# envseal desktop (native egui)

Pure Rust UI (`eframe` / **egui**) over OpenGL — no embedded browser or webview IPC boundary.

## Build

From the envseal workspace root:

```bash
cargo check -p envseal-gui --all-targets --locked
cargo build -p envseal-gui --release --locked
```

## Linux dependencies and reproducibility

`envseal-gui` uses `eframe`/`winit`, which can pull Wayland crates even when running X11.

- Install common native prerequisites in CI/dev images (`libwayland-dev`, `wayland-protocols`, `libxkbcommon-dev`, `libx11-dev`).
- Always use `--locked` in release/CI commands so dependency resolution cannot drift between runs.
- Avoid remote rustc wrappers for release checks (`RUSTC_WRAPPER=` / `SCCACHE_DISABLE=1`) so Wayland proc-macros can always read protocol side-files from crate sources.
- If a build fails with `wayland-client` proc-macro errors mentioning missing `wayland.xml`, treat it as a corrupted Cargo registry extraction and refresh only the affected crate cache:

```bash
rm -rf "$CARGO_HOME/registry/src"/*/wayland-client-*
rm -rf "$CARGO_HOME/registry/src"/*/wayland-scanner-*
cargo fetch --locked
```

## Configuration note: `custom_ui_cmd`

Advanced deployments can set **`custom_ui_cmd`** in the vault **security.toml** (same signed file as security tier and lockdown options) so approval and passphrase dialogs run a fixed helper executable instead of the default zenity/kdialog flow.

Setting `custom_ui_cmd` from this app follows the **same rules as the CLI**:

- The path must be **absolute** and must not live under writable locations such as `/tmp`, `/home`, … (validated when the config is loaded or saved).
- At **runtime** (every time the helper is spawned), envseal checks that the path **exists**, is **not a symlink**, and on **Unix** that the target is a **regular file owned by root (uid 0)** and is **not** group- or world-writable.

Do not assume that “putting the script under `/usr`” is enough: a user-owned file in `/usr/local/bin` will still **fail** until ownership and permissions match policy (typically via system packages or root-managed install).

See the root [README.md](../README.md) section **Custom approval UI (`custom_ui_cmd`)** for the threat-model summary.
