Make Wayland capture honest and replace the broad input group with least privilege #30

2026-07-04T04:40:24Z

Tyler commented

2026-07-04 04:40:24 +00:00

Phase 3, PR 10. Mirrors GitHub PR Twest2/StepForge#14.

packaging/linux/common/60-stepforge-input.rules: uaccess ACL for MOUSE devices only (excludes keyboards); session+device scoped. Replaces the broad input group.
scripts/linux/enable-click-capture.sh: opt-in installer (confirms, shows the rule, documents the tradeoff; never runs usermod -aG input).
chooseCaptureTrigger() (diagnostics + platform facade): honest trigger mapping; never promises per-click coordinates/marker on Wayland; platform:capabilities returns the active trigger.
GETTING_STARTED_WITH_LINUX.md: input group now a warning, least-privilege path documented, capability table corrected.

Verified: 289 unit tests incl. new Wayland-honesty suite; startup smoke + click selftest unchanged. Full Wayland runtime capture needs a real compositor CI job (recommended).

Phase 3, PR 10. Mirrors GitHub PR Twest2/StepForge#14. - packaging/linux/common/60-stepforge-input.rules: uaccess ACL for MOUSE devices only (excludes keyboards); session+device scoped. Replaces the broad input group. - scripts/linux/enable-click-capture.sh: opt-in installer (confirms, shows the rule, documents the tradeoff; never runs usermod -aG input). - chooseCaptureTrigger() (diagnostics + platform facade): honest trigger mapping; never promises per-click coordinates/marker on Wayland; platform:capabilities returns the active trigger. - GETTING_STARTED_WITH_LINUX.md: input group now a warning, least-privilege path documented, capability table corrected. Verified: 289 unit tests incl. new Wayland-honesty suite; startup smoke + click selftest unchanged. Full Wayland runtime capture needs a real compositor CI job (recommended).

Tyler added 1 commit 2026-07-04 04:40:25 +00:00

Make Wayland capture honest and replace the broad input group with least privilege

Template tests / tests (pull_request) Failing after 33s

Details

2c0b8b021e

Phase 3 of the improvement plan (PR 10 of the sequence): honest Wayland
behavior and a least-privilege alternative to the broad `input` group the
audit flagged as a keylogging surface.

Least-privilege input access:
- packaging/linux/common/60-stepforge-input.rules grants the ACTIVE session
  read access to MOUSE devices only (ID_INPUT_MOUSE, excluding
  ID_INPUT_KEYBOARD) via a systemd uaccess ACL — session-scoped, device-
  scoped, and never keyboards. This replaces `usermod -aG input`, which grants
  every input device (keyboards included) to the user permanently.
- scripts/linux/enable-click-capture.sh installs it opt-in: it prints the exact
  rule, requires confirmation, and documents the security tradeoff. It never
  runs the broad-group command.

Honest trigger reporting:
- New chooseCaptureTrigger() (app/platform/linux/diagnostics.js, re-exported
  from app/platform/index.js) maps a capability profile to the real trigger:
  per-click with a marker on X11+xinput; per-click WITHOUT coordinates or a
  marker on Wayland evdev (the platform exposes no pointer position); and an
  honest hotkey/interval fallback otherwise. It never promises per-click
  capture with coordinates on Wayland.
- platform:capabilities now includes the active trigger for the machine and
  the user's fallback setting, for the diagnostics UI.

Docs:
- GETTING_STARTED_WITH_LINUX.md no longer instructs every Wayland user to join
  the `input` group; it presents that as a warning, documents the least-
  privilege script, corrects the capability table (per-click is opt-in, mice
  only; hotkey/interval is the default Wayland trigger), and points at
  Settings → Diagnostics.

Tests: trigger decisions for X11/xinput, Wayland evdev (no coordinates/marker),
Wayland fallback (interval/hotkey with an honest note), the platform facade
wiring, Windows; the udev rule (mouse-only, excludes keyboards, uaccess); the
opt-in enable script (confirms, installs the rule, never runs usermod -aG
input as a command); and docs guards. 289 unit tests pass; startup smoke and
click self-test unchanged (stream, markers 3/3, burst 8/8).

Co-Authored-By: Claude Fable 5 <[email protected]>

Tyler added 1 commit 2026-07-04 04:42:48 +00:00

Make the enable-script guard robust to CRLF line endings

Template tests / tests (pull_request) Failing after 3m22s

Details

8c39e8db4e

The wayland-honesty guard stripped comments per line to check usermod is never
run, but the comment-strip regex depended on `.`/`$` behavior that breaks on
Windows CRLF checkouts (`.` does not cross `\r`), so the comment's cautionary
usermod mention was read as a command and the test failed only on windows-
latest CI. Check command position (line start, optional sudo) in multiline
mode instead — line-ending agnostic.

Co-Authored-By: Claude Fable 5 <[email protected]>

Tyler added 1 commit 2026-07-04 04:44:48 +00:00

Enforce LF line endings for Unix artifacts via .gitattributes

Template tests / tests (pull_request) Failing after 32s

Details

4f57cfacba

A shell script, .desktop, .rules, or .spec file checked out with CRLF (Windows
with core.autocrlf=true) breaks when run/parsed on Linux — a
`#!/usr/bin/env bash\r` shebang is a "bad interpreter" error, and the Linux
package would ship broken scripts. Pin these (and other text) to LF, and mark
binary assets (png/gz/traineddata) so they are never converted. Also harden
the packaging/wayland structural tests to strip CR defensively.

Co-Authored-By: Claude Fable 5 <[email protected]>

Tyler commented

2026-07-04 16:53:47 +00:00

Merged into main (same-SHA merge to both forges; GitHub mirror PR Twest2/StepForge#14 MERGED, CI green ubuntu+windows). Closing.

Tyler closed this pull request

2026-07-04 16:53:47 +00:00

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Tyler/StepForge#30