Merge remote-tracking branch 'origin/main' into fix/appimage-smoke-isolation

docs/evidence/framey-bluetooth-fixture-2026-10-25.md

@@ -1,16 +0,0 @@
-# Bluetooth 3.1.1 compatibility fixture, 25 October 2026
-
-The unmodified official Decky store archive for Bluetooth 3.1.1 (store ID 18,
-SHA-256 `f07f7b74f31da15b5e3a8234a3f00faa01365b56b8f496aca7bb79120be7b8a5`)
-passes Frame Control's archive rules. The fake Frame e2e harness installed it
-through the store API, verified the managed receipt and frontend bytes, then
-removed it. An earlier real Frame check recorded the backend's `Bluetooth
-plugin loaded` line while SteamVR was in standby.
-
-In a local Node host test, its official frontend starts and builds an initial
-panel tree. Framey supplies empty Steam token maps and readable English
-fallbacks for the three Bluetooth labels that lack plugin-owned fallbacks.
-The test leaves React effects and click
-handlers inert and sends no backend calls. It does not inspect paired devices,
-change Bluetooth state, exercise a controller, or prove the panel is visible in
-VR. No worn-headset check has passed for this plugin.

docs/releasing.md

@@ -22,8 +22,10 @@ count. So a build reaches people only when you publish it, after testing it.
    the affected upload; it refuses ambiguous matches.
    The Linux build runs `scripts/check-appimage-launch.py` before upload. It
    starts the built x86_64 AppImage on an isolated Xvfb display, checks that
-   its bundled server answers, and checks that the server stops on exit. This
-   CI test does not test a physical display, FUSE mount or a headset.
+   its bundled server answers, and checks that the server stops on exit. The
+   check disables telemetry and update requests, and keeps extraction in its
+   temporary profile. This CI test does not test a physical display, FUSE mount
+   or a headset.
 
 2. Download the draft's installers and test them. An installed copy of the
    previous version won't offer the draft, so install it directly.

scripts/check-appimage-launch.py

@@ -45,13 +45,17 @@ def check(appimage):
     digest = hashlib.sha256(appimage.read_bytes()).hexdigest()
     with tempfile.TemporaryDirectory(prefix="frame-appimage-smoke-") as directory:
         profile = Path(directory)
+        (profile / "tmp").mkdir()
         env = dict(os.environ)
         env.update(
             APPIMAGE_EXTRACT_AND_RUN="1", ELECTRON_DISABLE_SANDBOX="1",
+            TMPDIR=str(profile / "tmp"),
             XDG_CONFIG_HOME=str(profile / "config"),
             XDG_CACHE_HOME=str(profile / "cache"),
             XDG_DATA_HOME=str(profile / "data"),
             FRAME_ALIAS="frame-control-appimage-smoke-no-headset",
+            FRAME_CONTROL_TELEMETRY="0", FRAME_CONTROL_NO_UPDATE_CHECK="1",
+            DO_NOT_TRACK="1",
         )
         output = profile / "app.log"
         port = None

tests/fixtures/framey-official/README.md

@@ -10,20 +10,15 @@ from a local fixture so CI does not depend on the store being online.
 | `14.zip` | ProtonDB Badges | 1.3.4 | `90a3453ac02709cad64096e7539fd8141fa56f99ae3441fc24a4990dc9684358` |
 | `123.zip` | Steam Status | 1.2.3 | `9053308e04a74f44745b45b9f4f50af3673348d367e7b14bacc5677de707ac4e` |
 | `50.zip` | Storage Cleaner | 1.4.0 | `1afa1a6f129c5d419de0e0bf0f6db8d8e50385a5659179346e996031ea372591` |
-| `18.zip` | Bluetooth | 3.1.1 | `f07f7b74f31da15b5e3a8234a3f00faa01365b56b8f496aca7bb79120be7b8a5` |
 | `26.zip` | HLTB for Deck | 2.0.12 | `bd54a23b0b8ec0798aa590e5be236522a593529d7680e77fb888e2971bf3d558` |
 
 The matching source projects are
 [ProtonDB Badges](https://github.com/bschelst/protondb-decky),
-[Steam Status](https://github.com/bschelst/steamstatus-decky),
-[Storage Cleaner](https://github.com/mcarlucci/decky-storage-cleaner),
-[Bluetooth](https://github.com/Outpox/Bluetooth), and
+[Steam Status](https://github.com/bschelst/steamstatus-decky), and
+[Storage Cleaner](https://github.com/mcarlucci/decky-storage-cleaner), and
 [HLTB for Deck](https://github.com/morwy/hltb-for-deck).
 The test verifies the ZIP digest, archive policy, API v1/v2 manifest, installed
-frontend bytes, managed store receipt, and removal. Separate local host tests
-start Bluetooth's frontend and its initial panel without running effects or
-actions, and start HLTB's frontend and shallow settings view with a stub Steam
-module lookup. They do **not** run plugin Python backends, Bluetooth actions,
-HLTB searches, or prove JavaScript panels render in the VR shell. The
-Bluetooth result and limits are in
-[the fixture evidence](../../../docs/evidence/framey-bluetooth-fixture-2026-10-25.md).
+frontend bytes, managed store receipt, and removal. A separate local host
+test starts HLTB's bundled frontend and builds its settings view with a stub
+Steam module lookup. It does **not** run plugin Python backends, HLTB searches,
+or prove JavaScript panels render in the VR shell.

tests/framey_official.py

@@ -10,8 +10,6 @@ PLUGINS = (
      'folder': 'steamstatus-decky', 'sha256': '9053308e04a74f44745b45b9f4f50af3673348d367e7b14bacc5677de707ac4e'},
     {'id': 50, 'name': 'Storage Cleaner', 'version': '1.4.0', 'api_version': 1,
      'folder': 'decky-storage-cleaner', 'sha256': '1afa1a6f129c5d419de0e0bf0f6db8d8e50385a5659179346e996031ea372591'},
-    {'id': 18, 'name': 'Bluetooth', 'version': '3.1.1', 'api_version': 1,
-     'folder': 'Bluetooth', 'sha256': 'f07f7b74f31da15b5e3a8234a3f00faa01365b56b8f496aca7bb79120be7b8a5'},
     {'id': 26, 'name': 'HLTB for Deck', 'version': '2.0.12', 'api_version': 1,
      'folder': 'hltb-for-deck', 'sha256': 'bd54a23b0b8ec0798aa590e5be236522a593529d7680e77fb888e2971bf3d558'},
 )

tests/page/framey_bluetooth.mjs

@@ -1,43 +0,0 @@
-// Start the unmodified official Bluetooth frontend and build its initial UI.
-// Effects and click handlers are inert: no Bluetooth/backend operation runs.
-import assert from 'node:assert/strict';
-import {readFileSync} from 'node:fs';
-import vm from 'node:vm';
-
-const bundle=readFileSync(process.argv[2],'utf8');
-const official=bundle.replace(/export \{ index as default \};\s*\/\/# sourceMappingURL=index.js.map\s*$/,
-  'window.__official = index;');
-assert.notEqual(official,bundle);
-const source=readFileSync(new URL('../../ui/framey-host.js',import.meta.url),'utf8');
-const host=source.replace(/\n  start\(\);\n\}\)\(\);\s*$/, '\n})();');
-assert.notEqual(host,source);
-const react=new Proxy({Fragment:'fragment',Component:class {},
-  createElement:(type,props,...children)=>({type,props,children}),
-  createContext:value=>({Provider:()=>{},Consumer:()=>{},_currentValue:value}),
-  useState:value=>[value,()=>{}],useReducer:(_,value)=>[value,()=>{}],
-  useEffect(){},useRef:value=>({current:value}),useMemo:fn=>fn(),
-  useCallback:fn=>fn,forwardRef:fn=>fn,memo:fn=>fn},
-  {get:(target,key)=>target[key]??(()=>{})});
-const window={React:react,ReactDOM:{createRoot:()=>({render(){}})},location:{hash:''}};
-const elements=new Map();
-const messages=[];
-const context=vm.createContext({window,navigator:{language:'en'},parent:{postMessage:message=>messages.push(message)},
-  document:{getElementById:id=>{if(!elements.has(id))elements.set(id,{});return elements.get(id);}},
-  addEventListener(){},setTimeout:()=>1,clearTimeout(){},console,URL,Blob});
-vm.runInContext(host,context);
-context.DFL=window.DFL;
-context.SP_REACT=window.SP_REACT;
-context.SP_JSX=window.SP_JSX;
-context.LocalizationManager=window.LocalizationManager;
-assert.equal(window.LocalizationManager.m_mapTokens.size,0);
-assert.equal(window.LocalizationManager.m_mapFallbackTokens.get('Settings_Bluetooth_Devices'),'Devices');
-vm.runInContext(official,context,{timeout:2000});
-const plugin=window.__official();
-assert.equal(plugin.content?.type?.name,'Content');
-const panel=plugin.content.type();
-assert.equal(panel.type,'div');
-const text=JSON.stringify(panel);
-assert.match(text,/Bluetooth/);
-assert.match(text,/Devices/); // Readable fallback when Steam tokens are absent.
-assert.doesNotMatch(text,/Settings_Bluetooth_Devices/);
-assert.equal(messages.filter(message=>message.type==='framey:call').length,0);

tests/test_framey_official.py

@@ -21,17 +21,6 @@ from framey_official import PLUGINS, archive
 
 
 class OfficialBundles(unittest.TestCase):
-    @unittest.skipUnless(shutil.which('node'), 'Node is needed for the official frontend check')
-    def test_bluetooth_initial_panel_uses_safe_token_fallback(self):
-        with zipfile.ZipFile(io.BytesIO(archive(next(p for p in PLUGINS if p['id'] == 18)))) as bundle:
-            with tempfile.TemporaryDirectory() as folder:
-                frontend = Path(folder) / 'index.js'
-                frontend.write_bytes(bundle.read('Bluetooth/dist/index.js'))
-                script = Path(__file__).parent / 'page/framey_bluetooth.mjs'
-                result = subprocess.run(['node', str(script), str(frontend)],
-                                        capture_output=True, text=True, timeout=10)
-        self.assertEqual(result.returncode, 0, result.stderr)
-
     @unittest.skipUnless(shutil.which('node'), 'Node is needed for the official frontend check')
     def test_hltb_frontend_starts_with_framey_module_stub(self):
         script = Path(__file__).parent / 'page/framey_hltb.mjs'

ui/framey-host.js

@@ -11,14 +11,7 @@
       : R.createElement(type, elementProps);
   };
   window.SP_JSX = {jsx, jsxs:jsx, Fragment:R.Fragment};
-  // Steam normally fills these token maps. Official plugins can safely use
-  // their own fallback strings when the isolated panel has no Steam tokens.
-  window.LocalizationManager = {m_rgLocalesToUse:[navigator.language || 'en'],
-    m_mapTokens:new Map(), m_mapFallbackTokens:new Map([
-      ['Settings_Bluetooth_Connected','Connected'],
-      ['Settings_Bluetooth_NotConnected','Not connected'],
-      ['Settings_Bluetooth_Devices','Devices'],
-    ])};
+  window.LocalizationManager = {m_rgLocalesToUse:[navigator.language || 'en']};
   const root = document.getElementById('framey-root');
   const error = document.getElementById('framey-error');
   const toastRoot = document.getElementById('framey-toasts');