Skip to content

fix: provision lua runtime and repair fish activation #1858

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kRHYME7 merged 2 commits into from
Jul 29, 2026
+112 −21
Merged

fix: provision lua runtime and repair fish activation #1858

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
72da2c9
#1852 fix: provision lua runtime and repair fish activation
RAprogramm Jul 28, 2026
2625e00
#1852 fix: unify lua resolution and isolate the runtime fallback
RAprogramm Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 56 additions & 7 deletions Configs/.local/lib/hyde/shell/activate
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,32 @@ HYDE_ACTIVATED=1
HYDE_MODE=""
HYPRLAND_CONFIG=""

# A per-user runtime directory. Falling back to a shared directory would put
# sockets from every session into one namespace, so the fallback is private and
# only readable by its owner.
hyde_runtime_dir() {
_uid=$(id -u 2>/dev/null) || _uid=''

if [ -n "$_uid" ] && [ -d "/run/user/$_uid" ] && [ -w "/run/user/$_uid" ]; then
printf '%s\n' "/run/user/$_uid"
unset _uid
return 0
fi

_dir="${TMPDIR:-/tmp}/hyde-${_uid:-$$}"
mkdir -p "$_dir" 2>/dev/null && chmod 700 "$_dir" 2>/dev/null
printf '%s\n' "$_dir"
unset _uid _dir
}

setup_xdg() {
: "${XDG_CONFIG_HOME:=$HOME/.config}"
: "${XDG_CACHE_HOME:=$HOME/.cache}"
: "${XDG_DATA_HOME:=$HOME/.local/share}"
: "${XDG_STATE_HOME:=$HOME/.local/state}"

# fallback only
: "${XDG_RUNTIME_DIR:=/tmp}"
[ -n "${XDG_RUNTIME_DIR:-}" ] || XDG_RUNTIME_DIR=$(hyde_runtime_dir)
Comment on lines +22 to +35

@coderabbitai coderabbitai Bot Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Secure runtime-directory creation and fail closed in both activation scripts. Both fallbacks accept a predictable path under $TMPDIR and export it even if permission hardening fails, allowing a pre-created directory to become the session runtime namespace.

  • Configs/.local/lib/hyde/shell/activate#L22-L35: create a unique owner-private directory atomically (or validate owner/mode) and return failure without exporting it when setup fails.
  • Configs/.local/lib/hyde/shell/activate.fish#L21-L35: apply the equivalent secure creation/validation and prevent set -gx XDG_RUNTIME_DIR after failure.
📍 Affects 2 files
  • Configs/.local/lib/hyde/shell/activate#L22-L35 (this comment)
  • Configs/.local/lib/hyde/shell/activate.fish#L21-L35
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Configs/.local/lib/hyde/shell/activate` around lines 22 - 35, The
runtime-directory fallbacks must fail closed instead of exporting a predictable
or improperly secured path. In Configs/.local/lib/hyde/shell/activate lines
22-35, update hyde_runtime_dir/setup_xdg to create a unique owner-private
directory atomically or validate its owner and mode, return failure when setup
or hardening fails, and avoid assigning XDG_RUNTIME_DIR in that case. Apply the
equivalent secure creation/validation and failure guard in
Configs/.local/lib/hyde/shell/activate.fish lines 21-35, preventing set -gx
XDG_RUNTIME_DIR after failure.

@kRHYME7 kRHYME7 Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

was this handled ? @RAprogramm ?

@RAprogramm RAprogramm Jul 29, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that line is the fix rather than the old code. The /tmp default is gone:

[ -n "${XDG_RUNTIME_DIR:-}" ] || XDG_RUNTIME_DIR=$(hyde_runtime_dir)

hyde_runtime_dir prefers /run/user/$(id -u) when it exists and is writable, and only otherwise falls back to ${TMPDIR:-/tmp}/hyde-$(id -u) created with mode 700. Same change in activate.fish.

Checked both paths: with /run/user present both shells report /run/user/1000; with a stubbed id returning an unused uid both create the private directory as drwx------.

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!


export XDG_CONFIG_HOME XDG_CACHE_HOME XDG_DATA_HOME XDG_STATE_HOME XDG_RUNTIME_DIR
}
Expand Down Expand Up @@ -69,18 +87,49 @@ hyprland_has_lua() {
return 1
}

# Mirrors the resolution order in pyutils/lua_env.py, so a runtime that is good
# enough to provision the environment is not rejected here.
hyde_find_bin() {
for _candidate in "$@"; do
[ -n "$_candidate" ] || continue
if command -v "$_candidate" >/dev/null 2>&1; then
printf '%s\n' "$_candidate"
unset _candidate
return 0
fi
done

unset _candidate
return 1
}

hyde_find_lua() {
hyde_find_bin "${LUA:-}" lua lua5.5 lua5.4 lua5.3
}

hyde_find_luarocks() {
hyde_find_bin "${LUAROCKS:-}" luarocks luarocks-5.5 luarocks-5.4 luarocks-5.3
}

check_lua_runtime() {
hyde_has lua || return 1
hyde_has luarocks || return 1
_missing=''
hyde_find_lua >/dev/null || _missing='lua'
hyde_find_luarocks >/dev/null || _missing="${_missing:+$_missing }luarocks"

[ -z "$_missing" ] || {
printf 'Lua runtime incomplete, missing: %s\n' "$_missing" >&2
unset _missing
return 1
}

unset _missing
return 0
}

setup_lua_mode() {
HYPRLAND_CONFIG=$(find_hyde_lua)

check_lua_runtime || {
printf 'Lua runtime incomplete\n' >&2
return 1
}
check_lua_runtime || return 1

hyprland_has_lua || {
printf 'Hyprland lacks Lua support\n' >&2
Expand Down
69 changes: 55 additions & 14 deletions Configs/.local/lib/hyde/shell/activate.fish
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,30 @@ set -x HYDE_ACTIVATED 1
set -x HYDE_MODE ""
set -x HYPRLAND_CONFIG ""

# A per-user runtime directory. Falling back to a shared directory would put
# sockets from every session into one namespace, so the fallback is private and
# only readable by its owner.
function hyde_runtime_dir
set -l uid (id -u 2>/dev/null)
if test -n "$uid" -a -d "/run/user/$uid" -a -w "/run/user/$uid"
echo "/run/user/$uid"
return 0
end
set -l tmp $TMPDIR
test -n "$tmp"; or set tmp /tmp
set -l dir "$tmp/hyde-$uid"
mkdir -p $dir 2>/dev/null; and chmod 700 $dir 2>/dev/null
echo $dir
end

# Assignment is unconditional so a value that already exists in a non-exported
# scope still reaches child processes.
function setup_xdg
set -q XDG_CONFIG_HOME; or set -x XDG_CONFIG_HOME "$HOME/.config"
set -q XDG_CACHE_HOME; or set -x XDG_CACHE_HOME "$HOME/.cache"
set -q XDG_DATA_HOME; or set -x XDG_DATA_HOME "$HOME/.local/share"
set -q XDG_STATE_HOME; or set -x XDG_STATE_HOME "$HOME/.local/state"
set -q XDG_RUNTIME_DIR; or set -x XDG_RUNTIME_DIR "/tmp"
set -gx XDG_CONFIG_HOME (test -n "$XDG_CONFIG_HOME"; and echo $XDG_CONFIG_HOME; or echo "$HOME/.config")
set -gx XDG_CACHE_HOME (test -n "$XDG_CACHE_HOME"; and echo $XDG_CACHE_HOME; or echo "$HOME/.cache")
set -gx XDG_DATA_HOME (test -n "$XDG_DATA_HOME"; and echo $XDG_DATA_HOME; or echo "$HOME/.local/share")
set -gx XDG_STATE_HOME (test -n "$XDG_STATE_HOME"; and echo $XDG_STATE_HOME; or echo "$HOME/.local/state")
set -gx XDG_RUNTIME_DIR (test -n "$XDG_RUNTIME_DIR"; and echo $XDG_RUNTIME_DIR; or hyde_runtime_dir)
end

function hyde_die
Expand Down Expand Up @@ -61,18 +79,41 @@ function hyprland_has_lua
return 1
end

# Mirrors the resolution order in pyutils/lua_env.py, so a runtime that is good
# enough to provision the environment is not rejected here.
function hyde_find_bin
for candidate in $argv
test -n "$candidate"; or continue
if hyde_has $candidate
echo $candidate
return 0
end
end
return 1
end

function hyde_find_lua
hyde_find_bin $LUA lua lua5.5 lua5.4 lua5.3
end

function hyde_find_luarocks
hyde_find_bin $LUAROCKS luarocks luarocks-5.5 luarocks-5.4 luarocks-5.3
end

function check_lua_runtime
hyde_has lua; or return 1
hyde_has luarocks; or return 1
set -l missing
hyde_find_lua >/dev/null; or set -a missing lua
hyde_find_luarocks >/dev/null; or set -a missing luarocks
if test (count $missing) -gt 0
echo "Lua runtime incomplete, missing: $missing" >&2
return 1
end
end

function setup_lua_mode
set -l cfg (find_hyde_lua)
and set -gx HYPRLAND_CONFIG $cfg
check_lua_runtime; or begin
echo "Lua runtime incomplete" >&2
return 1
end
check_lua_runtime; or return 1
hyprland_has_lua; or begin
echo "Hyprland lacks Lua support" >&2
return 1
Expand All @@ -82,9 +123,9 @@ function setup_lua_mode
end

function setup_session
set -q XDG_CURRENT_DESKTOP; or set -x XDG_CURRENT_DESKTOP "HyDE"
set -q XDG_SESSION_DESKTOP; or set -x XDG_SESSION_DESKTOP "HyDE"
set -q XDG_SESSION_TYPE; or set -x XDG_SESSION_TYPE "wayland"
set -gx XDG_CURRENT_DESKTOP (test -n "$XDG_CURRENT_DESKTOP"; and echo $XDG_CURRENT_DESKTOP; or echo "HyDE")
set -gx XDG_SESSION_DESKTOP (test -n "$XDG_SESSION_DESKTOP"; and echo $XDG_SESSION_DESKTOP; or echo "HyDE")
set -gx XDG_SESSION_TYPE (test -n "$XDG_SESSION_TYPE"; and echo $XDG_SESSION_TYPE; or echo "wayland")
end

function hyde_activate
Expand Down
1 change: 1 addition & 0 deletions Scripts/pkg_core.lst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ wl-clip-persist # Keep Wayland clipboard
hyprsunset # blue light filter

# --------------------------------------------------- // Dependencies
lua # lua interpreter, required by the hyprland configuration
hyprpolkitagent # authentication agent
xdg-desktop-portal-hyprland # xdg desktop portal for hyprland
xdg-desktop-portal-gtk # file picker and dbus integration
Expand Down
Loading