breadcrumbs now speaks `org.freedesktop.NetworkManager` on the system
bus directly (new `zbus` dependency) — no `nmcli` subprocesses for
connect, scan, status, or the watch loop.
Why:
- Wi-Fi PSKs and 802.1x passwords no longer touch a command line. They
travel inside `AddAndActivateConnection2` / `Update2` settings
payloads, so they are never visible to other local users via
`/proc/<pid>/cmdline`. This fully supersedes the earlier
"feed the PSK to `nmcli --ask` on stdin" approach.
- The watch loop reacts to real `Device.StateChanged` / connectivity
signals instead of parsing `nmcli monitor` text.
- Connect waits on the device actually reaching the ACTIVATED state
rather than trusting `nmcli --wait`.
Config: `settings.nmcli_wait` is renamed to `connect_wait`; the old key
is still accepted via `#[serde(alias)]`. `status.rs` loses its private
`ipv4()` nmcli helper in favour of `nm::ipv4_address`. `util::run_with_stdin`
stays (tailscale still uses it) but no longer carries secrets.
The watch loop could spin forever on a stopped Tailscale daemon (the
auto-start path was unreachable) while re-notifying every retry, report
"connected" when NM autoconnect won a race onto a different SSID, and
classify captive portals as healthy (200/302 accepted as internet). The
bread-bus subscription thread also read/wrote config and state files
concurrently with the watch loop. Fix all of those plus: EDITOR values
with arguments, scan --to silently ignoring unknown profiles, deleted
core profiles being resurrected, inline-network migration data loss,
login never retried, XDG-unaware install-service, detect persisting a
stale default profile, password length leaking through the mask, a
stdin/stdout pipe deadlock, and several minor UI/robustness issues.
Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
First connect (and reuse-with-password) no longer puts the secret on
nmcli's command line, so it is not visible in /proc/<pid>/cmdline.
networks.toml stays 0600; the local copy is still cleared after first
success.
The watch daemon publishes bread.crumbs.profile.changed and
bread.crumbs.health.changed on real transitions (not every poll tick)
and honors bread.command.crumbs.set_profile via the existing
state::set_profile path. BreadClient is fail-silent: if breadd is
down, breadcrumbs behaves exactly as before.
Document the contract in EVENTS.md. CLAUDE.md now points at
CONTRIBUTING (single-trunk, no three-branch model), bakery, and
EVENTS.md.
Adds ci/build.sh + ci/bread-ecosystem.rev (pinned to bread-ecosystem
147cfbb) following the pattern proven in breadpad, so releases build
inside the shared pinned container instead of installing toolchain
deps directly on the bare runner. Routes dev/rc/release build+test
steps through it and adds a check.yml for fast clippy/test feedback
on feature/fix branches. No ci/deps.txt — breadcrumbs' dependencies
(clap/serde/toml/serde_json) are pure Rust with no system library
needs; nmcli/tailscale/sudo/xdg-open are shelled out to, not linked.
Replaces the dev/beta branch split with one trunk (main): dev-track
builds still publish on every push, but the beta track now publishes
from a vX.Y.Z-rc.N prerelease tag instead of a separately-maintained
beta branch. Removes the branch nobody reliably kept in sync.
bakery already fully covers what the PKGBUILD provided (binary, systemd
--user service where applicable, dependency declarations) except a LICENSE
copy, which bakery.toml's new license_file field now closes. Removes
packaging/arch/ and .forgejo/workflows/package.yml; adds the LICENSE
artifact to each release/dev-release/beta-release workflow's prepare
step. Not pacman-installed inside BOS today (BOS already consumes these
apps exclusively via build-local.sh's skel-staging), so this only removes
the option to `pacman -S` outside of BOS/bakery.
Documents the dev/beta/main branch and release-track workflow shared
across the bread ecosystem. See bread-ecosystem's docs/release-channels.md
for the full policy this implements.
Beta is now a real stabilization branch: publishes on every push to
`beta` (mirroring dev's model, auto-versioned X.Y.Z-beta.<ts>+<sha>,
base version from the latest published tag) instead of a manual
beta-v* tag. Fixes made during the freeze land via fix/<issue> branches
merged into `beta` directly. The gen-index.sh clone for beta pulls
bread-ecosystem's default branch (main) rather than pinning to dev,
since beta is the more stable track and main now carries the
TRACK-aware script.
Cargo.toml can drift stale relative to the actual last release (observed
on breadbox/breadpad/breadcrumbs/breadpaper), which made the auto-bumped
dev version sort as OLDER than what's already installed — bakery's semver
check correctly refused those "updates". Deriving the base version from
git ls-remote --tags instead is self-healing regardless of Cargo.toml
drift, with a Cargo.toml fallback only for a repo with no tags yet.
The fixed /tmp/bread-ecosystem-ci path races when multiple repos' dev/beta
workflows run close together on the same self-hosted runner — one job's
rm -rf/clone can stomp another's in-progress checkout, causing the
regenerate-index step to fail intermittently. Switch to mktemp -d.
Adds dev-release.yml (publishes on every push to dev) and beta-release.yml
(publishes on a beta-v* tag), mirroring the pattern landing in
bread-ecosystem/bread. See bread-ecosystem/docs/release-channels.md for
the three-track policy.
Bug fixes:
- mask() panicked on multi-byte UTF-8 passwords (byte-slicing a char
boundary); now masks by char count and never echoes a real character
- `cd --shell` interpolated the config path into a shell -c string via
Debug formatting, which doesn't neutralize shell metacharacters; now
passed as a positional shell argument instead
- connecting to open (no-password) networks failed because an empty PSK
was always sent to nmcli, which nmcli treats as secured-with-no-password
instead of open; the password arg is now omitted entirely when empty
- five nmcli terse-output parse sites used a raw splitn(2, ':'), which
mis-splits any device/connection name containing a literal ':'; unified
on the existing escape-aware field splitter
- watch's health classifier silently read a config-deleted profile as
"healthy" off a bare internet check instead of surfacing the misconfig
- the nmcli-monitor thread seeded its debounce clock with
`Instant::now() - 10s`, which panics on the monotonic clock near boot —
exactly when the generated systemd unit tends to start the watcher
Architecture:
- extracted src/lib.rs + src/app.rs so command logic can be exercised
in-process by tests instead of only by spawning the compiled binary
- added a Runner trait (src/util.rs) so subprocess calls can be faked in
tests; flow::run and watch::classify are now covered by real in-process
tests of the connect state machine and health transitions, not just
their pure helpers
- Wi-Fi passwords are no longer kept in breadcrumbs' config once
NetworkManager durably holds them: NetworkDef.password is now optional,
and a successful password-based connect clears + persists it
immediately, so it's never sent again on subsequent connects
- saved networks (SSID + optional local password) moved out of
breadcrumbs.toml into a separate networks.toml; old configs with
inline [[networks]] still load and migrate automatically on next save
- corrected a false README claim that passwords are never in nmcli argv
Test count: 20 -> 89 (52 unit, 24 CLI integration, 13 in-process
state-machine tests). Full clean run: cargo build/build --release/
test/clippy --all-targets, verified from a `cargo clean` rebuild.
- packaging/arch/PKGBUILD: builds and publishes breadcrumbs to [breadway] repo
- .forgejo/workflows/mirror.yml: mirrors every push/tag to GitHub
- .forgejo/workflows/package.yml: builds on tag, publishes to Forgejo registry
Requires FORGEJO_TOKEN and GITHUB_MIRROR_TOKEN secrets in Forgejo.
Core WiFi management works without Tailscale. tailscale, sudo, and
xdg-utils are only needed for Tailscale login and URL-open features,
so they become optional (warn, don't block) instead of required.
- bakery.toml: describes breadcrumbs for bakery install
- release.yml: builds on hestia self-hosted runner, publishes binary to
dl.breadway.dev and GitHub Releases on v* tags
- flow.rs/nm.rs: connect_and_verify now returns Result<(), String> with
a descriptive error message instead of a bare bool
