230 Commits
Author SHA1 Message Date
Nicolai Bruns 33581fb216 fix(nix): address review feedback on setup and runtime safety 2026-10-18 13:51:58 +02:00
Nicolai Bruns 6909c7f83b fix(nix): address review feedback on setup and runtime safety 2026-10-18 13:51:58 +02:00
Nicolai Bruns 573f290552 fix(nix): simplify compiler setup and complete rootless session lifecycle 2026-10-18 13:35:15 +02:00
Nicolai Bruns 57223d4c0a fix(nix): simplify compiler setup and complete rootless session lifecycle 2026-10-18 13:35:15 +02:00
Nicolai Bruns 3c0b9cdfd3 feat(nix): add experimental rootless FHS package and desktop launcher 2026-10-18 00:30:14 +02:00
Nicolai Bruns f5e65e3cf1 feat(nix): add experimental rootless FHS package and desktop launcher 2026-10-18 00:30:14 +02:00
lucannez64 91eaf21175 Add stable opt-in per-prefix identity provisioning 2026-10-17 23:38:49 +02:00
lucannez64 0f2233304a Add stable opt-in per-prefix identity provisioning 2026-10-17 23:38:49 +02:00
lucannez64 b6302bb2c6 Implement bounded registry APIs and opt-in platform configuration 2026-10-17 23:32:01 +02:00
lucannez64 d87ad2ce45 Implement bounded registry APIs and opt-in platform configuration 2026-10-17 23:32:01 +02:00
lucannez64 de3bbe94b1 Extract runtime compatibility fixes from PR 41 2026-10-17 23:04:23 +02:00
lucannez64 633c129a4f Extract runtime compatibility fixes from PR 41 2026-10-17 23:04:23 +02:00
lucannez64 d4dcd31a21 Merge main into setup runtime safety, preserving certificate setup 2026-10-17 22:56:34 +02:00
lucannez64 d6199db86f Merge main into setup runtime safety, preserving certificate setup 2026-10-17 22:56:34 +02:00
Nicolai Bruns 57b1df9e0b fix(setup): validate final runtime destinations 2026-10-17 22:24:06 +02:00
Nicolai Bruns 100bc8252d fix(setup): validate final runtime destinations 2026-10-17 22:24:06 +02:00
Nicolai Bruns 2e201dd19b fix(setup): use consistent runtime paths and reject incomplete installs 2026-10-17 22:09:29 +02:00
Nicolai Bruns 9adfaf010f fix(setup): use consistent runtime paths and reject incomplete installs 2026-10-17 22:09:29 +02:00
lucannez64 3264ca86fa Test merge root certificates 2026-10-17 21:08:12 +02:00
lucannez64 b38e87b039 Test merge root certificates 2026-10-17 21:08:12 +02:00
lucannez64andClaude Opus 5.5 52a6dae432 Build Darling's system root store from the host CA bundle
Security reads the system trust domain from
/System/Library/Keychains/SystemRootCertificates.keychain and
SystemTrustSettings.plist (TrustSettingsSchema.h). Darling ships neither, so
SecTrustSettingsCopyCertificates(kSecTrustSettingsDomainSystem) returns
errSecNoTrustSettings (-25263); Chromium's known_roots_mac and Riot's
CertBundle then report that they cannot read the system roots.

ensure-darling-root-certificates.py parses each host root with a minimal DER
walker and writes the trust record keyed by the uppercase SHA-1, with the
encoded issuer Name, the serial INTEGER's content octets, modDate and an
empty (unrestricted) trustSettings array. The keychain is built with the
guest security tool in one darling shell, in a private temporary directory,
and published from inside the guest so a running Darling sees it, falling
back to the host when the guest cannot write the directory. A digest stamp
skips later runs without starting Darling. The launcher warns and continues
on failure; install-runtime.sh runs it before stopping Darling.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-17 21:03:32 +02:00
lucannez64andClaude Opus 5.5 a1c00ee884 Build Darling's system root store from the host CA bundle
Security reads the system trust domain from
/System/Library/Keychains/SystemRootCertificates.keychain and
SystemTrustSettings.plist (TrustSettingsSchema.h). Darling ships neither, so
SecTrustSettingsCopyCertificates(kSecTrustSettingsDomainSystem) returns
errSecNoTrustSettings (-25263); Chromium's known_roots_mac and Riot's
CertBundle then report that they cannot read the system roots.

ensure-darling-root-certificates.py parses each host root with a minimal DER
walker and writes the trust record keyed by the uppercase SHA-1, with the
encoded issuer Name, the serial INTEGER's content octets, modDate and an
empty (unrestricted) trustSettings array. The keychain is built with the
guest security tool in one darling shell, in a private temporary directory,
and published from inside the guest so a running Darling sees it, falling
back to the host when the guest cannot write the directory. A digest stamp
skips later runs without starting Darling. The launcher warns and continues
on failure; install-runtime.sh runs it before stopping Darling.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-17 21:03:32 +02:00
lucannez64andClaude Opus 5.5 40f7a650d1 Report the host GPU name and VRAM from MTLDevice
-[MTLDevice name] returned "Darling Indium Device" for every GPU. It now
returns the selected Vulkan device's name in macOS Metal style: the
trailing driver note in brackets and the (R)/(TM) marks are removed, and
NVIDIA names are unchanged. The name is never replaced with another
vendor's. recommendedMaxWorkingSetSize is the device-local heap size on
discrete GPUs and all heaps on integrated/CPU devices, with the old 1 GiB
as fallback. Both are computed once per device.

hasUnifiedMemory stays YES by default: synchronizeResource:/
synchronizeTexture: are missing and Private buffers created with data
abort in Indium, so reporting NO on discrete GPUs would send apps down
unimplemented paths. DARLING_METAL_HOST_UNIFIED_MEMORY=1 opts in to the
GPU-type answer. DARLING_METAL_GPU_NAME and DARLING_METAL_VRAM_MB
override the name and working set.

The cleaning logic lives in private-include/Metal/MTLDeviceInfo.h and is
covered by the host check tools/test-metal-device-info.cpp. Metal now
links indium_private for the Vulkan properties, and the runtime build
script adds Indium's private headers before compiling MTLDevice.mm.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-17 20:49:42 +02:00
lucannez64andClaude Opus 5.5 2549e2b654 Report the host GPU name and VRAM from MTLDevice
-[MTLDevice name] returned "Darling Indium Device" for every GPU. It now
returns the selected Vulkan device's name in macOS Metal style: the
trailing driver note in brackets and the (R)/(TM) marks are removed, and
NVIDIA names are unchanged. The name is never replaced with another
vendor's. recommendedMaxWorkingSetSize is the device-local heap size on
discrete GPUs and all heaps on integrated/CPU devices, with the old 1 GiB
as fallback. Both are computed once per device.

hasUnifiedMemory stays YES by default: synchronizeResource:/
synchronizeTexture: are missing and Private buffers created with data
abort in Indium, so reporting NO on discrete GPUs would send apps down
unimplemented paths. DARLING_METAL_HOST_UNIFIED_MEMORY=1 opts in to the
GPU-type answer. DARLING_METAL_GPU_NAME and DARLING_METAL_VRAM_MB
override the name and working set.

The cleaning logic lives in private-include/Metal/MTLDeviceInfo.h and is
covered by the host check tools/test-metal-device-info.cpp. Metal now
links indium_private for the Vulkan properties, and the runtime build
script adds Indium's private headers before compiling MTLDevice.mm.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-17 20:49:42 +02:00
lucannez64 fc57385c68 Keep Metal presentation active in mixed IOSurface layer trees 2026-10-17 01:06:50 +02:00
lucannez64 2aac45d68d Keep Metal presentation active in mixed IOSurface layer trees 2026-10-17 01:06:50 +02:00
lucannez64 698d295b6d Merge PR #18 visible-cursor tracking with serial-aware mouse warps 2026-10-17 00:26:47 +02:00
lucannez64 e9753b3623 Merge PR #18 visible-cursor tracking with serial-aware mouse warps 2026-10-17 00:26:47 +02:00
lucannez64 44faf79bd8 Merge PR #15 fullscreen transitions with runtime review fixes 2026-10-17 00:26:09 +02:00
lucannez64 ce85298c0e Merge PR #15 fullscreen transitions with runtime review fixes 2026-10-17 00:26:09 +02:00
lucannez64 6c742155e9 Fix runtime safety, Xorg mouse synchronization and fullscreen startup 2026-10-17 00:25:34 +02:00
lucannez64 3db7115c93 Fix runtime safety, Xorg mouse synchronization and fullscreen startup 2026-10-17 00:25:34 +02:00
DevWebeloperandClaude Opus 5.5 8c01fe1547 Keep the relative-mode cursor on the visible pointer when warps are not honoured
League enters relative mouse mode on GNOME (Xwayland) and inside gamescope, but
keeps a visible cursor and warps it every frame at its own mouse speed. Xwayland
cannot move a visible pointer, so those warps never took effect: the virtual
cursor, where clicks land, drifted hundreds of pixels from the cursor on screen
and never reached the screen edges, which also stopped edge panning.

Where warps are not honoured, the virtual cursor now follows the physical
pointer and the game's warps leave it in place. With a hidden cursor, or on a
server that honours warps, nothing changes. The host model test gains a case
replaying the drift from an in-game trace.

Tested manually in the practice tool under gamescope 3.16.31 on GNOME 51 with
AMD RADV: clicks land on the cursor and edge panning works.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-17 00:49:53 +03:00
DevWebeloperandClaude Opus 5.5 adf74bf726 Keep the relative-mode cursor on the visible pointer when warps are not honoured
League enters relative mouse mode on GNOME (Xwayland) and inside gamescope, but
keeps a visible cursor and warps it every frame at its own mouse speed. Xwayland
cannot move a visible pointer, so those warps never took effect: the virtual
cursor, where clicks land, drifted hundreds of pixels from the cursor on screen
and never reached the screen edges, which also stopped edge panning.

Where warps are not honoured, the virtual cursor now follows the physical
pointer and the game's warps leave it in place. With a hidden cursor, or on a
server that honours warps, nothing changes. The host model test gains a case
replaying the drift from an in-game trace.

Tested manually in the practice tool under gamescope 3.16.31 on GNOME 51 with
AMD RADV: clicks land on the cursor and edge panning works.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-17 00:49:53 +03:00
lucannez64 ed9cc8310a Restore X11 fullscreen requests for monitor-sized borderless windows
Port the fullscreen policy omitted when adapting PR #12. Track requested fullscreen state across frame and style changes, exclude unmanaged windows, and use EWMH REMOVE when leaving fullscreen.

Extend the native geometry probe and document passive tracing for the reported vertical click offset, whose cause remains unconfirmed.
2026-10-16 17:13:11 +02:00
lucannez64 3778d518b7 Restore X11 fullscreen requests for monitor-sized borderless windows
Port the fullscreen policy omitted when adapting PR #12. Track requested fullscreen state across frame and style changes, exclude unmanaged windows, and use EWMH REMOVE when leaving fullscreen.

Extend the native geometry probe and document passive tracing for the reported vertical click offset, whose cause remains unconfirmed.
2026-10-16 17:13:11 +02:00
ztancrellandClaude Opus 5.5 4f7916370a Return a real physical size from CGDisplayScreenSize; never return NULL display modes
CGDisplayScreenSize returned 0x0 for any display with EDID (upstream left
that branch unimplemented). League divides by it for its camera aspect
ratio, so the view-projection x row became NaN: every 3D vertex was
discarded, the scene showed only its blue clear colour, and world clicks
were ignored. Read the size from the EDID detailed timing (mm) or basic
parameters (cm), fall back to 96 dpi, and use the main display for an
unknown id.

CGDisplayCopyAllDisplayModes returned NULL for display 0 (a window off
every screen), which League passes straight to CFArrayGetCount. Fall back
to the main display, then to an empty array.

Add riot-display-modes-check covering both for the main display,
display 0 and an unknown id.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-16 10:44:04 -04:00
ztancrellandClaude Opus 5.5 7af99c85db Return a real physical size from CGDisplayScreenSize; never return NULL display modes
CGDisplayScreenSize returned 0x0 for any display with EDID (upstream left
that branch unimplemented). League divides by it for its camera aspect
ratio, so the view-projection x row became NaN: every 3D vertex was
discarded, the scene showed only its blue clear colour, and world clicks
were ignored. Read the size from the EDID detailed timing (mm) or basic
parameters (cm), fall back to 96 dpi, and use the main display for an
unknown id.

CGDisplayCopyAllDisplayModes returned NULL for display 0 (a window off
every screen), which League passes straight to CFArrayGetCount. Fall back
to the main display, then to an empty array.

Add riot-display-modes-check covering both for the main display,
display 0 and an unknown id.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-16 10:44:04 -04:00
lucannez64andMaka d89a303ebe Fix X11 primary-monitor coordinates without changing fullscreen policy
Adapt the geometry fix from PR #12 to the current relative-mouse implementation. Keep display IDs independent of primary-first screen ordering, translate window and pointer coordinates consistently, and invalidate geometry on both RandR event types.

Handle failed RandR snapshots and free EDID data. Add isolated native geometry regression coverage and use the configured SDK when linking the X11 probe.

Validated all 30 component patches, the X11 and CoreGraphics builds, six native geometry groups, and the existing relative-mouse checks. The user confirmed the installed fix works on 2026-10-16.

Co-authored-by: Maka <[email protected]>
2026-10-16 15:52:42 +02:00
lucannez64andMaka 7f0e57fb5e Fix X11 primary-monitor coordinates without changing fullscreen policy
Adapt the geometry fix from PR #12 to the current relative-mouse implementation. Keep display IDs independent of primary-first screen ordering, translate window and pointer coordinates consistently, and invalidate geometry on both RandR event types.

Handle failed RandR snapshots and free EDID data. Add isolated native geometry regression coverage and use the configured SDK when linking the X11 probe.

Validated all 30 component patches, the X11 and CoreGraphics builds, six native geometry groups, and the existing relative-mouse checks. The user confirmed the installed fix works on 2026-10-16.

Co-authored-by: Maka <[email protected]>
2026-10-16 15:52:42 +02:00
lucannez64andClaude Opus 5.5 70fd5fdebd Emulate macOS relative mouse mode in the X11 backend and skip redundant cursor updates
CGAssociateMouseAndMouseCursorPosition(false) used to warp the pointer to the
window center, freeze the reported position there and treat the game's own
CGWarpMouseCursorPosition calls as motion. On Xwayland, which ignores warps
while the cursor is visible, this left League's cursor stuck in the middle.
The backend now keeps a frozen virtual cursor: physical motion only produces
deltas (deltaY positive downwards), application warps move the virtual cursor
and their echoes are dropped, mouseLocation returns it, and the pointer is only
warped back where the server honours warps. The grab no longer uses the
invalid FocusChangeMask and is released and retaken across focus changes.

setCursor: no longer re-sends XDefineCursor/XFlush when the window already has
that cursor; League set it about 190 times per second.

Also carries the opt-in input trace (/tmp/rclol-input-trace in the guest).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-16 15:14:06 +02:00
lucannez64andClaude Opus 5.5 426fb75ec8 Emulate macOS relative mouse mode in the X11 backend and skip redundant cursor updates
CGAssociateMouseAndMouseCursorPosition(false) used to warp the pointer to the
window center, freeze the reported position there and treat the game's own
CGWarpMouseCursorPosition calls as motion. On Xwayland, which ignores warps
while the cursor is visible, this left League's cursor stuck in the middle.
The backend now keeps a frozen virtual cursor: physical motion only produces
deltas (deltaY positive downwards), application warps move the virtual cursor
and their echoes are dropped, mouseLocation returns it, and the pointer is only
warped back where the server honours warps. The grab no longer uses the
invalid FocusChangeMask and is released and retaken across focus changes.

setCursor: no longer re-sends XDefineCursor/XFlush when the window already has
that cursor; League set it about 190 times per second.

Also carries the opt-in input trace (/tmp/rclol-input-trace in the guest).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-16 15:14:06 +02:00
lucannez64 937e632bcf Prepare nested Metal layers before compositing
Traverse the layer tree before compositing so nested Metal layers consume queued drawables and recycle their pool. Add a nested presentation probe covering pool reuse and Vulkan-to-OpenGL pixel readback.
2026-10-16 13:55:09 +02:00
lucannez64 47e91fb7be Prepare nested Metal layers before compositing
Traverse the layer tree before compositing so nested Metal layers consume queued drawables and recycle their pool. Add a nested presentation probe covering pool reuse and Vulkan-to-OpenGL pixel readback.
2026-10-16 13:55:09 +02:00
lucannez64 3d03548b54 Avoid blocking X11 cursor updates on a server round trip 2026-10-16 13:44:11 +02:00
lucannez64 8092e3109b Avoid blocking X11 cursor updates on a server round trip 2026-10-16 13:44:11 +02:00
lucannez64andClaude Sonnet 5.5 6d5d04ff71 Use optimal tiling for the drawable GL import on NVIDIA
NVIDIA's GL rejects GL_LINEAR_TILING_EXT with GL_INVALID_VALUE, so the
linear internal image could not be imported and the window stayed black.
Pick the tiling by GL_VENDOR; other drivers keep linear.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
2026-10-16 11:16:53 +02:00
lucannez64andClaude Sonnet 5.5 68f816deaf Use optimal tiling for the drawable GL import on NVIDIA
NVIDIA's GL rejects GL_LINEAR_TILING_EXT with GL_INVALID_VALUE, so the
linear internal image could not be imported and the window stayed black.
Pick the tiling by GL_VENDOR; other drivers keep linear.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
2026-10-16 11:16:53 +02:00
lucannez64andClaude Opus 5.5 f7eef7d88a Make the CFHost cancel probe wait for delivery and reject completed lookups
Wait up to 2 s for the cancellation callback instead of one 50 ms run-loop
pass, count only callbacks without stored addresses so a completed lookup
cannot pass as a cancellation, print the failing stage, and have the runner
require the exact success line since Darling can exit zero after a trap.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-16 09:09:28 +02:00
lucannez64andClaude Opus 5.5 72093a1b58 Make the CFHost cancel probe wait for delivery and reject completed lookups
Wait up to 2 s for the cancellation callback instead of one 50 ms run-loop
pass, count only callbacks without stored addresses so a completed lookup
cannot pass as a cancellation, print the failing stage, and have the runner
require the exact success line since Darling can exit zero after a trap.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-16 09:09:28 +02:00