[yahya637]

Summary

Lets X11 desktop input (XTest, used by Steam's desktop controller mappings) be allowed across Umbriel restarts, in two ways:

1. R on the prompt. "Allow desktop control?" now offers R to allow the application in every session. Remembered names are stored in $XDG_STATE_HOME/umbriel/x11-input-permissions.json (mode 0600, written atomically). umbriel x11-input-permissions lists them. umbriel x11-input-revoke <name|all> forgets a name, clears the session's allow or deny decision for it, and disconnects its approved EIS client, so the next request prompts again.
2. Config allowlist. [input] x11_input_allow = ["steam"] allows listed names without ever prompting.

[input]
x11_input_allow = ["steam"]

Enter still allows for the current session only, and any other key or click still denies. Emulated input is already dropped while a prompt is visible, so an XTest client cannot press R for itself. R on this prompt is accepted from the same keyboards as Enter. Session-lock behavior is unchanged.

The harness now gives each compositor a private XDG_STATE_HOME, so checks never read or write the user's state directory.

Motivation

Steam asks again after every Umbriel restart. A stray click denies Steam for the rest of the session, with no way back short of restarting Umbriel. Users who always allow Steam can now say so once, and x11-input-revoke also gives back the prompt after an accidental denial.

Names are the ones Xwayland reports, as the in-session approval already uses. security.md notes that X11 clients choose this name themselves, so an allowed name is trusted for any X11 client running as the user.

Type of Change

• New feature

Testing

• meson test -C build-debug: 152/152 pass, including the new x11-input-permissions store tests (persistence across instances, file mode, revoke, unsafe or malformed stores) and a config-load test for x11_input_allow.
• Harness, new checks:
  • input/xwayland_input_allow: a listed client types without a prompt, and an unlisted client is still prompted.
  • input/xwayland_input_remember: R remembers, x11-input-permissions lists the name (text and --json), revoke disconnects the client and a new request prompts, revoking a denial prompts again, and Enter does not remember.
  • With the allowlist check in server.cpp reverted, xwayland_input_allow fails as expected.
• Full harness (tests/harness/check.sh ./build-debug/umbriel): 453/458 pass. The 4 consistent failures (effect/selection, input/drop_zone_destination, input/title_bar_button_hover, render/title_bar) fail the same way on unmodified main on this machine. drag/toplevel_drag_lifecycle passed when rerun alone.
• clang-format and clang-tidy on the changed sources are clean, and tools/remark/format.mjs leaves the docs as committed.
• Manual, nested: with x11_input_allow = ["steam"], the Steam Controller desktop mapping moved and clicked with no prompt.
• Manual, native session (both commits cherry-picked onto 2952bbc, run as umbriel.service): R on Steam's prompt logged input permission remembered app='steam' and wrote the state file. x11-input-revoke steam cut Steam's input, and the prompt came back at once.

Manual Coverage

• Tested in a nested Umbriel session
• Tested in a native Umbriel session
• Tested with multiple monitors
• Tested with X11 applications through Xwayland

Checklist

• This PR is ready for review, or it is marked as Draft.
• This change fits SCOPE.md, or its scope was agreed in an issue or on Discord first.
• I read and followed the relevant guidance in CONTRIBUTING.md.
• I ran just format, or this PR has no C++, shader, or Markdown changes.
• I ran the relevant build, test, lint, or verification commands, or explained why they were not run.
• I functionally verified compositor behavior where automated checks are insufficient.
• I self-reviewed the changes.
• I checked for new warnings or errors.
• I updated docs/ and examples/config.toml, or this PR does not change user-facing configuration or behavior.
• I used canonical names for config keys, IPC actions, paths, and identifiers.

Additional Notes

• Scope: both parts are configuration and IPC over behavior Umbriel already implements, and R mirrors the InputCapture prompt. This was not discussed on Discord first; the two commits can be split if only one approach is wanted.
• input-capture-permissions has no text-mode printer upstream, so it prints nothing without --json. x11-input-permissions prints one name per line. I left the capture command alone to keep this PR to one change.
• Where R saves: R writes to the state file, not to config.toml, by design. The config is hand-edited, uses includes, and reloads live on save, so Umbriel rewriting it could lose comments or race the user's own edits. This also matches how InputCapture stores remembered grants. x11_input_allow stays the declarative, user-written list. If you'd prefer R to append to x11_input_allow instead, I can change it.

🤖 Generated with Claude Code