The old assertions required poll to report nothing, but the shared
helpers only looked for readable input, so a hangup or a bad descriptor
could satisfy a test that expects no wake. Reject any other readiness in
both helpers and pin that with a hung-up pipe.
Borrowing a descriptor requires it to be open at that moment, so the
broker entry cannot check a raw number through a borrow. Check both
numbers with getsockopt first, as main did, which keeps the rejection of
closed descriptors and makes the borrow's safety claim true.
The entry exits 126 either way, so this only restores the contract. Pin
that rejection with an integration test against the real binary.
Detach from the terminal with rustix and std, and drop the remaining
unsafe process, poll, and shutdown calls from the tests through small
shared helpers. Prune the rustix features nothing ended up using, and
record which call sites stay on libc and why in the agent guidance.
Replace the hand-built sendmsg and recvmsg control messages, the sealed
memfd handling, and the polling, signalling, and child status calls with
typed rustix calls. Broker functions now take borrowed descriptors instead
of raw integers, so fd lifetimes are checked by the compiler.
The packet and descriptor caps, the truncation checks, and the signal
allow-list stay. Passed descriptors now also close when a packet with no
data is rejected.
One check narrows: rustix skips ancillary types it does not know instead
of reporting them, so only descriptors and credentials are visible here,
and credentials are still rejected. The skipped case is SCM_SECURITY,
which needs SO_PASSSEC on the socket, and nothing here sets it.
The post-clone child stub stays on raw syscalls by design, and the
broker entry keeps one borrow of its inherited channels, which live until
the process exits.
Move pidfd opening and waiting, the boot clock and timerfd, the command
queue watcher, and the overlay watchdog to rustix, removing their unsafe
blocks. Deadlines, retries, and failure handling stay the same.
Three unsafe sites remain for a reason: the zero-signal pidfd check has
no rustix equivalent, the inotify parser keeps its buffer across calls,
and fail_stop exits without any cleanup. The watch mask drops two bits
the kernel ignores, because those events always arrive.
Move the no-replace renames, the pinned runtime state paths, and the
input node access check to rustix, removing their unsafe blocks. The
paths keep their existing NUL checks and error messages.
Share one safe FIFO helper across the tests that repeated an unsafe
mkfifo block, since the std version is still unstable.
Move the runtime wake eventfd, the Wayland and daemon poll loops, and the
input monitor to rustix, removing their unsafe blocks.
Timeout rounding, interruption retries, and readiness rules stay the
same. The runtime poll seam now passes readiness flags, since rustix does
not let tests write them into a poll descriptor. A test helper replaces
the repeated poll blocks in the wake tests.
Add rustix as a direct dependency. It is already compiled through the
Wayland stack, so this adds no new crate.
Use its typed flock operations for the durable, daemon protocol, and
action journal locks, which removes their unsafe blocks. Deadline locks
still always retry without blocking.
Replace the hand-written tokenizer and its short-cluster and attached
value helpers. Every accepted form and value rule stays the same, now
pinned by tests, including that a value starting with - must be attached.
Two edges change: a bare -- now ends options as usual, and an unknown -x
reports as an unknown short option like one inside a cluster. Non-UTF-8
session paths now reach the specific error for that case instead of the
generic one; they are still rejected.
The local gate serializes tests because of a native font race. nextest
gives each test its own process, so the whole suite can run in parallel
while iterating. It is local only: it skips doctests and the isolated
render tests, so the gate stays as it is. Add it to the Nix shell.
Add deny.toml and a dependency-policy job covering the whole workspace.
Bans, licenses, and sources block; advisories report without blocking,
so a newly published advisory cannot fail an unrelated pull request.
zbus 6 absorbed zvariant, zvariant_derive, and zbus_names, so RustSec
now lists them as unmaintained. ksni still requires zbus 5, so those
advisories are ignored with that reason until it moves.
Both packages now state their MIT license instead of leaving the check
to detect it. The configurator is marked publish = false: it has an
unversioned path dependency and cannot be published.
Bump the crate to the version tempfile already compiles, which removes
the duplicate 0.3 build. Make it required and replace the hand-written
libc getrandom loop in the daemon protocol, so portal tokens and protocol
identifiers share one source and one unsafe block goes away.
comparison_chain, ignore_without_reason, and
unnecessary_debug_formatting.
- The one-edit keybinding comparison matches on `a.len().cmp(&b.len())`.
- The Wayland smoke test says why it is ignored.
- The configurator search text includes session paths with `display()`
instead of `{:?}`, so searches match the path without debug quotes or
escapes.
Write the anonymous lifetime in paths: `BindingInserter<'_>`, not
`BindingInserter`, so a borrowed type is visible in the signature. The
lint goes in a new `[workspace.lints.rust]` table.
Applied from the compiler's suggestions, then `cargo fmt --all`.
Use `let ... else` for a `match` or `if let` that only unwraps a value
when the other branch diverges, for example with `return`, `continue`,
or `panic!`.
Clippy's suggestions for this lint are not machine-applicable, so they
were applied and each site was read. One suggestion lost a binding name
in the context-menu focus test; that site was fixed by hand. Every
`panic!` and `bail!` in the new `else` blocks ends with a semicolon.
duration_suboptimal_units, elidable_lifetime_names, explicit_iter_loop,
ignored_unit_patterns, implicit_clone, manual_is_variant_and,
manual_string_new, option_as_ref_cloned, and redundant_else.
Mechanical, with the lints enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
The tray shutdown calls return `()`, so they are plain `.await;` rather
than the `let () = ...` that the unit-pattern fix writes.
Give a raw string only the `#` delimiters its content needs: `r"..."`
when it contains no `"`, and `r#"..."#` when it contains `"` but not
`"#`.
Mechanical, with the lint enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
Put the positive condition first: `if x { a } else { b }` instead of
`if !x { b } else { a }`.
Mechanical, with the lint enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
Use `midpoint` instead of `(a + b) / 2`. The result is the same
wherever the sum does not overflow. Integer `midpoint` rounds toward
zero like `/ 2`. `f64::midpoint` computes `(a + b) * 0.5` when both
inputs are at most `f64::MAX / 2` in magnitude. Only where the sum
would overflow does `midpoint` differ: it still returns a value
between the two inputs.
Mechanical, with the lint enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
Take raw pointers with `&raw const` and `&raw mut` instead of casting a
reference, and change pointer constness with `cast_mut()`. The FFI calls
receive the same pointers, without an intermediate reference.
Mechanical, with the lints enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
Write a `match` with one pattern and a fallback as `if let ... else`.
Mostly mechanical, with the lint enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
Four matches with comments in their arms were converted by hand, so the
comments stay with their branch: config edit completion, the properties
toggle knob, a toolbar preset-slot test, and the configurator caret
restore.
End unit-valued trailing expressions with a semicolon.
Mechanical, with the lint enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
Put identifiers and Wayland protocol names in doc comments in backticks
(`wl_output`, `zwp_tablet_v2`). Product names that docs write plainly
(GLib, HarfBuzz, HiDPI, JetBrains, MSBuild, StatusNotifierItem, VSync)
go in `doc-valid-idents` in clippy.toml, next to Clippy's default list.
Mechanical, with the lint enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
Two comments that the fix could not mark up cleanly were reworded by
hand: the surface module summary and the zoom-chip invariant.
Use `map_or`, `map_or_else`, `is_some_and`, and `is_ok_and` instead of
`map(..).unwrap_or(..)`.
Mostly mechanical, with the lint enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
Written by hand:
- The four caret-movement arms in caret_edit.rs are a `match`. The
`map_or_else` form needs `caret` and `anchor` mutably in both
closures.
- `sub_ring_children` is a `match`: the `&[]` default does not infer
as a slice in `map_or`.
- The configurator's recorded-device mapping matches on
`Option<InputSource>` directly, instead of a `map_or` with a nested
`match`.
The translations guard lists the `tr(...)` arguments it accepts without
a literal as source text, so its two action-metadata entries follow the
new spelling.
Inline named arguments in format strings: `format!("{name}: {err}")`.
Mechanical, with the lint enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
Convert numbers that always fit with `From` (`f64::from(width)`) instead
of `as`. The lint skips `const` initializers, where `From` cannot be
called, and conversions to `usize` and `isize`, whose width depends on
the target, so those keep `as`.
Mechanical, with the lint enabled in Cargo.toml:
cargo clippy --fix --workspace --all-targets --all-features
cargo clippy --fix --workspace --all-targets --no-default-features
cargo fmt --all
Keep the press as the drag anchor until the pointer leaves the click
radius, so the first drag motion is not lost. After that the anchor
follows the pointer on every motion, including blocked ones, so
reversing at an edge moves the selection at once.
Apply coordinate limits on every board. Pannable boards still move
freely, but each translated coordinate and the painted bounds now stay
in the i32 range. Before, a nudge near i32::MAX wrapped in release
builds: the line jumped to span the whole coordinate range and was
saved that way. Debug builds panicked instead.
On a fixed canvas (the transparent overlay, or a board with panning
disabled), a selection that already crosses an edge, or lies outside
the canvas, can no longer move further out, and it is never pulled
back. Before, any nudge snapped it inside, up to thousands of pixels.
Align the move-to-edge actions with the visible canvas, including pan
and zoom, instead of the screen origin. A target further away than
i32::MAX is reached in several steps that record one undo entry.
Combine selection bounds in i64. Shape bounds are clamped to the i32
range, so a shape at the coordinate limit is measured on a copy moved
toward the origin; the limits and edge actions then see its full
stroke padding. A selection whose painted bounds end past i32::MAX
gets no selection Rect, because handle hit-testing and other selection
code compute x + width in i32. Its chrome then marks full damage, so
the halos of its other members are still repainted. The Properties
panel uses the same bounds, the text resize handle is omitted when it
would end past i32::MAX, and handle hit-testing compares pointer
distances in i64.
Test changes:
- nudge_selection_clamps_right_and_bottom_edges starts at (87, 87).
At (90, 90) the stroke padding already crossed the canvas edge, and
the test passed only because the old clamp pulled the shape back.
- moving_a_selection_on_transparent_board_clamps_to_screen checks the
exact landing edge. It also passed when nothing moved.
The coordinate guard and the view-relative edge targets are adapted
from #424.
- Pannable boards (solid boards) have unbounded canvases; do not clamp selection
translation against the viewport rectangle.
- Retain clamping on transparent overlay boards where the canvas is bound to the output.
- Always advance MovingSelection last_x/last_y on pointer motion so dragging against
a boundary does not leave a stale reference anchor that causes jumping.
Issue #422: Clamping against screen dimensions on panned or zoomed boards
uses mismatched units (canvas bounds vs screen dimensions), causing selections
to jump offscreen on the first drag motion or arrow-key nudge. Clamp against
the visible canvas rect instead.
Several identical frames can precede a popup's final layout, leaving the
capture restoration test with a premature reference image. Require a
quiet interval before recording that image while retaining the existing
settling deadline and exact restoration assertions.
Lead with platform support, then walk through the features with the
current screenshots and demo videos beside them. Each feature section
opens with the keys to press, keeps a short list visible, and moves
the long details into collapsed sections. The reference sections
fold their deep material the same way.
Remove the duplicated feature list from the roadmap and the repeated
help shortcuts. Split code blocks so each copy button copies one
runnable command or one sequence, and keep installer dry runs apart
from the install itself.
Mirror the new structure in the Simplified Chinese README.
Update global.json and the SDK consistency guard to
11.0.100-rc.2.26504.105. Refresh the release and version-metadata fixtures
while preserving strict SDK selection.
Put the language picker first in General UI, with a globe and a title
that includes every supported language. Derive its title and search terms
from shared language metadata.
Add regression coverage for the title, icon and row order, and format the
additions with the pinned Rust toolchain.
The menu-constrained case needs a compositor that shrinks an oversized
popup. Weston 13 on the Ubuntu 24.04 CI runner does not shrink it, so the
menu never overflows and the case fails before capture.
devmobasa