule.
///
/// Kept for API compatibility with older callers that only want the color
/// variables (not the full [`stylesheet`] component rules). It used to carry
/// its own hand-written `@define-color` block that predated the `accent` and
/// computed-ink (`on-*`) colors — that duplication is exactly what let it
/// drift out of sync and reintroduce the illegible-text bug (light pywal
/// colors + no computed ink meant white-on-white / black-on-black text
/// wherever a caller's own CSS referenced `@on-surface`, `@on-accent`, etc.,
/// since those names simply didn't exist in this block). It now delegates
/// to the same [`define_colors`] the full stylesheet uses, so there is only
/// one color-block implementation and it cannot drift again.
/// Emit the `@define-color` block that all bread apps use.
/// Apps append their own rules below this; user CSS goes on top.
pub fn css_vars(p: &Palette) -> String {
format!(
"{vars}* {{ font-family: {font}; font-size: {size}px; }}\n",
vars = define_colors(p),
font = css_font_family(),
"@define-color bg {bg};\n\
@define-color fg {fg};\n\
@define-color surface {c0};\n\
@define-color red {c1};\n\
@define-color green {c2};\n\
@define-color yellow {c3};\n\
@define-color blue {c4};\n\
@define-color pink {c5};\n\
@define-color teal {c6};\n\
@define-color overlay {c7};\n\
* {{ font-family: '{font}'; font-size: {size}px; }}\n",
bg = p.background,
fg = p.foreground,
c0 = p.color0,
c1 = p.color1,
c2 = p.color2,
c3 = p.color3,
c4 = p.color4,
c5 = p.color5,
c6 = p.color6,
c7 = p.color7,
font = tokens::FONT_FAMILY,
size = tokens::FONT_SIZE_BASE,
)
}
@ -84,11 +59,7 @@ pub fn luminance(hex: &str) -> f32 {
let h = hex.trim_start_matches('#');
let lin = |i: usize| -> f32 {
let c = u8::from_str_radix(h.get(i..i + 2).unwrap_or("00"), 16).unwrap_or(0) as f32 / 255.0;
if c <= 0.04045 {
c / 12.92
} else {
((c + 0.055) / 1.055).powf(2.4)
}
if c <= 0.04045 { c / 12.92 } else { ((c + 0.055) / 1.055).powf(2.4) }
};
0.2126 * lin(0) + 0.7152 * lin(2) + 0.0722 * lin(4)
}
@ -99,101 +70,44 @@ pub fn luminance(hex: &str) -> f32 {
/// text readable no matter how light or dark pywal makes a given palette slot,
/// without altering the palette colours themselves.
pub fn ink_on(hex: &str) -> &'static str {
if luminance(hex) > 0.179 {
"#11111b"
} else {
"#f5f5f5"
}
if luminance(hex) > 0.179 { "#11111b" } else { "#f5f5f5" }
}
/// Canonical (name, value) list: the single naming all bread apps share.
/// Canonical `@define-color` block: the single naming all bread apps share.
/// `surface` = color0 (darkest surface), `overlay` = color7 (muted), and
/// `accent` = color4. Apps must use these names, not raw palette slots, so the
/// whole ecosystem recolours together.
///
/// The `on-*` colours are computed ink (black/white) guaranteed to be legible on
/// the matching background — use `on-surface` for text on a `surface` panel,
/// `on-accent` on an `accent` button, etc. They exist because pywal can emit a
/// the matching background — use `@on-surface` for text on a `@surface` panel,
/// `@on-accent` on an `@accent` button, etc. They exist because pywal can emit a
/// light value in any slot, and white text on a light surface disappears.
///
/// [`define_colors`] (GTK `@define-color`) and [`css_custom_properties`] (web
/// `:root { --name: ... }`) both format this same list rather than each
/// hand-writing their own — see `css_vars_and_stylesheet_agree_on_color_block`
/// and `css_custom_properties_matches_define_colors_name_set` for the
/// regression tests this exists to satisfy.
fn color_pairs(p: &Palette) -> [(&'static str, String); 16] {
[
("bg", p.background.clone()),
("fg", p.foreground.clone()),
("surface", p.color0.clone()),
("overlay", p.color7.clone()),
("accent", p.color4.clone()),
("red", p.color1.clone()),
("green", p.color2.clone()),
("yellow", p.color3.clone()),
("blue", p.color4.clone()),
("pink", p.color5.clone()),
("teal", p.color6.clone()),
("on-bg", ink_on(&p.background).to_string()),
("on-surface", ink_on(&p.color0).to_string()),
("on-accent", ink_on(&p.color4).to_string()),
("on-red", ink_on(&p.color1).to_string()),
("on-overlay", ink_on(&p.color7).to_string()),
]
}
/// GTK `@define-color` block built from [`color_pairs`].
fn define_colors(p: &Palette) -> String {
color_pairs(p)
.iter()
.map(|(name, value)| format!("@define-color {name} {value};\n"))
.collect()
}
/// CSS custom-properties block (`:root { --bg: ...; --on-accent: ...; }`) for
/// web frontends (Tauri), using the exact same names as [`define_colors`] so
/// the GTK and web outputs cannot drift apart independently — both are
/// generated from [`color_pairs`], not two hand-written copies.
pub fn css_custom_properties(p: &Palette) -> String {
let vars: String = color_pairs(p)
.iter()
.map(|(name, value)| format!(" --{name}: {value};\n"))
.collect();
format!(":root {{\n{vars}}}\n")
}
/// CSS custom-properties for [`tokens`] (font, spacing, radii) — the web
/// counterpart to [`tokens`] being hand-read by GTK code, so a web frontend
/// isn't hand-copying the same numbers into a second source of truth.
pub fn css_tokens() -> String {
use tokens::*;
format!(
":root {{\n\
\x20\x20--font-family: {font};\n\
\x20\x20--font-size-base: {base}px;\n\
\x20\x20--font-size-secondary: {sec}px;\n\
\x20\x20--space-xs: {xs}px;\n\
\x20\x20--space-sm: {sm}px;\n\
\x20\x20--space-md: {md}px;\n\
\x20\x20--space-lg: {lg}px;\n\
\x20\x20--space-xl: {xl}px;\n\
\x20\x20--radius-primary: {r1}px;\n\
\x20\x20--radius-secondary: {r2}px;\n\
\x20\x20--radius-tertiary: {r3}px;\n\
\x20\x20--radius-pill: {pill}px;\n\
}}\n",
font = css_font_family(),
base = FONT_SIZE_BASE,
sec = FONT_SIZE_SECONDARY,
xs = SPACE_XS,
sm = SPACE_SM,
md = SPACE_MD,
lg = SPACE_LG,
xl = SPACE_XL,
r1 = RADIUS_PRIMARY,
r2 = RADIUS_SECONDARY,
r3 = RADIUS_TERTIARY,
pill = RADIUS_PILL,
"@define-color bg {bg};\n\
@define-color fg {fg};\n\
@define-color surface {c0};\n\
@define-color overlay {c7};\n\
@define-color accent {c4};\n\
@define-color red {c1};\n\
@define-color green {c2};\n\
@define-color yellow {c3};\n\
@define-color blue {c4};\n\
@define-color pink {c5};\n\
@define-color teal {c6};\n\
@define-color on-bg {on_bg};\n\
@define-color on-surface {on_surface};\n\
@define-color on-accent {on_accent};\n\
@define-color on-red {on_red};\n\
@define-color on-overlay {on_overlay};\n",
bg = p.background, fg = p.foreground,
c0 = p.color0, c1 = p.color1, c2 = p.color2, c3 = p.color3,
c4 = p.color4, c5 = p.color5, c6 = p.color6, c7 = p.color7,
on_bg = ink_on(&p.background),
on_surface = ink_on(&p.color0),
on_accent = ink_on(&p.color4),
on_red = ink_on(&p.color1),
on_overlay = ink_on(&p.color7),
)
}
@ -207,27 +121,16 @@ pub fn stylesheet(p: &Palette) -> String {
use tokens::*;
format!(
"{vars}\
* {{ font-family: {font}; font-size: {base}px; }}\n\
* {{ font-family: '{font}'; font-size: {base}px; }}\n\
/* Colour is set on containers; labels inherit it, so text on any panel,\
button, or accent is always the legible ink for that background. Bare\
`label {{ color }}` is deliberately avoided — as a type selector it\
would override a container's colour on its own child labels. */\n\
window {{ background-color: @bg; color: @on-bg; }}\n\
.dim-label, .dim {{ opacity: 0.6; font-size: {sec}px; }}\n\
/* Named `.page-title`, not the more obvious `.title` - libadwaita's\
own row/window-title widgets (AdwActionRow, AdwWindowTitle, GtkHeaderBar)\
put a bare `title` CSS class on their internal label, so a generic\
`.title` rule here would inflate every libadwaita row's title text\
to 1.4em too (this is exactly what caused the settings screen's\
~24px row-title bug). Scoping the name avoids the collision instead\
of trying to out-specificity a first-party GTK/libadwaita class. */\n\
.page-title {{ font-size: 1.4em; font-weight: bold; }}\n\
.title {{ font-size: 1.4em; font-weight: bold; }}\n\
.heading {{ font-weight: bold; opacity: 0.85; }}\n\
/* Same libadwaita-collision reasoning as `.page-title` above - a bare\
`.subtitle` also matches libadwaita's internal row-subtitle labels.\
Unused by any app today, but scoped so a future caller doesn't\
reintroduce the fight. */\n\
.page-subtitle {{ opacity: 0.7; font-size: {sec}px; }}\n\
.subtitle {{ opacity: 0.7; font-size: {sec}px; }}\n\
button {{ background-color: @surface; color: @on-surface; border: none;\
border-radius: {r1}px; padding: {sm}px {lg}px; }}\n\
button:hover {{ background-color: alpha(@on-surface, 0.14); }}\n\
@ -236,15 +139,8 @@ pub fn stylesheet(p: &Palette) -> String {
button.flat {{ background-color: transparent; color: @on-bg; }}\n\
button.suggested-action {{ background-color: @accent; color: @on-accent; }}\n\
button.suggested-action:hover {{ background-color: alpha(@accent, 0.85); }}\n\
/* Deliberately NOT @red: pywal can hand `red` any hue depending on\
the wallpaper (a blue-toned wallpaper's \"red\" slot can literally\
render blue), which would make a destructive action indistinguishable\
from a normal accent button - exactly backwards for a warning colour.\
GNOME's own destructive-action is a fixed red for the same reason;\
this is the one button style in the whole system that intentionally\
doesn't follow the palette. */\n\
button.destructive-action {{ background-color: #e01b24; color: #ffffff; }}\n\
button.destructive-action:hover {{ background-color: #c01c28; }}\n\
button.destructive-action {{ background-color: @red; color: @on-red; }}\n\
button.destructive-action:hover {{ background-color: alpha(@red, 0.85); }}\n\
entry, spinbutton {{ background-color: @surface; color: @on-surface;\
border: 1px solid @overlay; border-radius: {r2}px;\
padding: {xs}px {sm}px; caret-color: @on-surface; }}\n\
@ -255,23 +151,7 @@ pub fn stylesheet(p: &Palette) -> String {
switch {{ background-color: @overlay; border-radius: {pill}px; }}\n\
switch:checked {{ background-color: @accent; }}\n\
switch slider {{ background-color: @on-surface; border-radius: {pill}px; }}\n\
/* GtkScale (sliders) render with GTK's own default accent (a fixed\
blue, independent of the app's theme) unless styled explicitly —\
every app with a volume/brightness slider was silently showing\
that default instead of the palette's accent until this rule\
existed. */\n\
scale trough {{ background-color: @overlay; border-radius: {pill}px; min-height: 6px; }}\n\
scale trough highlight {{ background-color: @accent; border-radius: {pill}px; min-height: 6px; }}\n\
scale slider {{ background-color: @on-bg; border-radius: {pill}px; }}\n\
list, listbox {{ background-color: transparent; }}\n\
/* libadwaita's AdwPreferencesGroup wraps its rows in a GtkListBox\
carrying the `boxed-list` class, expecting a surface fill + radius\
to read as a card. The bare-type rule above (needed so plain\
GTK4 sidebars/lists stay transparent) was overriding that with\
equal specificity and no fill ever won, leaving preference groups\
as a bare bordered table instead of a card. This is scoped to the\
class only, so it doesn't touch any non-adw list. */\n\
list.boxed-list, listbox.boxed-list {{ background-color: @surface; border-radius: {r1}px; }}\n\
row {{ border-radius: {r2}px; }}\n\
row:selected, list row:selected {{ background-color: @accent; color: @on-accent; }}\n\
.sidebar {{ background-color: @surface; color: @on-surface; }}\n\
@ -290,7 +170,7 @@ pub fn stylesheet(p: &Palette) -> String {
textview, .mono {{ font-family: monospace; }}\n\
textview text {{ background-color: @surface; color: @on-surface; }}\n",
vars = define_colors(p),
font = css_font_family(),
font = FONT_FAMILY,
base = FONT_SIZE_BASE,
sec = FONT_SIZE_SECONDARY,
xs = SPACE_XS, sm = SPACE_SM, md = SPACE_MD, lg = SPACE_LG,
@ -309,34 +189,28 @@ pub fn render() -> String {
/// `bread-theme generate` CLI writes it. Per-session under `XDG_RUNTIME_DIR`,
/// falling back to the cache dir.
pub fn shared_css_path() -> std::path::PathBuf {
output::runtime_bread_dir().join("theme.css")
if let Ok(rt) = std::env::var("XDG_RUNTIME_DIR") {
if !rt.is_empty() {
return std::path::PathBuf::from(rt).join("bread").join("theme.css");
}
}
dirs::cache_dir()
.unwrap_or_else(|| std::path::PathBuf::from("/tmp"))
.join("bread")
.join("theme.css")
}
/// Write the shared stylesheet to [`shared_css_path`] (atomic rename). Returns
/// the path written. Used by the `bread-theme` CLI.
pub fn write_shared_css() -> std::io::Result<std::path::PathBuf> {
write_shared_css_from(&load_palette())
}
/// `stylesheet()` with `@name` references in rule bodies replaced by hex.
/// Longer names first (`on-surface` before `surface`, `on-bg` before `bg`)
/// so a prefix match cannot half-replace `@on-bg`.
pub fn stylesheet_resolved(p: &Palette) -> String {
resolve_color_names(&stylesheet(p), p)
}
/// Replace `@define-color` names (`@accent`, `@on-bg`, …) with hex values.
/// Used by [`stylesheet_resolved`] and by GTK `bind_window` so display-global
/// named colors cannot leak the wrong monitor's accent.
pub(crate) fn resolve_color_names(css: &str, p: &Palette) -> String {
let mut pairs: Vec<(&str, String)> = color_pairs(p).into_iter().collect();
// Longest name first, so `@on-bg` is replaced before `@bg` can match its tail.
pairs.sort_by_key(|(name, _)| std::cmp::Reverse(name.len()));
let mut out = css.to_string();
for (name, value) in pairs {
out = out.replace(&format!("@{name}"), &value);
let path = shared_css_path();
if let Some(parent) = path.parent() {
std::fs::create_dir_all(parent)?;
}
out
let tmp = path.with_extension("css.tmp");
std::fs::write(&tmp, render())?;
std::fs::rename(&tmp, &path)?;
Ok(path)
}
/// Convert a `#rrggbb` hex colour to `rgba(r, g, b, alpha)`.
@ -355,138 +229,29 @@ mod tests {
#[test]
fn css_vars_contains_all_define_color_names() {
let css = css_vars(&Palette::default());
for name in &[
"bg", "fg", "surface", "red", "green", "yellow", "blue", "pink", "teal", "overlay",
] {
assert!(
css.contains(&format!("@define-color {name} ")),
"missing @define-color {name}"
);
for name in &["bg", "fg", "surface", "red", "green", "yellow", "blue", "pink", "teal", "overlay"] {
assert!(css.contains(&format!("@define-color {name} ")), "missing @define-color {name}");
}
}
#[test]
fn css_vars_contains_font_rule() {
let css = css_vars(&Palette::default());
assert!(css.contains("font-family: 'Varela Round', sans-serif;"));
assert!(
!css.contains("font-family: 'Varela Round, sans-serif'"),
"named face and generic fallback must not be one quoted family"
);
assert!(css.contains("Varela Round"));
assert!(css.contains("14px"));
}
#[test]
fn css_vars_includes_accent_and_computed_ink_colors() {
// Regression test: css_vars() used to be a second, hand-written
// @define-color block that predated `accent` and the computed `on-*`
// ink colors. Any caller whose own CSS referenced `@on-surface` /
// `@on-accent` etc. against that older block would hit an undefined
// color name — the illegible-text bug. css_vars() must now emit
// exactly the same color set as the full stylesheet.
let css = css_vars(&Palette::default());
for name in &[
"accent",
"on-bg",
"on-surface",
"on-accent",
"on-red",
"on-overlay",
] {
assert!(
css.contains(&format!("@define-color {name} ")),
"missing @define-color {name}"
);
}
}
#[test]
fn css_vars_and_stylesheet_agree_on_color_block() {
// Both must derive their color variables from the same
// `define_colors` implementation, so they can't drift apart again.
let p = Palette::default();
let vars = css_vars(&p);
let sheet = stylesheet(&p);
for name in &[
"bg",
"fg",
"surface",
"overlay",
"accent",
"on-bg",
"on-surface",
"on-accent",
] {
let needle = format!("@define-color {name} ");
assert!(vars.contains(&needle) && sheet.contains(&needle));
}
}
#[test]
fn stylesheet_defines_canonical_colors_and_components() {
let css = stylesheet(&Palette::default());
for name in &["bg", "fg", "surface", "overlay", "accent", "red", "blue"] {
assert!(
css.contains(&format!("@define-color {name} ")),
"missing @define-color {name}"
);
assert!(css.contains(&format!("@define-color {name} ")), "missing @define-color {name}");
}
// a representative spread of the shared component selectors
for sel in &[
"button",
"entry",
"switch:checked",
".card",
".sidebar",
"scrollbar slider",
".page-title",
] {
for sel in &["button", "entry", "switch:checked", ".card", ".sidebar", "scrollbar slider", ".title"] {
assert!(css.contains(sel), "stylesheet missing selector: {sel}");
}
assert!(css.contains("font-family: 'Varela Round', sans-serif;"));
assert!(
!css.contains("font-family: 'Varela Round, sans-serif'"),
"named face and generic fallback must not be one quoted family"
);
}
#[test]
fn css_custom_properties_matches_define_colors_name_set() {
// Both must derive from the same color_pairs() list, so the web
// output can't drift from the GTK one the way css_vars/stylesheet
// used to (see css_vars_and_stylesheet_agree_on_color_block above).
let p = Palette::default();
let gtk = define_colors(&p);
let web = css_custom_properties(&p);
for (name, _) in color_pairs(&p) {
assert!(
gtk.contains(&format!("@define-color {name} ")),
"gtk missing {name}"
);
assert!(web.contains(&format!("--{name}: ")), "web missing {name}");
}
}
#[test]
fn css_custom_properties_is_valid_root_block() {
let p = Palette::default();
let css = css_custom_properties(&p);
assert!(css.starts_with(":root {\n"));
assert!(css.trim_end().ends_with('}'));
assert!(css.contains(&format!("--accent: {};", p.color4)));
}
#[test]
fn css_tokens_contains_font_and_spacing_vars() {
let css = css_tokens();
assert!(css.contains("--font-family: 'Varela Round', sans-serif;"));
assert!(
!css.contains("--font-family: 'Varela Round, sans-serif'"),
"named face and generic fallback must not be one quoted family"
);
assert!(css.contains("--font-size-base: 14px;"));
assert!(css.contains("--space-md: 12px;"));
assert!(css.contains("--radius-pill: 999px;"));
assert!(css.contains("Varela Round"));
}
#[test]
@ -513,10 +278,7 @@ mod tests {
fn stylesheet_defines_on_colors() {
let css = stylesheet(&Palette::default());
for name in &["on-bg", "on-surface", "on-accent", "on-red", "on-overlay"] {
assert!(
css.contains(&format!("@define-color {name} ")),
"missing @define-color {name}"
);
assert!(css.contains(&format!("@define-color {name} ")), "missing @define-color {name}");
}
}
@ -525,60 +287,13 @@ mod tests {
// A bare `label { color: ... }` would override container colours on child
// labels — the bug that made coloured-background text illegible.
let css = stylesheet(&Palette::default());
assert!(
!css.contains("label { color:"),
"blanket label colour rule reintroduced"
);
assert!(!css.contains("label { color:"), "blanket label colour rule reintroduced");
}
#[test]
fn shared_css_path_uses_runtime_dir() {
let _lock = crate::output::XDG_ENV_LOCK
.lock()
.unwrap_or_else(|e| e.into_inner());
std::env::set_var("XDG_RUNTIME_DIR", "/run/user/1234");
assert_eq!(
shared_css_path(),
std::path::PathBuf::from("/run/user/1234/bread/theme.css")
);
}
#[test]
fn stylesheet_resolved_inlines_color4_and_drops_named_refs_in_rules() {
let p = Palette {
color4: "#7aa2f7".into(),
..Default::default()
};
let css = stylesheet_resolved(&p);
assert!(css.contains("#7aa2f7"), "color4 must appear as hex: {css}");
// Rule bodies must not keep named colors — GTK display-global
// @define-color would otherwise leak the wrong monitor's accent.
let rules = css
.lines()
.filter(|l| !l.trim_start().starts_with("@define-color"))
.collect::<Vec<_>>()
.join("\n");
assert!(
!rules.contains("@accent"),
"leftover @accent in rules:\n{rules}"
);
assert!(
!rules.contains("@on-bg"),
"leftover @on-bg in rules:\n{rules}"
);
assert!(
!rules.contains("@on-surface"),
"leftover @on-surface in rules:\n{rules}"
);
assert!(
!rules.contains("@on-accent"),
"leftover @on-accent in rules:\n{rules}"
);
// Longer names first: @on-bg must not become @on-#...
assert!(
!rules.contains("@on-#"),
"half-replaced on-* name:\n{rules}"
);
assert_eq!(shared_css_path(), std::path::PathBuf::from("/run/user/1234/bread/theme.css"));
}
#[test]

344
bread-theme/src/output.rs
View file

@ -1,344 +0,0 @@
//! Per-output (per-monitor) palette and stylesheet paths under
//! `$XDG_RUNTIME_DIR/bread/{palettes,themes}/`.
use serde::Serialize;
use std::path::{Path, PathBuf};
use crate::palette::{from_wal_json, Palette};
use crate::{load_palette, stylesheet};
/// Session-scoped `$XDG_RUNTIME_DIR/bread`, same fallback as [`crate::shared_css_path`].
pub(crate) fn runtime_bread_dir() -> PathBuf {
// XDG spec: `XDG_RUNTIME_DIR` is only honored when set to a non-empty,
// *absolute* path; a relative value must be ignored.
if let Ok(rt) = std::env::var("XDG_RUNTIME_DIR") {
let p = PathBuf::from(&rt);
if !rt.is_empty() && p.is_absolute() {
return p.join("bread");
}
}
dirs::cache_dir()
.unwrap_or_else(|| PathBuf::from("/tmp"))
.join("bread")
}
/// Keep `[A-Za-z0-9._-]`; replace everything else with `_`.
pub fn sanitize_output(output: &str) -> String {
let s: String = output
.chars()
.map(|c| {
if c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-') {
c
} else {
'_'
}
})
.collect();
if s.is_empty() {
"_".into()
} else {
s
}
}
pub fn themes_dir() -> PathBuf {
runtime_bread_dir().join("themes")
}
pub fn palettes_dir() -> PathBuf {
runtime_bread_dir().join("palettes")
}
pub fn output_css_path(output: &str) -> PathBuf {
themes_dir().join(format!("{}.css", sanitize_output(output)))
}
pub fn output_palette_path(output: &str) -> PathBuf {
palettes_dir().join(format!("{}.json", sanitize_output(output)))
}
pub(crate) fn atomic_write(path: &Path, contents: &str) -> std::io::Result<()> {
if let Some(parent) = path.parent() {
std::fs::create_dir_all(parent)?;
}
// Pad the temp name with the pid (matching `bread_utils::atomic`) so two
// concurrent writers for the same target can't race on one shared `.tmp`
// file — e.g. two `bread-theme generate-output` runs writing the same
// `themes/<output>.css` at once.
let tmp = match path.file_name().and_then(|n| n.to_str()) {
Some(name) => path.with_file_name(format!(".{name}.tmp.{}", std::process::id())),
None => path.with_extension(format!("tmp.{}", std::process::id())),
};
std::fs::write(&tmp, contents)?;
std::fs::rename(&tmp, path)?;
Ok(())
}
/// Accents only — never persist pywal's light background/surface/overlay/fg.
#[derive(Serialize)]
struct StoredColors {
color1: String,
color2: String,
color3: String,
color4: String,
color5: String,
color6: String,
}
#[derive(Serialize)]
struct StoredPalette {
colors: StoredColors,
}
/// Parse on-disk JSON: wal `colors.json` shape, or a flat `{color1..color6}` object.
/// Always forces FIXED background/foreground/color0/color7 via [`from_wal_json`].
pub fn palette_from_json(json: &str) -> Option<Palette> {
let value: serde_json::Value = serde_json::from_str(json).ok()?;
if value
.get("colors")
.and_then(|c| c.as_object())
.is_some_and(|o| !o.is_empty())
{
return from_wal_json(json);
}
if value.get("color1").is_some()
|| value.get("color2").is_some()
|| value.get("color3").is_some()
|| value.get("color4").is_some()
|| value.get("color5").is_some()
|| value.get("color6").is_some()
{
let wrapped = serde_json::json!({ "colors": value });
return from_wal_json(&wrapped.to_string());
}
from_wal_json(json)
}
/// Load `palettes/<output>.json`; fall back to [`load_palette`].
pub fn load_palette_for(output: &str) -> Palette {
std::fs::read_to_string(output_palette_path(output))
.ok()
.and_then(|s| palette_from_json(&s))
.unwrap_or_else(load_palette)
}
pub fn write_output_palette(output: &str, palette: &Palette) -> std::io::Result<PathBuf> {
let path = output_palette_path(output);
let stored = StoredPalette {
colors: StoredColors {
color1: palette.color1.clone(),
color2: palette.color2.clone(),
color3: palette.color3.clone(),
color4: palette.color4.clone(),
color5: palette.color5.clone(),
color6: palette.color6.clone(),
},
};
let json = serde_json::to_string_pretty(&stored)
.map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
atomic_write(&path, &json)?;
Ok(path)
}
pub fn write_output_css(output: &str, palette: &Palette) -> std::io::Result<PathBuf> {
let path = output_css_path(output);
atomic_write(&path, &stylesheet(palette))?;
Ok(path)
}
/// Like [`crate::write_shared_css`] but from an explicit palette.
pub fn write_shared_css_from(palette: &Palette) -> std::io::Result<PathBuf> {
let path = crate::shared_css_path();
atomic_write(&path, &stylesheet(palette))?;
Ok(path)
}
/// Isolated `wal -i <image> -n -q` with `XDG_CACHE_HOME` set to a unique temp
/// dir so the user's `~/.cache/wal` is not clobbered.
pub fn palette_from_image(path: &Path) -> std::io::Result<Palette> {
let pid = std::process::id();
let nanos = std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
.unwrap_or_default()
.as_nanos();
let tmp = std::env::temp_dir().join(format!("bread-theme-wal-{pid}-{nanos}"));
std::fs::create_dir_all(&tmp)?;
struct Rm(PathBuf);
impl Drop for Rm {
fn drop(&mut self) {
let _ = std::fs::remove_dir_all(&self.0);
}
}
let _guard = Rm(tmp.clone());
// Classic pywal ignores XDG_CACHE_HOME and writes $HOME/.cache/wal.
// Point HOME at the temp dir so a per-output extract cannot clobber
// the session cache (or the other monitor's last `wal -i`).
let status = match std::process::Command::new("wal")
.arg("-i")
.arg(path)
.args(["-n", "-q"])
.env("HOME", &tmp)
.env("XDG_CACHE_HOME", tmp.join(".cache"))
.status()
{
Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
return Err(std::io::Error::new(
std::io::ErrorKind::NotFound,
"wal is not installed",
));
}
Err(e) => return Err(e),
Ok(s) => s,
};
if !status.success() {
return Err(std::io::Error::other(format!("wal failed with {status}")));
}
let json_path = [
tmp.join(".cache").join("wal").join("colors.json"),
tmp.join("wal").join("colors.json"),
]
.into_iter()
.find(|p| p.is_file())
.ok_or_else(|| {
std::io::Error::new(
std::io::ErrorKind::NotFound,
"wal did not write colors.json under the isolated cache",
)
})?;
let json = std::fs::read_to_string(&json_path)?;
from_wal_json(&json).ok_or_else(|| {
std::io::Error::new(
std::io::ErrorKind::InvalidData,
"wal produced unparseable colors.json",
)
})
}
/// [`palette_from_image`] + [`write_output_palette`] + [`write_output_css`].
pub fn generate_output(output: &str, image: &Path) -> std::io::Result<PathBuf> {
let palette = palette_from_image(image)?;
write_output_palette(output, &palette)?;
write_output_css(output, &palette)
}
#[cfg(test)]
pub(crate) static XDG_ENV_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
#[cfg(test)]
mod tests {
use super::*;
use crate::palette::{FIXED_BACKGROUND, FIXED_FOREGROUND, FIXED_OVERLAY, FIXED_SURFACE};
fn lock_xdg() -> std::sync::MutexGuard<'static, ()> {
XDG_ENV_LOCK.lock().unwrap_or_else(|e| e.into_inner())
}
fn with_runtime_dir<T>(f: impl FnOnce(&Path) -> T) -> T {
let _lock = lock_xdg();
let dir = std::env::temp_dir().join(format!(
"bread-theme-test-{}-{}",
std::process::id(),
std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
.unwrap_or_default()
.as_nanos()
));
std::fs::create_dir_all(&dir).unwrap();
let old = std::env::var("XDG_RUNTIME_DIR").ok();
std::env::set_var("XDG_RUNTIME_DIR", &dir);
let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| f(&dir)));
match old {
Some(v) => std::env::set_var("XDG_RUNTIME_DIR", v),
None => std::env::remove_var("XDG_RUNTIME_DIR"),
}
let _ = std::fs::remove_dir_all(&dir);
match result {
Ok(v) => v,
Err(e) => std::panic::resume_unwind(e),
}
}
#[test]
fn sanitize_output_keeps_hyprland_connectors() {
assert_eq!(sanitize_output("HDMI-A-1"), "HDMI-A-1");
assert_eq!(sanitize_output("eDP-1"), "eDP-1");
assert_eq!(sanitize_output("DP-2"), "DP-2");
}
#[test]
fn sanitize_output_replaces_unsafe_chars() {
assert_eq!(sanitize_output("HDMI A:1"), "HDMI_A_1");
assert_eq!(sanitize_output("foo/bar"), "foo_bar");
assert_eq!(sanitize_output(""), "_");
assert_eq!(sanitize_output("..ok_name-1"), "..ok_name-1");
}
#[test]
fn output_paths_use_sanitize_and_sit_under_dirs() {
let _lock = lock_xdg();
std::env::set_var("XDG_RUNTIME_DIR", "/run/user/1234");
let css = output_css_path("HDMI A:1");
let pal = output_palette_path("HDMI A:1");
assert_eq!(css, themes_dir().join("HDMI_A_1.css"));
assert_eq!(pal, palettes_dir().join("HDMI_A_1.json"));
assert!(css.starts_with(themes_dir()));
assert!(pal.starts_with(palettes_dir()));
assert_eq!(
output_css_path("eDP-1"),
PathBuf::from("/run/user/1234/bread/themes/eDP-1.css")
);
}
#[test]
fn load_palette_for_missing_file_has_fixed_bg() {
with_runtime_dir(|_| {
let p = load_palette_for("no-such-output");
assert_eq!(p.background, FIXED_BACKGROUND);
assert!(p.color4.starts_with('#'));
});
}
#[test]
fn write_output_palette_roundtrips_color4() {
with_runtime_dir(|_| {
let p = Palette {
color4: "#7aa2f7".into(),
background: "#ffffff".into(),
..Default::default()
};
write_output_palette("HDMI-A-1", &p).unwrap();
let loaded = load_palette_for("HDMI-A-1");
assert_eq!(loaded.color4, "#7aa2f7");
assert_eq!(loaded.background, FIXED_BACKGROUND);
assert_eq!(loaded.foreground, FIXED_FOREGROUND);
assert_eq!(loaded.color0, FIXED_SURFACE);
assert_eq!(loaded.color7, FIXED_OVERLAY);
});
}
#[test]
fn write_shared_css_from_writes_shared_css_path() {
with_runtime_dir(|rt| {
let path = write_shared_css_from(&Palette::default()).unwrap();
assert_eq!(path, crate::shared_css_path());
assert_eq!(path, rt.join("bread").join("theme.css"));
let css = std::fs::read_to_string(&path).unwrap();
assert!(css.contains("@define-color accent "));
});
}
#[test]
fn load_palette_for_accepts_flat_color_object() {
with_runtime_dir(|_| {
let path = output_palette_path("DP-1");
std::fs::create_dir_all(path.parent().unwrap()).unwrap();
std::fs::write(&path, r##"{"color4":"#112233","color1":"#abcdef"}"##).unwrap();
let p = load_palette_for("DP-1");
assert_eq!(p.color4, "#112233");
assert_eq!(p.color1, "#abcdef");
assert_eq!(p.background, FIXED_BACKGROUND);
});
}
}

13
bread-theme/src/palette.rs
View file

@ -9,10 +9,10 @@ use std::path::PathBuf;
/// off-hue background, and every bread GUI's panels inherit it — the app
/// stops looking like a dark BOS tool and starts looking like whatever colour
/// the wallpaper happened to be.
pub(crate) const FIXED_BACKGROUND: &str = "#0c0c0c";
pub(crate) const FIXED_FOREGROUND: &str = "#e8e8e8";
pub(crate) const FIXED_SURFACE: &str = "#1a1a1a";
pub(crate) const FIXED_OVERLAY: &str = "#d8d8d8";
const FIXED_BACKGROUND: &str = "#0c0c0c";
const FIXED_FOREGROUND: &str = "#e8e8e8";
const FIXED_SURFACE: &str = "#1a1a1a";
const FIXED_OVERLAY: &str = "#d8d8d8";
/// Accent fallback when no pywal palette exists yet (fresh install, before
/// any wallpaper has been set for real) — BOS's own bread-toned accents,
@ -84,10 +84,7 @@ pub fn load_palette() -> Palette {
pub(crate) fn from_wal_json(json: &str) -> Option<Palette> {
let wal: WalColors = serde_json::from_str(json).ok()?;
let c = |k: &str, fallback: &str| -> String {
wal.colors
.get(k)
.cloned()
.unwrap_or_else(|| fallback.into())
wal.colors.get(k).cloned().unwrap_or_else(|| fallback.into())
};
Some(Palette {
background: FIXED_BACKGROUND.into(),

113
bread-theme/src/shell/builtin.rs
View file

@ -1,113 +0,0 @@
//! The compiled-in themes (plan §11 phase 1/5: "**One** built-in manifest
//! (`liquid-motion`) describing the bar as it exists today", extended in
//! Phase 5 with `glass-workbench`, demo 02). Every file here is plain data,
//! not Rust — each `theme.toml` is the manifest text a user override would
//! otherwise supply, and each `<id>.css` is the CSS template `ShellTheme::css`
//! substitutes tokens into (see that method's doc comment for why this
//! template is a representative subset of `breadbar::theme::load_css`'s
//! full stylesheet rather than a byte-for-byte copy of it).
//!
//! All are read with `include_str!` so a broken build can't ship without
//! them, and so [`super`] never touches the filesystem for a builtin — it
//! must work identically whether or not `$XDG_CONFIG_HOME` exists at all.
pub const LIQUID_MOTION_ID: &str = "liquid-motion";
const LIQUID_MOTION_TOML: &str = include_str!(concat!(
env!("CARGO_MANIFEST_DIR"),
"/assets/shell/liquid-motion/theme.toml"
));
const LIQUID_MOTION_CSS: &str = include_str!(concat!(
env!("CARGO_MANIFEST_DIR"),
"/assets/shell/liquid-motion/liquid-motion.css"
));
pub const GLASS_WORKBENCH_ID: &str = "glass-workbench";
const GLASS_WORKBENCH_TOML: &str = include_str!(concat!(
env!("CARGO_MANIFEST_DIR"),
"/assets/shell/glass-workbench/theme.toml"
));
const GLASS_WORKBENCH_CSS: &str = include_str!(concat!(
env!("CARGO_MANIFEST_DIR"),
"/assets/shell/glass-workbench/glass-workbench.css"
));
pub const SPOTLIGHT_ID: &str = "spotlight";
const SPOTLIGHT_TOML: &str = include_str!(concat!(
env!("CARGO_MANIFEST_DIR"),
"/assets/shell/spotlight/theme.toml"
));
const SPOTLIGHT_CSS: &str = include_str!(concat!(
env!("CARGO_MANIFEST_DIR"),
"/assets/shell/spotlight/spotlight.css"
));
pub const DAYLIGHT_ID: &str = "daylight";
const DAYLIGHT_TOML: &str = include_str!(concat!(
env!("CARGO_MANIFEST_DIR"),
"/assets/shell/daylight/theme.toml"
));
const DAYLIGHT_CSS: &str = include_str!(concat!(
env!("CARGO_MANIFEST_DIR"),
"/assets/shell/daylight/daylight.css"
));
/// One compiled-in theme's identity plus its two `include_str!`ed assets.
/// `id`/`name` are also duplicated inside `toml`'s own `id =`/`name =`
/// fields — kept here too so [`all`]/[`find`] can list/look up a builtin
/// without parsing TOML first (`super::list`'s builtin fallback entry, and
/// `super::find_source`'s existence check, both run before any manifest
/// parsing happens).
pub struct BuiltinTheme {
pub id: &'static str,
pub name: &'static str,
pub toml: &'static str,
pub css: &'static str,
}
/// Every compiled-in theme, in the order [`super::list`] should present
/// them. Adding a third builtin is one entry here plus its two asset files
/// — nothing else in `mod.rs` names a specific builtin id except the always-
/// -safe fallback ([`LIQUID_MOTION_ID`], deliberately still hardcoded at
/// its one call site in `super::resolve_builtin` — see that function's doc
/// comment for why that one reference must NOT become "whichever builtin is
/// listed first").
pub const ALL: &[BuiltinTheme] = &[
BuiltinTheme {
id: LIQUID_MOTION_ID,
name: "Liquid Motion",
toml: LIQUID_MOTION_TOML,
css: LIQUID_MOTION_CSS,
},
BuiltinTheme {
id: GLASS_WORKBENCH_ID,
name: "Glass Workbench",
toml: GLASS_WORKBENCH_TOML,
css: GLASS_WORKBENCH_CSS,
},
BuiltinTheme {
id: SPOTLIGHT_ID,
name: "Spotlight",
toml: SPOTLIGHT_TOML,
css: SPOTLIGHT_CSS,
},
BuiltinTheme {
id: DAYLIGHT_ID,
name: "Daylight",
toml: DAYLIGHT_TOML,
css: DAYLIGHT_CSS,
},
];
/// Looks up a compiled-in theme by id — `None` means "not a builtin",
/// exactly like a miss in the user/system theme directories.
pub fn find(id: &str) -> Option<&'static BuiltinTheme> {
ALL.iter().find(|t| t.id == id)
}

318
bread-theme/src/shell/hotreload.rs
View file

@ -1,318 +0,0 @@
//! `watch()` — only compiled under the `gtk` feature, since
//! `gio::FileMonitor` is a gtk4 dependency and the rest of `shell` is
//! deliberately gtk-free (`bread`/`breadcrumbs` link this crate without the
//! `gtk` feature at all).
use gtk4::gio;
use gtk4::prelude::*;
use std::cell::RefCell;
use std::path::PathBuf;
use std::rc::Rc;
/// The handle [`watch`] returns. Keep it alive — dropping it disarms both
/// the config-file watch and whichever theme directory is currently armed;
/// there is nothing else to call on it.
///
/// Two independent [`gio::FileMonitor`]s live behind this, not one:
/// - a fixed watch on `~/.config/bread/` (or `$XDG_CONFIG_HOME/bread/`)
/// for `shell.toml` itself, so a change to the *active* theme id is
/// noticed at all;
/// - a swappable watch on whichever theme directory is currently active,
/// re-armed onto the new directory whenever the config watch observes
/// `active` changing (see [`watch`]'s doc comment for what this does and
/// does not cover).
pub struct ThemeWatch {
_config_monitor: Option<gio::FileMonitor>,
// `Rc<RefCell<..>>` (rather than a plain field) because the config
// watch's own callback needs to replace this monitor in place when the
// active theme changes, while this struct is what keeps it alive for
// the caller.
_theme_monitor: Rc<RefCell<Option<gio::FileMonitor>>>,
}
/// Best-effort: `monitor_directory` on `dir` can fail (e.g.
/// `fs.inotify.max_user_watches` exhausted) — that must never be fatal, per
/// this crate's "the shell must never fail to start because a theme file is
/// malformed" stance (`shell` module doc). Logs once per call site and
/// returns `None` rather than panicking; the caller simply runs without a
/// live watch for whatever this was meant to cover, same as
/// `bread_theme::gtk::watch_theme_file`'s existing `.ok()?` stance for the
/// shared-stylesheet watch.
fn monitor_dir(dir: &std::path::Path, what: &str) -> Option<gio::FileMonitor> {
let _ = std::fs::create_dir_all(dir);
match gio::File::for_path(dir).monitor_directory(gio::FileMonitorFlags::WATCH_MOVES, gio::Cancellable::NONE) {
Ok(m) => Some(m),
Err(err) => {
tracing::warn!(
"bread-theme: could not create a file monitor for {what} ({}); \
continuing without live reload for it",
err
);
None
}
}
}
fn theme_dir(id: &str) -> PathBuf {
super::user_theme_path(id)
.parent()
.expect("user_theme_path always has a parent")
.to_path_buf()
}
/// (Re-)arms `theme_monitor` on `id`'s own directory, replacing whatever was
/// armed before (dropping the old [`gio::FileMonitor`] disarms it). Returns
/// the id actually armed, so the caller can remember it for the "did the
/// active id change" comparison in [`watch`]'s config-watch callback.
fn arm_theme_watch(theme_monitor: &Rc<RefCell<Option<gio::FileMonitor>>>, id: &str, f: &Rc<dyn Fn(super::ShellTheme)>) {
let dir = theme_dir(id);
let monitor = monitor_dir(&dir, &format!("theme '{id}'s directory ({})", dir.display()));
if let Some(m) = &monitor {
let f = f.clone();
m.connect_changed(move |_, _file, _other, _event| {
f(super::load());
});
}
*theme_monitor.borrow_mut() = monitor;
}
/// Fires `f` with a freshly-[`super::load`]ed [`super::ShellTheme`] whenever
/// the active theme's own directory changes on disk, AND re-arms itself onto
/// a new theme's directory when `~/.config/bread/shell.toml`'s `active` key
/// changes — so switching themes while a host is already running (e.g.
/// bos-settings rewriting `active =`) picks up live edits to the *new*
/// theme without a restart, not just edits to whichever theme happened to
/// be active when `watch()` was first called.
///
/// Watches directories, not the files themselves, for the same reason
/// `bread_theme::gtk::watch_theme_file` does (see that function's doc
/// comment): an editor or `bread-theme` doing an atomic write-tmp-then-
/// rename replaces the inode, and a monitor on the file itself dies after
/// the first replace (inotify reports `DELETE_SELF` and never re-arms).
///
/// # What this does NOT cover
///
/// `$BREAD_SHELL_THEME` is a **single-process override for testing**, not
/// the primary theme selector (`shell.toml`'s `active` key is — see the
/// `shell` module doc's "Discovery" section) — precisely because an env var
/// set for one process is invisible to any other, it cannot coordinate two
/// already-running hosts (breadbar/breadbox) onto the same theme, and this
/// watch cannot observe it changing either: it's read once per call to
/// [`super::active_theme_id`] (i.e. once per `load()`/re-arm here), and
/// there is no filesystem event to watch for a process's own environment
/// changing out from under it. A host that wants to pick up a new
/// `$BREAD_SHELL_THEME` value has to restart, same as before this fix.
pub fn watch<F: Fn(super::ShellTheme) + 'static>(f: F) -> ThemeWatch {
let f: Rc<dyn Fn(super::ShellTheme)> = Rc::new(f);
let watched_id = Rc::new(RefCell::new(super::active_theme_id()));
let theme_monitor: Rc<RefCell<Option<gio::FileMonitor>>> = Rc::new(RefCell::new(None));
arm_theme_watch(&theme_monitor, &watched_id.borrow(), &f);
let config_dir = super::config_home().join("bread");
let config_monitor = monitor_dir(
&config_dir,
&format!("the shell config directory ({})", config_dir.display()),
);
if let Some(cm) = &config_monitor {
let theme_monitor = theme_monitor.clone();
let watched_id = watched_id.clone();
let f = f.clone();
cm.connect_changed(move |_, file, other, _event| {
// Only `shell.toml` changing can move `active` — ignore any
// other file (e.g. a theme directory that happens to also live
// under this same parent) so this doesn't re-check on every
// unrelated write in ~/.config/bread/.
let is_shell_toml = |f: &gio::File| {
f.basename().and_then(|b| b.to_str().map(str::to_string)) == Some("shell.toml".to_string())
};
if !is_shell_toml(file) && !other.is_some_and(is_shell_toml) {
return;
}
let new_id = super::active_theme_id();
if new_id == *watched_id.borrow() {
// shell.toml changed but `active` didn't (or moved to the
// same value) — the already-armed theme watch still covers
// whatever changed.
return;
}
*watched_id.borrow_mut() = new_id.clone();
arm_theme_watch(&theme_monitor, &new_id, &f);
f(super::load());
});
}
ThemeWatch {
_config_monitor: config_monitor,
_theme_monitor: theme_monitor,
}
}
#[cfg(test)]
mod tests {
use super::*;
use std::path::PathBuf;
/// Isolated `$XDG_CONFIG_HOME`, mirroring `shell::tests::isolated_xdg`
/// (can't reuse it directly — it's private to the parent module's own
/// `tests` submodule — but shares the same lock so the two test files
/// never race the same env vars).
struct EnvGuard {
_lock: std::sync::MutexGuard<'static, ()>,
dir: PathBuf,
old_xdg: Option<String>,
old_theme_var: Option<String>,
}
impl Drop for EnvGuard {
fn drop(&mut self) {
match &self.old_xdg {
Some(v) => std::env::set_var("XDG_CONFIG_HOME", v),
None => std::env::remove_var("XDG_CONFIG_HOME"),
}
match &self.old_theme_var {
Some(v) => std::env::set_var("BREAD_SHELL_THEME", v),
None => std::env::remove_var("BREAD_SHELL_THEME"),
}
let _ = std::fs::remove_dir_all(&self.dir);
}
}
fn isolated_xdg() -> EnvGuard {
let lock = crate::test_support::XDG_CONFIG_HOME_LOCK
.lock()
.unwrap_or_else(|e| e.into_inner());
let dir = std::env::temp_dir().join(format!(
"bread-theme-hotreload-test-{}-{}",
std::process::id(),
std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
.unwrap_or_default()
.as_nanos()
));
std::fs::create_dir_all(&dir).unwrap();
let old_xdg = std::env::var("XDG_CONFIG_HOME").ok();
let old_theme_var = std::env::var("BREAD_SHELL_THEME").ok();
std::env::set_var("XDG_CONFIG_HOME", &dir);
std::env::remove_var("BREAD_SHELL_THEME");
EnvGuard {
_lock: lock,
dir,
old_xdg,
old_theme_var,
}
}
fn write_theme(xdg: &EnvGuard, id: &str, toml_body: &str) {
let dir = xdg.dir.join("bread/themes").join(id);
std::fs::create_dir_all(&dir).unwrap();
std::fs::write(dir.join("theme.toml"), toml_body).unwrap();
}
fn write_shell_toml(xdg: &EnvGuard, active: &str) {
let dir = xdg.dir.join("bread");
std::fs::create_dir_all(&dir).unwrap();
std::fs::write(dir.join("shell.toml"), format!("active = \"{active}\"\n")).unwrap();
}
/// Pumps the default `glib::MainContext` (where `gio::FileMonitor`
/// dispatches its `connect_changed` signal) until `done()` returns
/// true or `timeout` elapses. Real inotify events go through the OS,
/// so this polls rather than blocking on a single iteration.
fn pump_until(timeout: std::time::Duration, mut done: impl FnMut() -> bool) {
let start = std::time::Instant::now();
let ctx = gtk4::glib::MainContext::default();
while !done() && start.elapsed() < timeout {
while ctx.iteration(false) {}
std::thread::sleep(std::time::Duration::from_millis(20));
}
}
#[test]
fn watch_arms_a_monitor_for_the_currently_active_theme() {
let xdg = isolated_xdg();
write_theme(&xdg, "liquid-motion", "id = \"liquid-motion\"\n");
let watch = watch(|_| {});
assert!(
watch._theme_monitor.borrow().is_some(),
"watch() should arm a monitor for the active theme's directory"
);
assert!(
watch._config_monitor.is_some(),
"watch() should arm a monitor for the shell config directory too"
);
}
#[test]
fn editing_the_active_theme_directory_fires_the_callback() {
let xdg = isolated_xdg();
write_theme(&xdg, "custom", "id = \"custom\"\n[tokens]\npad = 1\n");
write_shell_toml(&xdg, "custom");
let calls = Rc::new(RefCell::new(0));
let calls2 = calls.clone();
let _watch = watch(move |_| *calls2.borrow_mut() += 1);
write_theme(&xdg, "custom", "id = \"custom\"\n[tokens]\npad = 2\n");
pump_until(std::time::Duration::from_secs(3), || *calls.borrow() > 0);
assert!(
*calls.borrow() > 0,
"editing the active theme's own directory should fire the watch callback"
);
}
#[test]
fn switching_the_active_theme_re_arms_onto_the_new_directory() {
// This is the coordination gap the fix closes: before it, `watch()`
// resolved the active theme's directory once and pinned a monitor
// there forever, so a `shell.toml` `active` switch left the OLD
// theme's edits observed and the NEW theme's edits invisible until
// a restart.
let xdg = isolated_xdg();
write_theme(&xdg, "theme-a", "id = \"theme-a\"\n[tokens]\npad = 1\n");
write_theme(&xdg, "theme-b", "id = \"theme-b\"\n[tokens]\npad = 1\n");
write_shell_toml(&xdg, "theme-a");
let seen_ids = Rc::new(RefCell::new(Vec::<String>::new()));
let seen_ids2 = seen_ids.clone();
let _watch = watch(move |theme| seen_ids2.borrow_mut().push(theme.id().to_string()));
// Switch active to theme-b.
write_shell_toml(&xdg, "theme-b");
pump_until(std::time::Duration::from_secs(3), || {
seen_ids.borrow().iter().any(|id| id == "theme-b")
});
assert!(
seen_ids.borrow().iter().any(|id| id == "theme-b"),
"switching shell.toml's active id should fire the callback with the new theme: {:?}",
seen_ids.borrow()
);
seen_ids.borrow_mut().clear();
// Now edit theme-b's own directory — the re-armed watch must see it.
write_theme(&xdg, "theme-b", "id = \"theme-b\"\n[tokens]\npad = 2\n");
pump_until(std::time::Duration::from_secs(3), || !seen_ids.borrow().is_empty());
assert!(
!seen_ids.borrow().is_empty(),
"after switching, editing the NEW active theme's directory must fire the callback"
);
}
#[test]
fn monitor_dir_degrades_gracefully_instead_of_panicking() {
// A directory that cannot possibly be created (its parent is a
// plain file, not a directory) — `create_dir_all` fails, and this
// must not panic either way `monitor_directory` then behaves.
let xdg = isolated_xdg();
let blocker = xdg.dir.join("not-a-directory");
std::fs::write(&blocker, b"x").unwrap();
let impossible = blocker.join("child").join("grandchild");
// Must not panic; may or may not return a monitor depending on
// glib's own behavior for a directory that doesn't exist yet, but
// this call itself is infallible from the caller's point of view.
let _ = monitor_dir(&impossible, "test");
}
}

601
bread-theme/src/shell/manifest.rs
View file

@ -1,601 +0,0 @@
//! `theme.toml` deserialization, validation, and resolution into
//! [`crate::shell::ShellTheme`].
//!
//! Two layers on purpose: `Raw*` types mirror the TOML shape exactly (every
//! field optional, `deny_unknown_fields` everywhere so a typo'd key is a
//! hard error naming that key rather than a silent no-op) and know nothing
//! about defaults; [`RawManifest::resolve`] is the one place defaults get
//! filled and string enums get validated, producing the fully-resolved
//! types in `types.rs`.
use anyhow::{anyhow, bail, Context};
use std::collections::{BTreeMap, HashMap};
use super::types::*;
/// Module names a slot entry may reference without recompiling anything —
/// plan §2 tier 1/2 (declarative slots) plus the `widget:*` escape hatch
/// (tier 3, validated separately since its suffix is open-ended). This is
/// intentionally the set the *current* theme and the plan's own schema
/// example use; Phase 3 (breadbar's module registry) is the place a new
/// built-in module name gets added for real.
const KNOWN_MODULES: &[&str] = &[
"workspaces",
"media",
"clock",
"volume",
"wifi",
"battery",
"control",
"launcher_entry",
"launcher_results",
// `02-glass-workbench` (plan §11 phase 5): plain right-side stat chips,
// reusing the same `AppInput::StatsUpdate` data the control panel's
// sys-grid already receives — see breadbar's `bar::slots` module docs.
"cpu",
"ram",
];
pub(super) fn validate_module_name(theme_id: &str, slot: &str, module: &str) -> anyhow::Result<()> {
if module.starts_with("widget:") || KNOWN_MODULES.contains(&module) {
return Ok(());
}
bail!(
"theme '{theme_id}': slot \"{slot}\" references unknown module \"{module}\" \
(known modules: {}, or widget:<lua-module-name>)",
KNOWN_MODULES.join(", ")
);
}
pub(super) fn validate_slots(raw: &RawManifest, theme_id: &str) -> anyhow::Result<()> {
let Some(bar) = &raw.bar else { return Ok(()) };
let Some(slots) = &bar.slots else {
return Ok(());
};
for (slot_name, list) in [
("left", &slots.left),
("centre", &slots.centre),
("right", &slots.right),
("drawer", &slots.drawer),
] {
for module in list {
validate_module_name(theme_id, slot_name, module)?;
}
}
Ok(())
}
#[derive(Debug, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(super) struct RawManifest {
pub(super) name: Option<String>,
pub(super) id: Option<String>,
/// Present only so `extends` deserializes as a *known* field (otherwise
/// `deny_unknown_fields` would reject every theme that sets it). The
/// value itself is read straight off the raw `toml::Value` in
/// `mod.rs::resolve_theme` — before this struct exists — since the
/// merge has to happen ahead of (and separately from) deserialization.
#[allow(dead_code)]
pub(super) extends: Option<String>,
#[serde(default)]
pub(super) tokens: HashMap<String, toml::Value>,
pub(super) bar: Option<RawBar>,
pub(super) modules: Option<RawModules>,
pub(super) launcher: Option<RawLauncher>,
pub(super) surfaces: Option<HashMap<String, RawSurface>>,
pub(super) compositor: Option<HashMap<String, RawLayerRule>>,
/// Overlay CSS path, resolved relative to the theme file's own
/// directory, appended last by `ShellTheme::css`. Declared-but-not-yet-
/// consumed in production: `ShellTheme::css` (the only reader of this
/// field's resolved `extra_css`) is not called by breadbar or breadbox
/// today — see that method's doc comment. Setting this key is currently
/// a no-op for a real running shell (it IS exercised by this crate's own
/// tests). (Schema note: plan §4
/// shows `css = "extra.css"` textually after the `[compositor]` table
/// with no table header of its own between them, which in real TOML
/// would nest it *inside* `[compositor]`. Treated here as a top-level
/// field per §5's `css()` doc — see this crate's implementation notes.)
pub(super) css: Option<String>,
}
#[derive(Debug, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(super) struct RawBar {
pub(super) window: Option<RawWindow>,
pub(super) slots: Option<RawSlots>,
}
#[derive(Debug, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(super) struct RawWindow {
pub(super) anchors: Option<Vec<String>>,
pub(super) width: Option<RawSize>,
pub(super) height: Option<i64>,
pub(super) margin: Option<RawMargin>,
pub(super) exclusive: Option<RawExclusive>,
pub(super) keyboard: Option<String>,
pub(super) layer: Option<String>,
}
#[derive(Debug, serde::Deserialize)]
#[serde(untagged)]
pub(super) enum RawSize {
Named(String),
Px(i64),
}
#[derive(Debug, serde::Deserialize)]
#[serde(untagged)]
pub(super) enum RawExclusive {
Named(String),
Px(i64),
}
#[derive(Debug, Default, serde::Deserialize)]
#[serde(deny_unknown_fields, default)]
pub(super) struct RawMargin {
pub(super) top: i64,
pub(super) left: i64,
pub(super) right: i64,
/// See [`super::types::Margin::bottom`] — accepted and resolved, but
/// breadbar never applies it.
pub(super) bottom: i64,
}
#[derive(Debug, Default, serde::Deserialize)]
#[serde(deny_unknown_fields, default)]
pub(super) struct RawSlots {
pub(super) left: Vec<String>,
pub(super) centre: Vec<String>,
pub(super) right: Vec<String>,
pub(super) drawer: Vec<String>,
}
#[derive(Debug, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(super) struct RawModules {
pub(super) workspaces: Option<RawWorkspacesModule>,
pub(super) clock: Option<RawClockModule>,
}
#[derive(Debug, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(super) struct RawWorkspacesModule {
pub(super) style: Option<String>,
pub(super) show_empty: Option<bool>,
/// `[6, 10, 14, 18]`-shaped — see [`DotWidths`]. A length other than 4
/// is a hard error (validated in [`resolve_modules`]) rather than
/// silently truncated/padded, matching this file's "typo'd key is a
/// hard error" policy for enum-ish values.
pub(super) dot_widths: Option<Vec<i64>>,
}
#[derive(Debug, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(super) struct RawClockModule {
pub(super) style: Option<String>,
pub(super) format: Option<String>,
pub(super) show_date: Option<bool>,
pub(super) placeholder_clock: Option<bool>,
}
#[derive(Debug, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(super) struct RawLauncher {
pub(super) mode: Option<String>,
pub(super) width: Option<i64>,
pub(super) top: Option<String>,
pub(super) radius: Option<i64>,
pub(super) icon_px: Option<i64>,
pub(super) row_anim: Option<String>,
pub(super) rule: Option<String>,
pub(super) footer: Option<String>,
pub(super) sections: Option<bool>,
pub(super) modes: Option<Vec<String>>,
pub(super) search_width: Option<i64>,
pub(super) search_radius: Option<i64>,
pub(super) row_radius: Option<i64>,
pub(super) row_inset: Option<i64>,
pub(super) row_padding_v: Option<i64>,
pub(super) row_padding_h: Option<i64>,
pub(super) icon_radius: Option<i64>,
pub(super) search_font_size: Option<i64>,
pub(super) search_padding_v: Option<i64>,
pub(super) search_padding_h: Option<i64>,
pub(super) panel_alpha: Option<f64>,
pub(super) selection_alpha: Option<f64>,
}
#[derive(Debug, serde::Deserialize)]
#[serde(deny_unknown_fields)]
pub(super) struct RawSurface {
pub(super) anchor: Option<String>,
pub(super) offset: Option<RawOffset>,
pub(super) width: Option<RawSurfaceWidth>,
pub(super) layer: Option<String>,
}
#[derive(Debug, serde::Deserialize)]
#[serde(untagged)]
pub(super) enum RawOffset {
Single(f64),
Pair([f64; 2]),
}
#[derive(Debug, serde::Deserialize)]
#[serde(untagged)]
pub(super) enum RawSurfaceWidth {
Named(String),
Px(i64),
}
#[derive(Debug, Default, serde::Deserialize)]
#[serde(deny_unknown_fields, default)]
pub(super) struct RawLayerRule {
pub(super) blur: Option<bool>,
pub(super) ignore_alpha: Option<f64>,
pub(super) blur_popups: Option<bool>,
pub(super) animation: Option<String>,
pub(super) no_anim: Option<bool>,
}
fn token_value(v: &toml::Value) -> anyhow::Result<TokenValue> {
match v {
toml::Value::String(s) => Ok(TokenValue::Str(s.clone())),
toml::Value::Integer(i) => Ok(TokenValue::Int(*i)),
toml::Value::Float(f) => Ok(TokenValue::Float(*f)),
toml::Value::Boolean(b) => Ok(TokenValue::Bool(*b)),
other => Err(anyhow!("must be a string, number, or bool, got {other:?}")),
}
}
fn resolve_window(theme_id: &str, w: &RawWindow) -> anyhow::Result<WindowSpec> {
let default = WindowSpec::default();
let anchors = match &w.anchors {
Some(list) => {
for a in list {
if !matches!(a.as_str(), "top" | "bottom" | "left" | "right") {
bail!(
"theme '{theme_id}': bar.window.anchors contains unknown anchor \"{a}\" \
(expected top|bottom|left|right)"
);
}
}
list.clone()
}
None => default.anchors,
};
let width = match &w.width {
Some(RawSize::Named(s)) if s == "fill" => Width::Fill,
Some(RawSize::Named(other)) => bail!(
"theme '{theme_id}': bar.window.width = \"{other}\" is not \"fill\" \
(use a bare number for a fixed width)"
),
Some(RawSize::Px(n)) => Width::Px(*n as i32),
None => default.width,
};
let height = w.height.map(|h| h as i32).unwrap_or(default.height);
let margin = w
.margin
.as_ref()
.map(|m| Margin {
top: m.top as i32,
left: m.left as i32,
right: m.right as i32,
bottom: m.bottom as i32,
})
.unwrap_or(default.margin);
let exclusive = match &w.exclusive {
Some(RawExclusive::Named(s)) if s == "auto" => Exclusive::Auto,
Some(RawExclusive::Named(s)) if s == "none" => Exclusive::None,
Some(RawExclusive::Named(other)) => bail!(
"theme '{theme_id}': bar.window.exclusive = \"{other}\" is not \"auto\" or \"none\" \
(use a bare number for a fixed exclusive zone)"
),
Some(RawExclusive::Px(n)) => Exclusive::Px(*n as i32),
None => default.exclusive,
};
let keyboard = match w.keyboard.as_deref() {
None => default.keyboard,
Some("none") => Keyboard::None,
Some("on_demand") => Keyboard::OnDemand,
Some("exclusive") => Keyboard::Exclusive,
Some(other) => bail!(
"theme '{theme_id}': bar.window.keyboard = \"{other}\" is not none|on_demand|exclusive"
),
};
let layer = match w.layer.as_deref() {
None => default.layer,
Some("top") => "top".to_string(),
Some("overlay") => "overlay".to_string(),
Some(other) => {
bail!("theme '{theme_id}': bar.window.layer = \"{other}\" is not top|overlay")
}
};
Ok(WindowSpec {
anchors,
width,
height,
margin,
exclusive,
keyboard,
layer,
})
}
fn resolve_modules(theme_id: &str, m: Option<&RawModules>) -> anyhow::Result<Modules> {
let ws = m.and_then(|m| m.workspaces.as_ref());
let style = match ws.and_then(|w| w.style.as_deref()) {
None => WorkspaceStyle::Trail,
Some("trail") => WorkspaceStyle::Trail,
Some("pill") => WorkspaceStyle::Pill,
Some("dots") => WorkspaceStyle::Dots,
Some(other) => bail!(
"theme '{theme_id}': modules.workspaces.style = \"{other}\" is not trail|pill|dots"
),
};
let show_empty = ws.and_then(|w| w.show_empty).unwrap_or(true);
let dot_widths = match ws.and_then(|w| w.dot_widths.as_ref()) {
None => DEFAULT_DOT_WIDTHS,
Some(v) if v.len() == 4 => [v[0] as i32, v[1] as i32, v[2] as i32, v[3] as i32],
Some(v) => bail!(
"theme '{theme_id}': modules.workspaces.dot_widths has {} entries, expected 4 \
(0/1/2/3-or-more open windows)",
v.len()
),
};
let ck = m.and_then(|m| m.clock.as_ref());
let cstyle = match ck.and_then(|c| c.style.as_deref()) {
None => ClockStyle::Flip,
Some("flip") => ClockStyle::Flip,
Some("plain") => ClockStyle::Plain,
Some("none") => ClockStyle::None,
Some(other) => {
bail!("theme '{theme_id}': modules.clock.style = \"{other}\" is not flip|plain|none")
}
};
let format = ck
.and_then(|c| c.format.clone())
.unwrap_or_else(|| "%H:%M".to_string());
let show_date = ck.and_then(|c| c.show_date).unwrap_or(false);
let placeholder_clock = ck.and_then(|c| c.placeholder_clock).unwrap_or(false);
Ok(Modules {
workspaces: WorkspacesModule {
style,
show_empty,
dot_widths,
},
clock: ClockModule {
style: cstyle,
format,
show_date,
placeholder_clock,
},
})
}
fn resolve_launcher(theme_id: &str, l: Option<&RawLauncher>) -> anyhow::Result<Launcher> {
let mode = match l.and_then(|l| l.mode.as_deref()) {
None => LauncherMode::Overlay,
Some("overlay") => LauncherMode::Overlay,
Some("embedded") => LauncherMode::Embedded,
Some(other) => {
bail!("theme '{theme_id}': launcher.mode = \"{other}\" is not overlay|embedded")
}
};
let width = l.and_then(|l| l.width).unwrap_or(540) as i32;
let radius = l.and_then(|l| l.radius).unwrap_or(20) as i32;
Ok(Launcher {
mode,
width,
top: l
.and_then(|l| l.top.clone())
.unwrap_or_else(|| "16%".to_string()),
radius,
icon_px: l.and_then(|l| l.icon_px).unwrap_or(36) as i32,
row_anim: l
.and_then(|l| l.row_anim.clone())
.unwrap_or_else(|| "flip".to_string()),
rule: l
.and_then(|l| l.rule.clone())
.unwrap_or_else(|| "gradient".to_string()),
footer: l
.and_then(|l| l.footer.clone())
.unwrap_or_else(|| "count_apps".to_string()),
sections: l.and_then(|l| l.sections).unwrap_or(false),
modes: l
.and_then(|l| l.modes.clone())
.unwrap_or_else(|| vec!["apps".to_string()]),
// Default to the idle value — a theme that never sets these gets
// "no change while searching", not a hardcoded widen/shrink it
// never asked for (see the field docs on `Launcher`).
search_width: l.and_then(|l| l.search_width).map(|v| v as i32).unwrap_or(width),
search_radius: l.and_then(|l| l.search_radius).map(|v| v as i32).unwrap_or(radius),
// Defaults below reproduce breadbox's pre-redesign hardcoded CSS
// literals (`row { padding: 8px 12px; border-radius: 6px; }`,
// `listbox { padding: 4px; }`, no icon swatch, a solid — not
// alpha-blended — selection fill), so a theme that omits this whole
// block of new keys (spotlight does; its capsule doesn't read them
// at all) renders the same as before this change, not a jump to
// either built-in's specific numbers.
row_radius: l.and_then(|l| l.row_radius).unwrap_or(6) as i32,
row_inset: l.and_then(|l| l.row_inset).unwrap_or(4) as i32,
row_padding_v: l.and_then(|l| l.row_padding_v).unwrap_or(8) as i32,
row_padding_h: l.and_then(|l| l.row_padding_h).unwrap_or(12) as i32,
icon_radius: l.and_then(|l| l.icon_radius).unwrap_or(0) as i32,
search_font_size: l.and_then(|l| l.search_font_size).unwrap_or(16) as i32,
search_padding_v: l.and_then(|l| l.search_padding_v).unwrap_or(12) as i32,
search_padding_h: l.and_then(|l| l.search_padding_h).unwrap_or(16) as i32,
// 0.93 default, not breadbox's historical 0.60: a launcher panel needs
// near-opacity to stay legible over a bright wallpaper.
panel_alpha: l.and_then(|l| l.panel_alpha).unwrap_or(0.93),
selection_alpha: l.and_then(|l| l.selection_alpha).unwrap_or(0.24),
})
}
fn resolve_surfaces(
theme_id: &str,
raw: Option<&HashMap<String, RawSurface>>,
) -> anyhow::Result<BTreeMap<String, Surface>> {
let mut out = BTreeMap::new();
let Some(raw) = raw else { return Ok(out) };
for (namespace, s) in raw {
let anchor = match s.anchor.as_deref() {
Some(a @ ("top_right" | "bottom_right" | "bottom_centre" | "fill")) => a.to_string(),
Some(other) => bail!(
"theme '{theme_id}': surfaces.{namespace}.anchor = \"{other}\" is not \
top_right|bottom_right|bottom_centre|fill (the only shapes breadbar's \
satellite windows implement — see breadbar/src/surface.rs)"
),
None => bail!(
"theme '{theme_id}': surfaces.{namespace} has no anchor set \
(expected one of top_right|bottom_centre|fill)"
),
};
let offset = match &s.offset {
None => vec![],
Some(RawOffset::Single(v)) => vec![*v],
Some(RawOffset::Pair(v)) => v.to_vec(),
};
let width = match &s.width {
None => SurfaceWidth::Auto,
Some(RawSurfaceWidth::Named(n)) if n == "fill" => SurfaceWidth::Fill,
Some(RawSurfaceWidth::Named(n)) if n == "auto" => SurfaceWidth::Auto,
Some(RawSurfaceWidth::Named(other)) => bail!(
"theme '{theme_id}': surfaces.{namespace}.width = \"{other}\" is not \"fill\" or \"auto\" \
(use a bare number for a fixed width)"
),
Some(RawSurfaceWidth::Px(n)) => SurfaceWidth::Px(*n as i32),
};
let layer = match s.layer.as_deref() {
None | Some("overlay") => "overlay".to_string(),
Some("top") => "top".to_string(),
Some(other) => bail!(
"theme '{theme_id}': surfaces.{namespace}.layer = \"{other}\" is not top|overlay"
),
};
out.insert(
namespace.clone(),
Surface {
anchor,
offset,
width,
layer,
},
);
}
Ok(out)
}
fn resolve_compositor(raw: Option<&HashMap<String, RawLayerRule>>) -> BTreeMap<String, LayerRule> {
let mut out = BTreeMap::new();
let Some(raw) = raw else { return out };
for (namespace, r) in raw {
out.insert(
namespace.clone(),
LayerRule {
blur: r.blur.unwrap_or(false),
ignore_alpha: r.ignore_alpha,
blur_popups: r.blur_popups.unwrap_or(false),
animation: r.animation.clone(),
no_anim: r.no_anim.unwrap_or(false),
},
);
}
out
}
impl RawManifest {
/// Fill every default and validate every enum-ish string, producing a
/// fully-resolved [`super::ShellTheme`]. `requested_id` is the id this
/// manifest was looked up under (used as the id/name fallback when the
/// TOML omits `id`/`name`); `css_template` and `extra_css` are threaded
/// in by the discovery/extends logic in `mod.rs` since neither is a
/// plain TOML field (extra_css is *read from* a TOML field, `css`, but
/// resolving that path against the theme's own directory happens in the
/// caller, which is the only place that still has the directory handy).
pub(super) fn resolve(
&self,
requested_id: &str,
css_template: String,
extra_css: Option<String>,
) -> anyhow::Result<super::ShellTheme> {
let id = self.id.clone().unwrap_or_else(|| requested_id.to_string());
let name = self.name.clone().unwrap_or_else(|| id.clone());
let mut tokens_map = BTreeMap::new();
for (k, v) in &self.tokens {
let tv = token_value(v).with_context(|| format!("theme '{id}': tokens.{k}"))?;
tokens_map.insert(k.clone(), tv);
}
let tokens = Tokens::from_map(tokens_map);
let window = match self.bar.as_ref().and_then(|b| b.window.as_ref()) {
Some(w) => resolve_window(&id, w)?,
None => WindowSpec::default(),
};
let slots = self
.bar
.as_ref()
.and_then(|b| b.slots.as_ref())
.map(|s| Slots {
left: s.left.clone(),
centre: s.centre.clone(),
right: s.right.clone(),
drawer: s.drawer.clone(),
})
.unwrap_or_default();
let modules = resolve_modules(&id, self.modules.as_ref())?;
let launcher = resolve_launcher(&id, self.launcher.as_ref())?;
let surfaces = resolve_surfaces(&id, self.surfaces.as_ref())?;
let compositor = resolve_compositor(self.compositor.as_ref());
Ok(super::ShellTheme {
name,
id,
tokens,
window,
slots,
modules,
launcher,
surfaces,
compositor,
css_template,
extra_css,
})
}
}
/// Deep-merge `over` onto `base`: tables merge key-by-key recursively;
/// anything else (scalars, arrays — including slot lists) is a full
/// replacement. This is `extends`'s one-level merge (plan §4/§11):
/// `mod.rs` calls this exactly once per `load_named`, with the base's own
/// `extends` key already stripped by the caller so a chain can't go deeper
/// than one level.
pub(super) fn merge_values(base: toml::Value, over: toml::Value) -> toml::Value {
match (base, over) {
(toml::Value::Table(mut base_t), toml::Value::Table(over_t)) => {
for (k, v) in over_t {
let merged = match base_t.remove(&k) {
Some(existing) => merge_values(existing, v),
None => v,
};
base_t.insert(k, merged);
}
toml::Value::Table(base_t)
}
(_, over) => over,
}
}

1459
bread-theme/src/shell/mod.rs
View file

File diff suppressed because it is too large Load diff

590
bread-theme/src/shell/types.rs
View file

@ -1,590 +0,0 @@
//! Fully-resolved shell theme types — see `bread-theme/src/shell/mod.rs` for
//! the module overview and `manifest.rs` for how these are built from TOML.
//!
//! Every type here has all defaults filled in; there is no further "is this
//! set" branching once a `ShellTheme` exists. That resolution work happens
//! once, in `manifest.rs`, so consumers (breadbar, breadbox, bos-settings)
//! never have to know the manifest format at all.
use std::collections::BTreeMap;
/// Workspace strip rendering. Phase 1 ships only `Trail` (what breadbar draws
/// today); `Pill`/`Dots` exist now so 02/04 (plan §11 phases 5-6) are additive.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum WorkspaceStyle {
Trail,
Pill,
Dots,
}
/// Clock rendering. Phase 1 ships only `Flip` (today's per-digit flip clock).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ClockStyle {
Flip,
Plain,
None,
}
/// Dot pill widths (px) for 0/1/2/3-or-more open windows, `style = "dots"`
/// (theme 04/spotlight). Index 3 covers "3 or more" — the demo's own dots
/// never grow past that fourth width. Unused by `Trail`/`Pill`.
pub type DotWidths = [i32; 4];
/// The demo's own numbers (`04-spotlight.html`'s `.dots button[data-n="N"]`
/// rules) — the default a theme gets if it sets `style = "dots"` but omits
/// `dot_widths`.
pub const DEFAULT_DOT_WIDTHS: DotWidths = [6, 10, 14, 18];
/// How the launcher attaches to the shell. Phase 1 ships only `Overlay`
/// (breadbox's own window); `Embedded` is theme 04's bar-drawer launcher.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum LauncherMode {
Overlay,
Embedded,
}
/// `gtk4_layer_shell::KeyboardMode` mirror, kept independent of the `gtk`
/// feature so the manifest types stay usable without GTK linked in (bread,
/// breadcrumbs). Values map 1:1 onto `KeyboardMode::{None,Exclusive,OnDemand}`
/// (verified against gtk4-layer-shell 0.8.1's `src/auto/enums.rs`).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Keyboard {
None,
OnDemand,
Exclusive,
}
/// `bar.window.width` / a surface's `width`: `"fill"` spans the anchored
/// edges, a bare number is a fixed/centred/hug width.
#[derive(Debug, Clone, Copy, PartialEq)]
pub enum Width {
Fill,
Px(i32),
}
/// `bar.window.exclusive`: `"auto"` reserves `height + margin.top`, `"none"`
/// reserves nothing (theme 04's capsule), or a literal pixel override.
#[derive(Debug, Clone, Copy, PartialEq)]
pub enum Exclusive {
Auto,
None,
Px(i32),
}
/// A satellite surface's width: unlike the bar window, a satellite can also
/// be `Auto` — sized by its own content/CSS with no `set_default_width` call
/// at all. `breadbar-panel` is exactly this today (popover content decides
/// its width via `.control-panel-inner`/`.wifi-popover-inner` min-width, not
/// the layer-shell window).
#[derive(Debug, Clone, Copy, PartialEq)]
pub enum SurfaceWidth {
Fill,
Auto,
Px(i32),
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub struct Margin {
pub top: i32,
pub left: i32,
pub right: i32,
/// Declared-but-not-yet-consumed: parsed and carried all the way
/// through resolution, but breadbar only calls
/// `gtk4_layer_shell::LayerShell::set_margin` for
/// `Edge::{Top,Left,Right}` (`breadbar/src/main.rs`) — there is no
/// `Edge::Bottom` call anywhere in that crate. All three built-in
/// themes happen to omit `margin.bottom` (defaulting to 0, this
/// struct's own `Default`), which is exactly why the gap has stayed
/// invisible: a theme author who *does* set it would see no effect.
pub bottom: i32,
}
/// `bar.window` — plan §2: window shape is data, not a closed layout enum.
/// Island/Edge/Capsule are three *values* of this struct, not three code
/// paths.
#[derive(Debug, Clone, PartialEq)]
pub struct WindowSpec {
pub anchors: Vec<String>,
pub width: Width,
pub height: i32,
pub margin: Margin,
pub exclusive: Exclusive,
pub keyboard: Keyboard,
pub layer: String,
}
impl Default for WindowSpec {
/// Generic baseline for a theme that omits `[bar.window]` entirely —
/// deliberately the plan §4 schema example's numbers, not necessarily
/// any particular shipped theme's. `liquid-motion` sets every field
/// explicitly, so it never falls through to this.
fn default() -> Self {
WindowSpec {
anchors: vec!["top".into(), "left".into(), "right".into()],
width: Width::Fill,
height: 44,
margin: Margin {
top: 12,
left: 14,
right: 14,
bottom: 0,
},
exclusive: Exclusive::Auto,
keyboard: Keyboard::None,
layer: "top".into(),
}
}
}
/// `bar.slots` — plan §2: structure is slots, not layout code. `drawer` is
/// the only thing Capsule/theme-04 adds over Island, and it's just an
/// (empty, for now) slot list, not a code path.
#[derive(Debug, Clone, PartialEq, Eq, Default)]
pub struct Slots {
pub left: Vec<String>,
pub centre: Vec<String>,
pub right: Vec<String>,
pub drawer: Vec<String>,
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct WorkspacesModule {
pub style: WorkspaceStyle,
pub show_empty: bool,
/// `style = "dots"` only — see [`DotWidths`]. Trail/Pill ignore this.
pub dot_widths: DotWidths,
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ClockModule {
pub style: ClockStyle,
/// Consumed only by `ClockStyle::Plain` (`breadbar::bar::clock`'s
/// `formatted()`, called from `main.rs` only in the `Plain` arm) —
/// `Flip` and `None` never read it; `Flip`'s own `time()` hardcodes a
/// 24h `HH:MM` layout regardless of this field. All three built-in
/// themes set `format = "%H:%M"` (which happens to match `Flip`'s
/// hardcoded layout, masking the gap for two of the three styles); see
/// each `theme.toml`'s own note next to it for which styles actually
/// honour this.
pub format: String,
/// Consumed only by `ClockStyle::Plain`, same scoping as
/// [`Self::format`] — `date_lbl` is only ever attached under the
/// `Plain` arm's box, so this value can never be observed under
/// `Flip`/`None`. Currently harmless in practice (every built-in theme
/// that isn't `Plain` sets this `false`, so there's nothing to ignore),
/// but the same "declared, scoped to one style" caveat as `format`
/// applies.
pub show_date: bool,
/// `style = "none"` + this `true`: no module renders a clock label of
/// its own — `launcher_entry`'s placeholder text becomes the time
/// instead (theme 04/spotlight: the capsule's entry IS the clock until
/// focused, per `04-spotlight.html`'s `q.placeholder = t`). Meaningless
/// for `Flip`/`Plain`, which already show a time some other way.
pub placeholder_clock: bool,
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Modules {
pub workspaces: WorkspacesModule,
pub clock: ClockModule,
}
// No `Eq`: `selection_alpha` is an `f64`, which doesn't implement it.
#[derive(Debug, Clone, PartialEq)]
pub struct Launcher {
pub mode: LauncherMode,
pub width: i32,
pub top: String,
pub radius: i32,
pub icon_px: i32,
pub row_anim: String,
pub rule: String,
/// Selects the footer label's noun — `"count_apps"` renders
/// `"{n} applications"`, anything else (`"count_results"` included)
/// renders `"{n} results"`. Consumed by `breadbox::main`'s footer label
/// (appended below `ResultsList::scroller`, updated on every
/// `set_query` call alongside the visible-row count).
pub footer: String,
/// Consumed by breadbar's embedded capsule (`breadbar::main::run_ui`,
/// passed straight to `ResultsList::new`) for every theme, and by
/// breadbox's own overlay (`breadbox::main::run_ui`) as of the
/// liquid-motion/glass-workbench redesign — `true` groups the idle
/// (empty-query) view into "Recent"/"Apps" headers via
/// `bread_launcher::gtk::split_sections`, `false` reproduces the flat
/// list. breadbox no longer hardcodes `false` at its `ResultsList::new`
/// call site; it reads this field.
pub sections: bool,
pub modes: Vec<String>,
/// `LauncherMode::Embedded` only (theme 04/spotlight, plan §7 phase 6c):
/// the capsule's own width while a search is in progress
/// (`04-spotlight.html`: `.searching .capsule { width: 520px }` vs the
/// idle 480px). Defaults to `width` (no widen) for a theme that omits
/// it, so an `Overlay`-mode theme — which never reads this field at all
/// — and an `Embedded` theme that just doesn't want the widen both fall
/// back to "no change" rather than a hardcoded magic number.
pub search_width: i32,
/// `LauncherMode::Embedded` only: `border-radius` while searching
/// (`04-spotlight.html`: `.searching .capsule { border-radius: 20px }`
/// vs the collapsed 22px `radius`). Same default-to-`radius` fallback
/// reasoning as `search_width`.
pub search_radius: i32,
/// Result row `border-radius` (px) — `breadbox::main::build_css`'s
/// `row { border-radius: ... }`. Liquid Motion's soft 12px vs Glass
/// Workbench's dense 6px is the clearest single signal that the two
/// themes are different instruments, not one launcher recoloured.
pub row_radius: i32,
/// Result row horizontal inset (px) from the panel's edge —
/// `row { margin: 0 {row_inset}px; }`. Mirrors the demos' `.bx .r`
/// `margin: 0 Npx` rule (liquid-motion 8px, glass-workbench 6px).
pub row_inset: i32,
/// Result row vertical padding (px) — `row { padding: {row_padding_v}px
/// {row_padding_h}px; }`'s first component.
pub row_padding_v: i32,
/// Result row horizontal padding (px) — same rule's second component.
pub row_padding_h: i32,
/// Row icon `border-radius` (px) — `breadbox::main::build_css`'s
/// `image { border-radius: ...; }`, paired with `icon_px` for the
/// swatch's size. Liquid Motion's rounder 9px vs Glass Workbench's
/// tighter 5px.
pub icon_radius: i32,
/// Search entry font-size (px) — distinct from `tokens.font_size_base`
/// (which sizes the result rows): both demos give the search field a
/// larger face than its rows (liquid-motion 16 vs its rows' 14,
/// glass-workbench 14 vs its rows' 13).
pub search_font_size: i32,
/// Search entry vertical padding (px).
pub search_padding_v: i32,
/// Search entry horizontal padding (px).
pub search_padding_h: i32,
/// Opacity of the launcher PANEL itself, distinct from `tokens.bg_alpha`
/// (which governs the thin bar). A bar can be very translucent and stay
/// readable because it is 36-44px tall over a small slice of wallpaper; a
/// full launcher panel at the same alpha washes out badly over a bright
/// wallpaper and its text becomes hard to read. The approved reference
/// uses 0.95 (glass-workbench) and 0.93 (liquid-motion); breadbox
/// previously hardcoded 0.60, which is what made it look washed out.
pub panel_alpha: f64,
/// Selected/hovered row background: `alpha(@accent, selection_alpha)`.
/// Liquid Motion's softer 0.22 vs Glass Workbench's denser 0.28 — see
/// each demo's `.bx .r.sel` rule.
pub selection_alpha: f64,
}
/// A satellite surface, keyed by layer-shell namespace in `[surfaces.*]` —
/// deliberately the same keyspace as `[compositor.*]` (see module docs)
/// rather than a role name, so the two tables can be validated against each
/// other and a namespace's positioning and compositor treatment live under
/// one lookup.
#[derive(Debug, Clone, PartialEq)]
pub struct Surface {
/// One of `top_right`/`bottom_right`/`bottom_centre`/`fill` — validated
/// in `manifest.rs::resolve_surfaces` against the shapes
/// `breadbar/src/surface.rs::apply` actually implements, the same
/// "typo'd key is a hard error" policy this field's siblings
/// (`width`, `layer`) already got. Required, not defaulted: a surface
/// entry with no anchor at all is as much a hard `theme.toml` error as
/// an unrecognized one.
///
/// `bottom_right` (daylight, plan §11 phase 7) added alongside the
/// original three: every built-in theme before it anchored its bar to
/// the TOP, so `breadbar-notif`/`breadbar-panel` popping up from
/// `top_right` always sat naturally close to the bar. A bottom-anchored
/// bar has no shape in the original three that keeps those satellites
/// near it — `top_right` would put them at the opposite corner of the
/// screen from the dock they visually belong to. `offset` is
/// `[right, bottom]` for this anchor, the same two-element convention
/// `top_right`'s `[right, top]` already uses.
pub anchor: String,
pub offset: Vec<f64>,
pub width: SurfaceWidth,
pub layer: String,
}
/// One `[compositor.*]` entry — plan §9: the per-namespace layer-shell rule
/// an app ships as its default and a theme may override. Mirrors the field
/// set `hl.layer_rule` actually accepts in `scripts/ui/rules.lua` (blur,
/// ignore_alpha, blur_popups, animation, no_anim) — that Lua API isn't in
/// hyprland-api.lua's type annotations, so this field set is evidenced by
/// working usage, not documentation (plan §12 risk 3).
///
/// Also `Serialize`: this is the per-namespace shape written to
/// `~/.config/hypr/layerrules.json` by `bread_theme::layerrules` (plan §9
/// step 3-4), which `scripts/ui/rules.lua` parses back into `hl.layer_rule`
/// calls. `Option::None` fields are omitted rather than emitted as `null` —
/// the Lua JSON reader treats a missing key and a `null` value identically
/// (assigning `nil` into a table key is a no-op), so either encoding is
/// correct, but omitting keeps the file legible for hand inspection.
#[derive(Debug, Clone, PartialEq, Default, serde::Serialize)]
pub struct LayerRule {
pub blur: bool,
#[serde(skip_serializing_if = "Option::is_none")]
pub ignore_alpha: Option<f64>,
pub blur_popups: bool,
/// Passed through verbatim to `hl.layer_rule`'s `animation` field
/// (`"slide top"`, `"slide bottom"`, …) — kept as a plain string rather
/// than a closed enum since `hl.layer_rule`'s own field set is only
/// evidenced by working usage in `rules.lua`, not documented (plan §12
/// risk 3); a closed Rust enum here would need updating in lockstep
/// with Hyprland additions this crate has no way to know about.
#[serde(skip_serializing_if = "Option::is_none")]
pub animation: Option<String>,
pub no_anim: bool,
}
/// A raw TOML scalar carried through to [`Tokens`] for `{name}` substitution
/// in [`crate::shell::ShellTheme::css`]. Kept untyped (rather than forcing
/// every token into a `String`) so `css()` can format a number without a
/// theme author having to quote it, while `bg_alpha = 0.72` etc. still round
/// -trips as a real float for any future non-string consumer.
#[derive(Debug, Clone, PartialEq)]
pub enum TokenValue {
Str(String),
Int(i64),
Float(f64),
Bool(bool),
}
impl TokenValue {
/// Textual form used both for `{name}` substitution in CSS and for the
/// typed accessors' fallback formatting.
pub fn as_css(&self) -> String {
match self {
TokenValue::Str(s) => s.clone(),
TokenValue::Int(i) => i.to_string(),
TokenValue::Float(f) => {
if f.fract() == 0.0 {
format!("{f:.0}")
} else {
f.to_string()
}
}
TokenValue::Bool(b) => b.to_string(),
}
}
}
/// `[tokens]`, resolved. Deliberately an open bag (`BTreeMap`), not a fixed
/// struct: the schema (plan §4) names eleven fields, but a theme may define
/// arbitrary extra keys purely for `{name}` substitution in `extra.css`
/// (`radius_pill`, `chip_height`, `icon_px`, `spring_settle` below are all
/// exactly this — real values `theme.rs::load_css` uses today that the plan
/// text's `[tokens]` example didn't list). The named accessors below give
/// the documented fields typed access with sensible defaults; [`Tokens::get`]
/// and [`Tokens::substitute`] cover everything else.
#[derive(Debug, Clone, PartialEq, Default)]
pub struct Tokens {
pub(crate) map: BTreeMap<String, TokenValue>,
}
impl Tokens {
pub fn from_map(map: BTreeMap<String, TokenValue>) -> Self {
Tokens { map }
}
pub fn get(&self, key: &str) -> Option<&TokenValue> {
self.map.get(key)
}
pub fn keys(&self) -> impl Iterator<Item = &str> {
self.map.keys().map(|s| s.as_str())
}
fn str_or(&self, key: &str, default: &str) -> String {
match self.map.get(key) {
Some(v) => v.as_css(),
None => default.to_string(),
}
}
fn int_or(&self, key: &str, default: i64) -> i64 {
match self.map.get(key) {
Some(TokenValue::Int(i)) => *i,
Some(TokenValue::Float(f)) => *f as i64,
Some(TokenValue::Str(s)) => s.parse().unwrap_or(default),
_ => default,
}
}
fn float_or(&self, key: &str, default: f64) -> f64 {
match self.map.get(key) {
Some(TokenValue::Float(f)) => *f,
Some(TokenValue::Int(i)) => *i as f64,
Some(TokenValue::Str(s)) => s.parse().unwrap_or(default),
_ => default,
}
}
/// Same fallback shape as [`Self::str_or`]/[`Self::int_or`]/
/// [`Self::float_or`] for a `TokenValue::Bool`. First consumer: `light`
/// below (theme 05/daylight, plan §11 phase 7) — every existing token is
/// a string/number, this is the first bool-shaped one, hence the new
/// helper rather than reusing one of the three above.
fn bool_or(&self, key: &str, default: bool) -> bool {
match self.map.get(key) {
Some(TokenValue::Bool(b)) => *b,
Some(TokenValue::Str(s)) => s.parse().unwrap_or(default),
_ => default,
}
}
/// Consumed by `breadbox::main::build_css` for the launcher panel's
/// `font-family` (the `entry.search`/`row` rule) as of the
/// liquid-motion/glass-workbench redesign — combined with
/// [`Self::font_fallback`] into a CSS font stack. Still NOT consumed by
/// `breadbar` (bar/chip/clock text) or by [`crate::stylesheet`]'s
/// ecosystem-wide base rule, which still hardcodes
/// `crate::tokens::FONT_FAMILY` for every non-launcher widget — this is
/// a scoped, launcher-only wire-up, not the full "per-shell-theme font
/// everywhere" replacement a `stylesheet()` owner would need to decide
/// on separately.
pub fn font_family(&self) -> String {
self.str_or("font_family", crate::tokens::FONT_FAMILY)
}
/// See [`Self::font_family`] — same scoped (launcher-only) consumption,
/// appended after `font_family` in the CSS font stack breadbox builds.
pub fn font_fallback(&self) -> String {
self.str_or("font_fallback", "sans-serif")
}
/// Consumed by `breadbox::main::build_css` for the result rows'
/// `font-size` (the search entry uses `[launcher].search_font_size`
/// instead — both demos give the search field a larger face than its
/// rows). Still not read by `breadbar`.
pub fn font_size_base(&self) -> i64 {
self.int_or("font_size_base", crate::tokens::FONT_SIZE_BASE as i64)
}
pub fn radius_bar(&self) -> i64 {
self.int_or("radius_bar", crate::tokens::RADIUS_PRIMARY as i64)
}
pub fn radius_card(&self) -> i64 {
self.int_or("radius_card", crate::tokens::RADIUS_PRIMARY as i64)
}
pub fn radius_sm(&self) -> i64 {
self.int_or("radius_sm", crate::tokens::RADIUS_SECONDARY as i64)
}
/// Not in the plan §4 schema list, but a named local in
/// `theme.rs::load_css` (`radius_pill = "999px"`) alongside the three
/// siblings that are. See the [`Tokens`] doc comment.
pub fn radius_pill(&self) -> i64 {
self.int_or("radius_pill", crate::tokens::RADIUS_PILL as i64)
}
pub fn pad(&self) -> i64 {
self.int_or("pad", crate::tokens::SPACE_MD as i64)
}
pub fn bg_alpha(&self) -> f64 {
self.float_or("bg_alpha", 0.72)
}
/// The overshoot/bounce curve (`0.22, 1.35, 0.36, 1`) — clock flips,
/// pop-ins, the workspace caret draw.
pub fn spring(&self) -> String {
self.str_or("spring", "cubic-bezier(0.22, 1.35, 0.36, 1)")
}
/// The settle curve (`0.22, 1.2, 0.36, 1`) — hovers, workspace-btn
/// opacity/background transitions, OSD/notification slide-ins. Not in
/// the plan §4 schema (which names only `spring`), but `theme.rs` uses
/// it just as pervasively as the overshoot curve. See [`Tokens`] doc.
pub fn spring_settle(&self) -> String {
self.str_or("spring_settle", "cubic-bezier(0.22, 1.2, 0.36, 1)")
}
pub fn accent_from(&self) -> String {
self.str_or("accent_from", "accent")
}
/// Was declared-but-not-yet-consumed in production through theme 04
/// (spotlight): breadbar's hand-rolled Trail CSS hardcoded the literal
/// gradient `linear-gradient(90deg, @accent, @teal)` instead of
/// substituting `accent_from`/`accent_to`, silently correct only because
/// liquid-motion's own `accent_from`/`accent_to` happened to be
/// `"accent"`/`"teal"` — the exact two names the hardcode already spelled
/// out. Theme 05 (daylight, plan §11 phase 7) is the first Trail-style
/// theme to set a *different* pair (`accent_from = accent_to = "teal"`,
/// a flat fill, not a gradient), which is what finally forced
/// `breadbar::theme::load_css`'s Trail branch to read this method for
/// real instead of the two literal names — see that function's own note
/// next to `.workspace-trail`.
pub fn accent_to(&self) -> String {
let from = self.accent_from();
self.str_or("accent_to", &from)
}
/// A second, independent accent for chrome that shouldn't track the
/// primary `accent_from`/`accent_to` pair — daylight (plan §11 phase 7)
/// is the first theme that needs one: its media-widget equaliser bars
/// are warm amber while the workspace trail/active-fill accent is deep
/// teal, so one `accent_from` value can no longer describe both.
/// Defaults to `accent_from` itself, which reproduces every earlier
/// theme's actual rendering byte-for-byte (liquid-motion/glass-
/// workbench/spotlight all paint their equaliser with the same accent
/// as everything else, and none of them sets this key). Consumed by
/// `breadbar::theme::load_css`'s `.media-eq-bar` rule.
pub fn accent2(&self) -> String {
let from = self.accent_from();
self.str_or("accent2", &from)
}
/// Whether this theme's surfaces are painted ink-on-paper (near-opaque
/// LIGHT fills with dark ink) rather than the glass-on-dark look every
/// earlier theme assumed — daylight (plan §11 phase 7) is the first
/// theme to set this `true`. Defaults `false`, reproducing every
/// existing theme's rendering unchanged.
///
/// Exists because the palette's `bg`/`surface`/`overlay`/`fg` slots are
/// NEVER pywal-derived (`bread_theme::palette`'s `FIXED_*` constants —
/// deliberately, so a bright wallpaper can't turn the whole UI an
/// unreadable light colour by accident) — only the six accent slots
/// vary. That means there is no palette token whose value is a light
/// "paper" surface for a theme to reference by name; `@bg` is always
/// dark, `@on-bg` is always its computed-legible near-white ink.
/// `breadbar::theme::load_css` reads this flag to swap which of those
/// two *fixed, anti-correlated* tokens plays "surface fill" versus
/// "ink" for every translucent card/panel/hover-wash in the stylesheet
/// (`@on-bg` as the near-white fill, `@bg` as the near-black ink,
/// otherwise the reverse) — see that function's own `panel`/`ink`
/// locals. This works only because `@bg`/`@on-bg` are pinned opposite
/// constants by construction; it is not a general "pick any light
/// surface colour" mechanism, and this doc comment is the canonical
/// place that fact is written down (see the task report for the full
/// reasoning: the palette schema has no dedicated light-surface token).
pub fn light(&self) -> bool {
self.bool_or("light", false)
}
/// Workspace-pill / chip height. Not in the plan §4 schema, but
/// `breadbar::CHIP_HEIGHT` (32) today. See [`Tokens`] doc.
pub fn chip_height(&self) -> i64 {
self.int_or("chip_height", 32)
}
/// Not in the plan §4 schema, but `breadbar::ICON_PX` (24) today. See
/// [`Tokens`] doc.
pub fn icon_px(&self) -> i64 {
self.int_or("icon_px", 24)
}
/// Not in the plan §4 schema. `"full"` (default, liquid-motion's island)
/// draws a border on all four edges; `"bottom"` (glass-workbench's flush
/// edge-to-edge bar, plan §1) draws only the bottom hairline the demo's
/// `.bar { border-bottom: 1px solid #ffffff12 }` calls for — a floating
/// island's full border would otherwise render as a stray top/side line
/// flush against the screen edge. `"segmented"` (daylight, plan §11
/// phase 7) is a third value: `window.breadbar` itself gets NO fill,
/// border, or radius at all (fully transparent), and the bar's three
/// slot-group containers each carry their own pill surface instead (see
/// `breadbar::theme::load_css`'s `segmented`/`.bar-segment` locals) —
/// this is what lets one bar surface look like three detached floating
/// pills rather than one continuous strip. See [`Tokens`] doc; consumed
/// by `breadbar::theme::load_css`, not by [`crate::shell::ShellTheme::css`].
pub fn bar_border(&self) -> String {
self.str_or("bar_border", "full")
}
/// Replace every `{name}` occurrence in `template` with that token's
/// [`TokenValue::as_css`] form. Longest names are substituted first
/// (mirrors [`crate::resolve_color_names`]) so `{radius}` cannot
/// half-consume `{radius_bar}` if a theme happens to define both.
/// `@name` palette references are untouched — this only ever looks at
/// `{...}` tokens.
pub fn substitute(&self, template: &str) -> String {
let mut keys: Vec<&String> = self.map.keys().collect();
keys.sort_by_key(|k| std::cmp::Reverse(k.len()));
let mut out = template.to_string();
for k in keys {
let value = self.map[k].as_css();
out = out.replace(&format!("{{{k}}}"), &value);
}
out
}
}

36
bread-utils/Cargo.toml
View file

@ -1,36 +0,0 @@
[package]
name = "bread-utils"
version.workspace = true
edition.workspace = true
license.workspace = true
authors.workspace = true
description = "Shared plumbing for the bread ecosystem: Hyprland IPC, single-instance toggling, timeout-guarded subprocess execution, atomic file writes, XDG paths, and a GTK4 layer-shell popup scaffold"
repository = "https://git.breadway.dev/Breadway/bread-ecosystem"
keywords = ["hyprland", "wayland", "xdg", "gtk4"]
[dependencies]
serde = { workspace = true }
serde_json = { workspace = true }
dirs = { workspace = true }
gtk4 = { version = "0.11", features = ["v4_12"], optional = true }
gtk4-layer-shell = { version = "0.8", optional = true }
toml_edit = { version = "0.22", optional = true }
bread-shared = { git = "https://git.breadway.dev/Breadway/bread", tag = "v0.8.0", optional = true }
[features]
# Enable the layer-shell popup scaffold (breadbox, breadclip). Kept optional
# so headless/daemon consumers (breadmon, breadhelp's CLI half, breadcrumbs)
# don't have to pull in GTK4 + layer-shell just for `hypr`/`proc`/`xdg`.
gtk = ["dep:gtk4", "dep:gtk4-layer-shell"]
# Enable the non-destructive TOML doc load/save discipline (bos-settings,
# breadhelp). Optional so consumers that don't edit TOML configs (breadbox,
# breadclip, breadmon, ...) don't pull in toml_edit.
toml = ["dep:toml_edit"]
# Enable BreadClient, a persistent-connection client for breadd's IPC
# socket (emit + subscribe), for sibling bread* app daemons that want to
# integrate with the bread automation fabric. Optional so consumers that
# don't talk to breadd at all aren't forced to pull in bread-shared.
bread-client = ["dep:bread-shared"]
[dev-dependencies]
tempfile = "3"

185
bread-utils/src/atomic.rs
View file

@ -1,185 +0,0 @@
//! Atomic file writes: write to a sibling temp file, then `rename` over the
//! target so a crash, power loss, or disk-full error mid-write never leaves
//! a truncated/corrupt file behind (a same-filesystem rename is atomic).
//!
//! Two flavors, both extracted from real (and identical) duplication:
//!
//! - [`write_atomic`] — temp-then-rename, with an optional Unix `mode` set
//! up front (so secrets never exist world-readable even briefly). This is
//! `breadcrumbs/src/util.rs::write_atomic`, promoted verbatim.
//! - [`write_atomic_backed_up`] — temp-then-rename *plus* a best-effort
//! `<path>.bak` copy of whatever was there before, so a successful-but-wrong
//! write is always recoverable. This is `bos-settings/src/config/mod.rs`'s
//! `atomic_write`, which `breadhelp/src/config.rs` re-implemented
//! byte-for-byte in the same fix pass that introduced it (its own doc
//! comment says "same discipline as bos-settings/src/config/mod.rs") —
//! exactly the kind of fresh duplication this crate exists to remove.
use std::fs;
use std::io;
use std::path::{Path, PathBuf};
/// Write `contents` to `path` atomically. `mode` (Unix only) is applied to
/// the temp file *before* any data is written, so a file that must stay
/// private (secrets, tokens) is never briefly world-readable.
pub fn write_atomic(path: &Path, contents: &str, mode: Option<u32>) -> io::Result<()> {
write_atomic_bytes(path, contents.as_bytes(), mode)
}
/// Byte-oriented sibling of [`write_atomic`], for binary payloads (e.g. a
/// downloaded ONNX model file — see `bread-onnx`'s downloader).
pub fn write_atomic_bytes(path: &Path, contents: &[u8], mode: Option<u32>) -> io::Result<()> {
let dir = path.parent().unwrap_or_else(|| Path::new("."));
fs::create_dir_all(dir)?;
let tmp = tmp_path(path, dir);
let mut open = fs::OpenOptions::new();
open.write(true).create(true).truncate(true);
#[cfg(unix)]
if let Some(mode) = mode {
use std::os::unix::fs::OpenOptionsExt;
open.mode(mode);
}
#[cfg(not(unix))]
let _ = mode;
let res = (|| {
use std::io::Write;
let mut f = open.open(&tmp)?;
f.write_all(contents)?;
f.sync_all()?;
fs::rename(&tmp, path)
})();
if res.is_err() {
let _ = fs::remove_file(&tmp);
}
res
}
/// Like [`write_atomic`] (no `mode`), but first best-effort copies whatever
/// is currently at `path` to `<path>.bak`. The backup is best-effort — a
/// failure to back up (e.g. read-only source, first-ever write) does not
/// block the write itself.
pub fn write_atomic_backed_up(path: &Path, contents: &str) -> io::Result<()> {
if let Some(parent) = path.parent() {
fs::create_dir_all(parent)?;
}
if path.exists() {
let backup = backup_path(path);
let _ = fs::copy(path, &backup);
}
write_atomic(path, contents, None)
}
fn tmp_path(path: &Path, dir: &Path) -> PathBuf {
let stem = path.file_name().and_then(|s| s.to_str()).unwrap_or("bread");
dir.join(format!(".{stem}.tmp.{}", std::process::id()))
}
fn backup_path(path: &Path) -> PathBuf {
backup_path_for(path)
}
/// `<path>.bak` — shared with [`crate::tomlcfg`] so its own backup-before-
/// falling-back-to-defaults logging points at the same file this module
/// would have backed up to on a write.
pub(crate) fn backup_path_for(path: &Path) -> PathBuf {
PathBuf::from(format!("{}.bak", path.display()))
}
#[cfg(test)]
mod tests {
use super::*;
use std::io::Read;
fn tmp_dir(name: &str) -> PathBuf {
let dir = std::env::temp_dir().join(format!("bread-utils-atomic-test-{name}-{}", std::process::id()));
let _ = fs::remove_dir_all(&dir);
fs::create_dir_all(&dir).unwrap();
dir
}
#[test]
fn write_atomic_creates_file_with_contents() {
let dir = tmp_dir("basic");
let path = dir.join("config.toml");
write_atomic(&path, "hello", None).unwrap();
assert_eq!(fs::read_to_string(&path).unwrap(), "hello");
let _ = fs::remove_dir_all(&dir);
}
#[test]
fn write_atomic_leaves_no_tmp_file_behind() {
let dir = tmp_dir("no-leftover");
let path = dir.join("config.toml");
write_atomic(&path, "hello", None).unwrap();
let leftover: Vec<_> = fs::read_dir(&dir)
.unwrap()
.filter_map(|e| e.ok())
.map(|e| e.file_name().to_string_lossy().into_owned())
.filter(|n| n.contains(".tmp."))
.collect();
assert!(leftover.is_empty(), "leftover tmp files: {leftover:?}");
let _ = fs::remove_dir_all(&dir);
}
#[cfg(unix)]
#[test]
fn write_atomic_applies_mode_before_any_data_hits_disk() {
use std::os::unix::fs::PermissionsExt;
let dir = tmp_dir("mode");
let path = dir.join("secret");
write_atomic(&path, "token", Some(0o600)).unwrap();
let perms = fs::metadata(&path).unwrap().permissions();
assert_eq!(perms.mode() & 0o777, 0o600);
let _ = fs::remove_dir_all(&dir);
}
#[test]
fn write_atomic_backed_up_backs_up_previous_contents() {
let dir = tmp_dir("backup");
let path = dir.join("state.toml");
let backup = dir.join("state.toml.bak");
write_atomic_backed_up(&path, "first").unwrap();
assert_eq!(fs::read_to_string(&path).unwrap(), "first");
assert!(!backup.exists(), "no backup should exist before the first overwrite");
write_atomic_backed_up(&path, "second").unwrap();
assert_eq!(fs::read_to_string(&path).unwrap(), "second");
assert_eq!(fs::read_to_string(&backup).unwrap(), "first");
let _ = fs::remove_dir_all(&dir);
}
#[test]
fn write_atomic_backed_up_leaves_no_tmp_file_behind() {
let dir = tmp_dir("backup-no-leftover");
let path = dir.join("state.toml");
write_atomic_backed_up(&path, "first").unwrap();
write_atomic_backed_up(&path, "second").unwrap();
let leftover: Vec<_> = fs::read_dir(&dir)
.unwrap()
.filter_map(|e| e.ok())
.map(|e| e.file_name().to_string_lossy().into_owned())
.filter(|n| n.contains(".tmp."))
.collect();
assert!(leftover.is_empty(), "leftover tmp files: {leftover:?}");
let _ = fs::remove_dir_all(&dir);
}
#[test]
fn write_atomic_overwrite_never_leaves_partial_contents_visible() {
// Not a true crash-injection test (hard to do portably), but pins
// down the observable contract: after a successful call, the file
// is either fully old or fully new, never truncated.
let dir = tmp_dir("no-partial");
let path = dir.join("f");
write_atomic(&path, "aaaaaaaaaa", None).unwrap();
write_atomic(&path, "b", None).unwrap();
let mut s = String::new();
fs::File::open(&path).unwrap().read_to_string(&mut s).unwrap();
assert_eq!(s, "b");
let _ = fs::remove_dir_all(&dir);
}
}

493
bread-utils/src/bread_client.rs
View file

@ -1,493 +0,0 @@
//! A persistent-connection client for breadd's IPC socket, for sibling
//! `bread*` app daemons that run continuously.
//!
//! This is deliberately a *second* client alongside `bread-emit` (the
//! fire-and-forget CLI binary in the `bread` repo), not a replacement for
//! it: `bread-emit` skips holding a connection open at all, which is right
//! for occasional/hook-style callers (a git hook, a shell prompt) but wrong
//! for a long-running daemon like breadclipd that wants to publish an
//! event on every clipboard change and subscribe to a command stream —
//! reconnecting from scratch for every single emit would be wasteful, and
//! subscribing needs a held-open connection by nature.
//!
//! # Graceful degradation
//!
//! A sibling app must never crash or block because breadd is down,
//! restarting, or was never installed. Concretely:
//! - [`BreadClient::emit`] and [`BreadClient::command`] are best-effort,
//! fire-and-forget single-shot connections (mirroring `bread-emit`'s
//! own stance) — if breadd is unreachable, the event is silently
//! dropped, not an error the caller has to handle.
//! - [`BreadClient::health`] / [`BreadClient::api_version`] return `None`
//! when breadd is unreachable or the response is missing fields.
//! Long-running daemons SHOULD log a warning in that case and MUST NOT
//! crash. [`BreadClient::connect`] never fails just because breadd is
//! down — do not change that.
//! - [`BreadClient::subscribe`] runs its read loop on a background thread
//! that reconnects with exponential backoff on any disconnect. The
//! caller's callback simply stops being invoked while disconnected; it
//! resumes automatically once breadd comes back.
//!
//! # Namespace enforcement
//!
//! `emit` refuses locally (no network round trip) to publish an event
//! outside the app's own `bread.<app_id>.*` segment, so a misconfigured
//! caller fails fast instead of discovering the mistake from the daemon's
//! rejection. The daemon enforces the same rule server-side regardless.
//!
//! `command` is the outbound half of the same story: it publishes
//! `bread.command.<target_app>.<verb>` as an **unsourced** IPC emit
//! (`params` is `{ event, data }` only — no `source`/`kind`). The
//! daemon treats unsourced `bread.command.<known_app>.*` as legal so a
//! sibling can address another app without impersonating that app's
//! own namespace. Local refusal (eprint + return, same stance as
//! `emit`) if `target_app` or `verb` is empty, or if `verb` contains
//! `.` (a command verb is a single segment).
use std::io::{BufRead, BufReader, Write};
use std::net::Shutdown;
use std::os::unix::net::UnixStream;
use std::sync::atomic::{AtomicBool, Ordering};
use std::sync::{Arc, Mutex};
use std::thread;
use std::time::Duration;
use bread_shared::apps::validate_app_namespace;
use serde_json::{json, Value};
/// A normalized event as delivered by breadd's `events.subscribe` stream.
#[derive(Debug, Clone)]
pub struct BreadEvent {
/// Dotted event name, e.g. `bread.command.clip.clear`.
pub event: String,
/// Unix epoch milliseconds when the daemon observed the originating signal.
pub timestamp: u64,
/// Structured event data; shape depends on the event family.
pub data: Value,
}
/// A client bound to one sibling app's identity, used to `emit` within that
/// app's namespace and `subscribe` to events (typically its own
/// `bread.command.<app_id>.**` verb namespace).
///
/// Cheap to clone (just an `Arc`-free `String`); safe to share across
/// threads by cloning, or to construct fresh per call site.
#[derive(Clone)]
pub struct BreadClient {
app_id: String,
}
impl BreadClient {
/// Bind a client to `app_id` (e.g. `"clip"`). Does not connect yet —
/// there is no persistent connection to "fail" at construction time;
/// `emit` and `subscribe` each connect (or reconnect) as needed. This
/// is itself part of the graceful-degradation story: constructing a
/// `BreadClient` can never fail just because breadd isn't running yet.
pub fn connect(app_id: impl Into<String>) -> Self {
Self {
app_id: app_id.into(),
}
}
/// The app id this client is bound to.
pub fn app_id(&self) -> &str {
&self.app_id
}
/// Publish `event` (must be within `bread.<app_id>.*`) with `data`.
/// Fire-and-forget: a single short-lived connection is opened, the
/// request is written, and the reply is never read (mirroring
/// `bread-emit`). If breadd is unreachable or slow, this silently does
/// nothing — it never blocks or errors the caller.
pub fn emit(&self, event: &str, data: Value) {
if !validate_app_namespace(&self.app_id, event) {
eprintln!(
"bread-client: refusing to emit '{event}' outside the '{}' namespace",
self.app_id
);
return;
}
fire_and_forget_emit(json!({
"event": event,
"source": self.app_id,
"kind": event,
"data": data,
}));
}
/// Publish `bread.command.<target_app>.<verb>` as an unsourced IPC
/// emit so another bread app (or a Lua workflow) can act on it.
///
/// Fire-and-forget: same silent-if-down stance as [`emit`]. Locally
/// refuses (eprint + return, no socket) if `target_app` or `verb` is
/// empty, or if `verb` contains `.` — a verb is one segment
/// (`clear`, not `history.clear`).
///
/// The wire payload is `{ method: "emit", params: { event, data } }`
/// with **no** `source`/`kind`. Do not add those: a sourced emit
/// would have to claim the *target's* namespace (or ours), and the
/// daemon half of this integration is specifically making unsourced
/// `bread.command.<known_app>.*` legal.
pub fn command(&self, target_app: &str, verb: &str, data: Value) {
if target_app.is_empty() || verb.is_empty() || verb.contains('.') {
eprintln!(
"bread-client: refusing to send command to '{target_app}' with verb '{verb}' \
(target and verb must be non-empty; verb must be a single segment)"
);
return;
}
let event = format!("bread.command.{target_app}.{verb}");
fire_and_forget_emit(json!({
"event": event,
"data": data,
}));
}
/// One-shot `health` IPC request. `None` if breadd is unreachable or
/// the response is malformed / an error.
///
/// Long-running daemons SHOULD log a warning when this returns
/// `None` (or when [`api_version`] is missing) and MUST NOT crash.
pub fn health(&self) -> Option<Value> {
self.request("health", json!({}))
}
/// `api_version` string from [`health`], or `None` if health failed
/// or the field is absent. Same SHOULD-warn / MUST-NOT-crash rule
/// as [`health`].
pub fn api_version(&self) -> Option<String> {
self.health()?
.get("api_version")
.and_then(Value::as_str)
.map(str::to_owned)
}
/// Send a one-shot IPC request and return its `result`, or `None` on any
/// failure — breadd unreachable, a malformed response, or an `error`
/// field in the response. Mirrors `emit`'s graceful-degradation stance:
/// a caller checks for `None` the same way it'd handle "daemon not
/// installed," not via a `Result` that forces error-path plumbing for
/// what is, for most callers (a refresh-on-connect read), an expected
/// possibility rather than an exceptional one.
///
/// Unlike `emit`, this is not restricted to the client's own namespace —
/// `method`/`params` map directly onto breadd's IPC method table (see
/// `Documentation.md`'s "Dictionary: IPC protocol"), most of which
/// (`state.get`, `widgets.list`, ...) are cross-namespace reads by
/// design. Only first-party compiled code links `bread-utils`, so this
/// carries the same trust level as `emit`'s own request construction.
pub fn request(&self, method: &str, params: Value) -> Option<Value> {
let request = json!({
"id": "0",
"method": method,
"params": params,
});
let line = serde_json::to_string(&request).ok()?;
let mut stream = UnixStream::connect(bread_shared::resolve_socket_path()).ok()?;
stream
.set_write_timeout(Some(Duration::from_millis(200)))
.ok()?;
stream
.set_read_timeout(Some(Duration::from_millis(500)))
.ok()?;
writeln!(stream, "{line}").ok()?;
let mut response_line = String::new();
BufReader::new(stream).read_line(&mut response_line).ok()?;
if response_line.trim().is_empty() {
return None;
}
let value: Value = serde_json::from_str(&response_line).ok()?;
if value.get("error").is_some() {
return None;
}
value.get("result").cloned()
}
/// Subscribe to events matching `pattern` (glob: `*`/`**`/`?`), invoking
/// `on_event` for each one on a dedicated background thread. Typically
/// called with `"bread.command.<app_id>.**"` to receive commands
/// addressed to this app.
///
/// Returns a [`Subscription`] handle; drop or call [`Subscription::stop`]
/// to end it. The background thread reconnects with exponential backoff
/// (500ms, capped at ~32s) whenever the connection drops, so a restart
/// of breadd is transparent to the caller — `on_event` simply pauses
/// and resumes.
pub fn subscribe<F>(&self, pattern: impl Into<String>, on_event: F) -> Subscription
where
F: Fn(BreadEvent) + Send + 'static,
{
let pattern = pattern.into();
let stop = Arc::new(AtomicBool::new(false));
let current_stream: Arc<Mutex<Option<UnixStream>>> = Arc::new(Mutex::new(None));
let stop_for_thread = stop.clone();
let stream_for_thread = current_stream.clone();
let handle = thread::spawn(move || {
let mut attempt: u32 = 0;
while !stop_for_thread.load(Ordering::Relaxed) {
match run_subscription_once(&pattern, &on_event, &stream_for_thread) {
Ok(()) => attempt = 0, // clean end (stop() closed the socket)
Err(_) => attempt = attempt.saturating_add(1),
}
*stream_for_thread.lock().unwrap_or_else(|p| p.into_inner()) = None;
if stop_for_thread.load(Ordering::Relaxed) {
break;
}
let backoff_ms = 500u64.saturating_mul(2u64.saturating_pow(attempt.min(6)));
thread::sleep(Duration::from_millis(backoff_ms));
}
});
Subscription {
stop,
current_stream,
handle: Some(handle),
}
}
}
/// Fire-and-forget a single `emit` request. Shared by sourced [`BreadClient::emit`]
/// and unsourced [`BreadClient::command`] so the write/timeout path cannot
/// drift. Silent if the socket is missing, the write fails, or the body
/// cannot be serialized.
fn fire_and_forget_emit(params: Value) {
let request = json!({
"id": "0",
"method": "emit",
"params": params,
});
let Ok(line) = serde_json::to_string(&request) else {
return;
};
let Ok(mut stream) = UnixStream::connect(bread_shared::resolve_socket_path()) else {
return;
};
let _ = stream.set_write_timeout(Some(Duration::from_millis(200)));
let _ = writeln!(stream, "{line}");
}
/// Connects once, sends `events.subscribe`, and invokes `on_event` for every
/// matching line until the connection ends (cleanly or with an error).
/// Stores the live stream in `current_stream` so [`Subscription::stop`] can
/// shut it down from another thread to interrupt the blocking read promptly.
fn run_subscription_once(
pattern: &str,
on_event: &impl Fn(BreadEvent),
current_stream: &Mutex<Option<UnixStream>>,
) -> std::io::Result<()> {
let stream = UnixStream::connect(bread_shared::resolve_socket_path())?;
let read_stream = stream.try_clone()?;
*current_stream.lock().unwrap_or_else(|p| p.into_inner()) = Some(stream);
// Re-borrow to write the subscribe request through the stored copy so
// there is exactly one owner performing I/O per direction.
{
let guard = current_stream.lock().unwrap_or_else(|p| p.into_inner());
if let Some(stream) = guard.as_ref() {
let mut writer = stream;
let request = json!({
"id": "sub",
"method": "events.subscribe",
"params": { "filter": pattern }
});
let line = serde_json::to_string(&request).unwrap_or_default();
writeln!(writer, "{line}")?;
}
}
for line in BufReader::new(read_stream).lines() {
let line = line?;
if line.trim().is_empty() {
continue;
}
let Ok(value) = serde_json::from_str::<Value>(&line) else {
continue;
};
// The first line is the subscribe ack ({"result": {"subscribed": true}});
// only lines with an "event" field are actual BreadEvents.
if let Some(event_name) = value.get("event").and_then(Value::as_str) {
let timestamp = value.get("timestamp").and_then(Value::as_u64).unwrap_or(0);
let data = value.get("data").cloned().unwrap_or(Value::Null);
on_event(BreadEvent {
event: event_name.to_string(),
timestamp,
data,
});
}
}
Ok(())
}
/// Handle to a running [`BreadClient::subscribe`] background thread.
pub struct Subscription {
stop: Arc<AtomicBool>,
current_stream: Arc<Mutex<Option<UnixStream>>>,
handle: Option<thread::JoinHandle<()>>,
}
impl Subscription {
/// Stop the subscription and block until its background thread exits.
/// Shuts down the live socket (if connected) so a thread blocked in a
/// read wakes up immediately, rather than waiting for the next event or
/// a future reconnect attempt to notice the stop flag.
pub fn stop(mut self) {
self.stop.store(true, Ordering::Relaxed);
if let Some(stream) = self
.current_stream
.lock()
.unwrap_or_else(|p| p.into_inner())
.as_ref()
{
let _ = stream.shutdown(Shutdown::Both);
}
if let Some(h) = self.handle.take() {
let _ = h.join();
}
}
}
impl Drop for Subscription {
fn drop(&mut self) {
self.stop.store(true, Ordering::Relaxed);
if let Some(stream) = self
.current_stream
.lock()
.unwrap_or_else(|p| p.into_inner())
.as_ref()
{
let _ = stream.shutdown(Shutdown::Both);
}
// Best-effort on drop: don't block a caller who simply let the
// handle go out of scope. Explicit `stop()` is what actually waits.
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn connect_never_fails_even_with_no_daemon_present() {
// Constructing a client must not depend on breadd actually running —
// that's the whole point of the graceful-degradation design.
let _client = BreadClient::connect("clip");
}
#[test]
fn emit_is_a_silent_no_op_when_daemon_is_unreachable() {
// Point at a socket path that can't possibly exist by using an
// app id that still passes namespace validation; the daemon being
// absent must not panic or block this call.
let client = BreadClient::connect("clip");
client.emit("bread.clip.copied", json!({ "len": 1 }));
}
#[test]
fn emit_refuses_event_outside_own_namespace_without_connecting() {
// "pad" events are not this client's to publish — this must be
// caught locally (and cheaply) rather than round-tripped to a
// daemon that isn't even running in this test.
let client = BreadClient::connect("clip");
client.emit("bread.pad.reminder.due", json!({}));
// No assertion beyond "did not panic" — there is no daemon to
// observe the (correctly suppressed) call against in a unit test;
// the cross-process behavior is covered by breadd's own
// integration tests for the IPC-side of namespace validation.
}
/// Point `HOME` + `XDG_RUNTIME_DIR` at an empty temp dir so
/// `resolve_socket_path` cannot find a live breadd (either via
/// `~/.config/bread/breadd.toml` or `$XDG_RUNTIME_DIR/bread/breadd.sock`).
/// Serialized with the other env-mutating tests via `env_test_lock`.
fn with_unreachable_daemon<T>(f: impl FnOnce() -> T) -> T {
let _lock = crate::env_test_lock()
.lock()
.unwrap_or_else(|e| e.into_inner());
let tmp = tempfile::tempdir().unwrap();
let old_home = std::env::var("HOME").ok();
let old_xdg = std::env::var("XDG_RUNTIME_DIR").ok();
unsafe {
std::env::set_var("HOME", tmp.path());
std::env::set_var("XDG_RUNTIME_DIR", tmp.path());
}
struct Restore(Option<String>, Option<String>);
impl Drop for Restore {
fn drop(&mut self) {
unsafe {
match &self.0 {
Some(v) => std::env::set_var("HOME", v),
None => std::env::remove_var("HOME"),
}
match &self.1 {
Some(v) => std::env::set_var("XDG_RUNTIME_DIR", v),
None => std::env::remove_var("XDG_RUNTIME_DIR"),
}
}
}
}
let _restore = Restore(old_home, old_xdg);
f()
}
#[test]
fn request_returns_none_when_daemon_is_unreachable() {
with_unreachable_daemon(|| {
let client = BreadClient::connect("clip");
assert!(client.request("widgets.list", json!(null)).is_none());
});
}
#[test]
fn command_refuses_empty_target_without_connecting() {
let client = BreadClient::connect("clip");
client.command("", "clear", json!({}));
}
#[test]
fn command_refuses_empty_verb_without_connecting() {
let client = BreadClient::connect("clip");
client.command("clip", "", json!({}));
}
#[test]
fn command_refuses_dotted_verb_without_connecting() {
// A verb is a single segment — `history.clear` would produce
// `bread.command.clip.history.clear`, which is two verb segments.
let client = BreadClient::connect("clip");
client.command("clip", "history.clear", json!({}));
}
#[test]
fn command_is_a_silent_no_op_when_daemon_is_unreachable() {
let client = BreadClient::connect("clip");
client.command("clip", "clear", json!({ "n": 1 }));
}
#[test]
fn health_and_api_version_return_none_when_daemon_is_unreachable() {
with_unreachable_daemon(|| {
let client = BreadClient::connect("clip");
assert!(client.health().is_none());
assert!(client.api_version().is_none());
});
}
#[test]
fn subscription_stop_joins_the_background_thread() {
let client = BreadClient::connect("clip");
let sub = client.subscribe("bread.command.clip.**", |_event| {});
// Even with no daemon present (so the thread is spinning on
// connect-refused + backoff), stop() must return promptly rather
// than hanging.
sub.stop();
}
}

111
bread-utils/src/gtk_popup.rs
View file

@ -1,111 +0,0 @@
//! Shared GTK4 layer-shell popup scaffold: the full-screen transparent
//! overlay window setup, `ListBox` up/down visible-row navigation, and
//! click-outside-to-close gesture were duplicated near-verbatim between
//! `breadbox/src/main.rs` and `breadclip/src/main.rs`:
//!
//! - Layer-shell window setup: `breadbox/src/main.rs:357-365` /
//! `breadclip/src/main.rs:231-239` — identical `init_layer_shell` +
//! namespace + `Layer::Overlay` + `KeyboardMode::Exclusive` + anchor all
//! four edges + zero exclusive zone.
//! - Up/Down navigation loop: `breadbox/src/main.rs:515-546` /
//! `breadclip/src/main.rs:423-454` — byte-for-byte identical "find the
//! next/previous *visible* row" loop (breadclip's own comment even reads
//! `// ---- Keyboard handler (capture phase, same as breadbox) ----`).
//! - Click-outside-close: `breadbox/src/main.rs:566-581` /
//! `breadclip/src/main.rs:474-...` — identical bounds-check against a
//! content widget (breadclip: `// ---- Click outside panel → close (same
//! pattern as breadbox) ----`).
//!
//! Deliberately *not* extracted: the rest of each app's `EventControllerKey`
//! handling (Enter/Delete semantics, filter chips, search) — those differ
//! per app (`do_launch` vs `do_copy`+`Delete`-to-remove) and forcing them
//! into one callback-owning "scaffold" struct would be a leakier
//! abstraction than the ~5 free functions below.
//!
//! Requires the `gtk` feature.
use gtk4::prelude::*;
use gtk4::{ApplicationWindow, GestureClick};
use gtk4_layer_shell::{Edge, KeyboardMode, Layer, LayerShell};
/// Build the full-screen transparent overlay window every layer-shell popup
/// in this ecosystem starts from: layered above normal windows, keyboard-
/// exclusive (so Escape/Enter/arrow keys reach the popup instead of the
/// focused client behind it), anchored to all four edges with zero
/// exclusive zone (so it doesn't reserve screen space or push other layer
/// clients around).
pub fn new_overlay_window(app: &gtk4::Application, namespace: &str) -> ApplicationWindow {
let window = ApplicationWindow::builder().application(app).build();
window.init_layer_shell();
window.set_namespace(Some(namespace));
window.set_layer(Layer::Overlay);
window.set_keyboard_mode(KeyboardMode::Exclusive);
for edge in [Edge::Top, Edge::Bottom, Edge::Left, Edge::Right] {
window.set_anchor(edge, true);
}
window.set_exclusive_zone(0);
window
}
/// Select the next *visible* row after the current selection (rows can be
/// hidden by a live search filter — a plain "select index + 1" would land
/// on a filtered-out row). No-op if there is no next visible row.
pub fn select_next_visible(list: &gtk4::ListBox) {
let cur = list.selected_row().map(|r| r.index()).unwrap_or(-1);
let mut i = cur + 1;
loop {
match list.row_at_index(i) {
Some(r) if r.is_visible() => {
list.select_row(Some(&r));
break;
}
Some(_) => i += 1,
None => break,
}
}
}
/// Select the previous *visible* row before the current selection. No-op if
/// there is no previous visible row.
pub fn select_prev_visible(list: &gtk4::ListBox) {
let cur = list.selected_row().map(|r| r.index()).unwrap_or(0);
let mut i = cur - 1;
loop {
if i < 0 {
break;
}
match list.row_at_index(i) {
Some(r) if r.is_visible() => {
list.select_row(Some(&r));
break;
}
Some(_) => i -= 1,
None => break,
}
}
}
/// Attach a click gesture to `window` that calls `on_outside` whenever a
/// click lands outside `content`'s bounds (e.g. clicking the transparent
/// full-screen backdrop around a centered launcher/panel widget).
pub fn close_on_outside_click(
window: &ApplicationWindow,
content: &impl IsA<gtk4::Widget>,
on_outside: impl Fn() + 'static,
) {
let content = content.clone().upcast::<gtk4::Widget>();
let win_ref = window.clone();
let gesture = GestureClick::new();
gesture.connect_pressed(move |_, _, x, y| {
if let Some(b) = content.compute_bounds(&win_ref) {
if x < b.x() as f64
|| x > (b.x() + b.width()) as f64
|| y < b.y() as f64
|| y > (b.y() + b.height()) as f64
{
on_outside();
}
}
});
window.add_controller(gesture);
}

285
bread-utils/src/hypr.rs
View file

@ -1,285 +0,0 @@
//! Hyprland IPC client: socket1 request/response (JSON) and socket2 path
//! resolution.
//!
//! The socket-path resolution + raw request/response round trip was
//! duplicated near-verbatim in `breadbox/src/main.rs` (`get_active_workspace`,
//! lines 26-42) and `breadclip/src/position.rs` (`hyprctl_json`, lines
//! 58-71) — same `HYPRLAND_INSTANCE_SIGNATURE`/`XDG_RUNTIME_DIR` env lookup,
//! same `.socket.sock` path format, same connect/write/shutdown-write/
//! read-to-string sequence. `breadmon/src/main.rs`'s `hyprland_socket2_path`
//! duplicates just the path-resolution half for the event socket.
//!
//! `active_window`'s `fullscreen` field deserializes leniently as either a
//! JSON bool or integer: Hyprland has changed this field's type across
//! versions (older releases emit a bool, `0`/`1`; newer ones emit an
//! integer fullscreen *mode* — `0` none, `1` maximized, `2` fullscreen), and
//! a client hard-coded to one shape silently misreads the other instead of
//! erroring. `breadclip`'s own version (`as_i64().unwrap_or(0) != 0`) only
//! handles the integer shape; a bool `true` would `.as_i64()` to `None` and
//! silently read as "not fullscreen".
use serde::Deserialize;
use std::env;
use std::io::{Read, Write};
use std::os::unix::net::UnixStream;
use std::path::PathBuf;
/// Which of Hyprland's two IPC sockets: `.socket.sock` (request/response) or
/// `.socket2.sock` (event stream).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Socket {
Request,
Events,
}
/// Resolve the path to one of Hyprland's IPC sockets from
/// `HYPRLAND_INSTANCE_SIGNATURE` + `XDG_RUNTIME_DIR`. Returns `None` if
/// `HYPRLAND_INSTANCE_SIGNATURE` isn't set (Hyprland isn't running, or we're
/// not inside a Hyprland session) — `XDG_RUNTIME_DIR` falls back to
/// `/run/user/<uid>` (this process's real uid, or the historical
/// `/run/user/1000` if that can't be read) when unset.
pub fn socket_path(kind: Socket) -> Option<PathBuf> {
let sig = env::var("HYPRLAND_INSTANCE_SIGNATURE").ok()?;
// `XDG_RUNTIME_DIR` is normally `/run/user/<uid>`; when it's unset,
// reconstruct that from the process's real uid instead of assuming uid
// 1000, so the socket path is right for any account.
let rt = env::var("XDG_RUNTIME_DIR")
.ok()
.filter(|s| !s.is_empty())
.unwrap_or_else(fallback_runtime_dir);
let file = match kind {
Socket::Request => ".socket.sock",
Socket::Events => ".socket2.sock",
};
Some(PathBuf::from(format!("{rt}/hypr/{sig}/{file}")))
}
/// `XDG_RUNTIME_DIR`'s conventional `/run/user/<uid>` value, derived from
/// this process's real uid (`Uid:` line in `/proc/self/status`). Falls back
/// to the historical `/run/user/1000` if that can't be read.
fn fallback_runtime_dir() -> String {
let status = std::fs::read_to_string("/proc/self/status").unwrap_or_default();
for line in status.lines() {
if let Some(rest) = line.strip_prefix("Uid:") {
if let Some(uid) = rest.split_whitespace().next() {
return format!("/run/user/{uid}");
}
}
}
"/run/user/1000".to_string()
}
/// Send `request` (e.g. `"j/activewindow"`, `"j/monitors"`) to the socket1
/// IPC socket and return the raw response body. Blocking/synchronous — this
/// matches every current consumer (breadbox, breadclip), which call it from
/// non-async GTK app code.
///
/// Read/write timeouts are set on the socket (both original hand-rolled
/// implementations this replaces — breadbox's `get_active_workspace`,
/// breadclip's `hyprctl_json` — had none): a Hyprland instance that's
/// wedged or mid-reload could otherwise hang this call, and every current
/// caller runs it on the GTK main thread, so a hang here freezes the whole
/// UI, not just this query.
const REQUEST_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(2);
pub fn request(request: &str) -> Option<String> {
let socket = socket_path(Socket::Request)?;
let mut stream = UnixStream::connect(&socket).ok()?;
stream.set_read_timeout(Some(REQUEST_TIMEOUT)).ok()?;
stream.set_write_timeout(Some(REQUEST_TIMEOUT)).ok()?;
stream.write_all(request.as_bytes()).ok()?;
stream.shutdown(std::net::Shutdown::Write).ok()?;
let mut buf = String::new();
stream.read_to_string(&mut buf).ok()?;
Some(buf)
}
/// Like [`request`], parsed as JSON. `request` should already carry the `j/`
/// prefix Hyprland expects for JSON responses (e.g. `"j/activewindow"`).
pub fn request_json(request_str: &str) -> Option<serde_json::Value> {
serde_json::from_str(&request(request_str)?).ok()
}
/// Connect to the socket2 event stream. Callers read newline-delimited
/// `EVENT>>DATA` lines from the returned stream themselves — event framing
/// and reconnect/backoff policy are genuinely per-consumer (see
/// `breadmon`'s hotplug listener), so this only replaces the duplicated
/// path-resolution + connect boilerplate, not a full event-loop
/// abstraction.
pub fn connect_events() -> Option<UnixStream> {
let socket = socket_path(Socket::Events)?;
UnixStream::connect(&socket).ok()
}
/// Hyprland's `fullscreen` field, tolerant of either representation it has
/// shipped across versions: a plain bool, or an integer fullscreen mode
/// (`0` = none, nonzero = some fullscreen mode).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub struct FullscreenState(bool);
impl FullscreenState {
pub fn is_fullscreen(self) -> bool {
self.0
}
}
impl<'de> Deserialize<'de> for FullscreenState {
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
where
D: serde::Deserializer<'de>,
{
#[derive(Deserialize)]
#[serde(untagged)]
enum Repr {
Bool(bool),
Int(i64),
}
Ok(match Repr::deserialize(deserializer)? {
Repr::Bool(b) => FullscreenState(b),
Repr::Int(i) => FullscreenState(i != 0),
})
}
}
#[derive(Debug, Clone, Deserialize)]
pub struct ActiveWindow {
#[serde(default)]
pub class: String,
#[serde(default)]
pub fullscreen: FullscreenState,
pub at: (i32, i32),
pub size: (i32, i32),
}
impl ActiveWindow {
pub fn x(&self) -> i32 {
self.at.0
}
pub fn y(&self) -> i32 {
self.at.1
}
pub fn width(&self) -> i32 {
self.size.0
}
pub fn height(&self) -> i32 {
self.size.1
}
}
#[derive(Debug, Clone, Deserialize)]
pub struct Monitor {
pub name: String,
pub x: i32,
pub y: i32,
pub width: i32,
pub height: i32,
#[serde(default)]
pub focused: bool,
}
/// Query the currently active (focused) window. Returns `None` if the
/// window is fullscreen or no window is focused — same "centre the popup
/// instead" contract `breadclip`'s original `get_active_window` had.
pub fn active_window() -> Option<ActiveWindow> {
let win: ActiveWindow = serde_json::from_value(request_json("j/activewindow")?).ok()?;
if win.fullscreen.is_fullscreen() || win.class.is_empty() {
return None;
}
Some(win)
}
/// Query all monitors and return the focused one (or the first, if none
/// report as focused).
pub fn focused_monitor() -> Option<Monitor> {
let monitors: Vec<Monitor> = serde_json::from_value(request_json("j/monitors")?).ok()?;
monitors
.iter()
.find(|m| m.focused)
.or_else(|| monitors.first())
.cloned()
}
/// The active workspace's name (e.g. `"1"`, `"special:scratch"`).
pub fn active_workspace_name() -> Option<String> {
request_json("j/activeworkspace")?
.get("name")
.and_then(|v| v.as_str())
.map(str::to_string)
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn fullscreen_state_deserializes_from_bool() {
let s: FullscreenState = serde_json::from_str("true").unwrap();
assert!(s.is_fullscreen());
let s: FullscreenState = serde_json::from_str("false").unwrap();
assert!(!s.is_fullscreen());
}
#[test]
fn fullscreen_state_deserializes_from_int() {
let s: FullscreenState = serde_json::from_str("0").unwrap();
assert!(!s.is_fullscreen());
let s: FullscreenState = serde_json::from_str("2").unwrap();
assert!(s.is_fullscreen());
}
#[test]
fn active_window_parses_bool_fullscreen_shape() {
let json = r#"{"class":"kitty","fullscreen":true,"at":[10,20],"size":[300,400]}"#;
let win: ActiveWindow = serde_json::from_str(json).unwrap();
assert!(win.fullscreen.is_fullscreen());
assert_eq!(win.x(), 10);
assert_eq!(win.height(), 400);
}
#[test]
fn active_window_parses_int_fullscreen_shape() {
let json = r#"{"class":"kitty","fullscreen":1,"at":[0,0],"size":[100,100]}"#;
let win: ActiveWindow = serde_json::from_str(json).unwrap();
assert!(win.fullscreen.is_fullscreen());
}
#[test]
fn fallback_runtime_dir_is_user_uid_shaped() {
let dir = fallback_runtime_dir();
assert!(dir.starts_with("/run/user/"), "got {dir}");
let uid = dir.trim_start_matches("/run/user/");
assert!(
!uid.is_empty() && uid.chars().all(|c| c.is_ascii_digit()),
"fallback uid is not numeric: {uid}"
);
}
// Both env-var-dependent cases share one test function: `set_var`/
// `remove_var` are process-global, and cargo runs tests in parallel
// threads by default, so two separate #[test] fns racing on the same
// vars would be flaky.
#[test]
fn socket_path_env_var_behavior() {
let _lock = crate::env_test_lock().lock().unwrap_or_else(|e| e.into_inner());
unsafe { env::remove_var("HYPRLAND_INSTANCE_SIGNATURE") };
assert!(socket_path(Socket::Request).is_none());
unsafe {
env::set_var("HYPRLAND_INSTANCE_SIGNATURE", "test-sig");
env::set_var("XDG_RUNTIME_DIR", "/run/user/9999");
}
assert_eq!(
socket_path(Socket::Request).unwrap(),
PathBuf::from("/run/user/9999/hypr/test-sig/.socket.sock")
);
assert_eq!(
socket_path(Socket::Events).unwrap(),
PathBuf::from("/run/user/9999/hypr/test-sig/.socket2.sock")
);
unsafe {
env::remove_var("HYPRLAND_INSTANCE_SIGNATURE");
env::remove_var("XDG_RUNTIME_DIR");
}
}
}

56
bread-utils/src/lib.rs
View file

@ -1,56 +0,0 @@
//! Shared plumbing for the bread desktop-automation ecosystem.
//!
//! Extracted from genuine, verified duplication across breadbox, breadclip,
//! breadmon, breadcrumbs, bos-settings, and breadhelp during the 2026-07-16
//! ecosystem-wide utility audit. Each module's doc comment cites the
//! original file:line locations the code was extracted from.
//!
//! - [`hypr`] — Hyprland IPC: socket path resolution, socket1
//! request/response, typed `activewindow`/`monitors` queries with
//! version-tolerant `fullscreen` field parsing.
//! - [`singleton`] — correct, TOCTOU-free single-instance/PID-toggle.
//! - [`proc`] — timeout-guarded subprocess execution.
//! - [`atomic`] — atomic (temp-then-rename) file writes, with an optional
//! `.bak`-before-overwrite variant.
//! - [`xdg`] — XDG base directory helpers with a real (never literal-tilde)
//! `$HOME` fallback.
//! - [`tomlcfg`] (feature `toml`) — non-destructive TOML document
//! load/save discipline built on [`atomic`].
//! - [`gtk_popup`] (feature `gtk`) — shared layer-shell popup window setup,
//! list navigation, and click-outside-to-close.
//! - [`bread_client`] (feature `bread-client`) — a persistent-connection
//! client for breadd's IPC socket (`emit`, unsourced `command`,
//! `health`/`api_version`, `subscribe`), for sibling `bread*` app
//! daemons integrating with the bread automation fabric.
//! - [`screenshot_cli`] — shared `--screenshot` / `--output` /
//! `--width` / `--height` values, `SETTLE_DELAY` (300ms), and the
//! "both flags or neither" validator. Next-pin helper; no clap/GTK
//! dependency. Does not replace `bread-screenshots` or `bread-capture`.
pub mod atomic;
pub mod hypr;
pub mod proc;
pub mod screenshot_cli;
pub mod singleton;
pub mod xdg;
/// Serializes tests that read or mutate process-global env vars
/// (`XDG_RUNTIME_DIR`, `HYPRLAND_INSTANCE_SIGNATURE`) — `cargo test` runs
/// tests in parallel threads within one process by default, and
/// `std::env::set_var` is process-wide, so a `hypr` test temporarily
/// pointing `XDG_RUNTIME_DIR` at a nonexistent path can otherwise race a
/// concurrently-running `singleton` or `xdg` test that expects the real one.
#[cfg(test)]
pub(crate) fn env_test_lock() -> &'static std::sync::Mutex<()> {
static LOCK: std::sync::OnceLock<std::sync::Mutex<()>> = std::sync::OnceLock::new();
LOCK.get_or_init(|| std::sync::Mutex::new(()))
}
#[cfg(feature = "toml")]
pub mod tomlcfg;
#[cfg(feature = "gtk")]
pub mod gtk_popup;
#[cfg(feature = "bread-client")]
pub mod bread_client;

174
bread-utils/src/proc.rs
View file

@ -1,174 +0,0 @@
//! Timeout-guarded subprocess execution.
//!
//! Promoted verbatim from `breadcrumbs/src/util.rs` (the one implementation
//! in the ecosystem that already got this right — see the audit note in
//! `bread-utils`'s crate root). Several other repos shell out to
//! Wayland/Hyprland tools (`hyprctl`, `grim`, `wl-paste`, ...) via bare
//! `std::process::Command` with no timeout at all, so a hung child can wedge
//! the whole caller indefinitely. `run`/`run_with_stdin` below kill the
//! child and return a failed [`Output`] once `timeout` elapses instead.
use std::io::{Read, Write};
use std::process::{Command, Stdio};
use std::thread;
use std::time::{Duration, Instant};
#[derive(Debug, Clone)]
pub struct Output {
pub success: bool,
pub stdout: String,
pub stderr: String,
}
impl Output {
pub fn failed() -> Output {
Output {
success: false,
stdout: String::new(),
stderr: String::new(),
}
}
}
/// Run a command with a hard timeout. The child is killed if it overruns so
/// a hung subprocess can never wedge the caller.
pub fn run(prog: &str, args: &[&str], timeout: Duration) -> Output {
run_with_stdin(prog, args, None, timeout)
}
/// Like [`run`], but feeds `stdin` to the child's standard input. Useful for
/// handing secrets (e.g. Wi-Fi PSKs, API tokens) to a CLI without exposing
/// them in argv, where any local user could read them via `ps`.
pub fn run_with_stdin(prog: &str, args: &[&str], stdin: Option<&str>, timeout: Duration) -> Output {
let stdin_cfg = if stdin.is_some() {
Stdio::piped()
} else {
Stdio::null()
};
let mut child = match Command::new(prog)
.args(args)
// Pin the C locale so message text callers parse (hyprctl JSON keys,
// status output, ...) is stable regardless of the user's LANG.
.env("LC_ALL", "C")
.env("LANG", "C")
.stdin(stdin_cfg)
.stdout(Stdio::piped())
.stderr(Stdio::piped())
.spawn()
{
Ok(c) => c,
Err(_) => return Output::failed(),
};
let mut stdout_pipe = child.stdout.take();
let mut stderr_pipe = child.stderr.take();
let out_handle = thread::spawn(move || {
let mut buf = String::new();
if let Some(ref mut p) = stdout_pipe {
let _ = p.read_to_string(&mut buf);
}
buf
});
let err_handle = thread::spawn(move || {
let mut buf = String::new();
if let Some(ref mut p) = stderr_pipe {
let _ = p.read_to_string(&mut buf);
}
buf
});
// Feed stdin only after the reader threads are draining stdout/stderr, so
// a child that writes more than a pipe buffer before consuming stdin
// can't deadlock against our blocking write.
if let Some(data) = stdin {
if let Some(mut sink) = child.stdin.take() {
let _ = sink.write_all(data.as_bytes());
// Drop closes the pipe so the child's read sees EOF.
}
}
let start = Instant::now();
let status = loop {
match child.try_wait() {
Ok(Some(s)) => break Some(s),
Ok(None) => {
if start.elapsed() >= timeout {
let _ = child.kill();
let _ = child.wait();
break None;
}
thread::sleep(Duration::from_millis(50));
}
Err(_) => break None,
}
};
let stdout = out_handle.join().unwrap_or_default();
let stderr = err_handle.join().unwrap_or_default();
Output {
success: status.map(|s| s.success()).unwrap_or(false),
stdout,
stderr,
}
}
pub fn run_ok(prog: &str, args: &[&str], timeout: Duration) -> bool {
run(prog, args, timeout).success
}
/// Run a command and parse its stdout as JSON on success. Convenience for the
/// very common `hyprctl -j <subcommand>` / `<tool> --json` pattern.
pub fn run_json(prog: &str, args: &[&str], timeout: Duration) -> Option<serde_json::Value> {
let out = run(prog, args, timeout);
if !out.success {
return None;
}
serde_json::from_str(&out.stdout).ok()
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn run_captures_stdout() {
let out = run("printf", &["hello"], Duration::from_secs(2));
assert!(out.success);
assert_eq!(out.stdout, "hello");
}
#[test]
fn run_reports_failure_for_nonzero_exit() {
let out = run("sh", &["-c", "exit 3"], Duration::from_secs(2));
assert!(!out.success);
}
#[test]
fn run_kills_hung_child_after_timeout() {
let start = Instant::now();
let out = run("sleep", &["30"], Duration::from_millis(200));
assert!(!out.success);
assert!(start.elapsed() < Duration::from_secs(5), "child was not killed promptly");
}
#[test]
fn run_with_stdin_feeds_child_input() {
let out = run_with_stdin("cat", &[], Some("secret-data"), Duration::from_secs(2));
assert!(out.success);
assert_eq!(out.stdout, "secret-data");
}
#[test]
fn run_json_parses_stdout() {
let out = run_json("printf", &["{\"a\":1}"], Duration::from_secs(2));
assert_eq!(out.unwrap()["a"], 1);
}
#[test]
fn run_json_returns_none_on_failure() {
let out = run_json("sh", &["-c", "exit 1"], Duration::from_secs(2));
assert!(out.is_none());
}
}

156
bread-utils/src/screenshot_cli.rs
View file

@ -1,156 +0,0 @@
//! Shared `--screenshot` CLI flags and the post-`map` settle delay used by
//! bread-capture-driven GTK apps.
//!
//! The same clap block (`--screenshot`, `--output`, `--width`, `--height`)
//! plus a 300ms settle after GTK `map` is cloned across breadbar, breadbox,
//! breadclip, breadpad, breadman, breadsearch, and breadhelp. This module
//! is the next-pin target for that duplication — consumers this cycle still
//! pin an older bread-utils tag and will not see it until a future release.
//!
//! Zero extra deps: no clap, no GTK. Apps keep (or flatten) the four `#[arg]`
//! fields themselves and call [`validate_pair`] / [`SETTLE_DELAY`].
//!
//! Confirmed present in:
//! - `breadbar/src/screenshot.rs`
//! - `breadbox/breadbox/src/screenshot.rs`
//! - `breadclip/breadclip/src/screenshot.rs`
//! - `breadsearch/breadsearch/src/screenshot.rs`
//! - `breadpad/breadpad/src/screenshot.rs`
//! - `breadpad/breadman/src/screenshot.rs`
//! - `breadhelp/src/screenshot.rs`
//!
//! Do not fold `bread-screenshots` or `bread-capture`'s `TARGETS` table into
//! this module — those are the capture primitive and the orchestrator, not
//! the per-app CLI flags.
use std::path::{Path, PathBuf};
use std::time::Duration;
/// Extra settle time after GTK `map` for the first frame to actually paint
/// before grim runs. `map` fires once the surface exists, not once anything
/// has been drawn into it.
pub const SETTLE_DELAY: Duration = Duration::from_millis(300);
/// Default `--width`, matching `bread-capture --isolate-width`.
pub const DEFAULT_WIDTH: u32 = 1920;
/// Default `--height`, matching `bread-capture --isolate-height`.
pub const DEFAULT_HEIGHT: u32 = 1080;
/// The four `--screenshot` / `--output` / `--width` / `--height` values
/// parsed from an app's CLI.
///
/// `screenshot` and `output` must both be present (a capture run) or both
/// absent (a normal run) — see [`ScreenshotCli::validate`].
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ScreenshotCli {
/// Named view to capture (`--screenshot`). `None` for a normal run.
pub screenshot: Option<String>,
/// PNG path to write (`--output`). Required together with `screenshot`.
pub output: Option<PathBuf>,
/// Capture canvas width (`--width`).
pub width: u32,
/// Capture canvas height (`--height`).
pub height: u32,
}
impl Default for ScreenshotCli {
fn default() -> Self {
Self {
screenshot: None,
output: None,
width: DEFAULT_WIDTH,
height: DEFAULT_HEIGHT,
}
}
}
/// Why a screenshot-flag pair is invalid.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ScreenshotCliError {
/// `--screenshot` was given without `--output`.
ScreenshotWithoutOutput,
/// `--output` was given without `--screenshot`.
OutputWithoutScreenshot,
}
impl std::fmt::Display for ScreenshotCliError {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
match self {
Self::ScreenshotWithoutOutput => write!(f, "--screenshot requires --output"),
Self::OutputWithoutScreenshot => write!(f, "--output requires --screenshot"),
}
}
}
impl std::error::Error for ScreenshotCliError {}
/// Both `--screenshot` and `--output` must be present, or neither.
pub fn validate_pair(
screenshot: Option<&str>,
output: Option<&Path>,
) -> Result<(), ScreenshotCliError> {
match (screenshot, output) {
(Some(_), Some(_)) | (None, None) => Ok(()),
(Some(_), None) => Err(ScreenshotCliError::ScreenshotWithoutOutput),
(None, Some(_)) => Err(ScreenshotCliError::OutputWithoutScreenshot),
}
}
impl ScreenshotCli {
/// Both `screenshot` and `output` present, or neither.
pub fn validate(&self) -> Result<(), ScreenshotCliError> {
validate_pair(self.screenshot.as_deref(), self.output.as_deref())
}
/// `true` when this is a capture run (both flags present).
pub fn is_screenshot_run(&self) -> bool {
self.screenshot.is_some() && self.output.is_some()
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn settle_delay_is_300ms() {
assert_eq!(SETTLE_DELAY, Duration::from_millis(300));
}
#[test]
fn neither_flag_is_ok() {
assert!(validate_pair(None, None).is_ok());
assert!(ScreenshotCli::default().validate().is_ok());
assert!(!ScreenshotCli::default().is_screenshot_run());
}
#[test]
fn both_flags_are_ok() {
let cli = ScreenshotCli {
screenshot: Some("search".into()),
output: Some(PathBuf::from("/tmp/out.png")),
width: DEFAULT_WIDTH,
height: DEFAULT_HEIGHT,
};
assert!(cli.validate().is_ok());
assert!(cli.is_screenshot_run());
}
#[test]
fn screenshot_without_output_is_an_error() {
assert_eq!(
validate_pair(Some("search"), None),
Err(ScreenshotCliError::ScreenshotWithoutOutput)
);
}
#[test]
fn output_without_screenshot_is_an_error() {
let path = PathBuf::from("/tmp/out.png");
assert_eq!(
validate_pair(None, Some(path.as_path())),
Err(ScreenshotCliError::OutputWithoutScreenshot)
);
}
}

212
bread-utils/src/singleton.rs
View file

@ -1,212 +0,0 @@
//! Correct single-instance / PID-toggle, replacing the TOCTOU-prone pattern
//! duplicated in `breadbox/src/main.rs` (`toggle_or_continue`/`pid_file`,
//! ~30 lines) and `breadclip/src/main.rs` (same function names, whose own
//! comment reads `// ---- PID file toggle (single-instance, matches breadbox
//! pattern) ----`).
//!
//! The old pattern: read the PID file, `/proc/<pid>/comm`-check whether it's
//! still this app, `kill` it if so, otherwise `fs::write` our own PID over
//! it. That's three separate, non-atomic steps — two instances launched at
//! once can both read "no valid PID" and both proceed as the "first"
//! instance; a stale PID file left by a crash can also collide with an
//! unrelated process that was later assigned the same PID by the kernel,
//! sending it a `kill` it never asked for.
//!
//! This module instead holds an exclusive, kernel-atomic advisory lock
//! (`std::fs::File::try_lock`, i.e. `flock(2)`) on the PID file for the
//! entire lifetime of the process that acquires it. Lock ownership itself
//! *is* the liveness check — there is no window where two processes can
//! both believe they're the sole instance, and a crashed process's lock is
//! released by the kernel the instant it dies, so there's no stale-lock
//! case to reason about at all.
//!
//! [`try_acquire`] is the side-effect-free primitive (no signals sent);
//! [`toggle_or_kill`] layers breadbox/breadclip's actual desired behavior
//! (kill whoever's running, then exit) on top of it.
use std::fs::{File, OpenOptions};
use std::io::{Read, Seek, SeekFrom, Write};
use std::path::PathBuf;
/// Held for the lifetime of the running instance. Dropping it releases the
/// flock and removes the PID file. Keep this alive (e.g. in a `let _guard =
/// ...` bound in `main`) for as long as the app should be considered "the"
/// running instance.
pub struct Guard {
_file: File,
path: PathBuf,
}
impl Drop for Guard {
fn drop(&mut self) {
let _ = std::fs::remove_file(&self.path);
}
}
pub enum Acquire {
/// No other instance was running; we now hold the lock.
Acquired(Guard),
/// Another instance already holds the lock and is therefore alive right
/// now. Carries whatever PID it last recorded, if the file contents
/// parsed as one.
HeldByOther(Option<u32>),
}
pub enum Toggle {
/// No other instance was running; we now hold the lock. Keep the guard
/// alive for the process's lifetime.
Started(Guard),
/// Another instance was already running and (if a PID could be read
/// from the file) has been sent `SIGTERM`. The caller should exit
/// immediately without starting.
KilledExisting,
}
/// `$XDG_RUNTIME_DIR/<app>.pid` (falling back to `/tmp`, matching every
/// existing consumer's own fallback) — same location `breadbox`/`breadclip`
/// already used.
pub fn pid_file_path(app: &str) -> PathBuf {
crate::xdg::runtime_dir().join(format!("{app}.pid"))
}
/// Try to become the single instance of `app`, with no side effects beyond
/// the lock/file itself — in particular, unlike [`toggle_or_kill`], this
/// never signals another process. Prefer this if your app wants different
/// behavior than "kill the existing instance" (e.g. just refuse to start a
/// second copy).
pub fn try_acquire(app: &str) -> std::io::Result<Acquire> {
let path = pid_file_path(app);
let mut file = OpenOptions::new()
.read(true)
.write(true)
.create(true)
// Never truncate on open: an existing lock file may be held by a live
// instance. We only clear it (`set_len(0)`) *after* winning the lock.
.truncate(false)
.open(&path)?;
match file.try_lock() {
Ok(()) => {
file.set_len(0)?;
file.seek(SeekFrom::Start(0))?;
write!(file, "{}", std::process::id())?;
file.sync_all()?;
Ok(Acquire::Acquired(Guard { _file: file, path }))
}
Err(_) => {
let mut contents = String::new();
let _ = file.read_to_string(&mut contents);
Ok(Acquire::HeldByOther(contents.trim().parse::<u32>().ok()))
}
}
}
/// Toggle behavior: acquire the single-instance lock for `app`. If already
/// held by another live process, signal it to quit (`SIGTERM` via `kill`)
/// and return [`Toggle::KilledExisting`] — the caller should exit. Otherwise
/// take the lock and return [`Toggle::Started`] — the caller should proceed
/// and keep the guard alive.
pub fn toggle_or_kill(app: &str) -> std::io::Result<Toggle> {
Ok(match try_acquire(app)? {
Acquire::Acquired(guard) => Toggle::Started(guard),
Acquire::HeldByOther(Some(pid)) => {
kill(pid);
Toggle::KilledExisting
}
Acquire::HeldByOther(None) => Toggle::KilledExisting,
})
}
#[cfg(unix)]
fn kill(pid: u32) {
// Shells out rather than binding libc directly, matching how every
// existing consumer already did this (`Command::new("kill")`) — no new
// dependency for a one-shot signal.
let _ = std::process::Command::new("kill")
.arg(pid.to_string())
.status();
}
#[cfg(not(unix))]
fn kill(_pid: u32) {}
#[cfg(test)]
mod tests {
use super::*;
use std::time::Duration;
fn unique_app(name: &str) -> String {
format!("bread-utils-singleton-test-{name}-{}", std::process::id())
}
#[test]
fn first_acquire_succeeds_and_releases_on_drop() {
// Guards against `hypr`'s env-var test concurrently pointing
// XDG_RUNTIME_DIR at a nonexistent path mid-test — see `env_test_lock`.
let _lock = crate::env_test_lock().lock().unwrap_or_else(|e| e.into_inner());
let app = unique_app("first");
match try_acquire(&app).unwrap() {
Acquire::Acquired(_guard) => {}
Acquire::HeldByOther(_) => panic!("expected to be the first instance"),
}
// Guard dropped at end of scope; pid file should be gone.
std::thread::sleep(Duration::from_millis(10));
assert!(!pid_file_path(&app).exists());
}
#[test]
fn second_acquire_while_first_is_held_reports_held_by_other_with_our_pid() {
let _lock = crate::env_test_lock().lock().unwrap_or_else(|e| e.into_inner());
let app = unique_app("second");
let guard = match try_acquire(&app).unwrap() {
Acquire::Acquired(g) => g,
Acquire::HeldByOther(_) => panic!("expected to be the first instance"),
};
// A second attempt while the first guard is still held must not be
// able to acquire the lock too — that's the whole point. No signal
// is sent by `try_acquire` itself (that's `toggle_or_kill`'s job),
// so this is safe to assert without affecting the test process.
match try_acquire(&app).unwrap() {
Acquire::HeldByOther(pid) => assert_eq!(pid, Some(std::process::id())),
Acquire::Acquired(_) => panic!("second acquire succeeded while the first still holds the lock"),
}
drop(guard);
}
#[test]
fn lock_is_released_after_guard_drop_so_a_later_instance_can_acquire() {
let _lock = crate::env_test_lock().lock().unwrap_or_else(|e| e.into_inner());
let app = unique_app("release");
let guard = match try_acquire(&app).unwrap() {
Acquire::Acquired(g) => g,
Acquire::HeldByOther(_) => panic!("expected to be the first instance"),
};
drop(guard);
match try_acquire(&app).unwrap() {
Acquire::Acquired(_g) => {}
Acquire::HeldByOther(_) => panic!("lock should have been released when the guard was dropped"),
}
}
#[test]
fn toggle_or_kill_starts_when_nothing_else_is_running() {
let _lock = crate::env_test_lock().lock().unwrap_or_else(|e| e.into_inner());
let app = unique_app("toggle-start");
match toggle_or_kill(&app).unwrap() {
Toggle::Started(_guard) => {}
Toggle::KilledExisting => panic!("expected to start as the first instance"),
}
}
// Deliberately not unit-tested: `toggle_or_kill`'s kill-the-existing-
// instance branch. Exercising it for real means sending a real SIGTERM
// to a real process; the only PID a test process can safely target is
// its own (as a stand-in "other instance" via a shared PID file), and
// doing that would SIGTERM the test binary itself. The branch is a
// two-line, directly-inspectable call to `kill()` gated on
// `HeldByOther(Some(pid))`, which the `second_acquire_...` test above
// already exercises up to (and excluding) the signal send.
}

100
bread-utils/src/tomlcfg.rs
View file

@ -1,100 +0,0 @@
//! Non-destructive TOML config editing discipline.
//!
//! Extracted from `bos-settings/src/config/mod.rs` (`load_doc`/`save_doc`)
//! and `breadhelp/src/config.rs`, which re-implemented the exact same
//! function bodies in the same fix pass that introduced `bos-settings`'s
//! version — right down to the eprintln wording template. Both parse into a
//! `toml_edit::DocumentMut` (preserving keys/comments/formatting this app
//! doesn't model) and back up a file that exists but fails to parse, once,
//! before falling back to an empty document — so a bad edit is always
//! recoverable from `<path>.bak` instead of silently destroying whatever the
//! file used to hold.
//!
//! Requires the `toml` feature.
use std::path::Path;
use toml_edit::DocumentMut;
/// Load a TOML file into an editable document. A missing file yields an
/// empty document (normal for a fresh install). A file that *exists* but
/// fails to parse is backed up to `<path>.bak` once before falling back to
/// an empty document, so the next [`save_doc`] doesn't silently overwrite an
/// unparseable-but-recoverable file with only the caller's modelled keys.
///
/// `app` is used only to prefix the parse-failure log line (e.g.
/// `"breadhelp"`, `"bos-settings"`).
pub fn load_doc(app: &str, path: &Path) -> DocumentMut {
let Ok(text) = std::fs::read_to_string(path) else {
return DocumentMut::default();
};
match text.parse::<DocumentMut>() {
Ok(doc) => doc,
Err(e) => {
let backup = super::atomic::backup_path_for(path);
eprintln!(
"{app}: {} failed to parse ({e}); backed up to {} before falling back to defaults",
path.display(),
backup.display()
);
let _ = std::fs::write(&backup, &text);
DocumentMut::default()
}
}
}
/// Write the document back to disk atomically (temp-then-rename), backing up
/// whatever was there before overwriting it — see
/// [`crate::atomic::write_atomic_backed_up`].
pub fn save_doc(path: &Path, doc: &DocumentMut) -> std::io::Result<()> {
super::atomic::write_atomic_backed_up(path, &doc.to_string())
}
#[cfg(test)]
mod tests {
use super::*;
use toml_edit::value;
fn tmp_dir(name: &str) -> std::path::PathBuf {
let dir = std::env::temp_dir().join(format!("bread-utils-tomlcfg-test-{name}-{}", std::process::id()));
let _ = std::fs::remove_dir_all(&dir);
std::fs::create_dir_all(&dir).unwrap();
dir
}
#[test]
fn missing_file_yields_empty_document() {
let dir = tmp_dir("missing");
let doc = load_doc("test", &dir.join("nope.toml"));
assert!(doc.is_empty());
let _ = std::fs::remove_dir_all(&dir);
}
#[test]
fn save_then_load_round_trips() {
let dir = tmp_dir("roundtrip");
let path = dir.join("state.toml");
let mut doc = DocumentMut::default();
doc["general"]["mode"] = value("dad");
save_doc(&path, &doc).unwrap();
let loaded = load_doc("test", &path);
assert_eq!(
loaded.get("general").and_then(|t| t.get("mode")).and_then(|v| v.as_str()),
Some("dad")
);
let _ = std::fs::remove_dir_all(&dir);
}
#[test]
fn unparseable_existing_file_is_backed_up_before_falling_back() {
let dir = tmp_dir("bad-parse");
let path = dir.join("state.toml");
std::fs::write(&path, "this is not [ valid toml").unwrap();
let doc = load_doc("test", &path);
assert!(doc.is_empty());
let backup = dir.join("state.toml.bak");
assert_eq!(std::fs::read_to_string(&backup).unwrap(), "this is not [ valid toml");
let _ = std::fs::remove_dir_all(&dir);
}
}

123
bread-utils/src/xdg.rs
View file

@ -1,123 +0,0 @@
//! XDG base directory helpers.
//!
//! Several repos independently rolled `dirs::data_local_dir().unwrap_or_else(||
//! PathBuf::from("~/.local/share"))`-shaped fallbacks. The literal-tilde
//! string is the bug: `PathBuf`/`std::fs` never expand `~`, so on the rare
//! box where `dirs` can't resolve a home directory (no `HOME` env var, e.g.
//! some container/systemd-service contexts) the fallback silently resolves
//! to a directory literally named `~` in the process's current working
//! directory instead of the user's actual home. Confirmed present in:
//! - `breadclip-core/src/lib.rs:171-175` (`data_dir`)
//! - `breadpad-shared/src/classifier.rs:34-39` (`model_dir`)
//! - `breadpad-shared/src/config.rs:214-219` and `:221-226`
//! (`config_path`, `style_css_path`)
//! - `breadmon/src/profile.rs:31-35` (`profiles_dir`)
//! - `breadarr-shared/src/config.rs:316-321`'s own `expand_home` helper,
//! which had the same bug in a different shape: its *own* fallback (when
//! `HOME` itself isn't set) returned the literal, unexpanded input string
//! rather than a real path.
//!
//! The helpers here resolve a real `$HOME` (via `dirs::home_dir()`, which
//! itself falls back to reading `HOME` directly) before ever falling back,
//! so the fallback path is always an absolute, expanded path.
use std::path::PathBuf;
/// A real, absolute home directory — `dirs::home_dir()`, falling back to
/// `/root` only if that itself fails (no `HOME` env var *and* no passwd-db
/// entry, e.g. some minimal container contexts). Never a literal `"~"`.
pub fn home_dir() -> PathBuf {
home_or_root()
}
fn home_or_root() -> PathBuf {
dirs::home_dir().unwrap_or_else(|| PathBuf::from("/root"))
}
/// `$XDG_CONFIG_HOME` (only if it's set to an absolute path) or `~/.config`,
/// joined with `app`.
pub fn config_dir(app: &str) -> PathBuf {
config_home().join(app)
}
/// The bare `$XDG_CONFIG_HOME` (or `~/.config`) directory, with no app name
/// joined on — for callers that build up multiple sub-paths themselves
/// (e.g. `bos-settings`, which joins a different bread* app's name per
/// config file it edits).
pub fn config_home() -> PathBuf {
base_config_dir()
}
/// `$XDG_DATA_HOME` (only if absolute) or `~/.local/share`, joined with `app`.
pub fn data_dir(app: &str) -> PathBuf {
dirs::data_local_dir()
.unwrap_or_else(|| home_or_root().join(".local/share"))
.join(app)
}
/// `$XDG_CACHE_HOME` (only if absolute) or `~/.cache`, joined with `app`.
pub fn cache_dir(app: &str) -> PathBuf {
dirs::cache_dir()
.unwrap_or_else(|| home_or_root().join(".cache"))
.join(app)
}
/// `$XDG_RUNTIME_DIR`, falling back to `/tmp` — matches the fallback every
/// consumer (breadbox, breadclip, breadmon) already used for PID/socket
/// scratch files, which don't need to survive a reboot.
pub fn runtime_dir() -> PathBuf {
std::env::var_os("XDG_RUNTIME_DIR")
.map(PathBuf::from)
.unwrap_or_else(|| PathBuf::from("/tmp"))
}
fn base_config_dir() -> PathBuf {
if let Some(xdg) = std::env::var_os("XDG_CONFIG_HOME") {
let p = PathBuf::from(xdg);
if p.is_absolute() {
return p;
}
}
dirs::config_dir().unwrap_or_else(|| home_or_root().join(".config"))
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn config_dir_joins_app_name() {
let d = config_dir("breadpad");
assert!(d.ends_with("breadpad"));
assert!(d.is_absolute());
}
#[test]
fn home_dir_is_absolute_and_never_a_literal_tilde() {
let d = home_dir();
assert!(d.is_absolute());
assert!(!d.components().any(|c| c.as_os_str() == "~"));
}
#[test]
fn data_dir_never_contains_literal_tilde() {
// Regression guard for the exact bug this module replaces: the
// fallback must never be a literal "~/..." path component.
let d = data_dir("breadclip");
assert!(!d.components().any(|c| c.as_os_str() == "~"));
assert!(d.is_absolute());
}
#[test]
fn cache_dir_is_absolute() {
assert!(cache_dir("breadsearch").is_absolute());
}
#[test]
fn runtime_dir_falls_back_to_tmp() {
let _lock = crate::env_test_lock().lock().unwrap_or_else(|e| e.into_inner());
// We don't unset XDG_RUNTIME_DIR here (test isolation), just confirm
// the function returns *something* absolute either way.
assert!(runtime_dir().is_absolute());
}
}

Some files were not shown because too many files have changed in this diff Show more