Nexus Manager 0.0.4

A security and robustness pass over 0.0.3. Everything below was found by reviewing the code rather than by waiting for it to go wrong, and each fix was verified against the failure it repairs.

If you are on 0.0.3, this replaces it. Not affiliated with or endorsed by Corsair.

What's Fixed

• The headless service could never start — The bundled systemd user unit set ProtectHome=, which covers /run/user as well as your home directory. That made the directory holding the panel lock read-only, so the daemon could not start and reported "the panel is already being driven by another instance" — naming a process that did not exist. Anyone who tried to run the panel without a tray hit this every time.
• A damaged configuration crashed the application on startup — An interrupted save, or a hand edit with a typo in it, left screens.json unreadable and the application died on launch with no message explaining why. It now tells you what is wrong with the file, keeps a copy of it alongside, and starts from a freshly discovered configuration instead of overwriting what you had.
• Lock failures blamed the wrong thing — Several unrelated problems all reported that another instance held the panel. If you were told to stop a program that was not running, this is why.
• Launching a program could hang the button that launched it — A launch action waited on the program's output, so a program that printed a lot could deadlock, and launching anything long-lived tied up a worker for as long as it stayed open.
• A predictable temporary directory — On systems where XDG_RUNTIME_DIR is not set, the fallback directory under /tmp was created with default permissions at a name another user on the same machine could guess and create first. It is now created private to you, and refused if it is not.

What's New

• The Debian package installs the headless service — Previously only the AUR package did, so there was no supported way to run the daemon without a tray on Debian or Ubuntu.
• A security document — SECURITY.md sets out what the application can do, what it deliberately does not need — no root, no network, no system daemon — and where the trust boundaries are. Worth reading if you configure launch actions or key presses.

What's Updated

• The service is sandboxed considerably harder — System call filtering, no network access at all, and device access closed to everything except the panel and the virtual keyboard. systemd-analyze security rates the unit 1.3 where it previously rated 7.0. Two settings that improved the rating were removed again because the service would not start with them; SECURITY.md records which and why.

Installing

# Debian / Ubuntu
sudo dpkg -i nexus-manager.deb && sudo apt-get -f install

# Arch
paru -S nexus-manager-bin

Both install the udev rule and reload udev. If the panel was already plugged in, replug it or reboot so the access rule applies.

The music visualizers capture the default output through parec, which comes from pulseaudio-utils on Debian and libpulse on Arch. Everything else works without an audio server.