Repository navigation
Nucleus 3.0 - #628
Closed
kdroidFilter wants to merge 419 commits into
Closed
Nucleus 3.0#628kdroidFilter wants to merge 419 commits into
kdroidFilter wants to merge 419 commits into
Conversation
JEP 493 JDKs (Temurin 24+ and other builds without jmods/) refuse to link an image that contains jdk.jlink. includeAllModules copied `java --list-modules` verbatim, which includes it. A shipped app never needs jlink, so filter it out before --add-modules. The default module list never contained it, so default packaging is unchanged.
fix(jlink): drop jdk.jlink from includeAllModules runtime images (#673)
Every FsWatcher now owns a single native watcher shared by all of its registrations: one inotify instance, one FSEvents stream, one ReadDirectoryChangesW loop per watcher instead of per path. Events are routed back to registrations by root in lib.rs; a root already watched is not re-watched unless a recursive registration arrives over a non-recursive one, and the backend is dropped when the last registration goes. A per-watcher mutation lock serialises watch/unwatch/close and is never taken by callbacks. On macOS, FSEvents attaches an inode's accumulated flags to every event, so a rename of a long-existing file reaches the debouncer as Create+Rename+Modify on the gone path and gets folded into a bare Created(new); a delete of a pre-existing file surfaced as Modified. An FsEventsNormalizer now fronts the debounced backend (Create/Modify of an absent path, Remove of a present path and Create of an already-tracked path are history and dropped), the canonical root is handed to the backend so file-id pairing matches FSEvents' spelling, and renames the backend cannot pair are reported as Removed(old)+Created(new) instead of being discarded. Raw delivery is left untouched. Real-filesystem tests cover the four rename shapes, a non-canonical root, the pre-existing delete, the Raw rename contract, and 24 registrations sharing one native watcher (inotify instances via /proc on Linux, OS threads via ps on macOS), with per-registration routing and unwatch of a single path checked through the shared backend. Fixes #570 Fixes #571
With one INotifyWatcher per FsWatcher, two spellings of the same directory (its real path and a symlink to it) share a single inotify watch descriptor, and notify keeps one path per descriptor — so the alias that registered last decided the spelling every event was reported under and the other registration matched nothing. Unwatching either alias would also have removed the descriptor from under the other. The backend is now handed the canonical root on Linux as on macOS: one watch per real directory, shared by every alias, with the Kotlin side projecting events back onto each registration's own spelling exactly as it already does for FSEvents. Windows keeps the registered spelling because canonicalize() yields \\?\ verbatim paths that Java's toRealPath() never produces. A symlink root registered with followSymlinks = false is thereby reported on Linux the way the option documents and macOS always did (its target's events are not remapped onto the link), so that real-fs test now runs on Linux too.
A satellite palette follows its parent at an offset and docks from its screen geometry, neither of which means anything for a maximized window, yet nothing stopped it: isDialog never reached the native window and resizable = true gave it WS_MAXIMIZEBOX / the macOS zoom button. Add a maximizable flag mirroring minimizable (#504): TaoWindow.isMaximizable + setMaximizable, a SetMaximizable event backed by tao's set_maximizable, the parameter on every DecoratedWindow overload, NucleusWindowHost and HostedWindow. The Compose chromes drop the maximize slot and the title-bar double-click when it is off; Restore stays available so a window the WM maximized anyway can still leave. SatelliteWindow and DecoratedDialog pass maximizable = false; the satellite also un-maximizes itself on Linux, where tao has no client-side hint.
feat(window): maximizable flag, off by default for satellite windows
Applications that keep config, cache and logs under a single directory can
now relocate the native library extraction path, which was hard-wired to
`%LOCALAPPDATA%\nucleus\native` / `~/.cache/nucleus/native`.
Two levers, tried in order, each falling through to the next when the
directory cannot be created or written to:
1. `-Dnucleus.native.cacheDir=<dir>`, which also works for libraries
loaded before any application code runs and bakes into the launcher
`.cfg` through the existing `jvmArgs`;
2. `NativeLibraryLoader.cacheDirectory`, for a path computed in `main()`;
3. the platform default.
The root is resolved once, at the first extraction, so every library of a
run shares it; a later assignment is ignored with a warning. The
content-addressed layout of #304 is kept under the chosen root.
Also fixes a pre-existing defect in the default: a set-but-empty or
relative `XDG_CACHE_HOME` / `LOCALAPPDATA` made the root relative, putting
native libraries under the process working directory.
feat(core-runtime): configurable native library cache directory (#303)
Notification, launcher and media-control callbacks were posted with SwingUtilities.invokeLater. Under the Tao backend the AWT EDT is not Compose's UI thread, so those callbacks land on a thread that paints nothing — the same mistake menu-macos fixed in #310, still present in five modules. WindowBackend documents itself as the escape hatch for exactly this ("avoid touching the AWT event dispatch thread when running on Tao") and was read nowhere: its only use in the tree was the write in nucleusApplication. - add NucleusUiThread to core-runtime: a single marshalling point backed by an executor the backend registers, falling back to EventQueue.invokeLater when no Nucleus entry point ran. No new dependency, so the OS modules stay Compose-free and headless-capable. - register it (and WindowBackend.Tao, which a bare TaoApplication.run app never recorded) from TaoApplication.run, so a plain taoApplication host is covered too, not just nucleusApplication. - route the nine call sites in notification-linux, notification-windows, media-control, launcher-linux and launcher-macos through it. - restate the seven public KDoc blocks that promised the Swing EDT.
PKG was hardwired to the Mac App Store: TargetFormat.isStoreFormat forced
the sandboxed pipeline, "3rd Party Mac Developer" certificates and a
post-build productsign, so a PKG for MDM deployment or manual install
outside the store was not buildable.
Whether a PKG is a store package is now a DSL choice, macOS { pkg {
appStore } }, defaulting to the previous behaviour. With appStore = false
the PKG takes the same non-sandboxed pipeline as the DMG, electron-builder
signs the installer itself from the bare NAME (TEAMID) identity, a DSL
keychain travels as CSC_KEYCHAIN, and notarizePkg notarizes the .pkg.
electron-builder silently emits an unsigned package when no matching
"Developer ID Installer" certificate is found, so the task verifies the
result with pkgutil --check-signature.
pkg { preInstall / postInstall } stage install scripts for pkgbuild
--scripts. The App Store rejects them (error 90254), so they require
appStore = false, checked at configuration time.
The staged preinstall/postinstall are shims. electron-builder sets
BundlePre/PostInstallScriptPath *and* passes --scripts, so PackageInfo
declares each script twice and the Installer runs it twice, confirmed on
a real install. The shim skips the per-bundle pass and execs the app's
script, staged under a name electron-builder's scan does not match.
Runtime: ExecutableRuntime.isSandboxed() reads APP_SANDBOX_CONTAINER_ID.
The scheduler gates on it instead of isPkg(), and a Developer ID PKG
becomes self-updatable while the sandboxed store build stays excluded.
The ignored-projects list was maintained by hand, so every new sample had to be added to it. Twice it was not, and apiCheck failed with "Expected file with API declarations ... does not exist" for macos-appex-demo and reader-dock-demo. Excluding every :examples: subproject removes the class of failure. The predicate matches the one already used for detekt and explicitApi() lower in the file. decorated-window-jewel stays listed explicitly: it is not a sample, it is BCV's ASM being unable to read JVM 25 class files.
feat(pkg): Developer ID PKG with install scripts (#249)
ktlintCheck was failing on nucleus-2.6 independently of any branch: chain-method-continuation on the two kover plugin applications in the root build script, and an unused NucleusDecoratedWindowScope import in satellite-demo. Applied ktlintFormat to those two targets only, so the change is limited to them. detekt, ktlint and apiCheck are now green across the whole build.
… UI thread
`NotificationCenter` dispatches its delegate callbacks on a worker pool of
its own ("NucleusNotificationCallback-N"), so the portable `notification { }`
callbacks were the only ones left off the host UI thread on macOS while the
Linux and Windows bridges already post to it.
Verified on macOS with a real notification: clicking a button, the body and
the close box now all reach Kotlin on the Tao main thread (the thread Compose
composes on), instead of `NucleusNotificationCallback-1`.
`onFailed` from the `add()` completion takes the same route, since that
completion comes off the same pool.
#444) On Wayland `wl_egl_window_resize` only records a *pending* size: the buffer behind the default framebuffer is reallocated inside the next `eglSwapBuffers`. Skia's render target wraps that framebuffer (`fbId = 0`), so building it from the size we just requested overstates it for one frame, and under `SurfaceOrigin.BOTTOM_LEFT` the frame lands that many rows off the top of the real drawable — the band of clear colour the issue sees flicker on roughly a third of the frames of a drag. Both earlier attempts predicted that size rather than reading it: first "the buffer follows the request" (the flash), then "the buffer is one present behind", which had to be confined to KWin because the prediction was wrong elsewhere — it fixed Fedora Mutter and regressed Ubuntu GNOME. `eglQuerySurface` is neither prediction but the answer, so there is no desktop environment left in the decision: `useDrawableSizedPaint`, `drawableWidthPx` / `drawableHeightPx` and `onDrawablePresented` are gone. Where a driver answered with the requested size instead of the real one, this would behave exactly as the code did before it. Layout and the render target are also separated, which is what made the earlier attempt a trade-off in the first place: the scene keeps the window's size, so Compose never measures for a buffer that is a step behind, and only the render target follows the drawable. A frame drawn while the buffer lags is then anchored correctly and merely leaves that step uncovered until the catch-up frame, instead of displacing everything by it. Measured by a new headful case against a nested compositor: 16 of 64 frames painted at a size the buffer did not have before, 0 after, the window converging to its final size. The case fails when it measured nothing — it requires the window to have actually changed size, and reports the render passes dropped on a swap still in flight, because a window the compositor treats as occluded never gets its frame callbacks, renders nothing at all, and used to look exactly like a pass. `taoHeadfulTest` now forwards WAYLAND_DISPLAY so the suite can be pointed at a nested compositor instead of whichever session owns the screen. Defects (1) and (3) of the issue are untouched: the buffer still does not arrive in the same commit as the window geometry, which is a commit-ordering problem between GTK's toplevel and our sub-surface rather than a render target one.
fix: marshal native callbacks to the host UI thread, not the AWT EDT
Querying the drawable instead of predicting it is only authoritative if the driver cannot act on the pending `wl_egl_window_resize` after the answer is given. That held on Mesa, which defers the reallocation to `eglSwapBuffers` (measured: 0 of ~180 frames changed size under the frame). It does not hold on the NVIDIA proprietary driver, which reallocates when the back buffer is first used for rendering — in the middle of our frame, after the render target was built (measured on Ubuntu 26.04 / RTX 5060 Ti / 595.84: 12 of ~80 frames). So pin the moment rather than predict it per driver: on the frames that pushed a resize, bind the default framebuffer and clear it before querying, which is the first use either driver is waiting for. The answer then describes the buffer the whole frame lands in on both. The clear is not extra work — the frame clears anyway — and it is confined to resize frames because it costs a Skia GL state reset.
The render target is built from one `eglQuerySurface` taken before the frame, which is only authoritative if the driver cannot act on the pending resize afterwards. Drivers differ on exactly that, so the case reports the frames where it happened anyway and prints what the buffer became, which is what tells a stale basis from a correct one. This is what identified the NVIDIA behaviour: 12 of ~80 frames per run there, 0 of ~180 on Mesa, every one of them `queried -> requested` — Skia painting at the pre-configure size into a buffer that had already reached the new one.
Both said more than what was measured, which is the same mistake that produced the desktop-environment branch this change removes. - The paint-size KDoc claimed the queried drawable never changes under a frame, measured on Mesa and stated flatly. It changes on the NVIDIA proprietary driver; say which driver does what, and point at the call that pins it. - The headful case claimed compositors ignore `setInnerSize` "(this one does)". Mutter 50.1 honours it — #576 drives 40 distinct sizes through it. The case still drives maximize/restore, but because a client resize is advisory and a session that drops it would leave the case measuring nothing, not because compositors reject it.
…e-sized-paint fix(tao/linux): paint at the drawable's real size, not a predicted one (#444)
The badge a Caps Lock bound to keyboard-layout switching raises is a window HIToolbox creates *inside our own process*, positioned from whatever `firstRectForCharacterRange:` answers. TaoView answered a process-global caret rect that nothing ever invalidated, so once a focused text field was destroyed the badge kept appearing over the spot the field used to occupy. Before any field had been focused it was worse: the overrides were only installed when the first text-input session started, so tao's own implementation answered — the content-rect corner with a *top-down* y handed back as a Cocoa bottom-up coordinate — which parks the badge in the bottom-left corner of the screen of an app that has never shown a text field. Three changes, all measured against a logging `NSTextInputClient` probe driven by `TISSelectInputSource` with the badge window tracked through `CGWindowListCopyWindowInfo`: The cached rect is now scoped to the view that pushed it, and every other answer is `NSZeroRect`. That exact shape is the one AppKit reads as "no insertion point": a zero *size* alone does not suppress the badge — `(0, 30, 0x0)`, which is what tao answers, still draws it — and `selectedRange = NSNotFound` plus `invalidateCharacterCoordinates` change nothing at all. A rect falling outside the key window is not drawn either, which is why the corner case only shows on a window large enough to contain it. The overrides are installed per window creation rather than on the first session, so the answer is ours from the first frame. `TaoView` only exists once a window has been built, and the swizzle is idempotent. The input context is deactivated when the session ends. On its own that is not enough — `interpretKeyEvents:` re-activates it on the next keystroke — but it takes the badge down immediately for an app that is not being typed into. The teardown carries the activation token it was handed, because focus moving between fields starts the incoming session *before* the outgoing one is torn down: without the guard, focusing a second field deactivates the context the first teardown then finds live. Same ordering trap as the document cache.
`MacOsTextInputClientProbe.imeRect` reads what TaoView answers AppKit and reports an all-zero rect as "no insertion point", which is the property both cases assert. `caretRectDiesWithTheFocusedField` walks one field lifecycle: the caret is published, it follows focus to a second field (the ordering guard — without it the run takes three times as long because the incoming session's context is deactivated and has to be re-established), it is dropped when the fields are destroyed, a keystroke does not republish it, and a field composed again gets it back. `noCaretRectBeforeAnyField` covers the window that never shows one. Both fail on the code before this branch.
…indicator fix(tao/macos): keep the input-source indicator off a caret that is gone
AppKit fires `mouseExited:` for a cursor that never left the view. Measured on 26.5 with the pointer parked over a tab strip: enter → exit → enter → exit, all at one screen point. Two sources found — a hover card's own popup panel rising over the pointer, which is a *child window* of ours whose draw margin overlaps the tab it hangs off, and the rebuilds of tao's legacy tracking rect. That reaches Compose as `PointerEventType.Exit` and is taken at face value, so hover state is dropped. Nothing corrects it: `CursorEntered` carries no position and was never forwarded, and a pointer that *rests* sends nothing more. Hover effects and tab hover cards stay dead until the user moves the mouse — the symptom the standing HACK comment in `TaoComposeSceneHost` describes as "hover doesn't render until the user clicks once". A hover card is worse than dead: it dies on its own phantom exit, reopens, and exits again, a loop no pointer can break. So trust the geometry over the event. An exit is ignored when the cursor is demonstrably still ours — inside the view's bounds, and the window on top at that screen point is this window or one of its `childWindows` — and the position is re-published instead; `CursorLeft` is kept for a cursor that really is somewhere else. `mouseEntered:` publishes its position for the same reason.
`a popup outside the owner window is left alone while the screen has room` needs the popup to land outside the window *and* inside the work area at once. The default 800 dp window centred on the runner's 1024 px display leaves 112 px for it, so the popup was clamped back in — on the case whose whole point is that nothing clamps. A small window against the left edge has room anywhere we run. The two cases that need a window *above* the work area are asking for a state macOS does not have. Measured on 26.5: `setFrameOrigin:` and `setFrame:display:` both pull a frame whose top would go under the menu bar back down, titled and borderless alike, and only an override of `constrainFrameRect:toScreen:` escapes — not a trade Nucleus makes, since AppKit runs that constraint on display changes too and a window it no longer keeps on screen is a window the user cannot reach. A user cannot drag a window off the top there either. They skip on macOS with that reason and stay covered on Windows and Linux, where the drag is an everyday gesture.
`Robot.mouseMove` warps the cursor on macOS, and the events that follow a warp carry the *pre-warp* location for a few hundred ms — measured as ten consecutive moves all reporting one stale point. A press sent inside that window is hit-tested where the pointer used to be, so a case that clicks straight after moving clicks the wrong thing. `robotPressAndDrag` now lands on its start point in two hops, the second a real move from the cursor's new home, which is what flushes the true location through. Same shape as the pattern `NativePopupMarginInputHeadfulCases` already used for its pointer cases.
…r it (#444) Two ordering defects made the content trail the window by one configure on every commit of a Wayland resize — visible as the jump on a left/top edge drag, where the origin moves a step ahead of the content. 1. Tao's GTK `draw` and `configure-event` handlers only post to its event channel: `RedrawRequested` / `Resized` reach the host after GDK's after-paint has already committed the toplevel with the new `set_window_geometry`. The frame for configure N could never ride commit N. The widget helper now connects a real `draw` handler on the GtkWindow (`nativeConnectToplevelDraw`); during a resize burst the host renders from it, taking the size from `gtk_window_get_size` (GTK's own configure-event lags the same way), with the content sub-surface in `set_sync` and the swap at interval 0, and waits for the swap before returning — so the buffer is cached compositor-side when GTK's commit applies it, atomically with the geometry. Sync is armed only from an idle swap thread and only with the interval-0 burst, or a commit with a frame callback attached would wait for the very GTK commit the draw has yet to return to. The swap interval is now applied by the swap thread before its present, so it is in force before the first synced commit. 2. Mesa's `wl_egl_window` resize callback adopts the new size only while no back buffer is acquired, and `eglMakeCurrent` acquires one: a resize pushed after it lands in the next frame's buffer, and this frame paints the previous size. `applyPendingNativeResize` now runs before `nativeMakeCurrent`; the Skia surface rebuild a scale change asks for is deferred to when the context is current. Measured with a compositor-driven left-edge resize (KWin scripting, 30 steps of 8 px) and screen capture, counting frames where the content's right edge moves — which it never does for a plain GTK3 window: before 64–82 of ~300 frames, after 0 on three runs. A WAYLAND_DEBUG trace pairs every GTK geometry commit with a child buffer of exactly that width (100/100).
…awable A partial frame has a fixed cost (~0.3 ms for a few pixels against ~0.7 ms for a full frame). Measured on Apple Silicon at 2560×1050 with the real scene recording, full vs partial, GPU-synced medians: partial breaks even around 80 % of the drawable and costs up to ~5 % more above, while it still saves 6–26 % at 70 %. A repaint covering 80 % or more is now done in full.
…nt it as the dirty rect (#755) ANGLE's D3D11 window surface renders into an offscreen texture it copies into the swap chain at present. With EGL_BUFFER_PRESERVED that texture always holds the previous frame (buffer age 1), so a frame repaints only its damage; eglPostSubBufferNV copies just that rectangle and hands it to DXGI as the Present1 dirty rect. Damage drawn but not yet presented is accumulated for the next present. A frame that changed nothing is not presented, its successor held to the measured present period. NUCLEUS_TAO_PARTIAL_REDRAW=0 disables it natively.
…hold (#755) Measured on Windows (ANGLE / D3D11, 2560x1032, real scene recording, partial and full frames interleaved, GPU-synced medians): a partial frame costs ~0.4 ms for a few pixels against ~0.9 ms in full, breaks even at 80 % (1.01-1.05) and costs up to ~9 % more above, while it still saves 2-11 % at 70 % — the macOS figure. The constant and the check move to PartialRedraw so both hosts share them.
…tialRedraw } (#755) Off by default. The knob (also on under the nucleusOptimization master) registers the Compose patch — without it Compose is not transformed at all — adds -Dnucleus.tao.partialRedraw=true to jvmArgs, and bakes optimization.partialRedraw=true into nucleus-app.properties for native images, which have no launcher .cfg. The runtime reads the system property first, then that key. -Pnucleus.tao.partialRedraw.patch is gone; ProGuard also -dontwarns the generated hooks class, absent by default.
…updates" (#755) The tint marked what each partial frame repainted, alternating two colours, and left it in the preserved buffer: a full frame drew nothing, so a change it painted read as missed damage, and old tints stayed on screen until something repainted them. It now does what HWUI's FrameInfoVisualizer does: what a frame changed flashes in translucent red (0x7fff0000) every other drawn frame, the whole frame when the damage is unknown, and frames repaint in full while the tint is on (HWUI's unionDirty empties the dirty rectangle), so a flash lasts one frame. Empty frames are still skipped, and the debug stats still report what partial redraw would repaint. One helper, PartialRedraw.drawDebugTint, for the three hosts.
…ters (#755) nucleus.application { debug { partialRedraw { tint = true; stats = true; verify = false } recomposition { enabled = true; top = 10 } } } The block maps to the runtime switches (nucleus.tao.partialRedraw.tint / .debug / .verify) on the run task only: never the launcher .cfg, a runDistributable or a native image, so a build cannot ship with debug overlays. -Pnucleus.debug=tint,stats,verify,recomposition adds switches for one run without touching the build; unknown ones are warned about, and so are partial redraw switches while partial redraw is off (Compose is then not patched and every frame repaints in full). recomposition installs a CompositionTracer (RecompositionCounter, with the first scene) and logs the composables that ran the most every 3 s, what Android Studio's Layout Inspector shows as recomposition counts.
…orever (#755) A purged IOSurface stays Empty — and volatile — until someone makes it non-volatile, and Core Animation never does: the KeepCurrent read reported that buffer lost on every frame after a single purge. Read the state by setting NonVolatile, so the purge is reported once.
Seeded window-level chaos (resizes, bounces, maximize, fullscreen, minimize, clear colour, pauses around the idle reset, bursts, menus, a background-thread writer) over partial-friendly churn, for the verify oracle; partial.demo.settleDir adds a capture handshake that checks for stale pixels at real frame timing.
…t one (#755) The 4-40 ms window never accepted a frame above 250 Hz, so a 360 Hz panel stayed paced at the 60 Hz default after every clean frame, and it took two-refresh intervals (a slow frame, 30 fps content on 60 Hz) as a period, drifting the idle hold towards 33 ms.
The Windows and Linux hosts queue the scene's coroutines on a dispatcher drained only on the frame path, and a minimized window returns before any drain: every effect of that window froze until the user restored it (an app timer, an effect restoring the window itself), and the queue grew with every snapshot write. Minimized, nothing is drawn and the frame clock stays parked, but the queue is drained, at most once per display period so a self-dispatching coroutine cannot spin the loop.
…cle a race from a miss (#755) scene.draw applies the global snapshot itself, after the beforeDraw hook: a write since the frame's apply (another thread, a layout callback) invalidated a layer after the tracker measured the damage, so the frame re-recorded it outside the repaint and showed it a frame late. Applying it right before the last layout leaves only writes landing during the walk to race it. The tracker reports the layers whose version moved during the draw, and the verify oracle counts a difference confined to them as raced= rather than as missed damage.
…rank (#755) Every setContent moved its writer to the top of the clear-colour stack, and a writer's SideEffect runs on every recomposition. The resolved colour recomposes the chrome (its light/dark), so a TitleBar and a WindowBackground of opposite darkness took the top in turns, one frame each, forever: every frame a clear-colour change, repainted in full. Only a change of colour now re-ranks a writer. The partial redraw debug log names what changed in the frame key.
… a new size (#755) ANGLE resizes its window surface only at the end of a present (checkForOutOfDateSwapChain after swapRect), so the frame drawn right after a resize landed in the old-size buffer — origin bottom-left, everything past the old size lost — and was presented that way; the verify oracle's control caught it on every maximize, fullscreen and animated size step. nativeResize now posts one pixel of the current buffer when the size changed, which runs that check. An empty rectangle does not: EGL returns before reaching the swap chain.
…an (#755) renderFrameBlocking records without the damage walk and pumps the dispatcher before its replay: the pump can record and walk a newer loop frame that reaches the render thread first. The older blocking picture then landed in a drawable marked up to date, while the next damage was measured from the newer frame — whatever changed in between stayed stale in that drawable (a grid cell after a fullscreen toggle in the torture scene, ~1 per 10-30 cycles). The blocking frame now leaves its drawable unknown, so the next frame drawn into it repaints in full.
feat(tao): partial redraw — damage tracking + Linux EGL, macOS Metal, Windows ANGLE
glibc creates up to 8 x cores malloc arenas and each keeps what it once
held, which left SeforimApp ~900 MB above what it used. A new
nucleusOptimization { mallocArenas } knob (also on under the master)
caps them at 2 through mallopt(M_ARENA_MAX), first thing in
GraalVmInitializer.initialize(), for JVM and native-image apps alike.
- linux-hidpi: nativeSetMallocArenaMax (dlsym, glibc only) and
capLinuxMallocArenas(); an environment MALLOC_ARENA_MAX or
glibc.malloc.arena_max tunable always wins
- plugin: -Dnucleus.optimization.mallocArenaMax=2 in jvmArgs (an
explicit value wins, 0 disables) and optimization.mallocArenaMax in
nucleus-app.properties for native images
- rename HiDpiLinuxBridge to LinuxStartupBridge, since it now carries
more than the HiDPI detection
Linux: opt-in glibc malloc arena cap (#757)
fix(tao/macos): one cursor table, no throwing private NSCursor factory (#746)
The Linux and Windows hosts drained the scene's coroutine queue only from the frame path, so every dispatch requested a frame: a main-confined delay loop, a clock or a withContext(Dispatchers.Main) hop rendered (and on Linux presented) a full frame although nothing changed on screen. SceneMainDispatcher, shared by both hosts, still drains in the frame path before the frame clock ticks, and otherwise drains between frames through TaoMainDispatcher. Frames come from the scene's own invalidations only. The minimized drain and Linux's swap-busy / idle-hold drains are gone. partial-redraw-demo gains a main-tick scene reproducing the issue.
…-754 fix(tao): a main-dispatcher dispatch no longer renders a frame (#754)
`Version.fromString` did not accept a `+build` suffix, so a version such as `1.2.3+42` failed the regex and fell back to `0.0.0`. An app built with build metadata therefore saw every published release as newer and was offered the same update on every check. For pre-releases the metadata leaked into `meta` (`beta.1+sha`), which broke comparisons. Match the `+...` suffix and discard it, as SemVer 2.0.0 §10 requires build metadata to be ignored when determining precedence.
fix(updater): ignore SemVer build metadata when parsing versions
… hosts The loopback exception to the https requirement accepted any host starting with "127.", so a remote name such as 127.updates.example.com could serve updates over plain http. The 127.0.0.0/8 exception now applies only to a dotted-quad IPv4 literal, checked without resolving it. The IPv6 case never matched: URI.getHost() returns "[::1]" with brackets, so http://[::1] was rejected. "localhost" is now matched ignoring case. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(updater): limit GenericProvider's http exception to real loopback hosts
Draft
Collaborator
Author
|
Superseded by #776: the head branch was renamed from |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nucleus 3.0 vs current
main. Tao becomes the only window backend. Two multi-window archetypes land on it: satellite palettes that dock, and Chrome-like tabs. Compose 1.12's window API v2 is supported through an AWT-free clone. Windows can drop their minimize and maximize buttons.nucleusApplicationgainsexitProcessOnExit. Cmd+Q and Dock → Quit go through each window'sonCloseRequest. Native OS callbacks land on the host UI thread, not the AWT EDT. A stalled Windows event loop is reported instead of freezing silently. Recognized trackpad pinch reaches Compose asScaleevents.nucleusApplicationinitializes FileKit and skips single instance in dev runs. Packaging provisions its own Node.js, ships Nucleus JNI libraries next to the app instead of extracting them, takes ANGLE from Maven (D3D11 only), and gains macOS.appexembedding, a Developer ID PKG with install scripts, a startup optimization pack,lastJdk, JRE fonts stripped from the runtime image, G1 in native images on Windows / macOS, jlink / App Store PKG / NSIS fixes, and SemVer pre-release versions on Windows and macOS. Native libraries can extract to an app-chosen cache.FsWatchershares one native watcher per instance and delivers macOS renames asMoved. Windows NSIS installs update without closing the app, and updates can be tested without publishing a release, and a manifest file name can no longer escape the staging directory. A new Kotlin Multiplatformsharemodule opens the system share sheet. Tabs can live in app-owned windows and cross between linked workspaces. Mouse side buttons reach Compose, and a macOS Control-click is a secondary click. FileKit dialogs attach to a Nucleus window. Kotlin 2.4.20 and Compose 1.12.1 are required.The satellite / dock / tab family is
@ExperimentalNucleusApiand may still move.Breaking: Tao is the only backend
#593 deletes
decorated-window-awt,decorated-window-jbr,decorated-window-jni, andexamples/jni-demo(~10k lines).nucleus-applicationnowapi-depends ondecorated-window-tao: the backend is no longer a consumer choice, and a missing runtime would otherwise only fail at launch.Gone from the public API:
NucleusBackend,LocalNucleusBackend,nucleusApplication(backend = …),NucleusApplicationScope.backendNucleusWindowUnsafe.awtWindow/awtDialogMaterialDecoratedWindow/MaterialDecoratedDialog(M2 + M3) andJewelDecoratedWindow/JewelDecoratedDialog— only theNucleusApplicationScopereceivers remainCompose Desktop's AWT
Window,DialogandTrayare unsupported. UseDecoratedWindow,HostedWindow/HostedDialog, and an AWT-free tray.core-runtimestill hasWindowBackend.Awt: it describes a plain Compose Desktop / Swing host that embeds Nucleus libraries. The plugin'sjbr-apiProGuard keep and AOT unsealing stay, because an app can still shipjbr-apiitself.material2's dialog existed only in AWT form; it is now aNucleusApplicationScopereceiver, so M2 keeps parity with M3. Dropping the AWT overloads also retires theLowPriorityInOverloadResolution/INVISIBLE_REFERENCEworkarounds they needed.NucleusWindowHost.Windowis a publicfun interface.minimizable/maximizableare new parameters on it (and on everyDecoratedWindow/HostedWindowoverload). Themed hosts that implement the interface have to take them; 2.6 already breaks that ABI.Compose window API v2
#634. Compose 1.12's
androidx.compose.ui.window.v2is wired to AWT:Screenwraps aGraphicsDevice,WindowGeometryProviderScopetakes a displayablejava.awt.Window. Neither exists on Tao, and reflection is off the table in native-image. Accepting those types would mean every scoped geometry provider andrequestScreensilently dropped. That is worse than no surface, so Compose's v2 types are not accepted anywhere.The supported surface is
dev.nucleusframework.window.tao.v2, a member-for-member clone (Screen,WindowState,DialogState, the three providers, savers,remember*factories) backed byTaoMonitors+TaoWindow. Migrating from the Compose package is one import; deleting the clone restores the upstream import if JetBrains ever decouples its types.DecoratedWindow/DecoratedDialog/HostedWindow/HostedDialoggain overloads for the cloned states (no defaultstate, so v1 call sites stay unambiguous). Every request is applied,requestScreenincluded. Observedbounds/screenId/placement/isMinimizedrepublish from the native window on move and resize.TaoMonitorsenumerates displays without AWT (EnumDisplayMonitors/NSScreen.screens/ GDK): physical px, top-left origin, work area, never empty. Linux enumeration is checked against the real gdk3 API and never aborts the process.Size and position stay split (
CombinedBoundsProvider). ADpRectcannot carry "let the WM place it" or a wrap-content axis without turning both intoNaN. Wrap-content providers (Unconstrained,PreferredWidth/Height) re-measure continuously through the window's own wrap-content path.Wrap-content placement (#674, #675, fixes #546). A window or dialog with
Dp.Unspecifiedon an axis used to render at the right size and then sit wherever the creation fallback (800×600, or 0 dp) had been aligned. The initialAlignedis now remembered, skipped while wrap-content is unsettled, and re-applied aftersetInnerSizeonce the resize echo lands. A dialog with a parent recentres on that parent (macOS included); a parentless dialog centres on the screen, as AWT'ssetLocationRelativeTo(null). Once the measured size has landed, the scene column flips fromwrapContentWidth(unbounded = true)tofillMaxSize(), so aTitleBarspans the window instead of measuring 0 px wide.Known limits:
measureWindowContentbefore the window exists has no scene; it falls back to the current content size clamped to the constraints, then becomes a realComposeScene.measureContentpass once mapped.zoom:itself (that re-zoomed the window); setting the frame un-zooms, then bounds are applied and confirmed. A placement-toggle storm followed by a bounds request now converges instead of leaving the window zoomed (#647).Satellites, docking, Chrome-like tabs
#635 then #663. Two archetypes on one shared core, declared from
nucleusApplicationso an app never has to reach fordecorated-window-taotypes.Both families are
@ExperimentalNucleusApi(dev.nucleusframework.window, lives indecorated-window-core). Opt-in level is ERROR. Library modules and the demos opt in module-wide; a new public satellite / dock / tab declaration must carry the marker.Shared core (
window/tao/workspace/)Internal, not public:
WindowGroupRelocatedContentHost+RelocatingSaveableStateRegistryrememberSaveablestate that follows content between windowsHostGeometryCrossWindowDragDragGhostWindowScreenPlacementTaoWindow.canPlaceOnScreen— the native-Wayland gateTransferDragNative Wayland
xdg-shell gives a client neither its windows' screen position nor a way to place them. GDK reports every toplevel at
(0, 0)and ignores moves. Anything that treatsouterBoundsPx()'s origin as a screen coordinate must checkTaoWindow.canPlaceOnScreen(branch on that, not onisNativeWaylandSurface). The size half stays valid.Where the app cannot place its windows, the gesture rides the platform drag-and-drop session — the only pointer grab that crosses windows with coordinates. The source starts a session carrying an in-process token (
TaoPrivateTransfer,SAME_APPonly). The window under the pointer resolves the drop in its own coordinates and records it on the session; the source acts on that record when the session ends. Roles are inverted versus the pointer path, because the source is told nothing about where the pointer is. The drag icon is a reduced snapshot of the dragged palette or panel (TaoWindow.contentSnapshot).DragGhostWindow(popupFor = source)is the preview that follows the pointer out of a compositor-placed window (wl_subsurface, parent-relative positions).Chromium falls back to the same design on compositors without
xdg-toplevel-drag, which GTK3 cannot reach.NUCLEUS_TAO_LINUX_RENDERER=x11restores the window-following gesture.SatelliteScope.isCompositorPlacedis the same answer for the window the chrome is composed in.SatelliteWorkspace.dragKind(Window/Transfer) says how a drag in flight is carried, which is what tells preview code whetherdragGhostwill ever be published.Satellite windows
A satellite is a real native window that belongs to another one: it follows its parent, stays above it, hides with it, and can be reparented.
SatelliteWindow+SatelliteWindowStatecover the palette-attached-to-a-document case (WindowPositionerresolves the anchor).SatelliteWorkspaceis the workspace a tool app has: one palette serves whichever document is in front, and can be pulled into the document itself.nucleusApplication(args) { val workspace = rememberSatelliteWorkspace() DecoratedWindow(onCloseRequest = ::exitApplication) { JoinSatelliteWorkspace(workspace) WindowScaffold(titleBar = { TitleBar { Text("Document") } }) { padding -> DockLayout(workspace, Modifier.padding(padding)) { Document() } } } Satellite(workspace, id = "tools", title = "Tools") { ToolsPanel() } Satellite( workspace, id = "colors", title = "Colors", initialPlacement = SatellitePlacement.Docked(DockSide.Right), ) { ColorPanel() } }pinTo. When it closes, the next member takes over and the satellites move on without shifting on screen.SatellitePlacement.Floating/Docked(side)chooses between an owned window and a panel inside the owner'sDockLayout.Modifier.satelliteDragHandledrags a satellite between the two. A panel dragged out is previewed by a borderless click-through ghost window.snapshot()/restore()hand the whole layout to the app to persist.rememberSaveablestate inside a satellite survives the move between hosts.Absoluteposition is applied before the window is shown, so a satellite no longer flashes at the WM's default spot.controlButtonsDirection(#733) puts a floating satellite's controls on the main window's side. An RTL app on an LTR system that passesControlButtonsDirection.SystemNativeto its main window had its satellites' traffic lights on the opposite side. DefaultAuto, unchanged.maximizable = false. A maximized satellite breaks anchoring and the drag-to-dock hit-test. On Linux, tao'sset_maximizableis a no-op, so Super+Up is undone immediately.On Wayland, a floating satellite's header carries the drag while a caption strip beside the window controls keeps the compositor's move — the split Chrome's tab strip and GIMP's dock tabs both land on.
SatelliteCaptionStripWidth+ thefloatingCaptionslot ofSatelliteare composed only whereisCompositorPlaced, so an app never has to guess a width or accidentally claim the only area that can move the palette.Dock layout
DockLayoutis the dock. Sides nest insideOrder(outermost first, defaultDefaultDockSideOrder= top, bottom, left, right — notDockSide.entries, whose declaration order is left, right, top, bottom). A side is either split (panels share its length byDocked.weightand its thickness bydockExtent(side)) or layered (layeredSides: each panel a full-length layer of its ownDocked.extent, the shape of a nested split-pane tree without the tree).SatellitePlacement.Dockedcarries its ownextentandweight; both ride inSatelliteLayoutSnapshotand are driven bySatelliteWorkspace.setDockedExtent/setDockedWeight. Extents are fitted proportionally when the window is too small; the stored values come back with the room.The
splitterandpanelslots hand the drawing to the caller.DockSplitterScope.dockSplitterHandle()carries the gesture, so a 1 dp divider with a wider overflowing grip works.DefaultSatelliteHeaderno longer imposes a height or a background on a docked panel.Sides are physical. The layout forces LTR internally, then restores the caller's direction for content, panels and slots, so
DockSide.Leftis the left of the screen in an RTL app and the splitters drag the right way.Every panel and the content are
movableContentOf: no layout change (extent, weight, order, side, restore, side order, direction) rebuilds a subtree, so a docked pane keeps its scroll position and itsremembers. Inputs live inDockLayoutStateas snapshot state because the bands are separate composables that strong skipping would otherwise skip.Drop feedback is the target.
DockZoneHintsdraws rectangles and publishes them toHostGeometry.zoneBoundsInWindowPx.dockTargetAtresolves a drop against those, not against the window's edges. On a layered side the strip is inset behind the existing layers; the window's own edge behind them is nothing. A zone is entered when the dragged satellite's edge is within one zone thickness of the zone's outer edge and overlaps it across the other axis (edge alignment, not overlap, or a full-height panel could never be torn out). The pointer inside a zone is a second trigger and the tie-break.dockSides(Satellite(dockSides = …), default all four, empty = floating-only) is fixed at declaration and enforced everywhere:dock()andrestore()refuse another side, hints neither draw nor publish it, drag sessions filter on it, and the default header hides its Dock action for a floating-only palette.floatable = falseis a fixed panel:undock()refuses it, arestore()that floats it is ignored, the docked drag publishes no tear-out ghost, a release off every zone leaves it in place, the default header drops its Float action, and the declaration requires a dockedinitialPlacement.reorderable = falsepins the rank:dock(order)is ignored (it takes the declared rank back),insertInStackpushes any other panel past the last pinned one, drop slots keep the forbidden ranks as empty so a slot's index is still its rank, andsatelliteDragHandleis inert when a drag could not end anywhere.Ranks.
Docked.orderis kept contiguous from 0 per (host, side).dock(order)inserts at that index;nullis the rank the entry last held on that side (remembered inSatelliteEntry.dockMemory), else the end. A side with panels publishesDockDropZone.slots— one rect per rank, cut at the neighbours' centres, the dragged panel excluded — soDockTarget.orderis the rank under the pointer. A pointer over a stack beats a strip across its corner.minExtent/maxExtent(Satellite(...), defaultMinDockExtent..∞, #695) bound a panel's docked thickness: on its own layer, on a shared split side (thickest minimum, thinnest maximum, minimum wins), on the splitters, ondock()/restore(), and in the drop preview. The floating window is not constrained.restore()applies placements before extents.dock()and the preview share one width (dockSeedExtent) and one weight (dockSeedWeight), so what lights up is what the release produces — a split side's landing rect is the stack at the thickness the side takes once the panel joins it.Chrome-like tabs
Tabs are declared once with
Tab.TabWindowscomposes oneDecoratedWindowper group. Windows follow the tabs: a tear-off adds one, the last tab out closes one.nucleusApplication(args) { val workspace = rememberTabWorkspace() TabWindows(workspace, onLastWindowClosed = ::exitApplication) for (document in documents) { Tab(workspace, id = document.id, title = document.name) { Editor(document) } } }TabWindowshas two app slots, composed at one call site for every window, so a tab change neither rebuilds them nor moves the body's relocation keys:windowWrapperwraps the whole window including its strip (per-window locals, background).windowBodyWrapperwraps only what is under the strip — where window-level chrome goes (aDockLayout, activity bars).Two drag paths. Where the app places its windows, the gesture is
screenDragHandle→TabWorkspace.beginDrag(ghost window, screen hit-test, tear-off). A strip the card has reached counts as entered; the pointer's own strip still wins. Where it cannot (native Wayland), the grip istabStripLocalDragHandle: a local reorder driven by the pointer's travel in window px, and the moment the pointer leaves the strip the gesture is handed to the platform DnD session (transferDragHandle). That handover is what gives every other window the pointer in its own coordinates. The tab slot carriesnoWindowDrag(): the title bar's move is a compositor grab that swallows the gesture.TabStripmotion is a port ofsh.calvin.reorderable'sReorderableRowstate machine. Items arekeyed on the tab id. A tab dragged along its own strip publishes no ghost; the strip draws it at the pointer's travel since the grab. A neighbour slides one tab-width aside (springStiffnessMediumLow) when the carried tab's edge crosses its centre. On release the session setspendingReorderinstead of reordering — the strip'sTabStripMotion.settleslides the tab into the target slot, thenreorder()+rest()in the same frame, so nothing jumps. Offsets are draw-timegraphicsLayertranslations, sotabSlotgeometry is always the settled layout. Tabs open/close by width (AnimatedVisibility, 200 ms). A hover card shows the tab under the pointer; a click a drag no longer swallows.Direction.
reorderTargetandinsertionIndexare direction-aware (a right-to-left strip used to resolve every drop mirrored). Both take the direction the strip publishes onHostGeometry.layoutDirectionand infer it from the slot order only without one: a single tab cannot tell, and a right-to-left single-tab strip resolved left to right flipped the index on every sample — two cards sliding about (#695). The drag ghost is laid out in the source strip's / dock's direction.Customizable previews (#695):
TabEntry.thumbnailis app-assignable, so a restored layout can put its saved picture back (assign before the tab is shown; the recorder's capture replaces it once it is).TabPreview(tab, modifier)is the one composable for a tab's thumbnail; the stock hover card is built on it.TabWindows(dragGhost)draws the card under the pointer,TabStrip(dropGhostCard)the card in the landing slot. Both default to the now-publicTabGhostCard(tab, modifier).TabDropGhost.tabcarries the entry.TabStrip(tabLeading, tabTrailing)are per-tab slots; the 6 dp gap is charged only when a slot draws something, so the stock chip is unchanged.WorkspaceDragKind(Window/Transfer) replacesSatelliteDragKindand is shared bySatelliteWorkspace.dragKindandTabWorkspace.dragKind. It is observable and reportsTransferonly once the platform session exists.TabWindowsandDragGhostWindoware pinned to@ComposableOpenTarget(-1): the inferred target flipped with incremental compilation (Target-inferred nucleusApplication scope lets a callee's non-UI composable target flood the window scope #636).Title bar slot (#731).
TabWindows(titleBar = { strip -> … })keeps an app's own title bar (a gradient,newFullscreenControls,ControlButtonsDirection.SystemNative). The default is the now-publicDefaultTabTitleBar, the previousBasicTitleBar(FillCenter) { strip }. Innucleus-applicationthe slot has aNucleusDecoratedWindowScopereceiver;rememberNucleusScope()is extracted frombindNucleusContentso the title bar gets the Nucleus scope without running the window binding a third time.App-owned tab windows (#732).
TabWindowsis now built from public parts, so an app can open its own window per group (state, title, key handling, close policy) and draw its own strip with the exact workspace behavior:BindTabGroupWindow(workspace, group, window)attaches the window to its group and detaches it on dispose (closesOnQuit = false).TabGroupWindowPlacement(group, state)applies the group'splacementRevision(restore, tear-off) to an app-ownedWindowState, never fighting a user drag.ApplicationScope.TabDragGhostWindow(workspace, compositionLocalContext, content), plusNucleusApplicationScope.TabDragGhostWindow(workspace, nativeContextMenu, content).TabStripDrag+TabStripScope.rememberTabStripDrag(reorderAnimation): carry along the strip, slide home, hand-over to another window.Modifier.tabStripGrip(scope, drag, tab, index, cursor): slot, placement,noWindowDragand the drag handle in one place.Modifier.tabStripCarry(drag, tab)is the carried offset.TabGripCursorontabStripGripandTabStrip(gripCursor):Defaultkeeps the open/closed hand,Nonekeeps the strip's own pointer.Linked workspaces (#734). An app with one
TabWorkspaceper virtual desktop lets a tab cross between them.TabWorkspace.linkedWorkspaceslists the other workspaces whose strips accept this one's drags (tried after its own, pointer drags only).onForeignDrop(tab, into, target)is called on release over a linked strip; the workspace leaves the tab in place, because only the app can declare it in the other workspace. Withnull(default), linked strips are no target. Where strips of two workspaces overlap, the drop follows the in-workspace rule (a strip under the pointer beats one the card only reaches, then the most recently focused window) on one process-wide focus clock.Fixes: a tear-off after
restore()never takes a restored group's id (the counter restarted with the process, so two windows could share an id, or pending tabs landed in the torn-off window) (#731).tabSlotignores a tab that just left its group, which crashed the strip (found by a 400-operation random walk) (#732).One drop preview everywhere
The card that follows the pointer (
SatelliteGhostCard/TabGhostCardonDragPreviewSurface) is also drawn on the space the release fills. The dock draws it atDockLayoutState.dropRectPx(empty side: the edge strip; layered: the layer at that rank; split: the share the re-divided weights give it). The tab strip opens a slot of the dragged tab's width (TabStripScope.dropGhost). The sides merely on offer are the same surface athintintensity. No insertion bars, no drop-indicator lines. A custom strip drawsdropGhostitself, asjewel-tabs-demodoes with a placeholderTabData.Editor.Pointer icons
Compose still only defines Default / Text / Hand / Crosshair in common code, and AWT-backed
PointerIcon(Cursor(…))is unusable on Tao.TaoPointerIconsadds Grab / Grabbing, Move, NotAllowed, Wait, Progress, Help and the two axis resizes as plainPointerIconinstances carrying a native cursor code.Window chrome
#680 (fixes #504) then #684.
DecoratedWindow/HostedWindow/NucleusWindowHost.Windowgainminimizableandmaximizable, both defaulttrue, next toresizable.resizable = falsealready removed the maximize slot; this is the other half of the caption, so a login screen can be close-only:Both flags are snapshot-backed on
TaoWindowand re-applied at runtime through the sameLaunchedEffectasresizable. Restore stays available on a non-maximizable window, so one the WM maximized anyway can still leave.minimizable = falsemaximizable = falseNSWindowStyleMaskMiniaturizablecleared (Cmd+M and the Window menu follow)WS_MINIMIZEBOXdropped (taskbar click, Win+↓, system menu)WS_MAXIMIZEBOXdroppedset_minimizableis a no-op, so Super+H / Alt+Space still iconifyset_maximizableis a no-op; a satellite undoes Super+Up itselfDecoratedDialogpasses bothfalse.SatelliteWindowand workspace palettes passmaximizable = false.LCD / ClearType on Windows
#626. Compose Desktop hardcodes grayscale as the Windows font-smoothing default (CMP-5359 / compose-multiplatform#875). ClearType is enabled end to end with no runtime reflection, under HotSpot, ProGuard, and GraalVM native-image.
LcdTextDefaultTransform(artifact transform + ASM) patchesFontRasterizationSettings.PlatformDefaultinui-text-desktopjars on non-test runtime classpaths —SubpixelAntiAliason Windows. Compose layout drift fails the build: the patcher verifies the getter, the constructor descriptor, and the enum fields it references.lcdSurfacePropsattaches the OS-queried pixel geometry (cached, RGB/BGR, grayscale on any unknown) to opaque Windows window surfaces only. Per-pixel-alpha surfaces (popups, NativeView overlay, Mica / Acrylic, transparent windows) keep unknown geometry so Skia falls back to grayscale.Opt-outs:
-Dnucleus.text.lcd=false(runtime) /-Pnucleus.text.lcd.patch=false(build, skips the transform).Popup layers against the screen
#651, fixes #569.
nativePopupLayersalready exists onmain. What 2.6 changes is that those layers behave like the OS surfaces they are.LocalWindowInfosoPopup.skiko.ktsees the work-area-sized box the design always intended, instead of the owner window.popupScreenClampOffsetclamps the native frame into the work area of the display it lands on, re-clamped on every push, so an open popup survives an owner drag across monitors. Dialogs must not follow the display: layers report the window size for dialogs and the work area for popups, discriminated onscrimColor.boundsInWindowso shadows and the slide-in are not clipped. A closing dialog keeps its surface where it was while it fades out (Dialog.skiko.ktreports a zero-sizeboundsInWindowat the window centre during the fade).nativePopupLayersis now onJewelDecoratedWindow, which had no such parameter.Native context menu flyout (opt-in per popup).
NativePopupLayers { }is new: it provides, for its subtree only, the window scene's ownLocalComposeSceneContextwithcreateLayerrouted to the native popup layer factory. A friend-package Java accessor (TaoComposeSceneContextAccess) reaches that internal local without reflection. The Windows and Linux flyouts wrap in it; macOS stays onNSMenu.On Linux the menu maps as an
xdg_popupinstead of awl_subsurface, so the compositor flips and slides it. One popup per parent takes that path; dialogs keep the subsurface. A second right click now moves the menu instead of only closing it. The flyout draws real CSS box-shadow layers with each OS's own declarations (libadwaita, Breeze, WinUIMenuFlyoutatTranslation.Z = 32), becauseModifier.shadowmultiplied the OS alphas by Compose's elevation factors and left a ~1 % darkening nobody could see. The Fluent menu is laid out as WinUI lays out aMenuFlyout.Trackpad
Scroll and pan (macOS)
#661, port of #656 (#652–#654). Scroll deltas are AWT-shaped:
preciseWheelRotation, no display scale, no extra X flip on a horizontal swipe.Trackpad gestures reach Compose as
PanStart/PanMove/PanEnd(panOffset= AWT delta × 10 dp). Wheel notches stayScroll.Modifier.scrollablehandles both. Custom handlers that only listen forPointerEventType.Scrollmust also handle Pan, or the app can set-Dnucleus.tao.trackpadPanEvents=falseto get AWT-styleScrollfor everything.Everything scroll-related enters the scene through
TaoSceneScrollRouter(window host and macOS NSPanel popups). Native views get the whole pan, begin and end included. The phase wire (RustSCROLL_GESTURE_*,popup_panel.m,TaoScrollGesturePhase) is guarded byTaoScrollWireDriftTest.Pinch as Compose
Scaleevents#662, fixes #660. Platform-recognized pinch (AppKit magnify, GDK pinch, Windows / Linux Ctrl+wheel) used to be replayed as two synthetic
PointerType.Touchcontacts 120 px either side of the cursor: Compose re-recognized an already-recognized gesture (span / slop delay, ~13 % of pinch lost before any zoom), and a contact could land in neighbouring chrome (the MapLibre edge interruptions). It is nowScaleStart/ScaleChange/ScaleEndat the cursor,scaleGestureFactorbeing the per-event ratio.Modifier.transformableand MapLibre consume it; a +1 % pinch zooms immediately.detectTransformGesturesdoes not see Scale events (Compose 1.12). Apps pinching through it needModifier.transformableor aPointerEventType.Scale*listener.TaoTrackpadRotationContactsids, whichTitleBarignores (a rotation over the bar started a compositor move); an interrupted rotation cancels pointer input before releasing the contacts, so it is no longer a tap.Mouse buttons
Back and forward (#728). Side buttons reach Compose as
PointerButton.Back/PointerButton.Forwardon all three OSes. Windows and Linux used to send every extra button as the same code, macOS reported them all as Middle.TaoMouseButtongainsBACK = 3/FORWARD = 4andOTHERmoves from3to5(aconst val: recompile code that reads it). LinuxNativeViewcapture boxes map GDK buttons 8/9 instead of passing them as a primary click.TaoMouseButtonWireDriftTestguards the Rust / Kotlin codes. Native popup panels and the WindowsNativeViewblending overlay still drop side buttons.Control-click on macOS (#737, fixes #736). A left press with Control held is the secondary button, in the window (
TaoComposeSceneHost.onPointerButton) and in native popup panels (popup_panel.m). The choice is latched at the press, so the release names the same button even if Control is let go first.ContextMenuArea, text-field menus andisSecondaryPressednow see it.Packaging
Node.js is provisioned, not required
#709 then #711. Every format except
RawAppImagegoes through electron-builder, which needed anode/npmonPATH. The plugin now downloads Node.js fromnodejs.org(verified against the release'sSHASUMS256.txt) into<gradle-user-home>/nucleus/nodejs, like the GraalVM and packaging JDK toolchains; the three shareToolchainDownloads, and parallel format tasks in one daemon no longer race on the install lock (#711).nativeDistributions { nodejs { version = "22" // default; a major line, "lts", or a pinned release } }Precedence:
compose.electronBuilder.nodePath, thenNUCLEUS_NODE_HOME, then the provisioned install, thenPATH(also the fallback when the download fails). A floating line is sticky once downloaded. electron-builder moves to 26.16.1. CI dropsactions/setup-nodeeverywhere;universal-macosprovisions electron-builder the same way throughprovision-electron-builder.shinstead ofnpx --yes.Nucleus JNI libraries ship next to the app
#712. Packaged apps carried every Nucleus native library inside its module JAR and extracted them on the first launch after an install or update. Only Nucleus libraries move — each
nucleus.native-modulemodule ships aMETA-INF/nucleus/native-libraries/nucleus.<module>manifest, and every othernucleus/native/entry (an app's own library, a third party's) stays in its JAR.$APPDIRnext to Skiko, other platforms' copies are dropped, and the launcher gets-Dnucleus.native.libraryPath=$APPDIR, whichNativeLibraryLoadertries first. Only done whencore-runtime'sbundled-native-librariesmarker is on the classpath (an older loader would not look there). The sandboxed pipeline keeps its layout.Contents/MacOSon macOS, stripped / patched / signed with the other dylibs).Measured on Windows (
tao-demo, 9 DLLs): ~40–90 ms of extraction on the first launch after an update, ~10 ms per warm launch.ANGLE from Maven, D3D11 only
#707. The Windows ANGLE DLLs were extracted at build time from a pinned Electron release: 292 MB of download for 8.5 MB of DLL, carrying Vulkan, WGL, D3D9, SwiftShader and GLES1 backends Tao cannot reach. They now come from
dev.nucleusframework:nucleus.angle-natives(8037.1, the Chromium branch), built from unmodified upstream sources of the branch stable Chrome ships with everything but D3D11 disabled.libGLESv2.dllx64 is 30 % smaller, arm64 is new, andgdi32.dllleaves the import table. A fresh worktree no longer lacks the DLLs. Dependabot is configured for Gradle and GitHub Actions, with ANGLE in a group of its own.macOS app extensions (
.appex)#396, addresses #394. First-class embedding and signing of prebuilt
.appexbundles (e.g. a Network Extension) intoContents/PlugIns/. Nucleus does not build the.appex(that stays Xcode / Kotlin/Native); it copies, signs, and seals.macOS { entitlementsFile.set(file("packaging/app.entitlements")) appExtensions { extension("NetworkFilter") { appex(file("build/appex/NetworkFilter.appex")) entitlements(file("packaging/extension/NetworkExtension.entitlements")) // provisioningProfile(file("packaging/NetworkFilter.provisionprofile")) } } }Each extension is signed inside-out with its own entitlements and (optional) provisioning profile. The outer app is then sealed without
--deep, so the nested signature is preserved. Wired on the JVM/jpackage path, the DMG/PKG re-seal (electron-builder), and GraalVM native images. Unused, the new paths are no-ops.Follow-up from TestFlight validation: the jpackage path now copies with
cp -Rso the nested executable keeps+x(copyRecursivelydropped the POSIX mode and launchd could not spawn the provider, errno 111). The plugin warns when an extension is embedded into an app whose entitlements still grantallow-unsigned-executable-memory/disable-library-validation(both in the default entitlements); a host carrying them alongside a network extension has been reported not to launch.com.apple.security.cs.allow-jitis enough for the JVM.Caveats:
.app.runcannot exercise it; userunDistributable.com.apple.developer.networking.networkextension. Ad-hoc builds only prove bundling and signing.signing {}for a notarized GraalVM DMG.NEFilterManager/NETunnelProviderManager) is out of scope here.Demo:
examples/macos-appex-demo(minimalNEFilterDataProvidercompiled to a universal.appex).nucleusOptimizationandlastJdk#639. One-switch startup pack, with per-knob overrides. Does not enable AOT (
enableAotCacheis separate). Does not change the Gradle compile JDK.nucleus.application { nucleusOptimization = true nucleusOptimization { idleGc = false } }serialGcgarbageCollectoris unset. An explicit collector always wins.compactHeap-Xms32mand-XX:MaxRAMPercentage=25, unless already injvmArgs.singleJarjoinOutputJarswhen ProGuard is on) so the jpackage image contains a single JAR.idleGcbindNucleusContent/bindNucleusDialogContent, so decorated windows, dialogs, tabs and satellites all get it. Also honored in GraalVM native images, throughnucleus-app.properties(#715).lastJdk<gradle-user-home>/nucleus/jdklike the GraalVM toolchain. An explicitjavaHomealways wins.lastJdkis pinned to OpenJDK 27 GA (build 35, https://jdk.java.net/27/). Intel macs and Windows ARM fall back to BellSoft Liberica JDK 27 (Oracle dropped those ports). Liberica Lite is not used: Lite has nojmods, sojlinkcannot produce a runtime image (#669).Developer ID PKG with install scripts
#688, closes #249. PKG was hardwired to the Mac App Store, so a PKG for Jamf / MDM or manual install was not buildable.
macOS { pkg { appStore } }now picks the channel (defaulttrue, existing builds unchanged):macOS { pkg { appStore = false preInstall.set(file("packaging/macos/preinstall")) postInstall.set(file("packaging/macos/postinstall")) } }appStore = falsetakes the DMG's non-sandboxed pipeline. electron-builder signs the installer with the matching Developer ID Installer certificate, handed the bareNAME (TEAMID)fromsigning {}(it prepends the certificate type and rejects a prefixed qualifier), a DSL keychain travels asCSC_KEYCHAIN, andnotarizePkgnotarizes the.pkg. A missing certificate would produce a silently unsigned package, so the task checks the result withpkgutil --check-signature.preInstall/postInstallare staged forpkgbuild --scripts(shebang required). The App Store rejects install scripts (error 90254), so they requireappStore = false, enforced at configuration time.PackageInfo, and Installer ran it twice on a real install. The stagedpreinstall/postinstallare shims that skip the per-bundle pass and exec the app's copy.ExecutableRuntime.isSandboxed()(APP_SANDBOX_CONTAINER_ID). The scheduler gates on it instead ofisPkg(), and a Developer ID PKG is self-updatable while the store build stays excluded. Build-side, the channel ismacOS { pkg { appStore } }itself: nothing public replacesisStoreFormat, a build script readsappStore.macOS.appStoreandTargetFormat.isStoreFormatare deprecated at ERROR level rather than re-aliased: the former was ignored and defaulted tofalse, so an alias would have silently flipped existing builds to the other channel.JRE fonts stripped from the runtime image
#694, port of JetBrains/compose-multiplatform#5706.
createRuntimeImagepasses--exclude-files=glob:/java.desktop/lib/fonts/**. Compose draws with its own fonts; on JetBrains Runtime 21 the image drops from 87 MB to 78 MB. Temurin and Liberica ship nolib/fonts, so nothing changes there.runand GraalVM images are unaffected. An app that renders text through AWT / Swing opts out:nativeDistributions { stripJreFonts = false }GraalVM 25i4
#698. The default innovation toolchain moves from
25i3(GraalVM 25.3.4.1) to25i4(GraalVM 25.4.4.1.1, JDK 25.0.4.1.1). Roll back withgraalvm { toolchain { version = "25i3" } }.G1 in native images on Windows and macOS
#708.
NativeImageGarbageCollector.G1was gated to Linux. Oracle GraalVM ships the G1 libraries for Windows and macOS since 25.4, so the gate is now a version floor read fromGRAALVM_VERSIONin the toolchain'sreleasefile. 25.3 advertises--gc=G1but dies at link time (g1gc-cr.lib); an unreadable version off Linux falls back to Serial. G1 stays Oracle-only.App Store PKG is not notarized
#681, fixes #650. electron-builder was notarizing the macOS App Store PKG with the same credentials as the DMG. App Store packages must not be notarized; the plugin now emits
notarize: falsefor that job. DMG / ZIP are unchanged.jdk.jlinkdropped fromincludeAllModules#682, fixes #673. On a JEP 493 JDK (Temurin 24+ and other builds without
jmods/),jlinkrefuses to emit an image containingjdk.jlink.nativeDistributions.includeAllModules = truecopiedjava --list-modulesverbatim, which includes it.AbstractJLinkTasknow filtersjdk.jlinkout before--add-modules. A shipped app never needs jlink. The default module list never contained it, so default packaging is unchanged.NSIS
#718.
deleteAppDataOnUninstallnow removes%APPDATA%\<appId>in both pipelines (a custom GraalVMimageNameleft it behind).package.jsonis regenerated on every packaging, so apackageNamechange reaches the installer name. Repackaging on Windows no longer fails withCannot delete … after 5 attempts: the read-only flag of jpackage's launcher is cleared before deleting.app-image.Classpath order in packaged launchers
#729. jpackage builds
app.classpathfrom its--inputdirectory sorted by name, so when two JARs define the same classes a packaged app loaded whichever sorted first, while./gradlew runfollows Gradle's order. Every Jewel app was affected: the IntelliJ icon libraries pullkotlinx-coroutines-core-jvm-1.10.2-intellij-2, which sorted before1.11.0and failed withNoSuchMethodError: Job.cancel$default.LauncherClasspathOrderrewrites the launcher.cfgclasspath in Gradle's order (main JAR first) right after jpackage, before macOS signing and the Linux pathing-jar collapse. The sandboxed strip task records.classpath-orderfor it.AWT fonts in macOS GraalVM bundles
#735. Any
java.awt.Fontuse crashed in macOS native bundles (Problem reading font data/Fontconfig head is null); Jewel hits it at startup.sun.awt.fontconfigpointed at the binaryfontconfig.bfc, which the JDK always parses as text properties, andresolveMacOsFontConfiglooked in the wrong directory whenexecDirended in/.. The plugin now ships the JDK'sfontconfig.properties.srcasContents/Resources/fontconfig.properties, the path is normalized, and theFont.createFont(int, InputStream)substitution applies on macOS too.Pre-release versions on Windows and macOS
#255. jpackage on Windows and macOS rejects SemVer pre-release / build metadata (
2.3.5-beta.7failed withinvalid component [5-beta.7]), and every installer format is built from its app image. The plugin now strips the suffix wherever the platform needs a numeric version; no new DSL.--app-version(Windows / macOS) gets theMAJOR.MINOR.PATCHcore. Linux keeps the full version.CFBundleVersionfalls back to the numeric version whenpackageBuildVersionis unset. GraalVM bundles do the same inInfo.plist; the Windows.rcbuildsFILEVERSION/PRODUCTVERSIONfrom the numeric version (2.3.5-beta.7used to become2,3,0,7) and keeps the full one in the strings.packageVersionFor(format → OS →packageVersion→project.version→1.0.0). The GraalVM Windows.rcused to skipproject.version.nucleus-app.propertiesuses the same lookup without the1.0.0default, soNucleusApp.versionand the updater see the full pre-release even thoughjpackage.app-versionis shortened.Auto-update
Hot update on Windows
#720. On Windows,
installAndRestartclosed the app, ran the NSIS installer and relaunched it: ~13–15 s with nothing on screen. The app now stays visible for the whole update.App.exe+app\App.cfgstay at the install root, the runtime and the app move toversions\<version>\, so a new version installs next to the running one.NUCLEUS_HOT_UPDATE=1, which makes the generated NSIS hooks neither kill the app nor delete its files.UpdateHandoff.signalReady()). The new version deletes the retired one.pendingRestartVersionand switch withrestartToInstalledVersion(relaunchArguments).consumeUpdateEvent/wasJustUpdatedno longer report an update whose install failed.New public API:
UpdateHandoff,VersionedInstall,SingleInstanceManager.releaseForHandoff(),installAndRestart(file, relaunchArguments),pendingRestartVersion,restartToInstalledVersion(). GraalVM native images, MSI and portable builds keep the classic update.Test updates without publishing a release
#725. Modeled on electron-updater's
dev-app-update.ymland Squirrel / Velopack local sources../gradlew run -Pnucleus.updater.simulate=update-Pnucleus.updater.feedUrl=build/compose/binaries/main/nsisserveUpdateFeedUpdateSimulation(in code ornucleus.updater.simulate*) plays available / up-to-date / check-error / download-error / checksum-error, timed progress, differential and "just updated".UpdaterConfig.allowLaunchOverrides. An unpackaged run always honours them and never installs.serveUpdateFeedpackages, then serves the manifests and artifacts with byte ranges on127.0.0.1:8421.updater-testing:UpdateFeedServerwith fault injection (FeedFault.Status / Delay / Throttle / Truncate / Corrupt / IgnoreRange).latest*.yml(electron-builder wrote none without apublishprovider); only artifacts of the packaged version are listed, and old manifests are deleted first (clients downloaded the previous installer or failed its checksum);GenericProvideracceptshttp://[::1].Manifest file names
#740. The artifact's file name comes from the manifest's
urlfield (remote input) and names the staged download, so../victim.zipresolved outside the staging directory and the download + rename could overwrite any file the app can write.downloadUpdate()now throwsParseExceptionfor a name that is not a single path component (empty,.,..,/or\) before creating the staging directory or downloading anything. No legitimate manifest is affected.Share sheet
#727. New
sharemodule (dev.nucleusframework:nucleus.share), the repo's first Kotlin Multiplatform library, inspired byrobius-share. Rust only on desktop; Android, iOS and the web are pure Kotlin.ACTION_SEND/ACTION_SEND_MULTIPLE)UIActivityViewControllerNSSharingServicePicker(Rust, JNI)DataTransferManagerdesktop interop (Rust, JNI)xdg-openfallback (Rust, JNI)js,wasmJs)ShareSheet.shareissuspendand safe from any dispatcher. It reports neither the picked target nor a cancel. Errors areShareException(ShareError), validated in common code first.NucleusWindow.share(nucleus-application,compileOnlyonnucleus.share) resolves the parent: HWND,NSWindow(picker pointing atshareAnchor(density)or the top centre),x11:<xid>, or a Waylandxdg_foreignexport released once the portal dialog closes.NucleusShareProvider(${applicationId}.nucleus.share, no AndroidX). The web needs a secure context and a user gesture, and sharesblob:/data:/ same-origin URIs.nucleus.native-modulewiresjvmProcessResourcesfor KMP modules; the root build wires per-source-set detekt tasks intocheck.Native library cache
#686, closes #303. The extraction path was hard-wired (
%LOCALAPPDATA%\nucleus\native,~/Library/Caches/nucleus/native,$XDG_CACHE_HOME/nucleus/native). An app that keeps config, cache, logs and natives under one directory can now relocate it. Candidates are tried in order; a directory that cannot be created or written to falls through:-Dnucleus.native.cacheDir=<dir>(NativeLibraryLoader.CACHE_DIR_PROPERTY). Works for libraries loaded before any application code runs, and bakes into the launcher.cfgthrough existingjvmArgs. The JVM does not expand${user.home}; a path computed at run time goes throughcacheDirectoryinstead. Do not point this at the install directory or inside a macOS.app(read-only for a standard user; writing inside the bundle breaks the signature).NativeLibraryLoader.cacheDirectory, set frommain()before the first native library loads.The root is resolved once, at the first extraction. A later assignment is ignored with a warning naming the root in use. A configured directory is validated with a real write probe (create + delete a temp file), not
Files.isWritable. The content-addressed layout of #304 (<root>/<platform>/<fingerprint>/<library>) is kept under the chosen root.Packaged applications built by the Gradle plugin ship their natives next to the app and extract nothing (#712); this setting matters for fat JARs, IDE runs and distributions that bypass the plugin.
A set-but-empty or relative
XDG_CACHE_HOME/LOCALAPPDATAused to make the cache root relative to the working directory. Those values are now ignored, as the XDG spec requires.Filesystem watcher
#683, fixes #570 and #571. No public API change.
One native watcher per
FsWatcher(#571). Every registration on that instance shares it: one inotify instance / FSEvents stream /ReadDirectoryChangesWloop, not one per path. Events are routed back by root inlib.rs. A root already watched is not re-watched (except non-recursive → recursive, done asunwatch+watch). The backend is created on the firstwatch()and dropped after the lastunwatch().The backend is handed the canonical root on macOS and Linux (one watch per real directory; inotify keys watches by inode and
notifykeeps one spelling per descriptor, so aliases must share it — Kotlin projects events back onto each registration's spelling). On Windows the registered spelling is used (canonicalize()yields\\?\paths there).macOS renames (#570). FSEvents reports an inode's accumulated flags: a rename of an old file arrives as
Create+Rename+Modifyon the gone path, whichnotify-debouncer-fullused to fold into a bareCreated(new); a delete of a pre-existing file surfaced asModified.FsEventsNormalizernow fronts the debounced backend and drops what cannot be true of the path right now. Renames the backend cannot pair areRemoved(old)+Created(new), never dropped.Rawdelivery never emitsMoved.Application lifecycle
#676, fixes #667.
nucleusApplication(andtaoApplication) takeexitProcessOnExit: Boolean = true, matching Compose Desktop'sapplication(exitProcessOnExit).After the last window closes, the JVM is terminated (
exitProcess(0)on a normal quit,exitProcess(1)after a fatal error). That is still required because Compose/Skiko initialisation touches AWT, whose non-daemon EDT would otherwise keep the process alive.exitProcessOnExit = falsereturns normally so the caller can continue in-process. A fatal error is then rethrown after the same SEVERE log.On Linux the closed window no longer stays mapped and frozen after
nucleusApplicationreturns: the GDK and secondary X11 displays are flushed once the loop ends (#714).System quit is cancellable (#696). Cmd+Q and Dock → Quit on macOS used to terminate immediately, bypassing the windows' close handlers. They now deliver
onCloseRequestto every open Tao window, so the same save / confirm / cancel handling works on all three OSes. With no window open, the event loop exits. No new public API.FileKit is initialized for you (#718). When FileKit is on the runtime classpath and the app has not initialized it,
nucleusApplicationcallsFileKit.init(NucleusApp.appId), so dev runs, packaged JVM apps and native images share one data directory. FileKit iscompileOnly; without it the call is a caughtLinkageError, no reflection. Opt out withinitializeFileKit = false.FileKit dialogs attached to a window (#722).
NucleusWindow.withFileKitDialogSettings { settings -> … }fillsFileKitDialogSettings.parentfrom the window: HWND on Windows,x11:<xid>on X11, anxdg_foreignexport on Wayland (closed when the block returns or throws). macOS needs none: FileKit's panels are app-modal.filekit-dialogsiscompileOnly. FileKit moves to 0.16.0.Single instance is off in dev runs (#717).
enableSingleInstancedefaults to!ExecutableRuntime.isDev(), so a second debug instance, or one started while a packaged copy runs, is no longer forwarded and exited. Packaged builds are unchanged.No system-theme polling (#716). Compose 1.12 polls the OS theme every second on
Dispatchers.IO(ComposeUiFlags.pollSystemTheme). Nucleus already providesLocalSystemThemefrom its reactive detector, sonucleusApplicationclears the flag.Native callbacks on the UI thread
#687.
notification-linux,notification-windows,media-control,launcher-linuxandlauncher-macosposted their native callbacks withSwingUtilities.invokeLater. Under Tao the AWT EDT is not Compose's UI thread, and calling it initialises AWT in a process that may want none (graalvm { headless = true }).NucleusUiThread(new,core-runtime) is the one marshalling point: an executor the backend registers, falling back toEventQueue.invokeLaterwhen no Nucleus entry point ran.postalways queues, never runs inline. The OS modules stay Compose-free;javax.swingis gone from all five.TaoApplication.run, so a baretaoApplicationhost is covered too. The same place recordsWindowBackend.Tao, which a bareTaoApplication.runapp used to report asAwt.global-hotkey(#721) invokedHotKeyListeneron the native thread that received the press. Its three bridges now post toNucleusUiThreadand resolve the listener inside the posted block, so a press still queued whenunregister()returns is dropped.Verified on Linux against real D-Bus (notification close, MPRIS play, dbusmenu event): callbacks run on the Tao
mainthread. Without a Nucleus entry point they land on the same threadSwingUtilities.invokeLaterwould use, GUI or headless.Event-loop watchdog
#710, closes #643. A deadlocked event loop produces no exception — to the JVM the thread is a healthy
RUNNABLEin native code — so #640 froze the app in complete silence.TaoEventLoopWatchdogpollsIsHungAppWindowevery 2 s and, once a window has been hung past a grace period on top of Windows' own ~5 s, logsSEVEREwith a full thread dump (event-loop thread first). The probe is a pure OS query: it sends nothing to the loop, unlike aWM_NULLprobe, whose inline sent message is exactly the re-entrancy that deadlocked #640.The shape is Electron's: the framework logs and raises callbacks, the "wait or quit" prompt is the app's to build.
nucleusApplication(args) { onUnresponsive { showWaitOrQuit() } onResponsive { hideWaitOrQuit() } expectUnresponsive { importHugeProjectSynchronously() } // not reported }nucleus-tao-watchdog-eventsthread — not the stuck UI thread, and not the sampling thread, so a blocking listener never delays detection.-Dnucleus.tao.watchdog=falsedisables it (=trueforces it on under a debugger),-Dnucleus.tao.watchdogGraceMs=<ms>retunes it,-Dnucleus.tao.watchdogDialog=truealso pops the native dialog._NET_WM_PINGperturbs the loop it observes.Dependencies
#723. Kotlin 2.4.20, Compose 1.12.1, Jewel 0.41.0, Ktor 3.6.0, Coil 3.6.3, materialkolor 5.0.1, composenativetray 2.1.6, composewebview 1.0.3, BCV 0.18.2, GraalVM native build tools 1.1.14. Compose 1.12.1 types
LocalSystemThemeas its ownSystemTheme;ProvideNucleusSystemThemeprovides that enum, soisSystemInDarkTheme()still reads Nucleus's reactive detector.Tao follow-ups that are not on main
Resize present, macOS and Windows (#678, fixes #576). Animated
WindowState.sizeand title-bar double-click zoom trembled and trailed the window edge. Each resize, Compose presented one to two frames behind the new bounds and the compositor stretched the stale drawable over them.onResizedpresents a frame at the new size inside the resize dispatch (whatprepareFullscreenFramealready did for Decorated window title bar content freeze when enter full screen mode #327), without pumping the dispatcher there. Vendored tao'sset_maximized_asyncno longer uses the NSWindow animator: 16 ms steps eased overanimationResizeTime:, a new request cancels the chain in flight.nativeResizeanchors the stale drawable top-left instead of stretching. Idle zoom: 20 / 20 steps presented before the next arrived (was 2 / 20); median resize → present ~2 ms.Edge double-click zoom, macOS (#693, follow-up to #678). AppKit's own animated frame changes — edge double-click (
_zoomToScreenEdge:), Window-menu tiling,zoom:— run a private run-loop mode tao's observers never see, so the content replayed the whole animation in one burst at the end. The vendoredTaoWindowoverridessetFrame:display:animate:and routes every animated frame change through the #678 stepper, now the single engine (fullscreen transitions untouched).Resizedevents dispatched with the native frame elsewhere: 42 → 0.Linux / Wayland resize (#689 then #691, closes #444).
wl_egl_window_resizeonly records a pending size, so painting at the requested size put ~1 frame in 3 that many rows off. The paint size now comes fromeglQuerySurface, not a prediction — and no desktop-environment check is left in that decision. On NVIDIA the driver reallocates mid-frame, so frames that pushed a resize first bind and clear the default framebuffer, then query (12 → 0 mid-frame reallocations). The scene keeps the window's size; only the render target follows the buffer, so layout no longer lags. Wrong-size frames on a maximize/restore storm: 16/64 → 0.drawhook on the GtkWindow (nativeConnectToplevelDraw, size fromgtk_window_get_size) with the content sub-surface inset_syncand swap interval 0, and waits for the swap before returning. Mesa adopts awl_egl_windowresize only while no back buffer is acquired, so the resize is pushed beforeeglMakeCurrent. Frames with the right edge moving on a scripted left-edge drag: 82 → 0 (a plain GTK3 window: 0). In a native image the draw hook never connected (method looked up on an unregistered anonymous class) and was retried every frame; it now resolves onToplevelDrawCallbackand is tried once per window (#704).queue_drawunanswered for 50 ms falls back to the event-loop render path, it is never armed while maximized / tiled / fullscreen, and the content's opaque region leaves its bottom row out so Mutter never culls the toplevel (which froze GDK's frame clock and with it pointer motion).Input-source indicator, macOS (#690). The badge a Caps Lock bound to layout switching raises is positioned from
firstRectForCharacterRange:. TaoView answered a process-global caret rect nothing invalidated, so the badge kept appearing where a destroyed field used to be — or, before any field was focused, in the bottom-left corner of the screen. The rect is now scoped to the view that pushed it (NSZeroRectotherwise, the only shape AppKit reads as "no insertion point"), theNSTextInputClientoverrides are installed per window creation, and the input context is deactivated when the session ends (guarded by its activation token).Windows re-entrancy deadlocks (#646, ports #640 / #644). Three non-reentrant locks were held across a call that pumps or synchronously sends messages, so a nested window-procedure dispatch parked the event-loop thread in
WaitOnAddressfor good — the window went(Not Responding). Triggers: moving a window to another virtual desktop on Windows 11, Alt+Tab during startup, RDP disconnect, Explorer restarting (TaskbarCreated), end of an IME composition. tao 0.36.0 has the fixes; we vendor 0.35.0 and cannot bump (tao#1231 removed Windows subclassing, which ourPATCH(nucleus)set lives in), so they are hand-ported. Shipped on 2.5 asv2.5.13.GPU resource cache on macOS and Linux (#641). Windows already purges on
main. The Metal host and the Linux GL host now run the same policy. Sharedscene/GpuResourceCache.kt: the limit-toggle is the only primitive skiko gives us, and what actually reclaims is the purge (writing Skia's default 256 MiB budget was a no-op). macOS purges every 250 ms while sizes stream. Linux arms the purge inonResizedand performs it in the render pass, the one point where this host's private EGL context is current. No settle purge and noSystem.gc()nudge on either: macOS and GTK have no drag-end signal, so a timer would fire after every size change.NativeView / TextureView embed bugs (#659). The widgets already exist on
main. New headful monkeys (click storms, resize storms, 150-action random walks) found and fixed:NativeViewdisposed the platform view before detaching it (SIGSEGV);nativeViewHost()returned a new object per call.nativeSetContentOffsetcommitted GTK's toplevel out of band and aborted in cairo.MainEventsClearedfrom aWM_PAINTa modal loop never generates.NSTextField.mouseDown:runstrackMouse:untilMouseUp:on the Tao thread, so a synthetic press never returned;nucleusIOSurfaceTextureSourcenow retains theIOSurface.Dialog's disappearance animation.Window content stays on the UI applier (#649, port of #648, fixes #636). Window and dialog openers (including
Satellite,SatelliteWindow,Tab) are@ComposableOpenTarget(-1)with@UiComposablecontent lambdas, so a non-UI composable called in thenucleusApplicationscope — MapLibre Compose'srememberMapStatewas the reporter — cannot reclassify nested window content.COMPOSE_APPLIER_CALL_MISMATCHis escalated to an error in the two modules' test compilations; aComposableTargetIsolationFixturecompiles the reported shape.JNI exceptions are logged before they are cleared (#677, fixes #486). Every JNI upcall path used to
ExceptionCheck+ExceptionClear: a Kotlin listener that threw vanished, no JUL line, no stderr. Shared helpernucleus_jni_clear_exceptioninnative-common/nucleus_jni.hnow reports throughJniExceptionReporter(JULWARNINGwith the throwable — visible even whenallowNucleusRuntimeLoggingis off) and only then clears. All 34 native bridges go through it.NativeJniExceptionHygieneTestfails the build if a newExceptionClear/ExceptionDescribeappears outside the helper.launcher-linuxnever autolaunches the session bus. WithoutDBUS_SESSION_BUS_ADDRESS, GDBus spawneddbus-launch, which waited for an X display that never came. Nine of ninepreMergejobs that hit the 30-min cap were stuck in:launcher-linux:test.get_connectionnow treats "no address" as "no bus"; both native tests skip without one.GDK's
(0, 0, 1, 1)frame-extents placeholder is not published as a window's frame (tao patch 0007).TaoMonitor.isPrimaryno longer throws under GDK's Wayland backend, which names no primary at all.Windows redraws are served at the end of the batch, not inside it.
No internal
onGloballyPositioned(#705, closes #560) indecorated-window-taoandnucleus-application. Geometry sites (NativeView,windowGlassRegion, caption hit zones,tabSlot,DockLayout,publishHostGeometry) use an internalModifier.onPositionChangedthat fires only on real moves while keeping the modifier's own coordinates; the drag sessions useonPlaced. PlainonLayoutRectChangedwas not a drop-in: it reports the node's outer rect, which differs once apadding/offsetprecedes the modifier.Headful screenshots are captured off the Tao thread (#658).
GraalVM native-test (#657): the test image is given the classes it was compiled against (Material 3 cases were dying with
NoClassDefFoundError). The live-theme e2e is skipped on runners without an XDG portal (#703).A window created maximized restores to its floating size, macOS (#733).
applyMacOsInitialMaximizedSizebuilt the native window at the work area, which tao keeps as the frame to restore to, so leaving maximized gave a screen-sized window pushed down by the title bar (0,-32 1710x1073→ now155,105 1400x900). The native window is built at the requested size;WindowStatestill holds the work area for the first frame.Unplaceable outer positions are rejected (#738).
TaoWindow.setOuterPositionrequires a finite position within ±1,000,000 dp and throwsIllegalArgumentExceptionnaming the values. On macOS such a value (a sentinel likeInt.MIN_VALUE) reachedsetFrameTopLeftPoint:, AppKit raised, and withpanic = "abort"the process died with onlypanic in a function that cannot unwind.Drag ghost off every display (#759). The ghost's position (pointer − grab offset) could land past the ±1,000,000 dp guard of #738 when the pointer left every display, and
setOuterPositionthrew on the Tao main thread.DragGhostWindowclamps its pointer-driven position (clampOuterPosition()); app-requested positions keep the strict guard.Wrap-content windows settle even when the scene re-measures (#759, #546). A re-measurement during the resize echo cancelled the effect before
WindowSizePolicy.settled, so the scene kept wrapping (TitleBar 138 px in a 300 px scene) and the initial centring was lost. The wait,settledand the centring now run in a separate effect keyed on the once-recorded resolved size.Headful suite runs to the end on every OS (#758, #759, #760). The #576 zoom present-lag case is skipped on Linux (the GTK host records no presented size); the #569 dialog-appearance and popup-placement cases no longer depend on the sampling clock, the wallpaper or one large display; the suite watchdog goes from 15 to 45 min (macOS never finished) and the job limit to 60 min.
One
TaoGpuRenderContextper surface (#752).rememberTaoGpuRenderContext()promised an identity-stable instance but built one per call site, so filament-compose created one engine per 3D view instead of one per window. The context is memoized per texture host (weak keys and values); a rebuilt GPU context still yields a new instance. In Zayit: 21 → 6 Filament engines, new-tab freeze 210–250 ms → 75–125 ms.XInitThreadsbefore GTK opens its display, Linux (#744). On libX11 < 1.8 (Ubuntu 22.04) Xlib only locks connections opened afterXInitThreads(), and rendering, input and GTK's loop share GDK's connection across threads: random[xcb] Unknown sequence numberaborts. Tao now calls it once beforegtk::init().launcher-linuxnever loses an earlyGMainLoopquit (#744).g_main_loop_run()ignores ag_main_loop_quit()issued before it runs, soregisterQueryHandler()followed byunregister()could hang inpthread_joinforever. The quit is now an idle source on the loop's own context. #744 also makes the pre-merge checks green again since the move toubuntu-22.04(theme e2e probe bounded, D-Bus tests skipped without a responsive bus, GraalVM jobs onsetup-nucleus's Xvfb, one flaky scroll test parked on CMP-10875).Demos
examples/satellite-demoexamples/tabs-demorememberSaveablestate following a tab between windowsexamples/jewel-tabs-demoTabStrip/TabData.Editorchromeexamples/tab-satellites-demoSatelliteWorkspaceper tab window, palettes drawing that window's selected tabexamples/reader-dock-demosideOrderputting the right side outside the bottom one, 1 dp + 5 dp-grip splitters, hover headers, Classic / Islands styles, RTL. Book tree and contents arefloatable = false+reorderable = false+dockSides = setOf(Right)— furniture, and no pane can be dropped in front of them. One dock per tab window hung onTabWindows(windowBodyWrapper), so the strip stays the top of the window and a tab change touches no panel.examples/share-demo/examples/share-web-demoexamples/hot-update-demoscripts/windows-hot-update-e2e.ps1examples/macos-appex-demo.appexembedded and signed throughmacOS { appExtensions { } }scheduler-demoandservice-management-demomoved off AWT (java.desktop/sun.*add-opens gone; SMAppService completion handlers hop to the Tao main thread).Migration
From 2.5 / current
main:nucleus.decorated-window-tao. Dropbackend = NucleusBackend.….NucleusBackendandLocalNucleusBackendare gone.window.unsafe.awtWindow/awtDialogand Compose Desktop'sWindow/Dialog/TraywithnucleusWindow,HostedWindow/HostedDialog, and an AWT-free tray.androidx.compose.ui.window.v2todev.nucleusframework.window.tao.v2. Compose's own types are not accepted.@OptIn(ExperimentalNucleusApi::class)or-opt-in=dev.nucleusframework.window.ExperimentalNucleusApi. The surface may change without a deprecation cycle.TaoWindow.canPlaceOnScreen(orSatelliteScope.isCompositorPlaced), not on the compositor name. UsefloatingCaptionfor the strip the title bar leaves to the compositor's move.-Dnucleus.text.lcd=falseor-Pnucleus.text.lcd.patch=false.nucleusOptimization = trueis opt-in.lastJdkdownloads OpenJDK 27 (Liberica on Intel mac and Windows ARM) the first time a packaging orruntask needs it.minimizable/maximizabledefault totrue. ThemedNucleusWindowHostimplementations must take the new parameters. Dialogs and satellite palettes already pass the right values.exitProcessOnExitdefaults totrue. Passfalseonly if you need to continue in-process after the last window.-Dnucleus.native.cacheDir=orNativeLibraryLoader.cacheDirectorybefore the first native load. Packaged plugin builds skip extraction.PointerEventType.Scrollhandlers on macOS must also handle Pan, or set-Dnucleus.tao.trackpadPanEvents=false.SatelliteDragKind→WorkspaceDragKind,TabDropGhost.title→TabDropGhost.tab.macOS.appStoreandTargetFormat.isStoreFormatno longer compile. UsemacOS { pkg { appStore = … } }(a build script that branched onisStoreFormatreadsappStoreinstead); gate sandbox-sensitive code onExecutableRuntime.isSandboxed(), notisPkg().nativeDistributions { stripJreFonts = false }.onCloseRequest. A handler that never callsexitApplication(or closes its window) now vetoes the quit.PointerEventType.Scale*, no longer as two synthetic touches. Code pinching throughdetectTransformGesturesmoves toModifier.transformableor a Scale listener.setup-nodefrom CI and cache~/.gradle/nucleus/nodejs. Disable withnodejs { autoDownload = false }.NativeLibraryLoader.enableSingleInstanceis off in dev runs. Passtrueto test single-instance behavior fromrun.NucleusApp.appId. An app that calledFileKit.initbeforenucleusApplicationkeeps its own configuration; one that calls it insidecontentreplaces the automatic one. Opt out withinitializeFileKit = false.SEVERE. HookonUnresponsive/onResponsivefor UI, wrap known long synchronous work inexpectUnresponsive { }, or disable with-Dnucleus.tao.watchdog=false.versions\<version>\. Don't build paths from the install root. An app that shows no Nucleus window callsUpdateHandoff.signalReady()once it is up.TaoMouseButton.OTHERis now5(3/4areBACK/FORWARD). Recompile code that reads raw Tao button codes.TaoWindow.setOuterPositionthrows on NaN, infinite or out-of-range positions. Don't pass sentinels such asInt.MIN_VALUE.project.versionset,NucleusApp.versionnow reports it,./gradlew runincluded, so update checks run there instead of returningNotAvailable. Pre-release suffixes are kept at runtime and stripped only where jpackage /CFBundleVersionneed a numeric version.downloadUpdate()throwsParseExceptionfor a manifest artifact name that is not a single path component.Merged PRs
PRs that landed on
nucleus-2.6and are not already onmain:.appex)nucleusOptimizationstartup packdockSides/floatable/reorderable, in-hand tab reorder, one drop previewlastJdkLiberica fallback for Windows ARMexitProcessOnExitonnucleusApplication(#667)minimizableflag to drop the minimize button (#504)jdk.jlinkfromincludeAllModulesruntime images (#673)maximizableflag, off by default for satellite windows25i4DockLandingRectTestwith the #695 split-side previewubuntu-22.04onGloballyPositionedoff the per-placement path (#560)--gc=G1on Windows and macOS from GraalVM 25.4titleBarslot onTabWindowsTabWindows' parts for app-owned tab windows,TabGripCursorXInitThreads, launcher-linux quit race)TaoGpuRenderContextinstance per surface