fix(flatpak): allocate PTY on host via rio-pty-host helper

[daniloaguiarbr]

Summary

Fix tty: not a tty / no such device warning seen on the first shell line when Rio is launched from the Flatpak build (Fedora 44, runtime org.freedesktop.Platform/x86_64/25.08).

The existing flatpak-spawn integration in teletypewriter/src/unix/mod.rs (added in #1116 and earlier work referenced in #198) successfully launches the host shell, but the PTY itself is still allocated inside the sandbox via openpty(). Bash login init scripts that call ttyname(0) — most notably /etc/profile.d/gnupg2.sh (export GPG_TTY=$(tty)) on Fedora — therefore fail with ENODEV, because the sandbox /dev/pts/N does not exist in the host's mount namespace. GPG_TTY ends up empty as a side effect.

This PR introduces a small helper binary, rio-pty-host, that runs on the host and creates the PTY there. Rio then spawns the user's shell through that helper, so ttyname() resolves correctly and GPG_TTY is populated as expected.

Approach

• New crate rio-pty-host (added to the workspace) — uses only libc (workspace) plus thiserror = \"2.0.1\" (promoted to [workspace.dependencies]). No additional transitive dependencies.
• The helper does the standard openpty → fork → child runs setsid + ioctl(TIOCSCTTY) + dup2 + execvp → parent relays I/O between its stdio (the sandbox PTY slave that arrived through flatpak-spawn) and the host PTY master.
• All unsafe blocks carry a // SAFETY: comment explaining the maintained invariant.
• Shell paths are validated as absolute (starts_with('/')) before being passed to execvp to avoid PATH manipulation; CString failures map to a dedicated ShellInvalido variant.
• Signal handling on the parent uses a static AtomicBool (no Arc::into_raw leak); SIGCHLD wakes up the relay loop, after which waitpid returns the child exit status.

On the Rio side:

• New module teletypewriter::unix::flatpak caches the /.flatpak-info probe and the resolved path of ~/.local/bin/rio-pty-host via OnceLock.
• On first invocation inside Flatpak, it checks for an existing host-side helper; if missing, it installs the bundled /app/bin/rio-pty-host via flatpak-spawn --host using a stdin pipe and an atomic mktemp → chmod +x → mv -f sequence (atomicity comes from rename(2) on the same filesystem, so concurrent Rio instances are safe).
• create_pty_with_spawn now prefers the helper when available and falls back to the existing direct-shell invocation when it isn't, emitting a tracing::warn that names the residual cosmetic limitation.
• \$SHELL retrieved via flatpak-spawn is defensively trimmed and falls back to /bin/sh if empty.
• Behaviour is unchanged on macOS, FreeBSD, and any non-Flatpak Linux launch.

Distribution Note

This PR adds the source crate and the runtime auto-install plumbing inside Rio. The Flathub manifest at flathub/com.rioterm.Rio will need a follow-up to actually build rio-pty-host and ship it at /app/bin/rio-pty-host; the Rio code degrades gracefully (legacy behaviour with the warn message) if that binary is absent.

Tests

• rio-pty-host: 7 unit tests covering argv parsing, openpty validity, absolute-path enforcement (relative shell name and ../foo both rejected), and a happy-path spawn that runs /bin/echo and waits for it.
• teletypewriter: 3 unit tests around the new module — installation no-op when /app/bin/rio-pty-host is absent, obter_home_host doesn't panic, and a documented #[ignore]-d Flatpak detection test (the OnceLock cannot be reset between tests in the same process; the recommended invocation is via assert_cmd in a subprocess).

Validation

cargo check  -p rio-pty-host -p teletypewriter             # PASS, 0 errors
cargo clippy -p rio-pty-host -p teletypewriter -- -D warnings  # PASS, 0 warnings
cargo fmt    -p rio-pty-host -p teletypewriter --check     # PASS, 0 diffs
cargo test   -p rio-pty-host                                # 7/7 PASS
cargo test   -p teletypewriter --lib                       # 2/2 PASS, 1 ignored
cargo build  -p rio-pty-host --release                     # 328 KB binary

Known Limitation (v1)

SIGWINCH is not yet propagated by rio-pty-host to the child shell. The initial winsize is set from <COLS> <ROWS> arguments, but dynamic resize after Rio's window changes will not reach the host PTY. A v2 follow-up should monitor TIOCGWINSZ on the helper's stdin and forward via TIOCSWINSZ to the host master.

Test plan

• cargo check / clippy / fmt --check / test clean
• Manual: launch the Flatpak build with the bundled rio-pty-host and confirm:
  • First shell line no longer prints tty: ttyname: ... / not a tty
  • tty returns /dev/pts/N and echo \$GPG_TTY prints the same
  • Multiple terminal tabs each get distinct /dev/pts/N and behave normally
• Verify legacy fallback (warn message) by removing ~/.local/bin/rio-pty-host after first install

Related

• Original Flatpak shell-detection work: Flatpak #198, Skip passing sandbox env to spawned shell in Flatpak #1116.