moonarch

nevaforget/moonarch

Fork 0

Commit Graph

Author	SHA1	Message	Date
nevaforget	952776c4f9	batsaver: switch to pkexec helper, drop broken udev permission hack Update PKGBUILD version / update-pkgver (push) Successful in 2s Details The wheel-write-via-udev approach for charge_control_end_threshold has been broken since 2026-04-08: the audit-remediation commit added ACTION=="add" to the rule, but the threshold attribute doesn't exist yet at the add event on Lenovo, so chmod fails silently and permissions are never set. moonarch-batsaver-toggle has been returning Permission denied since. Replace the udev-rule approach with a pkexec helper: defaults/bin/moonarch-batsaver-apply privileged: validate + write defaults/bin/moonarch-batsaver-toggle user: read sysfs, dispatch via pkexec defaults/bin/moonarch-batsaver-restore boot-time root restore (extracted from inline ExecStart for clarity) Default Standard-pkexec prompt — password cached per session for the ~5min auth window; no polkit no-password rule, no privilege escalation surface from misvalidated input. Same pattern Battery-Health-Charging GNOME extension uses. The boot-time restore service now skips the kernel write when the sysfs value already matches the saved state (Lenovo drivers reject same-value writes with EINVAL). DECISIONS.md documents the failure analysis and trade-offs. CLAUDE.md updated to describe the new flow. moonarch-doctor: udev-effectiveness check removed.	2026-05-04 12:17:31 +02:00
nevaforget	ac2b210a1f	fix: audit remediation — security, quality and performance fixes Update PKGBUILD version / update-pkgver (push) Successful in 3s Details - CI Dockerfile: verify act_runner SHA256, restrict sudoers to safe pacman arguments (S-C1, S-C2) - cliphist: split into cliphist-text + cliphist-image services with Type=simple for proper PID tracking and restart (Q-C3) - batsaver-toggle: validate sysfs input as numeric, check state file write (Q-C2, S-W2) - udev battery rule: add ACTION=="add" filter to avoid firing on every battery event (Q-W3) - cpugov: replace eval with direct expansion, switch waybar module to signal-based updates, send SIGRTMIN+10 after toggle (Q-W1, S-W1, P-W4) - Remove docker group auto-assignment from install scripts (S-I1)	2026-04-08 11:45:56 +02:00
nevaforget	579a948449	feat: add battery conservation mode with Waybar toggle Update PKGBUILD version / update-pkgver (push) Successful in 2s Details Laptops with charge_control_end_threshold support get a click-to-toggle on the battery module (80% ↔ 100%). A ♥ icon appears when conservation is active, hidden when inactive. State persists across reboots via systemd oneshot service. udev rule grants wheel group write access so no sudo is needed for toggling.	2026-04-08 09:55:46 +02:00

Author

SHA1

Message

Date

nevaforget

952776c4f9

batsaver: switch to pkexec helper, drop broken udev permission hack

Update PKGBUILD version / update-pkgver (push) Successful in 2s

Details

The wheel-write-via-udev approach for charge_control_end_threshold has
been broken since 2026-04-08: the audit-remediation commit added
ACTION=="add" to the rule, but the threshold attribute doesn't exist
yet at the add event on Lenovo, so chmod fails silently and permissions
are never set. moonarch-batsaver-toggle has been returning Permission
denied since.

Replace the udev-rule approach with a pkexec helper:

  defaults/bin/moonarch-batsaver-apply    privileged: validate + write
  defaults/bin/moonarch-batsaver-toggle   user: read sysfs, dispatch via pkexec
  defaults/bin/moonarch-batsaver-restore  boot-time root restore (extracted
                                          from inline ExecStart for clarity)

Default Standard-pkexec prompt — password cached per session for the
~5min auth window; no polkit no-password rule, no privilege escalation
surface from misvalidated input. Same pattern Battery-Health-Charging
GNOME extension uses.

The boot-time restore service now skips the kernel write when the
sysfs value already matches the saved state (Lenovo drivers reject
same-value writes with EINVAL).

DECISIONS.md documents the failure analysis and trade-offs.
CLAUDE.md updated to describe the new flow.
moonarch-doctor: udev-effectiveness check removed.

2026-05-04 12:17:31 +02:00

nevaforget

ac2b210a1f

fix: audit remediation — security, quality and performance fixes

Update PKGBUILD version / update-pkgver (push) Successful in 3s

Details

- CI Dockerfile: verify act_runner SHA256, restrict sudoers to safe
  pacman arguments (S-C1, S-C2)
- cliphist: split into cliphist-text + cliphist-image services with
  Type=simple for proper PID tracking and restart (Q-C3)
- batsaver-toggle: validate sysfs input as numeric, check state file
  write (Q-C2, S-W2)
- udev battery rule: add ACTION=="add" filter to avoid firing on
  every battery event (Q-W3)
- cpugov: replace eval with direct expansion, switch waybar module
  to signal-based updates, send SIGRTMIN+10 after toggle (Q-W1,
  S-W1, P-W4)
- Remove docker group auto-assignment from install scripts (S-I1)

2026-04-08 11:45:56 +02:00

nevaforget

579a948449

feat: add battery conservation mode with Waybar toggle

Update PKGBUILD version / update-pkgver (push) Successful in 2s

Details

Laptops with charge_control_end_threshold support get a click-to-toggle
on the battery module (80% ↔ 100%). A ♥ icon appears when conservation
is active, hidden when inactive. State persists across reboots via
systemd oneshot service. udev rule grants wheel group write access
so no sudo is needed for toggling.

2026-04-08 09:55:46 +02:00

3 Commits