Repoint bread-theme, bread-utils, and bread-screenshots at tag v0.7.2
on git.breadway.dev. Drop the 69ce2d67 rev pin now that screenshots
is on a tagged release.
Popup, daemon, and core were split across git.breadway.dev v0.3.0 and
GitHub v0.3.1. Point every bread-theme / bread-utils dep at the same
Forgejo tag. bread-screenshots is not in v0.7.1 (the crate landed after
that tag) so it stays on that remote's main until the next ecosystem
release.
CLAUDE.md now documents the single-trunk model. EVENTS.md is unchanged
— no pin/select verbs.
Mirrors tonight's breadbox migration (same shared crate, same duplicated
patterns):
- position.rs's raw socket1 client -> bread_utils::hypr (file removed
entirely, its logic now lives in the shared crate)
- toggle_or_continue's TOCTOU-prone PID-file dance -> bread_utils::singleton
- the layer-shell window setup, Up/Down visible-row navigation, and
click-outside-close gesture -> bread_utils::gtk_popup
- breadclip-core's data_dir(): replaced the buggy
`dirs::data_local_dir().unwrap_or_else(|| PathBuf::from("~/.local/share"))`
fallback (flagged but never fixed in tonight's earlier audit pass —
PathBuf never expands `~`) with bread_utils::xdg::data_dir, which
resolves a real $HOME before ever falling back.
Builds and tests clean across the whole breadclip workspace.
- history.db and images/*.png are now created with 0600 permissions
(owner-only) instead of default umask, since clipboard history can
contain plaintext passwords/tokens.
- breadclipd never persists clipboard content flagged with the
x-kde-passwordManagerHint MIME type (the convention KeePassXC,
Bitwarden, etc. use to mark content they own).
- Replaced breadclipd's 500ms busy-poll loop (2-3 wl-paste forks per
cycle, forever) with wl-paste --watch, so it only reacts on actual
clipboard changes.
- Documented both behaviors in the README.
