arch-updater: fix the news-timer watchdog kill; terminal/background update modes, ignore management, one polkit password, update history with rollback

[UmedjonBA]

Plugin

• Id: yuuto/arch-updater
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Three commits. The first is a standalone bugfix and can be cherry-picked on its own if the rest is not wanted; the second and third change the plugin's update flow, so they need @yuuto's sign-off per the repo rules. The third commit addresses @Reiling-Jeff's review of the first revision.

Commit 1 — fix the news timer (fixes #382), version 1.1.1.
The startup branch of the Arch news check (sinceNewsCheck == AUTO_CHECK_DELAY) resets the counter to 0, so it re-fires every 10 seconds forever. Each firing is an HTTP fetch plus RSS parsing in the service callback; the repeated work exceeds the 25 ms CPU budget and Noctalia's health watchdog auto-disables the whole plugin ~50 seconds after the shell starts whenever check_arch_news is on (the default). The fix resets the counter back to AUTO_CHECK_DELAY, so news is checked once at startup and then every 6 hours, as intended.

Commit 2 — background updates, ignore management, one polkit password, version 2.0.0.

Background update run. The run is spawned fully detached (double-fork + setsid): pkexec pacman -Syu for repo packages, the AUR helper with --sudo pkexec plus non-interactive flags (--noconfirm --noprogressbar --color never, paru: --skipreview, yay: --answerdiff/--answerclean/--answeredit None), then optionally flatpak update -y --noninteractive. All output goes to <data>/update.log between ::START <epoch> / ::EXIT <code> markers. The engine tails the log every 2 s: the panel swaps the package list for a live log tail (configurable log_lines) with a progress bar, and the bar widget shows a percentage. Because the runner is detached it survives a shell restart — a fresh engine re-attaches to an unfinished log (younger than 6 h). On success: notification + automatic re-check; a failed run keeps its log on screen and offers Retry in terminal, tee'd into the same log.

Ignore management. Packages held back by pacman.conf's IgnorePkg come out of checkupdates/-Qua with an [ignored] suffix; previously they were counted and listed as pending even though the run skips them. They are now excluded from the count and shown in a new expandable Ignored section, together with the plugin-side ignore list. Each package row gets an ignore button; those entries persist in <data>/ignore.json (the panel cannot write plugin settings) and have a restore button. Entries from the ignore_packages setting and from pacman.conf are tagged with where they are managed (the settings tag opens the plugin settings; pacman.conf is never edited by the plugin). New ignore:NAME / unignore:NAME IPC events.

One polkit password per run. pkexec authenticates each pacman transaction separately, so a db sync plus a couple of AUR install batches meant three password dialogs. The panel shows a hint with an Ask once button until a keep-authorization rule is installed: one user-confirmed pkexec install call places polkit/49-arch-updater-pacman.rules (shipped in the plugin directory, also embedded in service.luau because Lua cannot see the plugin dir) into /etc/polkit-1/rules.d/. rules.d is 750 root:polkitd on Arch — not probeable by a regular user — so a marker file in the data dir remembers a successful install; the hint can also be hidden with the hide_polkit_hint setting.

Commit 3 — review follow-up + update history with rollback, version 2.4.0.

The terminal is a first-class update path again (review point 2). A new update_mode setting: "terminal" (the default — the same interactive flow the plugin always had: prompts, conflicts and the PKGBUILD review work exactly as on the command line) or "background" (the opt-in non-interactive run from commit 2). Update follows the setting; update_background / update_terminal IPC events force one mode. Terminal runs tee into the same log, so the live tail, progress bar, bar-widget percentage and the history all work in both modes. Net effect vs. upstream 1.1.0: the default behavior is unchanged, the background run is something you turn on.

The activity graph is restored (review point 1). show_activity_graph and activity_history_length are back, along with the history_state.json read/write path (old-format data migrates) and the panel section — gated on the setting, opt-in default as suggested. One deviation from a 1:1 restore, submitted for the reviewer's consideration: the hover hit-zones under the graph used to be invisible ghost buttons; their geometry and behavior are unchanged, but they are now drawn as a row of small axis dots (the hovered dot is highlighted in the accent color). The invisible zones were difficult to discover, and the ghost buttons' hover flash was more prominent than the graph itself. This detail will be reverted on request.

Stale-run guard fixed (review point 3). The 30-minute no-log-growth timeout now applies only to background runs. The run's mode is tracked and persisted in run_meta.json, so the exemption survives a shell restart mid-run. A user reading a PKGBUILD diff for an hour no longer gets their run declared failed (and can no longer be offered a retry that would truncate the log under the live process).

Missing dependency (review point 4). install is declared, and while at it every other shelled-out helper too: date, grep, head, less, rm, tee, wc.

Flatpak progress (review point 5). The progress count now also matches Flatpak's per-ref Updating app/... lines, so a run with pending Flatpak updates can reach 100%.

Startup race (review point 6). The startup auto-check now waits until resumeRunIfActive's log probe has answered, so it can no longer steal the phase from a still-running detached update.

Polkit scope disclosure (review point 7). The install button's tooltip and the README now state plainly that the rule covers any pkexec-launched /usr/bin/pacman call from an active local wheel session for ~5 minutes after an authentication — not only this plugin's calls — and how to remove it.

New: update history with rollback. A strip at the bottom of the panel shows one segment per recorded run (last 15, stored in <data>/runs.json; rollbacks get their own segments). Click a segment to open the run's package list (name from → to per row): each row has a rollback button (second click confirms), the header rolls back the whole run in one transaction. Rollback installs the old package files straight from the caches (/var/cache/pacman/pkg, paru's/yay's build dirs) with pkexec pacman -U; dependencies updated in the same run ride along in the same transaction (resolved with pactree against the run's package list, version constraints stripped). --nodeps is never used, so a downgrade that would break other packages makes pacman refuse the whole transaction before anything changes. Opening a run probes the caches and reverse dependencies: packages whose old file is gone are greyed out, and the tooltip warns how many installed packages require the one being rolled back. Flatpak entries are listed but not rollbackable. Before a run is recorded, pacman -Q verifies which packages actually changed, so anything declined during an interactive terminal run is not offered for rollback; failed runs are not recorded. An optional rollback_auto_ignore setting (off by default) adds rolled-back packages to the plugin ignore list.

Also new: run_meta.json persists the current run's kind and package list, so a run resumed after a shell restart keeps its progress percentage and still lands in the history; Open full log opens the log in a terminal pager (less +G) instead of xdg-open, which dies silently when text/plain maps to a terminal editor; the polkit hint only shows in background mode (terminal runs go through sudo and never hit the multi-prompt problem); the retry-in-terminal button is not offered after a failed rollback (retrying the update command is not a retry of the rollback).

External dependencies

All declared in dependencies in plugin.toml: pacman-contrib (checkupdates, pactree), pacman, pkexec (polkit escalation for the background run and rollback), sh, awk, sed, grep, tail, head, tee, wc, date, rm, install, less, test, uname, plus optional paru/yay, flatpak, xdg-open, and sudo (terminal mode and fallback).

Full accounting: network access is the same set of mirror/AUR/Flatpak contacts a manual upgrade makes, plus the Arch news feed fetch (startup + every 6 h). Files written are confined to the plugin data directory (update.log, run_meta.json, runs.json, history_state.json, ignore.json, news_state.json, a staged copy of the polkit rule, an install marker) — with one exception, /etc/polkit-1/rules.d/49-arch-updater-pacman.rules, written only by pkexec install after the user explicitly clicks Ask once and authenticates. Processes spawned are listed in the README's Notes section.

Testing

Exercised on a real Arch system over several sessions: checks across pacman/AUR (paru)/Flatpak; full background runs (paru building and installing AUR packages, log tail + progress in the panel, ::EXIT 0, notification, auto re-check) with the polkit rule asking exactly one password; the [ignored] filtering against a real IgnorePkg entry; ignore/unignore via panel buttons and IPC (persistence verified); the polkit rule install and removal via the panel flow (rule active, marker recorded, hint gone; hint returns after removal); live per-package rollback of real system packages with a same-run dependency riding along (fzf + linux-api-headers via glibc's pactree closure — including the version-constraint parsing fix this exposed), a whole-run rollback, and a roll-forward through the rollback's own history segment; history verification against pacman -Q after a run; the activity graph recording checks, surviving reloads and drawing the post-update drop; hot-reload and full plugin reload with no [ERR] lines; the news fix running for days with check_arch_news on and no watchdog trips.

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against: noctalia-git 5.0.0.r5277.gced2221ee-1
• Plugin API level: 9

Screenshots / Videos

Attached in a comment below: idle panel with the Ignored section, the polkit hint, the activity graph and the history strip; a background run in progress with the live log; the panel after an update (graph showing the drop, history grown).

---

A note on language: I do not speak English; this text and the review conversation are translated with AI assistance. The changes themselves are tested on a real system as described above.

🤖 Generated with Claude Code

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Note on the thumbnail item: thumbnail.webp is the plugin's existing generator-made thumbnail, shipped unchanged by this PR (the box is checked because the repository's template check requires every item checked on a non-draft PR). This PR adds no non-English translations; the existing de/fr/tr files are untouched (their new keys fall back to English until the translation service catches up).

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[github-actions]

CC @Reiling-Jeff

[ItsLemmy]

waiting on author review

[Reiling-Jeff]

Thanks for the effort here, the background-run mechanics (detached run, ::START/::EXIT markers, log-tailing, resume-after-restart, the ignore system, the polkit rule) are well thought through and clearly tested on real hardware. Requesting changes before merge, for the reasons below.

Blocking

1. Please keep the activity graph (opt-in instead of opt-out is fine, removal is not)
This PR deletes show_activity_graph/activity_history_length, history_state.json, and all the rendering/recording code (recordCheck, recordUpdateRun, activitySection, the upsampling/hover helpers). That's a real feature loss bundled into what's framed as an update-flow PR. I'd like the graph to stay — flip the default to false (opt-in) if you'd like it out of most users' way by default, but please don't remove the feature and its persisted history outright. Concretely: restore the two settings (default false instead of true), the history_state.json read/write path, and the panel section, gated on the setting exactly like before.

2. A terminal must remain a first-class way to run the update, not just a post-failure fallback.
Right now "Update" always runs silently in the background, and the interactive terminal (runUpdateTerminal) only appears after a background run has already failed (runFailed()). That removes real functionality for anyone who wants to watch the run as it happens, in particular reviewing an AUR helper's interactive output (PKGBUILD diffs, paru/yay warnings, "there's a conflict, pick one" prompts) before something silently auto-answers it, not just after the fact. --skipreview/--answerdiff None etc. make choices on the users behalf that some of us specifically don't want made automatically.

Please expose "run in terminal" as a normal, equally-weighted action alongside the background run e.g. a setting like update_mode = "background" | "terminal" (background as the new default is fine), or simply keep both buttons visible in the footer instead of gating the terminal option behind runFailed(). The important part: a user who wants the terminal every time shouldn't have to first let a silent run fail to get it.

3. Correctness bug: the 30-minute stale-log timeout must not apply to terminal-driven runs.
pollRunLog() (service.luau) applies RUN_STALE_LIMIT_S = 1800 uniformly to phase == "running", regardless of whether the run was started by runUpdate() (background) or runUpdateTerminal() (interactive). A paru/yay PKGBUILD review, or a user just stepping away mid-review, can easily leave the log silent for >30 minutes with the terminal process still very much alive. When the timeout fires, finishRun(-1) marks the run "failed" and re-offers "Retry in terminal" and if the user clicks that while the original terminal is still running, runUpdateTerminal() truncates (>) the same log file out from under the first process's open fd and launches a second pacman/AUR invocation concurrently with the first (pacman db lock conflict at best, interleaved/corrupted log at worst).

Given point 2 above, this needs a real fix, not just a wider timeout: please skip (or separately track) staleness detection for terminal-launched runs there's no way to distinguish "stuck" from "user is reading a diff" from log silence alone.

4. Missing dependency: install.
installPolkitRule() shells out to pkexec install -Dm644 -o root -g root ... (service.luau), but install (coreutils) isn't in plugin.toml's dependencies or the README's Requirements section. Per this repo's own convention every shelled-out command gets listed, even universally-available ones (test/uname already are). CI's validator doesn't statically check this, so it needs to be caught here.

Non-blocking, please take a look

5. Progress bar/percentage undercounts when Flatpak has pending updates. runTotal (the denominator) is pacman.n + aur.n + flatpak.n, but pollRunLog()'s progress grep only matches pacman/AUR-style ^(upgrading|installing|reinstalling|downgrading) lines, Flatpak's own output never matches, so with Flatpak updates pending the bar/percentage plateaus below 100% even on full success (the actual completion detection via ::EXIT is unaffected, this is purely cosmetic).

6. resumeRunIfActive() can lose a race against the auto-check timer on startup. It only reattaches to a live run if phase == "idle" when its async log probe returns. If auto_check_hours fires startCheck() first (moving phase to "checking") before that probe resolves, plausible right after a reboot, when a real background pacman/AUR process is competing for I/O, which is exactly the scenario this function exists for a genuinely still-running background update silently stops being tracked. Low likelihood given the timeout margins, but worth a defensive fix.

7. Please explicitly confirm the polkit rule's scope is intentional. AUTH_ADMIN_KEEP is granted for any pkexec pacman <anything> call by any process in an active local wheel session, not just calls made by this plugin, for ~5 minutes after each authenticated run. That's a disclosed, opt-in, one-click trade-off (similar to a manually-added NOPASSWD sudoers line), and the shipped rule file and the embedded copy in service.luau are functionally identical, no drift bug. Just flagging it as a system-wide security-posture change (writes outside the plugin's own data dir) that deserves a conscious sign-off rather than passing review by default.

8. Please attach some screenshots, as you said in the PR "Panel screenshots (idle with the Ignored section, the polkit hint, and a run in progress) will be attached in a comment below."
Screenshots are helpful to review the PR! :D

---

Overall: solid engineering on the mechanics, but I'd like points 1–2 addressed as design requirements (not just my preference, losing "always-visible terminal" and "activity history" are real regressions for existing users), and point 3 is a genuine correctness bug once point 2 is addressed. Happy to re-review once these are in.

[UmedjonBA]

@Reiling-Jeff thank you for the review. Every point was justified, and two of them (3 and 6) were real bugs. All of them are addressed in the new commit (version 2.4.0); the PR body has been updated accordingly. Point by point:

1. Activity graph — restored. show_activity_graph and activity_history_length are back, together with the history_state.json read/write path (old-format entries are migrated) and the panel section, gated on the setting exactly as before, with the opt-in default you suggested (false). One deviation from a 1:1 restore, submitted for your consideration: the hover hit-zones under the graph used to be invisible ghost buttons. Their geometry and behavior are unchanged, but they are now drawn as a row of small axis dots, with the hovered dot highlighted in the accent color. The reasoning: the invisible zones were difficult to discover, and the ghost buttons' hover flash was more prominent than the graph itself. If you prefer the original invisible row, I will revert this detail.

2. The terminal is a first-class update path again — and it is the default. A new update_mode setting: "terminal" (default) opens the fully interactive flow — prompts, conflicts and the PKGBUILD review work exactly as on the command line; "background" is the opt-in non-interactive run. Update follows the setting; the update_background / update_terminal IPC events force a specific mode. Terminal runs are tee'd into the same log, so the live tail, the progress bar and the history work in both modes. Relative to upstream 1.1.0 the default behavior is therefore unchanged: nothing auto-answers on the user's behalf unless background mode was explicitly enabled.

3. Stale-log timeout — fixed as described. The run's mode is tracked (and persisted in run_meta.json, so it survives a shell restart mid-run), and pollRunLog() skips staleness detection entirely for terminal runs — not a wider timeout. A long PKGBUILD review can no longer get a run declared failed, which also removes the path where the retry button truncated the log under the live process's open fd. The 30-minute guard still applies to background runs, where log silence does mean the run is stuck.

4. Missing dependency — declared. install is now listed, and the audit added every other shelled-out helper as well: date, grep, head, less, rm, tee, wc. The README's Requirements section lists them too.

5. Flatpak progress — fixed. The progress count now also matches Flatpak's per-ref Updating/Installing app|runtime/... lines, so the bar can reach 100% with Flatpak updates pending. (Runtime dependencies pulled in by Flatpak can overshoot the denominator; the display clamps at 100%, and completion detection remains via ::EXIT.)

6. Startup race — fixed. The startup auto-check now waits until resumeRunIfActive's log probe has answered before it may fire, so it can no longer move the phase to "checking" under the probe and orphan a live detached run — the reboot-plus-slow-I/O scenario you described.

7. Polkit scope — explicitly confirmed as intentional. Yes: the rule grants AUTH_ADMIN_KEEP (~5 minutes) for any pkexec-launched /usr/bin/pacman call from an active local wheel session, not only this plugin's calls — comparable to a manually added NOPASSWD-with-timeout sudoers line. That is the intended trade-off for an opt-in, one-click convenience, and I sign off on it. Following this review, the disclosure is now stated where the decision is made: the Ask once button's tooltip spells out the scope, and the README has a "Scope, stated plainly" paragraph with the removal command. Additionally, since the terminal mode escalates through sudo and never encounters the multi-prompt problem, the hint (and with it the rule suggestion) is now shown only in background mode.

8. Screenshots — below: the idle panel with the Ignored section, the polkit hint, the activity graph and the history strip; a background run in progress; the panel right after an update.

Idle + polkit hint	Background run	After the update

Beyond the review, the commit also introduces the update history and rollback feature, described in detail in the updated PR body. Field-testing it on real system packages exposed one additional bug, fixed in the same commit: pactree -l prints raw depend strings (libelf=0.196, linux-api-headers>=4.10), so same-run dependency matching required stripping the version constraints. Live rollbacks with a dependency riding along, and rolling forward again through the rollback's own history segment, were exercised on a real system as listed in the Testing section.

I will adjust any of the above on request, including reverting the graph's dot axis to the original invisible hover row.

---

I do not speak English; this text was translated with AI assistance.

[github-actions]

This pull request was automatically closed because its description no longer contains
every part of the pull request template
that this repository requires.

Missing:

• the checked checklist entry: I created thumbnail.webp with the thumbnail generator.

Please add the items listed above back to the description, keeping their exact wording, then
reopen the pull request. Reopening re-runs this check. Draft pull requests may leave boxes
unchecked. Before a pull request is ready for review, exactly one plugin type, at least one
tested compositor, and every item under Checklist and Code review attestation must be checked.

[UmedjonBA]

Continued in #392.

The template bot closed this pull request when I marked it ready for review — I had left the thumbnail checklist item unchecked. I fixed the description right away (the enforce check passes on it), but reopening is not possible here: I force-pushed this branch earlier while preparing the first submission, and GitHub refuses to change the state of any pull request opened from it (state cannot be changed. The ... branch was force-pushed or recreated, the same error #383 returns).

#392 carries the same commits from a fresh branch, plus one further commit fixing a locale bug, and it answers @Reiling-Jeff's review point by point with the screenshots attached. Apologies for the extra pull request.

---

I do not speak English; this text was translated with AI assistance.