From fe16e1c85216c0df86c13cda9397aed829e04f4b Mon Sep 17 00:00:00 2001
From: Mat4m0 <matthias@lupinum.com>
Date: Mon, 31 Aug 2026 02:10:10 +0200
Subject: [PATCH] feat(linux): protect saved login with Secret portal

---
 .../src/components/GeneralUpdateSettings.vue  |   4 +-
 .../UpdateGameFilesSettings.test.ts           |  16 ++
 apps/launcher/src/launcher-view-model.ts      |   1 +
 apps/launcher/src/update-game-files-copy.ts   |   6 +
 forge.config.ts                               |   2 +-
 packaging/linux/io.github.mat4m0.gwonmac.yml  |   1 -
 scripts/build-linux-secret-portal.mjs         |  31 +++
 scripts/build.mjs                             |  10 +-
 scripts/package-ignore.ts                     |   1 +
 src/main/app-updater.ts                       |  16 +-
 src/main/linux-portal-keychain.ts             | 234 ++++++++++++++++++
 src/main/main.ts                              |  22 +-
 src/native/linux-secret-portal/main.cpp       | 232 +++++++++++++++++
 src/shared/contracts.ts                       |   5 +
 tests/policy/forbidden-artifacts.test.ts      |   1 +
 tests/policy/source-linux-flatpak.test.ts     |   2 +-
 tests/policy/source-native-keychain.test.ts   |  12 +-
 tests/policy/source-release-pipeline.test.ts  |   6 +-
 .../policy/source-saved-login-surface.test.ts |   7 +-
 tests/unit/app-updater.test.ts                |  20 ++
 tests/unit/linux-portal-keychain.test.ts      |  81 ++++++
 21 files changed, 683 insertions(+), 27 deletions(-)
 create mode 100644 scripts/build-linux-secret-portal.mjs
 create mode 100644 src/main/linux-portal-keychain.ts
 create mode 100644 src/native/linux-secret-portal/main.cpp
 create mode 100644 tests/unit/linux-portal-keychain.test.ts

diff --git a/apps/launcher/src/components/GeneralUpdateSettings.vue b/apps/launcher/src/components/GeneralUpdateSettings.vue
index cf6183f7..b3f82324 100644
--- a/apps/launcher/src/components/GeneralUpdateSettings.vue
+++ b/apps/launcher/src/components/GeneralUpdateSettings.vue
@@ -33,14 +33,14 @@ function performAction(): Promise<void> {
 <template>
   <h1>General</h1>
   <div class="setting-group">
-    <label>
+    <label v-if="update.phase !== 'managed'">
       <span>
         <strong>Automatically update this launcher</strong>
         <small>Checks for Guild Wars Reforged app updates. Guild Wars game files update separately.</small>
       </span>
       <input type="checkbox" :checked="settings.autoCheckUpdates" @change="save({ autoCheckUpdates: checked($event) })" />
     </label>
-    <label>
+    <label v-if="update.phase !== 'managed'">
       <span><strong>Launcher update channel</strong><small>Stable is recommended.</small></span>
       <select :value="settings.updateTrack" @change="save({ updateTrack: track($event) })">
         <option value="stable">Stable</option>
diff --git a/apps/launcher/src/components/UpdateGameFilesSettings.test.ts b/apps/launcher/src/components/UpdateGameFilesSettings.test.ts
index 16017834..602c5315 100644
--- a/apps/launcher/src/components/UpdateGameFilesSettings.test.ts
+++ b/apps/launcher/src/components/UpdateGameFilesSettings.test.ts
@@ -23,6 +23,22 @@ describe("launcher update settings", () => {
     expect(wrapper.text()).toContain("Guild Wars game files update separately");
   });
 
+  it("leaves Flatpak application updates to the software center", () => {
+    const wrapper = mount(GeneralUpdateSettings, {
+      props: {
+        settings: fixtureSnapshot.settings,
+        update: { phase: "managed", currentVersion: "2026.8.10" },
+        save: noOp,
+        check: noOp,
+        restart: noOp,
+        openReleases: noOp,
+      },
+    });
+    expect(wrapper.text()).toContain("installed by your software center");
+    expect(wrapper.text()).not.toContain("Automatically update this launcher");
+    expect(wrapper.find("button").exists()).toBe(false);
+  });
+
   it("opens Releases instead of looping a manual Stable return through Check now", async () => {
     const openReleases = vi.fn(noOp);
     const check = vi.fn(noOp);
diff --git a/apps/launcher/src/launcher-view-model.ts b/apps/launcher/src/launcher-view-model.ts
index e2a93462..31714be6 100644
--- a/apps/launcher/src/launcher-view-model.ts
+++ b/apps/launcher/src/launcher-view-model.ts
@@ -69,6 +69,7 @@ export function cacheSummary(info: CacheInfo): string {
 
 export function updateStatus(update: AppUpdateState): { title: string; detail: string } {
   switch (update.phase) {
+    case "managed": return { title: "Application updates", detail: "Updates are installed by your software center." };
     case "checking": return { title: "Checking for updates…", detail: `Installed version ${update.currentVersion}` };
     case "up-to-date": return { title: "Guild Wars Reforged is up to date", detail: `Version ${update.currentVersion}` };
     case "downloading": return { title: `Downloading version ${update.latestVersion}…`, detail: `Installed version ${update.currentVersion}` };
diff --git a/apps/launcher/src/update-game-files-copy.ts b/apps/launcher/src/update-game-files-copy.ts
index f863829f..bc25cbbe 100644
--- a/apps/launcher/src/update-game-files-copy.ts
+++ b/apps/launcher/src/update-game-files-copy.ts
@@ -15,6 +15,12 @@ export function applicationUpdatePresentation(
   update: AppUpdateState,
 ): ApplicationUpdatePresentation {
   switch (update.phase) {
+    case "managed":
+      return {
+        title: "Launcher updates",
+        detail: `Version ${update.currentVersion}. Updates are installed by your software center.`,
+        action: "none",
+      };
     case "checking":
       return {
         title: "Checking for launcher updates…",
diff --git a/forge.config.ts b/forge.config.ts
index c3fd835f..9c0a966c 100644
--- a/forge.config.ts
+++ b/forge.config.ts
@@ -103,7 +103,7 @@ const config: ForgeConfig = {
     // `.node` addon cannot be dlopen'd from it, and a helper cannot be spawned
     // from it.
     asar: {
-      unpack: "**/build/native/{host.node,windows-host.node,gw-dat-decode,gw-dat-decode.exe}",
+      unpack: "**/build/native/{host.node,windows-host.node,gw-secret-portal,gw-dat-decode,gw-dat-decode.exe}",
     },
     name: channelConfig.productName,
     executableName: channelConfig.productName,
diff --git a/packaging/linux/io.github.mat4m0.gwonmac.yml b/packaging/linux/io.github.mat4m0.gwonmac.yml
index 03f04522..31764035 100644
--- a/packaging/linux/io.github.mat4m0.gwonmac.yml
+++ b/packaging/linux/io.github.mat4m0.gwonmac.yml
@@ -15,7 +15,6 @@ finish-args:
   - --socket=x11
   - --socket=pulseaudio
   - --device=dri
-  - --talk-name=org.freedesktop.portal.Secret
   - --env=ELECTRON_TRASH=gio
   - --env=XCURSOR_PATH=/run/host/user-share/icons:/run/host/share/icons
 
diff --git a/scripts/build-linux-secret-portal.mjs b/scripts/build-linux-secret-portal.mjs
new file mode 100644
index 00000000..323876e6
--- /dev/null
+++ b/scripts/build-linux-secret-portal.mjs
@@ -0,0 +1,31 @@
+import { spawnSync } from "node:child_process";
+import { mkdirSync } from "node:fs";
+
+if (process.platform !== "linux" || process.arch !== "x64") {
+  throw new Error("the Secret portal helper is an x86_64 Linux build");
+}
+
+const flags = spawnSync("pkg-config", ["--cflags", "--libs", "gio-unix-2.0"], {
+  encoding: "utf8",
+});
+if (flags.status !== 0) {
+  throw new Error(flags.stderr || "gio-unix-2.0 development files are required");
+}
+mkdirSync("build/native", { recursive: true });
+const result = spawnSync("c++", [
+  "-std=c++20",
+  "-O2",
+  "-fPIE",
+  "-pie",
+  "-fstack-protector-strong",
+  "-D_FORTIFY_SOURCE=3",
+  "-Wall",
+  "-Wextra",
+  "-Werror",
+  "src/native/linux-secret-portal/main.cpp",
+  "-o",
+  "build/native/gw-secret-portal",
+  ...flags.stdout.trim().split(/\s+/u),
+  "-Wl,-z,relro,-z,now",
+], { stdio: "inherit" });
+if (result.status !== 0) throw new Error("Secret portal helper build failed");
diff --git a/scripts/build.mjs b/scripts/build.mjs
index 8f3b43d1..acb69dfb 100644
--- a/scripts/build.mjs
+++ b/scripts/build.mjs
@@ -197,9 +197,9 @@ export function nativeBuildSteps(platform, architecture) {
     if (architecture !== "x64") {
       throw new Error(`unsupported Linux build architecture: ${architecture}`);
     }
-    return [[
-      "c++",
-      [
+    return [
+      [process.execPath, ["scripts/build-linux-secret-portal.mjs"]],
+      ["c++", [
         "-std=c++20",
         "-O2",
         '-D__int64=long long',
@@ -209,8 +209,8 @@ export function nativeBuildSteps(platform, architecture) {
         ...DECODER_SOURCES,
         "-o",
         "build/native/gw-dat-decode",
-      ],
-    ]];
+      ]],
+    ];
   }
 
   throw new Error(`unsupported native build platform: ${platform}`);
diff --git a/scripts/package-ignore.ts b/scripts/package-ignore.ts
index 59e311e4..c439e1e4 100644
--- a/scripts/package-ignore.ts
+++ b/scripts/package-ignore.ts
@@ -31,6 +31,7 @@ export function ignorePackageFile(file: string): boolean {
     p === "/build/native"
     || p === "/build/native/host.node"
     || p === "/build/native/windows-host.node"
+    || p === "/build/native/gw-secret-portal"
     || p === "/build/native/gw-dat-decode"
     || p === "/build/native/gw-dat-decode.exe"
   ) {
diff --git a/src/main/app-updater.ts b/src/main/app-updater.ts
index 49661b27..cc367634 100644
--- a/src/main/app-updater.ts
+++ b/src/main/app-updater.ts
@@ -46,6 +46,7 @@ interface NativeUpdater {
 export interface AppUpdaterOptions {
   currentVersion: string;
   capable: boolean;
+  externallyManaged?: boolean;
   target: AppUpdateTarget | null;
   nativeUpdater: NativeUpdater;
   fetch?: typeof fetch;
@@ -78,10 +79,9 @@ export class AppUpdater {
       ?? ((input, init) => globalThis.fetch(input, init));
     this.now = options.now ?? (() => Date.now());
     this.timeoutMs = options.timeoutMs ?? TIMEOUT_MS;
-    this.state = {
-      phase: "idle",
-      currentVersion: options.currentVersion,
-    };
+    this.state = options.externallyManaged
+      ? { phase: "managed", currentVersion: options.currentVersion }
+      : { phase: "idle", currentVersion: options.currentVersion };
   }
 
   getState(): AppUpdateState {
@@ -103,6 +103,7 @@ export class AppUpdater {
   }
 
   check(track: UpdateTrack): Promise<void> {
+    if (this.state.phase === "managed") return Promise.resolve();
     if (
       this.inFlight
       || this.state.phase === "downloading"
@@ -316,9 +317,10 @@ export class AppUpdater {
   }
 
   private lastCheckedAt(): string | undefined {
-    return "checkedAt" in this.state
-      ? this.state.checkedAt
-      : this.state.lastCheckedAt;
+    if ("checkedAt" in this.state) return this.state.checkedAt;
+    return "lastCheckedAt" in this.state
+      ? this.state.lastCheckedAt
+      : undefined;
   }
 
   private fail(
diff --git a/src/main/linux-portal-keychain.ts b/src/main/linux-portal-keychain.ts
new file mode 100644
index 00000000..1551aa47
--- /dev/null
+++ b/src/main/linux-portal-keychain.ts
@@ -0,0 +1,234 @@
+/**
+ * Owns the Flatpak Secret portal boundary and profile-scoped encrypted store.
+ * Portal failures remain closed; this module never writes unencrypted secrets.
+ */
+import {
+  createCipheriv,
+  createDecipheriv,
+  hkdfSync,
+  randomBytes,
+} from "node:crypto";
+import { spawn } from "node:child_process";
+import { readFile, unlink } from "node:fs/promises";
+import path from "node:path";
+import { writeAtomic } from "./core/atomic-file.js";
+import type { NativeKeychain, SecretSlot } from "./core/native-keychain.js";
+import { unpackedPath, type BundleLayout } from "./core/paths.js";
+
+const PORTAL_PROTOCOL = Buffer.from("GWSPv1\0\0", "ascii");
+const STORE_MAGIC = Buffer.from("GWKSv1\0\0", "ascii");
+const MAX_PORTAL_OUTPUT = 16 * 1024;
+
+export interface LinuxPortalSecret {
+  readonly token: string;
+  readonly secret: Buffer;
+}
+
+export type LinuxPortalSecretProvider = () => Promise<LinuxPortalSecret>;
+
+export function linuxSecretPortalPath(layout: BundleLayout): string {
+  return unpackedPath(layout, "build/native/gw-secret-portal");
+}
+
+function portalRequest(token: string): Buffer {
+  const encoded = Buffer.from(token, "utf8");
+  if (encoded.byteLength > 4096) throw new Error("Secret portal token is too large");
+  const request = Buffer.allocUnsafe(4 + encoded.byteLength);
+  request.writeUInt32BE(encoded.byteLength, 0);
+  encoded.copy(request, 4);
+  encoded.fill(0);
+  return request;
+}
+
+export async function retrieveLinuxPortalSecret(
+  executable: string,
+  token: string,
+): Promise<LinuxPortalSecret> {
+  const request = portalRequest(token);
+  return new Promise((resolve, reject) => {
+    const child = spawn(executable, [], {
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true,
+    });
+    const stdout: Buffer[] = [];
+    const stderr: Buffer[] = [];
+    let outputBytes = 0;
+    let errorBytes = 0;
+    let spawnError: Error | null = null;
+    child.once("error", (error) => {
+      spawnError = error;
+    });
+    child.stdout.on("data", (chunk: Buffer) => {
+      outputBytes += chunk.byteLength;
+      if (outputBytes > MAX_PORTAL_OUTPUT) child.kill();
+      else stdout.push(Buffer.from(chunk));
+    });
+    child.stderr.on("data", (chunk: Buffer) => {
+      if (errorBytes >= 4096) return;
+      const retained = chunk.subarray(0, 4096 - errorBytes);
+      errorBytes += retained.byteLength;
+      stderr.push(Buffer.from(retained));
+    });
+    child.once("close", (code) => {
+      request.fill(0);
+      if (spawnError !== null) {
+        reject(spawnError);
+        return;
+      }
+      if (code !== 0 || outputBytes > MAX_PORTAL_OUTPUT) {
+        const detail = Buffer.concat(stderr).toString("utf8").trim();
+        reject(new Error(detail || "Secret portal unavailable"));
+        return;
+      }
+      const output = Buffer.concat(stdout);
+      try {
+        if (output.byteLength < 16 || !output.subarray(0, 8).equals(PORTAL_PROTOCOL)) {
+          throw new Error("Secret portal returned an invalid response");
+        }
+        const tokenLength = output.readUInt32BE(8);
+        const secretLength = output.readUInt32BE(12);
+        if (
+          tokenLength > 4096
+          || secretLength < 16
+          || secretLength > 4096
+          || 16 + tokenLength + secretLength !== output.byteLength
+        ) throw new Error("Secret portal returned invalid lengths");
+        const nextToken = output.subarray(16, 16 + tokenLength).toString("utf8");
+        const secret = Buffer.from(output.subarray(16 + tokenLength));
+        output.fill(0);
+        resolve({ token: nextToken, secret });
+      } catch (error) {
+        output.fill(0);
+        reject(error);
+      }
+    });
+    child.stdin.end(request);
+  });
+}
+
+export function linuxPortalSecretProvider(input: {
+  readonly executable: string;
+  readonly tokenPath: string;
+}): LinuxPortalSecretProvider {
+  return async () => {
+    const previousToken = await readFile(input.tokenPath, "utf8").catch(
+      (error: NodeJS.ErrnoException) => {
+        if (error.code === "ENOENT") return "";
+        throw error;
+      },
+    );
+    const result = await retrieveLinuxPortalSecret(
+      input.executable,
+      previousToken,
+    );
+    if (result.token !== "" && result.token !== previousToken) {
+      await writeAtomic(input.tokenPath, result.token, 0o600);
+    }
+    return result;
+  };
+}
+
+interface EncryptedDocument {
+  readonly nonce: Buffer;
+  readonly tag: Buffer;
+  readonly ciphertext: Buffer;
+}
+
+function decodeDocument(value: Buffer): EncryptedDocument {
+  if (value.byteLength < 36 || !value.subarray(0, 8).equals(STORE_MAGIC)) {
+    throw new Error("Saved login is corrupt");
+  }
+  return {
+    nonce: value.subarray(8, 20),
+    tag: value.subarray(20, 36),
+    ciphertext: value.subarray(36),
+  };
+}
+
+/** Encrypted per-slot documents, rooted only inside the Flatpak sandbox. */
+export class LinuxPortalKeychain implements NativeKeychain {
+  readonly #identity: string;
+  readonly #root: string;
+  readonly #provideSecret: LinuxPortalSecretProvider;
+  #key: Promise<Buffer> | null = null;
+
+  constructor(input: {
+    readonly identity: string;
+    readonly root: string;
+    readonly provideSecret: LinuxPortalSecretProvider;
+  }) {
+    this.#identity = input.identity;
+    this.#root = input.root;
+    this.#provideSecret = input.provideSecret;
+  }
+
+  #slotPath(slot: SecretSlot): string {
+    return path.join(this.#root, `${slot}.secret`);
+  }
+
+  #aad(slot: SecretSlot): Buffer {
+    return Buffer.from(`gwonmac-linux-keychain-v1\0${this.#identity}\0${slot}`, "utf8");
+  }
+
+  #encryptionKey(): Promise<Buffer> {
+    this.#key ??= this.#provideSecret().then(({ secret }) => {
+      try {
+        return Buffer.from(hkdfSync(
+          "sha256",
+          secret,
+          Buffer.from(this.#identity, "utf8"),
+          Buffer.from("gwonmac/linux-portal-keychain/v1", "utf8"),
+          32,
+        ));
+      } finally {
+        secret.fill(0);
+      }
+    }).catch((error: unknown) => {
+      this.#key = null;
+      throw error;
+    });
+    return this.#key;
+  }
+
+  async load(slot: SecretSlot): Promise<Buffer | null> {
+    let document: Buffer;
+    try {
+      document = await readFile(this.#slotPath(slot));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+      throw error;
+    }
+    const { nonce, tag, ciphertext } = decodeDocument(document);
+    const key = await this.#encryptionKey();
+    try {
+      const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+      decipher.setAAD(this.#aad(slot));
+      decipher.setAuthTag(tag);
+      return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    } catch {
+      throw new Error("Saved login could not be decrypted");
+    } finally {
+      document.fill(0);
+    }
+  }
+
+  async save(slot: SecretSlot, value: Buffer): Promise<void> {
+    const key = await this.#encryptionKey();
+    const nonce = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key, nonce);
+    cipher.setAAD(this.#aad(slot));
+    const ciphertext = Buffer.concat([cipher.update(value), cipher.final()]);
+    const document = Buffer.concat([STORE_MAGIC, nonce, cipher.getAuthTag(), ciphertext]);
+    try {
+      await writeAtomic(this.#slotPath(slot), document, 0o600);
+    } finally {
+      document.fill(0);
+    }
+  }
+
+  async clear(slot: SecretSlot): Promise<void> {
+    await unlink(this.#slotPath(slot)).catch((error: NodeJS.ErrnoException) => {
+      if (error.code !== "ENOENT") throw error;
+    });
+  }
+}
diff --git a/src/main/main.ts b/src/main/main.ts
index a4eaf855..370da2d2 100644
--- a/src/main/main.ts
+++ b/src/main/main.ts
@@ -176,6 +176,11 @@ import {
   windowsSquirrelFirstRun,
 } from "./windows-squirrel-startup.js";
 import { trustedFlatpakIdentity } from "./linux-flatpak.js";
+import {
+  LinuxPortalKeychain,
+  linuxPortalSecretProvider,
+  linuxSecretPortalPath,
+} from "./linux-portal-keychain.js";
 
 const windowsSquirrelStartupHandled = process.platform === "win32"
   && handleWindowsSquirrelStartup({
@@ -664,6 +669,7 @@ if (primaryInstance) void app.whenReady().then(async () => {
   await startDiagnostics();
   const distributionChannel = packagedDistributionChannel();
   const distribution = distributionCapabilities(distributionChannel);
+  const nativeApplicationUpdates = distribution.automaticUpdates && !linuxFlatpak;
   if (!app.isPackaged) {
     console.warn(
       "Saved login is memory-only in pnpm dev; use pnpm dev:signed for persistent development credentials.",
@@ -734,6 +740,17 @@ if (primaryInstance) void app.whenReady().then(async () => {
         windowsNativeHost,
         distributionChannel,
       );
+    } else if (process.platform === "linux" && linuxFlatpak) {
+      const linuxSecretRoot = path.join(paths.storage.data, "secrets");
+      await sweepOrphanDirectories([linuxSecretRoot]);
+      keychain = new LinuxPortalKeychain({
+        identity: DISTRIBUTION_CHANNEL_CONFIG[distributionChannel].bundleId,
+        root: linuxSecretRoot,
+        provideSecret: linuxPortalSecretProvider({
+          executable: linuxSecretPortalPath(nativeHostLayout),
+          tokenPath: path.join(paths.storage.config, "secret-portal-token"),
+        }),
+      });
     } else {
       throw new Error("persistent secret provider is unavailable");
     }
@@ -760,7 +777,8 @@ if (primaryInstance) void app.whenReady().then(async () => {
   const sockets = buildSocketManager();
   appUpdaterController = new AppUpdater({
     currentVersion: HOST_VERSION,
-    capable: distribution.automaticUpdates,
+    capable: nativeApplicationUpdates,
+    externallyManaged: linuxFlatpak,
     target: appUpdateTarget(process.platform, process.arch),
     nativeUpdater: {
       setFeedURL: (options) => autoUpdater.setFeedURL(options),
@@ -1125,7 +1143,7 @@ if (primaryInstance) void app.whenReady().then(async () => {
         !clientRuntime.active
         || clientRuntime.isDownloading
         || !periodicCheckDue({
-          capable: distribution.automaticUpdates,
+          capable: nativeApplicationUpdates,
           autoCheckUpdates: current.autoCheckUpdates,
           activeSockets: sockets.size(),
           lastUpdateCheckAt: current.lastUpdateCheckAt,
diff --git a/src/native/linux-secret-portal/main.cpp b/src/native/linux-secret-portal/main.cpp
new file mode 100644
index 00000000..e5319465
--- /dev/null
+++ b/src/native/linux-secret-portal/main.cpp
@@ -0,0 +1,232 @@
+#include <gio/gio.h>
+#include <gio/gunixfdlist.h>
+#include <glib.h>
+#include <unistd.h>
+
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <vector>
+
+namespace {
+
+constexpr std::size_t kMaximumValue = 4096;
+constexpr std::array<unsigned char, 8> kProtocol = {
+    'G', 'W', 'S', 'P', 'v', '1', '\0', '\0'};
+
+void Zero(std::vector<unsigned char> &value) {
+  volatile unsigned char *bytes = value.data();
+  for (std::size_t index = 0; index < value.size(); ++index) bytes[index] = 0;
+  value.clear();
+}
+
+bool ReadExact(FILE *stream, unsigned char *output, std::size_t size) {
+  std::size_t offset = 0;
+  while (offset < size) {
+    const std::size_t read = std::fread(output + offset, 1, size - offset, stream);
+    if (read == 0) return false;
+    offset += read;
+  }
+  return true;
+}
+
+bool WriteExact(FILE *stream, const unsigned char *input, std::size_t size) {
+  std::size_t offset = 0;
+  while (offset < size) {
+    const std::size_t written = std::fwrite(input + offset, 1, size - offset, stream);
+    if (written == 0) return false;
+    offset += written;
+  }
+  return true;
+}
+
+std::array<unsigned char, 4> EncodeLength(std::size_t value) {
+  return {
+      static_cast<unsigned char>((value >> 24U) & 0xffU),
+      static_cast<unsigned char>((value >> 16U) & 0xffU),
+      static_cast<unsigned char>((value >> 8U) & 0xffU),
+      static_cast<unsigned char>(value & 0xffU),
+  };
+}
+
+bool ReadToken(std::string *token) {
+  std::array<unsigned char, 4> encoded{};
+  if (!ReadExact(stdin, encoded.data(), encoded.size())) return false;
+  const std::uint32_t length =
+      (static_cast<std::uint32_t>(encoded[0]) << 24U)
+      | (static_cast<std::uint32_t>(encoded[1]) << 16U)
+      | (static_cast<std::uint32_t>(encoded[2]) << 8U)
+      | static_cast<std::uint32_t>(encoded[3]);
+  if (length > kMaximumValue) return false;
+  std::vector<unsigned char> bytes(length);
+  if (length > 0 && !ReadExact(stdin, bytes.data(), bytes.size())) return false;
+  if (std::memchr(bytes.data(), '\0', bytes.size()) != nullptr) {
+    Zero(bytes);
+    return false;
+  }
+  token->assign(bytes.begin(), bytes.end());
+  Zero(bytes);
+  return true;
+}
+
+struct RequestState {
+  GMainLoop *loop = nullptr;
+  std::string expectedHandle;
+  std::string token;
+  bool complete = false;
+  bool success = false;
+};
+
+void OnResponse(
+    GDBusConnection *, const gchar *, const gchar *objectPath, const gchar *,
+    const gchar *, GVariant *parameters, gpointer userData) {
+  auto &state = *static_cast<RequestState *>(userData);
+  if (state.expectedHandle != objectPath) return;
+  guint response = 1;
+  GVariant *results = nullptr;
+  g_variant_get(parameters, "(u@a{sv})", &response, &results);
+  if (response == 0) {
+    GVariant *token = g_variant_lookup_value(results, "token", G_VARIANT_TYPE_STRING);
+    if (token != nullptr) {
+      state.token = g_variant_get_string(token, nullptr);
+      g_variant_unref(token);
+    }
+    state.success = true;
+  }
+  g_variant_unref(results);
+  state.complete = true;
+  g_main_loop_quit(state.loop);
+}
+
+gboolean OnTimeout(gpointer userData) {
+  auto &state = *static_cast<RequestState *>(userData);
+  if (!state.complete) g_main_loop_quit(state.loop);
+  return G_SOURCE_REMOVE;
+}
+
+bool RetrieveSecret(
+    const std::string &previousToken, std::string *nextToken,
+    std::vector<unsigned char> *secret) {
+  GError *error = nullptr;
+  GDBusConnection *bus = g_bus_get_sync(G_BUS_TYPE_SESSION, nullptr, &error);
+  if (bus == nullptr) {
+    if (error != nullptr) g_error_free(error);
+    return false;
+  }
+
+  int pipeFds[2] = {-1, -1};
+  if (pipe(pipeFds) != 0) {
+    g_object_unref(bus);
+    return false;
+  }
+  GUnixFDList *fdList = g_unix_fd_list_new();
+  const int fdIndex = g_unix_fd_list_append(fdList, pipeFds[1], &error);
+  if (fdIndex < 0) {
+    if (error != nullptr) g_error_free(error);
+    close(pipeFds[0]);
+    close(pipeFds[1]);
+    g_object_unref(fdList);
+    g_object_unref(bus);
+    return false;
+  }
+
+  gchar *uuid = g_uuid_string_random();
+  std::string handleToken = uuid;
+  g_free(uuid);
+  for (char &value : handleToken) {
+    if (value == '-') value = '_';
+  }
+
+  RequestState state;
+  state.loop = g_main_loop_new(nullptr, FALSE);
+  const guint subscription = g_dbus_connection_signal_subscribe(
+      bus, "org.freedesktop.portal.Desktop", "org.freedesktop.portal.Request",
+      "Response", nullptr, nullptr, G_DBUS_SIGNAL_FLAGS_NONE, OnResponse,
+      &state, nullptr);
+
+  GVariantBuilder options;
+  g_variant_builder_init(&options, G_VARIANT_TYPE_VARDICT);
+  g_variant_builder_add(&options, "{sv}", "handle_token",
+                        g_variant_new_string(handleToken.c_str()));
+  if (!previousToken.empty()) {
+    g_variant_builder_add(&options, "{sv}", "token",
+                          g_variant_new_string(previousToken.c_str()));
+  }
+  GVariant *result = g_dbus_connection_call_with_unix_fd_list_sync(
+      bus, "org.freedesktop.portal.Desktop", "/org/freedesktop/portal/desktop",
+      "org.freedesktop.portal.Secret", "RetrieveSecret",
+      g_variant_new("(ha{sv})", fdIndex, &options), G_VARIANT_TYPE("(o)"),
+      G_DBUS_CALL_FLAGS_NONE, 30000, fdList, nullptr, nullptr, &error);
+  close(pipeFds[1]);
+  pipeFds[1] = -1;
+  g_object_unref(fdList);
+
+  bool ok = result != nullptr;
+  if (ok) {
+    const gchar *handle = nullptr;
+    g_variant_get(result, "(&o)", &handle);
+    state.expectedHandle = handle;
+    g_variant_unref(result);
+    const guint timeout = g_timeout_add_seconds(30, OnTimeout, &state);
+    g_main_loop_run(state.loop);
+    if (state.complete) g_source_remove(timeout);
+    ok = state.complete && state.success;
+  } else if (error != nullptr) {
+    g_error_free(error);
+  }
+
+  if (ok) {
+    std::array<unsigned char, 1024> buffer{};
+    while (true) {
+      const ssize_t count = read(pipeFds[0], buffer.data(), buffer.size());
+      if (count == 0) break;
+      if (count < 0 || secret->size() + static_cast<std::size_t>(count) > kMaximumValue) {
+        ok = false;
+        break;
+      }
+      secret->insert(secret->end(), buffer.begin(), buffer.begin() + count);
+    }
+    volatile unsigned char *bytes = buffer.data();
+    for (std::size_t index = 0; index < buffer.size(); ++index) bytes[index] = 0;
+    ok = ok && secret->size() >= 16;
+  }
+
+  close(pipeFds[0]);
+  g_dbus_connection_signal_unsubscribe(bus, subscription);
+  g_main_loop_unref(state.loop);
+  g_object_unref(bus);
+  if (!ok) {
+    Zero(*secret);
+    return false;
+  }
+  *nextToken = state.token;
+  return true;
+}
+
+}  // namespace
+
+int main() {
+  std::string previousToken;
+  if (!ReadToken(&previousToken)) return 2;
+  std::string nextToken;
+  std::vector<unsigned char> secret;
+  if (!RetrieveSecret(previousToken, &nextToken, &secret)) {
+    std::fputs("Secret portal unavailable\n", stderr);
+    return 3;
+  }
+  const auto tokenLength = EncodeLength(nextToken.size());
+  const auto secretLength = EncodeLength(secret.size());
+  const bool written =
+      WriteExact(stdout, kProtocol.data(), kProtocol.size())
+      && WriteExact(stdout, tokenLength.data(), tokenLength.size())
+      && WriteExact(stdout, secretLength.data(), secretLength.size())
+      && WriteExact(stdout,
+                    reinterpret_cast<const unsigned char *>(nextToken.data()),
+                    nextToken.size())
+      && WriteExact(stdout, secret.data(), secret.size())
+      && std::fflush(stdout) == 0;
+  Zero(secret);
+  return written ? 0 : 4;
+}
diff --git a/src/shared/contracts.ts b/src/shared/contracts.ts
index 177fca1c..a0858bc2 100644
--- a/src/shared/contracts.ts
+++ b/src/shared/contracts.ts
@@ -629,6 +629,11 @@ export type AppUpdateErrorCode =
  * from the network reaches the UI.
  */
 export type AppUpdateState =
+  | {
+      /** The installed package manager owns discovery and replacement. */
+      phase: "managed";
+      currentVersion: string;
+    }
   | {
       phase: "idle";
       currentVersion: string;
diff --git a/tests/policy/forbidden-artifacts.test.ts b/tests/policy/forbidden-artifacts.test.ts
index 748e07ce..9f478f9f 100644
--- a/tests/policy/forbidden-artifacts.test.ts
+++ b/tests/policy/forbidden-artifacts.test.ts
@@ -121,6 +121,7 @@ test("only public identifiers and explicit profile-id fixtures are UUID-shaped",
     "tests/unit/credentials.test.ts",
     "tests/unit/launcher-orchestrator.test.ts",
     "tests/unit/launcher-state.test.ts",
+    "tests/unit/linux-portal-keychain.test.ts",
     "tests/unit/multiple-accounts.test.ts",
     "tests/unit/native-keychain.test.ts",
     "tests/unit/paths.test.ts",
diff --git a/tests/policy/source-linux-flatpak.test.ts b/tests/policy/source-linux-flatpak.test.ts
index 08c47afc..0539bd1e 100644
--- a/tests/policy/source-linux-flatpak.test.ts
+++ b/tests/policy/source-linux-flatpak.test.ts
@@ -22,7 +22,7 @@ describe("Linux Flatpak package", () => {
     assert.match(manifest, /--device=dri/u);
     assert.doesNotMatch(manifest, /--device=input/u);
     assert.doesNotMatch(manifest, /--device=all/u);
-    assert.match(manifest, /--talk-name=org\.freedesktop\.portal\.Secret/u);
+    assert.doesNotMatch(manifest, /--talk-name=org\.freedesktop\.secrets/u);
   });
 
   it("does not grant broad host filesystem access", () => {
diff --git a/tests/policy/source-native-keychain.test.ts b/tests/policy/source-native-keychain.test.ts
index 646464dc..e8f6b90e 100644
--- a/tests/policy/source-native-keychain.test.ts
+++ b/tests/policy/source-native-keychain.test.ts
@@ -109,7 +109,7 @@ test("the canonical build emits one host-only Node-API 8 addon", () => {
   );
 });
 
-test("Windows and Linux build the decoder without the Darwin host", () => {
+test("Windows and Linux build only their target-native boundaries", () => {
   const windows = nativeBuildSteps("win32", "x64");
   const linux = nativeBuildSteps("linux", "x64");
 
@@ -122,8 +122,9 @@ test("Windows and Linux build the decoder without the Darwin host", () => {
   assert.ok(windows[1]?.[1].includes("build/native/node.lib"));
   assert.ok(windows[1]?.[1].includes("/Fe:build/native/windows-host.node"));
   assert.ok(windows[2]?.[1].includes("/Fe:build/native/gw-dat-decode.exe"));
-  assert.deepEqual(linux.map(([command]) => command), ["c++"]);
-  assert.deepEqual(linux[0]?.[1].slice(-2), [
+  assert.deepEqual(linux.map(([command]) => command), [process.execPath, "c++"]);
+  assert.deepEqual(linux[0]?.[1], ["scripts/build-linux-secret-portal.mjs"]);
+  assert.deepEqual(linux[1]?.[1].slice(-2), [
     "-o",
     "build/native/gw-dat-decode",
   ]);
@@ -154,7 +155,7 @@ test("the first target ports refuse unsupported CPU architectures", () => {
 });
 
 // Each package contains the decoder for its own platform. macOS and Windows
-// also contain their separate native host. Every listed file is executable
+// also contain their separate native credential boundary. Every listed file is executable
 // code that cannot run inside the archive, and the allowlist remains exact
 // rather than opening a directory.
 test("Forge unpacks only the platform-native executables from ASAR", () => {
@@ -162,12 +163,13 @@ test("Forge unpacks only the platform-native executables from ASAR", () => {
   const packageIgnore = read("scripts/package-ignore.ts");
   assert.match(
     forge,
-    /unpack: "\*\*\/build\/native\/\{host\.node,windows-host\.node,gw-dat-decode,gw-dat-decode\.exe\}"/u,
+    /unpack: "\*\*\/build\/native\/\{host\.node,windows-host\.node,gw-secret-portal,gw-dat-decode,gw-dat-decode\.exe\}"/u,
   );
   for (const kept of [
     /p === "\/build\/native"/u,
     /p === "\/build\/native\/host\.node"/u,
     /p === "\/build\/native\/windows-host\.node"/u,
+    /p === "\/build\/native\/gw-secret-portal"/u,
     /p === "\/build\/native\/gw-dat-decode"/u,
     /p === "\/build\/native\/gw-dat-decode\.exe"/u,
   ]) {
diff --git a/tests/policy/source-release-pipeline.test.ts b/tests/policy/source-release-pipeline.test.ts
index 16e85459..4659c6ff 100644
--- a/tests/policy/source-release-pipeline.test.ts
+++ b/tests/policy/source-release-pipeline.test.ts
@@ -129,7 +129,9 @@ test("the host has one native automatic application replacement path", () => {
   assert.match(main, /import \{[\s\S]{0,80}\bapp,[\s\S]{0,80}\bautoUpdater,/);
   assert.match(main, /new AppUpdater/);
   assert.match(main, /packagedDistributionChannel\(\)/);
-  assert.match(main, /capable: distribution\.automaticUpdates/);
+  assert.match(main, /const nativeApplicationUpdates = distribution\.automaticUpdates && !linuxFlatpak/);
+  assert.match(main, /capable: nativeApplicationUpdates/);
+  assert.match(main, /externallyManaged: linuxFlatpak/);
   assert.match(main, /autoUpdater\.quitAndInstall\(\)/);
   // Startup, client-ready events, and the periodic tick share one scheduler.
   // That scheduler owns the audited due-time and client-readiness gates, so a
@@ -180,7 +182,7 @@ test("distribution channels use preflighted signing and a scoped marker", () =>
   assert.match(forge, /distribution-channel\.json/);
   assert.match(
     forge,
-    /\(platform === "darwin" \|\| platform === "win32"\)[\s\S]*packageMode\.kind === "signed"/,
+    /\(platform === "darwin" \|\| platform === "win32" \|\| platform === "linux"\)[\s\S]*packageMode\.kind === "signed"/,
   );
   assert.doesNotMatch(forge, /official-update\.json|GW_OFFICIAL_RELEASE/);
   assert.match(forge, /appBundleId: channelConfig\.bundleId/);
diff --git a/tests/policy/source-saved-login-surface.test.ts b/tests/policy/source-saved-login-surface.test.ts
index b57cb11a..9b93519b 100644
--- a/tests/policy/source-saved-login-surface.test.ts
+++ b/tests/policy/source-saved-login-surface.test.ts
@@ -72,7 +72,8 @@ test("only provisioned distribution channels enable persistent secrets", () => {
   );
   assert.match(profileStorage, /workspace\.legacyPrimaryProfileId/);
   assert.doesNotMatch(main, /accountWorkspace\.legacyPrimaryProfileId/);
-  assert.match(main, /capable: distribution\.automaticUpdates/);
+  assert.match(main, /const nativeApplicationUpdates = distribution\.automaticUpdates && !linuxFlatpak/);
+  assert.match(main, /capable: nativeApplicationUpdates/);
   assert.match(
     main,
     /if \(persistentSecrets\) \{[\s\S]{0,160}distributionChannel === null[\s\S]{0,120}persistent secret provider is unavailable/,
@@ -85,6 +86,10 @@ test("only provisioned distribution channels enable persistent secrets", () => {
     main,
     /process\.platform === "win32" && windowsNativeHost !== null[\s\S]{0,160}keychain = new WindowsCredentialKeychain/,
   );
+  assert.match(
+    main,
+    /process\.platform === "linux" && linuxFlatpak[\s\S]{0,500}keychain = new LinuxPortalKeychain/,
+  );
   assert.match(
     main,
     /else \{\s*throw new Error\("persistent secret provider is unavailable"\)/,
diff --git a/tests/unit/app-updater.test.ts b/tests/unit/app-updater.test.ts
index 1bb0e4d0..9fc50e12 100644
--- a/tests/unit/app-updater.test.ts
+++ b/tests/unit/app-updater.test.ts
@@ -42,6 +42,7 @@ function response(body: unknown, status = 200, headers?: HeadersInit): Response
 
 function fixture(options: {
   capable?: boolean;
+  externallyManaged?: boolean;
   currentVersion?: string;
   target?: AppUpdateTarget | null;
   fetch?: typeof fetch;
@@ -61,6 +62,7 @@ function fixture(options: {
   const updater = new AppUpdater({
     currentVersion: options.currentVersion ?? "2026.7.0-beta.1",
     capable: options.capable ?? true,
+    externallyManaged: options.externallyManaged ?? false,
     target: options.target === undefined ? "darwin-arm64" : options.target,
     fetch: options.fetch ?? (async () => response(manifest("2026.7.0-beta.2"))),
     now: () => 1234,
@@ -99,6 +101,24 @@ function fixture(options: {
 }
 
 describe("application updater", () => {
+  it("defers installed Flatpak updates to the software center", async () => {
+    let requests = 0;
+    const f = fixture({
+      externallyManaged: true,
+      fetch: async () => {
+        requests += 1;
+        return response(manifest("2026.8.1"));
+      },
+    });
+    assert.deepEqual(f.updater.getState(), {
+      phase: "managed",
+      currentVersion: "2026.7.0-beta.1",
+    });
+    await f.updater.check("stable");
+    assert.equal(requests, 0);
+    assert.equal(f.nativeChecks(), 0);
+  });
+
   it("reads exactly one static manifest for the selected channel", async () => {
     for (const track of ["stable", "beta"] as const) {
       const requests: string[] = [];
diff --git a/tests/unit/linux-portal-keychain.test.ts b/tests/unit/linux-portal-keychain.test.ts
new file mode 100644
index 00000000..f52ee818
--- /dev/null
+++ b/tests/unit/linux-portal-keychain.test.ts
@@ -0,0 +1,81 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, stat } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { describe, it } from "node:test";
+import { LinuxPortalKeychain } from "../../src/main/linux-portal-keychain.ts";
+import { multiSecretSlot } from "../../src/main/core/native-keychain.ts";
+import { parseProfileId } from "../../src/shared/multiple-accounts.ts";
+
+const profile = parseProfileId("2d31e565-9fc8-4dde-9fd4-9d644f8283ae");
+const otherProfile = parseProfileId("c1353d4b-fb98-4de4-8798-7133050fe3d5");
+const firstSlot = multiSecretSlot(profile, "arenaNetCredentials");
+const secondSlot = multiSecretSlot(otherProfile, "arenaNetCredentials");
+
+async function fixture(secret: string): Promise<{
+  readonly root: string;
+  readonly keychain: LinuxPortalKeychain;
+}> {
+  const root = await mkdtemp(path.join(os.tmpdir(), "gwonmac-linux-secrets-"));
+  return {
+    root,
+    keychain: new LinuxPortalKeychain({
+      identity: "io.github.mat4m0.gwonmac",
+      root,
+      provideSecret: async () => ({
+        token: "token",
+        secret: Buffer.from(secret.repeat(4), "utf8"),
+      }),
+    }),
+  };
+}
+
+describe("Linux Secret portal keychain", () => {
+  it("encrypts profile slots independently with owner-only files", async () => {
+    const { root, keychain } = await fixture("master-secret-value");
+    await keychain.save(firstSlot, Buffer.from("first-password"));
+    await keychain.save(secondSlot, Buffer.from("second-password"));
+
+    assert.equal((await keychain.load(firstSlot))?.toString(), "first-password");
+    assert.equal((await keychain.load(secondSlot))?.toString(), "second-password");
+    const document = await readFile(path.join(root, `${firstSlot}.secret`));
+    assert.equal(document.includes(Buffer.from("first-password")), false);
+    assert.equal((await stat(path.join(root, `${firstSlot}.secret`))).mode & 0o777, 0o600);
+
+    await keychain.clear(firstSlot);
+    assert.equal(await keychain.load(firstSlot), null);
+    assert.equal((await keychain.load(secondSlot))?.toString(), "second-password");
+  });
+
+  it("fails closed when a different portal secret opens the document", async () => {
+    const { root, keychain } = await fixture("first-master-secret");
+    await keychain.save(firstSlot, Buffer.from("saved-password"));
+    const replacement = new LinuxPortalKeychain({
+      identity: "io.github.mat4m0.gwonmac",
+      root,
+      provideSecret: async () => ({
+        token: "replacement",
+        secret: Buffer.from("different-master-secret".repeat(4), "utf8"),
+      }),
+    });
+
+    await assert.rejects(
+      () => replacement.load(firstSlot),
+      /could not be decrypted/,
+    );
+  });
+
+  it("binds ciphertext to the distribution identity", async () => {
+    const { root, keychain } = await fixture("shared-master-secret");
+    await keychain.save(firstSlot, Buffer.from("saved-password"));
+    const foreign = new LinuxPortalKeychain({
+      identity: "io.github.attacker.gwonmac",
+      root,
+      provideSecret: async () => ({
+        token: "token",
+        secret: Buffer.from("shared-master-secret".repeat(4), "utf8"),
+      }),
+    });
+    await assert.rejects(() => foreign.load(firstSlot), /could not be decrypted/);
+  });
+});