fix(flatpakrepo): add RuntimeRepo so the runtime resolves without Flathub

A fresh system (e.g. Ubuntu after apt install flatpak) has no Flathub
remote, so installing from the .flatpakrepo could not find the
freedesktop 25.08 runtime. Found in the HeiniRemote VM test 2026-10-13.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build-flatpak.yml

@@ -30,10 +30,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      # ubuntu:24.04 matches the freedesktop 24.08 runtime closely enough
+      # ubuntu:24.04 (glibc 2.39, GStreamer 1.24) is older than the
-      # (glibc 2.39, GStreamer 1.24) that the cargo-built binary runs
+      # freedesktop 25.08 runtime (glibc 2.41, GStreamer 1.26), so the
-      # unmodified inside the runtime. Privileged so Flatpak's bwrap works
+      # cargo-built binary runs unmodified inside the runtime (same sonames,
-      # where needed (runtime install triggers).
+      # forward-compatible symbol versions). 25.08 is required: 24.08 ships
+      # libpipewire 1.2 whose buffer negotiation fails against KWin 6.7 /
+      # PipeWire 1.6 hosts ("pipewiresrc: error alloc buffers"). Privileged
+      # so Flatpak's bwrap works where needed (runtime install triggers).
       image: ubuntu:24.04
       options: --privileged
     steps:
@@ -120,7 +123,7 @@ jobs:
         if: steps.check.outputs.build == 'true'
         run: |
           flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-          flatpak install -y flathub org.freedesktop.Platform//24.08 org.freedesktop.Sdk//24.08
+          flatpak install -y flathub org.freedesktop.Platform//25.08 org.freedesktop.Sdk//25.08
 
       - name: Stamp version into AppStream metadata
         if: steps.check.outputs.build == 'true'
@@ -149,6 +152,7 @@ jobs:
           [Flatpak Repo]
           Title=HeiniRemote Agent
           Url=$BASE
+          RuntimeRepo=https://dl.flathub.org/repo/flathub.flatpakrepo
           Homepage=https://pc-heini.de/
           Comment=HeiniRemote remote maintenance agent as a Flatpak
           Description=Install the HeiniRemote agent on any Linux distribution via Flatpak.

README.md

@@ -3,7 +3,8 @@
 Flatpak packaging for the [HeiniRemote](https://git.pc-heini.de/pc-heini/HeiniRemote)
 customer agent (`de.pc_heini.HeiniRemoteAgent`) — an additional distribution
 channel next to the plain release binary, with all dependencies (GStreamer,
-libnice, wl-clipboard, …) pinned inside the freedesktop 24.08 runtime.
+libnice, wl-clipboard, …) pinned inside the freedesktop 25.08 runtime (24.08 ships libpipewire 1.2,
+whose buffer negotiation fails against KWin 6.7 / PipeWire 1.6 hosts).
 
 Same setup as [o3de-flatpak](https://git.pc-heini.de/pc-heini/o3de-flatpak):
 a Gitea Action builds the Flatpak **without** `flatpak-builder` (no bubblewrap
@@ -14,6 +15,12 @@ repackaging a prebuilt archive.
 
 ## Install
 
+> **Note:** this repository must stay **public**. Flatpak fetches the OSTree
+> repo from the raw `pages` branch without any credentials — with the repo set
+> to private, `flatpak remote-add` / `flatpak install` fail with a 404.
+> (The agent's source lives in the private HeiniRemote repo; only the built
+> binary is published here.)
+
 From the Flatpak remote (gets updates via `flatpak update`):
 
 ```sh
@@ -54,7 +61,7 @@ user unit wrapping `flatpak run`:
 ```ini
 # ~/.config/systemd/user/heiniremote-agent.service
 [Unit]
-Description=HeiniRemote agent (Flatpak)
+Description=PC-Heini Fernwartung (HeiniRemote Agent, Flatpak)
 After=graphical-session.target
 
 [Service]
@@ -93,3 +100,5 @@ StatusNotifier names for the tray icon.
 | `heiniremote-wrapper.sh` | Entry point: host-shell `$SHELL` override + config adoption. |
 | `host-shell.sh` | `flatpak-spawn --host` bridge for the PTY console. |
 | `de.pc_heini.HeiniRemoteAgent.*` | Desktop file, AppStream metainfo (version stamped by CI), icon. |
+
+Builds track the newest upstream `main` commit. To rebuild before the nightly check, push a change to a packaging file (README, docs, LICENSE and .gitignore are ignored by the workflow) or run the workflow manually via `workflow_dispatch`.

de.pc_heini.HeiniRemoteAgent.desktop

@@ -1,9 +1,13 @@
 [Desktop Entry]
 Type=Application
-Name=HeiniRemote Agent
+Name=PC-Heini Fernwartung
-Comment=Remote maintenance agent — connects this machine to a HeiniRemote server
+Name[en]=PC-Heini Remote Support
+GenericName=Fernwartung
+GenericName[en]=Remote Support
+Comment=Erlaubt PC-Heini, diesen Computer nach Ihrer Zustimmung aus der Ferne zu warten
+Comment[en]=Lets PC-Heini service this computer remotely, after you grant access
 Exec=heiniremote-wrapper.sh
 Icon=de.pc_heini.HeiniRemoteAgent
 Terminal=false
 Categories=Network;RemoteAccess;
-Keywords=remote;support;fernwartung;
+Keywords=PC-Heini;pcheini;pc heini;Heini;Fernwartung;Fernzugriff;Fernhilfe;Support;Hilfe;HeiniRemote;remote;

de.pc_heini.HeiniRemoteAgent.metainfo.xml

@@ -3,14 +3,34 @@
   <id>de.pc_heini.HeiniRemoteAgent</id>
   <metadata_license>CC0-1.0</metadata_license>
   <project_license>proprietary</project_license>
-  <name>HeiniRemote Agent</name>
+  <name>PC-Heini Fernwartung</name>
-  <summary>Remote maintenance agent for HeiniRemote</summary>
+  <name xml:lang="en">PC-Heini Remote Support</name>
+  <summary>Fernwartung Ihres Computers durch PC-Heini</summary>
+  <summary xml:lang="en">Remote support for your computer by PC-Heini</summary>
   <description>
     <p>
-      Customer-side agent for HeiniRemote: Wayland screen capture and input
+      Mit diesem Programm kann PC-Heini Ihren Computer aus der Ferne warten:
-      injection via xdg-desktop-portal, plus a PTY rescue console, streamed
+      Bildschirm ansehen, Maus und Tastatur bedienen und bei Bedarf eine
-      over WebRTC to the HeiniRemote management console. Requires a HeiniRemote
+      Konsole nutzen. Nichts passiert ohne Ihre Zustimmung: Vor jeder Sitzung
-      server URL and device token (agent.toml).
+      fragt Ihr System, ob der Bildschirm freigegeben werden darf.
+    </p>
+    <p>
+      Die Verbindung ist Ende-zu-Ende verschlüsselt und läuft über den
+      Fernwartungsserver von PC-Heini. Das Programm läuft unauffällig im
+      Hintergrund und zeigt ein Symbol in der Leiste, solange es aktiv ist.
+    </p>
+  </description>
+  <description xml:lang="en">
+    <p>
+      This program lets PC-Heini service your computer remotely: view the
+      screen, operate mouse and keyboard and, if needed, use a console.
+      Nothing happens without your consent: before every session your system
+      asks whether the screen may be shared.
+    </p>
+    <p>
+      The connection is end-to-end encrypted and goes through PC-Heini's
+      remote support server. The program runs quietly in the background and
+      shows a tray icon while it is active.
     </p>
   </description>
   <launchable type="desktop-id">de.pc_heini.HeiniRemoteAgent.desktop</launchable>

heiniremote.flatpakrepo

@@ -4,6 +4,9 @@ Title=HeiniRemote Agent
 # so the canonical copy to use is:
 #   https://git.pc-heini.de/pc-heini/HeiniRemote-AgentFlatpak/raw/branch/pages/heiniremote.flatpakrepo
 Url=https://git.pc-heini.de/pc-heini/HeiniRemote-AgentFlatpak/raw/branch/pages
+# Lets `flatpak install` pull the freedesktop runtime on a system that has no
+# Flathub remote yet (e.g. a fresh Ubuntu after `apt install flatpak`).
+RuntimeRepo=https://dl.flathub.org/repo/flathub.flatpakrepo
 Homepage=https://pc-heini.de/
 Comment=HeiniRemote remote maintenance agent as a Flatpak
 Description=Install the HeiniRemote agent on any Linux distribution via Flatpak.

host-shell.sh

@@ -9,9 +9,21 @@
 # The inner resolution runs ON THE HOST: flatpak-spawn forwards the sandbox
 # environment, so $SHELL would still point at this script — resolve the user's
 # real login shell from passwd instead and fix up $SHELL before exec'ing it.
-exec flatpak-spawn --host /bin/sh -c '
+#
+# The PTY itself was allocated inside the sandbox (its own devpts instance),
+# so on the host the forwarded fd cannot be named (`tty` fails, no
+# controlling terminal, tools that open /dev/tty break). script(1) allocates a
+# second, host-side PTY for the shell and relays through the forwarded one;
+# util-linux >= 2.35 also passes window-size changes along.
+# flatpak-spawn --host does not forward the caller's environment: without
+# --env the host shell starts with no TERM at all (login scripts then fail
+# in tput and in integer tests on the empty LINES/COLUMNS).
+exec flatpak-spawn --host --env=TERM="${TERM:-xterm-256color}" --env=COLORTERM=truecolor /bin/sh -c '
     shell="$(getent passwd "$(id -un)" | cut -d: -f7)"
     [ -x "$shell" ] || shell=/bin/sh
     export SHELL="$shell"
+    if command -v script >/dev/null 2>&1; then
+        exec script -q -e -c "exec \"$shell\" -l" /dev/null
+    fi
     exec "$shell" -l
 '

scripts/make-flatpak.sh

@@ -16,7 +16,7 @@ set -euo pipefail
 cd "$(dirname "$0")/.."
 
 APP_ID=de.pc_heini.HeiniRemoteAgent
-RUNTIME_VER=24.08
+RUNTIME_VER=25.08
 BRANCH=stable
 AGENT_BIN="${AGENT_BIN:?set AGENT_BIN to the compiled heiniremote-agent}"
 WL_DIR="${WL_CLIPBOARD_DIR:-/usr/bin}"
@@ -72,3 +72,5 @@ flatpak build-export --disable-sandbox repo build-dir "$BRANCH"
 flatpak build-update-repo repo --title="HeiniRemote Agent" --prune --prune-depth=1
 
 echo ">> done: ./repo"
+
+# Touched to trigger a rebuild against upstream f8c509b (2026-09-21).