[jochenkirstaetter]

Summary

Second slice of splitting the Linux desktop port (#12) into 6 focused, independently reviewable PRs as requested in #12 (review), building on Part 1 (#34).

Every change outside desktop/app/src/linux/ is strictly gated behind #[cfg(target_os = "linux")] / #[cfg(not(target_os = "linux"))] so Windows and macOS code paths remain untouched.

What's in Part 2 (linux-2-basics)

• Clipboard (desktop/app/src/linux/clipboard.rs):
  • Wayland (wl-paste / wl-copy), X11 (xclip / xsel), and Qt QClipboard fallback for plain text, rich text (text/html, text/rtf), images (image/png), and file URI lists (text/uri-list).
  • Password manager privacy hint detection (x-kde-passwordManagerHint, x-gnome-privacy-hint) and fingerprint deduplication (LAST_REPORTED) to prevent echo loops.
• Notifications (desktop/app/src/linux/toast.rs, desktop/app/src/pc_notifications.rs):
  • Freedesktop org.freedesktop.Notifications integration via gdbus (with notify-send fallback), supporting action buttons, inline replies, in-place progress bar updates (replaces_id + int:value), and notification dismissal signals (ActionInvoked, NotificationReplied, NotificationClosed).
  • PC-to-phone notification listener (dbus-monitor session bus observer with self-source filtering) in pc_notifications.rs.
• System Tray, Global Hotkeys & Window Focus (desktop/app/src/linux/tray.rs):
  • StatusNotifierItem / D-Bus tray integration, logind PrepareForSleep resume detection, XDG Desktop Portal org.freedesktop.appearance dark/light mode change monitoring, X11 XGrabKey global hotkey listener, and active window tracking/focus (xdotool / kdotool / wmctrl).
• Desktop Integration (autostart.rs, shell.rs, jumplist.rs, shortcut.rs, share_target.rs, single_instance.rs, widget.rs):
  • XDG autostart (~/.config/autostart/nectarlink.desktop), .desktop launcher & Quick Actions (jumplist.rs), file-manager "Send to Phone" scripts/menus for Nautilus, KDE Dolphin, and Nemo/Thunar (shortcut.rs), FreeDesktop Trash & org.freedesktop.FileManager1 file reveal (shell.rs), flock + Unix domain socket single-instance IPC (single_instance.rs), and atomic widget-state.json writer (widget.rs).
• Connectivity & Diagnostics (wifi.rs, wol.rs, ble_beacon.rs, doctor.rs, image.rs, elevated.rs):
  • nmcli Wi-Fi status & Instant Hotspot connection (wifi.rs), /sys/class/net + ethtool Wake-on-LAN status & magic packet sender (wol.rs, enabling pc.wake on Linux), BlueZ LE Advertising Manager beacon (ble_beacon.rs), Linux system diagnostics (doctor.rs), pkexec argument forwarding (elevated.rs), and pure-Rust image decoding/resizing/thumbnailing (image.rs).

Series Roadmap

1. Part 1 (linux-1-build) — Build, CI, Qt6 windowing, linux/mod.rs foundation, CLI linux_watch, and packaging (feat(linux): Linux platform foundation, Qt6 windowing, and packaging (Part 1/6) #34, merged)
2. Part 2 (linux-2-basics) — Clipboard, Freedesktop notifications (toast.rs, pc_notifications.rs), tray & hotkeys, autostart, shell, shortcuts, single-instance, widget, WoL, BLE beacon, and doctor checks (this PR)
3. Part 3 (linux-3-input) — Input injection (uinput / Wayland / X11), deck actions, frameless Wayland/X11 window move/resize filter, and window capture
4. Part 4 (linux-4-media) — Audio (wpctl/pactl), low-latency PCM output, PC loopback audio stream, MPRIS (media_sessions.rs, smtc.rs), OpenH264/FFmpeg H.264 & MP4, phone/PC screen mirroring, v4l2loopback virtual camera, PipeWire/PulseAudio virtual microphone, Bluetooth HFP, and voice recording conversion
5. Part 5 (linux-5-storage) — FUSE3 virtual filesystem (fuser) and file-manager sidebar bookmarks (gtk-3.0/bookmarks, user-places.xbel)
6. Part 6 (linux-6-updater) — Linux HTTP client (curl), self-updater (.deb / .AppImage / .tar.gz), and setup uninstaller

[thtbee]

Thanks Jochen. I checked the four files outside linux/ (core_host.rs, send_to.rs, settings.rs, transfers.rs), and the Windows and macOS paths are unchanged there. Honoring x-kde-passwordManagerHint and x-gnome-privacy-hint in the clipboard is good to see, and so is open_url only taking http(s).

What needs changing:

1. Notification text ends up on the command line (linux/toast.rs). Phone notifications (SMS, one-time codes, chats) are passed to gdbus call and notify-send as arguments, so while they run, any other user on the PC can read them in ps or /proc/<pid>/cmdline. We never let message content out like that. gdbus call also parses each argument as GVariant text, so a body that happens to look like a literal ('ok', @s 'x', numbers) is shown changed. Please send these over D-Bus directly (zbus is pure Rust and MIT/Apache), which fixes both.

2. Tray through an embedded python3 script (linux/tray.rs). That's a hidden runtime dependency on python3 plus its GTK bindings, and the labels go on its command line too. Qt already gives us a StatusNotifierItem tray on Linux through QSystemTrayIcon, which works on KDE and on GNOME with the AppIndicator extension. Could the Linux tray use that instead?

3. Clipboard polling with processes (linux/clipboard.rs). Every 450 ms it starts wl-paste --list-types and then a read, so a few processes a second for as long as the app runs. On GNOME Wayland, which has no data-control protocol, wl-paste has to map a surface to read, which can steal focus or flicker. The first poll also sends whatever is already on the clipboard when the app starts. QClipboard::dataChanged avoids all of that while our window has focus, and wl-paste --watch is event-driven when it doesn't. Please also seed the last-seen fingerprint at startup so nothing is sent until the user copies something.

4. Firewall fix (linux/doctor.rs, fix_firewall):

   • ufw allow 7718 opens the port on every network, including public Wi-Fi. On Windows we only allow it for private networks. Please scope it to local subnets (ufw allow from 192.168.0.0/16 to any port 7718, and the same for 10/8 and 172.16/12), or use a firewalld zone.
   • The nftables branch adds rules to inet filter, which may not exist, and they're gone after a reboot.
   • With no firewall found it returns Ok(true), so the Doctor says it fixed something it didn't touch. It should be Ok(false).

5. Notification forwarding listener (pc_notifications.rs):

   • It parses dbus-monitor output line by line, so a body with a newline (most chat previews) loses everything after the first line.
   • Turning the setting off doesn't stop it, and if dbus-monitor exits it never starts again.

   A zbus BecomeMonitor subscription would fix all three.

6. Runtime tools. This part calls xclip/xsel/wl-paste, gdbus, notify-send, dbus-monitor, xdotool/kdotool/wmctrl/xprop and python3. Fewer of them after 1 to 5. Whatever stays, please list in the .deb dependencies and the docs, and have the Doctor say when one is missing, so it doesn't fail silently.

Smaller: the autostart Exec= line quotes the path but doesn't escape ", `, $ or \ inside it, as the desktop entry spec asks.

Happy to look again once these are in.

[thtbee]

Thanks a lot for the quick fixes, Jochen, and for all the work on the port.

Since all six parts are ready on your branches, we'd like to help speed things up. We've put your whole series together locally on top of the upcoming release and are reviewing and testing it end to end, with your commits kept as yours. Anything we fix or add goes on top as separate commits, and we'll share those with you once they're in good shape, so you can see what changed and why.

The plan is to have the Linux app in the next release. If you can keep testing on your Linux machines, that would help a lot, since we only have WSL here. No need to wait on us for anything.

[thtbee]

Quick note on the red CI run, in case it saves you some time: on Windows and macOS, pc_notifications.rs uses zbus outside #[cfg(target_os = "linux")] (lines 167, 169, 185, 310 and 313), so those builds can't find the crate. On Linux, clippy stops on warnings at main.rs:78 and pc_notifications.rs:64 and :108, which look like the old dbus-monitor parsing helpers that nothing calls anymore.

[jochenkirstaetter]

Hello @thtbee

Thanks for picking it up. It's nice to see the collaboration is solid.
I've taken the recent feedback in and fixing it. Then I'm going to rebase the stacked branches on topof those and run a full audit to avoid any future repetitions. Applying previous feedback retrospective.

I'll create the pending four PRs now.

I understand your urge to speed up things, please let's not end up in a merge and conflict resolving chaos based on this. I pushed those stacked branches into my repository for backup purpose mainly, not really for pre-mature cross-checks prior to actually creating the PRs. The original draft PR #12 has everything and feedback there could have been used to drive those six stacked branches.

Thanks for your understanding and consideration.

Cheers

[thtbee]

Thanks Jochen, and you're right. I'm sorry for getting ahead of you there.

Some context on why we did it: we're preparing the next release and hoped to ship the Linux app in it, so last night we put your whole series together locally and tested it end to end (WSL with WSLg, a CLI phone, the Android emulator, and the packages in clean environments). The idea was only to find problems early, before release day, not to replace your work or run a second copy of it. Looking at it from your side, I can see how a parallel branch with changes on top of your code looks exactly like the merge chaos you want to avoid, and that wasn't fair to you.

So from here we'll follow your PRs: no parallel branches to merge, everything goes through your series, and you decide what goes in. So that what we learned doesn't trickle in one review at a time, here it is all at once. I checked each point against your current branches (linux-2-basics at fe3fdf1, linux-3-input at 426360f, linux-4-media at 355c08b, and linux-5-storage / linux-6-updater as they are now), so it only lists what still applies there. Please take it as notes from testing, not as a list of demands; you know this code far better than we do, and if you see a better way for any of it, that's great.

Where we already wrote a fix, it's on linux-review-fixes in this repo, on top of your Oct 20 commits, and is referenced below as (ref abc1234). It's there only as a reference: take what's useful, rewrite what isn't, or ignore it. Nothing in it will be merged on its own, and we've stopped working on that branch.

Part 2 (#38)

1. linux/toast.rs, two D-Bus connections. send_notification uses the shared connection, but monitor_loop opens a new one with Connection::session(). Servers send ActionInvoked, NotificationReplied and NotificationClosed to the unique name of the connection that called Notify, so clicks and replies can go to a connection nobody listens on. Please use one connection for both (ref 6291b51).
2. linux/toast.rs, ask the server what it supports. Markup, buttons and the reply field are always sent. Servers without body-markup show & and <i> literally, and only KDE has inline-reply, so elsewhere "Reply" is a button that does nothing. Calling GetCapabilities once per connection and sending only what's listed fixes both (ref 6291b51, with tests).
3. linux/toast.rs, text. "Open" and "Reply" aren't translated (tr!), and the progress line joins with an em dash; the app uses " · " everywhere else.
4. linux/toast.rs, enabled(). It runs on the GUI thread each time the window comes to the front, and makes a D-Bus call and starts gsettings each time. Caching the answer for a few seconds is enough (ref 6291b51).
5. linux/clipboard.rs, processes per change. On GNOME Wayland (no data-control) every change still starts wl-paste --list-types and then a read per type. Reading through Qt's QClipboard/QMimeData in process, with wl-paste --watch only as the unfocused watcher, avoids it. Writes have the same issue in reverse: HTML and RTF are kept in memory but only plain text reaches the system clipboard, and private clips written through xclip lose the x-kde-passwordManagerHint marker.
6. linux/tray.rs:
   • unsafe impl Send/Sync for SharedHandler wraps a closure that isn't Send and calls it from four threads; requiring F: Fn(TrayEvent) + Send + Sync + 'static makes it sound without unsafe.
   • XSetErrorHandler replaces Qt's process-wide X11 error handler; please restore the previous one, or avoid it.
   • Global shortcuts are X11 only; on Wayland they need the GlobalShortcuts portal.
   • is_window_alive_and_visible and focus_window report success for LAST_EXTERNAL_WINDOW even when nothing checked or focused it.
7. linux/doctor.rs, firewalld. The ufw fix is scoped to private ranges now (thanks), but firewalld still runs --add-port=7718/tcp --add-port=7718/udp --add-port=5353/udp on the default zone, which opens it to every network. Rich rules with source address= for the same ranges match the ufw behaviour (ref b346bfe, build_firewalld_fix_script).
8. src/doctor.rs, Windows text on Linux. The firewall titles say "Windows Firewall", and network-settings opens ms-settings:network-status on Linux too (ref a815275, which also translates the Linux checks).
9. linux/ble_beacon.rs, the beacon. It still drives an interactive bluetoothctl with advertise on and scan on. A continuous scan on the user's adapter affects their other Bluetooth devices, and the walk-away lock should only look at paired phones. BlueZ over D-Bus (LEAdvertisingManager1, and Device1 RSSI for paired phones only, only while walk-away lock is on) avoids both (ref b346bfe).
10. linux/single_instance.rs, watch(). conn.read() has no timeout, so a client that connects without writing blocks every later wake-up, and the loop ends for good on the first accept error. A read timeout, and continue instead of break, fixes both.

Part 3 (#41)

1. linux/input.rs, typed text on the command line. type_text ends in wtype -- <text> and xdotool type -- <text>, so whatever the phone types (including passwords) is readable by every user on the PC in ps and /proc/<pid>/cmdline while it runs. Both tools read stdin (wtype -, xdotool type --file -); please pass the text that way (ref b346bfe).
2. linux/input.rs, Wayland input. On Wayland it relies on ydotool/wtype, so a process per pointer event at touchpad rates, and ydotool needs its daemon and root. /dev/uinput where the user has access, and the RemoteDesktop portal otherwise, keep it in process (ref b346bfe).
3. Keyboard layout, for whichever path uses key codes. uinput and the portal's keycode calls send physical keys, so any US-layout key table types the wrong characters on other layouts ("z" and "y" swap on German, and Undo becomes Ctrl+Y). We map through the user's XKB layout with libxkbcommon (ref 7bc9b2b, with tests on us/de/fr).
4. qml/pages/DeckPage.qml. "Show desktop (Win+D)" and "Screenshot (Win+Shift+S)" show on Linux too.
5. Idle time: the code takes GetSessionIdleTime as milliseconds. I believe KDE returns milliseconds, but the freedesktop spec says seconds, so it's worth checking on each desktop that implements it.

Window capture through XGetImage in process is a clear improvement, thanks.

Part 4 (linux-4-media, not open yet)

1. src/pc_audio_stream.rs, records the microphone. The pw-record fallback runs pw-record --raw --format=f32 --rate=48000 --channels=2 - without a target, so it records the default source, which is the microphone. It needs -P stream.capture.sink=true (and the sink as --target) to capture what the PC plays.
2. src/recordings.rs, ffmpeg never succeeds. convert_audio passes -- before the output file. ffmpeg has no -- option, so every conversion fails. Plain arguments with explicit encoders work, and the real conversion test passes with them (ref a0864fe).
3. linux/h264.rs. It tries libavcodec.so.59 to .61; Ubuntu 26.04 ships FFmpeg 8 (libavcodec.so.62), so mirroring has no decoder there.
4. src/pc_mirror.rs, Wayland screen sharing. If it uses the ScreenCast portal, the stream has to be read through the fd from OpenPipeWireRemote; a separate process connecting to PipeWire on its own can be refused. Keeping the portal's restore_token avoids asking again in the same run, and a slow frame shouldn't end the session, since a new one asks the user again (ref a94e916).

Part 5 (linux-5-storage, not open yet)

1. linux/storage.rs is a sync loop, not a mount. It walks the phone every 4 s (LINUX_SYNC_INTERVAL) and downloads every file into ~/Nectarlink/<phone>. That copies gigabytes the user didn't ask for, brings back files deleted locally 4 s later, and duplicates renamed ones. The roadmap says FUSE; an on-demand FUSE mount reads only what's opened. We wrote one against the kernel protocol through fusermount3 (ref b346bfe). Tested end to end: a 1 GiB file read intact at about 40 MB/s, plus write, cp, mkdir, rename and rm. Two follow-ups came out of that testing:
   • a mount left by a crash blocks the next start (ref ea1f8e0);
   • a mount could be left after quit, because a reconcile raced shutdown (ref e58ee10).
2. KDE Dolphin's sidebar is ~/.local/share/user-places.xbel, besides GTK's bookmarks.

Part 6 (linux-6-updater, not open yet)

1. linux/http.rs shells out to curl/wget; reqwest with rustls is already in the dependency tree and would drop a runtime dependency.
2. src/updater.rs. The .deb path is careful (the hash is checked again as root on a root-owned copy). Small things:
   • pkexec sh -c makes the prompt name sh; a polkit action would name NectarLink;
   • a tarball install only opens the browser;
   • non-AppImage installs always pick _amd64.deb.

Across the series

1. SIGTERM. Logging out or shutting down sends SIGTERM, which ends the app without unmounting or saying goodbye to the phone. We quit through the normal path on SIGTERM/SIGINT/SIGHUP (ref ccb9318).
2. Packaging. build-tarball.sh still doesn't bundle libQt6Widgets, which the app links since the tray moved to QSystemTrayIcon (the .deb and AppImage do now). release.yml needs a Linux job; ours pins appimagetool 1.9.1 and the type2 runtime by SHA-256, and starts every package in a clean Ubuntu 24.04 before a release can be drafted (ref 0be2ddf). The binary needs GLIBC_2.39, so Ubuntu 24.04, Debian 13 and Fedora 40 are the minimum. Debian 12 isn't supported.
3. Translations. New user-facing strings need German and Chinese entries in the same change (cargo xtask strings, lupdate), otherwise check.ps1 fails.

Could you let us know roughly when you expect parts 3 to 6 to be ready? We'd like to plan the next release around them, and we'll review each PR as soon as it opens; it should be quick now that we know the code. Thanks again for all the work on this.

[jochenkirstaetter]

Hi @thtbee

Awesome, thank you so much for the breakdown.
All feedback is going to be reviewed, addressed and resolved. I totally understand your side about moving forward for the new release. there's also the macOS port already knocking on the doors, and quite a lot of work from here is useful there, too.

We shall have this completed by the end of the day. A couple of hours.

Cheers

[jochenkirstaetter]

Massive thank you @thtbee for the deep review and for putting together linux-review-fixes (b346bfe..e58ee10) across the entire stacked series! Truly appreciate the collaborative effort and attention to detail.

We have merged upstream/main (including the ctutils 0.4.5 advisory bump) and integrated all the findings and reference commits from linux-review-fixes into the respective PR branches down the stack (with Co-authored-by: Bee <302257494+thtbee@users.noreply.github.com>):

• PR feat(linux): clipboard, notifications, tray, autostart, shell, shortcuts, network & BLE (Part 2/6) #38 (linux-2-basics) — commit 6adc2db (from b346bfe, 3a0f7cd, 4676757):
  • Doctor & Wayland clipboard: check_clipboard now runs wl-paste --list-types with a bounded 750 ms poll timeout (avoiding indefinite hangs when no selection owner exists), checks WAYLAND_DISPLAY live, and updates clipboard.rs to verify both wl-copy and wl-paste (falling back to X11/XWayland when wl-paste is missing).
  • Firewall diagnostics: Added native nft list ruleset inspection with port-range matching, ufw output fallback to ufw status / iptables -S INPUT, and firewall-cmd multi-token port parsing.
  • D-Bus & MPRIS: Scoped notification action/closed signal routing to our own notification IDs, shortened MPRIS track IDs (.../track/{hash}), bounded thumbnail cache growth, and aligned Identity / DesktopEntry with nectarlink.desktop.
  • Packaging & AppStream: Updated .desktop categories (Network;Utility;FileTransfer;), AppStream developer block & release metadata, .deb dependencies (libfuse3-3 | libfuse3-4, Recommends wl-clipboard, xclip), and user-local install fallbacks when pkexec/sudo is cancelled.
• PR feat(linux): input injection, deck actions, and window capture (Part 3/6) #41 (linux-3-input) — commit 824712f (from a8431b5):
  • Added US QWERTY symbols, shifted punctuation, and navigation keys to keymap.rs + unit test coverage.
  • Fixed X11 window capture crop rectangle calculation to use window-relative coordinates (0, 0) instead of subtracting screen origin from root-less XGetImage geometry.
• PR feat(linux): Linux desktop support — Part 4/6: Audio, video, and media sessions #42 (linux-4-media) — commit 4b4f03e (from cf7ab65, c9f5b10):
  • Fixed PipeWire ScreenCast portal stream startup using spa_pod_builder (SPA_Choice_Enum framerate + resolution range) and handling 64-bit SPA_TYPE_Fd.
  • Added libopenh264-dev to .github/workflows/ci.yml (desktop-linux) and runtime ABI detection in pc_mirror.rs so both OpenH264 2.3+ (SLayerBSInfo 56-byte struct) and Debian/Ubuntu libopenh264-7 (SLayerBSInfoV20 40-byte struct) work seamlessly.
  • Hardened vcam.rs, vmic.rs, mp4.rs, and camera.rs cleanup and safety.
• PR feat(linux): Linux desktop support — Part 5/6: Phone storage sync and file manager integration #43 (linux-5-storage) — commit 67a0e90 (from 64d36fc):
  • Updated linux/storage.rs and core_host.rs to perform on-demand FUSE directory/file fetches (StorageListing::request + StorageDownload::fetch) with ENOENT caching and clean unmount via fusermount3 -u -z / fusermount -u -z.
• PR feat(linux): Linux desktop support — Part 6/6: HTTPS client, self-updater, and setup uninstaller #44 (linux-6-updater) — commit ea0ba78 (from e58ee10):
  • Integrated the HTTP response line limit (MAX_LINE_LEN) and preserved the 120s idle read timeout in linux/http.rs.
  • Integrated the hardened .deb / .tar.gz install and update flows in setup.rs and updater.rs, plus #[cfg] platform guards so macOS CI compiles and passes all tests cleanly alongside Windows and Linux.

[thtbee]

Thank you, Jochen. I went through the final series again file by file against the findings: everything is addressed, and your OpenH264 ABI detection is a nice addition I hadn't thought of. On 0b37495 the full Windows check, fmt, clippy and every test on Linux, the FUSE end-to-end run (read, write, rename, the phone going away and coming back, quit, SIGTERM, and a crash followed by a restart), and all three packages (glibc floor 2.39, started with an empty environment) pass. Approving; I'll merge the parts in order.