`daemon_survives_repeated_reloads_and_pipeline_resumes` manually emitted
`bread.reload.before` / `.after`. Since "Allow well-formed bread.command
events on the emit bus" tightened the normalizer, a manual emit of an
adapter-owned domain (`reload`) is rejected, so this test — and every
push to main since — failed at the test step, blocking the dev-track
publish.
The event names are incidental here; the test only checks that events
flow through the pipeline before and after a reload storm. Renamed to
`bread.reloadtest.*` (a non-reserved domain).
- io.rs: factor the pending-RPC-replies map into a PendingReplies
type alias (type_complexity)
- lua_env.rs: drop a redundant i64->i64 cast and an unneeded borrow
before create_string (unnecessary_cast, needless_borrows_for_generic_args)
- state_engine.rs: iterate watches.values() instead of discarding the
key from watches.iter() (for_kv_map)
- module_host_sandbox.rs: collapse nested if into a single condition
(collapsible_if)
(cherry picked from commit 49063cb98ddfeae35d842a6cf439123cfda763d9)
Docs already said any module or app could publish bread.command.<app>.<verb>,
but command is reserved so both unsourced bread-emit and sourced App emit
rejected the whole namespace. Keep command unclaimable as an app id; accept
bread.command.<known-app>.<verb> (and let an app command another known app).
Also ship bread-emit and bread-module-host, and give udev enumerate the same
classification fields as a live add so boot-time devices are not all unknown.
The integration test harness (ipc_integration.rs and
module_host_sandbox.rs) tore down spawned breadd instances via
Child::kill() (SIGKILL). Since breadd's PodmanAdapter is enabled by
default and the test breadd.toml fixtures didn't disable it, every
test-spawned daemon on a machine with podman installed ran a real
`podman events --format json` child. SIGKILL gives breadd zero chance
to run its own graceful shutdown path (wait_for_shutdown -> adapter
tasks dropping -> kill_on_drop firing on that child), so it was
orphaned and reparented to init on every single test run instead.
A day of repeated `cargo test --workspace` runs during today's
workstream development left 1,559 such orphaned processes consuming
76.8GB of RSS system-wide, found and cleaned up separately.
Fix is two-layered: disable the podman adapter in both harnesses'
breadd.toml fixtures (tests don't need real container-lifecycle
watching, matching how hyprland/udev/power/network are already
disabled there), and change TestHarness::drop to send SIGTERM with a
bounded wait before falling back to SIGKILL, so breadd's own cleanup
gets a real chance to run - defense in depth against any future
adapter that spawns a subprocess.
Verified: two full `cargo test --workspace` runs (282 tests) produce
zero new podman events processes and zero leftover breadd/
bread-module-host processes.
Closes the gap Workstream D's in-process capability scoping left open:
build_scoped_env only gated presence of bread.* bindings, but os.execute/
io.open/debug.* remained fully reachable since a module's Lua still ran
inside breadd's own process. A module that declares [[permissions]] in
bread.module.toml (including an explicit empty list) is now spawned as a
separate bread-module-host process instead, restricted by a Landlock
ruleset breadd builds from that module's granted permissions and applies
via Command::pre_exec before the child executes any Lua at all. A module
with no manifest at all keeps today's in-process, ungated behavior for
backward compatibility.
- bread-module-host: new minimal binary (mlua + tokio + serde_json) that
connects to breadd's existing IPC socket, presents a one-time spawn
token, and proxies bread.* calls as RPC instead of direct bindings.
- breadd/src/module_host.rs: spawn + token registry + apply_sandbox
(Landlock ruleset construction), with unit tests that spawn a real
child and verify denial at the OS level, not a Lua-level check.
- breadd/src/ipc/module_host_bridge.rs: the module_host.* RPC bridge
(on/once/off/emit/after/every/cancel, fs.read/write, exec/exec_capture,
state.get, log/warn/error, status) plus the hello handshake. Bumped
API_VERSION to 1.6.0.
- breadd/tests/module_host_sandbox.rs: end-to-end acceptance tests going
through a real spawned breadd + bread-module-host + IPC handshake —
os.execute/io.open denied outside a module's granted fs.read scope, and
kill -9 on a module-host child leaving breadd and other modules intact
while breadd reports bread.module.crashed.
- bread-shared/src/module_host_ipc.rs: shared wire types (hello result,
tagged event/timer push envelope) so breadd and bread-module-host can't
drift on the handshake/push shape.
Deferred (documented in Documentation.md's Workstream G section): the
trust="in-process" opt-out, remaining bread.* namespaces over RPC
(hyprland/widget/machine/bluetooth/notify/state.watch), network
sandboxing, and a fully static build that would remove the Execute grant
Landlock's dynamic-linker requirement forces on system library dirs.
The test triggered its rules via IPC's no-source emit method with real
adapter-owned event names (bread.device.*, bread.power.*), which
Workstream A now correctly rejects as impersonation. Switched to a
custom non-reserved domain (testrule.*) since what's under test is
rules.toml -> bread.on() -> action wiring, not adapter-specific event
names -- real rules.toml usage is unaffected since it subscribes to
genuine adapter-sourced events, not manually-injected ones.
ModuleManifest gains a structured [[permissions]] field (bread-shared's
new ModulePermission/PermissionKind, shared between bread-cli and breadd
so the two never drift on what a permission "type" string means).
breadd now gives every third-party module's Lua chunk a scoped _ENV
instead of the shared global table: load_scoped_lua_file builds a fresh
`bread` table containing only baseline bindings (event subscription,
timers, json, module/store, logging, and the pure-Lua sugar built on top
of those) plus whatever the manifest's permissions grant, with a
metatable __index falling back to the real globals for everything else
(stdlib, require/package - so require("bread.devices") keeps working,
since builtins load unscoped and their closures capture that environment
lexically regardless of the caller's). _G is explicitly rebound to the
scoped table itself to close the obvious escape hatch. A module with no
manifest, or a manifest with no permissions key, keeps full ambient
access unchanged (today's behavior) but is now tracked as `ungated` in
module status and surfaced by `bread doctor`. An explicit `permissions =
[]` is scoped for real but not flagged, since that's a deliberate
declaration.
Adds `bread modules audit <name>`: a best-effort text scan of a module's
.lua files suggesting a [[permissions]] block to paste into its manifest.
Converts examples/modules/cpu-temp-widget.lua into a directory module
with a worked bread.module.toml (fs.read + widget) as the reference
example. Documentation.md gets a new "Capability-scoped modules" section
covering the taxonomy, the require()/closure mechanism, and an explicit
note that path/bin scoping is recorded but not yet enforced per-call -
that's the out-of-process module sandboxing workstream this manifest
schema is laid down for. API_VERSION bumped 1.4.0 -> 1.5.0.
Adds a bread.rules built-in module plus a breadd/src/core/rules.rs
parser/validator so the common "when event X happens, do Y" case
(dock connect script, AC-disconnect notification, keyboard rate on
connect) no longer requires hand-written init.lua.
- rules.toml is optional, XDG_CONFIG_HOME-aware (mirrors breadd.toml's
config_path() resolution), and purely additive alongside init.lua.
- Each [[rule]] needs `on` (event suffix, "bread." implied, wildcards
supported) and exactly one of run/exec/notify. `run` names a single
script (tilde-expanded + shell-quoted so spaces in the path can't be
word-split); `exec` is a raw shell command line passed through as-is;
`notify` shows a desktop notification.
- Rule data is threaded into the bread.rules Lua module via globals
set just before it loads (same technique load_profiles() already
uses for __profiles_path), avoiding any need to hand-escape values
into generated Lua source text.
- Parse/validation failures surface through the existing module
load-error path (Lua error() -> run_on_load -> set_module_status),
so a bad rules.toml shows up via `bread doctor` exactly like a
broken hand-written module would, without blocking other valid
rules in the same file.
- Documentation.md gets a new Getting-started fast path plus a
Dictionary entry; README's Configuration section gets a short
pointer. Since: v1.5.
Every BreadEvent now gets a unique id at construction (via
BreadEvent::new/with_timestamp, and the normalizer's struct-literal call
sites, which all now assign one explicitly). A new caused_by field is
populated only when a Lua bread.emit() call runs synchronously inside a
bread.on subscriber's handler: LuaEngine tracks the currently-dispatching
event's id (set/restored around each handle_event invocation, single-
threaded so a plain Mutex-guarded slot suffices) and bread.emit()'s Rust
binding reads it when constructing the outgoing event. This lets chains of
Lua modules that react to each other's events be reconstructed instead of
timestamp-guessed from a live `bread events` log.
Also:
- bread events --tree renders the caused_by chain as an indented,
live-streaming-friendly tree instead of a flat line-per-event stream.
- API_VERSION bumped 1.4.0 -> 1.5.0 (additive-only change).
- Documentation.md's event envelope, bread.emit, and debugging-tips
sections updated with Since: v1.5 markers.
- New end-to-end regression test spawning the real daemon with 3 chained
Lua handlers (A emits X on trigger, B emits Y on X, C emits Z on Y) and
asserting caused_by threads correctly through all three hops.
The IPC "emit" method's no-source path took a bare event+data and sent it
straight to emit_tx tagged AdapterSource::System with zero validation of
the event name. Any same-UID process on the socket could send e.g.
{"event":"bread.power.ac.connected",...} and have it delivered to every
Lua subscriber indistinguishable from a real adapter event, since System
is the same tag the daemon uses for its own trusted, Rust-originated
sends (bread.system.startup, bread.profile.activated).
Fix, scoped to the actual threat model (same-UID Unix socket trust means
there's no way to cryptographically distinguish "the real bread-cli
binary" from any other local process, so a generic connection-identity
handshake would be theater):
- New AdapterSource::Manual tag for the no-source emit path. System is
now reserved for daemon-internal, Rust-code-originated sends only and
can never again be produced from data that arrived over the wire.
- The event name is rejected if its top-level dotted segment is one of
the reserved, adapter-owned domains (RESERVED_DOMAINS in
bread-shared/src/apps.rs) -- extended with bluetooth/workspace/window/
monitor, event families the Hyprland and Bluetooth adapters already
publish under but that were missing from that list. Freely-named
custom/test event names are untouched, so `bread emit <name>` and
bread-emit's fire-and-forget single-line-write design keep working
exactly as documented.
Bumped API_VERSION to 1.5.0 and updated Documentation.md's IPC emit
section and Namespaces reserved-domains list accordingly.
Also fixed a subscribe/emit race that surfaced while adding regression
tests for this: events.subscribe's ack is written to the client before
the server task actually registers on the broadcast channel, so a test
that emits immediately after reading the ack can race the registration.
Added a settle delay plus an explicit timeout (instead of an unbounded
read loop) so a future regression fails the test instead of hanging the
whole binary.
Security:
- Remove `bread modules install github:…`. Remote fetch pulled unreviewed
third-party Lua and ran it with full bread.exec() privileges in an
unsandboxed runtime. Module install is now local-only; parse_source
rejects github:/git: with an explicit message.
bread-sync extracted from the workspace (parked for its own project):
- Removed from workspace members (now excluded); see bread-sync/EXTRACTION.md
- Removed the entire `bread sync` CLI surface and now-unused deps
(bread-sync, reqwest, tar, flate2; tempfile demoted to dev-dependency)
- Removed the sync.status IPC method from breadd plus its integration tests
- Moved the generic `expand_path` helper into bread-shared (with unit tests)
CI now actually runs and gates quality:
- Trigger on master/dev (was `main` — CI had never run, not once)
- Added `cargo fmt --check` and `clippy -D warnings`; fixed 4 clippy warnings
- Dropped the macOS matrix entry (breadd is Linux-only: udev/rtnetlink);
added the libudev-dev system dependency the Linux build needs
Hardening / honesty:
- New ipc test: daemon survives repeated reloads and the event pipeline
resumes (the prior suite only had a single happy-path reload check)
- Docs scrubbed of sync across README/Documentation/Overview/DAEMON
- "production-ready" and "compositor-agnostic" claims reworded to match
reality rather than aspiration
Note: bread-sync/src/export.rs held pre-existing local WIP authored outside
this change set and is intentionally excluded from this commit.
