fix(console): pass TERM/COLORTERM through flatpak-spawn --host

flatpak-spawn --host does not forward the caller's environment; the host
login shell started without TERM (tput errors, integer test on empty
LINES/COLUMNS in the profile scripts).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018jkHZhr7ZzHGGuE2bJQmGa

.gitea/workflows/build-flatpak.yml

@@ -30,10 +30,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      # ubuntu:24.04 matches the freedesktop 24.08 runtime closely enough
+      # ubuntu:24.04 (glibc 2.39, GStreamer 1.24) is older than the
-      # (glibc 2.39, GStreamer 1.24) that the cargo-built binary runs
+      # freedesktop 25.08 runtime (glibc 2.41, GStreamer 1.26), so the
-      # unmodified inside the runtime. Privileged so Flatpak's bwrap works
+      # cargo-built binary runs unmodified inside the runtime (same sonames,
-      # where needed (runtime install triggers).
+      # forward-compatible symbol versions). 25.08 is required: 24.08 ships
+      # libpipewire 1.2 whose buffer negotiation fails against KWin 6.7 /
+      # PipeWire 1.6 hosts ("pipewiresrc: error alloc buffers"). Privileged
+      # so Flatpak's bwrap works where needed (runtime install triggers).
       image: ubuntu:24.04
       options: --privileged
     steps:
@@ -120,7 +123,7 @@ jobs:
         if: steps.check.outputs.build == 'true'
         run: |
           flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-          flatpak install -y flathub org.freedesktop.Platform//24.08 org.freedesktop.Sdk//24.08
+          flatpak install -y flathub org.freedesktop.Platform//25.08 org.freedesktop.Sdk//25.08
 
       - name: Stamp version into AppStream metadata
         if: steps.check.outputs.build == 'true'

README.md

@@ -3,7 +3,8 @@
 Flatpak packaging for the [HeiniRemote](https://git.pc-heini.de/pc-heini/HeiniRemote)
 customer agent (`de.pc_heini.HeiniRemoteAgent`) — an additional distribution
 channel next to the plain release binary, with all dependencies (GStreamer,
-libnice, wl-clipboard, …) pinned inside the freedesktop 24.08 runtime.
+libnice, wl-clipboard, …) pinned inside the freedesktop 25.08 runtime (24.08 ships libpipewire 1.2,
+whose buffer negotiation fails against KWin 6.7 / PipeWire 1.6 hosts).
 
 Same setup as [o3de-flatpak](https://git.pc-heini.de/pc-heini/o3de-flatpak):
 a Gitea Action builds the Flatpak **without** `flatpak-builder` (no bubblewrap
@@ -14,6 +15,12 @@ repackaging a prebuilt archive.
 
 ## Install
 
+> **Note:** this repository must stay **public**. Flatpak fetches the OSTree
+> repo from the raw `pages` branch without any credentials — with the repo set
+> to private, `flatpak remote-add` / `flatpak install` fail with a 404.
+> (The agent's source lives in the private HeiniRemote repo; only the built
+> binary is published here.)
+
 From the Flatpak remote (gets updates via `flatpak update`):
 
 ```sh
@@ -54,7 +61,7 @@ user unit wrapping `flatpak run`:
 ```ini
 # ~/.config/systemd/user/heiniremote-agent.service
 [Unit]
-Description=HeiniRemote agent (Flatpak)
+Description=PC-Heini Fernwartung (HeiniRemote Agent, Flatpak)
 After=graphical-session.target
 
 [Service]
@@ -93,3 +100,5 @@ StatusNotifier names for the tray icon.
 | `heiniremote-wrapper.sh` | Entry point: host-shell `$SHELL` override + config adoption. |
 | `host-shell.sh` | `flatpak-spawn --host` bridge for the PTY console. |
 | `de.pc_heini.HeiniRemoteAgent.*` | Desktop file, AppStream metainfo (version stamped by CI), icon. |
+
+Builds track the newest upstream `main` commit. To rebuild before the nightly check, push a change to a packaging file (README, docs, LICENSE and .gitignore are ignored by the workflow) or run the workflow manually via `workflow_dispatch`.

de.pc_heini.HeiniRemoteAgent.desktop

@@ -1,9 +1,13 @@
 [Desktop Entry]
 Type=Application
-Name=HeiniRemote Agent
+Name=PC-Heini Fernwartung
-Comment=Remote maintenance agent — connects this machine to a HeiniRemote server
+Name[en]=PC-Heini Remote Support
+GenericName=Fernwartung
+GenericName[en]=Remote Support
+Comment=Erlaubt PC-Heini, diesen Computer nach Ihrer Zustimmung aus der Ferne zu warten
+Comment[en]=Lets PC-Heini service this computer remotely, after you grant access
 Exec=heiniremote-wrapper.sh
 Icon=de.pc_heini.HeiniRemoteAgent
 Terminal=false
 Categories=Network;RemoteAccess;
-Keywords=remote;support;fernwartung;
+Keywords=PC-Heini;pcheini;pc heini;Heini;Fernwartung;Fernzugriff;Fernhilfe;Support;Hilfe;HeiniRemote;remote;

de.pc_heini.HeiniRemoteAgent.metainfo.xml

@@ -3,14 +3,34 @@
   <id>de.pc_heini.HeiniRemoteAgent</id>
   <metadata_license>CC0-1.0</metadata_license>
   <project_license>proprietary</project_license>
-  <name>HeiniRemote Agent</name>
+  <name>PC-Heini Fernwartung</name>
-  <summary>Remote maintenance agent for HeiniRemote</summary>
+  <name xml:lang="en">PC-Heini Remote Support</name>
+  <summary>Fernwartung Ihres Computers durch PC-Heini</summary>
+  <summary xml:lang="en">Remote support for your computer by PC-Heini</summary>
   <description>
     <p>
-      Customer-side agent for HeiniRemote: Wayland screen capture and input
+      Mit diesem Programm kann PC-Heini Ihren Computer aus der Ferne warten:
-      injection via xdg-desktop-portal, plus a PTY rescue console, streamed
+      Bildschirm ansehen, Maus und Tastatur bedienen und bei Bedarf eine
-      over WebRTC to the HeiniRemote management console. Requires a HeiniRemote
+      Konsole nutzen. Nichts passiert ohne Ihre Zustimmung: Vor jeder Sitzung
-      server URL and device token (agent.toml).
+      fragt Ihr System, ob der Bildschirm freigegeben werden darf.
+    </p>
+    <p>
+      Die Verbindung ist Ende-zu-Ende verschlüsselt und läuft über den
+      Fernwartungsserver von PC-Heini. Das Programm läuft unauffällig im
+      Hintergrund und zeigt ein Symbol in der Leiste, solange es aktiv ist.
+    </p>
+  </description>
+  <description xml:lang="en">
+    <p>
+      This program lets PC-Heini service your computer remotely: view the
+      screen, operate mouse and keyboard and, if needed, use a console.
+      Nothing happens without your consent: before every session your system
+      asks whether the screen may be shared.
+    </p>
+    <p>
+      The connection is end-to-end encrypted and goes through PC-Heini's
+      remote support server. The program runs quietly in the background and
+      shows a tray icon while it is active.
     </p>
   </description>
   <launchable type="desktop-id">de.pc_heini.HeiniRemoteAgent.desktop</launchable>

host-shell.sh

@@ -9,9 +9,21 @@
 # The inner resolution runs ON THE HOST: flatpak-spawn forwards the sandbox
 # environment, so $SHELL would still point at this script — resolve the user's
 # real login shell from passwd instead and fix up $SHELL before exec'ing it.
-exec flatpak-spawn --host /bin/sh -c '
+#
+# The PTY itself was allocated inside the sandbox (its own devpts instance),
+# so on the host the forwarded fd cannot be named (`tty` fails, no
+# controlling terminal, tools that open /dev/tty break). script(1) allocates a
+# second, host-side PTY for the shell and relays through the forwarded one;
+# util-linux >= 2.35 also passes window-size changes along.
+# flatpak-spawn --host does not forward the caller's environment: without
+# --env the host shell starts with no TERM at all (login scripts then fail
+# in tput and in integer tests on the empty LINES/COLUMNS).
+exec flatpak-spawn --host --env=TERM="${TERM:-xterm-256color}" --env=COLORTERM=truecolor /bin/sh -c '
     shell="$(getent passwd "$(id -un)" | cut -d: -f7)"
     [ -x "$shell" ] || shell=/bin/sh
     export SHELL="$shell"
+    if command -v script >/dev/null 2>&1; then
+        exec script -q -e -c "exec \"$shell\" -l" /dev/null
+    fi
     exec "$shell" -l
 '

scripts/make-flatpak.sh

@@ -16,7 +16,7 @@ set -euo pipefail
 cd "$(dirname "$0")/.."
 
 APP_ID=de.pc_heini.HeiniRemoteAgent
-RUNTIME_VER=24.08
+RUNTIME_VER=25.08
 BRANCH=stable
 AGENT_BIN="${AGENT_BIN:?set AGENT_BIN to the compiled heiniremote-agent}"
 WL_DIR="${WL_CLIPBOARD_DIR:-/usr/bin}"
@@ -72,3 +72,5 @@ flatpak build-export --disable-sandbox repo build-dir "$BRANCH"
 flatpak build-update-repo repo --title="HeiniRemote Agent" --prune --prune-depth=1
 
 echo ">> done: ./repo"
+
+# Touched to trigger a rebuild against upstream f8c509b (2026-09-21).