[onyxhq-dev]

The Bridge side of custom games and Logitech game profile buttons in the OpenMouse app.

• Custom games. A game added by hand (its name and executables) is stored in the Bridge config, apart from the catalog, and tracked like any listed game. Names and executables are normalized, and the list is capped (200 games, 80 characters per name, 20 executables per game).
• Side button assignments. A game profile can assign a Logitech mouse's Back and Forward buttons to a key (with modifiers) or a media key. While that profile is active, the Node helper native-hid/src/button-listener.mjs reports button changes and Bridge presses the assigned key. An unassigned side button keeps its normal click. The default profile can carry Host buttons too.
• Key presses on all three systems. Windows uses SendInput. Linux uses a virtual keyboard and mouse through /dev/uinput, which works on X11 and Wayland. macOS posts CoreGraphics events and asks for the Accessibility permission. Media keys are not pressed on macOS yet. install-linux.sh adds a udev rule for /dev/uinput and loads the uinput module at boot; the uninstall removes both.
• Custom game pictures. Upload one (PNG, JPEG or WebP, up to 512 KB) or paste a link. Link downloads accept public http and https addresses only, check every redirect, connect to the checked addresses, cap size (12 MB) and time (10 s), and allow two at a time. Both image routes send X-Content-Type-Options: nosniff.

Tests: cargo test passes, including new tests for the config limits, the image routes, the address checks and the key tables. The new Linux and macOS modules compile for x86_64-unknown-linux-gnu and aarch64-apple-darwin.

Checked by hand: the Windows listener works (bunny hop and the default Back and Forward mapping included). The Linux key injection was run on a real Linux 6.8 kernel and delivered the expected key and button events. Not tested: a Linux desktop (X11 or Wayland) and macOS, so those need someone to try them.

Draft because the listener needs a protocol release with the button listener (OpenMouse-Project/mouse-protocol#246). Once that is released, native-hid/package.json should be bumped to it. Until then the listener reports that it is unavailable and does nothing.

Note

Add custom games, profile-driven side buttons, and custom game images

• Adds a persisted custom_games config collection with shared normalization and size limits; tracked_games merges custom games with catalog games, and catalog names win collisions in config.rs
• Adds HTTP endpoints for custom games and their images: GET/PUT /v1/custom-games, GET/PUT /v1/custom-games/image, GET /v1/custom-games/image-from-url, and GET /v1/default-profile in api.rs
• Stores custom game images as PNG, JPEG, or WebP up to 512 KiB under a stable hashed filename next to the config file, and prunes images for removed games in service.rs
• Adds SSRF-safe remote image fetch: DNS results must be public addresses, redirects are followed manually with re-validation, and downloads are capped at 12 MiB with a 10s timeout in remote_image.rs
• Adds a Logitech side-button listener driven by the active profile: buttons.Assignments::from_profile parses hostButtons, a Node.js helper (button-listener.mjs) reports button masks, and platform injectors emit key, media, and side-button events on Windows (SendInput), Linux (uinput), and macOS (CoreGraphics) in buttons.rs
• Risk: behavioral changes — BridgeService.games and snapshot now return tracked games (catalog plus custom) instead of catalog only; the monitor suppresses button updates while a HID client session is active; unsupported operating systems log but do not inject button events; Linux installs now add a udev rule and module-load config for /dev/uinput in install-linux.sh

📊 Macroscope summarized 3ea9f42. 16 files reviewed, 8 issues evaluated, 1 issue filtered, 7 comments posted

🗂️ Filtered Issues

src/buttons.rs — 3 comments posted, 4 evaluated, 1 filtered

• line 568: Overlapping assignments release keys still held by the other button. For example, assign Back=Ctrl+A and Forward=Ctrl+B, press both, then release Back: keys(..., false) sends Ctrl-up even though Forward remains down. Assigning both buttons the same key similarly releases it on the first button-up. steps and the injectors track button transitions but never ownership/counts of shared keys/modifiers. Microsoft's SendInput documentation states these are inserted into the keyboard input stream and current keyboard state is not reset; there is no per-action ownership supplied by that API. Track held output keys and only release on the last owner. [ Cross-file consolidated ]

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

🟡 Medium src/button-listener.mjs:46

Valid Logitech mice that answer only on HID++ index 0x01 are rejected as “no mouse answered”: this 3-second timeout closes the device before readStatus() can finish its fallback from 0xFF, even though each probe allows 6 seconds. Let discovery complete within the driver's full budget, or use a suitably bounded listener-specific probe.

🤖 Copy this AI Prompt to have your agent fix this:

In file @native-hid/src/button-listener.mjs around line 46:

Valid Logitech mice that answer only on HID++ index `0x01` are rejected as “no mouse answered”: this 3-second timeout closes the device before `readStatus()` can finish its fallback from `0xFF`, even though each probe allows 6 seconds. Let discovery complete within the driver's full budget, or use a suitably bounded listener-specific probe.