muglock v0.2.0

The scanner moved to howdy-next 3.x, which is the branch that is actually maintained — and it is faster, because the Python interpreter is no longer on the scan path.

• Native howdy-compare instead of howdy 2.x's compare.py: 1.88 s per unlock over five consecutive runs (5/5 matched, max 1.90 s), against 2.9–3.1 s on the same machine and camera. About 0.9 s of the old number was interpreter startup plus numpy/cv2/dlib imports.
• Recognition engine is YuNet + SFace (ONNX), not dlib. The match knob is [face] sface_threshold, not certainty, and the sudoers line names the new helper.
• ⚠️ Upgrading requires re-enrolling your face — sudo howdy add. howdy-next keeps models in its own location, so an upgraded machine has a working camera and no enrolled face.
• Two exit codes were classified wrong, and the fix is the point of this release. Exit 10 is "no model for this user", not a backend fault — mapping it to "Camera unavailable" is exactly how a healthy webcam came to look broken during this migration. It now says "No face enrolled" and names the fix. Exit 11 is the scan window expiring, and howdy-next has no separate no-match code, so it reads "didn't recognize you" rather than a timeout.
• lockNoScan IPC command: engage the lock without starting a scan, for a lid daemon locking a laptop that is already shut. That used to burn several seconds of camera time and land on "too dark" — a message for someone who can see the screen, drawn on a closed panel. The scan happens on the following wake.
• Fixed: an unlock that went through the watchdog left the lock screen pinned over the desktop. forceUnlock() cleared fading but left overlayArmed to fadeAnim.onStopped, and stop() emits nothing when the animation never ran — which is precisely that path. The overlay stayed mapped at full opacity and, being input-transparent, produced a working cursor under a frozen lock screen until the daemon was killed from a tty.

Full list in CHANGELOG.md.

⚠️ RGB camera — can be fooled by a photo. Convenience, not a security boundary. Your password always works.
🤖 100% vibecoded.

muglock v0.1.1

First round of fixes from actually living with it for a night. The headline ones:

• Runtime assets never loaded from an installed config. The config is a symlink and Quickshell.shellPath() resolves against it, so ../assets/... pointed outside it — the unlock chirp silently never played and the background dither never rendered. Assets moved inside shell/, and a new test runs the shell through a symlink, which is the coverage that was missing.
• A failed scan could leave the camera unable to deliver frames until the kernel module was reloaded: the UI cap fired before the kernel-side cap and SIGKILLed sudo, orphaning the process holding the camera, which was then killed mid-capture. Teardown is SIGTERM now, relayed all the way down, and the timeout ladder fires inside-out.
• A wrong password could lock out the password path entirely — PAM was answered on a property transition that only fires once per process. Answered per message now, with Escape as an abort.
• The second unlock of a session could hang on the checkmark. Overlays are armed at lock time, a watchdog unlocks without the animation, and an authenticated unlock always wins over animation state.
• Honest failure messages: "didn't recognize you" only when howdy really looked and did not match. A busy camera, a dark room, a timeout and a broken config each say so.
• Keyboard layout chip in the password field, loud when the layout is not EN.
• The background is dithered: the palette spans ~38 blue values across the screen, so an exact 8-bit gradient could only render as ~24 px stripes.

Full list in CHANGELOG.md.

⚠️ RGB camera — can be fooled by a photo. Convenience, not a security boundary.
🤖 100% vibecoded.

muglock v0.1.0

macOS-style FaceID for the Hyprland lockscreen.

• quickshell (QML) lockscreen with WlSessionLock, PAM password fallback, EN/RU layout chip
• face recognition via howdy 2.6.x (compare.py), scan hard-capped at 12 s via kernel-side timeout
• success chirp + seamless fade-to-desktop through an overlay-layer handoff
• mock/dev modes for hacking without a camera or root
• install: AUR-style via install.sh on Arch, or the attached .deb (deps checked by postinst)

⚠️ RGB camera only — can be fooled by a photo. Convenience, not a security boundary.
🤖 100% vibecoded: every line written by Claude in dialogue with a human.