fix(linux): release forwarded keys on the proxy keyboard when it fails open (#1619)

Author: y3owk1n

docs/adr/0014-the-wayland-keyboard-is-a-proxy.md

@@ -145,8 +145,16 @@ it, so a hint label typed while Super is still coming up is the label.
   probe against a real kernel is
   `TestProxyNode_HeldByAnother_SeesAGrabFromAnotherFd`). The remapper's
   output returns to the compositor, so the user's keys and remaps work; what
-  is lost is capturing keys for a mode. The setup guide tells remapper users
-  to exclude the `neru-` devices instead.
+  is lost is capturing keys for a mode. Failing open is the one time the
+  proxy lets a keyboard go without waiting for it to be idle, so a key down
+  at that instant, whose press the proxy re-emitted, is released on the proxy
+  keyboard first (`releaseForwarded`, pinned by
+  `TestEvdevProxy_FailOpen_ReleasesEveryKeyItForwarded`): its physical
+  release goes to the physical device, whose libinput never saw the press
+  and drops it, and a key left down on the proxy would stay down for the
+  daemon's lifetime, a Super that Hyprland merged into every key typed
+  afterwards. The setup guide tells remapper users to exclude the `neru-`
+  devices instead.
 - A remapper's output keyboard also advertises relative motion and mouse
   buttons, so a key can move the pointer, and so does a receiver that exposes a
   mouse and a keyboard on one node. Grabbing such a device takes its motion, so

internal/adapter/eventtap/linux/evdev_proxy_cgo.go

@@ -502,14 +502,20 @@ func (p *evdevProxy) emitPointer(event waylandEvdevEvent) {
 // emitKey re-emits a key event of the proxy's own making, with the sync report
 // that makes it a complete frame.
 func (p *evdevProxy) emitKey(code uint16, value int32) {
+	frame := keyFrame(code, value)
+	p.write(p.uinputFd, &frame[0], len(frame))
+}
+
+// keyFrame is one key event and the sync report that completes it.
+func keyFrame(code uint16, value int32) [2]C.struct_input_event {
 	var frame [2]C.struct_input_event
 	frame[0]._type = C.ushort(evdevEventKey)
 	frame[0].code = C.ushort(code)
 	frame[0].value = C.int(value)
 	frame[1]._type = C.ushort(evdevEventSyn)
 	frame[1].code = C.ushort(evdevSynReport)
 
-	p.write(p.uinputFd, &frame[0], len(frame))
+	return frame
 }
 
 // write puts count events on one proxy device, whole. Anything less means the
@@ -542,6 +548,8 @@ func (p *evdevProxy) failOpen(err error) {
 		return
 	}
 
+	p.releaseForwarded()
+
 	p.capture.ungrabAll()
 
 	// The keys now reach the compositor as well, so a session reading them
@@ -571,6 +579,38 @@ func (p *evdevProxy) failOpen(err error) {
 	)
 }
 
+// releaseForwarded re-emits a release on the proxy keyboard for every key the
+// rule counts as forwarded and down, then zeroes the rule. Failing open is the
+// one time a keyboard is let go without waiting for it to be idle: a key down
+// at that instant had its press re-emitted here, and its release goes to the
+// physical device next, whose libinput never saw the press and drops it. Left
+// down on the proxy keyboard it would stay down for the daemon's lifetime, and
+// a compositor that merges modifiers across keyboards (Hyprland) would put
+// that Super on every key typed afterwards. Base keys go up before modifiers,
+// the way a chord is let go of. The writes bypass the forwarding flag, which
+// failOpen has cleared; on a proxy that stopped taking writes they fail as the
+// last one did, and there is nothing more to do for it.
+func (p *evdevProxy) releaseForwarded() {
+	var keys, modifiers []uint16
+
+	for code := range uint16(evdevKeyCodeCount) {
+		switch {
+		case !p.rule.isDown(code):
+		case p.capture.modifierName(code) != "":
+			modifiers = append(modifiers, code)
+		default:
+			keys = append(keys, code)
+		}
+	}
+
+	p.rule = forwardRule{}
+
+	for _, code := range append(keys, modifiers...) {
+		frame := keyFrame(code, evdevValueRelease)
+		C.neru_evdev_write_events(p.uinputFd, &frame[0], C.int(len(frame)))
+	}
+}
+
 // forwardWithheld hands a press the session had withheld to the compositor
 // after all, together with every modifier the user is physically holding that
 // the session withheld too. Each is marked forwarded, so its repeats and its

internal/adapter/eventtap/linux/evdev_proxy_test.go

@@ -479,6 +479,39 @@ func TestEvdevProxy_FailOpenReleasesTheKeyboardsAndRefusesSessions(t *testing.T)
 	}
 }
 
+// A key down when the proxy fails open had its press re-emitted on the proxy
+// keyboard, and its release goes to the physical device next, where libinput
+// never saw the press: the proxy releases what it forwarded before it lets
+// the keyboards go, or the key stays down on the proxy for the daemon's life.
+func TestEvdevProxy_FailOpen_ReleasesEveryKeyItForwarded(t *testing.T) {
+	t.Parallel()
+
+	proxy := newTestProxy()
+
+	// The activation chord, forwarded: no session is capturing.
+	proxy.handle(keyEvent(evdevKeyLeftMeta, evdevValuePress))
+	proxy.handle(keyEvent(evdevKeyJ, evdevValuePress))
+
+	if !proxy.rule.isDown(evdevKeyLeftMeta) || !proxy.rule.isDown(evdevKeyJ) {
+		t.Fatal("the chord was not forwarded before the proxy failed open")
+	}
+
+	proxy.forwarding.Store(true)
+	proxy.capture.grab = true
+	proxy.failOpen(errWaylandEvdevProxyGrabbed)
+
+	for _, code := range []uint16{evdevKeyLeftMeta, evdevKeyJ} {
+		if proxy.rule.isDown(code) {
+			t.Errorf("key %d is still down on the proxy keyboard after it failed open", code)
+		}
+	}
+
+	// The physical releases that follow are the physical device's now.
+	if proxy.rule.release(evdevKeyJ) || proxy.rule.release(evdevKeyLeftMeta) {
+		t.Error("a release was forwarded for a key the fail-open already released")
+	}
+}
+
 // A keyboard yielded to a remapper is with the compositor until the remapper
 // claims it or it is taken back; a mode started meanwhile would get nothing
 // while its keys went to the focused app, so it is refused and falls back.