feat(linux): protect saved login with Secret portal

apps/launcher/src/components/GeneralUpdateSettings.vue

@@ -33,14 +33,14 @@ function performAction(): Promise<void> {
 <template>
   <h1>General</h1>
   <div class="setting-group">
-    <label>
+    <label v-if="update.phase !== 'managed'">
       <span>
         <strong>Automatically update this launcher</strong>
         <small>Checks for Guild Wars Reforged app updates. Guild Wars game files update separately.</small>
       </span>
       <input type="checkbox" :checked="settings.autoCheckUpdates" @change="save({ autoCheckUpdates: checked($event) })" />
     </label>
-    <label>
+    <label v-if="update.phase !== 'managed'">
       <span><strong>Launcher update channel</strong><small>Stable is recommended.</small></span>
       <select :value="settings.updateTrack" @change="save({ updateTrack: track($event) })">
         <option value="stable">Stable</option>

apps/launcher/src/components/UpdateGameFilesSettings.test.ts

@@ -23,6 +23,22 @@ describe("launcher update settings", () => {
     expect(wrapper.text()).toContain("Guild Wars game files update separately");
   });
 
+  it("leaves Flatpak application updates to the software center", () => {
+    const wrapper = mount(GeneralUpdateSettings, {
+      props: {
+        settings: fixtureSnapshot.settings,
+        update: { phase: "managed", currentVersion: "2026.8.10" },
+        save: noOp,
+        check: noOp,
+        restart: noOp,
+        openReleases: noOp,
+      },
+    });
+    expect(wrapper.text()).toContain("installed by your software center");
+    expect(wrapper.text()).not.toContain("Automatically update this launcher");
+    expect(wrapper.find("button").exists()).toBe(false);
+  });
+
   it("opens Releases instead of looping a manual Stable return through Check now", async () => {
     const openReleases = vi.fn(noOp);
     const check = vi.fn(noOp);

apps/launcher/src/launcher-view-model.ts

@@ -69,6 +69,7 @@ export function cacheSummary(info: CacheInfo): string {
 
 export function updateStatus(update: AppUpdateState): { title: string; detail: string } {
   switch (update.phase) {
+    case "managed": return { title: "Application updates", detail: "Updates are installed by your software center." };
     case "checking": return { title: "Checking for updates…", detail: `Installed version ${update.currentVersion}` };
     case "up-to-date": return { title: "Guild Wars Reforged is up to date", detail: `Version ${update.currentVersion}` };
     case "downloading": return { title: `Downloading version ${update.latestVersion}…`, detail: `Installed version ${update.currentVersion}` };

apps/launcher/src/update-game-files-copy.ts

@@ -15,6 +15,12 @@ export function applicationUpdatePresentation(
   update: AppUpdateState,
 ): ApplicationUpdatePresentation {
   switch (update.phase) {
+    case "managed":
+      return {
+        title: "Launcher updates",
+        detail: `Version ${update.currentVersion}. Updates are installed by your software center.`,
+        action: "none",
+      };
     case "checking":
       return {
         title: "Checking for launcher updates…",

forge.config.ts

@@ -103,7 +103,7 @@ const config: ForgeConfig = {
     // `.node` addon cannot be dlopen'd from it, and a helper cannot be spawned
     // from it.
     asar: {
-      unpack: "**/build/native/{host.node,windows-host.node,gw-dat-decode,gw-dat-decode.exe}",
+      unpack: "**/build/native/{host.node,windows-host.node,gw-secret-portal,gw-dat-decode,gw-dat-decode.exe}",
     },
     name: channelConfig.productName,
     executableName: channelConfig.productName,

packaging/linux/io.github.mat4m0.gwonmac.yml

@@ -15,7 +15,6 @@ finish-args:
   - --socket=x11
   - --socket=pulseaudio
   - --device=dri
-  - --talk-name=org.freedesktop.portal.Secret
   - --env=ELECTRON_TRASH=gio
   - --env=XCURSOR_PATH=/run/host/user-share/icons:/run/host/share/icons
 

scripts/build-linux-secret-portal.mjs

@@ -0,0 +1,31 @@
+import { spawnSync } from "node:child_process";
+import { mkdirSync } from "node:fs";
+
+if (process.platform !== "linux" || process.arch !== "x64") {
+  throw new Error("the Secret portal helper is an x86_64 Linux build");
+}
+
+const flags = spawnSync("pkg-config", ["--cflags", "--libs", "gio-unix-2.0"], {
+  encoding: "utf8",
+});
+if (flags.status !== 0) {
+  throw new Error(flags.stderr || "gio-unix-2.0 development files are required");
+}
+mkdirSync("build/native", { recursive: true });
+const result = spawnSync("c++", [
+  "-std=c++20",
+  "-O2",
+  "-fPIE",
+  "-pie",
+  "-fstack-protector-strong",
+  "-D_FORTIFY_SOURCE=3",
+  "-Wall",
+  "-Wextra",
+  "-Werror",
+  "src/native/linux-secret-portal/main.cpp",
+  "-o",
+  "build/native/gw-secret-portal",
+  ...flags.stdout.trim().split(/\s+/u),
+  "-Wl,-z,relro,-z,now",
+], { stdio: "inherit" });
+if (result.status !== 0) throw new Error("Secret portal helper build failed");

scripts/build.mjs

@@ -197,9 +197,9 @@ export function nativeBuildSteps(platform, architecture) {
     if (architecture !== "x64") {
       throw new Error(`unsupported Linux build architecture: ${architecture}`);
     }
-    return [[
-      "c++",
-      [
+    return [
+      [process.execPath, ["scripts/build-linux-secret-portal.mjs"]],
+      ["c++", [
         "-std=c++20",
         "-O2",
         '-D__int64=long long',
@@ -209,8 +209,8 @@ export function nativeBuildSteps(platform, architecture) {
         ...DECODER_SOURCES,
         "-o",
         "build/native/gw-dat-decode",
-      ],
-    ]];
+      ]],
+    ];
   }
 
   throw new Error(`unsupported native build platform: ${platform}`);

scripts/package-ignore.ts

@@ -31,6 +31,7 @@ export function ignorePackageFile(file: string): boolean {
     p === "/build/native"
     || p === "/build/native/host.node"
     || p === "/build/native/windows-host.node"
+    || p === "/build/native/gw-secret-portal"
     || p === "/build/native/gw-dat-decode"
     || p === "/build/native/gw-dat-decode.exe"
   ) {

src/main/app-updater.ts

@@ -46,6 +46,7 @@ interface NativeUpdater {
 export interface AppUpdaterOptions {
   currentVersion: string;
   capable: boolean;
+  externallyManaged?: boolean;
   target: AppUpdateTarget | null;
   nativeUpdater: NativeUpdater;
   fetch?: typeof fetch;
@@ -78,10 +79,9 @@ export class AppUpdater {
       ?? ((input, init) => globalThis.fetch(input, init));
     this.now = options.now ?? (() => Date.now());
     this.timeoutMs = options.timeoutMs ?? TIMEOUT_MS;
-    this.state = {
-      phase: "idle",
-      currentVersion: options.currentVersion,
-    };
+    this.state = options.externallyManaged
+      ? { phase: "managed", currentVersion: options.currentVersion }
+      : { phase: "idle", currentVersion: options.currentVersion };
   }
 
   getState(): AppUpdateState {
@@ -103,6 +103,7 @@ export class AppUpdater {
   }
 
   check(track: UpdateTrack): Promise<void> {
+    if (this.state.phase === "managed") return Promise.resolve();
     if (
       this.inFlight
       || this.state.phase === "downloading"
@@ -316,9 +317,10 @@ export class AppUpdater {
   }
 
   private lastCheckedAt(): string | undefined {
-    return "checkedAt" in this.state
-      ? this.state.checkedAt
-      : this.state.lastCheckedAt;
+    if ("checkedAt" in this.state) return this.state.checkedAt;
+    return "lastCheckedAt" in this.state
+      ? this.state.lastCheckedAt
+      : undefined;
   }
 
   private fail(