From 967fd9f1b787ba7bea65f5d59ff3084e55b3b5d2 Mon Sep 17 00:00:00 2001 From: Breadway Date: Mon, 31 Aug 2026 15:07:04 +0800 Subject: [PATCH 1/4] breadclip-core: history DB hardening + user config + pin/primary schema MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Persistence layer changes, all backward-compatible with existing databases via in-place column migration: - WAL journal mode + a 5s busy timeout so overlapping `--capture-once` writers and the popup reader stop dropping captures on SQLITE_BUSY. - `HistoryError` replaces bare `rusqlite::Error` so a filesystem failure while writing an image file surfaces instead of leaving a row that points at a file that was never written. - Image files are created 0600 from the first syscall (O_CREAT|O_EXCL, mode 0600) — no world-readable window before a chmod. Data and images dirs are forced to 0700 on every open. `gc_orphaned_images` sweeps image files no row references (older than 1h, to spare in-flight writes). - `pinned` and `is_primary` columns. Pinned rows are exempt from trim and sort first; `list_entries` breaks timestamp ties by `id DESC` so ordering (and which rows trim keeps) is deterministic within a second. - `Retention` caps are now a field on `HistoryDb` (`open_with`), and `0` is a legal value ("keep no unpinned entries of this kind"). New `config` module: optional TOML at `$XDG_CONFIG_HOME/breadclip/config.toml`, every key defaulted and clamped, unparseable file backed up once (bread-utils tomlcfg discipline). Keys: retention.text/images, panel.width, capture.primary. --- Cargo.lock | 3 +- breadclip-core/Cargo.toml | 5 +- breadclip-core/src/config.rs | 175 ++++++++++ breadclip-core/src/lib.rs | 642 +++++++++++++++++++++++++++++++---- 4 files changed, 750 insertions(+), 75 deletions(-) create mode 100644 breadclip-core/src/config.rs diff --git a/Cargo.lock b/Cargo.lock index 07dd579..885ea87 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -134,6 +134,7 @@ dependencies = [ "gtk4-layer-shell", "serde", "serde_json", + "toml_edit 0.22.27", ] [[package]] @@ -156,11 +157,11 @@ name = "breadclip-core" version = "0.2.4" dependencies = [ "bread-utils", - "dirs", "hex", "rusqlite", "sha2", "tempfile", + "toml_edit 0.22.27", ] [[package]] diff --git a/breadclip-core/Cargo.toml b/breadclip-core/Cargo.toml index 2742fb8..6cbe951 100644 --- a/breadclip-core/Cargo.toml +++ b/breadclip-core/Cargo.toml @@ -7,8 +7,9 @@ edition = "2021" rusqlite = { version = "0.31", features = ["bundled"] } sha2 = "0.10" hex = "0.4" -dirs = "5" -bread-utils = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2" } +toml_edit = "0.22" +# `toml` for bread-utils' non-destructive config load/save discipline (config.rs). +bread-utils = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2", features = ["toml"] } [dev-dependencies] tempfile = "3" diff --git a/breadclip-core/src/config.rs b/breadclip-core/src/config.rs new file mode 100644 index 0000000..5f69611 --- /dev/null +++ b/breadclip-core/src/config.rs @@ -0,0 +1,175 @@ +//! breadclip's user configuration. +//! +//! Read from `$XDG_CONFIG_HOME/breadclip/config.toml` (or +//! `~/.config/breadclip/config.toml`). Every key has a sensible default, so +//! the file is entirely optional. A file that *exists* but fails to parse is +//! backed up to `config.toml.bak` (once) and defaults are used, matching +//! bread-utils' non-destructive TOML discipline (see +//! `bread_utils::tomlcfg::load_doc`). +//! +//! ```toml +//! [retention] +//! text = 200 # max non-pinned text entries (0 = keep none) +//! images = 50 # max non-pinned image entries (0 = keep none) +//! +//! [panel] +//! width = 520 # popup panel width, px +//! +//! [capture] +//! primary = false # also watch the middle-click primary selection +//! ``` + +use crate::Retention; +use std::path::PathBuf; +use toml_edit::{DocumentMut, Item}; + +/// Resolved configuration. `Config::default()` matches the built-in +/// behavior before config files existed. +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub struct Config { + pub retention: Retention, + pub panel_width: i32, + pub capture_primary: bool, +} + +impl Default for Config { + fn default() -> Self { + Self { + retention: Retention::default(), + panel_width: 520, + capture_primary: false, + } + } +} + +/// Clamp bounds. Retention can legitimately be `0` ("keep no unpinned +/// entries of this kind") but never huge; the panel width is bounded to +/// something that still fits on a screen. +const MAX_RETENTION: i64 = 10_000; +const MIN_PANEL_WIDTH: i64 = 300; +const MAX_PANEL_WIDTH: i64 = 2000; + +pub fn config_path() -> PathBuf { + bread_utils::xdg::config_dir("breadclip").join("config.toml") +} + +/// Load configuration, falling back to defaults for anything missing, +/// unparseable, or out of range. +pub fn load() -> Config { + let doc = bread_utils::tomlcfg::load_doc("breadclip", &config_path()); + Config { + retention: Retention { + text: int(&doc, "retention", "text", Retention::default().text as i64) + .clamp(0, MAX_RETENTION) as usize, + images: int(&doc, "retention", "images", Retention::default().images as i64) + .clamp(0, MAX_RETENTION) as usize, + }, + panel_width: int(&doc, "panel", "width", 520) + .clamp(MIN_PANEL_WIDTH, MAX_PANEL_WIDTH) as i32, + capture_primary: boolean(&doc, "capture", "primary", false), + } +} + +fn int(doc: &DocumentMut, section: &str, key: &str, default: i64) -> i64 { + doc.get(section) + .and_then(Item::as_table) + .and_then(|t| t.get(key)) + .and_then(Item::as_integer) + .unwrap_or(default) +} + +fn boolean(doc: &DocumentMut, section: &str, key: &str, default: bool) -> bool { + doc.get(section) + .and_then(Item::as_table) + .and_then(|t| t.get(key)) + .and_then(Item::as_bool) + .unwrap_or(default) +} + +#[cfg(test)] +mod tests { + use super::*; + + fn with_config_dir T, T>(f: F) -> T { + let _guard = crate::env_test_lock().lock().unwrap_or_else(|p| p.into_inner()); + let dir = tempfile::tempdir().expect("tempdir"); + std::env::set_var("XDG_CONFIG_HOME", dir.path()); + let r = f(); + let _ = std::fs::remove_dir_all(dir.path()); + r + } + + fn write_config(body: &str) { + let path = config_path(); + std::fs::create_dir_all(path.parent().unwrap()).unwrap(); + std::fs::write(&path, body).unwrap(); + } + + #[test] + fn missing_config_yields_defaults() { + with_config_dir(|| { + assert_eq!(load(), Config::default()); + }); + } + + #[test] + fn parses_known_keys() { + with_config_dir(|| { + write_config( + r#" +[retention] +text = 10 +images = 0 + +[panel] +width = 700 + +[capture] +primary = true +"#, + ); + let cfg = load(); + assert_eq!(cfg.retention.text, 10); + assert_eq!(cfg.retention.images, 0, "0 retention is legal"); + assert_eq!(cfg.panel_width, 700); + assert!(cfg.capture_primary); + }); + } + + #[test] + fn out_of_range_values_are_clamped_not_trusted() { + with_config_dir(|| { + write_config( + r#" +[retention] +text = -5 +images = 99999999 + +[panel] +width = 50 +"#, + ); + let cfg = load(); + assert_eq!(cfg.retention.text, 0); + assert_eq!(cfg.retention.images, MAX_RETENTION as usize); + assert_eq!(cfg.panel_width, MIN_PANEL_WIDTH as i32); + }); + } + + #[test] + fn partial_config_falls_back_per_key() { + with_config_dir(|| { + write_config( + r#" +[retention] +text = 7 +"#, + ); + let cfg = load(); + assert_eq!(cfg.retention.text, 7); + assert_eq!(cfg.retention.images, Retention::default().images); + assert_eq!(cfg.panel_width, Config::default().panel_width); + assert!(!cfg.capture_primary); + }); + } +} diff --git a/breadclip-core/src/lib.rs b/breadclip-core/src/lib.rs index 571891c..db09c8b 100644 --- a/breadclip-core/src/lib.rs +++ b/breadclip-core/src/lib.rs @@ -1,7 +1,50 @@ -use rusqlite::{params, Connection, Result as SqlResult}; +pub mod config; + +use rusqlite::{params, Connection}; use sha2::{Digest, Sha256}; -use std::os::unix::fs::PermissionsExt; +use std::fmt; +use std::io::Write; +use std::os::unix::fs::{OpenOptionsExt, PermissionsExt}; use std::path::{Path, PathBuf}; +use std::time::Duration; + +/// How many non-pinned text and image entries history keeps by default. The +/// popup fetches everything (see its `FETCH_ALL`), so entries the daemon +/// persists are always reachable from the UI; pinned entries are exempt from +/// trimming entirely and can exceed these caps. +pub const MAX_TEXT_ENTRIES: usize = 200; +pub const MAX_IMAGE_ENTRIES: usize = 50; + +/// Retention caps for non-pinned entries. `0` is meaningful: it means +/// "keep no (unpinned) entries of this kind". +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub struct Retention { + pub text: usize, + pub images: usize, +} + +impl Default for Retention { + fn default() -> Self { + Self { + text: MAX_TEXT_ENTRIES, + images: MAX_IMAGE_ENTRIES, + } + } +} + +/// Where a clipboard entry came from: the regular clipboard (Ctrl+C / copy) +/// or the middle-click primary selection. +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub enum CaptureSource { + Clipboard, + Primary, +} + +impl CaptureSource { + pub fn is_primary(self) -> bool { + matches!(self, CaptureSource::Primary) + } +} #[derive(Debug, Clone)] pub struct ClipEntry { @@ -11,18 +54,84 @@ pub struct ClipEntry { pub content: Option, pub image_path: Option, pub content_hash: String, + pub pinned: bool, + pub is_primary: bool, +} + +/// Unified error type for `HistoryDb` operations: SQLite failures plus the +/// filesystem work the database implicitly depends on (creating the data +/// directory, writing image files). A bare `rusqlite::Error` can't represent +/// "disk full while writing the thumbnail file", and swallowing that failure +/// is what used to leave broken rows behind (an `image_path` pointing at a +/// file that was never written). +#[derive(Debug)] +pub enum HistoryError { + Sql(rusqlite::Error), + Io { + action: &'static str, + path: PathBuf, + source: std::io::Error, + }, +} + +impl fmt::Display for HistoryError { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + match self { + HistoryError::Sql(e) => write!(f, "database error: {e}"), + HistoryError::Io { action, path, source } => { + write!(f, "failed to {action} {}: {source}", path.display()) + } + } + } +} + +impl std::error::Error for HistoryError { + fn source(&self) -> Option<&(dyn std::error::Error + 'static)> { + match self { + HistoryError::Sql(e) => Some(e), + HistoryError::Io { source, .. } => Some(source), + } + } +} + +impl From for HistoryError { + fn from(e: rusqlite::Error) -> Self { + HistoryError::Sql(e) + } } pub struct HistoryDb { conn: Connection, + retention: Retention, } impl HistoryDb { - pub fn open() -> SqlResult { + /// Open with the default retention caps. + pub fn open() -> Result { + Self::open_with(Retention::default()) + } + + pub fn open_with(retention: Retention) -> Result { let dir = data_dir(); - std::fs::create_dir_all(&dir).ok(); + std::fs::create_dir_all(&dir).map_err(|source| HistoryError::Io { + action: "create data directory", + path: dir.clone(), + source, + })?; + // The data dir holds clipboard secrets (history.db is plaintext). + // A 0700 parent also blocks traversal to whatever SQLite's + // -wal/-shm side files look like, regardless of their own mode. + restrict_dir(&dir, 0o700); + let db_path = dir.join("history.db"); let conn = Connection::open(&db_path)?; + // Clipboard events can spawn overlapping `--capture-once` processes + // and the popup opens the same DB — without a busy timeout a writer + // can hit SQLITE_BUSY and silently drop a capture. + conn.busy_timeout(Duration::from_secs(5))?; + // WAL: concurrent readers (popup) and the single writer (daemon) no + // longer block each other, and readers see a consistent snapshot. + conn.pragma_update(None, "journal_mode", "WAL")?; conn.execute_batch( "CREATE TABLE IF NOT EXISTS history ( id INTEGER PRIMARY KEY AUTOINCREMENT, @@ -30,53 +139,99 @@ impl HistoryDb { mime_type TEXT NOT NULL, content TEXT, image_path TEXT, - content_hash TEXT NOT NULL UNIQUE + content_hash TEXT NOT NULL UNIQUE, + pinned INTEGER NOT NULL DEFAULT 0, + is_primary INTEGER NOT NULL DEFAULT 0 ); - CREATE INDEX IF NOT EXISTS history_ts ON history(timestamp DESC);", + CREATE INDEX IF NOT EXISTS history_ts ON history(timestamp DESC, id DESC);", + )?; + // Migrate databases created before `pinned`/`is_primary` existed. + ensure_column( + &conn, + "pinned", + "ALTER TABLE history ADD COLUMN pinned INTEGER NOT NULL DEFAULT 0", + )?; + ensure_column( + &conn, + "is_primary", + "ALTER TABLE history ADD COLUMN is_primary INTEGER NOT NULL DEFAULT 0", )?; // history.db can contain plaintext secrets copied to the clipboard // (passwords, tokens, TOTP codes); restrict it to owner-only, every open. restrict_permissions(&db_path); - Ok(Self { conn }) + let db = Self { conn, retention }; + db.gc_orphaned_images()?; + Ok(db) } - pub fn insert_text(&self, text: &str) -> SqlResult<()> { + pub fn insert_text(&self, text: &str, source: CaptureSource) -> Result<(), HistoryError> { let hash = sha256_hex(text.as_bytes()); let ts = unix_now(); self.conn.execute( - "INSERT INTO history (timestamp, mime_type, content, content_hash) - VALUES (?1, 'text/plain', ?2, ?3) - ON CONFLICT(content_hash) DO UPDATE SET timestamp = ?1", - params![ts, text, hash], + "INSERT INTO history (timestamp, mime_type, content, content_hash, is_primary) + VALUES (?1, 'text/plain', ?2, ?3, ?4) + ON CONFLICT(content_hash) DO UPDATE SET timestamp = ?1, is_primary = ?4", + params![ts, text, hash, source.is_primary() as i64], )?; - self.trim(200, 50) + self.trim() } - pub fn insert_image(&self, png_bytes: &[u8]) -> SqlResult<()> { - let hash = sha256_hex(png_bytes); + /// Store an image. `mime_type` is persisted with the row and drives the + /// file extension, so a JPEG capture is stored as a `.jpg` offered as + /// `image/jpeg` — not silently re-encoded/relabeled as PNG. + pub fn insert_image( + &self, + bytes: &[u8], + mime_type: &str, + source: CaptureSource, + ) -> Result<(), HistoryError> { + let hash = sha256_hex(bytes); let images_dir = data_dir().join("images"); - std::fs::create_dir_all(&images_dir).ok(); - // Use first 16 hex chars for the filename (collision-safe for 50 images) - let path = images_dir.join(format!("{}.png", &hash[..16])); + std::fs::create_dir_all(&images_dir).map_err(|source| HistoryError::Io { + action: "create images directory", + path: images_dir.clone(), + source, + })?; + restrict_dir(&images_dir, 0o700); + + let ext = match mime_type { + "image/jpeg" => "jpg", + _ => "png", + }; + // First 16 hex chars of the hash: collision-safe for the few dozen + // images history keeps. + let path = images_dir.join(format!("{}.{}", &hash[..16], ext)); if !path.exists() { - std::fs::write(&path, png_bytes).ok(); - restrict_permissions(&path); + write_image_file(&path, bytes)?; } let path_str = path.to_string_lossy().to_string(); let ts = unix_now(); self.conn.execute( - "INSERT INTO history (timestamp, mime_type, image_path, content_hash) - VALUES (?1, 'image/png', ?2, ?3) - ON CONFLICT(content_hash) DO UPDATE SET timestamp = ?1", - params![ts, path_str, hash], + "INSERT INTO history (timestamp, mime_type, image_path, content_hash, is_primary) + VALUES (?1, ?2, ?3, ?4, ?5) + ON CONFLICT(content_hash) DO UPDATE SET timestamp = ?1, is_primary = ?5", + params![ts, mime_type, path_str, hash, source.is_primary() as i64], )?; - self.trim(200, 50) + self.trim() } - pub fn list_entries(&self, limit: usize) -> SqlResult> { + /// Pin (or unpin) an entry. Pinned entries are exempt from trimming and + /// sort to the top of the history list. + pub fn set_pinned(&self, id: i64, pinned: bool) -> Result<(), HistoryError> { + self.conn.execute( + "UPDATE history SET pinned = ?1 WHERE id = ?2", + params![pinned as i64, id], + )?; + Ok(()) + } + + pub fn list_entries(&self, limit: usize) -> Result, HistoryError> { + // Pinned rows first, then `timestamp DESC, id DESC` — many copies + // land within the same second, and the `id` tiebreaker keeps that + // order (and therefore which rows trim keeps) deterministic. let mut stmt = self.conn.prepare( - "SELECT id, timestamp, mime_type, content, image_path, content_hash - FROM history ORDER BY timestamp DESC LIMIT ?1", + "SELECT id, timestamp, mime_type, content, image_path, content_hash, pinned, is_primary + FROM history ORDER BY pinned DESC, timestamp DESC, id DESC LIMIT ?1", )?; let rows = stmt .query_map([limit as i64], |row| { @@ -87,35 +242,40 @@ impl HistoryDb { content: row.get(3)?, image_path: row.get(4)?, content_hash: row.get(5)?, + pinned: row.get(6)?, + is_primary: row.get(7)?, }) })? - .collect::>>(); - rows + .collect::>>()?; + Ok(rows) } - /// Deletes every history entry and every stored image file. Used by the + /// Deletes every history entry and every stored image file — a hard + /// reset that clears pinned entries too. Used by the /// `bread.command.clip.clear` handler (see breadclipd's bread-client - /// subscription) as well as anything else that wants a hard reset of - /// clipboard history. - pub fn clear_all(&self) -> SqlResult<()> { + /// subscription) as well as anything else that wants a full wipe. + pub fn clear_all(&self) -> Result<(), HistoryError> { let image_paths: Vec = { let mut stmt = self .conn .prepare("SELECT image_path FROM history WHERE image_path IS NOT NULL")?; let paths = stmt .query_map([], |row| row.get(0))? - .collect::>>()?; + .collect::>>()?; paths }; + // Delete rows first, then files — the reverse order would leave rows + // pointing at already-removed files if the DELETE failed halfway. + self.conn.execute("DELETE FROM history", [])?; for path in image_paths { let _ = std::fs::remove_file(path); } - self.conn.execute("DELETE FROM history", [])?; Ok(()) } - pub fn delete_entry(&self, id: i64) -> SqlResult<()> { - // Clean up image file if present + pub fn delete_entry(&self, id: i64) -> Result<(), HistoryError> { + // Clean up image file if present — after the row is gone, so a + // failed DELETE never leaves a row pointing at a deleted file. let image_path: Option = self .conn .query_row( @@ -125,56 +285,114 @@ impl HistoryDb { ) .ok() .flatten(); + self.conn.execute("DELETE FROM history WHERE id = ?1", [id])?; if let Some(p) = image_path { let _ = std::fs::remove_file(p); } - self.conn - .execute("DELETE FROM history WHERE id = ?1", [id])?; Ok(()) } - fn trim(&self, max_text: usize, max_images: usize) -> SqlResult<()> { + /// Sweep image files on disk that no history row references anymore + /// (e.g. left behind by a crash between writing the file and inserting + /// the row). Files written in the last hour are left alone so a + /// concurrent `--capture-once` that is mid-insert (file on disk, row not + /// yet committed) is never deleted out from under itself. + pub fn gc_orphaned_images(&self) -> Result<(), HistoryError> { + let referenced: std::collections::HashSet = { + let mut stmt = self + .conn + .prepare("SELECT image_path FROM history WHERE image_path IS NOT NULL")?; + let paths = stmt + .query_map([], |row| row.get::<_, Option>(0))? + .collect::>>()?; + paths.into_iter().flatten().collect() + }; + let images_dir = data_dir().join("images"); + let Ok(entries) = std::fs::read_dir(&images_dir) else { + return Ok(()); // no images dir yet — nothing to sweep + }; + let cutoff = std::time::SystemTime::now() + .checked_sub(Duration::from_secs(3600)) + .unwrap_or(std::time::UNIX_EPOCH); + for entry in entries.flatten() { + let path = entry.path(); + if referenced.contains(&path.to_string_lossy().to_string()) { + continue; + } + let modified = entry + .metadata() + .and_then(|m| m.modified()) + .unwrap_or(std::time::UNIX_EPOCH); + if modified < cutoff { + let _ = std::fs::remove_file(&path); + } + } + Ok(()) + } + + fn trim(&self) -> Result<(), HistoryError> { + // Oldest non-pinned text rows beyond the cap. Pinned rows are never + // trimmed — that's the point of pinning them. self.conn.execute( "DELETE FROM history - WHERE mime_type = 'text/plain' + WHERE mime_type = 'text/plain' AND pinned = 0 AND id NOT IN ( - SELECT id FROM history WHERE mime_type = 'text/plain' - ORDER BY timestamp DESC LIMIT ?1 + SELECT id FROM history WHERE mime_type = 'text/plain' AND pinned = 0 + ORDER BY timestamp DESC, id DESC LIMIT ?1 )", - [max_text as i64], + [self.retention.text as i64], )?; - // Collect old image paths before deleting rows + // Collect the image files that are about to be trimmed, delete the + // rows first, then the files — so a failed DELETE never leaves rows + // pointing at already-removed files. `LIKE 'image/%'` covers every + // image mime type (png, jpeg, and anything added later). let old_paths: Vec = { let mut stmt = self.conn.prepare( "SELECT image_path FROM history - WHERE mime_type = 'image/png' + WHERE mime_type LIKE 'image/%' + AND pinned = 0 AND image_path IS NOT NULL AND id NOT IN ( - SELECT id FROM history WHERE mime_type = 'image/png' - ORDER BY timestamp DESC LIMIT ?1 + SELECT id FROM history WHERE mime_type LIKE 'image/%' AND pinned = 0 + ORDER BY timestamp DESC, id DESC LIMIT ?1 )", )?; let paths = stmt - .query_map([max_images as i64], |row| row.get(0))? - .collect::>>()?; + .query_map([self.retention.images as i64], |row| row.get(0))? + .collect::>>()?; paths }; + self.conn.execute( + "DELETE FROM history + WHERE mime_type LIKE 'image/%' + AND pinned = 0 + AND id NOT IN ( + SELECT id FROM history WHERE mime_type LIKE 'image/%' AND pinned = 0 + ORDER BY timestamp DESC, id DESC LIMIT ?1 + )", + [self.retention.images as i64], + )?; for path in old_paths { let _ = std::fs::remove_file(path); } - self.conn.execute( - "DELETE FROM history - WHERE mime_type = 'image/png' - AND id NOT IN ( - SELECT id FROM history WHERE mime_type = 'image/png' - ORDER BY timestamp DESC LIMIT ?1 - )", - [max_images as i64], - )?; Ok(()) } } +/// Add `column` to the history table if it isn't there (migration for +/// databases created by older versions). Table/column names are our own +/// constants, never user input. +fn ensure_column(conn: &Connection, column: &str, add_ddl: &str) -> rusqlite::Result<()> { + let mut stmt = conn.prepare("PRAGMA table_info(history)")?; + let names = stmt.query_map([], |row| row.get::<_, String>(1))?; + for name in names { + if name? == column { + return Ok(()); + } + } + conn.execute_batch(add_ddl) +} + /// Restrict a file to owner-only read/write (0600). Clipboard history can /// contain passwords and other secrets, so this must not be world/group /// readable regardless of the process umask. @@ -186,6 +404,42 @@ fn restrict_permissions(path: &Path) { } } +/// Restrict a directory to owner-only (0700). Used for the data dir and the +/// images dir, both of which contain clipboard secrets. +fn restrict_dir(path: &Path, mode: u32) { + if let Ok(meta) = std::fs::metadata(path) { + let mut perms = meta.permissions(); + perms.set_mode(mode); + let _ = std::fs::set_permissions(path, perms); + } +} + +/// Write an image file, created 0600 from the very first syscall — no window +/// where a clipboard image (possibly a screenshot with sensitive pixels) is +/// world-readable before a chmod lands, and no dependence on the umask. +fn write_image_file(path: &Path, bytes: &[u8]) -> Result<(), HistoryError> { + match std::fs::OpenOptions::new() + .write(true) + .create_new(true) + .mode(0o600) + .open(path) + { + Ok(mut f) => f.write_all(bytes).map_err(|source| HistoryError::Io { + action: "write image file", + path: path.to_path_buf(), + source, + }), + // Same hash filename means identical content — a concurrent + // `--capture-once` already wrote it. + Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => Ok(()), + Err(source) => Err(HistoryError::Io { + action: "create image file", + path: path.to_path_buf(), + source, + }), + } +} + pub fn sha256_hex(data: &[u8]) -> String { let mut hasher = Sha256::new(); hasher.update(data); @@ -209,28 +463,33 @@ fn unix_now() -> i64 { .as_secs() as i64 } +/// Serializes tests that redirect `$XDG_DATA_HOME`/`$XDG_CONFIG_HOME` +/// (process-global env vars) against each other — `cargo test` runs tests +/// in parallel threads within one process. +#[cfg(test)] +pub(crate) fn env_test_lock() -> &'static std::sync::Mutex<()> { + static LOCK: std::sync::OnceLock> = std::sync::OnceLock::new(); + LOCK.get_or_init(|| std::sync::Mutex::new(())) +} + #[cfg(test)] mod tests { use super::*; - // `HistoryDb::open` resolves its path via `data_dir()`, which follows - // `$XDG_DATA_HOME` — redirecting it to a fresh temp dir per test keeps - // this isolated from a real `~/.local/share/breadclip` and from other - // tests. Safe without a lock: this is currently the only test in the - // crate that touches XDG_DATA_HOME. - fn open_test_db() -> (tempfile::TempDir, HistoryDb) { + fn open_test_db() -> (std::sync::MutexGuard<'static, ()>, tempfile::TempDir, HistoryDb) { + let guard = env_test_lock().lock().unwrap_or_else(|p| p.into_inner()); let dir = tempfile::tempdir().expect("tempdir"); std::env::set_var("XDG_DATA_HOME", dir.path()); let db = HistoryDb::open().expect("open history db"); - (dir, db) + (guard, dir, db) } #[test] fn clear_all_removes_every_entry_and_image_file() { - let (_dir, db) = open_test_db(); - db.insert_text("first").unwrap(); - db.insert_text("second").unwrap(); - db.insert_image(b"not really a png, just bytes for the test") + let (_guard, _dir, db) = open_test_db(); + db.insert_text("first", CaptureSource::Clipboard).unwrap(); + db.insert_text("second", CaptureSource::Clipboard).unwrap(); + db.insert_image(b"not really a png, just bytes for the test", "image/png", CaptureSource::Clipboard) .unwrap(); let before = db.list_entries(10).unwrap(); @@ -253,8 +512,247 @@ mod tests { #[test] fn clear_all_on_empty_history_is_a_harmless_no_op() { - let (_dir, db) = open_test_db(); + let (_guard, _dir, db) = open_test_db(); db.clear_all().unwrap(); assert!(db.list_entries(10).unwrap().is_empty()); } + + #[test] + fn open_uses_wal_journal_mode() { + let (_guard, _dir, db) = open_test_db(); + let mode: String = db + .conn + .pragma_query_value(None, "journal_mode", |r| r.get(0)) + .unwrap(); + assert_eq!(mode, "wal"); + } + + #[test] + fn entries_with_equal_timestamps_order_by_id_desc() { + let (_guard, _dir, db) = open_test_db(); + db.insert_text("first", CaptureSource::Clipboard).unwrap(); + db.insert_text("second", CaptureSource::Clipboard).unwrap(); + let entries = db.list_entries(10).unwrap(); + assert_eq!(entries[0].content.as_deref(), Some("second")); + assert_eq!(entries[1].content.as_deref(), Some("first")); + } + + #[test] + fn trim_caps_text_and_images_at_retention_limits() { + let (_guard, _dir, db) = open_test_db(); + for i in 0..210 { + db.insert_text(&format!("text-{i}"), CaptureSource::Clipboard).unwrap(); + } + for i in 0..55 { + db.insert_image(format!("img-{i}").as_bytes(), "image/png", CaptureSource::Clipboard) + .unwrap(); + } + let entries = db.list_entries(1000).unwrap(); + let texts = entries + .iter() + .filter(|e| e.mime_type == "text/plain") + .count(); + let images = entries + .iter() + .filter(|e| e.mime_type.starts_with("image/")) + .count(); + assert_eq!(texts, MAX_TEXT_ENTRIES); + assert_eq!(images, MAX_IMAGE_ENTRIES); + } + + #[test] + fn trim_respects_configured_retention() { + let (_guard, _dir, _db) = open_test_db(); // holds the env lock + // Reopen with a custom retention on a fresh dir. + let dir = tempfile::tempdir().expect("tempdir"); + std::env::set_var("XDG_DATA_HOME", dir.path()); + let db = HistoryDb::open_with(Retention { text: 3, images: 2 }).expect("open db"); + for i in 0..10 { + db.insert_text(&format!("t{i}"), CaptureSource::Clipboard).unwrap(); + } + for i in 0..5 { + db.insert_image(format!("img-{i}").as_bytes(), "image/png", CaptureSource::Clipboard) + .unwrap(); + } + let entries = db.list_entries(100).unwrap(); + assert_eq!( + entries.iter().filter(|e| e.mime_type == "text/plain").count(), + 3 + ); + assert_eq!( + entries.iter().filter(|e| e.mime_type.starts_with("image/")).count(), + 2 + ); + } + + #[test] + fn pinned_entries_survive_trim() { + let (_guard, _dir, db) = open_test_db(); + for i in 0..205 { + db.insert_text(&format!("t{i}"), CaptureSource::Clipboard).unwrap(); + } + let entries = db.list_entries(1000).unwrap(); + let oldest_id = entries.last().unwrap().id; + let oldest_text = entries.last().unwrap().content.clone().unwrap(); + db.set_pinned(oldest_id, true).unwrap(); + + // Push past the cap: the pinned entry must survive while the rest + // stay capped. + for i in 0..10 { + db.insert_text(&format!("more{i}"), CaptureSource::Clipboard).unwrap(); + } + let entries = db.list_entries(1000).unwrap(); + assert!( + entries.iter().any(|e| e.id == oldest_id && e.pinned), + "a pinned entry must never be trimmed" + ); + assert_eq!( + entries + .iter() + .filter(|e| !e.pinned && e.mime_type == "text/plain") + .count(), + MAX_TEXT_ENTRIES + ); + + // Unpinning lets it get trimmed again like any other entry. + db.set_pinned(oldest_id, false).unwrap(); + for i in 0..10 { + db.insert_text(&format!("final{i}"), CaptureSource::Clipboard).unwrap(); + } + let entries = db.list_entries(1000).unwrap(); + assert!( + !entries.iter().any(|e| e.content.as_deref() == Some(oldest_text.as_str())), + "an unpinned entry falls back under normal trimming" + ); + } + + #[test] + fn pinned_entries_sort_first() { + let (_guard, _dir, db) = open_test_db(); + db.insert_text("a", CaptureSource::Clipboard).unwrap(); + db.insert_text("b", CaptureSource::Clipboard).unwrap(); + let second_id = db.list_entries(10).unwrap()[1].id; + + db.set_pinned(second_id, true).unwrap(); + + let entries = db.list_entries(10).unwrap(); + assert_eq!(entries[0].id, second_id, "pinned rows sort before unpinned"); + assert!(entries[0].pinned); + } + + #[test] + fn primary_source_is_recorded() { + let (_guard, _dir, db) = open_test_db(); + db.insert_text("primary text", CaptureSource::Primary).unwrap(); + db.insert_image(b"png", "image/png", CaptureSource::Clipboard).unwrap(); + + let entries = db.list_entries(10).unwrap(); + let text = entries.iter().find(|e| e.mime_type == "text/plain").unwrap(); + assert!(text.is_primary, "primary-selection text is tagged"); + let img = entries + .iter() + .find(|e| e.mime_type.starts_with("image/")) + .unwrap(); + assert!(!img.is_primary, "clipboard image is not tagged primary"); + } + + #[test] + fn insert_image_jpeg_stores_jpg_file_and_trims_with_other_images() { + let (_guard, _dir, db) = open_test_db(); + db.insert_image(b"\xff\xd8\xff fake jpeg", "image/jpeg", CaptureSource::Clipboard) + .unwrap(); + let jpeg_path = db + .list_entries(10) + .unwrap() + .into_iter() + .find(|e| e.mime_type == "image/jpeg") + .expect("jpeg entry") + .image_path + .unwrap(); + assert!(jpeg_path.ends_with(".jpg")); + assert!(Path::new(&jpeg_path).exists()); + + // 49 more images: the jpeg is still within the newest 50. + for i in 0..49 { + db.insert_image(format!("img-{i}").as_bytes(), "image/png", CaptureSource::Clipboard) + .unwrap(); + } + let entries = db.list_entries(100).unwrap(); + assert_eq!( + entries + .iter() + .filter(|e| e.mime_type.starts_with("image/")) + .count(), + MAX_IMAGE_ENTRIES + ); + assert!( + entries.iter().any(|e| e.mime_type == "image/jpeg"), + "jpeg is among the newest 50 images, so it must survive trim" + ); + + // Push it past the cap: the jpeg row and its file both go. + for i in 0..10 { + db.insert_image(format!("late-{i}").as_bytes(), "image/png", CaptureSource::Clipboard) + .unwrap(); + } + let entries = db.list_entries(100).unwrap(); + assert!(!entries.iter().any(|e| e.mime_type == "image/jpeg")); + assert!( + !Path::new(&jpeg_path).exists(), + "trim must remove the file of a trimmed image row" + ); + } + + #[test] + fn insert_image_propagates_write_failure_without_leaving_a_row() { + let (_guard, _dir, db) = open_test_db(); + // Replace the images dir with a regular file so create_dir_all fails. + let images_dir = data_dir().join("images"); + std::fs::create_dir_all(&images_dir).unwrap(); + std::fs::remove_dir_all(&images_dir).unwrap(); + std::fs::write(&images_dir, b"not a directory").unwrap(); + + let result = db.insert_image(b"png bytes", "image/png", CaptureSource::Clipboard); + assert!( + result.is_err(), + "a failed image write must surface as an error" + ); + assert!( + db.list_entries(10).unwrap().is_empty(), + "a failed image write must not leave a broken row behind" + ); + + std::fs::remove_file(&images_dir).unwrap(); + } + + #[test] + fn gc_orphaned_images_removes_unreferenced_but_keeps_referenced_files() { + let (_guard, _dir, db) = open_test_db(); + db.insert_image(b"png-a", "image/png", CaptureSource::Clipboard).unwrap(); + let referenced = db + .list_entries(10) + .unwrap() + .into_iter() + .next() + .unwrap() + .image_path + .unwrap(); + + // An orphan: an image file no history row references. Fake an old + // mtime so the age guard (which protects concurrent in-flight + // writes) doesn't skip it. + let orphan = data_dir().join("images/orphan.png"); + std::fs::write(&orphan, b"orphan").unwrap(); + let file = std::fs::File::options().write(true).open(&orphan).unwrap(); + let old = std::time::SystemTime::now() - Duration::from_secs(7200); + file.set_modified(old).unwrap(); + + db.gc_orphaned_images().unwrap(); + + assert!( + Path::new(&referenced).exists(), + "a referenced image must survive GC" + ); + assert!(!orphan.exists(), "an unreferenced image must be swept"); + } } From 83630033cd6275d9ab74146a30d40305404d26ff Mon Sep 17 00:00:00 2001 From: Breadway Date: Mon, 31 Aug 2026 15:07:22 +0800 Subject: [PATCH 2/4] breadclipd: watch-driven capture, flock singleton, ignore rules, pin verb MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Capture now keys off wl-paste's `CLIPBOARD_STATE`: `sensitive` (password manager via `wl-copy --sensitive`, covers the old x-kde-passwordManagerHint case) and `nil`/`clear` persist nothing; `data` reads the content off stdin in the same event, so the sensitive check and the read can't straddle a clipboard change. A manual `--capture-once` with no CLIPBOARD_STATE falls back to querying wl-paste directly, now wrapped in `timeout -k 2 5` so a stalled offer can't block a capture process forever. - Single-instance guard moves to `bread_utils::singleton` (flock) — kernel-atomic, auto-released on death, no stale pid file. - `ignore_rules::is_sensitive`: conservative best-effort heuristics that skip copies which look like secrets even when unflagged — PEM/OpenSSH private key blocks, `password:`-style lines, labelled one-time codes, Luhn-valid card numbers, well-known token prefixes. A convenience, not a security boundary. - `bread.command.clip.pin` verb (payload `{id, pin?}`, pin defaults true) → `set_pinned`, emits `bread.clip.pinned` / `.pin.failed`. - Two independent `wl-paste --watch` loops (regular clipboard always on; primary selection when `capture.primary`), each restarting with 2s→30s capped backoff and state-change-only journal logging. - Image type is sniffed from magic bytes (PNG/JPEG) on the stdin path and requested by actual offered type on the fallback path — a JPEG is stored as `.jpg` / `image/jpeg`, not relabelled PNG. - content_kind: a single line of prose that merely contains a keyword ("class is a concept") no longer classifies as code — it must look like a statement. --- breadclipd/src/content_kind.rs | 38 ++- breadclipd/src/ignore_rules.rs | 182 ++++++++++++++ breadclipd/src/main.rs | 441 +++++++++++++++++++++++++-------- contrib/breadclipd.service | 5 + 4 files changed, 555 insertions(+), 111 deletions(-) create mode 100644 breadclipd/src/ignore_rules.rs diff --git a/breadclipd/src/content_kind.rs b/breadclipd/src/content_kind.rs index fd27a98..4e882e3 100644 --- a/breadclipd/src/content_kind.rs +++ b/breadclipd/src/content_kind.rs @@ -105,12 +105,29 @@ fn looks_like_code(text: &str) -> bool { }) .count(); - // Multi-line with a meaningful fraction of "code-shaped" lines, or an - // unambiguous single-line token (import/#include/fn signature), counts - // as code. A single short line of prose won't hit either bar. - token_hits >= 2 - || (lines.len() > 1 && brace_or_semicolon_lines * 2 >= lines.len()) - || (lines.len() == 1 && token_hits >= 1 && text.len() < 200) + // Multi-line with a meaningful fraction of "code-shaped" lines, or a + // couple of code tokens anywhere, counts as code. + if lines.len() > 1 { + return token_hits >= 2 || brace_or_semicolon_lines * 2 >= lines.len(); + } + + // A single line only counts as code if it actually *looks* like a code + // statement — a prose sentence that merely contains a keyword ("let me + // show you", "function of time", "class is a concept") must stay plain. + if lines.len() == 1 && token_hits >= 1 && text.len() < 200 { + let trimmed = text.trim_start(); + let import_like = trimmed.starts_with("import ") || trimmed.starts_with("#include"); + let code_shaped = trimmed.ends_with('{') + || trimmed.ends_with('}') + || trimmed.ends_with(';') + || trimmed.ends_with('(') + || trimmed.ends_with(')') + || trimmed.contains("=>") + || (trimmed.contains('(') && trimmed.contains(')')) + || trimmed.contains(" = "); + return import_like || code_shaped; + } + false } #[cfg(test)] @@ -170,6 +187,15 @@ mod tests { assert_eq!(detect("import numpy as np"), "code"); } + #[test] + fn single_line_prose_containing_a_keyword_is_plain() { + assert_eq!(detect("let me show you something"), "plain"); + assert_eq!(detect("function of time"), "plain"); + assert_eq!(detect("class is a concept"), "plain"); + assert_eq!(detect("const means constant"), "plain"); + assert_eq!(detect("def is short for define"), "plain"); + } + #[test] fn plain_prose_is_plain() { assert_eq!( diff --git a/breadclipd/src/ignore_rules.rs b/breadclipd/src/ignore_rules.rs new file mode 100644 index 0000000..cca4df7 --- /dev/null +++ b/breadclipd/src/ignore_rules.rs @@ -0,0 +1,182 @@ +//! Best-effort content heuristics for never persisting obvious secrets. +//! +//! The password-manager path (`CLIPBOARD_STATE=sensitive` / the +//! `x-kde-passwordManagerHint` MIME type) only catches copies an app +//! deliberately flagged. These rules catch copies that *look* like secrets +//! even when the app didn't flag them — one-time codes, credit card +//! numbers, private keys, credential lines. They are deliberately +//! conservative (a false "skip" is cheaper than a leaked password) and they +//! are a convenience, not a security boundary: the 0600 file permissions +//! and 0700 data dir are the real protection. + +/// Would persisting this text be a bad idea? Skipped copies never reach the +/// database (or the event bus), like the password-manager path. +pub fn is_sensitive(text: &str) -> bool { + let trimmed = text.trim(); + if trimmed.is_empty() { + return false; + } + looks_like_private_key(trimmed) + || looks_like_credential_line(trimmed) + || looks_like_otp(trimmed) + || contains_card_number(trimmed) + || contains_api_token(trimmed) +} + +/// PEM/OpenSSH private key blocks (and PGP blocks, which are just as +/// sensitive). +fn looks_like_private_key(text: &str) -> bool { + text.contains("-----BEGIN") || text.contains("PRIVATE KEY") +} + +/// A line that labels a credential directly: `password: hunter2`, +/// `passwd = hunter2`, etc. +fn looks_like_credential_line(text: &str) -> bool { + let first = text.lines().next().unwrap_or("").trim().to_ascii_lowercase(); + const PREFIXES: [&str; 8] = [ + "password:", + "password =", + "password=", + "passwd:", + "passwd =", + "passwd=", + "pw:", + "pass:", + ]; + PREFIXES.iter().any(|p| first.starts_with(p)) +} + +/// A one-time code: a short copy that mentions a code keyword and contains +/// a 6–8 digit run. A *bare* 6-digit number is deliberately not flagged — +/// too many legitimate numbers have that shape. +fn looks_like_otp(text: &str) -> bool { + if text.len() > 60 { + return false; + } + let lower = text.to_ascii_lowercase(); + const LABELS: [&str; 8] = [ + "code", "otp", "verification", "verif", "2fa", "passcode", "one-time", "one time", + ]; + if !LABELS.iter().any(|k| lower.contains(k)) { + return false; + } + has_digit_run(text, 6, 8) +} + +/// Credit card numbers: 13–19 digit runs (allowing spaces/dashes between +/// groups) that pass the Luhn check. +fn contains_card_number(text: &str) -> bool { + let mut run = String::new(); + for c in text.chars() { + if c.is_ascii_digit() { + run.push(c); + } else if (c == ' ' || c == '-') && !run.is_empty() { + run.push(' '); // keep one run across group separators + } else { + if card_like(&run) { + return true; + } + run.clear(); + } + } + card_like(&run) +} + +fn card_like(run: &str) -> bool { + let digits: String = run.chars().filter(|c| c.is_ascii_digit()).collect(); + (13..=19).contains(&digits.len()) && luhn_valid(&digits) +} + +fn luhn_valid(digits: &str) -> bool { + let mut sum: u32 = 0; + let mut double = false; + for b in digits.bytes().rev() { + let mut d = (b - b'0') as u32; + if double { + d *= 2; + if d > 9 { + d -= 9; + } + } + sum += d; + double = !double; + } + sum.is_multiple_of(10) +} + +/// Well-known API token prefixes (OpenAI, GitHub, Slack, AWS access keys). +fn contains_api_token(text: &str) -> bool { + const PREFIXES: [&str; 7] = ["sk-", "sk-proj-", "ghp_", "gho_", "xoxb-", "xoxp-", "AKIA"]; + PREFIXES.iter().any(|p| text.contains(p)) +} + +fn has_digit_run(text: &str, min: usize, max: usize) -> bool { + let mut run = 0usize; + for c in text.chars() { + if c.is_ascii_digit() { + run += 1; + } else { + if run >= min && run <= max { + return true; + } + run = 0; + } + } + run >= min && run <= max +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn private_key_blocks_are_sensitive() { + assert!(is_sensitive( + "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEA..." + )); + assert!(is_sensitive("-----BEGIN PGP MESSAGE-----")); + } + + #[test] + fn credential_labeled_lines_are_sensitive() { + assert!(is_sensitive("password: hunter2")); + assert!(is_sensitive("Password = correct horse battery staple")); + assert!(is_sensitive("passwd=hunter2")); + } + + #[test] + fn labeled_one_time_codes_are_sensitive() { + assert!(is_sensitive("Your verification code is 483920")); + assert!(is_sensitive("483920 is your code")); + assert!(is_sensitive("OTP: 12345678")); + } + + #[test] + fn bare_numbers_are_not_sensitive() { + // A bare 6-digit number is too ambiguous to drop on purpose. + assert!(!is_sensitive("483920")); + assert!(!is_sensitive("The answer is 42")); + // A long random number that happens to be 16 digits but fails Luhn. + assert!(!is_sensitive("1234567890123456")); + } + + #[test] + fn luhn_valid_card_numbers_are_sensitive() { + assert!(is_sensitive("4111 1111 1111 1111")); + assert!(is_sensitive("card number: 4111-1111-1111-1111")); + } + + #[test] + fn api_token_prefixes_are_sensitive() { + assert!(is_sensitive("sk-proj-abc123def456")); + assert!(is_sensitive("ghp_1234567890abcdefghijklmnopqrstuvwxyz")); + assert!(is_sensitive("AKIAIOSFODNN7EXAMPLE")); + } + + #[test] + fn normal_prose_is_not_sensitive() { + assert!(!is_sensitive("just a normal sentence someone copied")); + assert!(!is_sensitive("here is the plan for next week")); + assert!(!is_sensitive("the password field in the form is empty")); + } +} diff --git a/breadclipd/src/main.rs b/breadclipd/src/main.rs index 012c6f1..981b0da 100644 --- a/breadclipd/src/main.rs +++ b/breadclipd/src/main.rs @@ -1,8 +1,11 @@ mod content_kind; +mod ignore_rules; use bread_utils::bread_client::BreadClient; -use breadclip_core::HistoryDb; -use std::{env, fs, path::PathBuf, process::Command, thread, time::Duration}; +use bread_utils::singleton::{try_acquire, Acquire}; +use breadclip_core::{CaptureSource, HistoryDb}; +use serde_json::Value; +use std::{env, io::Read, process::Command, thread, time::Duration}; /// This app's id in bread's sibling-app namespace registry /// (`bread_shared::apps::KNOWN_APPS`) — events are published as @@ -14,15 +17,52 @@ const APP_ID: &str = "clip"; /// needed for a single internal flag). const CAPTURE_FLAG: &str = "--capture-once"; +/// Second positional arg distinguishing a capture spawned by the primary- +/// selection watcher from one spawned by the regular-clipboard watcher. +const PRIMARY_FLAG: &str = "--primary"; + /// MIME type convention (originating with KDE's Klipper) that password /// managers such as KeePassXC and Bitwarden set on clipboard content they -/// own, signaling "don't persist this". Any offer advertising it is skipped -/// entirely. +/// own, signaling "don't persist this". Only reachable on the fallback +/// capture path — when invoked through `wl-paste --watch`, `CLIPBOARD_STATE` +/// carries the same information from the same event (see `capture_once`). const PASSWORD_HINT_MIME: &str = "x-kde-passwordManagerHint"; -fn get_available_types() -> Vec { - Command::new("wl-paste") - .args(["--list-types"]) +/// Build a `wl-paste` command with a hard deadline. Without the timeout, a +/// stalled selection offer (source app died mid-transfer, compositor never +/// completes the handoff) leaves `wl-paste` blocked forever reading a pipe +/// that never closes — and a forever-blocked fallback capture would eat a +/// file descriptor per event over a long session. `timeout -k` guarantees a +/// SIGKILL if the initial SIGTERM doesn't land. Only used by the manual +/// fallback path (`capture_via_wl_paste`); the `--watch` path reads the +/// content from stdin and so has nothing that can hang. +fn wl_paste_cmd(primary: bool) -> Command { + let mut cmd = Command::new("timeout"); + cmd.args(["-k", "2", "5", "wl-paste"]); + if primary { + cmd.arg("--primary"); + } + cmd +} + +/// `wl-paste --watch` sets this in the spawned command's environment for +/// every clipboard event (see wl-paste(1)): `data` (read the content from +/// stdin), `nil` (empty clipboard), `clear` (explicitly cleared), or +/// `sensitive` (a password manager flagged the selection). Unset or +/// unrecognized means we were not invoked by `--watch` (e.g. a manual +/// `--capture-once` run) and we fall back to querying wl-paste directly. +const CLIPBOARD_STATE: &str = "CLIPBOARD_STATE"; + +/// Open the history DB with the retention caps from the user's config. The +/// `--capture-once` processes run per clipboard event, so they load the +/// config fresh rather than inheriting anything from the long-lived daemon. +fn open_db() -> Result { + HistoryDb::open_with(breadclip_core::config::load().retention) +} + +fn get_available_types(primary: bool) -> Vec { + wl_paste_cmd(primary) + .arg("--list-types") .output() .ok() .filter(|o| o.status.success()) @@ -31,8 +71,16 @@ fn get_available_types() -> Vec { .unwrap_or_default() } -fn get_clipboard_text() -> Option { - let output = Command::new("wl-paste") +fn get_clipboard_bytes(mime: &str, primary: bool) -> Option> { + let output = wl_paste_cmd(primary).args(["--type", mime]).output().ok()?; + if !output.status.success() || output.stdout.is_empty() { + return None; + } + Some(output.stdout) +} + +fn get_clipboard_text(primary: bool) -> Option { + let output = wl_paste_cmd(primary) .args(["--no-newline", "--type", "text/plain"]) .output() .ok()?; @@ -44,48 +92,80 @@ fn get_clipboard_text() -> Option { .filter(|s| !s.trim().is_empty()) } -fn get_clipboard_image() -> Option> { - let output = Command::new("wl-paste") - .args(["--type", "image/png"]) - .output() - .ok()?; - if !output.status.success() || output.stdout.is_empty() { - return None; +/// Identify an image payload by its magic bytes. `wl-paste --watch` hands us +/// the content on stdin without saying which offered type it picked, so the +/// bytes are the only reliable signal — and they're exact, because watch +/// mode never appends a trailing newline. +fn sniff_image_mime(bytes: &[u8]) -> Option<&'static str> { + if bytes.starts_with(b"\x89PNG\r\n\x1a\n") { + return Some("image/png"); } - Some(output.stdout) + if bytes.starts_with(&[0xFF, 0xD8, 0xFF]) { + return Some("image/jpeg"); + } + None } -fn lock_file() -> PathBuf { - env::var("XDG_RUNTIME_DIR") - .map(PathBuf::from) - .unwrap_or_else(|_| PathBuf::from("/tmp")) - .join("breadclipd.lock") +fn source(primary: bool) -> CaptureSource { + if primary { + CaptureSource::Primary + } else { + CaptureSource::Clipboard + } } -// Returns false if another instance is already running. -fn acquire_lock() -> bool { - let path = lock_file(); - if let Ok(content) = fs::read_to_string(&path) { - if let Ok(pid) = content.trim().parse::() { - let alive = fs::read_to_string(format!("/proc/{}/comm", pid)) - .map(|s| s.trim() == "breadclipd") - .unwrap_or(false); - if alive { - eprintln!("breadclipd: already running (pid {})", pid); - return false; - } +fn store_text(text: &str, primary: bool) { + let db = match open_db() { + Ok(db) => db, + Err(e) => { + eprintln!("breadclipd: failed to open database: {e}"); + return; + } + }; + match db.insert_text(text, source(primary)) { + Ok(()) => emit_copied(content_kind::detect(text), text.len()), + Err(e) => eprintln!("breadclipd: insert text: {e}"), + } +} + +fn store_image(bytes: Vec, mime: &str, primary: bool) { + let db = match open_db() { + Ok(db) => db, + Err(e) => { + eprintln!("breadclipd: failed to open database: {e}"); + return; + } + }; + match db.insert_image(&bytes, mime, source(primary)) { + Ok(()) => emit_copied("image", bytes.len()), + Err(e) => eprintln!("breadclipd: insert image: {e}"), + } +} + +/// Capture path for `wl-paste --watch` invocations: the clipboard content +/// arrives on our stdin together with its `CLIPBOARD_STATE` in one event, so +/// the sensitive check and the data read can't race each other (two separate +/// `wl-paste` calls could straddle a clipboard change mid-capture). +fn capture_from_stdin(primary: bool) { + let mut buf = Vec::new(); + if std::io::stdin().read_to_end(&mut buf).is_err() || buf.is_empty() { + return; + } + if let Some(mime) = sniff_image_mime(&buf) { + store_image(buf, mime, primary); + } else if let Ok(text) = String::from_utf8(buf) { + if !text.trim().is_empty() && !ignore_rules::is_sensitive(&text) { + store_text(&text, primary); } } - let _ = fs::write(&path, std::process::id().to_string()); - true } -/// Invoked once per clipboard-change event (as the handler command for -/// `wl-paste --watch`). Reads whatever is on the clipboard right now, skips -/// it entirely if a password manager flagged it as sensitive, and otherwise -/// persists a text or image entry to the history DB. -fn capture_once() { - let types = get_available_types(); +/// Fallback capture path for manual `--capture-once` invocations (no +/// `CLIPBOARD_STATE` was set by wl-paste): ask wl-paste directly. Same +/// behavior as the stdin path, including requesting whichever image type is +/// actually offered rather than assuming PNG. +fn capture_via_wl_paste(primary: bool) { + let types = get_available_types(primary); if types.iter().any(|t| t == PASSWORD_HINT_MIME) { // Password manager (KeePassXC, Bitwarden, etc.) marked this copy as @@ -97,31 +177,42 @@ fn capture_once() { let has_image = types.iter().any(|t| t == "image/png" || t == "image/jpeg"); let has_text = types.iter().any(|t| t.starts_with("text/")); - let db = match HistoryDb::open() { - Ok(db) => db, - Err(e) => { - eprintln!("breadclipd: failed to open database: {e}"); - return; - } - }; - if has_image && !has_text { - if let Some(bytes) = get_clipboard_image() { - match db.insert_image(&bytes) { - Ok(()) => emit_copied("image", bytes.len()), - Err(e) => eprintln!("breadclipd: insert image: {e}"), - } + let mime = if types.iter().any(|t| t == "image/png") { + "image/png" + } else { + "image/jpeg" + }; + if let Some(bytes) = get_clipboard_bytes(mime, primary) { + store_image(bytes, mime, primary); } } else if has_text { - if let Some(text) = get_clipboard_text() { - match db.insert_text(&text) { - Ok(()) => emit_copied(content_kind::detect(&text), text.len()), - Err(e) => eprintln!("breadclipd: insert text: {e}"), + if let Some(text) = get_clipboard_text(primary) { + if !ignore_rules::is_sensitive(&text) { + store_text(&text, primary); } } } } +/// Invoked once per clipboard-change event (as the handler command for +/// `wl-paste --watch`). Stores a text or image entry to the history DB, +/// unless the selection was flagged as sensitive — in which case nothing is +/// ever persisted. +fn capture_once(primary: bool) { + match env::var(CLIPBOARD_STATE).as_deref() { + // Password manager (KeePassXC, Bitwarden, ...) flagged this selection + // as sensitive via `wl-copy --sensitive` — never persist it. + Ok("sensitive") => {} + // Empty clipboard (nil) or an explicit clear — nothing to store. + Ok("nil") | Ok("clear") => {} + Ok("data") => capture_from_stdin(primary), + // Unset or unrecognized: not invoked by `--watch`. Fall back to the + // direct wl-paste path rather than blocking on whatever stdin is. + _ => capture_via_wl_paste(primary), + } +} + /// Publishes `bread.clip.copied` into the bread event fabric. Fire-and-forget /// and non-fatal by design (`BreadClient::emit` never blocks or errors this /// caller) — breadd being absent or not installed must never affect @@ -134,19 +225,18 @@ fn emit_copied(kind: &str, len: usize) { ); } -/// Reacts to `bread.command.clip.*` verbs. Only `clear` maps to real, -/// existing breadclip functionality today — `pin`/`select` would need a new -/// "pinned" concept that doesn't exist anywhere in the history DB schema, -/// which is a real product decision for breadclip itself (does it want -/// pinning at all, and what would the GTK UI for it look like?), not -/// something to fabricate as a side effect of wiring up the event bus. See +/// Reacts to `bread.command.clip.*` verbs. Only `clear` and `pin` map to +/// real, existing breadclip functionality today — `select` would need a +/// "remote-activate a row" concept the popup doesn't expose over the bus, +/// which is a real product decision for breadclip itself, not something to +/// fabricate as a side effect of wiring up the event bus. See /// `breadclip/EVENTS.md` for the honest current status. /// -/// Emits `bread.clip..done`/`.failed` per the confirmation convention -/// in bread's Documentation.md — a module that started this command via -/// `bread.wait`/`bread.wait_any` can await the real outcome instead of -/// assuming success the moment it publishes the command. -fn handle_command(event_name: &str) { +/// Emits `bread.clip..done`/`bread.clip.pinned`/`.failed` per the +/// confirmation convention in bread's Documentation.md — a module that +/// started this command via `bread.wait`/`bread.wait_any` can await the real +/// outcome instead of assuming success the moment it publishes the command. +fn handle_command(event_name: &str, data: &Value) { let Some(verb) = event_name.strip_prefix("bread.command.clip.") else { return; }; @@ -164,22 +254,121 @@ fn handle_command(event_name: &str) { ); } }, + "pin" => match data.get("id").and_then(Value::as_i64) { + Some(id) => { + let pin = data.get("pin").and_then(Value::as_bool).unwrap_or(true); + match HistoryDb::open().and_then(|db| db.set_pinned(id, pin)) { + Ok(()) => { + eprintln!( + "breadclipd: {} entry {id} via bread.command.clip.pin", + if pin { "pinned" } else { "unpinned" } + ); + BreadClient::connect(APP_ID).emit( + "bread.clip.pinned", + serde_json::json!({ "id": id, "pinned": pin }), + ); + } + Err(e) => { + eprintln!("breadclipd: bread.command.clip.pin failed: {e}"); + BreadClient::connect(APP_ID).emit( + "bread.clip.pin.failed", + serde_json::json!({ "error": e.to_string() }), + ); + } + } + } + None => { + eprintln!("breadclipd: bread.command.clip.pin missing 'id'"); + BreadClient::connect(APP_ID).emit( + "bread.clip.pin.failed", + serde_json::json!({ "error": "missing 'id'" }), + ); + } + }, other => { eprintln!("breadclipd: ignoring unrecognized command verb '{other}'"); } } } +/// Backoff for the `wl-paste --watch` restart loops: 2s → 4s → 8s → 16s → +/// 32s, capped at 30s. A dead compositor keeps the daemon alive without +/// hammering either wl-paste or the journal. +fn restart_delay(consecutive_failures: u32) -> Duration { + Duration::from_secs((2u64 << consecutive_failures.saturating_sub(1).min(4)).min(30)) +} + +/// Log a watch-loop restart, but only on state changes — the first failure +/// announces it, then every 8th attempt. Otherwise a persistent failure +/// would spam the journal every two seconds forever. +fn log_restart(what: &str, detail: &str, attempt: u32) { + if attempt == 1 || attempt.is_multiple_of(8) { + eprintln!("breadclipd: {what} ({detail}), restarting (attempt {attempt})"); + } +} + +/// Runs one `wl-paste --watch` watcher for the daemon's whole lifetime, +/// restarting it with capped backoff whenever it exits (e.g. the compositor +/// connection dropped). `primary` selects the middle-click primary selection +/// watcher (`--watch --primary`) instead of the regular clipboard watcher. +fn watch_loop(exe: std::path::PathBuf, primary: bool) { + let label = if primary { + "wl-paste --watch (primary)" + } else { + "wl-paste --watch" + }; + let mut consecutive_failures: u32 = 0; + loop { + // `wl-paste --watch ` runs once per selection-change + // event instead of polling — zero idle cost between changes, and no + // forking wl-paste repeatedly. Each event re-invokes this same + // binary with --capture-once to do a single read-and-store pass. + let mut cmd = Command::new("wl-paste"); + cmd.arg("--watch"); + if primary { + cmd.arg("--primary"); + } + cmd.arg(&exe).arg(CAPTURE_FLAG); + if primary { + cmd.arg(PRIMARY_FLAG); + } + let status = cmd.status(); + + match status { + Ok(s) => { + consecutive_failures += 1; + log_restart(label, &format!("{s}"), consecutive_failures); + } + Err(e) => { + consecutive_failures += 1; + log_restart(label, &e.to_string(), consecutive_failures); + } + } + thread::sleep(restart_delay(consecutive_failures)); + } +} + fn main() { let args: Vec = env::args().collect(); if args.get(1).map(String::as_str) == Some(CAPTURE_FLAG) { - capture_once(); + capture_once(args.iter().any(|a| a == PRIMARY_FLAG)); return; } - if !acquire_lock() { - std::process::exit(1); - } + // flock(2)-based singleton (bread_utils::singleton): lock ownership is + // kernel-atomic and released automatically the instant this process + // dies, so there's no stale-pid-file case to reason about. + let _singleton = match try_acquire("breadclipd") { + Ok(Acquire::Acquired(guard)) => Some(guard), + Ok(Acquire::HeldByOther(pid)) => { + eprintln!("breadclipd: already running (pid {:?})", pid); + std::process::exit(1); + } + Err(e) => { + eprintln!("breadclipd: single-instance lock unavailable ({e}); continuing without it"); + None + } + }; // Wait briefly for WAYLAND_DISPLAY — common when started early in the session let mut retries = 0; @@ -189,14 +378,14 @@ fn main() { } if env::var("WAYLAND_DISPLAY").is_err() { eprintln!("breadclipd: WAYLAND_DISPLAY not set after waiting, exiting"); - let _ = fs::remove_file(lock_file()); std::process::exit(1); } + let cfg = breadclip_core::config::load(); + // Fail fast (before we start watching) if the DB can't be opened. - if let Err(e) = HistoryDb::open() { + if let Err(e) = HistoryDb::open_with(cfg.retention) { eprintln!("breadclipd: failed to open database: {e}"); - let _ = fs::remove_file(lock_file()); std::process::exit(1); } @@ -204,7 +393,6 @@ fn main() { Ok(p) => p, Err(e) => { eprintln!("breadclipd: could not resolve own executable path: {e}"); - let _ = fs::remove_file(lock_file()); std::process::exit(1); } }; @@ -219,29 +407,22 @@ fn main() { // delivering commands until it reconnects. let command_client = BreadClient::connect(APP_ID); let _commands = command_client.subscribe("bread.command.clip.**", |event| { - handle_command(&event.event); + handle_command(&event.event, &event.data); }); - // `wl-paste --watch ` runs once per clipboard-change event - // instead of polling — zero idle cost between changes, and no more - // forking wl-paste 4-6 times a second. Each event re-invokes this same - // binary with --capture-once to do a single read-and-store pass. - loop { - let status = Command::new("wl-paste") - .args(["--watch"]) - .arg(&exe) - .arg(CAPTURE_FLAG) - .status(); + // Regular-clipboard watcher, always on. + let clipboard_exe = exe.clone(); + thread::spawn(move || watch_loop(clipboard_exe, false)); + // Primary-selection watcher (middle-click), opt-in via config. + if cfg.capture_primary { + eprintln!("breadclipd: watching primary selection"); + thread::spawn(move || watch_loop(exe, true)); + } - match status { - Ok(s) => { - eprintln!("breadclipd: wl-paste --watch exited ({s}), restarting in 2s"); - } - Err(e) => { - eprintln!("breadclipd: failed to spawn wl-paste --watch: {e}, retrying in 2s"); - } - } - thread::sleep(Duration::from_secs(2)); + // The watcher threads own the daemon's lifetime; this thread just keeps + // the process (and the singleton guard above) alive. + loop { + thread::sleep(Duration::from_secs(3600)); } } @@ -267,6 +448,22 @@ mod tests { f(); } + #[test] + fn sniff_image_mime_detects_png_and_jpeg() { + assert_eq!(sniff_image_mime(b"\x89PNG\r\n\x1a\nrest"), Some("image/png")); + assert_eq!(sniff_image_mime(&[0xFF, 0xD8, 0xFF, 0xE0]), Some("image/jpeg")); + assert_eq!(sniff_image_mime(b"plain text"), None); + } + + #[test] + fn restart_delay_backs_off_and_caps() { + assert_eq!(restart_delay(1), Duration::from_secs(2)); + assert_eq!(restart_delay(2), Duration::from_secs(4)); + assert_eq!(restart_delay(3), Duration::from_secs(8)); + assert_eq!(restart_delay(4), Duration::from_secs(16)); + assert_eq!(restart_delay(100), Duration::from_secs(30)); + } + #[test] fn handle_command_clear_empties_history_even_with_no_daemon_reachable() { // The point of this test: handle_command's actual effect (clearing @@ -276,23 +473,57 @@ mod tests { // made contingent on the emit succeeding, this test would fail. with_isolated_history(|| { let db = HistoryDb::open().expect("open history db"); - db.insert_text("something to clear").unwrap(); + db.insert_text("something to clear", CaptureSource::Clipboard).unwrap(); assert_eq!(db.list_entries(10).unwrap().len(), 1); - handle_command("bread.command.clip.clear"); + handle_command("bread.command.clip.clear", &serde_json::json!({})); let db = HistoryDb::open().expect("reopen history db"); assert!(db.list_entries(10).unwrap().is_empty()); }); } + #[test] + fn handle_command_pin_toggles_pinned_state() { + with_isolated_history(|| { + let db = HistoryDb::open().expect("open history db"); + db.insert_text("to pin", CaptureSource::Clipboard).unwrap(); + let id = db.list_entries(10).unwrap()[0].id; + assert!(!db.list_entries(10).unwrap()[0].pinned); + + handle_command( + "bread.command.clip.pin", + &serde_json::json!({ "id": id, "pin": true }), + ); + assert!(db.list_entries(10).unwrap()[0].pinned); + + handle_command( + "bread.command.clip.pin", + &serde_json::json!({ "id": id, "pin": false }), + ); + assert!(!db.list_entries(10).unwrap()[0].pinned); + }); + } + + #[test] + fn handle_command_pin_without_id_is_a_no_op() { + with_isolated_history(|| { + let db = HistoryDb::open().expect("open history db"); + db.insert_text("untouched", CaptureSource::Clipboard).unwrap(); + + handle_command("bread.command.clip.pin", &serde_json::json!({})); + + assert!(!db.list_entries(10).unwrap()[0].pinned); + }); + } + #[test] fn handle_command_ignores_unrecognized_verb() { with_isolated_history(|| { let db = HistoryDb::open().expect("open history db"); - db.insert_text("should survive").unwrap(); + db.insert_text("should survive", CaptureSource::Clipboard).unwrap(); - handle_command("bread.command.clip.pin"); + handle_command("bread.command.clip.select", &serde_json::json!({})); let db = HistoryDb::open().expect("reopen history db"); assert_eq!( @@ -307,11 +538,11 @@ mod tests { fn handle_command_ignores_events_outside_its_own_command_namespace() { with_isolated_history(|| { let db = HistoryDb::open().expect("open history db"); - db.insert_text("should survive").unwrap(); + db.insert_text("should survive", CaptureSource::Clipboard).unwrap(); // Not a `bread.command.clip.*` event at all — must be a no-op. - handle_command("bread.command.pad.clear"); - handle_command("bread.clip.copied"); + handle_command("bread.command.pad.clear", &serde_json::json!({})); + handle_command("bread.clip.copied", &serde_json::json!({})); let db = HistoryDb::open().expect("reopen history db"); assert_eq!(db.list_entries(10).unwrap().len(), 1); diff --git a/contrib/breadclipd.service b/contrib/breadclipd.service index d206506..be5cb24 100644 --- a/contrib/breadclipd.service +++ b/contrib/breadclipd.service @@ -11,6 +11,11 @@ ExecStart=%h/.cargo/bin/breadclipd Restart=on-failure RestartSec=2 +# wl-paste/wl-copy live on the user's PATH (e.g. ~/.local/bin or +# ~/.cargo/bin via bakery/cargo install), which systemd user services don't +# inherit by default — without this, breadclipd starts but captures nothing. +Environment=PATH=%h/.local/bin:%h/.cargo/bin:/usr/local/bin:/usr/bin:/bin + # Forward stdout/stderr to the journal so `journalctl --user -u breadclipd` works StandardOutput=journal StandardError=journal From d308593efdc1069d27dd84b13143d26a99afc1f9 Mon Sep 17 00:00:00 2001 From: Breadway Date: Mon, 31 Aug 2026 15:07:35 +0800 Subject: [PATCH 3/4] breadclip: pin toggle, primary/pin badges, config-driven panel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Ctrl+P pins/unpins the selected row, re-reads history (pinned rows sort first), rebuilds the list and re-selects the toggled row. - ★ badge on pinned rows, "primary" badge on primary-selection rows. - Panel width comes from `config.panel_width`; positioning now runs after the panel is realised and measures its natural height instead of always assuming the worst-case estimate, so a short history gets a correctly-anchored short panel. - Delete in the search box edits the query again instead of deleting the selected history row. - Re-copy offers an image row as its stored MIME type (JPEG stays JPEG). History fetch is a flat cap since pinned rows can exceed retention. --- breadclip/src/main.rs | 234 +++++++++++++++++++++++++++++------------- 1 file changed, 160 insertions(+), 74 deletions(-) diff --git a/breadclip/src/main.rs b/breadclip/src/main.rs index 4d2858e..d2eb00a 100644 --- a/breadclip/src/main.rs +++ b/breadclip/src/main.rs @@ -18,11 +18,13 @@ use std::{ rc::Rc, }; -const PANEL_WIDTH: i32 = 520; -const MAX_ENTRIES: usize = 200; +// Pinned entries are exempt from trimming, so the fetch limit can't be +// derived from the retention caps alone. History stays tiny in practice — +// fetching it all keeps every pinned row reachable regardless of count. +const FETCH_ALL: usize = 10_000; const PANEL_GAP: i32 = 8; // gap between focused window bottom and panel top -// Worst-case panel height (search + chips + full-height list), used to keep -// the panel fully on-screen before its natural size is known. +// Fallback panel height, used only if measuring the panel before it's shown +// reports nothing sensible. const PANEL_HEIGHT_ESTIMATE: i32 = 580; #[derive(Clone, Copy, PartialEq)] @@ -142,6 +144,21 @@ fn build_row(entry: &ClipEntry) -> gtk4::ListBoxRow { hbox.append(&text_lbl); } + // Pin / primary-selection badges + if entry.pinned { + let pin_lbl = Label::new(Some("★")); + pin_lbl.add_css_class("clip-meta"); + pin_lbl.add_css_class("clip-pinned"); + pin_lbl.set_tooltip_text(Some("Pinned — Ctrl+P toggles")); + hbox.append(&pin_lbl); + } + if entry.is_primary { + let prim_lbl = Label::new(Some("primary")); + prim_lbl.add_css_class("clip-meta"); + prim_lbl.set_tooltip_text(Some("Copied from the primary (middle-click) selection")); + hbox.append(&prim_lbl); + } + let ts_lbl = Label::new(Some(&format_timestamp(entry.timestamp))); ts_lbl.add_css_class("clip-meta"); ts_lbl.set_xalign(1.0); @@ -153,31 +170,30 @@ fn build_row(entry: &ClipEntry) -> gtk4::ListBoxRow { } fn do_copy(entry: &ClipEntry) { - match entry.mime_type.as_str() { - "image/png" => { - if let Some(ref path) = entry.image_path { - if let Ok(file) = fs::File::open(path) { - let _ = Command::new("wl-copy") - .args(["--type", "image/png"]) - .stdin(Stdio::from(file)) - .stdout(Stdio::null()) - .stderr(Stdio::null()) - .spawn(); - } - } - } - _ => { - if let Some(ref content) = entry.content { - if let Ok(mut child) = Command::new("wl-copy") - .stdin(Stdio::piped()) + if entry.mime_type.starts_with("image/") { + // Re-paste with the same type we stored — a JPEG row must be offered + // as image/jpeg, not relabeled as image/png. + if let Some(ref path) = entry.image_path { + if let Ok(file) = fs::File::open(path) { + let _ = Command::new("wl-copy") + .args(["--type", entry.mime_type.as_str()]) + .stdin(Stdio::from(file)) .stdout(Stdio::null()) .stderr(Stdio::null()) - .spawn() - { - if let Some(mut stdin) = child.stdin.take() { - let _ = stdin.write_all(content.as_bytes()); - } - } + .spawn(); + } + } + return; + } + if let Some(ref content) = entry.content { + if let Ok(mut child) = Command::new("wl-copy") + .stdin(Stdio::piped()) + .stdout(Stdio::null()) + .stderr(Stdio::null()) + .spawn() + { + if let Some(mut stdin) = child.stdin.take() { + let _ = stdin.write_all(content.as_bytes()); } } } @@ -186,6 +202,13 @@ fn do_copy(entry: &ClipEntry) { // ---- UI --------------------------------------------------------------------- fn run_ui(entries: Vec, screenshot_req: Option) { + // Live snapshot of the entries backing the list — pinning re-reads the + // DB (pinned rows sort first) and rebuilds the rows from this. Built + // outside connect_activate because that handler is `Fn` (runs once per + // activation) and can't consume the entries vector. + let entries_rc: Rc>> = + Rc::new(std::cell::RefCell::new(entries)); + let mut builder = Application::builder().application_id("com.breadway.breadclip"); if screenshot_req.is_some() { // GApplication is single-instance by default; this machine typically @@ -205,52 +228,10 @@ fn run_ui(entries: Vec, screenshot_req: Option= PANEL_HEIGHT_ESTIMATE || space_below >= space_above { - win.y() + win.height() + PANEL_GAP - } else { - win.y() - PANEL_GAP - PANEL_HEIGHT_ESTIMATE - }; - let clamped_top = top - .min(mon_y + mon_h - PANEL_HEIGHT_ESTIMATE - PANEL_GAP) - .max(mon_y + PANEL_GAP); - - panel.set_halign(gtk4::Align::Start); - panel.set_valign(gtk4::Align::Start); - panel.set_margin_top(clamped_top); - panel.set_margin_start(clamped_left); - } else { - panel.set_halign(gtk4::Align::Center); - panel.set_valign(gtk4::Align::Center); - } + panel.set_size_request(panel_width, -1); // ---- Search entry ---- let search = SearchEntry::new(); @@ -286,7 +267,7 @@ fn run_ui(entries: Vec, screenshot_req: Option, screenshot_req: Option 0 { + natural_h + } else { + PANEL_HEIGHT_ESTIMATE + }; + + // If a non-fullscreen window is focused, anchor the panel just below it. + // Otherwise, centre the panel on screen. + let active_win = bread_utils::hypr::active_window(); + let monitor = bread_utils::hypr::focused_monitor(); + if let Some(ref win) = active_win { + let (mon_x, mon_y, mon_w, mon_h) = monitor + .as_ref() + .map(|m| (m.x, m.y, m.width, m.height)) + .unwrap_or((0, 0, 1920, 1080)); + + // Clamp horizontally so the panel never runs off the left/right + // edge of the focused monitor. + let clamped_left = win + .x() + .min(mon_x + mon_w - panel_width - PANEL_GAP) + .max(mon_x + PANEL_GAP); + + // Prefer anchoring below the window, but flip above it when there + // isn't enough room underneath (e.g. a maximized/tiled window + // with a text box near the bottom of the screen) — otherwise the + // panel gets pushed off-screen and never becomes visible. + let space_below = (mon_y + mon_h) - (win.y() + win.height() + PANEL_GAP); + let space_above = win.y() - mon_y - PANEL_GAP; + let top = if space_below >= panel_height || space_below >= space_above { + win.y() + win.height() + PANEL_GAP + } else { + win.y() - PANEL_GAP - panel_height + }; + let clamped_top = top + .min(mon_y + mon_h - panel_height - PANEL_GAP) + .max(mon_y + PANEL_GAP); + + panel.set_halign(gtk4::Align::Start); + panel.set_valign(gtk4::Align::Start); + panel.set_margin_top(clamped_top); + panel.set_margin_start(clamped_left); + } else { + panel.set_halign(gtk4::Align::Center); + panel.set_valign(gtk4::Align::Center); + } + // ---- Shared state ---- let query_rc: Rc> = Rc::new(std::cell::RefCell::new(String::new())); let filter_rc: Rc> = Rc::new(Cell::new(Filter::All)); @@ -349,7 +384,11 @@ fn run_ui(entries: Vec, screenshot_req: Option { @@ -366,6 +405,11 @@ fn run_ui(entries: Vec, screenshot_req: Option { + // Deleting a character in the search box must not + // delete the selected history row. + if search_k.has_focus() { + return glib::Propagation::Proceed; + } if let Some(row) = list_k.selected_row() { if let Some(entry) = get_row_entry(&row) { if let Ok(db) = HistoryDb::open() { @@ -394,6 +438,48 @@ fn run_ui(entries: Vec, screenshot_req: Option { + if let Some(row) = list_k.selected_row() { + if let Some(entry) = get_row_entry(&row) { + if let Ok(db) = HistoryDb::open() { + let _ = db.set_pinned(entry.id, !entry.pinned); + } + let target_id = entry.id; + let new_entries = HistoryDb::open() + .and_then(|db| db.list_entries(FETCH_ALL)) + .unwrap_or_default(); + *entries_k.borrow_mut() = new_entries; + while let Some(r) = list_k.row_at_index(0) { + list_k.remove(&r); + } + { + let rows = entries_k.borrow(); + for e in rows.iter() { + list_k.append(&build_row(e)); + } + } + let query = query_k.borrow().clone(); + refresh_list(&list_k, &query, filter_k.get()); + // Prefer re-selecting the row we just toggled. + let mut i = 0; + while let Some(r) = list_k.row_at_index(i) { + if get_row_entry(&r) + .map(|e| e.id == target_id) + .unwrap_or(false) + && r.is_visible() + { + list_k.select_row(Some(&r)); + break; + } + i += 1; + } + } + } + glib::Propagation::Stop + } _ => glib::Propagation::Proceed, } }); @@ -465,7 +551,7 @@ fn main() { }; let entries = HistoryDb::open() - .and_then(|db| db.list_entries(MAX_ENTRIES)) + .and_then(|db| db.list_entries(FETCH_ALL)) .unwrap_or_default(); run_ui(entries, screenshot_req); From 6db4a960261b59aa2f7442a32a604cd4bb84f325 Mon Sep 17 00:00:00 2001 From: Breadway Date: Mon, 31 Aug 2026 15:07:35 +0800 Subject: [PATCH 4/4] breadclip: document pin verb, config file, and ignore rules MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - EVENTS.md: `bread.command.clip.pin` and `bread.clip.pinned` / `.pin.failed` are now implemented; `select` stays explicitly not implemented with the reason. AGENTS.md follows. - README: Configuration section, Ctrl+P bind, updated privacy notes (CLIPBOARD_STATE + ignore rules), JPEG image entries, primary badge. - check.yml also runs on pushes to `main` — a push to main triggers a dev-track release build, so it should be linted/tested first. - release.yml uses `${GITHUB_REPOSITORY}` instead of a hard-coded `Breadway/breadclip` for the GitHub mirror release upload. --- .forgejo/workflows/check.yml | 7 ++++--- .forgejo/workflows/release.yml | 4 ++-- AGENTS.md | 14 ++++++++------ EVENTS.md | 32 +++++++++++++++++++++----------- README.md | 32 +++++++++++++++++++++++++++++--- contrib/config.toml.example | 24 ++++++++++++++++++++++++ 6 files changed, 88 insertions(+), 25 deletions(-) create mode 100644 contrib/config.toml.example diff --git a/.forgejo/workflows/check.yml b/.forgejo/workflows/check.yml index b547c34..fbbf1a1 100644 --- a/.forgejo/workflows/check.yml +++ b/.forgejo/workflows/check.yml @@ -1,10 +1,11 @@ name: check -# Fast-fail lint/test on short-lived work branches, before it ever reaches -# main and triggers a dev-track release build. +# Fast-fail lint/test on short-lived work branches, and on `main` itself — +# a push to main immediately triggers a dev-track release build, so it +# should be linted/tested first, not shipped unchecked. on: push: - branches: ['feature/**', 'fix/**'] + branches: ['feature/**', 'fix/**', 'main'] jobs: check: diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml index 0105b92..f8b8290 100644 --- a/.forgejo/workflows/release.yml +++ b/.forgejo/workflows/release.yml @@ -64,9 +64,9 @@ jobs: set -euo pipefail VERSION="${GITHUB_REF_NAME#v}" PKG_DIR="/srv/breadway-dl/breadclip/${VERSION}" - gh release create "${GITHUB_REF_NAME}" --repo Breadway/breadclip \ + gh release create "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" \ --title "breadclip v${VERSION}" --generate-notes 2>/dev/null || true - gh release upload "${GITHUB_REF_NAME}" --repo Breadway/breadclip \ + gh release upload "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" \ "${PKG_DIR}/breadclip-x86_64" \ "${PKG_DIR}/breadclipd-x86_64" \ "${PKG_DIR}/breadclip-x86_64.sha256" \ diff --git a/AGENTS.md b/AGENTS.md index dc7aab5..f5e1185 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -51,12 +51,14 @@ Three crates: through `bread-screenshots`; do not rewrite it just to retarget the crate pin. `EVENTS.md` is the bread-event contract. App id `clip`. Implemented: -`bread.clip.copied`, `bread.clip.clear.done`/`.failed`, and command -`bread.command.clip.clear`. There is no pin/select — the history schema has -no pinned column and the popup has no pin UI. Do not invent -`bread.command.clip.pin`/`.select` (or matching events) ahead of a real -product feature. +`bread.clip.copied`, `bread.clip.clear.done`/`.failed`, +`bread.clip.pinned`/`bread.clip.pin.failed`, and commands +`bread.command.clip.clear` and `bread.command.clip.pin`. Pinning is real: +the history schema has a `pinned` column, the popup has a Ctrl+P toggle, and +trim exempts pinned rows. There is no `select` — the popup is a transient +process with no resident service to receive `bread.command.clip.select`; +do not invent it (or `bread.clip.selected`) ahead of a real product feature. ## Don't - Don't embed credentials in remote URLs — SSH or a credential helper only. -- Don't invent pin/select on the event bus. See `EVENTS.md`. +- Don't invent `select` on the event bus. See `EVENTS.md`. diff --git a/EVENTS.md b/EVENTS.md index 0a5e520..f84061f 100644 --- a/EVENTS.md +++ b/EVENTS.md @@ -21,6 +21,8 @@ per-clipboard-change process invocation, not inside a persistent loop). | `bread.clip.copied` | `{ "kind": "url" \| "error" \| "code" \| "path" \| "plain", "len": }` | Every successful clipboard capture (text or image — images always get `kind: "image"`). `kind` is a heuristic classification (see `breadclipd/src/content_kind.rs`), not a guarantee — don't build a security decision on it. | | `bread.clip.clear.done` | `{}` | `bread.command.clip.clear` was received and history was successfully cleared. | | `bread.clip.clear.failed` | `{ "error": "" }` | `bread.command.clip.clear` was received but clearing failed (e.g. DB error). | +| `bread.clip.pinned` | `{ "id": , "pinned": true \| false }` | An entry was pinned or unpinned — either via `bread.command.clip.pin`, or locally from the popup's Ctrl+P toggle (which updates the DB directly; see below). | +| `bread.clip.pin.failed` | `{ "error": "" }` | `bread.command.clip.pin` was received but pinning failed (e.g. DB error, or the command was missing its `id`). | Content is never included in the payload — only its detected kind and length. History (including the actual copied content) stays local to breadclip's own SQLite database; the event bus is for *notifications about* clipboard activity, not a channel for clipboard content itself. @@ -28,19 +30,27 @@ Content is never included in the payload — only its detected kind and length. | Verb | Effect | |------|--------| -| `clear` | Deletes all clipboard history (text entries and stored image files). Emits `bread.clip.clear.done`/`.failed`. | +| `clear` | Deletes all clipboard history (text entries, stored image files, pinned entries — it's a hard reset). Emits `bread.clip.clear.done`/`.failed`. | +| `pin` | Payload `{ "id": , "pin": true \| false }`. Pins or unpins a history entry by id; `pin` defaults to `true` if omitted. Emits `bread.clip.pinned`/`bread.clip.pin.failed`. | -### Not implemented: `pin` / `select` +Pinned entries are exempt from the daemon's trimming and sort to the top of +the history list. The popup's Ctrl+P toggle writes the same `pinned` column +directly (it doesn't round-trip through the bus), and also emits +`bread.clip.pinned`, so automation can observe either path. Entry `id`s come +from `list_entries` — there is currently no read API on the bus for the +history contents. -An earlier draft of this integration planned `pin`/`select` verbs, but -breadclip's history schema has no "pinned" concept at all today — there's no -column for it, and the GTK popup UI has no corresponding affordance. Adding -real pin/select support is a product decision for breadclip itself (does it -want pinning, and what should the UI look like?), not something to fabricate -as a side effect of wiring up the event bus. If/when breadclip grows that -feature, the corresponding `bread.command.clip.pin`/`.select` verbs (and -matching `bread.clip.pinned`/`.selected` events) should be added at the same -time, not stubbed out ahead of it. +### Not implemented: `select` + +`select` (remote-activate a row from the bus, e.g. "paste entry 42 now") +is still deliberately not implemented: the popup is a short-lived process +with no resident service to receive that command, and the daemon has no +reason to talk to a transient popup. That's a real product decision for +breadclip itself — what should "select from the bus" even mean when the +popup isn't open? — not something to fabricate as a side effect of wiring +up the event bus. When breadclip grows that feature, the matching +`bread.command.clip.select` verb and `bread.clip.selected` event should be +added at the same time. ## Fail-safe behavior diff --git a/README.md b/README.md index debe88b..2ddf262 100644 --- a/README.md +++ b/README.md @@ -77,6 +77,7 @@ Running `breadclip` a second time while it is open closes it (toggle behaviour). | `Up` / `Down` | Move selection | | `Enter` | Copy selected entry to clipboard and close | | `Delete` | Remove selected entry from history | +| `Ctrl+P` | Pin/unpin selected entry (pinned entries survive trimming and sort to the top) | | `Escape` | Close without copying | Clicking an entry copies it and closes the popup. Clicking outside the panel closes it. @@ -85,6 +86,25 @@ Clicking an entry copies it and closes the popup. Clicking outside the panel clo The popup has three filter chips — **All**, **Text**, **Images** — and a search box. The search box filters text entries by content; image entries only appear under the **Images** filter. +## Configuration + +Optional TOML config at `$XDG_CONFIG_HOME/breadclip/config.toml` (typically +`~/.config/breadclip/config.toml`). Every key has a sensible default, so the +file can be omitted entirely — a copy of the full example lives in +`contrib/config.toml.example`: + +```toml +[retention] +text = 200 # max non-pinned text entries (0 = keep none) +images = 50 # max non-pinned image entries (0 = keep none) + +[panel] +width = 520 # popup panel width, px + +[capture] +primary = false # also watch the middle-click primary selection +``` + ## Data storage History is stored under `$XDG_DATA_HOME/breadclip/` (typically `~/.local/share/breadclip/`): @@ -92,14 +112,20 @@ History is stored under `$XDG_DATA_HOME/breadclip/` (typically `~/.local/share/b | Path | Contents | |------|----------| | `history.db` | SQLite database of all entries | -| `images/` | PNG files for image entries | +| `images/` | PNG/JPEG files for image entries | -The daemon keeps at most 200 text entries and 50 image entries, trimming oldest entries automatically. +The daemon trims the oldest non-pinned entries automatically, keeping at +most `retention.text` text entries and `retention.images` image entries +(defaults 200 and 50; configurable). **Pinned entries are exempt from +trimming** and sort to the top of the popup. Entries captured from the +primary (middle-click) selection — when `capture.primary = true` — are +stored alongside regular clipboard entries with a `primary` badge. ### Privacy - `history.db` and every file under `images/` are created with `0600` permissions (owner read/write only), regardless of your umask. -- breadclipd **never persists clipboard content flagged as sensitive by a password manager**. If a clipboard offer advertises the `x-kde-passwordManagerHint` MIME type — the convention used by KeePassXC, Bitwarden, and other password managers to mark content they own — that copy is skipped entirely and never reaches the database. +- breadclipd **never persists clipboard content flagged as sensitive**. `wl-paste --watch` reports copies made with `wl-copy --sensitive` — which also covers offers advertising the `x-kde-passwordManagerHint` MIME type, the convention used by KeePassXC, Bitwarden, and other password managers to mark content they own — via `CLIPBOARD_STATE=sensitive`, and those copies are skipped entirely and never reach the database. +- On top of that, breadclipd runs **best-effort ignore rules** that skip copies that *look* like secrets even when the app didn't flag them: one-time codes, Luhn-valid credit card numbers, private key blocks, `password:`-style credential lines, and well-known API token prefixes (see `breadclipd/src/ignore_rules.rs`). These are deliberately conservative and are a convenience, not a security boundary — the 0600/0700 permissions are the real protection. - That said, this is still a plaintext SQLite database of everything else you copy. Anything copied by an app that doesn't set the hint (e.g. copying a password from a terminal or a non-integrated app) will be stored like any other text entry. Treat `history.db` as sensitive, and don't rely on it as your only safeguard. ## Theming diff --git a/contrib/config.toml.example b/contrib/config.toml.example new file mode 100644 index 0000000..69b8928 --- /dev/null +++ b/contrib/config.toml.example @@ -0,0 +1,24 @@ +# breadclip configuration — copy to +# $XDG_CONFIG_HOME/breadclip/config.toml (usually ~/.config/breadclip/config.toml) +# +# Every key is optional; a missing file, missing key, or out-of-range value +# falls back to the default shown here. A config file that fails to parse is +# backed up to config.toml.bak once before defaults are used. + +[retention] +# Max non-pinned entries kept per kind; the oldest are trimmed automatically. +# 0 means "keep no (unpinned) entries of this kind". Pinned entries are never +# trimmed, regardless of these caps. +text = 200 +images = 50 + +[panel] +# Popup panel width in pixels. +width = 520 + +[capture] +# Also watch the middle-click "primary" selection (wl-paste --watch --primary) +# and store those entries alongside regular clipboard entries with a +# "primary" badge. Off by default because primary selections tend to be +# transient and noisy. +primary = false