SynapseOS 1.0.0

SynapseOS 1.0 — the first release to carry that number. It is a rolling
release: an installed machine keeps taking updates through syn-update, and the
number on an ISO only says which image a machine was installed from.

What is new since 0.3.1: this desktop from another room, a malware scanner, a
Users pane, fingerprints for every administrator prompt, and an assistant that
gets out of the way when the machine needs its memory back.

86 commits.

This desktop, from another machine

syn-remote is new: syn-remote on, and a VNC viewer somewhere else has the
screen — including when nobody is sitting at this one.

The usual "Wayland can't do remote desktop" does not apply here. GNOME and
KDE gate capture behind a portal that asks a human per session, which rules out
unattended access. xdg-desktop-portal-wlr implements ScreenCast but not
RemoteDesktop, so portal-based tools can watch a wlroots desktop and cannot
touch it. wayvnc, the server here, is the wlroots-native one: it captures
through zwlr_screencopy_manager_v1 and drives the seat through
zwp_virtual_pointer_manager_v1 and zwp_virtual_keyboard_manager_v1. synui
implements all three and hands them to any native client, so no portal is
involved and nothing prompts. The one real limit is that nothing exists to
connect to before somebody logs in, and syn-remote status says so.

⛔ A blanked output cannot be captured at all. Once the idle blank stage has
fired, screencopy answers failed to copy output: a viewer gets a grey
rectangle, with no frame to click on to get out of it, ten minutes after the
last keypress. A connection turns the screen it serves back on — that screen,
not every screen in the house — and holds a real idle inhibitor until the last
viewer leaves.

⛔ It binds to loopback. synnet's base firewall is default-drop on input
and accepts everything from 10/8, 172.16/12 and 192.168/16 — so a port on
0.0.0.0 is not "open but firewalled", it is reachable by every device on the
network. syn-remote listen lan is the deliberate way to change that and says
so. Either way the connection carries TLS and a password: sign in with a
generated twenty-character password, or with your own account through PAM.

When somebody is connected, the bar says so. An eye appears on the bar while
a viewer or a stream is attached — not while the server is merely running — and
clicking it ends the session.

And the other end. syn-remote add desktop 192.168.1.50, trust desktop
and connect desktop save somebody else's machine, check its certificate once,
and open it with a viewer that can answer the password itself, from a keyring
if one is running and from a 0600 file if not. trust is not optional:
until the certificate is pinned, the TLS session comes up and is dropped with no
error at the machine you are sitting at.

⛔ A machine that is asleep answers nothing at all. A suspended one has no
server, no port and nothing listening. syn-remote wakeable on arms the wired
card for a magic packet, syn-remote wake <name> sends one to a saved
connection — and syn-remote connect sends one by itself when the machine it
is opening is not answering, then waits for it to really be serving before the
viewer opens. ⚠ A magic packet is a broadcast, so the machine sending it has to
be on the same network.

Arming it writes two places, and it needs both: NetworkManager remembers
the flag and re-applies it every time the connection comes up, which survives a
reboot, a replug and a driver that clears it on link-down; a small helper
applies it right now, because re-activating the connection you are reaching
the machine over would drop the link underneath you. wakeable reads the state
back off the card, not out of the setting — the two disagree in exactly the
case that matters, armed now and forgotten at the next boot.

And the address it is sent to is on screen. A magic packet is addressed to a
hardware address, so waking a machine from another one means reading a MAC off
it first. Settings ▸ Network now lists every interface's hardware address
beside the addresses it holds, with one gateway row and one nameserver row, and
says which cards can be woken at all (wired, not Wi-Fi). Addresses arrive
masked — ••:••:••:••:••:•• — until Reveal addresses is pressed, and so do
the Bluetooth adapter's and every paired device's. This is the window that ends
up in a screenshot attached to a question. syn-settings --reveal is the same
from a terminal.

Settings ▸ Remote Desktop carries all of it. And adding it turned up a pane
that had been missing: Speech existed in syn-settings, every row on it
worked, and the window's sidebar never offered it — so the screen reader and the
wake word were reachable from a terminal and nowhere else. Both panes are in the
window now.

A port for a VPN. sudo synnet --open tcp/5900 100.64.0.0/10 (or
syn net open) opens a port to a source outside the private ranges — the case
that bites a mesh VPN like Tailscale, whose addresses are not private, so the
tunnel comes up and every packet inside it is dropped with nothing in any log
mentioning the firewall. The source is never optional: --open with no range
writes any in full and says out loud what that means.

…and streamed, on a screen that isn't there

VNC sends rectangles of pixels. syn-remote stream on sends an encoded video
frame instead, through sunshine, to Moonlight on a PC, a phone or a TV
box — the GPU does the encoding, so a desktop at 1440p120 is smooth where VNC is
a slideshow. It captures the same way the VNC server does and needs no portal
for the same reason: sunshine's Wayland grabber binds
zwlr_export_dmabuf_manager_v1 and xdg_output, and synui exports both.

By default the stream does not show a monitor. synui grew virtual
displays — synctl virtual add 1920x1080@120 puts a headless output on the
running compositor, a real screen in every way except the cable: it takes a
desktop, it holds windows, the bar and the dock and the wallpaper come up on it,
and nothing scans it out. The stream serves that, so a remote session gets its
own resolution and its own windows, and the screens in the room are not
touched — the client's mouse stays on that display too. Right-click an
application in the dock there for Move Window Here, and with Moonlight
fullscreen on a SynapseOS machine, synui's shortcuts reach the streamed desktop
instead of the machine you are sitting at.

And the display becomes whatever the client asked for. Before each stream,
the client's width, height and frame rate become one resize: a phone gets a
phone-shaped desktop, a 4K television gets a 4K one. The head is resized, never
replaced, because destroying an output re-homes every window that was on it.

⛔ A virtual display is never blanked by the idle stage. Every reason to turn
a screen off is about a panel in a room, and a headless output has none of them
— only somebody at the other end of it.

syn-remote stream solo on turns this machine's own screens off while somebody
is streaming — DPMS off rather than disabled, so the layout does not reshuffle
and the far end does not watch every window jump one screen to the left.

⛔ A streaming host is on the network. sunshine binds every interface and
announces itself over mDNS; there is no loopback-only mode, which is the
opposite of the VNC default above, and stream status, the usage text and the
settings page all say so. Pairing is what stands in the way: Settings ▸
Remote Desktop ▸ Pair a Moonlight client takes the PIN a Moonlight client is
showing, and so does syn-remote stream pair 1234. While the server is down
the same row starts it.

Saved connections know which kind they are: syn-remote add tv 192.168.1.60 --stream saves a Moonlight host, connect opens it with Moonlight, and trust
pairs with it.

sunshine comes from [cachyos], and the installer now adds that repository
on every install — not only with Steam — before it installs the SynapseOS
packages. It is the generic [cachyos] alone, appended last in
/etc/pacman.conf, so it can only supply names no other repository carries
(sunshine, and CachyOS Proton for Steam); core and extra keep every package
they share with it, and the master key is pinned by fingerprint. ⚠ A machine
installed before 1.0 without Steam has no [cachyos], so syn-remote cannot
install there: synpkg cachyos enable-repo adds it the same way.

A malware scanner

syn-scan scans files at rest: a front end giving ClamAV, rkhunter and
chkrootkit one schedule, one quarantine and one window. It detects nothing
itself. synguard watches what programs do — every rule is an activity — and
never looks inside a file, so a download, an archive or a Windows program
sitting in a Wine prefix was invisible to it. syn-scan opens archives: EICAR
inside a .zip, renamed to .exe, is found.

A weekly sweep runs from a timer, findings are quarantined, never
deleted, and syn-scan quarantine restore puts one back without overwriting anything
that has since taken its place. Settings ▸ Malware Scanning shows the last
sweep, the engines and the quarantine, and switches the schedule, the signature
updates and clamd.

clamd is off by default. It keeps the signature set resident — 0.95 GB —
and makes a single scan near-instant (5.9 s → 0.02 s); the weekly sweep barely
benefits. On-access scanning stays masked, because the open() path belongs
to synguard's BPF-LSM. chkrootkit is optional (it lives in BlackArch), and a missing engine is
reported and skipped. ClamAV's own service units ship with no hardening at all;
drop-ins take them from 9.6 UNSAFE to 3.9 and 3.7 PROTECTED.

It is a checkbox in the installer, ticked by default.

Accounts, fingerprints, and what runs at login

Settings ▸ Users. Each account's role (administrator means the wheel
group), a password reset, a finger picker when there is a reader, removal with
or without its files behind a second click, and Add a user. It refuses to
remove or demote the account that is asking, the last administrator, or an
account that is signed in. A new account now gets the desktop: it used to
log into a bare session, because the house synuirc was written into the first
account only. A second account signs in by pressing Tab to the name field at the
login screen.

Administrator prompts take a finger. With a finger enrolled, sudo in a
terminal asks for it first and falls back to the password after ten seconds or
a finger that does not match — and so does the password box behind synpkg,
Settings and software updates. sudo over SSH goes straight to the password.
One switch on the Fingerprint pane covers both.

⛔ An idle login screen could lock the account. With the login fingerprint
on, the greeter re-arms the reader every ten seconds, and each time PAM recorded
the password prompt nobody answered as a failed login. Three of them locked
the account while the finger still worked — and then an update's sudo
rejected the correct password. An unanswered prompt no longer counts; a wrong
password still does. It is applied at every boot, so machines installed before
1.0 are fixed too.

Settings ▸ Startup lists what runs when you log in, from the three places
that actually start programs here: synui's own autostart lines (switched off
and back on without retyping, removed, or added), user services, and XDG
autostart entries —
which a synui session does not run, and says so; switching one on copies its
command into synui's list. synui used to keep eight autostart lines and drop
the rest in silence. It keeps 32 now, and logs any line past that.

The assistant gives the machine back

synapd holds the largest single allocation on the graphics card, and it used
to hold it for the whole session whatever else the desktop was doing. It
watches now:

• VRAM. When free video memory falls below a floor, the model is re-fitted
  with fewer layers on the card and more on the CPU; the layers go back when the
  pressure does.
• RAM and CPU. A layer taken off the card is computed in system memory, so
  when memory is what is short, shedding makes it worse. When available memory
  or the kernel's own stall figure crosses its line, the model is released
  outright and comes back when the machine is quiet — never because of a load
  synapd is causing itself by answering a question.
• Games. Game mode used to stop the daemon. It now releases the model on the
  way into a game and reloads it on the way out. The daemon, its socket and
  retrieval — chibi's memory — stay up for the whole game.

Touchpad gestures

Four fingers left or right change desktop; up and down open and close mission
control. Each gesture is a bind, so any action can go on one
(gesture = swipe:4:left ws next), and Control panel ▸ Input ▸ Touchpad
gestures is the switch over the whole table. Two- and three-finger gestures and
every pinch still reach the application under the pointer unless bound.

Files

A mounted disc image is in the sidebar, under Removable Devices with an
Eject button, named after its label or its file — mounting one from the
right-click menu used to open a window and leave nothing to get back to it or
eject it with. Eject also lets go of the image.

Properties has tabs: General with how much room is left on the disk,
Permissions as a working read/write/execute grid, Checksums on request (paste
a published digest and it says whether it matches), and Details.

The sidebar notices a disk by itself — a stick plugged in, a disc inserted,
a share mounted — instead of waiting for something else to refresh it. And the
Eject button holds still under the pointer.

The Trash has an Original location column and a Deleted date, and the
Restore button restores — it never took a click; right-click ▸ Restore always
worked. Double-clicking a Trash row no longer opens the path the file used to
live at.

The television

A disc in the drive is a tile — Blu-ray, DVD or audio CD, named after the
disc and gone when it comes out. mpv is a Standard install now, because the
tile needs it.

The remote reaches what is playing. Once a tile was pressed, OK, ⏭, ⏮ and
Guide reached nothing at all; they do now, and ⏪ ⏩ wind thirty seconds instead
of skipping to the next file. The on-screen keyboard is on a held Start now:
a press belongs to the game, whose own menu is on Start.

Everything else

• syn-edit's Save dialogue has a name field the moment it opens. It used to
  be a folder picker with nowhere to type.
• Two new screensavers for Super+Z: floaters, after xfce4-screensaver's,
  and a bouncing DVD logo that counts its corner hits.
• A fifth clock face: a pink animal holding the dial.
• transparency_exclude keeps chosen applications solid when windows are
  see-through; mpv and vlc by default.
• A Windows installer run under Wine could open off every screen on a
  floating desktop. Its dialogs are centred now.
• A bar tooltip opened clipped off the right edge the first time it was
  hovered. Any popup a client moved after opening landed unconstrained.
• Dim text on a clear bar was unreadable over some wallpapers — the empty
  desktop numbers, a muted volume, a paused track. It follows the wallpaper now.
• The update badge kept its last count forever when the network was down.
  A failed check says so now.
• The AI model download list is fetched again after six hours, instead of
  once per session.
• chibi's camera is off by default, and has a switch.
• Dictation and the screen reader's voice no longer need chibi. The speech
  engine (faster-whisper, piper and their models) is its own package,
  synapse-voice, with its own checkbox in the installer, and chibi uses the
  same one. Dictation also stopped hearing a microphone that idles off zero, as
  some laptop mics do, as speech that never ends.
• The software list's icons came back. Arch's application catalogue
  switched its icons to JPEG XL on 10 September, which Qt cannot read on its
  own, and every package that was not installed lost its picture. synpkg reads
  them now and brings the decoder with it.

---

Download

The ISO is split into parts to fit GitHub's 2 GiB release-asset limit.
Download all .part* files into one folder, then join them back into a
single ISO and check it. Joining is a plain byte-for-byte concatenation, so any
tool that does not "help" works; the checksum is what tells you it worked.

Linux / macOS

cat SynapseOS-1.0.0-x86_64.iso.part* > SynapseOS-1.0.0-x86_64.iso
sha256sum -c SynapseOS-1.0.0-x86_64.iso.sha256

(Optionally verify each part before reassembly: sha256sum -c SynapseOS-1.0.0-x86_64.iso.parts.sha256)

On macOS the checksum tool is spelled differently — shasum -a 256 -c SynapseOS-1.0.0-x86_64.iso.sha256.

Windows

Open Command Prompt in the folder you downloaded the parts to (Shift+right-click
the folder ▸ Open in Terminal, or cd to it) and run:

copy /b SynapseOS-1.0.0-x86_64.iso.part00 + SynapseOS-1.0.0-x86_64.iso.part01 + SynapseOS-1.0.0-x86_64.iso.part02 SynapseOS-1.0.0-x86_64.iso
certutil -hashfile SynapseOS-1.0.0-x86_64.iso SHA256

/b is not optional: without it copy works in text mode and stops at
the first 0x1A byte, which in an ISO is a few hundred KB in. You get a short
file, no error, and a stick that will not boot.

certutil prints the hash; compare it against the one inside
SynapseOS-1.0.0-x86_64.iso.sha256. To have Windows do the comparison instead, use PowerShell:

(Get-FileHash -Algorithm SHA256 .\SynapseOS-1.0.0-x86_64.iso).Hash -eq (((Get-Content .\SynapseOS-1.0.0-x86_64.iso.sha256) -split '\s+')[0]).ToUpper()

That prints True when the join is good. (Get-FileHash returns uppercase
hex and sha256sum writes lowercase, which is why the file's copy is upper-cased
before the compare — the bytes are the same either way.)

If copy /b gives you trouble, PowerShell can do the join on its own, and it
never has a text mode to fall into:

$out = [System.IO.File]::Create((Join-Path $PWD 'SynapseOS-1.0.0-x86_64.iso'))
Get-ChildItem 'SynapseOS-1.0.0-x86_64.iso.part*' | Sort-Object Name | ForEach-Object {
  $in = [System.IO.File]::OpenRead($_.FullName); $in.CopyTo($out); $in.Close()
}
$out.Close()

Write to USB

This erases the USB stick. It is written as a raw disk image, not copied as a
file, so whatever was on it is gone.

Linux / macOS

sudo dd if=SynapseOS-1.0.0-x86_64.iso of=/dev/sdX bs=4M status=progress oflag=sync

Check /dev/sdX with lsblk first, and write to the disk
(/dev/sdb), not a partition on it (/dev/sdb1).

Windows

Use one of:

• Rufus — pick the ISO, leave the defaults, click START.
  It will ask whether to write in ISO Image mode or DD Image mode: choose
  DD Image mode. This is a hybrid image and DD mode writes it unaltered;
  ISO mode rebuilds the boot files and has no reason to get this one right.
• balenaEtcher — select image, select drive,
  Flash. Nothing to configure; it only ever writes raw.
• Ventoy — if you already run a Ventoy stick,
  just copy SynapseOS-1.0.0-x86_64.iso onto it and pick it from the boot menu. Nothing is erased
  and other ISOs on the stick keep working.

Then reboot and choose the USB stick from your firmware's boot menu (usually
F12, F11, Esc or Del at power-on). Secure Boot must be off, or SynapseOS enrolled
— see the wiki's Secure Boot page.