869d03d fix: hide text keys in secret mode, wipe key residue, skip identical masks, wrap errors · neferclient

M handler.go +4 -1


@@ -59,7 +59,10 @@ type Handler interface {
59	59		// keyboard focus. Text is the text the key produced (nil for releases and
60	60		// keys without text) and is valid only during the call. While a
61	61		// [SecretBuffer] is installed with [Seat.SetSecret], Text is always nil
62		-	// and the text goes into the buffer; see [Handler.SecretChanged]. ev is
	62	+	// and the text goes into the buffer; see [Handler.SecretChanged]. For
	63	+	// those keys (press, repeat and release) ev.Secret is set and Keycode and
	64	+	// Keysym are 0, so the event does not reveal the typed character; Enter,
	65	+	// Escape, BackSpace and Control combinations keep their keysym. ev is
63	66		// valid only during the call.
64	67		Key(ev *KeyEvent)
65	68		// KeyboardFocus reports that a surface gained or lost keyboard focus.

 	// keyboard focus. Text is the text the key produced (nil for releases and
 	// keys without text) and is valid only during the call. While a
 	// [SecretBuffer] is installed with [Seat.SetSecret], Text is always nil
-	// and the text goes into the buffer; see [Handler.SecretChanged]. ev is
+	// and the text goes into the buffer; see [Handler.SecretChanged]. For
+	// those keys (press, repeat and release) ev.Secret is set and Keycode and
+	// Keysym are 0, so the event does not reveal the typed character; Enter,
+	// Escape, BackSpace and Control combinations keep their keysym. ev is
 	// valid only during the call.
 	Key(ev *KeyEvent)
 	// KeyboardFocus reports that a surface gained or lost keyboard focus.

M keyboard.go +106 -40


@@ -2,6 +2,7 @@ package neferclient
2	2
3	3		import (
4	4		"errors"
	5	+	"fmt"
5	6		"io"
6	7		"os"
7	8		"time"

@@ -34,16 +35,33 @@ const (
34	35		keymapMax = 16 << 20
35	36		)
36	37
37		-	type heldKey struct{ evdev, sym uint32 }
	38	+	// heldKey is a pressed key. A key that went into the SecretBuffer keeps no
	39	+	// keysym and is flagged hidden, so its release is reported without either.
	40	+	type heldKey struct {
	41	+	evdev, sym uint32
	42	+	hidden bool
	43	+	}
38	44
39	45		type textKind uint8
40	46
41	47		const (
42		-	kindNone textKind = iota
43		-	kindText
	48	+	kindNone textKind = iota
	49	+	kindText // printable text went into the SecretBuffer
	50	+	kindPending // a dead or compose key: part of a text sequence, no text yet
44	51		kindBackspace
45	52		)
46	53
	54	+	// secretWork is the argument and result area of doSecret, which secret.Do runs
	55	+	// without arguments. translate clears it after every use.
	56	+	type secretWork struct {
	57	+	evdev, sym uint32
	58	+	mods Modifiers
	59	+	repeat bool
	60	+	kind textKind
	61	+	changed bool
	62	+	err error
	63	+	}
	64	+
47	65		// keyboard interprets wl_keyboard events with xkbcommon. It runs only on the
48	66		// owner goroutine. It never builds a string from key text: translations go
49	67		// through the fixed scratch array, which is wiped after every use.

@@ -65,6 +83,7 @@ type keyboard struct {
65	83		delay int32 // milliseconds before the first repeat
66	84		repeating uint32
67	85		composePending bool
	86	+	composeUsed bool // the last text() call consumed the key into a compose sequence
68	87
69	88		tfd int // repeat timerfd
70	89		tbuf [8]byte

@@ -72,23 +91,16 @@ type keyboard struct {
72	91		secret *SecretBuffer
73	92		scratch [scratchSize]byte
74	93
75		-	// Work area of doSecret, which secret.Do runs without arguments.
76	94		secretFn func()
77		-	w struct {
78		-	evdev, sym uint32
79		-	mods Modifiers
80		-	repeat bool
81		-	kind textKind
82		-	changed bool
83		-	err error
84		-	}
85		-	changed bool // the last translation edited the SecretBuffer
	95	+	w secretWork
	96	+	changed bool // the last translation edited the SecretBuffer
	97	+	timerErr error // first repeat timer failure, reported by the seat
86	98		}
87	99
88	100		func newKeyboard(locale string) (*keyboard, error) {
89	101		c, err := xkb.NewContext()
90	102		if err != nil {
91		-	return nil, err
	103	+	return nil, fmt.Errorf("xkb context: %w", err)
92	104		}
93	105		k := &keyboard{ctx: c, held: make([]heldKey, 0, maxHeldKeys), tfd: -1}
94	106		k.secretFn = k.doSecret

@@ -98,7 +110,7 @@ func newKeyboard(locale string) (*keyboard, error) {
98	110		}
99	111		if k.tfd, err = unix.TimerfdCreate(unix.CLOCK_MONOTONIC, unix.TFD_NONBLOCK\|unix.TFD_CLOEXEC); err != nil {
100	112		_ = c.Close()
101		-	return nil, err
	113	+	return nil, fmt.Errorf("repeat timer: %w", err)
102	114		}
103	115		return k, nil
104	116		}

@@ -147,7 +159,7 @@ func (k *keyboard) replaceFD(fd, size int) error {
147	159		defer f.Close()
148	160		km, err := k.ctx.NewKeymapFD(fd, size)
149	161		if err != nil {
150		-	return err
	162	+	return fmt.Errorf("neferclient: compile keymap: %w", err)
151	163		}
152	164		return k.replace(km)
153	165		}

@@ -156,7 +168,7 @@ func (k keyboard) replace(km xkb.Keymap) error {
156	168		s, err := km.NewState()
157	169		if err != nil {
158	170		_ = km.Close()
159		-	return err
	171	+	return fmt.Errorf("neferclient: xkb state: %w", err)
160	172		}
161	173		k.reset()
162	174		if k.state != nil {

@@ -180,26 +192,36 @@ func (k keyboard) replace(km xkb.Keymap) error {
180	192		}
181	193
182	194		func (k *keyboard) setMask(depressed, latched, locked, group uint32) error {
183		-	k.lastMask = [6]uint32{depressed, latched, locked, 0, 0, group}
	195	+	mask := [6]uint32{depressed, latched, locked, 0, 0, group}
	196	+	if k.haveMask && mask == k.lastMask {
	197	+	return nil // compositors repeat identical masks; the state is current
	198	+	}
	199	+	k.lastMask = mask
184	200		k.haveMask = true
185	201		if k.state == nil {
186	202		return nil
187	203		}
188		-	_, err := k.state.UpdateMask(depressed, latched, locked, 0, 0, group)
189		-	k.refresh()
190		-	return err
	204	+	changed, err := k.state.UpdateMask(depressed, latched, locked, 0, 0, group)
	205	+	if err != nil {
	206	+	return fmt.Errorf("neferclient: update xkb mask: %w", err)
	207	+	}
	208	+	if changed != 0 {
	209	+	k.refresh()
	210	+	}
	211	+	return nil
191	212		}
192	213
193	214		// refresh recomputes the cached modifiers and layout from the xkb state. Both
194	215		// only change when the mask does, so keys do not query them.
195	216		func (k *keyboard) refresh() {
196		-	k.mods, k.group = k.queryModifiers(), 0
	217	+	k.mods = k.queryModifiers()
197	218		k.group, _ = k.state.Layout()
198	219		}
199	220
200	221		// reset drops held keys, repeat and compose state. It keeps the keymap, the
201	222		// modifier mask and the focus flag.
202	223		func (k *keyboard) reset() {
	224	+	clear(k.held[:cap(k.held)]) // no hidden-key record outlives the reset
203	225		k.held = k.held[:0]
204	226		k.repeating = 0
205	227		k.disarm()

@@ -233,16 +255,29 @@ func (k *keyboard) arm() {
233	255		Interval: unix.NsecToTimespec(int64(time.Second) / int64(k.rate)),
234	256		Value: unix.NsecToTimespec(max(int64(k.delay)*int64(time.Millisecond), 1)), // zero would disarm
235	257		}
236		-	_ = unix.TimerfdSettime(k.tfd, 0, &spec, nil)
	258	+	k.setTimer(&spec)
237	259		}
238	260
239	261		func (k *keyboard) disarm() {
240	262		if k.tfd >= 0 {
241	263		var spec unix.ItimerSpec
242		-	_ = unix.TimerfdSettime(k.tfd, 0, &spec, nil)
	264	+	k.setTimer(&spec)
	265	+	}
	266	+	}
	267	+
	268	+	func (k keyboard) setTimer(spec unix.ItimerSpec) {
	269	+	if err := unix.TimerfdSettime(k.tfd, 0, spec, nil); err != nil && k.timerErr == nil {
	270	+	k.timerErr = fmt.Errorf("neferclient: repeat timer: %w", err)
243	271		}
244	272		}
245	273
	274	+	// takeTimerErr returns and clears the first timer failure.
	275	+	func (k *keyboard) takeTimerErr() error {
	276	+	err := k.timerErr
	277	+	k.timerErr = nil
	278	+	return err
	279	+	}
	280	+
246	281		// expired consumes a timer expiration. Missed ticks are not accumulated: one
247	282		// call yields at most one repeat.
248	283		func (k *keyboard) expired() bool {

@@ -273,7 +308,12 @@ func (k *keyboard) find(evdev uint32) int {
273	308		return -1
274	309		}
275	310
276		-	func (k *keyboard) drop(i int) { k.held = append(k.held[:i], k.held[i+1:]...) }
	311	+	func (k *keyboard) drop(i int) {
	312	+	last := len(k.held) - 1
	313	+	copy(k.held[i:], k.held[i+1:])
	314	+	k.held[last] = heldKey{} // clear the vacated slot
	315	+	k.held = k.held[:last]
	316	+	}
277	317
278	318		// press translates a key press into ev. It reports false when the press must
279	319		// not be delivered (no focus or keymap).

@@ -289,13 +329,17 @@ func (k keyboard) press(evdev uint32, ev KeyEvent) (bool, error) {
289	329		}
290	330		sym, err := k.state.KeySym(xkb.WaylandKeycode(evdev))
291	331		if err != nil {
292		-	return false, err
	332	+	return false, fmt.Errorf("neferclient: key symbol: %w", err)
293	333		}
294	334		kind, err := k.translate(evdev, sym, false, ev)
295	335		if err != nil {
296		-	return false, err
	336	+	return false, fmt.Errorf("neferclient: key text: %w", err)
	337	+	}
	338	+	if ev.Secret {
	339	+	k.held = append(k.held, heldKey{evdev: evdev, hidden: true})
	340	+	} else {
	341	+	k.held = append(k.held, heldKey{evdev: evdev, sym: sym})
297	342		}
298		-	k.held = append(k.held, heldKey{evdev, sym})
299	343		if k.secret == nil && repeatable(sym) \|\| k.secret != nil && (kind == kindBackspace \|\| kind == kindText && repeatable(sym)) {
300	344		if k.rate > 0 {
301	345		k.repeating = evdev

@@ -322,7 +366,10 @@ func (k keyboard) release(evdev uint32, ev KeyEvent) bool {
322	366		k.repeating = 0
323	367		k.disarm()
324	368		}
325		-	ev.Keycode, ev.Keysym, ev.Pressed = evdev, h.sym, false
	369	+	ev.Pressed, ev.Secret = false, h.hidden
	370	+	if !h.hidden {
	371	+	ev.Keycode, ev.Keysym = evdev, h.sym
	372	+	}
326	373		k.changed = false
327	374		ev.Modifiers, ev.Group = k.mods, k.group
328	375		return true

@@ -342,7 +389,7 @@ func (k keyboard) repeat(ev KeyEvent) (bool, error) {
342	389		sym, err := k.state.KeySym(xkb.WaylandKeycode(evdev))
343	390		if err != nil {
344	391		_, _ = stop()
345		-	return false, err
	392	+	return false, fmt.Errorf("neferclient: key symbol: %w", err)
346	393		}
347	394		if k.secret == nil && !repeatable(sym) {
348	395		return stop()

@@ -350,7 +397,7 @@ func (k keyboard) repeat(ev KeyEvent) (bool, error) {
350	397		kind, err := k.translate(evdev, sym, true, ev)
351	398		if err != nil {
352	399		_, _ = stop()
353		-	return false, err
	400	+	return false, fmt.Errorf("neferclient: key text: %w", err)
354	401		}
355	402		if k.secret != nil && kind != kindBackspace && !(kind == kindText && repeatable(sym)) {
356	403		return stop()

@@ -365,11 +412,17 @@ func (k keyboard) translate(evdev, sym uint32, repeat bool, ev KeyEvent) (text
365	412		ev.Modifiers, ev.Group = k.mods, k.group
366	413		k.changed = false
367	414		if k.secret != nil {
368		-	w := &k.w
369		-	w.evdev, w.sym, w.mods, w.repeat = evdev, sym, ev.Modifiers, repeat
	415	+	k.w = secretWork{evdev: evdev, sym: sym, mods: ev.Modifiers, repeat: repeat}
370	416		secret.Do(k.secretFn)
371		-	k.changed = w.changed
372		-	return w.kind, w.err
	417	+	kind, changed, err := k.w.kind, k.w.changed, k.w.err
	418	+	k.w = secretWork{} // the key identity must not stay in the work area
	419	+	k.changed = changed
	420	+	if kind == kindText \|\| kind == kindPending {
	421	+	// Text keys are not identified: the keycode and keysym would
	422	+	// reveal the secret character.
	423	+	ev.Keycode, ev.Keysym, ev.Secret = 0, 0, true
	424	+	}
	425	+	return kind, err
373	426		}
374	427		n, err := k.text(evdev, sym, repeat)
375	428		if err != nil {

@@ -385,7 +438,6 @@ func (k keyboard) translate(evdev, sym uint32, repeat bool, ev KeyEvent) (text
385	438		// handles secret text, so it runs under runtime/secret when available.
386	439		func (k *keyboard) doSecret() {
387	440		w := &k.w
388		-	w.kind, w.changed, w.err = kindNone, false, nil
389	441		defer clear(k.scratch[:])
390	442		switch {
391	443		case w.sym == raw.XKB_KEY_BackSpace:

@@ -402,9 +454,12 @@ func (k *keyboard) doSecret() {
402	454		w.err = err
403	455		return
404	456		}
405		-	if classifySecretText(k.scratch[:n]) {
	457	+	switch {
	458	+	case classifySecretText(k.scratch[:n]):
406	459		w.kind = kindText
407	460		w.changed = k.secret.appendText(k.scratch[:n])
	461	+	case k.composeUsed \|\| k.composePending \|\| isDeadKey(w.sym):
	462	+	w.kind = kindPending // dead and compose keys name an accent, so hide them too
408	463		}
409	464		}
410	465		}

@@ -420,6 +475,7 @@ func (k *keyboard) resetCompose() {
420	475		// is fed only by physical presses: a repeat neither advances a sequence nor
421	476		// replays composed text.
422	477		func (k *keyboard) text(evdev, sym uint32, repeat bool) (int, error) {
	478	+	k.composeUsed = false
423	479		if k.compose != nil && !repeat {
424	480		if _, err := k.compose.Feed(sym); err != nil {
425	481		return 0, err

@@ -428,6 +484,7 @@ func (k *keyboard) text(evdev, sym uint32, repeat bool) (int, error) {
428	484		if err != nil {
429	485		return 0, err
430	486		}
	487	+	k.composeUsed = status == raw.XKB_COMPOSE_COMPOSING \|\| status == raw.XKB_COMPOSE_CANCELLED \|\| status == raw.XKB_COMPOSE_COMPOSED
431	488		switch status {
432	489		case raw.XKB_COMPOSE_COMPOSING:
433	490		k.composePending = true

@@ -461,11 +518,20 @@ func shortAsEmpty(n int, err error) (int, error) {
461	518		// Modifier, dead and compose keys never repeat. The compositor provides rate
462	519		// and delay; its keymap is authoritative for text and layout.
463	520		func repeatable(sym uint32) bool {
	521	+	return !isModifierKey(sym) && !isDeadKey(sym)
	522	+	}
	523	+
	524	+	func isModifierKey(sym uint32) bool {
464	525		switch sym {
465	526		case raw.XKB_KEY_Shift_L, raw.XKB_KEY_Shift_R, raw.XKB_KEY_Control_L, raw.XKB_KEY_Control_R,
466	527		raw.XKB_KEY_Alt_L, raw.XKB_KEY_Alt_R, raw.XKB_KEY_Super_L, raw.XKB_KEY_Super_R,
467		-	raw.XKB_KEY_Caps_Lock, raw.XKB_KEY_Num_Lock, raw.XKB_KEY_Multi_key:
468		-	return false
	528	+	raw.XKB_KEY_Caps_Lock, raw.XKB_KEY_Num_Lock:
	529	+	return true
469	530		}
470		-	return sym < raw.XKB_KEY_dead_grave \|\| sym > raw.XKB_KEY_dead_currency
	531	+	return false
	532	+	}
	533	+
	534	+	// isDeadKey reports dead keys and the compose key, which start a sequence.
	535	+	func isDeadKey(sym uint32) bool {
	536	+	return sym == raw.XKB_KEY_Multi_key \|\| sym >= raw.XKB_KEY_dead_grave && sym <= raw.XKB_KEY_dead_currency
471	537		}

 import (
 	"errors"
+	"fmt"
 	"io"
 	"os"
 	"time"
 	keymapMax   = 16 << 20
 )
-type heldKey struct{ evdev, sym uint32 }
+// heldKey is a pressed key. A key that went into the SecretBuffer keeps no
+// keysym and is flagged hidden, so its release is reported without either.
+type heldKey struct {
+	evdev, sym uint32
+	hidden     bool
+}
 type textKind uint8
 const (
-	kindNone textKind = iota
+	kindNone    textKind = iota
-	kindText
+	kindText             // printable text went into the SecretBuffer
+	kindPending          // a dead or compose key: part of a text sequence, no text yet
 	kindBackspace
 )
+// secretWork is the argument and result area of doSecret, which secret.Do runs
+// without arguments. translate clears it after every use.
+type secretWork struct {
+	evdev, sym uint32
+	mods       Modifiers
+	repeat     bool
+	kind       textKind
+	changed    bool
+	err        error
+}
 // keyboard interprets wl_keyboard events with xkbcommon. It runs only on the
 // owner goroutine. It never builds a string from key text: translations go
 // through the fixed scratch array, which is wiped after every use.
 	delay          int32 // milliseconds before the first repeat
 	repeating      uint32
 	composePending bool
+	composeUsed    bool // the last text() call consumed the key into a compose sequence
 	tfd  int // repeat timerfd
 	tbuf [8]byte
 	secret  *SecretBuffer
 	scratch [scratchSize]byte
-	// Work area of doSecret, which secret.Do runs without arguments.
 	secretFn func()
-	w        struct {
+	w        secretWork
-		evdev, sym uint32
+	changed  bool  // the last translation edited the SecretBuffer
-		mods       Modifiers
+	timerErr error // first repeat timer failure, reported by the seat
-		repeat     bool
-		kind       textKind
-		changed    bool
-		err        error
-	}
-	changed bool // the last translation edited the SecretBuffer
 }
 func newKeyboard(locale string) (*keyboard, error) {
 	c, err := xkb.NewContext()
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("xkb context: %w", err)
 	}
 	k := &keyboard{ctx: c, held: make([]heldKey, 0, maxHeldKeys), tfd: -1}
 	k.secretFn = k.doSecret
 	}
 	if k.tfd, err = unix.TimerfdCreate(unix.CLOCK_MONOTONIC, unix.TFD_NONBLOCK|unix.TFD_CLOEXEC); err != nil {
 		_ = c.Close()
-		return nil, err
+		return nil, fmt.Errorf("repeat timer: %w", err)
 	}
 	return k, nil
 }
 	defer f.Close()
 	km, err := k.ctx.NewKeymapFD(fd, size)
 	if err != nil {
-		return err
+		return fmt.Errorf("neferclient: compile keymap: %w", err)
 	}
 	return k.replace(km)
 }
 	s, err := km.NewState()
 	if err != nil {
 		_ = km.Close()
-		return err
+		return fmt.Errorf("neferclient: xkb state: %w", err)
 	}
 	k.reset()
 	if k.state != nil {
 }
 func (k *keyboard) setMask(depressed, latched, locked, group uint32) error {
-	k.lastMask = [6]uint32{depressed, latched, locked, 0, 0, group}
+	mask := [6]uint32{depressed, latched, locked, 0, 0, group}
+	if k.haveMask && mask == k.lastMask {
+		return nil // compositors repeat identical masks; the state is current
+	}
+	k.lastMask = mask
 	k.haveMask = true
 	if k.state == nil {
 		return nil
 	}
-	_, err := k.state.UpdateMask(depressed, latched, locked, 0, 0, group)
+	changed, err := k.state.UpdateMask(depressed, latched, locked, 0, 0, group)
-	k.refresh()
+	if err != nil {
-	return err
+		return fmt.Errorf("neferclient: update xkb mask: %w", err)
+	}
+	if changed != 0 {
+		k.refresh()
+	}
+	return nil
 }
 // refresh recomputes the cached modifiers and layout from the xkb state. Both
 // only change when the mask does, so keys do not query them.
 func (k *keyboard) refresh() {
-	k.mods, k.group = k.queryModifiers(), 0
+	k.mods = k.queryModifiers()
 	k.group, _ = k.state.Layout()
 }
 // reset drops held keys, repeat and compose state. It keeps the keymap, the
 // modifier mask and the focus flag.
 func (k *keyboard) reset() {
+	clear(k.held[:cap(k.held)]) // no hidden-key record outlives the reset
 	k.held = k.held[:0]
 	k.repeating = 0
 	k.disarm()
 		Interval: unix.NsecToTimespec(int64(time.Second) / int64(k.rate)),
 		Value:    unix.NsecToTimespec(max(int64(k.delay)*int64(time.Millisecond), 1)), // zero would disarm
 	}
-	_ = unix.TimerfdSettime(k.tfd, 0, &spec, nil)
+	k.setTimer(&spec)
 }
 func (k *keyboard) disarm() {
 	if k.tfd >= 0 {
 		var spec unix.ItimerSpec
-		_ = unix.TimerfdSettime(k.tfd, 0, &spec, nil)
+		k.setTimer(&spec)
+	}
+}
+func (k *keyboard) setTimer(spec *unix.ItimerSpec) {
+	if err := unix.TimerfdSettime(k.tfd, 0, spec, nil); err != nil && k.timerErr == nil {
+		k.timerErr = fmt.Errorf("neferclient: repeat timer: %w", err)
 	}
 }
+// takeTimerErr returns and clears the first timer failure.
+func (k *keyboard) takeTimerErr() error {
+	err := k.timerErr
+	k.timerErr = nil
+	return err
+}
 // expired consumes a timer expiration. Missed ticks are not accumulated: one
 // call yields at most one repeat.
 func (k *keyboard) expired() bool {
 	return -1
 }
-func (k *keyboard) drop(i int) { k.held = append(k.held[:i], k.held[i+1:]...) }
+func (k *keyboard) drop(i int) {
+	last := len(k.held) - 1
+	copy(k.held[i:], k.held[i+1:])
+	k.held[last] = heldKey{} // clear the vacated slot
+	k.held = k.held[:last]
+}
 // press translates a key press into ev. It reports false when the press must
 // not be delivered (no focus or keymap).
 	}
 	sym, err := k.state.KeySym(xkb.WaylandKeycode(evdev))
 	if err != nil {
-		return false, err
+		return false, fmt.Errorf("neferclient: key symbol: %w", err)
 	}
 	kind, err := k.translate(evdev, sym, false, ev)
 	if err != nil {
-		return false, err
+		return false, fmt.Errorf("neferclient: key text: %w", err)
+	}
+	if ev.Secret {
+		k.held = append(k.held, heldKey{evdev: evdev, hidden: true})
+	} else {
+		k.held = append(k.held, heldKey{evdev: evdev, sym: sym})
 	}
-	k.held = append(k.held, heldKey{evdev, sym})
 	if k.secret == nil && repeatable(sym) || k.secret != nil && (kind == kindBackspace || kind == kindText && repeatable(sym)) {
 		if k.rate > 0 {
 			k.repeating = evdev
 		k.repeating = 0
 		k.disarm()
 	}
-	ev.Keycode, ev.Keysym, ev.Pressed = evdev, h.sym, false
+	ev.Pressed, ev.Secret = false, h.hidden
+	if !h.hidden {
+		ev.Keycode, ev.Keysym = evdev, h.sym
+	}
 	k.changed = false
 	ev.Modifiers, ev.Group = k.mods, k.group
 	return true
 	sym, err := k.state.KeySym(xkb.WaylandKeycode(evdev))
 	if err != nil {
 		_, _ = stop()
-		return false, err
+		return false, fmt.Errorf("neferclient: key symbol: %w", err)
 	}
 	if k.secret == nil && !repeatable(sym) {
 		return stop()
 	kind, err := k.translate(evdev, sym, true, ev)
 	if err != nil {
 		_, _ = stop()
-		return false, err
+		return false, fmt.Errorf("neferclient: key text: %w", err)
 	}
 	if k.secret != nil && kind != kindBackspace && !(kind == kindText && repeatable(sym)) {
 		return stop()
 	ev.Modifiers, ev.Group = k.mods, k.group
 	k.changed = false
 	if k.secret != nil {
-		w := &k.w
+		k.w = secretWork{evdev: evdev, sym: sym, mods: ev.Modifiers, repeat: repeat}
-		w.evdev, w.sym, w.mods, w.repeat = evdev, sym, ev.Modifiers, repeat
 		secret.Do(k.secretFn)
-		k.changed = w.changed
+		kind, changed, err := k.w.kind, k.w.changed, k.w.err
-		return w.kind, w.err
+		k.w = secretWork{} // the key identity must not stay in the work area
+		k.changed = changed
+		if kind == kindText || kind == kindPending {
+			// Text keys are not identified: the keycode and keysym would
+			// reveal the secret character.
+			ev.Keycode, ev.Keysym, ev.Secret = 0, 0, true
+		}
+		return kind, err
 	}
 	n, err := k.text(evdev, sym, repeat)
 	if err != nil {
 // handles secret text, so it runs under runtime/secret when available.
 func (k *keyboard) doSecret() {
 	w := &k.w
-	w.kind, w.changed, w.err = kindNone, false, nil
 	defer clear(k.scratch[:])
 	switch {
 	case w.sym == raw.XKB_KEY_BackSpace:
 			w.err = err
 			return
 		}
-		if classifySecretText(k.scratch[:n]) {
+		switch {
+		case classifySecretText(k.scratch[:n]):
 			w.kind = kindText
 			w.changed = k.secret.appendText(k.scratch[:n])
+		case k.composeUsed || k.composePending || isDeadKey(w.sym):
+			w.kind = kindPending // dead and compose keys name an accent, so hide them too
 		}
 	}
 }
 // is fed only by physical presses: a repeat neither advances a sequence nor
 // replays composed text.
 func (k *keyboard) text(evdev, sym uint32, repeat bool) (int, error) {
+	k.composeUsed = false
 	if k.compose != nil && !repeat {
 		if _, err := k.compose.Feed(sym); err != nil {
 			return 0, err
 		if err != nil {
 			return 0, err
 		}
+		k.composeUsed = status == raw.XKB_COMPOSE_COMPOSING || status == raw.XKB_COMPOSE_CANCELLED || status == raw.XKB_COMPOSE_COMPOSED
 		switch status {
 		case raw.XKB_COMPOSE_COMPOSING:
 			k.composePending = true
 // Modifier, dead and compose keys never repeat. The compositor provides rate
 // and delay; its keymap is authoritative for text and layout.
 func repeatable(sym uint32) bool {
+	return !isModifierKey(sym) && !isDeadKey(sym)
+}
+func isModifierKey(sym uint32) bool {
 	switch sym {
 	case raw.XKB_KEY_Shift_L, raw.XKB_KEY_Shift_R, raw.XKB_KEY_Control_L, raw.XKB_KEY_Control_R,
 		raw.XKB_KEY_Alt_L, raw.XKB_KEY_Alt_R, raw.XKB_KEY_Super_L, raw.XKB_KEY_Super_R,
-		raw.XKB_KEY_Caps_Lock, raw.XKB_KEY_Num_Lock, raw.XKB_KEY_Multi_key:
+		raw.XKB_KEY_Caps_Lock, raw.XKB_KEY_Num_Lock:
-		return false
+		return true
 	}
-	return sym < raw.XKB_KEY_dead_grave || sym > raw.XKB_KEY_dead_currency
+	return false
+}
+// isDeadKey reports dead keys and the compose key, which start a sequence.
+func isDeadKey(sym uint32) bool {
+	return sym == raw.XKB_KEY_Multi_key || sym >= raw.XKB_KEY_dead_grave && sym <= raw.XKB_KEY_dead_currency
 }

M queue.go +1 -1


@@ -170,7 +170,7 @@ func (q queue) pop(ev event) bool {
170	170		return false
171	171		}
172	172		*ev = q.ring[q.head]
173		-	q.ring[q.head].kind = 0 // ownership of a carried descriptor moved to ev
	173	+	q.ring[q.head] = event{} // ownership of a carried descriptor moved to ev; leave no key data behind
174	174		q.head = (q.head + 1) % ringSize
175	175		full := q.n == ringSize
176	176		q.n--


@@ -170,7 +170,7 @@ func (q queue) pop(ev event) bool {
170		return false	170		return false
171		}	171		}
172		*ev = q.ring[q.head]	172		*ev = q.ring[q.head]
173	-	q.ring[q.head].kind = 0 // ownership of a carried descriptor moved to ev	173	+	q.ring[q.head] = event{} // ownership of a carried descriptor moved to ev; leave no key data behind
174		q.head = (q.head + 1) % ringSize	174		q.head = (q.head + 1) % ringSize
175		full := q.n == ringSize	175		full := q.n == ringSize
176		q.n--	176		q.n--

M seat.go +44 -24


@@ -10,8 +10,8 @@ import (
10	10		"golang.org/x/sys/unix"
11	11		)
12	12
13		-	// maxSeatVersion is the wl_seat version bound: 9 adds axis_value120 users and
14		-	// the release requests.
	13	+	// maxSeatVersion is the highest wl_seat version bound. Version 5 adds the
	14	+	// wl_seat.release request and wl_pointer.frame, 8 adds wl_pointer.axis_value120.
15	15		const maxSeatVersion = 9
16	16
17	17		// CursorShape is a wp_cursor_shape_v1 shape. The values are the protocol's.

@@ -95,12 +95,18 @@ type PointerEvent struct {
95	95		// KeyEvent is one key press, repeat or release.
96	96		type KeyEvent struct {
97	97		Surface SurfaceID
98		-	Keycode uint32 // evdev key code
99		-	Keysym uint32 // xkb keysym in the current layout and modifier state
	98	+	Keycode uint32 // evdev key code; 0 when Secret is set
	99	+	Keysym uint32 // xkb keysym in the current layout and modifier state; 0 when Secret is set
100	100		Modifiers Modifiers
101	101		Group uint32 // effective layout index
102	102		Pressed bool
103	103		Repeat bool
	104	+	// Secret is set while a [SecretBuffer] is installed, for the press,
	105	+	// repeats and release of a key that produced text (or is a dead or compose
	106	+	// key): the text went into the buffer, and Keycode and Keysym are 0 so the
	107	+	// event does not reveal which character was typed. Other keys (Enter,
	108	+	// Escape, BackSpace, modifiers, Control combinations) keep their keysym.
	109	+	Secret bool
104	110		// Text is the UTF-8 text of the key, nil for releases and keys without
105	111		// text. It aliases library storage that is wiped when Handler.Key
106	112		// returns. It is always nil while a [SecretBuffer] is installed.

@@ -109,7 +115,8 @@ type KeyEvent struct {
109	115
110	116		// Seat is the connection's first wl_seat: pointer, keyboard and cursor. It
111	117		// belongs to the owner goroutine. Without a seat global every method is a
112		-	// no-op.
	118	+	// no-op. The seat is bound once, at first use: a seat announced later is not
	119	+	// picked up, and a removed one is not replaced (no seat hotplug).
113	120		type Seat struct {
114	121		c *Conn
115	122		proxy *wayland.Seat

@@ -184,8 +191,15 @@ func (c *Conn) ensureSeat() {
184	191		// SetSecret installs b to receive typed text, or removes it with nil. While
185	192		// installed, printable text goes only into b and never into KeyEvent.Text;
186	193		// BackSpace removes one code point; every other key is still delivered as a
187		-	// KeyEvent without text. Installing or removing cancels held keys and repeat.
188		-	// The previous buffer is not wiped: that is the caller's call.
	194	+	// KeyEvent without text. Keys that produced text are delivered with
	195	+	// KeyEvent.Secret set and Keycode and Keysym 0, for the press, repeats and
	196	+	// release; Enter, Escape, BackSpace and Control combinations keep their
	197	+	// keysym. Installing or removing cancels held keys and repeat. The previous
	198	+	// buffer is not wiped: that is the caller's call.
	199	+	//
	200	+	// Limits: runtime/secret (GOEXPERIMENT=runtimesecret) erases Go registers,
	201	+	// stack and heap temporaries, but not the native memory of libxkbcommon, which
	202	+	// processes the key text.
189	203		func (s Seat) SetSecret(b SecretBuffer) {
190	204		if s == nil {
191	205		return

@@ -203,28 +217,24 @@ func (s *Seat) SetCursor(shape CursorShape) error {
203	217		if s == nil \|\| s.c.closed {
204	218		return ErrClosed
205	219		}
206		-	limit := CursorZoomOut
207		-	if s.shapesVer >= 2 {
208		-	limit = CursorAllResize
209		-	}
210	220		if shape < CursorDefault \|\| shape > CursorAllResize {
211	221		return fmt.Errorf("neferclient: invalid cursor shape %d", shape)
212	222		}
213		-	if s.shapes == nil \|\| s.pointer == nil \|\| s.enterSerial == 0 \|\| shape == s.shape {
214		-	return nil
215		-	}
216		-	if shape > limit {
	223	+	if shape >= CursorDndAsk && s.shapes != nil && s.shapesVer < 2 {
217	224		return &CapabilityError{Name: cursorshape.WpCursorShapeManagerInterface, Cause: fmt.Errorf("shape %d requires version 2", shape)}
218	225		}
	226	+	if s.shapes == nil \|\| s.pointer == nil \|\| s.ptrSurf == 0 \|\| shape == s.shape {
	227	+	return nil
	228	+	}
219	229		if s.shapeDev == nil {
220	230		dev, err := s.shapes.GetPointer(s.pointer)
221	231		if err != nil {
222		-	return err
	232	+	return fmt.Errorf("neferclient: cursor shape device: %w", err)
223	233		}
224	234		s.shapeDev = dev
225	235		}
226	236		if err := s.shapeDev.SetShape(s.enterSerial, uint32(shape)); err != nil {
227		-	return err
	237	+	return fmt.Errorf("neferclient: set cursor shape: %w", err)
228	238		}
229	239		s.shape = shape
230	240		return nil

@@ -258,6 +268,9 @@ func (c *Conn) seatRepeat(h Handler) {
258	268		s.deliverKey(ke, h)
259	269		}
260	270		}
	271	+	if err := s.kb.takeTimerErr(); err != nil {
	272	+	h.Error(err)
	273	+	}
261	274		if !c.closed {
262	275		if err := c.armFD(s.kb.tfd, unix.EPOLL_CTL_MOD); err != nil {
263	276		h.Error(err)

@@ -268,7 +281,7 @@ func (c *Conn) seatRepeat(h Handler) {
268	281		func (s Seat) deliverKey(ke KeyEvent, h Handler) {
269	282		h.Key(ke)
270	283		clear(s.kb.scratch[:]) // ordinary text must not outlive the call
271		-	ke.Text = nil
	284	+	*ke = KeyEvent{}
272	285		if s.kb.changed {
273	286		h.SecretChanged(s.secret.Len())
274	287		}

@@ -363,7 +376,7 @@ func (s *Seat) newPointer() error {
363	376		defer c.resume()
364	377		p, err := s.proxy.GetPointer()
365	378		if err != nil {
366		-	return err
	379	+	return fmt.Errorf("neferclient: get wl_pointer: %w", err)
367	380		}
368	381		s.pointer = p
369	382		s.ptrGen++

@@ -391,11 +404,11 @@ func (s *Seat) newKeyboard() error {
391	404		if s.kb == nil {
392	405		kb, err := newKeyboard(composeLocale())
393	406		if err != nil {
394		-	return err
	407	+	return fmt.Errorf("neferclient: keyboard: %w", err)
395	408		}
396	409		if err = c.armFD(kb.tfd, unix.EPOLL_CTL_ADD); err != nil {
397	410		kb.close()
398		-	return err
	411	+	return err // armFD wraps it
399	412		}
400	413		kb.secret = s.secret
401	414		s.kb = kb

@@ -404,7 +417,7 @@ func (s *Seat) newKeyboard() error {
404	417		defer c.resume()
405	418		k, err := s.proxy.GetKeyboard()
406	419		if err != nil {
407		-	return err
	420	+	return fmt.Errorf("neferclient: get wl_keyboard: %w", err)
408	421		}
409	422		s.keyboard = k
410	423		s.kbGen++

@@ -455,6 +468,9 @@ func (c Conn) applySeat(ev event, h Handler) {
455	468		default:
456	469		if s.keyboard != nil && ev.version == s.kbGen {
457	470		s.applyKeyboard(ev, h)
	471	+	if err := s.kb.takeTimerErr(); err != nil {
	472	+	h.Error(err)
	473	+	}
458	474		}
459	475		}
460	476		}

@@ -538,10 +554,14 @@ func (s Seat) applyKeyboard(ev event, h Handler) {
538	554		switch ev.kind {
539	555		case evKbKeymap:
540	556		fd := int(ev.fd)
541		-	ev.fd = -1 // replaceFD consumes fd; the deferred closeFD must not touch the number again
	557	+	ev.fd = -1 // replaceFD consumes fd; the deferred closeFD must not touch the number again
	558	+	if ev.a == 0 { // no_keymap: the compositor sends no usable map; nothing to report
	559	+	_ = unix.Close(fd)
	560	+	return
	561	+	}
542	562		if ev.a != 1 \|\| ev.flags == 0 \|\| ev.flags > keymapMax {
543	563		_ = unix.Close(fd)
544		-	h.Error(errors.New("neferclient: unsupported keymap format or size"))
	564	+	h.Error(fmt.Errorf("neferclient: unsupported keymap format %d or size %d", ev.a, ev.flags))
545	565		return
546	566		}
547	567		if err := kb.replaceFD(fd, int(ev.flags)); err != nil {

 	"golang.org/x/sys/unix"
 )
-// maxSeatVersion is the wl_seat version bound: 9 adds axis_value120 users and
+// maxSeatVersion is the highest wl_seat version bound. Version 5 adds the
-// the release requests.
+// wl_seat.release request and wl_pointer.frame, 8 adds wl_pointer.axis_value120.
 const maxSeatVersion = 9
 // CursorShape is a wp_cursor_shape_v1 shape. The values are the protocol's.
 // KeyEvent is one key press, repeat or release.
 type KeyEvent struct {
 	Surface   SurfaceID
-	Keycode   uint32 // evdev key code
+	Keycode   uint32 // evdev key code; 0 when Secret is set
-	Keysym    uint32 // xkb keysym in the current layout and modifier state
+	Keysym    uint32 // xkb keysym in the current layout and modifier state; 0 when Secret is set
 	Modifiers Modifiers
 	Group     uint32 // effective layout index
 	Pressed   bool
 	Repeat    bool
+	// Secret is set while a [SecretBuffer] is installed, for the press,
+	// repeats and release of a key that produced text (or is a dead or compose
+	// key): the text went into the buffer, and Keycode and Keysym are 0 so the
+	// event does not reveal which character was typed. Other keys (Enter,
+	// Escape, BackSpace, modifiers, Control combinations) keep their keysym.
+	Secret bool
 	// Text is the UTF-8 text of the key, nil for releases and keys without
 	// text. It aliases library storage that is wiped when Handler.Key
 	// returns. It is always nil while a [SecretBuffer] is installed.
 // Seat is the connection's first wl_seat: pointer, keyboard and cursor. It
 // belongs to the owner goroutine. Without a seat global every method is a
-// no-op.
+// no-op. The seat is bound once, at first use: a seat announced later is not
+// picked up, and a removed one is not replaced (no seat hotplug).
 type Seat struct {
 	c     *Conn
 	proxy *wayland.Seat
 // SetSecret installs b to receive typed text, or removes it with nil. While
 // installed, printable text goes only into b and never into KeyEvent.Text;
 // BackSpace removes one code point; every other key is still delivered as a
-// KeyEvent without text. Installing or removing cancels held keys and repeat.
+// KeyEvent without text. Keys that produced text are delivered with
-// The previous buffer is not wiped: that is the caller's call.
+// KeyEvent.Secret set and Keycode and Keysym 0, for the press, repeats and
+// release; Enter, Escape, BackSpace and Control combinations keep their
+// keysym. Installing or removing cancels held keys and repeat. The previous
+// buffer is not wiped: that is the caller's call.
+//
+// Limits: runtime/secret (GOEXPERIMENT=runtimesecret) erases Go registers,
+// stack and heap temporaries, but not the native memory of libxkbcommon, which
+// processes the key text.
 func (s *Seat) SetSecret(b *SecretBuffer) {
 	if s == nil {
 		return
 	if s == nil || s.c.closed {
 		return ErrClosed
 	}
-	limit := CursorZoomOut
-	if s.shapesVer >= 2 {
-		limit = CursorAllResize
-	}
 	if shape < CursorDefault || shape > CursorAllResize {
 		return fmt.Errorf("neferclient: invalid cursor shape %d", shape)
 	}
-	if s.shapes == nil || s.pointer == nil || s.enterSerial == 0 || shape == s.shape {
+	if shape >= CursorDndAsk && s.shapes != nil && s.shapesVer < 2 {
-		return nil
-	}
-	if shape > limit {
 		return &CapabilityError{Name: cursorshape.WpCursorShapeManagerInterface, Cause: fmt.Errorf("shape %d requires version 2", shape)}
 	}
+	if s.shapes == nil || s.pointer == nil || s.ptrSurf == 0 || shape == s.shape {
+		return nil
+	}
 	if s.shapeDev == nil {
 		dev, err := s.shapes.GetPointer(s.pointer)
 		if err != nil {
-			return err
+			return fmt.Errorf("neferclient: cursor shape device: %w", err)
 		}
 		s.shapeDev = dev
 	}
 	if err := s.shapeDev.SetShape(s.enterSerial, uint32(shape)); err != nil {
-		return err
+		return fmt.Errorf("neferclient: set cursor shape: %w", err)
 	}
 	s.shape = shape
 	return nil
 			s.deliverKey(ke, h)
 		}
 	}
+	if err := s.kb.takeTimerErr(); err != nil {
+		h.Error(err)
+	}
 	if !c.closed {
 		if err := c.armFD(s.kb.tfd, unix.EPOLL_CTL_MOD); err != nil {
 			h.Error(err)
 func (s *Seat) deliverKey(ke *KeyEvent, h Handler) {
 	h.Key(ke)
 	clear(s.kb.scratch[:]) // ordinary text must not outlive the call
-	ke.Text = nil
+	*ke = KeyEvent{}
 	if s.kb.changed {
 		h.SecretChanged(s.secret.Len())
 	}
 	defer c.resume()
 	p, err := s.proxy.GetPointer()
 	if err != nil {
-		return err
+		return fmt.Errorf("neferclient: get wl_pointer: %w", err)
 	}
 	s.pointer = p
 	s.ptrGen++
 	if s.kb == nil {
 		kb, err := newKeyboard(composeLocale())
 		if err != nil {
-			return err
+			return fmt.Errorf("neferclient: keyboard: %w", err)
 		}
 		if err = c.armFD(kb.tfd, unix.EPOLL_CTL_ADD); err != nil {
 			kb.close()
-			return err
+			return err // armFD wraps it
 		}
 		kb.secret = s.secret
 		s.kb = kb
 	defer c.resume()
 	k, err := s.proxy.GetKeyboard()
 	if err != nil {
-		return err
+		return fmt.Errorf("neferclient: get wl_keyboard: %w", err)
 	}
 	s.keyboard = k
 	s.kbGen++
 	default:
 		if s.keyboard != nil && ev.version == s.kbGen {
 			s.applyKeyboard(ev, h)
+			if err := s.kb.takeTimerErr(); err != nil {
+				h.Error(err)
+			}
 		}
 	}
 }
 	switch ev.kind {
 	case evKbKeymap:
 		fd := int(ev.fd)
-		ev.fd = -1 // replaceFD consumes fd; the deferred closeFD must not touch the number again
+		ev.fd = -1     // replaceFD consumes fd; the deferred closeFD must not touch the number again
+		if ev.a == 0 { // no_keymap: the compositor sends no usable map; nothing to report
+			_ = unix.Close(fd)
+			return
+		}
 		if ev.a != 1 || ev.flags == 0 || ev.flags > keymapMax {
 			_ = unix.Close(fd)
-			h.Error(errors.New("neferclient: unsupported keymap format or size"))
+			h.Error(fmt.Errorf("neferclient: unsupported keymap format %d or size %d", ev.a, ev.flags))
 			return
 		}
 		if err := kb.replaceFD(fd, int(ev.flags)); err != nil {