feat(desktop): broaden Linux system-proxy to a layered stack

Linux has no single proxy store, so apply/clear now runs every applicable layer
instead of just the first match:
- gsettings org.gnome.system.proxy, guarded by schema presence (covers
  GNOME/MATE/Cinnamon/Budgie + GLib/Chromium apps on most desktops);
- KDE kioslaverc, now followed by a reparseSlaveConfiguration D-Bus signal so
  KIO apps actually reload (previously they kept the old proxy until restart);
- environment variables — ~/.config/environment.d for persistence plus a live
  systemctl --user / dbus-update-activation-environment push. This is the only
  layer reaching CLI tools and non-GLib apps, and the only mechanism for
  XFCE/LXQt/LXDE (no native proxy store). Env vars can't carry a PAC, so they're
  cleared in pac mode and set only in system mode.

All layers are unprivileged, user-scoped. clear runs all three (idempotent).

Author: loss-and-quick

src-tauri/src/desktop/sysproxy.rs

@@ -1,12 +1,24 @@
 //! OS system-proxy integration for the `system` and `pac` proxy modes: point the OS
 //! proxy (or PAC auto-config URL) at the core's local inbound and clear it again.
-//! Linux drives gsettings (GNOME-family) or kwriteconfig (KDE) by desktop; Windows
-//! the WinINET registry keys plus an `InternetSetOption` refresh so the change takes
-//! effect without a sign-out. macOS has no port yet (no-op).
 //!
-//! These modes never elevate, so the process runs as the logged-in user and the
-//! gsettings/registry writes land in that user's session — exactly where the OS
-//! reads its proxy from.
+//! Linux has no single system-proxy store, so the apply/clear pipeline is *layered*
+//! and the layers are NOT mutually exclusive — each reaches a disjoint set of apps:
+//!   1. **gsettings `org.gnome.system.proxy`** (guarded by schema presence) — covers
+//!      GNOME, MATE, Cinnamon, Budgie, and every GLib/GIO + Chromium-family app on
+//!      any desktop where the schema is installed (most XFCE/LXQt/LXDE too).
+//!   2. **kwriteconfig `kioslaverc`** on KDE/Plasma, followed by a
+//!      `reparseSlaveConfiguration` D-Bus signal so KIO apps reload.
+//!   3. **environment variables** (`~/.config/environment.d` for persistence + a live
+//!      `systemctl --user`/`dbus-update-activation-environment` push) — the only layer
+//!      that reaches CLI tools and non-GLib apps, and the only programmatic mechanism
+//!      for XFCE/LXQt/LXDE. Env vars can't express a PAC URL, so they apply in `system`
+//!      mode only.
+//!
+//! Windows uses the WinINET registry keys plus an `InternetSetOption` refresh so the
+//! change takes effect without a sign-out. macOS has no port yet (no-op).
+//!
+//! These modes never elevate, so the process runs as the logged-in user and every
+//! write lands in that user's session — exactly where the OS reads its proxy from.
 
 #[cfg(target_os = "linux")]
 pub use linux::{clear_system_proxy, set_pac, set_system_proxy};
@@ -18,91 +30,154 @@ pub use other::{clear_system_proxy, set_pac, set_system_proxy};
 
 #[cfg(target_os = "linux")]
 mod linux {
-    use crate::desktop::silent;
+    use std::path::PathBuf;
+
+    use crate::desktop::{run_out, silent};
 
     const HOST: &str = "127.0.0.1";
     const IGNORE_GNOME: &str = "['localhost', '127.0.0.0/8', '::1']";
     const IGNORE_KDE: &str = "localhost,127.0.0.1,::1";
+    const NO_PROXY: &str = "localhost,127.0.0.1,::1";
 
-    /// True on a KDE/Plasma session (uses kwriteconfig); everything else takes the
-    /// gsettings path, which the GNOME/XFCE/Cinnamon/MATE/Budgie proxy schema covers.
-    fn is_kde() -> bool {
-        std::env::var("XDG_CURRENT_DESKTOP")
-            .unwrap_or_default()
-            .to_ascii_lowercase()
-            .contains("kde")
+    /// Proxy env vars, lower- and upper-case (programs disagree on which they read).
+    const ENV_KEYS: &[&str] = &[
+        "http_proxy",
+        "https_proxy",
+        "all_proxy",
+        "no_proxy",
+        "HTTP_PROXY",
+        "HTTPS_PROXY",
+        "ALL_PROXY",
+        "NO_PROXY",
+    ];
+    /// Persistent per-user env file (systemd user generator reads `environment.d`).
+    const ENV_FILE_REL: &str = ".config/environment.d/50-kasumi-proxy.conf";
+
+    // ── apply / clear: run EVERY applicable layer, not just the first match ──
+
+    /// Point the OS at the local socks/http inbound. `http_port` carries http + https,
+    /// `socks_port` the socks proxy (a sing-box mixed inbound passes the same for both).
+    pub async fn set_system_proxy(socks_port: u16, http_port: u16) {
+        gsettings_manual(socks_port, http_port).await;
+        kde_manual(socks_port, http_port).await;
+        env_apply(socks_port, http_port).await;
     }
 
-    /// The KDE config writer present on this host (Plasma 6 ships `kwriteconfig6`,
-    /// Plasma 5 `kwriteconfig5`).
-    fn kde_writer() -> Option<&'static str> {
-        ["kwriteconfig6", "kwriteconfig5"]
-            .into_iter()
-            .find(|bin| which(bin))
+    /// Point the OS at a PAC auto-config URL (`pac` mode). Env vars can't express a PAC,
+    /// so the env layer is cleared rather than set.
+    pub async fn set_pac(pac_url: &str) {
+        gsettings_auto(pac_url).await;
+        kde_pac(pac_url).await;
+        env_clear().await;
     }
 
-    fn which(bin: &str) -> bool {
-        std::env::var("PATH")
-            .unwrap_or_default()
-            .split(':')
-            .any(|dir| std::path::Path::new(dir).join(bin).exists())
+    /// Disable every layer. Idempotent — safe whatever was (or wasn't) set.
+    pub async fn clear_system_proxy() {
+        gsettings_none().await;
+        kde_none().await;
+        env_clear().await;
     }
 
-    /// Point the OS proxy at the local socks/http inbound. `http_port` carries http +
-    /// https; `socks_port` the socks proxy (for a sing-box mixed inbound the caller
-    /// passes the same port for both).
-    pub async fn set_system_proxy(socks_port: u16, http_port: u16) {
-        let http = http_port.to_string();
-        let socks = socks_port.to_string();
-        if is_kde() {
-            let Some(w) = kde_writer() else { return };
-            kde(w, "ProxyType", "1").await;
-            kde(w, "httpProxy", &format!("http://{HOST} {http}")).await;
-            kde(w, "httpsProxy", &format!("http://{HOST} {http}")).await;
-            kde(w, "socksProxy", &format!("socks://{HOST} {socks}")).await;
-            kde(w, "NoProxyFor", IGNORE_KDE).await;
+    // ── layer 1: gsettings (GNOME schema), guarded by schema presence ──
+
+    /// Only call gsettings when the proxy schema is installed, so minimal systems
+    /// (no `gsettings-desktop-schemas`) don't spew errors.
+    async fn gnome_schema_present() -> bool {
+        let (code, out) = run_out(&["gsettings", "list-schemas"]).await;
+        code == 0 && out.lines().any(|l| l.trim() == "org.gnome.system.proxy")
+    }
+
+    async fn gsettings(args: &[&str]) {
+        let mut argv = vec!["gsettings", "set"];
+        argv.extend_from_slice(args);
+        silent(&argv).await;
+    }
+
+    async fn gsettings_manual(socks_port: u16, http_port: u16) {
+        if !gnome_schema_present().await {
             return;
         }
+        let http = http_port.to_string();
+        let socks = socks_port.to_string();
         gsettings(&["org.gnome.system.proxy", "mode", "manual"]).await;
-        for (schema, port) in [
-            ("org.gnome.system.proxy.http", &http),
-            ("org.gnome.system.proxy.https", &http),
+        for schema in [
+            "org.gnome.system.proxy.http",
+            "org.gnome.system.proxy.https",
         ] {
             gsettings(&[schema, "host", HOST]).await;
-            gsettings(&[schema, "port", port]).await;
+            gsettings(&[schema, "port", &http]).await;
         }
         gsettings(&["org.gnome.system.proxy.socks", "host", HOST]).await;
         gsettings(&["org.gnome.system.proxy.socks", "port", &socks]).await;
         gsettings(&["org.gnome.system.proxy", "ignore-hosts", IGNORE_GNOME]).await;
     }
 
-    /// Point the OS at a PAC auto-config URL (the `pac` mode).
-    pub async fn set_pac(pac_url: &str) {
-        if is_kde() {
-            let Some(w) = kde_writer() else { return };
-            kde(w, "ProxyType", "2").await;
-            kde(w, "Proxy Config Script", pac_url).await;
+    async fn gsettings_auto(pac_url: &str) {
+        if !gnome_schema_present().await {
             return;
         }
         gsettings(&["org.gnome.system.proxy", "mode", "auto"]).await;
         gsettings(&["org.gnome.system.proxy", "autoconfig-url", pac_url]).await;
     }
 
-    /// Disable the OS proxy. Idempotent — safe to call when nothing was set.
-    pub async fn clear_system_proxy() {
-        if is_kde() {
-            if let Some(w) = kde_writer() {
-                kde(w, "ProxyType", "0").await;
-            }
+    async fn gsettings_none() {
+        if !gnome_schema_present().await {
             return;
         }
         gsettings(&["org.gnome.system.proxy", "mode", "none"]).await;
     }
 
-    async fn gsettings(args: &[&str]) {
-        let mut argv = vec!["gsettings", "set"];
-        argv.extend_from_slice(args);
-        silent(&argv).await;
+    // ── layer 2: KDE kioslaverc (+ reparse so KIO apps reload) ──
+
+    /// True on a KDE/Plasma session.
+    fn is_kde() -> bool {
+        std::env::var("XDG_CURRENT_DESKTOP")
+            .unwrap_or_default()
+            .to_ascii_lowercase()
+            .contains("kde")
+    }
+
+    /// The KDE config writer present on this host (Plasma 6 → `kwriteconfig6`, 5 → 5).
+    fn kde_writer() -> Option<&'static str> {
+        ["kwriteconfig6", "kwriteconfig5"]
+            .into_iter()
+            .find(|bin| which(bin))
+    }
+
+    fn which(bin: &str) -> bool {
+        std::env::var("PATH")
+            .unwrap_or_default()
+            .split(':')
+            .any(|dir| std::path::Path::new(dir).join(bin).exists())
+    }
+
+    async fn kde_manual(socks_port: u16, http_port: u16) {
+        let Some(w) = (is_kde().then(kde_writer)).flatten() else {
+            return;
+        };
+        kde(w, "ProxyType", "1").await;
+        kde(w, "httpProxy", &format!("http://{HOST} {http_port}")).await;
+        kde(w, "httpsProxy", &format!("http://{HOST} {http_port}")).await;
+        kde(w, "socksProxy", &format!("socks://{HOST} {socks_port}")).await;
+        kde(w, "NoProxyFor", IGNORE_KDE).await;
+        kde_reparse().await;
+    }
+
+    async fn kde_pac(pac_url: &str) {
+        let Some(w) = (is_kde().then(kde_writer)).flatten() else {
+            return;
+        };
+        kde(w, "ProxyType", "2").await;
+        kde(w, "Proxy Config Script", pac_url).await;
+        kde_reparse().await;
+    }
+
+    async fn kde_none() {
+        let Some(w) = (is_kde().then(kde_writer)).flatten() else {
+            return;
+        };
+        kde(w, "ProxyType", "0").await;
+        kde_reparse().await;
     }
 
     async fn kde(writer: &str, key: &str, value: &str) {
@@ -118,6 +193,71 @@ mod linux {
         ])
         .await;
     }
+
+    /// Without this signal KIO apps keep the old proxy until restart.
+    async fn kde_reparse() {
+        silent(&[
+            "dbus-send",
+            "--type=signal",
+            "/KIO/Scheduler",
+            "org.kde.KIO.Scheduler.reparseSlaveConfiguration",
+            "string:",
+        ])
+        .await;
+    }
+
+    // ── layer 3: environment variables (CLI + non-GLib apps; the only XFCE/LXQt path) ──
+
+    fn env_file() -> Option<PathBuf> {
+        std::env::var_os("HOME").map(|h| PathBuf::from(h).join(ENV_FILE_REL))
+    }
+
+    /// Persist the proxy env vars (`environment.d`, survives re-login) and push them
+    /// live into the running session (systemd user manager + D-Bus activation env).
+    async fn env_apply(socks_port: u16, http_port: u16) {
+        let http_url = format!("http://{HOST}:{http_port}");
+        let socks_url = format!("socks5://{HOST}:{socks_port}");
+        let assigns = [
+            format!("http_proxy={http_url}"),
+            format!("https_proxy={http_url}"),
+            format!("all_proxy={socks_url}"),
+            format!("no_proxy={NO_PROXY}"),
+            format!("HTTP_PROXY={http_url}"),
+            format!("HTTPS_PROXY={http_url}"),
+            format!("ALL_PROXY={socks_url}"),
+            format!("NO_PROXY={NO_PROXY}"),
+        ];
+
+        if let Some(path) = env_file() {
+            if let Some(dir) = path.parent() {
+                let _ = std::fs::create_dir_all(dir);
+            }
+            let _ = std::fs::write(&path, format!("{}\n", assigns.join("\n")));
+        }
+
+        let refs: Vec<&str> = assigns.iter().map(String::as_str).collect();
+        run_with(&["systemctl", "--user", "set-environment"], &refs).await;
+        run_with(&["dbus-update-activation-environment", "--systemd"], &refs).await;
+    }
+
+    /// Remove the persistent file and unset the vars in the live session. D-Bus can't
+    /// truly unset, so it gets the vars emptied; systemd does the real unset.
+    async fn env_clear() {
+        if let Some(path) = env_file() {
+            let _ = std::fs::remove_file(path);
+        }
+        run_with(&["systemctl", "--user", "unset-environment"], ENV_KEYS).await;
+        let empties: Vec<String> = ENV_KEYS.iter().map(|k| format!("{k}=")).collect();
+        let refs: Vec<&str> = empties.iter().map(String::as_str).collect();
+        run_with(&["dbus-update-activation-environment", "--systemd"], &refs).await;
+    }
+
+    /// Run `base` with `extra` args appended (one process, args owned by the caller).
+    async fn run_with(base: &[&str], extra: &[&str]) {
+        let mut argv = base.to_vec();
+        argv.extend_from_slice(extra);
+        silent(&argv).await;
+    }
 }
 
 #[cfg(target_os = "windows")]