AutoHotkey v2.0.26 for Linux - linux.22

AutoHotkey v2.0.26 for Linux - linux.22

This release closes the deterministic high-priority findings from AutoHotkey_Linux_Audit_47d1fcc_zh.md and adds real interaction gates for the Syntax Studio example and VS Code tooling. The project remains a technology preview with explicit desktop and long-soak boundaries.

Highlights

• Local evdev fail-open: keyboard-only admission rejects composite pointer nodes; raw keycode/value/repeat replay preserves the physical event; SYN_DROPPED waits for a frame boundary and reconciles with EVIOCGKEY; an independent grab watchdog releases EVIOCGRAB after a stalled owner.
• Per-device and multi-transaction state: remap replacement ownership is stored per physical device; broker synthetic held-key references are shared across injection transactions so abort/timeout cannot release another transaction's key.
• Capability correctness: required suppression is rejected when the negotiated inputd grant is absent instead of silently becoming observe-only. ahk --check now reports backend, broker socket and /dev/uinput diagnostics.
• Clipboard restore: native-Wayland paste saves a rich ClipboardAll snapshot when available; X11 owner check and restore are serialized briefly at the server; Wayland cancellation remains conservative.
• X11 and pack safety: fatal Xlib I/O marks the connection unusable and reconnects only from normal code; --pack fails before replacing an existing output on missing resources, uses checked footer arithmetic and atomic finalization.
• Packaging: AUR is pinned to linux.22 with a verified SHA-256 source archive; Flatpak is pinned to linux.22 and explicitly grants only --device=input, without claiming /dev/uinput automation.
• Real UI/tool gates: Syntax Studio has an X11 interaction oracle for lesson selection, search filtering, Check, Run and output creation. VS Code extension-host/DAP validation is now required in core CI.

Verification

• VM: inputd protocol 28/28, injection 26/26, headless regression 27/27, paste-restore PASS, pack failure and positive pack PASS, Syntax Studio UI PASS.
• Source guards cover evdev watchdog/raw replay, per-device broker state, effective capabilities, IME snapshots, Xlib I/O policy, package pins, launcher diagnostics and pack failure safety.
• Core CI additionally runs the real Syntax Studio X11 interaction oracle, pack negative-path oracle and the VS Code extension-host/DAP oracle.
• Real KDE, real desktop Fcitx5, Flatpak/portal IM visibility, physical multi-device fault injection, and 24-72 hour multi-script soak remain explicit environment-dependent boundaries.

Assets

• autohotkey-linux-2.0.26-linux.22-amd64.deb
• autohotkey-linux-2.0.26-linux.22-x86_64.rpm
• autohotkey-linux-2.0.26-linux.22-amd64.tar.gz
• autohotkey-linux-2.0.26-linux.22-x86_64.AppImage
• autohotkey-linux-tools-0.2.1.vsix
• CKSUMS.txt
• UNSIGNED.txt