You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Update to an existing plugin (version bumped in plugin.toml)
What it does
Desktop/Lockscreen widget to show battery.
External dependencies
None.
Testing
Tested on Niri
Tested on Hyprland
Tested on Sway
Tested on another compositor:
Noctalia version tested against: v5.0.0
Plugin API level: 19
Screenshots / Videos
Checklist
The directory name matches the part of id after the / in plugin.toml exactly.
It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
README.md follows the README template, documents
every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
I did not edit catalog.toml; CI generates it.
This PR touches exactly one plugin directory.
Code review attestation
Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:
The code is readable and not obfuscated, minified, or generated.
It does not download and execute remote code.
Every network call, filesystem write, and spawned process is something the description above accounts for.
I have the right to publish this code under the license declared in plugin.toml.
The refresh path builds a shell string and runs it through noctalia.runAsync:
"cat " .. path .. batName .. "/capacity " .. path .. batName .. "/status".
noctalia.runAsync(string) executes via /bin/sh -lc, so batName is interpolated
into a shell command unescaped. batName comes from the free-form "battery_name"
string setting when "battery" is set to "custom" (battery-widget/widget.luau:17),
so shell metacharacters in that value are executed.
This is user-configures-own-session only, not a remote or cross-user attack
surface, so it is not a trust blocker. It is still avoidable: the plugin API
exposes noctalia.readFile, which reads /sys/class/power_supply//capacity
and /status directly and removes both the shell interpolation and a spawned
subprocess every refresh interval. If the subprocess is kept, quote and escape
the value the way battery-graph/battery-desktop.luau:6 does.
non-blocking - battery-widget/widget.luau:117
The chunk defines update() but never renders once at load. The host arms a
repeating timer whose first fire is one full interval away, and setUpdateInterval
on battery-widget/widget.luau:1 raises that interval to refresh_interval (default
60s). Result: after the widget is added, and after every script reload, nothing is
drawn for up to 60 seconds. Calling refreshBattery() at the end of the chunk fixes
the cold start.
non-blocking - battery-widget/widget.luau:1
setUpdateInterval (line 1) and getBatName() (line 111) are evaluated once at chunk
load, unlike layout, show_glyph, show_label, hide_plugged, hide_full, color,
warning_color and charging_color, which are read inside render()/getColor() and
therefore track settings live. So "refresh_interval", "battery" and "battery_name"
only take effect when the chunk is reloaded. This is very likely the "plugin
settings don't hot reload" behavior reported in the PR conversation. Moving both
calls inside update() matches what battery-graph/battery-desktop.luau:18 does and
makes all settings live.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Plugin
yocraft/battery-widgetplugin.toml)What it does
Desktop/Lockscreen widget to show battery.
External dependencies
None.
Testing
Screenshots / Videos
Checklist
idafter the/inplugin.tomlexactly.plugin.toml,README.md,thumbnail.webp, andtranslations/en.json.README.mdfollows theREADME template, documents
every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
thumbnail.webpwith the thumbnail generator.versionfollows semver and is bumped in this PR;plugin_apiis the oldest API level this plugin requires.understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
catalog.toml; CI generates it.Code review attestation
Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:
licensedeclared inplugin.toml.