The Windows exe and the AppImage now read and write settings.json in
their own folder, so a copied or moved folder keeps its settings. A .deb
install still uses the user's config folder, because it lives in a
read-only system folder.
Rename the crate, binary, product name, identifier, settings folder, log
file, autostart entry, user agent, updater endpoint and release assets.
Legacy Win32 clients still update: they fall back to the first .exe asset,
and the legacy rollback workflow reads the package name from the ref it
builds. Upgraded installs start with default settings.
The updater left an environment proxy to the plugin's reqwest, which was
built without SOCKS support, so a SOCKS ALL_PROXY broke updates and, on
Windows, displaced a working system proxy. Enable reqwest's socks feature
and pass the chosen environment or system proxy to the plugin explicitly.
Clash and v2ray set ALL_PROXY=socks5h://..., which ureq reads before
HTTPS_PROXY. Enable the socks-proxy feature so that entry is used instead
of skipped, and cover a socks5h tunnel with a fake SOCKS5 server.
The plugin fetches latest.json and downloads the platform entry, verifying
its minisign signature. The suffix-ignoring version comparison moves to
core::version and drives the plugin comparator; a manifest without an entry
for this platform counts as up to date. The Windows portable exe swaps
itself in with self_replace, an AppImage goes through the plugin install,
and both relaunch with --updated-to. A package-manager install keeps
checking but greys the apply item.
The GitHub API lookup, the WinHTTP download and the --apply-update helper
are gone, along with the sha2 dependency they needed.
A 1.5 s thread asks the platform whether the foreground window is a
fullscreen window of another process and feeds the result through the
visibility state machine. Windows keeps the proven evaluation with an
own-process check in place of the bubble class check; Linux reads the
EWMH active window state over X11; native Wayland and macOS report false.
Each enabled live provider gets a transparent, undecorated, always-on-top
bubble webview, created hidden at its exact physical size and its saved or
default position, clamped into the work area. It is shown without taking
focus once the page reports ready, or 1.5 s after creation.
On Windows a subclass hook reports move ends, setting changes (theme
recheck and reclamp) and display changes, answers WM_MOUSEACTIVATE with
MA_NOACTIVATE, and bubbles are shown and hidden only through
SW_SHOWNOACTIVATE and SW_HIDE. Elsewhere a 250 ms debounce armed by the
page's drag start ends the drag; on X11 it waits while Button1 is held.
Move end snaps once and saves the position; resize, clamp and reset only
move the windows. Native Wayland skips positioning.
User show/hide goes through a pure visibility state shared with the coming
fullscreen auto-hide, and the saved widget_visible now applies at startup.
A theme change reaches open bubbles. The unused os module is removed.
A per-icon tray handler runs while Tauri holds the per-icon listener
table; the inline refresh could build a missing icon that locks the same
table. The app-level handler avoids that. The AppIndicator probe now
matches the tray backend's backcompat names, which some AppImages need,
and keeps the loaded library open.
Building a webview window inside a menu or window event handler deadlocks
on Windows, so provider toggles and the Destroyed recreate now build the
bubble on a short-lived thread, serialised so only one of them creates it.
refresh_shell now takes its state snapshot inside the main-thread closure,
so a refresh queued by the poll worker cannot re-apply a tree older than
one a menu click already applied.
On Windows the start-at-login entry is written through auto-launch in
current-user mode with the quoted exe path, so an elevated run can no
longer write an all-users entry with an unquoted path that a normal run
cannot remove. Linux and macOS keep the autostart plugin.
Each enabled live provider gets a tray icon with the usage badge, a four-line tooltip and the context menu; a left click toggles the widget. Menus are rebuilt from state after every click so native check marks stay right, and a bubble right-click pops the same menu.
Alerts go through the notification plugin. On Windows the app id is registered under HKCU with a name and icon first, so a portable exe without a Start-menu shortcut can show toasts.
Start at login uses the autostart plugin under the Run value name earlier releases wrote, so an existing entry is picked up as is. On Linux the tray is skipped when no AppIndicator library loads instead of aborting.
run() keeps the pre-builder order: diagnostic log, the Windows WebView2 guard
(a message box with the download link, then exit 0), the --wait-pid wait
capped at 15 s, GDK_BACKEND=x11 under Wayland when Xwayland is present, and
the single-instance plugin registered first with a no-op callback.
setup() loads the settings, drops positions on missing monitors, reads the
theme, cleans up after earlier updates, starts the scheduler and polls. The
state sits behind one mutex reached only through with_state, so no Tauri call
runs under the lock. The poll worker keeps the in-flight gate, applies the
results, runs the CLI credential refresh and pushes bubble payloads from the
main thread.
Commands: get_bubble_state, get_strings, log_js and bubble_ready. Bubble
windows ignore close requests; Restart saves the settings and exits only once
the new instance spawned. The scaffold window now renders its payload as JSON.
The Win32 app module is removed.
One std thread owns the poll, countdown and update-check deadlines and is fed
over an mpsc channel. The deadline rules are a pure struct tested with
fabricated instants; the thread hands each due action to a host trait.
An update check that fires stays disarmed until the check reports back, and
only that report re-arms the full interval, so the automatic check repeats
instead of running once. Changing the interval checks at once when the last
check is older than the new interval.
The argv parser accepts --diagnose, --wait-pid and --updated-to and ignores
anything else, including --apply-update, which no released version passes to
the downloaded binary. Arguments are read lossily, so a non-UTF-8 argument no
longer panics.
The wait for a parent pid polls kill(pid, 0) on Unix and waits on the process
handle on Windows, capped by the caller. The Windows platform module gains the
WebView2 runtime probe, an error message box and the theme read.
handoff::relaunch spawns the AppImage or the current executable detached with
--wait-pid and returns the spawn error to the caller. The startup cleanup of
<exe>.old.* siblings and staged updater executables moves out of the Win32
update module.
ureq is built without socks-proxy, so an ALL_PROXY=socks5h entry failed
every request and a socks5 entry silently connected directly, while also
suppressing the Windows system proxy. Pick the first HTTP or HTTPS proxy
from the environment ourselves, keep NO_PROXY on it, and fall back to the
system proxy when none is usable.
Replace the WinHTTP client with a ureq agent that keeps the same
Client/Response surface: status errors come back as responses, gzip,
60 s connect / 30 s receive / 120 s total timeouts, rustls with the
platform verifier and a per-request User-Agent override.
Environment proxies come from ureq. On Windows, when none is set, the
static Internet Settings proxy is read from HKCU and parsed by a pure
core module (per-scheme ProxyServer, ProxyOverride globs and <local>);
bypassed hosts go through a direct agent. PAC/WPAD is not evaluated.
The usage providers and credential sources compile again on every
platform. Refresh keeps the Windows candidates and CREATE_NO_WINDOW;
Unix spawns claude/codex from PATH plus the usual per-user install
directories and reaps the child on a detached thread. An empty
CODEX_HOME now counts as unset and a float expiresAt is truncated
instead of ignored.
Fixture tests cover the OAuth usage body, rate-limit headers (including
a 429 over loopback), the ChatGPT envelope, ISO 8601 edge cases,
credential JSON and proxy strings. An ignored live_poll test polls the
real providers.
Poll results, threshold crossings and the alert cooldown now return
values instead of calling the tray, so they run under unit tests. The
bubble and panel payloads carry every display string and colour from
Rust, and the context menu is a plain tree with string ids that parse
back into commands. The update-check schedule and countdown delay are
plain functions of the stored times.
Settings, the English strings, the colour ramp and the bubble geometry no
longer touch Win32 types, so they compile and test on every platform.
Snapping, clamping, default placement, panel placement and the monitor
probe take plain rects; settings loading is split into parsing and an
offscreen check fed with the monitor list. ProviderId now serialises as
its slug.
Turn the package into a lib plus thin bin on Tauri v2 with a root-level
tauri.conf.json, capabilities, generated icons (keeping the hand-tuned
icon.ico) and a placeholder bubble page. The Win32 modules leave the
module tree until each one is ported; their sources stay on disk.
tauri-build now embeds the icon, a VERSIONINFO from the Cargo version and
a PerMonitorV2 manifest, replacing res/icon.rc and its stale 0.1.0.
Inner ring's consumed wedge now grows clockwise from 12 o'clock (mirroring
a clock-hand countdown) and the tail remaining-time bar shrinks toward the
right edge instead of the left. Usage ring and weekly usage bar unchanged.
- Lift inner time ring above WCAG 1.4.11 (track #303030 -> #404040,
stroke floor 1 -> 2 logical, ring gap 3 -> 4).
- Breathe tail bar/text with bar_text_gap=8 (was pad=6); right inset
12 -> 14 logical so text clears the stadium end-cap.
- Reweight typography: head percent FW_BOLD, "5H" tag and tail percent
FW_SEMIBOLD, tail countdown stays normal but takes muted color so
the percent reads as the headline.
- Tone down usage track (#3A3A3A/#D6D6D6 -> #2C2C2C/#E2E2E2) so fill
dominates at low percentages.
- Differentiate lane mass: usage bar 9%/5..12 -> 10%/6..12, time bar
5%/3..7 -> 4%/3..6, lane gap 5 -> 6. Time bar now reads as supporting
context, not a competing quota.
- Min-fill guard on weekly bar: sub-cap fills floor at one cap-diameter
so 1% renders as a recognizable dot.
- head_pad 4 -> 5; big-font ratio 26% -> 24% of head diameter (BOLD
compensates for the size cut).
v0.3.0 introduced a tail 7d% reading but the layout-collapse guard
fired at every common bubble configuration — at the default 200-logical
size on both 100% and 125% DPI, after reserving the CJK worst-case
countdown column ("999시간") and the "100%" text rect, the tail had
less than 20 logical of bar room left. The guard collapsed the % rect
to zero width and the paint code's `if rect.right > rect.left` skip
ran on every frame, so the feature was effectively dead on arrival
for the majority of users.
The 20-logical bar minimum was the pre-feature bar floor, used to
guarantee a readable bar at very small bubble sizes. It does not need
to apply when the % is shown — the % is the actual data and the bar
becomes secondary visual context. Split into two thresholds:
- `bar_min_with_pct = 8 logical` decides whether the % can fit. With
8 logical of bar room the bar still renders as a short pill.
- `bar_min = 20 logical` only applies on the fallback (140-logical
minimum bubble) path where the % has been dropped — preserving
the pre-feature readable-bar behavior at the smallest size.
The bar's render floor now follows the active path (`bar_render_min`)
so a thin bar in the pct-active case does not overlap the countdown.
The stadium bubble previously dropped the 5h reset countdown (only the
ring + percent were visible in the head) and never showed the 7d percent
as a number (only the tail bar fill suggested it). Two more glanceable
data points now live on the bubble face without reopening the panel.
Head: the small "5h" tag is replaced by the live 5h countdown (e.g.
"2h14m"). Falls back to the literal "5h" when no countdown is available
yet (cold start) or when the localized string would overflow the rect —
DT_NOCLIP would otherwise leak wide CJK glyphs ("4시간 32분") onto the
ring stroke at the 140-logical minimum width.
Tail: a new "X%" reading sits between the "7d" label and the bar
(layout reads "7d 62% ▰▰▰▰▰▱▱▱ 6d4h"). Foreground text color —
not the bar accent — because Codex teal #10A37F on the light theme
background only hits ~3.2:1 contrast, below WCAG AA for small text;
adjacency to the bar carries the visual grouping without hue. The text
brightens in sync with the bar fill when weekly_pct >= 95%.
compute_bubble_layout reserves room for a "100%"-sized rect between
label and bar; if that would push the bar below the 20-logical
minimum, the % rect collapses to zero width and the layout falls back
to the original label→bar→countdown geometry, so the 140-logical
bubble keeps its bar.
No new graphics dependencies; tiny-skia + GDI hybrid render path
unchanged. session_text plumbing in src/app.rs was already wired but
unused in the render — now consumed.
cargo check: clean. cargo test: 2/2. cargo clippy: 13 warnings
(unchanged baseline).
User report on v0.1.14: text appears semi-transparent, desktop wallpaper
bleeds through glyph pixels.
Root cause: GDI's DrawTextW writes only RGB into 32bpp BI_RGB DIBs — the
"reserved" alpha byte (byte 3) is not preserved per the BITMAPINFOHEADER
contract. When UpdateLayeredWindow later composites with AC_SRC_ALPHA, it
reads alpha=0 at every glyph pixel and shows them as fully transparent.
The pre-v0.1.13 pipeline worked around this with an apply_alpha_mask
post-pass that OR'd 0xFF000000 into every pixel inside the rounded rect.
The stadium-shape rewrite (526786b) removed it on the false assumption
that tiny-skia's per-pixel alpha would "stick" through subsequent GDI
writes — but GDI runs *after* tiny-skia in the pipeline, so any pixel
GDI text writes to loses the alpha that tiny-skia set.
Fix: re-stamp the alpha channel from the original Pixmap after the GDI
text overlay. This restores tiny-skia's exact alpha values (255 in the
stadium interior, partial on the AA curved perimeter, 0 outside),
including the AA fade at the stadium's rounded ends.
Implementation:
- new helper `restore_alpha_from_pixmap(pixmap, dst)` next to the
existing `copy_pixmap_to_dib`
- hoist `pixmap` out of the if-let arm in render() so it survives until
after `paint_bubble_text`
- call `restore_alpha_from_pixmap` post-text
Two parallel reviewers (debugger + code-reviewer) converged on the same
diagnosis; the debugger preferred this approach for its simplicity and
because it's robust to any GDI behavior (whether alpha is zeroed,
untouched, or scribbled on, we overwrite with the known-good value).
Build clean.
User feedback on v0.1.13: design works, but the 5h percent glyph in the
head crowds the ring at small bubble sizes (the "100%" string was wider
than the ring's inner clear at MIN_BUBBLE_SIZE).
Two parallel UI/UX reviewers converged on:
- big_font_px ratio: head_diameter × 26/100 (was 35/100), floor 11
- small_font_px ratio: big × 55/100 (was 45/100), floor 9
- head_pad: 4 logical px (was 6) — recovers 4px
of inner clear at small sizes
- ring_stroke_w: clamped to [2, 4] (was floor 2 only)
- label/glyph gap: big × 15/100, floor 2 (was implicit 0)
- tail_bar_h: 5 logical px (was 6) — restores
proportion against the 3-px head ring stroke
Worked example at MIN_BUBBLE_SIZE=140 (head_diameter=47):
before: "100%" glyph ≈ 32px wide vs 28px ring inner — overflow
after: "100%" glyph ≈ 23px wide vs 32px ring inner — comfortable
Worked example at MAX_BUBBLE_SIZE=360 (head_diameter=138):
glyph ≈ 70px wide in 124px inner clear (~57%) — confident not crowding
Deliberately not applying:
- drop "7d" label (one reviewer wanted it): rejected — symmetry with
"5h" matters for self-explanation at a glance, and the ~14px cost is
acceptable
- head_diameter bump to canvas_h × 1.08: rejected — only useful coupled
with the label drop
Build clean.
Phase 2 lite. Replaces the horizontal pill (two stacked progress bars)
with a stadium-shaped bubble: a circle "head" on the left showing the
5h percentage as a big glyph surrounded by a stroked progress ring,
plus a "tail" extending right with the 7d label, a thin progress bar,
and the 7d countdown.
The bubble's primary metric (5h window) is now glanceable from across
the room — a thick ring sweeping around a big number reads at a much
greater distance than two thin horizontal bars. The 7d window remains
visible as supporting context. The expanded panel (left-click) still
shows both windows in full.
Implementation notes:
- Hybrid render: tiny-skia (already a Cargo dep for tray badge) paints
the AA shape into a Pixmap. The pixmap is copied byte-for-byte into
the 32bpp BI_RGB DIB; GDI overlays ClearType text on top;
UpdateLayeredWindow blits with per-pixel alpha as before.
- Stadium outline: corner_radius = height/2 so point_in_rounded_rect
exactly approximates the capsule shape for hit-test.
- Pulse animation on ≥95% applies to both the ring sweep (5h) and the
tail bar fill (7d) independently.
- Codex teal #10A37F and Claude orange #D97757 carry across the ring,
the tail bar, and the tray badge sweep via crate::usage_color.
Removed (dead after pipeline swap):
- per-pixel paint_background / paint_accent_stripe / paint_bars /
paint_one_bar / apply_alpha_mask / row_band / rgb_to_dib / blend
- BarLayout struct + compute_layout
- old paint_text_layer / draw_label / draw_percent / draw_countdown
- Breakpoint struct + breakpoint_for_width_logical (font sizes now
derive from head_diameter directly)
- luminance / use_dark_text_over (text was over bar fills; new tail
bar carries no overlaid text)
- constants ACCENT_STRIPE_W_LOGICAL, LABEL_PAD_LOGICAL,
PERCENT_TEMPLATE
Build: cargo build --release clean. Clippy 13 warnings (was 11); the
2 new ones are field-assign-after-Default::default() on tiny-skia
Stroke setup, matching the existing pattern in src/tray/badge.rs.
Known follow-up: BubbleState.session_text + BubbleConfig.session_text
plumbing is now unused (head shows percent only, no 5h countdown on
the bubble). Removing it is a multi-file chain through app.rs and
panel.rs; deferred.
Whole-project review pass over the entire crate. No new features.
All function definitions preserved; layout and visibility reorganised.
Bug fixes:
- bubble: ExtractIconExW HICON pair was leaked per bubble toggle.
Extract once into a process-wide OnceLock, reuse forever (bounded).
- usage/anthropic: parse_iso8601 was stripping the UTC offset without
applying it — negative-offset users saw countdowns up to 14h wrong.
Now parses signed minutes and computes utc_secs = local - off*60.
Also rejects y<1970, mo∉[1,12], d∉[1,max_day(mo,y)] up front so
malformed API responses can't index DAYS_IN_MONTH out of bounds.
- usage: clamp utilization to [0,100] at all four Window construction
sites so a misbehaving server can't render "121%".
- bubble: GetDC and CreateCompatibleDC results weren't checked. Guard
both; release the screen DC on the CreateCompatibleDC failure path.
Refactor:
- Drop type TrayIconKind = ProviderId aliases (5 sites); use ProviderId
directly everywhere. Inline the identity-function kind_to_provider.
- Delete panel::bar_color_for shim (was just argument-reorder glue).
- Replace local scale_to_dpi fns in bubble.rs and panel.rs with
use crate::os::dpi::scale as scale_to_dpi (brings os::dpi into the
live import graph; was unused before).
- Delete dead PCWSTR import + #[allow(dead_code)] sentinel in
tray/badge.rs; fold the trailing `use BOOL` into the top imports.
- Inline app::primary_dpi() to crate::os::dpi::for_system().
app.rs:
- Add update_settings(|s: &mut AppState|) helper that locks state,
runs the closure, snapshots Settings, drops the lock, then saves
to disk. Convert four pure-mutate-then-save callsites.
Layering: bubble.rs no longer reaches upward into crate::app::.
Introduce bubble::Callbacks (fn-pointers), OnceLock<Callbacks>, and
bubble::install_callbacks(). The wnd_proc dispatches the six prior
upward calls via a private dispatch() helper. app::run installs
callbacks once at startup; the six on_bubble_* / recheck_theme fns
are demoted from pub fn to fn.
Resource-warning logs added: dispatch() warns on uninstalled
callbacks; app_icons() warns when ExtractIconExW returns nulls.
Build: cargo build --release clean; cargo clippy reports zero new
warnings (11 pre-existing, all in untouched code).
Phase 0 of UI/UX polish pass. Surgical changes, no substrate migration yet.
- Extract bar_fill_color + accent_color_for into new src/usage_color.rs so
the bubble, panel, and tray badge agree on a single 4-band usage ramp.
- Panel: color each bar from its own percent (was using max(5h, 7d) for
both rows, so a healthy 5h bar turned red whenever 7d was full).
- Light-mode amber #B47A20 (was #E0A040, failed WCAG AA at 2.4:1).
- Codex identity: switch from white/charcoal to OpenAI teal #10A37F
across bubble, panel stripe, and tray sweep so the surfaces share one
brand color and the tray badge stops reading as "loading spinner".
- Panel: drop WS_BORDER, add DwmSetWindowAttribute(DWMWCP_ROUND) for
Win11 rounded corners. Idempotent re-apply on every show() so the
attribute survives any future destroy/recreate path. Silently no-ops
on Win10.
Drop nl/es/fr/de locales (no native-speaker maintenance) and add
Vietnamese. The supported set is now the languages with active
users we can support: English, Japanese, Korean, Vietnamese, and
Traditional Chinese.
Both the in-app restart and the auto-update install previously
shelled out to cmd.exe so the new instance could wait for the old
one to release the singleton mutex and the locked exe file. On
some Windows configurations the `start ""` inside `cmd /c ...` can
flash a console window despite CREATE_NO_WINDOW + DETACHED_PROCESS
flags. The replacement spawns the child binary directly via
CreateProcessW; since the main exe is built with
windows_subsystem = "windows", no console is ever allocated.
- New `src/update/handoff.rs` exposes `spawn_detached`,
`wait_for_parent_exit`, and `cleanup_stale_old_exes`.
- New CLI flags `--wait-pid <pid>` and `--updated-to <version>`
parsed early in `main`; the child waits up to 5s on the parent
PID via OpenProcess+WaitForSingleObject before falling through
to a 3s mutex-acquisition retry.
- `restart_app` and `install::begin` both spawn detached children
using the new helper.
- Update install now uses MoveFileExW twice (rename running exe
sideways, then move staged exe into place with
MOVEFILE_REPLACE_EXISTING | MOVEFILE_COPY_ALLOWED so portable
installs on non-system drives still work). Rollback restores
the backup if either the swap OR the post-swap detached spawn
fails, and a MessageBoxW modal surfaces the backup path if the
rollback itself fails.
- First launch after an auto-update shows a blue-info tray
balloon "Updated to vX.Y.Z" via a new `tray::notify_info` (the
existing `tray::notify` is split into `notify_warning` +
`notify_info` sharing a `notify_inner`).
- Startup sweeps stale `<exe>.old.<pid>` siblings left by past
in-place updates.
- Three new `LocaleStrings` fields translated across all 8
supported locales (en/nl/es/fr/de/ja/ko/zh-TW).
reset_positions() destroys and recreates the bubbles, which leaves them
displaying the spawn_bubble "…" placeholder until the next 5-minute
TIMER_POLL fires. Push the cached snapshot via propagate_to_ui() so the
last-known values appear immediately, and kick spawn_poll_thread() (idempotent
via POLL_IN_FLIGHT gate) so fresh data follows shortly after.
tiennm99