kick/tabbed-wlroots.c

/* tabbed-wlroots.c -- nested tabbed compositor built on wlroots 0.19.
 *
 * Renders a headless wlroots output (via wlr_scene) inside a host Wayland
 * window (the "host" connection, e.g. labwc).  Input from the host is
 * forwarded into a wlr_seat, so wlroots handles all sub-surface hit-testing,
 * enter/leave, input regions and coordinate translation.  Clients are always
 * maximized to the host content area; a client's fullscreen request is
 * honored and mirrors onto the host window, and vice versa.
 */

#define _GNU_SOURCE

#include <errno.h>
#include <execinfo.h>
#include <fcntl.h>
#include <linux/memfd.h>
#include <poll.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/poll.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <drm_fourcc.h>

#include <wayland-client.h>
#include <wayland-egl.h>
#include <wayland-server.h>

#include "xdg-decoration-client.h"
#include "xdg-shell-client.h"
#include "wlr-data-control-client.h"

#include <EGL/egl.h>
#include <EGL/eglext.h>
#include <GLES2/gl2.h>
#include <GLES2/gl2ext.h>

#include <xkbcommon/xkbcommon.h>

#include <ft2build.h>
#include FT_FREETYPE_H

#include <cairo.h>
#include <librsvg/rsvg.h>
#include <png.h>

#include <wlr/backend.h>
#include <wlr/backend/headless.h>
#include <wlr/interfaces/wlr_keyboard.h>
#include <wlr/render/allocator.h>
#include <wlr/render/drm_format_set.h>
#include <wlr/render/egl.h>
#include <wlr/render/gles2.h>
#include <wlr/render/swapchain.h>
#include <wlr/render/wlr_renderer.h>
#include <wlr/types/wlr_buffer.h>
#include <wlr/types/wlr_compositor.h>
#include <wlr/types/wlr_data_control_v1.h>
#include <wlr/types/wlr_data_device.h>
#include <wlr/types/wlr_keyboard.h>
#include <wlr/types/wlr_linux_dmabuf_v1.h>
#include <wlr/types/wlr_output.h>
#include <wlr/types/wlr_pointer.h>
#include <wlr/types/wlr_scene.h>
#include <wlr/types/wlr_seat.h>
#include <wlr/types/wlr_shm.h>
#include <wlr/types/wlr_subcompositor.h>
#include <wlr/types/wlr_xdg_shell.h>
#include <wlr/util/log.h>

/* server.apps grows as needed; there is no tab limit. */

/* ===================== Server-side (wlroots) state ===================== */

struct tabbed_app {
    char *cmd;
    pid_t pid;
    struct wlr_xdg_toplevel *toplevel;
    struct wlr_scene_tree *tree;
    struct wl_listener destroy;
    struct wl_listener map;
    struct wl_listener commit;
    struct wl_listener request_maximize;
    struct wl_listener request_fullscreen;
    struct wl_listener request_minimize;
    struct wl_listener request_move;
    struct wl_listener request_resize;

    /* Resolved overlay icon (a GL texture in host pixel space). */
    GLuint icon_tex;
    int icon_w, icon_h;
    bool icon_resolved;   /* true once a load attempt has been made */

    /* Slot created by add_tab() (Ctrl+Shift+T) awaiting its toplevel.  Lets
       handle_new_toplevel claim exactly this slot instead of an earlier
       stale free one (a closed tab's hole), so a new terminal keeps its
       "right of the current tab" position. */
    bool pending_claim;
};

struct tabbed_server {
    struct wl_display *wl_display;
    struct wl_event_loop *loop;
    struct wlr_backend *backend;
    struct wlr_renderer *renderer;
    struct wlr_allocator *allocator;
    struct wlr_scene *scene;
    struct wlr_output *output;
    struct wlr_scene_output *scene_output;
    struct wlr_scene_rect *bg_rect;
    struct wlr_seat *seat;
    struct wlr_xdg_shell *xdg_shell;
    struct wlr_keyboard keyboard;
    struct wlr_swapchain *swapchain;

    struct wl_listener new_output;
    struct wl_listener new_toplevel;
    struct wl_listener new_popup;
    struct wl_listener frame;
    struct wl_event_source *ctl_source;

    struct wlr_xdg_toplevel *active;
    struct tabbed_app **apps;
    int num_apps;
    int apps_cap;

    struct xkb_context *xkb_ctx;
    struct xkb_keymap *xkb_keymap;
    struct xkb_state *xkb_state;
    xkb_mod_index_t xkb_alt_mod;

    /* Mirrors the host window's fullscreen state onto every client. */
    bool clients_fullscreen;
};

/* ===================== Host-side (nested) state ===================== */

/* One cached ASCII glyph in the overlay's font atlas texture. */
struct overlay_glyph {
    int ax, ay;   /* atlas pixel origin */
    int pw, ph;   /* glyph bitmap size */
    int adv;      /* advance width, pixels */
    int top;      /* y offset of the glyph top from the row top */
};

struct tabbed_host {
    struct wl_display *display;
    struct wl_registry *registry;
    struct wl_compositor *compositor;
    struct wl_surface *surface;
    struct xdg_wm_base *wm_base;
    struct xdg_surface *xdg_surface;
    struct xdg_toplevel *toplevel;
    struct zxdg_decoration_manager_v1 *decoration;
    struct zxdg_toplevel_decoration_v1 *decoration_obj;
    struct wl_seat *seat;
    struct wl_keyboard *keyboard;
    struct wl_pointer *pointer;
    bool configured;
    bool fullscreen;
    int width, height;
    /* EGL */
    bool egl_ok;
    EGLDisplay egl_display;
    EGLConfig egl_config;
    EGLContext egl_context;
    EGLSurface egl_surface;
    struct wl_egl_window *egl_window;
    /* host modifiers (for tab-switch detection) */
    uint32_t host_mods_depressed;
    uint32_t axis_source;
    int32_t axis_discrete[2];
    /* GL program */
    GLuint gl_program;
    GLint gl_pos_loc, gl_uv_loc, gl_tex_loc, gl_color_loc;
    GLuint import_tex;
    /* Alt-held tab-title overlay */
    bool overlay_visible;
    GLuint overlay_atlas_tex;
    GLuint overlay_white_tex;
    int overlay_atlas_w, overlay_atlas_h;
    struct overlay_glyph overlay_glyphs[95]; /* chars 32..126 */
    int overlay_font_h;                     /* ascent + descent, pixels */
    /* Present gating: at most one buffer aimed at the host compositor at a
       time, paced by the host surface's wl_callback. */
    struct wl_callback *frame_cb;
    bool present_pending;
    bool back_dirty;
    /* Keybind repeat for the captured tab-switch binding.  The host
       compositor only sends one physical press, so we drive the repeat
       ourselves with a timer (fixed delay/rate), like labwc does for its
       own keybinds. */
    struct wl_event_source *repeat_timer;
    uint32_t repeat_key;
    int repeat_dir;
};

static struct tabbed_server server;
static struct tabbed_host host;
static char tabbed_socket[64];
static char socket_path[256];
static volatile sig_atomic_t needs_redraw;
static bool frame_pending;
static bool shutting_down;

/* Terminal launched for the Ctrl+Shift+T "new tab" binding.  Defaults to
   alacritty (sane no-config font size, unlike foot's 8pt); overridable via
   the $TERMINAL environment variable.  The value is used verbatim by sh -c,
   so it may carry arguments. */
static const char *term_cmd = "alacritty";
static bool term_key_held;   /* Ctrl+Shift+T currently down (repeat latch) */

/* ===================== Clipboard bridge ===================== */

enum bridge_backend {
    BRIDGE_BACKEND_NONE = 0,
    BRIDGE_BACKEND_DATA_CONTROL,
    BRIDGE_BACKEND_WL_DATA_DEVICE,
};

/* Bridges the nested seat's clipboard with the host compositor's.  Two host
   backends share one inner (nested-seat) implementation:
     - data-control: zwlr_data_control_v1 (labwc/sway/etc.), full duplex,
       independent of keyboard focus.
     - wl_data_device: plain stable protocol (Mutter/GNOME fallback).  Writing
       the host selection always works (needs a captured keyboard serial);
       reading the host selection only works while our window is focused.
   Data flows by passing file descriptors straight through in both directions
   (host offer -> nested source, nested source -> host source), so no
   intermediate copy is needed. */
struct clipboard_bridge {
    enum bridge_backend backend;

    /* nested (wlroots) seat */
    struct wl_listener request_set_selection;
    struct wl_listener set_selection;

    /* the nested selection source currently mirrored to the host; serves
       host paste requests until it is destroyed */
    struct wlr_data_source *inner_src;
    struct wl_listener inner_src_destroy;
    bool inner_clear_requested; /* nested client asked to clear the selection */
    bool ignore_next_inner;     /* one-shot echo guard for host->nested clears */

    /* host: standard wl_data_device (always bound; the fallback backend) */
    struct wl_data_device_manager *ddm;
    struct wl_data_device *dd;
    struct wl_data_source *dd_source;    /* our host-side source (nested copy) */
    struct wl_data_offer *dd_offer;      /* current host selection offer */
    struct wl_data_offer *dd_echo_offer; /* offer describing our own set */
    uint32_t kbd_serial;                 /* last host keyboard/enter serial */

    /* host: wlr-data-control backend (if the host exposes it) */
    struct zwlr_data_control_manager_v1 *dc_manager;
    struct zwlr_data_control_device_v1 *dc_device;
    struct zwlr_data_control_source_v1 *dc_source;
    struct zwlr_data_control_offer_v1 *dc_offer;
    struct zwlr_data_control_offer_v1 *dc_echo_offer;

    /* MIME list currently being collected from a host offer */
    char **mimes;
    size_t mimes_len, mimes_cap;
    bool dc_pending_echo; /* our own set via data-control: echo not yet consumed */
    bool dd_pending_echo; /* our own set via wl_data_device: echo not yet consumed */
    bool host_set_pending; /* nested selection not yet on the host; retry on focus */

    /* Eager text prefetch: when a real host selection is mirrored, its primary
       text MIME is pulled into this buffer at copy time so pastes are served
       instantly instead of asking the host for each one. */
    int prefetch_fd;                 /* pipe read end, -1 when idle */
    struct wl_event_source *prefetch_src;
    char *prefetch_buf;
    size_t prefetch_len, prefetch_cap;
    char prefetch_mime[64];          /* canonical text MIME, "" if none */
    bool prefetch_ready;             /* buffer complete (EOF received) */
};

static struct clipboard_bridge bridge = { .prefetch_fd = -1 };

static void bridge_cleanup(void);
static void bridge_init(void);
static void bridge_attach_seat(void);

/* Frame dumps: SIGUSR1 (or TABBED_AUTODUMP) requests a scene-buffer save
   (client content as wlroots drew it) and a host back-buffer save (what we
   composited for the host) on the next frame. */
static volatile sig_atomic_t dump_scene_req, dump_host_req;
static int dump_seq;
static bool client_dumped = false;

static void set_active_surface(struct wlr_xdg_toplevel *toplevel);
static void render_and_present(void);
static struct tabbed_app *app_for_toplevel(struct wlr_xdg_toplevel *toplevel);
static int app_index(struct tabbed_app *app);
static int add_tab(const char *cmd);

/* Logging levels: quiet by default so a plain launch writes nothing to the
   launching terminal except fatal errors.  TABBED_LOG=1 shows status lines,
   TABBED_LOG=2 adds the per-frame [diag] trace.  SIGUSR1 and TABBED_AUTODUMP
   dumps always write their .ppm files regardless of level. */
enum { TABBED_LOG_QUIET = 0, TABBED_LOG_INFO = 1, TABBED_LOG_DEBUG = 2 };

static int tabbed_log_level(void) {
    static volatile sig_atomic_t level = -1;
    if (level < 0) {
        const char *v = getenv("TABBED_LOG");
        int l = v ? atoi(v) : 0;
        if (l < TABBED_LOG_QUIET) l = TABBED_LOG_QUIET;
        if (l > TABBED_LOG_DEBUG) l = TABBED_LOG_DEBUG;
        level = l;
    }
    return level;
}

static void tabbed_vlog(int level, const char *fmt, va_list args) {
    if (level > tabbed_log_level())
        return;
    vfprintf(stderr, fmt, args);
}

static void tabbed_log(int level, const char *fmt, ...) {
    va_list args;
    va_start(args, fmt);
    tabbed_vlog(level, fmt, args);
    va_end(args);
}

/* Route libxkbcommon's own log output (which otherwise writes
   "xkbcommon: ERROR: ..." straight to stderr, bypassing TABBED_LOG) through
   our level system.  Errors surface at info level; warnings and below are
   debug-only, so a quiet launch no longer leaks parse failures to the
   launching terminal. */
static void tabbed_xkb_log(struct xkb_context *ctx, enum xkb_log_level level,
                           const char *fmt, va_list args)
{
    (void)ctx;
    int l = (level <= XKB_LOG_LEVEL_ERROR) ? TABBED_LOG_INFO : TABBED_LOG_DEBUG;
    if (l > tabbed_log_level())
        return;
    fputs("tabbed-wlroots: xkbcommon: ", stderr);
    vfprintf(stderr, fmt, args);
}

static void tabbed_log_level_init(void) {
    (void)tabbed_log_level();
}

/* Terminate every launched client: SIGTERM first for a graceful shutdown,
   then SIGKILL any stragglers after a short grace period. */
static void terminate_clients(void) {
    for (int i = 0; i < server.num_apps; i++) {
        if (server.apps[i]->pid > 0)
            kill(-server.apps[i]->pid, SIGTERM);
    }
    struct timespec wait = { .tv_sec = 0, .tv_nsec = 150000000 };
    nanosleep(&wait, NULL);
    for (int i = 0; i < server.num_apps; i++) {
        if (server.apps[i]->pid > 0)
            kill(-server.apps[i]->pid, SIGKILL);
    }
}

/* Remove the session's Wayland socket file (and its companion .lock file,
   both created by wl_display_add_socket), if present.  The full path is
   precomputed at startup so this only ever calls unlink()/snprintf(), which
   are async-signal-safe and therefore safe from the signal/crash handlers
   too.  A missing file is fine: ENOENT is ignored, i.e. nothing to clean. */
static void remove_socket_file(void) {
    unlink(socket_path);
    char lock_path[sizeof(socket_path) + 6];
    snprintf(lock_path, sizeof(lock_path), "%s.lock", socket_path);
    unlink(lock_path);
}

static void overlay_font_fini(void);

/* Grow server.apps to hold at least n entries.  Returns 0 on success, -1 on
   allocation failure.  The buffer is freed in shutdown_cleanup(). */
static int apps_ensure_cap(int n) {
    if (n <= server.apps_cap) return 0;
    struct tabbed_app **grown =
        realloc(server.apps, (size_t)n * sizeof(*grown));
    if (!grown) return -1;
    server.apps = grown;
    server.apps_cap = n;
    return 0;
}

/* Full shutdown of the nested session: take down the clients first, then
   free our own allocations and exit. Guarded so the various close paths
   (host window close, last tab closed) only run once. */
static void shutdown_cleanup(void) {
    if (shutting_down) return;
    shutting_down = true;
    terminate_clients();
    for (int i = 0; i < server.num_apps; i++) {
        if (host.egl_ok && server.apps[i]->icon_tex) {
            glDeleteTextures(1, &server.apps[i]->icon_tex);
            server.apps[i]->icon_tex = 0;
        }
        free(server.apps[i]->cmd);
        free(server.apps[i]);
    }
    free(server.apps);
    server.apps = NULL;
    if (server.xkb_state) xkb_state_unref(server.xkb_state);
    if (server.xkb_keymap) xkb_keymap_unref(server.xkb_keymap);
    if (server.xkb_ctx) xkb_context_unref(server.xkb_ctx);
    overlay_font_fini();
    bridge_cleanup();
    remove_socket_file();
}

/* ===================== EGL helpers ===================== */

static PFNEGLCREATEIMAGEKHRPROC pfn_eglCreateImageKHR;
static PFNEGLDESTROYIMAGEKHRPROC pfn_eglDestroyImageKHR;
static PFNEGLGETPLATFORMDISPLAYEXTPROC pfn_eglGetPlatformDisplayEXT;
static PFNGLEGLIMAGETARGETTEXTURE2DOESPROC pfn_glEGLImageTargetTexture2DOES;

static void *egl_proc(const char *name) {
    void *p = (void *)eglGetProcAddress(name);
    if (!p)
        fprintf(stderr, "tabbed-wlroots: EGL proc %s unavailable\n", name);
    return p;
}

static GLuint compile_shader(GLenum type, const char *src) {
    GLuint sh = glCreateShader(type);
    glShaderSource(sh, 1, &src, NULL);
    glCompileShader(sh);
    GLint ok;
    glGetShaderiv(sh, GL_COMPILE_STATUS, &ok);
    if (!ok) {
        char log[512];
        glGetShaderInfoLog(sh, sizeof(log), NULL, log);
        fprintf(stderr, "tabbed-wlroots: shader error: %s\n", log);
        glDeleteShader(sh);
        return 0;
    }
    return sh;
}

static bool gl_setup(void) {
    const char *vs =
        "attribute vec2 a_pos;\n"
        "attribute vec2 a_uv;\n"
        "varying vec2 v_uv;\n"
        "void main() {\n"
        "  v_uv = a_uv;\n"
        "  gl_Position = vec4(a_pos, 0.0, 1.0);\n"
        "}\n";
    const char *fs =
        "precision mediump float;\n"
        "varying vec2 v_uv;\n"
        "uniform sampler2D u_tex;\n"
        "uniform vec4 u_color;\n"
        "void main() {\n"
        "  gl_FragColor = texture2D(u_tex, v_uv) * u_color;\n"
        "}\n";
    GLuint vsh = compile_shader(GL_VERTEX_SHADER, vs);
    GLuint fsh = compile_shader(GL_FRAGMENT_SHADER, fs);
    if (!vsh || !fsh) return false;
    host.gl_program = glCreateProgram();
    glAttachShader(host.gl_program, vsh);
    glAttachShader(host.gl_program, fsh);
    glBindAttribLocation(host.gl_program, 0, "a_pos");
    glBindAttribLocation(host.gl_program, 1, "a_uv");
    glLinkProgram(host.gl_program);
    GLint ok;
    glGetProgramiv(host.gl_program, GL_LINK_STATUS, &ok);
    glDeleteShader(vsh);
    glDeleteShader(fsh);
    if (!ok) {
        char log[512];
        glGetProgramInfoLog(host.gl_program, sizeof(log), NULL, log);
        fprintf(stderr, "tabbed-wlroots: link error: %s\n", log);
        return false;
    }
    host.gl_pos_loc = glGetAttribLocation(host.gl_program, "a_pos");
    host.gl_uv_loc = glGetAttribLocation(host.gl_program, "a_uv");
    host.gl_tex_loc = glGetUniformLocation(host.gl_program, "u_tex");
    host.gl_color_loc = glGetUniformLocation(host.gl_program, "u_color");

    glGenTextures(1, &host.import_tex);
    glBindTexture(GL_TEXTURE_2D, host.import_tex);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
    glBindTexture(GL_TEXTURE_2D, 0);

    glGenTextures(1, &host.overlay_white_tex);
    glBindTexture(GL_TEXTURE_2D, host.overlay_white_tex);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
    const GLubyte white_px[4] = { 255, 255, 255, 255 };
    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, 1, 1, 0, GL_RGBA,
                 GL_UNSIGNED_BYTE, white_px);
    glBindTexture(GL_TEXTURE_2D, 0);
    return true;
}

/* Blit a source rect of a texture into the window at the given destination
   rect (dst_x, dst_y, dst_w, dst_h, window coords), clipped to the window.
   The source is stretched uniformly to the destination (1:1 when the rects
   match).  The draw is tinted by `color` (RGBA), so solid rects are drawn
   from a 1x1 white texture and text glyphs from the font atlas. */
static void draw_texture_rect(GLuint tex, int tex_w, int tex_h,
                              int src_x, int src_y, int src_w, int src_h,
                              int dst_x, int dst_y, int dst_w, int dst_h,
                              int win_w, int win_h, const GLfloat color[4])
{
    if (win_w <= 0 || win_h <= 0) return;
    if (src_w <= 0 || src_h <= 0 || dst_w <= 0 || dst_h <= 0) return;
    if (src_x >= tex_w || src_y >= tex_h) return;
    if (src_w > tex_w - src_x) src_w = tex_w - src_x;
    if (src_h > tex_h - src_y) src_h = tex_h - src_y;
    int cx = dst_x < 0 ? -dst_x : 0;
    int cy = dst_y < 0 ? -dst_y : 0;
    if (cx >= dst_w || cy >= dst_h) return;
    int wx0 = dst_x + cx;
    int wy0 = dst_y + cy;
    int cw = dst_w - cx;
    int ch = dst_h - cy;
    int maxw = win_w - wx0;
    int maxh = win_h - wy0;
    if (cw > maxw) cw = maxw;
    if (ch > maxh) ch = maxh;
    if (cw <= 0 || ch <= 0) return;

    float u0 = ((float)src_x + (float)src_w * cx / dst_w) / (float)tex_w;
    float u1 = ((float)src_x + (float)src_w * (cx + cw) / dst_w) / (float)tex_w;
    float v0 = ((float)src_y + (float)src_h * cy / dst_h) / (float)tex_h;
    float v1 = ((float)src_y + (float)src_h * (cy + ch) / dst_h) / (float)tex_h;

    float nx0 = -1.0f + 2.0f * (float)wx0 / (float)win_w;
    float ny0 = 1.0f - 2.0f * (float)wy0 / (float)win_h;
    float nx1 = -1.0f + 2.0f * (float)(wx0 + cw) / (float)win_w;
    float ny1 = 1.0f - 2.0f * (float)(wy0 + ch) / (float)win_h;

    GLfloat verts[8] = {
        nx0, ny0,
        nx1, ny0,
        nx1, ny1,
        nx0, ny1,
    };
    GLfloat uvs[8] = {
        u0, v0,
        u1, v0,
        u1, v1,
        u0, v1,
    };
    GLushort idx[6] = { 0, 1, 2, 0, 2, 3 };

    glUseProgram(host.gl_program);
    glActiveTexture(GL_TEXTURE0);
    glBindTexture(GL_TEXTURE_2D, tex);
    glUniform1i(host.gl_tex_loc, 0);
    glUniform4fv(host.gl_color_loc, 1, color);

    glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, verts);
    glEnableVertexAttribArray(0);
    glVertexAttribPointer(1, 2, GL_FLOAT, GL_FALSE, 0, uvs);
    glEnableVertexAttribArray(1);

    glDrawElements(GL_TRIANGLES, 6, GL_UNSIGNED_SHORT, idx);

    glDisableVertexAttribArray(0);
    glDisableVertexAttribArray(1);
}

/* ============ Alt-held tab-title overlay ============
   While the host Alt modifier is held, a passive list of tab titles is
   drawn into the top-left of the host window with the active tab
   highlighted.  Up/Down already cycle tabs while Alt is held, so the
   highlight follows server.active automatically.  Titles are read from the
   wlr_xdg_toplevel at draw time (terminals retitle themselves), so no
   per-client listeners are needed. */

static FT_Library overlay_ft_lib;
static FT_Face overlay_ft_face;
static bool overlay_font_ok;

/* Fixed rasterized font size; 30px is twice the original 15px constant. */
#define OVERLAY_FONT_PX 30

static const char *overlay_pick_font(void) {
    static const char *const paths[] = {
        "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf",
        "/usr/share/fonts/dejavu/DejaVuSans.ttf",
        "/usr/share/fonts/TTF/DejaVuSans.ttf",
        "/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf",
        "/usr/share/fonts/truetype/liberation2/LiberationSans-Regular.ttf",
        "/usr/share/fonts/liberation/LiberationSans-Regular.ttf",
        "/usr/share/fonts/noto/NotoSans-Regular.ttf",
    };
    const char *env = getenv("TABBED_FONT");
    if (env && access(env, R_OK) == 0)
        return env;
    for (size_t i = 0; i < sizeof(paths) / sizeof(paths[0]); i++)
        if (access(paths[i], R_OK) == 0)
            return paths[i];
    return NULL;
}

/* Build the ASCII glyph atlas (chars 32..126) from the chosen system font.
   Must be called with the host EGL context current.  Non-fatal: on failure
   the overlay still renders its boxes, just without text. */
static void overlay_font_init(void) {
    int px = OVERLAY_FONT_PX;
    static const char *overlay_font_path = NULL;
    if (!overlay_ft_lib) {
        const char *path = overlay_pick_font();
        if (!path) {
            tabbed_log(TABBED_LOG_INFO, "[overlay] no font found; "
                    "set TABBED_FONT to enable overlay text\n");
            return;
        }
        overlay_font_path = path;
        if (FT_Init_FreeType(&overlay_ft_lib) != 0) {
            tabbed_log(TABBED_LOG_INFO, "[overlay] FreeType init failed\n");
            return;
        }
        if (FT_New_Face(overlay_ft_lib, path, 0, &overlay_ft_face) != 0) {
            tabbed_log(TABBED_LOG_INFO, "[overlay] cannot load font %s\n", path);
            FT_Done_FreeType(overlay_ft_lib);
            overlay_ft_lib = NULL;
            return;
        }
    }
    if (FT_Set_Pixel_Sizes(overlay_ft_face, 0, px) != 0) {
        tabbed_log(TABBED_LOG_INFO, "[overlay] cannot set pixel size %d\n", px);
        return;
    }

    int height = (int)(overlay_ft_face->size->metrics.height / 64.0f) + 1;
    int asc = (int)(overlay_ft_face->size->metrics.ascender / 64.0f);
    int adv_max = 0;
    for (int c = 32; c <= 126; c++) {
        if (FT_Load_Char(overlay_ft_face, c, FT_LOAD_DEFAULT) == 0) {
            int adv = (int)(overlay_ft_face->glyph->advance.x / 64.0f);
            if (adv > adv_max) adv_max = adv;
        }
    }
    if (adv_max <= 0) adv_max = 8;
    int cell_w = adv_max + 3;
    int cell_h = height + 3;
    int cols = 16;
    int rows = (95 + cols - 1) / cols;
    int atlas_w = cols * cell_w;
    int atlas_h = rows * cell_h;

    unsigned char *atlas = calloc((size_t)atlas_w * atlas_h * 2, 1);
    if (!atlas) {
        tabbed_log(TABBED_LOG_INFO, "[overlay] atlas alloc failed\n");
        return;
    }
    int n_glyphs = 0;
    for (int c = 32; c <= 126; c++) {
        struct overlay_glyph *g = &host.overlay_glyphs[c - 32];
        if (FT_Load_Char(overlay_ft_face, c, FT_LOAD_RENDER) != 0)
            continue;
        FT_Bitmap *bmp = &overlay_ft_face->glyph->bitmap;
        /* A bitmap wider/taller than its cell would corrupt the glyphs it
           spills into; skip such glyphs rather than damage the atlas. */
        if ((int)bmp->width > cell_w - 2 || (int)bmp->rows > cell_h - 2)
            continue;
        int cell = c - 32;
        int cx = (cell % cols) * cell_w;
        int cy = (cell / cols) * cell_h;
        g->ax = cx + 1;
        g->ay = cy + 1;
        g->pw = bmp->width;
        g->ph = bmp->rows;
        g->adv = (int)(overlay_ft_face->glyph->advance.x / 64.0f);
        g->top = asc - overlay_ft_face->glyph->bitmap_top;
        /* Cells are GL_LUMINANCE_ALPHA, so each 8-bit alpha is duplicated. */
        for (int r = 0; r < (int)bmp->rows; r++) {
            const unsigned char *src = bmp->buffer + (size_t)r * bmp->pitch;
            unsigned char *dst = atlas
                + ((size_t)(g->ay + r) * atlas_w + g->ax) * 2;
            for (int x = 0; x < (int)bmp->width; x++) {
                dst[x * 2 + 0] = src[x];
                dst[x * 2 + 1] = src[x];
            }
        }
        n_glyphs++;
    }
    if (n_glyphs == 0) {
        free(atlas);
        return;
    }

    if (!host.overlay_atlas_tex)
        glGenTextures(1, &host.overlay_atlas_tex);
    glBindTexture(GL_TEXTURE_2D, host.overlay_atlas_tex);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
    glTexImage2D(GL_TEXTURE_2D, 0, GL_LUMINANCE_ALPHA, atlas_w, atlas_h, 0,
                 GL_LUMINANCE_ALPHA, GL_UNSIGNED_BYTE, atlas);
    glBindTexture(GL_TEXTURE_2D, 0);
    free(atlas);
    host.overlay_atlas_w = atlas_w;
    host.overlay_atlas_h = atlas_h;
    host.overlay_font_h = height;
    overlay_font_ok = true;
    tabbed_log(TABBED_LOG_INFO, "[overlay] font %s glyphs=%d atlas=%dx%d\n",
            overlay_font_path, n_glyphs, atlas_w, atlas_h);
}

static void overlay_font_fini(void) {
    if (overlay_ft_face) {
        FT_Done_Face(overlay_ft_face);
        overlay_ft_face = NULL;
    }
    if (overlay_ft_lib) {
        FT_Done_FreeType(overlay_ft_lib);
        overlay_ft_lib = NULL;
    }
    overlay_font_ok = false;
}

/* ===================== Overlay app icons ===================== */

/* Drawn square of the icon slot, in host pixels. */
#define OVERLAY_ICON_SZ 28
#ifndef MIN
#define MIN(a, b) ((a) < (b) ? (a) : (b))
#endif

static char *overlay_strndup(const char *s, size_t n) {
    char *r = malloc(n + 1);
    if (r) {
        memcpy(r, s, n);
        r[n] = '\0';
    }
    return r;
}

static bool overlay_endswith(const char *s, const char *suffix) {
    size_t ls = strlen(s), lx = strlen(suffix);
    return ls >= lx && strcmp(s + ls - lx, suffix) == 0;
}

/* Read the Icon= value (case-sensitive, not the localized Icon[lang]= form)
   out of a .desktop file, malloc'd, or NULL. */
static char *desktop_icon_from_file(FILE *f) {
    char line[1024];
    while (fgets(line, sizeof(line), f)) {
        if (strncmp(line, "Icon=", 5) != 0)
            continue;
        if (line[5] == '[')   /* Icon[locale]= */
            continue;
        size_t n = strlen(line);
        while (n > 5 && (line[n - 1] == '\n' || line[n - 1] == '\r' ||
                         line[n - 1] == ' ' || line[n - 1] == '\t'))
            n--;
        return overlay_strndup(line + 5, n - 5);
    }
    return NULL;
}

/* Find `<app_id>.desktop` under an XDG data dir and return its Icon= value,
   or NULL. */
static char *desktop_icon_name(const char *app_id) {
    const char *data_home = getenv("XDG_DATA_HOME");
    const char *data_dirs = getenv("XDG_DATA_DIRS");
    if (!data_dirs || !data_dirs[0])
        data_dirs = "/usr/local/share:/usr/share";
    char buf[4096];

    if (data_home && data_home[0]) {
        snprintf(buf, sizeof(buf), "%s/applications/%s.desktop",
                 data_home, app_id);
        FILE *f = fopen(buf, "r");
        if (f) {
            char *icon = desktop_icon_from_file(f);
            fclose(f);
            if (icon) return icon;
        }
    }
    char *copy = strdup(data_dirs);
    if (!copy) return NULL;
    for (char *p = copy, *dir; p; p = dir) {
        dir = strchr(p, ':');
        if (dir) *dir++ = '\0';
        if (p[0]) {
            snprintf(buf, sizeof(buf), "%s/applications/%s.desktop", p, app_id);
            FILE *f = fopen(buf, "r");
            if (f) {
                char *icon = desktop_icon_from_file(f);
                fclose(f);
                if (icon) {
                    free(copy);
                    return icon;
                }
            }
        }
    }
    free(copy);
    return NULL;
}

/* Turn an Icon= value (theme name, bare filename or absolute path) into a
   loadable .png/.svg path, or NULL. */
static char *overlay_find_icon_file(const char *name) {
    static const char *const themes[] = { "Adwaita", "hicolor", "default" };
    static const char *const sizes[] =
        { "scalable", "48x48", "32x32", "24x24" };
    static const char *const exts[] = { "png", "svg" };
    char roots[8][512];
    int n_roots = 0;
    const char *data_home = getenv("XDG_DATA_HOME");
    const char *data_dirs = getenv("XDG_DATA_DIRS");
    if (data_home && data_home[0] && n_roots < 8)
        snprintf(roots[n_roots++], sizeof(roots[0]), "%s/icons", data_home);
    if (!data_dirs || !data_dirs[0])
        data_dirs = "/usr/local/share:/usr/share";
    char *copy = strdup(data_dirs);
    for (char *p = copy, *dir; p && n_roots < 8; p = dir) {
        dir = strchr(p, ':');
        if (dir) *dir++ = '\0';
        if (p[0])
            snprintf(roots[n_roots++], sizeof(roots[0]), "%s/icons", p);
    }
    free(copy);

    if (strchr(name, '/') && access(name, R_OK) == 0 &&
            (overlay_endswith(name, ".png") ||
             overlay_endswith(name, ".svg")))
        return strdup(name);

    char buf[4096];
    for (int tr = 0; tr < n_roots; tr++) {
        for (size_t t = 0; t < sizeof(themes) / sizeof(themes[0]); t++) {
            for (size_t s = 0; s < sizeof(sizes) / sizeof(sizes[0]); s++) {
                for (size_t e = 0; e < sizeof(exts) / sizeof(exts[0]); e++) {
                    snprintf(buf, sizeof(buf), "%s/%s/%s/apps/%s.%s",
                             roots[tr], themes[t], sizes[s], name, exts[e]);
                    if (access(buf, R_OK) == 0)
                        return strdup(buf);
                }
            }
        }
    }
    static const char *const pixmap_roots[] = {
        "/usr/share/pixmaps", "/usr/local/share/pixmaps",
    };
    for (size_t pr = 0; pr < sizeof(pixmap_roots) / sizeof(pixmap_roots[0]); pr++) {
        for (size_t e = 0; e < sizeof(exts) / sizeof(exts[0]); e++) {
            snprintf(buf, sizeof(buf), "%s/%s.%s", pixmap_roots[pr], name, exts[e]);
            if (access(buf, R_OK) == 0)
                return strdup(buf);
        }
    }
    return NULL;
}

/* Decode a PNG into straight (non-premultiplied) RGBA8, malloc'd. */
static unsigned char *overlay_load_png(const char *path, int *w, int *h) {
    FILE *f = fopen(path, "rb");
    if (!f) return NULL;
    png_structp png = png_create_read_struct(PNG_LIBPNG_VER_STRING, NULL, NULL,
                                             NULL);
    if (!png) {
        fclose(f);
        return NULL;
    }
    png_infop info = png_create_info_struct(png);
    if (!info) {
        png_destroy_read_struct(&png, NULL, NULL);
        fclose(f);
        return NULL;
    }
    if (setjmp(png_jmpbuf(png))) {
        png_destroy_read_struct(&png, &info, NULL);
        fclose(f);
        return NULL;
    }
    png_init_io(png, f);
    png_read_info(png, info);
    int bw = (int)png_get_image_width(png, info);
    int bh = (int)png_get_image_height(png, info);
    png_byte ct = png_get_color_type(png, info);
    png_byte bd = png_get_bit_depth(png, info);
    if (ct == PNG_COLOR_TYPE_PALETTE)
        png_set_palette_to_rgb(png);
    if (ct == PNG_COLOR_TYPE_GRAY && bd < 8)
        png_set_expand_gray_1_2_4_to_8(png);
    if (png_get_valid(png, info, PNG_INFO_tRNS))
        png_set_tRNS_to_alpha(png);
    if (bd == 16)
        png_set_strip_16(png);
    if (ct == PNG_COLOR_TYPE_RGB || ct == PNG_COLOR_TYPE_GRAY)
        png_set_filler(png, 0xff, PNG_FILLER_AFTER);
    if (ct == PNG_COLOR_TYPE_GRAY || ct == PNG_COLOR_TYPE_GRAY_ALPHA)
        png_set_gray_to_rgb(png);
    png_read_update_info(png, info);

    size_t rowbytes = png_get_rowbytes(png, info);
    size_t size = (size_t)bh * rowbytes;
    unsigned char *rgba = malloc(size);
    if (!rgba) {
        png_destroy_read_struct(&png, &info, NULL);
        fclose(f);
        return NULL;
    }
    png_bytep *rows = malloc(sizeof(png_bytep) * (size_t)bh);
    if (!rows) {
        free(rgba);
        png_destroy_read_struct(&png, &info, NULL);
        fclose(f);
        return NULL;
    }
    for (int y = 0; y < bh; y++)
        rows[y] = rgba + (size_t)y * rowbytes;
    png_read_image(png, rows);
    free(rows);
    png_destroy_read_struct(&png, &info, NULL);
    fclose(f);
    *w = bw;
    *h = bh;
    return rgba;
}

/* Decode an SVG into straight RGBA8 at its intrinsic size, malloc'd. */
static unsigned char *overlay_load_svg(const char *path, int *w, int *h) {
    GError *err = NULL;
    RsvgHandle *handle = rsvg_handle_new_from_file(path, &err);
    if (!handle || err) {
        if (err) g_error_free(err);
        return NULL;
    }
    double iw = 0, ih = 0;
    if (!rsvg_handle_get_intrinsic_size_in_pixels(handle, &iw, &ih))
        iw = ih = 48.0;   /* dimension-less SVG: assume an icon-sized square */
    if (iw <= 0 || ih <= 0) {
        g_object_unref(handle);
        return NULL;
    }
    int bw = (int)iw, bh = (int)ih;
    cairo_surface_t *surf =
        cairo_image_surface_create(CAIRO_FORMAT_ARGB32, bw, bh);
    if (cairo_surface_status(surf) != CAIRO_STATUS_SUCCESS) {
        cairo_surface_destroy(surf);
        g_object_unref(handle);
        return NULL;
    }
    cairo_t *cr = cairo_create(surf);
    RsvgRectangle viewport = { 0, 0, iw, ih };
    if (!rsvg_handle_render_document(handle, cr, &viewport, &err)) {
        if (err) g_error_free(err);
        cairo_destroy(cr);
        cairo_surface_destroy(surf);
        g_object_unref(handle);
        return NULL;
    }
    cairo_destroy(cr);
    cairo_surface_flush(surf);

    /* Cairo's ARGB32 is premultiplied, little-endian byte order B,G,R,A. */
    int n = bw * bh;
    unsigned char *rgba = malloc(sizeof(unsigned char) * 4 * (size_t)n);
    if (rgba) {
        unsigned char *src = cairo_image_surface_get_data(surf);
        for (int i = 0; i < n; i++) {
            unsigned char a = src[i * 4 + 3];
            unsigned char r = src[i * 4 + 2];
            unsigned char g = src[i * 4 + 1];
            unsigned char b = src[i * 4 + 0];
            if (a > 0) {
                r = (unsigned char)MIN((r * 255 + a / 2) / a, 255);
                g = (unsigned char)MIN((g * 255 + a / 2) / a, 255);
                b = (unsigned char)MIN((b * 255 + a / 2) / a, 255);
            }
            rgba[i * 4 + 0] = r;
            rgba[i * 4 + 1] = g;
            rgba[i * 4 + 2] = b;
            rgba[i * 4 + 3] = a;
        }
    }
    cairo_surface_destroy(surf);
    g_object_unref(handle);
    *w = bw;
    *h = bh;
    return rgba;
}

/* Resolve and upload `app`'s icon as a GL_RGBA texture (host EGL context
   must be current).  Best-effort: on any failure the app keeps no icon and
   the overlay draws the placeholder instead. */
static void overlay_icon_load(struct tabbed_app *app) {
    app->icon_resolved = true;
    const char *app_id = app->toplevel ? app->toplevel->app_id : NULL;
    if (!app_id || !app_id[0])
        return;

    char *icon = desktop_icon_name(app_id);
    char *path = overlay_find_icon_file(icon ? icon : app_id);
    free(icon);
    if (!path)
        return;

    int w = 0, h = 0;
    unsigned char *rgba = NULL;
    if (overlay_endswith(path, ".svg"))
        rgba = overlay_load_svg(path, &w, &h);
    else if (overlay_endswith(path, ".png"))
        rgba = overlay_load_png(path, &w, &h);
    free(path);
    if (!rgba || w <= 0 || h <= 0) {
        free(rgba);
        return;
    }

    GLuint tex;
    glGenTextures(1, &tex);
    glBindTexture(GL_TEXTURE_2D, tex);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
    glPixelStorei(GL_UNPACK_ALIGNMENT, 1);
    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, w, h, 0,
                 GL_RGBA, GL_UNSIGNED_BYTE, rgba);
    glBindTexture(GL_TEXTURE_2D, 0);
    free(rgba);
    app->icon_tex = tex;
    app->icon_w = w;
    app->icon_h = h;
    tabbed_log(TABBED_LOG_INFO, "[overlay] icon %s %dx%d\n", app_id, w, h);
}

static void draw_rect(int x, int y, int w, int h,
                      float r, float g, float b, float a)
{
    if (w <= 0 || h <= 0) return;
    GLfloat color[4] = { r, g, b, a };
    draw_texture_rect(host.overlay_white_tex, 1, 1,
                      0, 0, 1, 1, x, y, w, h, host.width, host.height, color);
}

/* Draw `s` at (x, y) (window coords, y is the row top) tinted by `color`.
   Non-ASCII characters are skipped with a narrow advance. */
static void draw_text(const char *s, int x, int y,
                      float r, float g, float b, float a)
{
    if (!overlay_font_ok) return;
    GLfloat color[4] = { r, g, b, a };
    int pen = x;
    for (const unsigned char *p = (const unsigned char *)s; *p; p++) {
        int c = *p;
        if (c < 32 || c > 126) {
            pen += 4;
            continue;
        }
        struct overlay_glyph *glyph = &host.overlay_glyphs[c - 32];
        draw_texture_rect(host.overlay_atlas_tex, host.overlay_atlas_w,
                          host.overlay_atlas_h,
                          glyph->ax, glyph->ay, glyph->pw, glyph->ph,
                          pen, y + glyph->top, glyph->pw, glyph->ph,
                          host.width, host.height, color);
        pen += glyph->adv;
    }
}

static int overlay_text_width(const char *s) {
    if (!overlay_font_ok) return 0;
    int w = 0;
    for (const unsigned char *p = (const unsigned char *)s; *p; p++) {
        int c = *p;
        if (c < 32 || c > 126) {
            w += 4;
            continue;
        }
        w += host.overlay_glyphs[c - 32].adv;
    }
    return w;
}

/* Copy `src` into `out`, truncated so that its on-screen width plus a
   trailing "..." fits within `max_px`.  Uses the same advance rules as
   overlay_text_width().  Falls back to an empty string when even one dot
   won't fit. */
static void fit_text(const char *src, int max_px, char *out, int out_sz)
{
    const char *dots = "...";
    int dot_w = 0;
    for (const unsigned char *p = (const unsigned char *)dots; *p; p++) {
        int c = *p;
        if (c < 32 || c > 126) { dot_w += 4; continue; }
        dot_w += host.overlay_glyphs[c - 32].adv;
    }
    out[0] = '\0';
    if (!src || max_px < dot_w || out_sz <= 1) return;

    int w = 0;
    size_t n = 0;
    const unsigned char *p;
    for (p = (const unsigned char *)src; *p; p++) {
        int c = *p;
        int adv = (c < 32 || c > 126) ? 4 : host.overlay_glyphs[c - 32].adv;
        if (w + adv + dot_w > max_px)
            break;
        if (n + 1 >= (size_t)out_sz)
            break;
        out[n++] = (char)c;
        w += adv;
    }
    if (*p) {
        if (n + 4 < (size_t)out_sz) {
            memcpy(out + n, dots, 3);
            n += 3;
        }
    }
    out[n] = '\0';
}

static void draw_tab_overlay(void) {
    if (!host.overlay_visible || server.num_apps < 1) return;

    int margin = 8, boxpad = 6;
    int icon_sz = OVERLAY_ICON_SZ, icon_gap = 8;
    int row_h = host.overlay_font_h > 0 ? host.overlay_font_h + 8 : 18;
    if (row_h < icon_sz + 4) row_h = icon_sz + 4;
    int max_row_w = 0, n_rows = 0;
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *app = server.apps[i];
        if (!app->toplevel) continue;
        if (!app->icon_resolved)
            overlay_icon_load(app);
        const char *title = app->toplevel->title;
        char fallback[16];
        if (!title || !title[0]) {
            snprintf(fallback, sizeof(fallback), "tab %d", i);
            title = fallback;
        }
        int w = icon_sz + icon_gap + overlay_text_width(title);
        if (w > max_row_w) max_row_w = w;
        n_rows++;
    }
    if (n_rows == 0) return;

    int avail_w = host.width - 2 * margin - 2 * boxpad;
    if (max_row_w > avail_w) max_row_w = avail_w;

    int box_w = max_row_w + 2 * boxpad;
    int box_h = n_rows * row_h + 2 * boxpad;
    if (box_w > host.width - 2 * margin) box_w = host.width - 2 * margin;
    if (box_h > host.height - 2 * margin) box_h = host.height - 2 * margin;
    int box_x = (host.width - box_w) / 2;
    int box_y = (host.height - box_h) / 2;

    draw_rect(box_x, box_y, box_w, box_h, 0.07f, 0.07f, 0.09f, 1.0f);

    int row = 0;
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *app = server.apps[i];
        if (!app->toplevel) continue;
        const char *title = app->toplevel->title;
        char fallback[16];
        if (!title || !title[0]) {
            snprintf(fallback, sizeof(fallback), "tab %d", i);
            title = fallback;
        }
        int ry = box_y + boxpad + row * row_h;
        bool active = app->toplevel == server.active;
        char row_text[512];
        int budget = max_row_w - icon_sz - icon_gap;
        if (budget < 0) budget = 0;
        fit_text(title, budget, row_text, sizeof(row_text));
        int text_w = overlay_text_width(row_text);
        if (active) {
            int hw = icon_sz + icon_gap + text_w + 4;
            int max_hw = box_w - 2 * boxpad + 4;
            if (hw > max_hw) hw = max_hw;
            draw_rect(box_x + boxpad - 2, ry - 1, hw, row_h,
                      0.24f, 0.36f, 0.60f, 0.9f);
        }
        int ix = box_x + boxpad;
        int iy = ry + (row_h - icon_sz) / 2;
        if (app->icon_tex) {
            GLfloat tint[4] = { active ? 1.0f : 0.72f,
                                active ? 1.0f : 0.72f,
                                active ? 1.0f : 0.72f, 1.0f };
            draw_texture_rect(app->icon_tex, app->icon_w, app->icon_h,
                              0, 0, app->icon_w, app->icon_h,
                              ix, iy, icon_sz, icon_sz,
                              host.width, host.height, tint);
        } else {
            /* Generic placeholder: a bordered square for apps with no icon. */
            draw_rect(ix, iy, icon_sz, icon_sz, 0.45f, 0.45f, 0.48f, 0.85f);
            draw_rect(ix + 3, iy + 3, icon_sz - 6, icon_sz - 6,
                      0.07f, 0.07f, 0.09f, 1.0f);
        }
        draw_text(row_text, ix + icon_sz + icon_gap,
                  ry + (row_h - host.overlay_font_h) / 2,
                  active ? 1.0f : 0.72f,
                  active ? 1.0f : 0.72f,
                  active ? 1.0f : 0.72f,
                  active ? 1.0f : 0.9f);
        row++;
    }
}


/* ===================== Server-side wlroots setup ===================== */

static void swapchain_resize(int width, int height) {
    if (width < 50) width = 50;
    if (height < 50) height = 50;
    static uint64_t mods[] = { DRM_FORMAT_MOD_LINEAR };
    struct wlr_drm_format fmt = {
        .format = DRM_FORMAT_ARGB8888,
        .len = 1,
        .capacity = 1,
        .modifiers = mods,
    };
    if (server.swapchain) {
        wlr_swapchain_destroy(server.swapchain);
        server.swapchain = NULL;
    }
    server.swapchain = wlr_swapchain_create(server.allocator, width, height, &fmt);
    if (!server.swapchain)
        fprintf(stderr, "tabbed-wlroots: swapchain create failed at %dx%d\n",
                width, height);
}

static void output_resize(int width, int height) {
    if (width < 50) width = 50;
    if (height < 50) height = 50;
    if (!server.output || !server.allocator) return;

    struct wlr_output_state state;
    wlr_output_state_init(&state);
    wlr_output_state_set_enabled(&state, true);
    wlr_output_state_set_custom_mode(&state, width, height, 0);
    wlr_output_commit_state(server.output, &state);
    wlr_output_state_finish(&state);

    swapchain_resize(width, height);

    if (server.bg_rect)
        wlr_scene_rect_set_size(server.bg_rect, width, height);

    /* Keep every mapped client at the current maximized size so switching
       tabs is instant and no tab is left small after a host resize.  While
       fullscreen the fullscreen configure already sizes clients to the
       output, so skip the maximize request to avoid state churn. */
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *app = server.apps[i];
        if (!app->toplevel) continue;
        if (!server.clients_fullscreen)
            wlr_xdg_toplevel_set_maximized(app->toplevel, true);
        wlr_xdg_toplevel_set_size(app->toplevel, width, height);
    }

    needs_redraw = true;
}

static void handle_output_frame(struct wl_listener *listener, void *data) {
    (void)listener; (void)data;
    frame_pending = true;
}

static void handle_new_output(struct wl_listener *listener, void *data) {
    (void)listener;
    struct wlr_output *output = data;

    if (!wlr_output_init_render(output, server.allocator, server.renderer)) {
        fprintf(stderr, "tabbed-wlroots: output init_render failed\n");
        return;
    }
    wlr_output_create_global(output, server.wl_display);

server.output = output;
    server.scene_output = wlr_scene_output_create(server.scene, output);
    wlr_scene_output_set_position(server.scene_output, 0, 0);

    /* Render whenever the output is ready for a frame (refresh-rate driven),
       like tinywl; this is what drives client frame callbacks / surface
       enter events even before any damage has accumulated. */
    server.frame.notify = handle_output_frame;
    wl_signal_add(&output->events.frame, &server.frame);

    /* Enable the output up front so buffer commits succeed even before the
       host window has been configured. */
    int w = output->width > 0 ? output->width : host.width;
    int h = output->height > 0 ? output->height : host.height;
    struct wlr_output_state state;
    wlr_output_state_init(&state);
    wlr_output_state_set_enabled(&state, true);
    wlr_output_state_set_custom_mode(&state, w, h, 0);
    wlr_output_commit_state(output, &state);
    wlr_output_state_finish(&state);

    swapchain_resize(w, h);

    /* An opaque full-output background node gives the scene a deterministic
       backdrop so the nested frame is never transparent. (Direct scanout is
       disabled separately above; a rect alone cannot prevent it because
       wlroots culls a rect that a covering client surface occludes, leaving
       a single render-list entry which is exactly what triggers scanout.) */
    server.bg_rect = wlr_scene_rect_create(&server.scene->tree, w, h,
                                           (float[]){ 0.0f, 0.0f, 0.0f, 1.0f });
    if (server.bg_rect)
        wlr_scene_node_lower_to_bottom(&server.bg_rect->node);
}

static void handle_toplevel_destroy(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_app *app = wl_container_of(listener, app, destroy);
    struct wlr_xdg_toplevel *toplevel = app->toplevel;
    app->toplevel = NULL;
    app->tree = NULL;
    if (app->icon_tex) {
        glDeleteTextures(1, &app->icon_tex);
        app->icon_tex = 0;
    }

    /* wlroots emits destroy with data=NULL and asserts every toplevel
       event listener list is empty afterwards; remove all listeners we
       attached to satisfy that and avoid use-after-free. */
    wl_list_remove(&app->destroy.link);
    wl_list_remove(&app->map.link);
    wl_list_remove(&app->commit.link);
    wl_list_remove(&app->request_maximize.link);
    wl_list_remove(&app->request_fullscreen.link);
    wl_list_remove(&app->request_minimize.link);
    wl_list_remove(&app->request_move.link);
    wl_list_remove(&app->request_resize.link);

    if (server.active != NULL && server.active == toplevel) {
        server.active = NULL;
        for (int i = 0; i < server.num_apps; i++)
            if (server.apps[i]->toplevel) {
                set_active_surface(server.apps[i]->toplevel);
                return;
            }
        /* last tab closed: close the host window and exit */
        xdg_toplevel_destroy(host.toplevel);
        wl_surface_destroy(host.surface);
        shutdown_cleanup();
        exit(0);
    }
}

static void handle_request_maximize(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_app *app = wl_container_of(listener, app, request_maximize);
    struct wlr_xdg_toplevel *toplevel = app->toplevel;
    if (toplevel->base->initialized)
        wlr_xdg_toplevel_set_maximized(toplevel, true);
}

static void handle_request_fullscreen(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_app *app = wl_container_of(listener, app, request_fullscreen);
    struct wlr_xdg_toplevel *toplevel = app->toplevel;
    if (!toplevel->base->initialized) return;
    /* wlroots 0.19 emits request_fullscreen with NULL data; the direction
       lives in toplevel->requested.fullscreen.  Honor the client's request
       and mirror it onto the host window: a fullscreen client fills the
       host window, and an un-fullscreen client puts it back. */
    bool fs = toplevel->requested.fullscreen;
    wlr_xdg_toplevel_set_fullscreen(toplevel, fs);
    tabbed_log(TABBED_LOG_INFO, "client fullscreen=%d\n", fs);
    if (fs)
        xdg_toplevel_set_fullscreen(host.toplevel, NULL);
    else
        xdg_toplevel_unset_fullscreen(host.toplevel);
}

/* Propagate the host window's fullscreen state onto every client.  Called
   from host_xdg_toplevel_configure when that state actually changes. */
static void clients_set_fullscreen(bool fs) {
    server.clients_fullscreen = fs;
    tabbed_log(TABBED_LOG_INFO, "clients fullscreen=%d\n", fs);
    for (int i = 0; i < server.num_apps; i++) {
        struct tabbed_app *app = server.apps[i];
        if (!app->toplevel || !app->toplevel->base->initialized) continue;
        wlr_xdg_toplevel_set_fullscreen(app->toplevel, fs);
        if (!fs) {
            wlr_xdg_toplevel_set_maximized(app->toplevel, true);
            wlr_xdg_toplevel_set_size(app->toplevel, server.output->width,
                                      server.output->height);
        }
    }
}

static void handle_request_minimize(struct wl_listener *listener, void *data) {
    (void)listener; (void)data;
}

static void handle_request_move(struct wl_listener *listener, void *data) {
    (void)listener; (void)data;
}

static void handle_request_resize(struct wl_listener *listener, void *data) {
    (void)listener; (void)data;
}

static void position_toplevel(struct tabbed_app *app) {
    if (!app || !app->tree) return;
    /* CSD clients (foot/kitty) reserve a titlebar gutter above their
       content, which we don't paint, so it shows as a dark bar and their
       content sits too low (bottom row/cursor cropped). Shift them up by
       that gutter so the dark bar is cropped instead of the terminal's
       bottom. Clients with no gutter (geometry.y >= 0, e.g. wltest) are
       left untouched. */
    struct wlr_box geom = app->toplevel->base->geometry;
    int y = -geom.y;
    if (geom.y < 0)
        y = 0;
    wlr_scene_node_set_position(&app->tree->node, -geom.x, y);
}

static void handle_toplevel_commit(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_app *app = wl_container_of(listener, app, commit);
    struct wlr_xdg_toplevel *toplevel = app->toplevel;
    if (toplevel->base->initial_commit) {
        wlr_xdg_toplevel_set_maximized(toplevel, true);
        wlr_xdg_toplevel_set_size(toplevel, server.output->width,
                                  server.output->height);
        if (server.clients_fullscreen)
            wlr_xdg_toplevel_set_fullscreen(toplevel, true);
    }
    /* Geometry can settle after the first frames (kitty/foot report a
       negative y once they decide on their titlebar), so keep the scene
       position in sync with every commit instead of only at activation. */
    position_toplevel(app);

    /* [diag] What does this client commit, and is its scene node visible? */
    struct wlr_surface *s = toplevel->base->surface;
    struct wlr_buffer *cbuf = s ? s->current.buffer : NULL;
    struct wlr_dmabuf_attributes dma;
    static struct wlr_buffer *last_logged = NULL;
    if (cbuf && cbuf != last_logged) {
        last_logged = cbuf;
        bool is_dma = wlr_buffer_get_dmabuf(cbuf, &dma);
        bool node_on = app->tree ? app->tree->node.enabled : false;
        if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
            tabbed_log(TABBED_LOG_DEBUG, "[diag] commit app=%d geom=%dx%d+%d+%d "
                    "buf=%dx%d dma=%d%s node_enabled=%d active=%d\n",
                    app_index(app),
                    toplevel->base->geometry.width,
                    toplevel->base->geometry.height,
                    toplevel->base->geometry.x,
                    toplevel->base->geometry.y,
                    s->current.buffer_width,
                    s->current.buffer_height,
                    is_dma,
                    is_dma ? (dma.n_planes ? "" : " planes=0") : "",
                    node_on,
                    server.active == toplevel);
            if (is_dma) {
                tabbed_log(TABBED_LOG_DEBUG, "[diag]   dmabuf planes=%d "
                        "format=0x%x mod=0x%llx\n",
                        dma.n_planes, dma.format,
                        (unsigned long long)dma.modifier);
            }
        }
        if (!is_dma) {
            /* shm buffer: flag for TABBED_AUTODUMP; at debug level also count
               non-black pixels and save the client's own buffer so we can tell
               "client painted nothing" from "we failed to import". */
            void *data;
            uint32_t fmt;
            size_t stride;
            if (wlr_buffer_begin_data_ptr_access(
                    cbuf, WLR_BUFFER_DATA_PTR_ACCESS_READ,
                    &data, &fmt, &stride)) {
                client_dumped = true;
                if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
                    int bw = cbuf->width, bh = cbuf->height;
                    unsigned long nonblack = 0, lum = 0;
                    unsigned char *p = data;
                    for (int yy = 0; yy < bh; yy++) {
                        unsigned char *row = p + (size_t)yy * stride;
                        for (int xx = 0; xx < bw; xx++) {
                            unsigned long v = row[xx*4+0] + row[xx*4+1]
                                            + row[xx*4+2];
                            lum += v;
                            if (v > 12) nonblack++;
                        }
                    }
                    tabbed_log(TABBED_LOG_DEBUG, "[diag]   shm fmt=0x%x "
                            "nonblack=%lu/%lu mean=%lu\n", fmt, nonblack,
                            (unsigned long)bw * bh,
                            lum / ((unsigned long)bw * bh + 1));
                    char cpath[64];
                    snprintf(cpath, sizeof(cpath), "/tmp/client_%d.ppm",
                             dump_seq);
                    FILE *cf = fopen(cpath, "wb");
                    if (cf) {
                        fprintf(cf, "P6\n%d %d\n255\n", bw, bh);
                        unsigned char *cp = data;
                        for (int yy = 0; yy < bh; yy++) {
                            unsigned char *crow = cp + (size_t)yy * stride;
                            for (int xx = 0; xx < bw; xx++) {
                                fputc(crow[xx*4+0], cf);
                                fputc(crow[xx*4+1], cf);
                                fputc(crow[xx*4+2], cf);
                            }
                        }
                        fclose(cf);
                        tabbed_log(TABBED_LOG_DEBUG, "[diag]   client buffer "
                                "-> %s\n", cpath);
                    }
                }
                wlr_buffer_end_data_ptr_access(cbuf);
            }
        }
    }
}

static void handle_toplevel_map(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_app *app = wl_container_of(listener, app, map);
    struct wlr_xdg_toplevel *toplevel = app->toplevel;
    if (tabbed_log_level() >= TABBED_LOG_DEBUG)
        tabbed_log(TABBED_LOG_DEBUG, "[diag] map app=%d\n", app_index(app));
    wlr_xdg_toplevel_set_activated(toplevel, true);
    set_active_surface(toplevel);
}

static void handle_new_toplevel(struct wl_listener *listener, void *data) {
    (void)listener;
    struct wlr_xdg_toplevel *toplevel = data;

    struct tabbed_app *app = NULL;
    /* Prefer a slot prepared by add_tab() (Ctrl+Shift+T): its position was
       chosen to sit right next to the tab the user launched it from, so an
       earlier stale free slot (a closed tab's hole) must not steal it. */
    for (int i = 0; i < server.num_apps && !app; i++)
        if (!server.apps[i]->toplevel && server.apps[i]->pending_claim)
            app = server.apps[i];
    /* Otherwise claim the first free slot, as before (CLI startup tabs are
       claimed in connection order). */
    if (!app)
        for (int i = 0; i < server.num_apps; i++)
            if (!server.apps[i]->toplevel) {
                app = server.apps[i];
                break;
            }
    if (!app) {
        /* No slot for this toplevel (e.g. a dialog/second window opened by
           an already-running client). Give it its own tab so it appears on
           top and stays reachable via tab cycling. Place the new tab right
           after the tab that created it (protocol parent, else the active
           tab); fall back to the far right if neither can be identified. */
        if (apps_ensure_cap(server.num_apps + 1) != 0) return;
        app = calloc(1, sizeof(*app));
        if (!app) return;
        app->pid = -1;
        app->cmd = NULL;

        int anchor = -1;
        struct tabbed_app *pa = toplevel->parent
            ? app_for_toplevel(toplevel->parent) : NULL;
        if (!pa)
            pa = app_for_toplevel(server.active);
        if (pa)
            for (int i = 0; i < server.num_apps; i++)
                if (server.apps[i] == pa) {
                    anchor = i;
                    break;
                }
        if (anchor < 0) {
            server.apps[server.num_apps] = app;
        } else {
            int at = anchor + 1;
            if (at < server.num_apps)
                memmove(&server.apps[at + 1], &server.apps[at],
                        (server.num_apps - at) * sizeof(*server.apps));
            server.apps[at] = app;
        }
        server.num_apps++;
    }

    app->toplevel = toplevel;
    app->pending_claim = false;
    app->tree = wlr_scene_xdg_surface_create(&server.scene->tree,
                                             toplevel->base);
    /* hidden until it becomes the active tab */
    wlr_scene_node_set_enabled(&app->tree->node, false);

    /* [claim] ties the app slot to the *connected client's* PID, so tests
       can kill the tab that is actually active.  App slots are claimed in
       connection order (first free slot), which is NOT the launch order
       the [launch] lines use when two clients start concurrently. */
    pid_t cpid = -1;
    if (toplevel->base->client)
        wl_client_get_credentials(toplevel->base->client->client,
                                  &cpid, NULL, NULL);
    tabbed_log(TABBED_LOG_INFO, "[claim] app=%d pid=%d\n",
            app_index(app), (int)cpid);

    app->destroy.notify = handle_toplevel_destroy;
    wl_signal_add(&toplevel->events.destroy, &app->destroy);

    app->map.notify = handle_toplevel_map;
    wl_signal_add(&toplevel->base->surface->events.map, &app->map);

    app->commit.notify = handle_toplevel_commit;
    wl_signal_add(&toplevel->base->surface->events.commit, &app->commit);

    app->request_maximize.notify = handle_request_maximize;
    wl_signal_add(&toplevel->events.request_maximize, &app->request_maximize);
    app->request_fullscreen.notify = handle_request_fullscreen;
    wl_signal_add(&toplevel->events.request_fullscreen, &app->request_fullscreen);
    app->request_minimize.notify = handle_request_minimize;
    wl_signal_add(&toplevel->events.request_minimize, &app->request_minimize);
    app->request_move.notify = handle_request_move;
    wl_signal_add(&toplevel->events.request_move, &app->request_move);
    app->request_resize.notify = handle_request_resize;
    wl_signal_add(&toplevel->events.request_resize, &app->request_resize);
}

/* ===================== Tab management ===================== */

static struct tabbed_app *app_for_toplevel(struct wlr_xdg_toplevel *toplevel) {
    if (!toplevel) return NULL;
    for (int i = 0; i < server.num_apps; i++)
        if (server.apps[i]->toplevel == toplevel)
            return server.apps[i];
    return NULL;
}

static int app_index(struct tabbed_app *app) {
    for (int i = 0; i < server.num_apps; i++)
        if (server.apps[i] == app)
            return i;
    return -1;
}

struct tabbed_popup {
    struct wlr_xdg_surface *xdg_surface;
    struct wlr_scene_tree *scene;
    struct wl_listener commit;
    struct wl_listener destroy;
    struct wl_listener reposition;
};

/* Enough of the host window for popups to be positioned within; open menus
   may exceed the toplevel but we keep them inside the visible area. */
static void popup_usable_box(struct wlr_box *box) {
    box->x = 0;
    box->y = 0;
    if (server.output) {
        box->width = server.output->width;
        box->height = server.output->height;
    } else {
        box->width = host.width;
        box->height = host.height;
    }
}

/* Popups (menus, tooltips) are regular wlr_scene_xdg_surface nodes under
   their parent's tree, so wlroots' scene renderer composites them into the
   output buffer like any other surface.  We only need to make sure the client
   gets its initial configure (unconstrain from the output box) and to place
   each popup under its parent's tree. */
static void popup_handle_commit(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_popup *tp = wl_container_of(listener, tp, commit);
    struct wlr_xdg_surface *xdg_surface = tp->xdg_surface;
    /* The client cannot map/render the popup until it receives its initial
       configure, which wlroots only sends via wlr_xdg_popup_unconstrain_from
       (which also adjusts geometry within the usable area). initial_commit is
       true on the first commit; later commits are ignored. */
    if (xdg_surface->initial_commit && xdg_surface->popup) {
        struct wlr_box box;
        popup_usable_box(&box);
        wlr_xdg_popup_unconstrain_from_box(xdg_surface->popup, &box);
    }
}

static void popup_handle_reposition(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_popup *tp = wl_container_of(listener, tp, reposition);
    if (tp->xdg_surface->popup) {
        struct wlr_box box;
        popup_usable_box(&box);
        wlr_xdg_popup_unconstrain_from_box(tp->xdg_surface->popup, &box);
    }
}

static void popup_handle_destroy(struct wl_listener *listener, void *data) {
    (void)data;
    struct tabbed_popup *tp = wl_container_of(listener, tp, destroy);
    wl_list_remove(&tp->commit.link);
    wl_list_remove(&tp->destroy.link);
    wl_list_remove(&tp->reposition.link);
    free(tp);
}

static void create_popup(struct wlr_xdg_popup *popup,
                         struct wlr_scene_tree *parent_tree) {
    struct wlr_xdg_surface *xdg_surface = popup->base;
    struct tabbed_popup *tp = calloc(1, sizeof(*tp));
    if (!tp) return;
    tp->xdg_surface = xdg_surface;
    tp->scene = wlr_scene_xdg_surface_create(parent_tree, xdg_surface);
    /* wlr_scene_xdg_surface_create destroys the node when the surface is
       destroyed, so we only track positioning/reposition listeners here. */
    tp->commit.notify = popup_handle_commit;
    wl_signal_add(&xdg_surface->surface->events.commit, &tp->commit);
    tp->destroy.notify = popup_handle_destroy;
    /* Listen on the popup's own destroy: wlroots emits it (then asserts its
       event lists are empty) before the popup is freed. */
    wl_signal_add(&popup->events.destroy, &tp->destroy);
    tp->reposition.notify = popup_handle_reposition;
    wl_signal_add(&popup->events.reposition, &tp->reposition);
    /* remember the scene tree so a submenu popup can find its parent's tree */
    xdg_surface->data = tp;
}

static void handle_new_popup(struct wl_listener *listener, void *data) {
    (void)listener;
    struct wlr_xdg_popup *popup = data;

    /* Popups position themselves relative to their immediate parent surface,
       so place each popup under its parent's scene tree. */
    struct wlr_scene_tree *parent_tree = NULL;
    struct wlr_xdg_surface *parent =
        wlr_xdg_surface_try_from_wlr_surface(popup->parent);
    if (parent) {
        if (parent->role == WLR_XDG_SURFACE_ROLE_TOPLEVEL) {
            struct tabbed_app *app = app_for_toplevel(parent->toplevel);
            if (app) parent_tree = app->tree;
        } else if (parent->role == WLR_XDG_SURFACE_ROLE_POPUP) {
            struct tabbed_popup *tp = parent->data;
            if (tp) parent_tree = tp->scene;
        }
    }
    if (!parent_tree) return;
    create_popup(popup, parent_tree);
}

static void set_active_surface(struct wlr_xdg_toplevel *toplevel) {
    if (server.active == toplevel) return;

    struct tabbed_app *old = app_for_toplevel(server.active);
    if (old && old->tree)
        wlr_scene_node_set_enabled(&old->tree->node, false);
    if (server.active)
        wlr_xdg_toplevel_set_activated(server.active, false);

    server.active = toplevel;
    wlr_xdg_toplevel_set_activated(toplevel, true);

    struct tabbed_app *app = app_for_toplevel(server.active);
    if (app && app->tree) {
        position_toplevel(app);
        wlr_scene_node_set_enabled(&app->tree->node, true);
        if (tabbed_log_level() >= TABBED_LOG_DEBUG)
            tabbed_log(TABBED_LOG_DEBUG, "[diag] active app=%d surface=%dx%d "
                    "node on\n", app_index(app),
                    toplevel->base->surface->current.width,
                    toplevel->base->surface->current.height);
    } else if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
        tabbed_log(TABBED_LOG_DEBUG, "[diag] active app=%d has NO scene node!\n",
                app ? app_index(app) : -1);
    }

    wlr_seat_keyboard_notify_enter(server.seat, toplevel->base->surface,
        server.keyboard.keycodes, server.keyboard.num_keycodes,
        &server.keyboard.modifiers);
    needs_redraw = true;
}

static void cycle_tab(int dir) {
    if (server.num_apps == 0) return;
    int idx = -1;
    for (int i = 0; i < server.num_apps; i++)
        if (server.apps[i]->toplevel == server.active) {
            idx = i;
            break;
        }
    for (int k = 1; k <= server.num_apps; k++) {
        int j = ((idx < 0 ? 0 : idx) + k * dir + server.num_apps) % server.num_apps;
        if (server.apps[j]->toplevel) {
            set_active_surface(server.apps[j]->toplevel);
            return;
        }
    }
}

/* Fixed keybind repeat: first repeat after 600ms, then every 40ms (25Hz). */
#define TABBED_REPEAT_DELAY_MS 600
#define TABBED_REPEAT_INTERVAL_MS 40

static void kbd_repeat_cancel(void) {
    if (host.repeat_timer) {
        wl_event_source_remove(host.repeat_timer);
        host.repeat_timer = NULL;
    }
    host.repeat_key = 0;
}

static int kbd_repeat_cb(void *data) {
    (void)data;
    if (host.repeat_key == 0)
        return 0;
    cycle_tab(host.repeat_dir);
    if (host.repeat_timer)
        wl_event_source_timer_update(host.repeat_timer,
                                     TABBED_REPEAT_INTERVAL_MS);
    return 0;
}

static void kbd_repeat_start(int key, int dir) {
    kbd_repeat_cancel();
    host.repeat_key = key;
    host.repeat_dir = dir;
    host.repeat_timer = wl_event_loop_add_timer(server.loop, kbd_repeat_cb, NULL);
    if (host.repeat_timer)
        wl_event_source_timer_update(host.repeat_timer, TABBED_REPEAT_DELAY_MS);
}

/* ===================== Clipboard bridge implementation ===================== */

static void bridge_mimes_reset(void) {
    for (size_t i = 0; i < bridge.mimes_len; i++)
        free(bridge.mimes[i]);
    bridge.mimes_len = 0;
}

static void bridge_mimes_append(const char *mime) {
    if (bridge.mimes_len == bridge.mimes_cap) {
        size_t ncap = bridge.mimes_cap ? bridge.mimes_cap * 2 : 8;
        char **nm = realloc(bridge.mimes, ncap * sizeof(*nm));
        if (!nm)
            return;
        bridge.mimes = nm;
        bridge.mimes_cap = ncap;
    }
    bridge.mimes[bridge.mimes_len++] = strdup(mime);
}

static void bridge_inner_src_destroy(struct wl_listener *l, void *data);
static bool bridge_prefetch_mime_compatible(const char *mime);
static void bridge_prefetch_serve(const char *mime, int32_t fd);

/* Compositor-side nested source: when a nested client pastes, wlroots calls
   our impl->send() and we pull the data from the host offer straight into the
   fd wlroots gave us (zero copy, no relay). */
static void bridge_inner_source_send(struct wlr_data_source *src,
                                     const char *mime, int32_t fd) {
    (void)src;
    if (bridge_prefetch_mime_compatible(mime)) {
        bridge_prefetch_serve(mime, fd);
        return;
    }
    if (bridge.backend == BRIDGE_BACKEND_DATA_CONTROL && bridge.dc_offer) {
        zwlr_data_control_offer_v1_receive(bridge.dc_offer, mime, fd);
        close(fd);
    } else if (bridge.backend == BRIDGE_BACKEND_WL_DATA_DEVICE &&
               bridge.dd_offer) {
        wl_data_offer_receive(bridge.dd_offer, mime, fd);
        close(fd);
    } else {
        close(fd);
    }
}

static void bridge_inner_source_destroy(struct wlr_data_source *src) {
    free(src);
}

static const struct wlr_data_source_impl bridge_inner_source_impl = {
    .send = bridge_inner_source_send,
    .destroy = bridge_inner_source_destroy,
};

static void bridge_set_inner_src(struct wlr_data_source *src) {
    if (bridge.inner_src == src)
        return;
    if (bridge.inner_src) {
        wl_list_remove(&bridge.inner_src_destroy.link);
        bridge.inner_src = NULL;
    }
    bridge.inner_src = src;
    if (src) {
        bridge.inner_src_destroy.notify = bridge_inner_src_destroy;
        wl_signal_add(&src->events.destroy, &bridge.inner_src_destroy);
    }
}

static void bridge_inner_src_destroy(struct wl_listener *l, void *data) {
    (void)data;
    wl_list_remove(&l->link);
    bridge.inner_src = NULL;
}

/* Put a host selection into the nested seat.  The source stays valid for the
   whole lifetime of the host offer, so pastes can be served asynchronously. */
static void bridge_mirror_to_nested(void) {
    struct wlr_data_source *src = calloc(1, sizeof(*src));
    if (!src) {
        bridge_mimes_reset();
        return;
    }
    wlr_data_source_init(src, &bridge_inner_source_impl);
    for (size_t i = 0; i < bridge.mimes_len; i++) {
        char **p = wl_array_add(&src->mime_types, sizeof(char *));
        if (!p) {
            for (size_t j = i; j < bridge.mimes_len; j++)
                free(bridge.mimes[j]);
            bridge.mimes_len = 0;
            break;
        }
        *p = bridge.mimes[i];
        bridge.mimes[i] = NULL; /* ownership moves into the wl_array */
    }
    bridge.mimes_len = 0;
    bridge_set_inner_src(src);
    wlr_seat_set_selection(server.seat, src,
        wl_display_next_serial(server.wl_display));
}

static void bridge_clear_nested(void) {
    if (!server.seat->selection_source)
        return;
    bridge.ignore_next_inner = true;
    wlr_seat_set_selection(server.seat, NULL,
        wl_display_next_serial(server.wl_display));
}

/* ---------------- text prefetch: serve pastes from a buffered copy -------- */

#define TABBED_PREFETCH_MAX (16 * 1024 * 1024)

static void bridge_prefetch_cancel(void) {
    if (bridge.prefetch_src) {
        wl_event_source_remove(bridge.prefetch_src);
        bridge.prefetch_src = NULL;
    }
    if (bridge.prefetch_fd >= 0) {
        close(bridge.prefetch_fd);
        bridge.prefetch_fd = -1;
    }
    free(bridge.prefetch_buf);
    bridge.prefetch_buf = NULL;
    bridge.prefetch_len = bridge.prefetch_cap = 0;
    bridge.prefetch_mime[0] = '\0';
    bridge.prefetch_ready = false;
}

/* Drain the prefetch pipe into the buffer.  Returns true when the stream is
   finished (EOF/error) and the buffer should be kept as the paste payload. */
static bool bridge_prefetch_drain(int fd) {
    for (;;) {
        size_t room = bridge.prefetch_cap - bridge.prefetch_len;
        if (bridge.prefetch_len + 4096 > bridge.prefetch_cap &&
                bridge.prefetch_cap < TABBED_PREFETCH_MAX) {
            size_t ncap = bridge.prefetch_cap ? bridge.prefetch_cap * 2 : 8192;
            if (ncap > TABBED_PREFETCH_MAX)
                ncap = TABBED_PREFETCH_MAX;
            char *nb = realloc(bridge.prefetch_buf, ncap);
            if (nb) {
                bridge.prefetch_buf = nb;
                bridge.prefetch_cap = ncap;
                room = bridge.prefetch_cap - bridge.prefetch_len;
            }
        }
        if (room == 0) {
            /* cap reached: drain without storing to keep the writer unblocked */
            char tmp;
            ssize_t n = read(fd, &tmp, 1);
            if (n > 0)
                continue;
            if (n == 0)
                return true;
            if (errno == EINTR)
                continue;
            if (errno == EAGAIN)
                return false;
            return true;
        }
        ssize_t n = read(fd, bridge.prefetch_buf + bridge.prefetch_len, room);
        if (n > 0) {
            bridge.prefetch_len += (size_t)n;
            continue;
        }
        if (n == 0)
            return true; /* EOF */
        if (errno == EINTR)
            continue;
        if (errno == EAGAIN)
            return false; /* more data pending */
        return true;      /* read error: keep whatever we got */
    }
}

static int bridge_prefetch_cb(int fd, uint32_t mask, void *data) {
    (void)data; (void)mask;
    if (!bridge_prefetch_drain(fd))
        return 0;
    if (bridge.prefetch_src) {
        wl_event_source_remove(bridge.prefetch_src);
        bridge.prefetch_src = NULL;
    }
    close(fd);
    bridge.prefetch_fd = -1;
    bridge.prefetch_ready = true;
    return 0;
}

/* Pick the best text MIME offered for prefetching. */
static const char *bridge_pick_text_mime(void) {
    static const char *pref[] = {
        "text/plain;charset=utf-8", "text/plain", "UTF8_STRING", NULL,
    };
    for (int i = 0; pref[i]; i++)
        for (size_t j = 0; j < bridge.mimes_len; j++)
            if (strcmp(bridge.mimes[j], pref[i]) == 0)
                return bridge.mimes[j];
    for (size_t j = 0; j < bridge.mimes_len; j++)
        if (strncmp(bridge.mimes[j], "text/", 5) == 0)
            return bridge.mimes[j];
    return NULL;
}

/* Start pulling the current host offer's primary text MIME into our buffer.
   Must be called while bridge.mimes holds the freshly collected list. */
static void bridge_prefetch_start(void) {
    bridge_prefetch_cancel();
    if (!bridge.mimes_len)
        return;
    const char *mime = bridge_pick_text_mime();
    if (!mime)
        return;
    int p[2];
    if (pipe2(p, O_CLOEXEC | O_NONBLOCK) != 0)
        return;
    bridge.prefetch_fd = p[0];
    bridge.prefetch_src = wl_event_loop_add_fd(server.loop, p[0],
        WL_EVENT_READABLE, bridge_prefetch_cb, NULL);
    if (!bridge.prefetch_src) {
        close(p[0]);
        close(p[1]);
        bridge.prefetch_fd = -1;
        return;
    }
    snprintf(bridge.prefetch_mime, sizeof(bridge.prefetch_mime), "%s", mime);
    if (bridge.backend == BRIDGE_BACKEND_DATA_CONTROL && bridge.dc_offer) {
        zwlr_data_control_offer_v1_receive(bridge.dc_offer, mime, p[1]);
        close(p[1]);
    } else if (bridge.backend == BRIDGE_BACKEND_WL_DATA_DEVICE &&
               bridge.dd_offer) {
        wl_data_offer_receive(bridge.dd_offer, mime, p[1]);
        close(p[1]);
    } else {
        bridge_prefetch_cancel();
    }
}

/* The requested MIME can be served from the prefetched plain-text buffer. */
static bool bridge_prefetch_mime_compatible(const char *mime) {
    if (!bridge.prefetch_ready || bridge.prefetch_mime[0] == '\0')
        return false;
    if (strcmp(mime, bridge.prefetch_mime) == 0)
        return true;
    bool a = strncmp(mime, "text/plain", 10) == 0 ||
             strcmp(mime, "UTF8_STRING") == 0;
    bool b = strncmp(bridge.prefetch_mime, "text/plain", 10) == 0 ||
             strcmp(bridge.prefetch_mime, "UTF8_STRING") == 0;
    return a && b;
}

static void bridge_prefetch_serve(const char *mime, int32_t fd) {
    if (!bridge_prefetch_mime_compatible(mime)) {
        close(fd);
        return;
    }
    size_t off = 0;
    while (off < bridge.prefetch_len) {
        ssize_t n = write(fd, bridge.prefetch_buf + off,
                          bridge.prefetch_len - off);
        if (n > 0) {
            off += (size_t)n;
        } else if (n < 0 && (errno == EAGAIN || errno == EINTR)) {
            continue;
        } else {
            break;
        }
    }
    close(fd);
}

/* ---------------- host backend: wlr-data-control ---------------- */

static void bridge_dc_source_send(void *data,
        struct zwlr_data_control_source_v1 *src, const char *mime, int32_t fd) {
    (void)data; (void)src;
    if (bridge.inner_src)
        wlr_data_source_send(bridge.inner_src, mime, fd);
    else
        close(fd);
}

static void bridge_dc_source_cancelled(void *data,
        struct zwlr_data_control_source_v1 *src) {
    (void)data;
    zwlr_data_control_source_v1_destroy(src);
    bridge.dc_source = NULL;
    bridge.dc_pending_echo = false;
    bridge.dd_pending_echo = false;
}

static const struct zwlr_data_control_source_v1_listener bridge_dc_source_listener = {
    .send = bridge_dc_source_send,
    .cancelled = bridge_dc_source_cancelled,
};

static void bridge_dc_offer_mime(void *data,
        struct zwlr_data_control_offer_v1 *offer, const char *mime) {
    (void)data; (void)offer;
    bridge_mimes_append(mime);
}

static const struct zwlr_data_control_offer_v1_listener bridge_dc_offer_listener = {
    .offer = bridge_dc_offer_mime,
};

static void bridge_dc_device_finished(void *data,
        struct zwlr_data_control_device_v1 *dev) {
    (void)data; (void)dev;
    bridge.backend = bridge.dd ? BRIDGE_BACKEND_WL_DATA_DEVICE
                               : BRIDGE_BACKEND_NONE;
    if (bridge.dc_offer) {
        zwlr_data_control_offer_v1_destroy(bridge.dc_offer);
        bridge.dc_offer = NULL;
    }
    if (bridge.dc_device) {
        zwlr_data_control_device_v1_destroy(bridge.dc_device);
        bridge.dc_device = NULL;
    }
    tabbed_log(TABBED_LOG_INFO, "clipboard bridge: host data-control "
            "finished; falling back to %s\n",
            bridge.backend == BRIDGE_BACKEND_WL_DATA_DEVICE ?
            "focus-based wl_data_device" : "none");
}

static void bridge_dc_device_data_offer(void *data,
        struct zwlr_data_control_device_v1 *dev,
        struct zwlr_data_control_offer_v1 *offer) {
    (void)data; (void)dev;
    if (bridge.dc_pending_echo) {
        bridge.dc_pending_echo = false;
        bridge.dc_echo_offer = offer;
    }
    bridge_mimes_reset();
    zwlr_data_control_offer_v1_add_listener(offer, &bridge_dc_offer_listener, NULL);
}

static void bridge_dc_device_selection(void *data,
        struct zwlr_data_control_device_v1 *dev,
        struct zwlr_data_control_offer_v1 *offer) {
    (void)data; (void)dev;
    bridge_prefetch_cancel();
    /* Destroying our own previous source in bridge_host_set_selection makes the
       compositor briefly emit selection(NULL) before the echo of the new source;
       it is not a real clear, so ignore it while our echo is still pending. */
    if (!offer && bridge.dc_pending_echo)
        return;
    if (offer && offer == bridge.dc_echo_offer) {
        bridge.dc_echo_offer = NULL;
        bridge_mimes_reset();
        zwlr_data_control_offer_v1_destroy(offer);
        bridge.dc_pending_echo = false;
        return;
    }
    bridge.dc_pending_echo = false;
    bridge.dd_pending_echo = false;
    if (bridge.dc_offer)
        zwlr_data_control_offer_v1_destroy(bridge.dc_offer);
    bridge.dc_offer = offer;
    if (!offer) {
        bridge_mimes_reset();
        bridge_clear_nested();
        return;
    }
    bridge_prefetch_start();
    bridge_mirror_to_nested();
}

/* Primary selection is intentionally not bridged; the offer must still be
   acknowledged (NULL handler would make libwayland abort on the event) and
   destroyed so it does not leak. */
static void bridge_dc_device_primary_selection(void *data,
        struct zwlr_data_control_device_v1 *dev,
        struct zwlr_data_control_offer_v1 *offer) {
    (void)data; (void)dev;
    if (offer)
        zwlr_data_control_offer_v1_destroy(offer);
}

static const struct zwlr_data_control_device_v1_listener bridge_dc_listener = {
    .data_offer = bridge_dc_device_data_offer,
    .selection = bridge_dc_device_selection,
    .primary_selection = bridge_dc_device_primary_selection,
    .finished = bridge_dc_device_finished,
};

/* ---------------- host backend: wl_data_device (focus-based) ---------------- */

static void bridge_dd_source_send(void *data, struct wl_data_source *src,
        const char *mime, int32_t fd) {
    (void)data; (void)src;
    if (bridge.inner_src)
        wlr_data_source_send(bridge.inner_src, mime, fd);
    else
        close(fd);
}

static void bridge_dd_source_cancelled(void *data, struct wl_data_source *src) {
    (void)data;
    wl_data_source_destroy(src);
    bridge.dd_source = NULL;
    bridge.dc_pending_echo = false;
    bridge.dd_pending_echo = false;
    bridge.host_set_pending = true;
}

static const struct wl_data_source_listener bridge_dd_source_listener = {
    .send = bridge_dd_source_send,
    .cancelled = bridge_dd_source_cancelled,
};

static void bridge_dd_offer_mime(void *data, struct wl_data_offer *offer,
                                 const char *mime) {
    (void)data; (void)offer;
    bridge_mimes_append(mime);
}

static const struct wl_data_offer_listener bridge_dd_offer_listener = {
    .offer = bridge_dd_offer_mime,
    /* source_actions / action left unset: drag & drop is not bridged */
};

static void bridge_dd_data_offer(void *data, struct wl_data_device *dev,
                                 struct wl_data_offer *offer) {
    (void)data; (void)dev;
    if (bridge.dd_pending_echo) {
        bridge.dd_pending_echo = false;
        bridge.dd_echo_offer = offer;
    }
    bridge_mimes_reset();
    wl_data_offer_add_listener(offer, &bridge_dd_offer_listener, NULL);
}

static void bridge_dd_selection(void *data, struct wl_data_device *dev,
                                struct wl_data_offer *offer) {
    (void)data; (void)dev;
    if (!offer) {
        /* Focus blip: the host selection is momentarily gone (or we lost
           keyboard focus).  Keep the last-known nested selection and, above
           all, leave the pending-echo flags intact so an in-flight dc/dd
           set_selection reply is still recognized as our own echo. */
        bridge_mimes_reset();
        return;
    }
    bridge_prefetch_cancel();
    if (offer == bridge.dd_echo_offer) {
        bridge.dd_echo_offer = NULL;
        bridge_mimes_reset();
        wl_data_offer_destroy(offer);
        bridge.dd_pending_echo = false;
        return;
    }
    bridge.dc_pending_echo = false;
    bridge.dd_pending_echo = false;
    if (bridge.dd_offer)
        wl_data_offer_destroy(bridge.dd_offer);
    bridge.dd_offer = offer;
    bridge_prefetch_start();
    bridge_mirror_to_nested();
}

static const struct wl_data_device_listener bridge_dd_listener = {
    .data_offer = bridge_dd_data_offer,
    .selection = bridge_dd_selection,
    /* enter/leave/motion/drop left unset: drag & drop is not bridged */
};

/* ---------------- nested seat side ---------------- */

static void bridge_seat_request_set_selection(struct wl_listener *l, void *data) {
    (void)l;
    struct wlr_seat_request_set_selection_event *event = data;
    bridge.inner_clear_requested = (event->source == NULL);
    wlr_seat_set_selection(server.seat, event->source, event->serial);
}

static void bridge_host_set_selection(struct wlr_data_source *src) {
    bridge_set_inner_src(src);

    if (bridge.backend == BRIDGE_BACKEND_DATA_CONTROL && bridge.dc_device) {
        if (bridge.dc_source) {
            zwlr_data_control_source_v1_destroy(bridge.dc_source);
            bridge.dc_source = NULL;
        }
        struct zwlr_data_control_source_v1 *s =
            zwlr_data_control_manager_v1_create_data_source(bridge.dc_manager);
        char **p;
        wl_array_for_each(p, &src->mime_types)
            zwlr_data_control_source_v1_offer(s, *p);
        zwlr_data_control_source_v1_add_listener(s, &bridge_dc_source_listener, NULL);
        bridge.dc_source = s;
        bridge.dc_pending_echo = true;
        bridge.dd_pending_echo = true;
        zwlr_data_control_device_v1_set_selection(bridge.dc_device, s);
        bridge.host_set_pending = false;
        return;
    }

    if (bridge.backend == BRIDGE_BACKEND_WL_DATA_DEVICE && bridge.dd) {
        if (bridge.dd_source) {
            wl_data_source_destroy(bridge.dd_source);
            bridge.dd_source = NULL;
        }
        if (!bridge.kbd_serial) {
            bridge.host_set_pending = true;
            tabbed_log(TABBED_LOG_INFO, "clipboard bridge: no host keyboard "
                    "serial yet; deferring host set_selection until focus\n");
            return;
        }
        struct wl_data_source *s =
            wl_data_device_manager_create_data_source(bridge.ddm);
        char **p;
        wl_array_for_each(p, &src->mime_types)
            wl_data_source_offer(s, *p);
        wl_data_source_add_listener(s, &bridge_dd_source_listener, NULL);
        bridge.dd_source = s;
        bridge.dc_pending_echo = true;
        bridge.dd_pending_echo = true;
        wl_data_device_set_selection(bridge.dd, s, bridge.kbd_serial);
        bridge.host_set_pending = false;
        return;
    }
}

static void bridge_host_clear(void) {
    if (bridge.backend == BRIDGE_BACKEND_DATA_CONTROL && bridge.dc_device)
        zwlr_data_control_device_v1_set_selection(bridge.dc_device, NULL);
    /* focus-based backend: nothing reliable to clear without focus/serial */
}

static void bridge_seat_set_selection(struct wl_listener *l, void *data) {
    (void)l; (void)data;
    struct wlr_data_source *src = server.seat->selection_source;
    if (src && src->impl == &bridge_inner_source_impl)
        return; /* our own host->nested mirror */
    if (bridge.ignore_next_inner) {
        bridge.ignore_next_inner = false;
        return;
    }
    if (!src) {
        if (bridge.inner_clear_requested) {
            bridge.inner_clear_requested = false;
            bridge_host_clear();
        }
        return;
    }
    bridge.inner_clear_requested = false;
    bridge_host_set_selection(src);
}

/* ---------------- lifecycle ---------------- */

static void bridge_attach_seat(void) {
    bridge.request_set_selection.notify = bridge_seat_request_set_selection;
    wl_signal_add(&server.seat->events.request_set_selection,
        &bridge.request_set_selection);
    bridge.set_selection.notify = bridge_seat_set_selection;
    wl_signal_add(&server.seat->events.set_selection, &bridge.set_selection);
}

static void bridge_init(void) {
    if (!host.seat) {
        tabbed_log(TABBED_LOG_INFO, "clipboard bridge: no host seat; disabled\n");
        return;
    }
    if (bridge.ddm) {
        bridge.dd = wl_data_device_manager_get_data_device(bridge.ddm, host.seat);
        wl_data_device_add_listener(bridge.dd, &bridge_dd_listener, NULL);
    }
    if (bridge.dc_manager) {
        bridge.dc_device = zwlr_data_control_manager_v1_get_data_device(
            bridge.dc_manager, host.seat);
        zwlr_data_control_device_v1_add_listener(bridge.dc_device,
            &bridge_dc_listener, NULL);
        bridge.backend = BRIDGE_BACKEND_DATA_CONTROL;
        tabbed_log(TABBED_LOG_INFO, "clipboard bridge: host data-control backend\n");
    } else if (bridge.dd) {
        bridge.backend = BRIDGE_BACKEND_WL_DATA_DEVICE;
        tabbed_log(TABBED_LOG_INFO, "clipboard bridge: focus-based wl_data_device "
                "backend (host lacks wlr-data-control; host->nested sync needs "
                "focus)\n");
    } else {
        tabbed_log(TABBED_LOG_INFO, "clipboard bridge: no host clipboard path\n");
    }
}

static void bridge_cleanup(void) {
    if (bridge.inner_src) {
        wl_list_remove(&bridge.inner_src_destroy.link);
        bridge.inner_src = NULL;
    }
    if (bridge.dc_source) {
        zwlr_data_control_source_v1_destroy(bridge.dc_source);
        bridge.dc_source = NULL;
    }
    if (bridge.dd_source) {
        wl_data_source_destroy(bridge.dd_source);
        bridge.dd_source = NULL;
    }
    if (bridge.dc_offer) {
        zwlr_data_control_offer_v1_destroy(bridge.dc_offer);
        bridge.dc_offer = NULL;
    }
    if (bridge.dd_offer) {
        wl_data_offer_destroy(bridge.dd_offer);
        bridge.dd_offer = NULL;
    }
    if (bridge.dc_device) {
        zwlr_data_control_device_v1_destroy(bridge.dc_device);
        bridge.dc_device = NULL;
    }
    bridge_mimes_reset();
    free(bridge.mimes);
    bridge.mimes = NULL;
    bridge.mimes_cap = 0;
    bridge_prefetch_cancel();
    bridge.backend = BRIDGE_BACKEND_NONE;
}

/* ===================== Host-side listeners ===================== */

static void host_registry_global(void *data, struct wl_registry *registry,
                                 uint32_t name, const char *interface,
                                 uint32_t version)
{
    (void)data;
    if (strcmp(interface, wl_compositor_interface.name) == 0) {
        host.compositor = wl_registry_bind(registry, name,
            &wl_compositor_interface, version < 4 ? version : 4);
    } else if (strcmp(interface, xdg_wm_base_interface.name) == 0) {
        host.wm_base = wl_registry_bind(registry, name,
            &xdg_wm_base_interface, version < 1 ? version : 1);
    } else if (strcmp(interface, zxdg_decoration_manager_v1_interface.name) == 0) {
        host.decoration = wl_registry_bind(registry, name,
            &zxdg_decoration_manager_v1_interface, 1);
    } else if (strcmp(interface, wl_seat_interface.name) == 0) {
        host.seat = wl_registry_bind(registry, name,
            &wl_seat_interface, version < 5 ? version : 5);
    } else if (strcmp(interface, wl_data_device_manager_interface.name) == 0) {
        bridge.ddm = wl_registry_bind(registry, name,
            &wl_data_device_manager_interface, version < 3 ? version : 3);
    } else if (strcmp(interface,
                      zwlr_data_control_manager_v1_interface.name) == 0) {
        bridge.dc_manager = wl_registry_bind(registry, name,
            &zwlr_data_control_manager_v1_interface, version < 2 ? version : 2);
    }
}

static void host_registry_global_remove(void *data, struct wl_registry *registry,
                                        uint32_t name)
{
    (void)data; (void)registry; (void)name;
}

static const struct wl_registry_listener host_registry_listener = {
    .global = host_registry_global,
    .global_remove = host_registry_global_remove,
};

static void host_xdg_wm_ping(void *data, struct xdg_wm_base *wm, uint32_t serial) {
    (void)data;
    xdg_wm_base_pong(wm, serial);
}

static const struct xdg_wm_base_listener host_xdg_wm_listener = {
    .ping = host_xdg_wm_ping,
};

static void host_xdg_surface_configure(void *data, struct xdg_surface *s,
                                       uint32_t serial)
{
    (void)data;
    xdg_surface_ack_configure(s, serial);
}

static const struct xdg_surface_listener host_xdg_surface_listener = {
    .configure = host_xdg_surface_configure,
};

static void host_resize(int width, int height) {
    if (width < 50) width = 50;
    if (height < 50) height = 50;
    host.width = width;
    host.height = height;
    if (host.egl_window)
        wl_egl_window_resize(host.egl_window, width, height, 0, 0);
    if (host.egl_ok) {
        eglMakeCurrent(host.egl_display, host.egl_surface, host.egl_surface,
                       host.egl_context);
    }
    output_resize(width, height);
    needs_redraw = true;
}

static void host_xdg_toplevel_configure(void *data, struct xdg_toplevel *t,
                                        int32_t width, int32_t height,
                                        struct wl_array *states)
{
    (void)data; (void)t;
    host.fullscreen = false;
    uint32_t *state;
    wl_array_for_each(state, states)
        if (*state == XDG_TOPLEVEL_STATE_FULLSCREEN)
            host.fullscreen = true;
    /* Mirror the host window's state onto the clients: fullscreen begets
       fullscreen, anything else begets maximized. */
    if (host.fullscreen != server.clients_fullscreen) {
        tabbed_log(TABBED_LOG_INFO, "host fullscreen=%d\n", host.fullscreen);
        clients_set_fullscreen(host.fullscreen);
    }
    if (width > 0 && height > 0)
        host_resize(width, height);
    host.configured = true;
}

static void host_xdg_toplevel_close(void *data, struct xdg_toplevel *t) {
    (void)data; (void)t;
    tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: window closed\n");
    shutdown_cleanup();
    exit(0);
}

static const struct xdg_toplevel_listener host_xdg_toplevel_listener = {
    .configure = host_xdg_toplevel_configure,
    .close = host_xdg_toplevel_close,
};

static void host_decoration_configure(void *data,
                                      struct zxdg_toplevel_decoration_v1 *dec,
                                      uint32_t mode)
{
    (void)data; (void)dec;
    tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: host decoration mode=%u (%s)\n",
            mode,
            mode == ZXDG_TOPLEVEL_DECORATION_V1_MODE_SERVER_SIDE
                ? "server-side" : "client-side");
}

static const struct zxdg_toplevel_decoration_v1_listener host_decoration_listener = {
    .configure = host_decoration_configure,
};

/* ---------- host keyboard ---------- */

/* (Re)build the xkb_state used to translate raw evdev keycodes into
   keysyms for host hotkey matching.  The state is derived from whatever
   keymap is current (host-provided or fallback), so the hotkeys work on
   any keyboard/layout without hardcoded keycodes. */
static void xkb_state_reload(void)
{
    if (server.xkb_state) {
        xkb_state_unref(server.xkb_state);
        server.xkb_state = NULL;
    }
    if (!server.xkb_keymap)
        return;
    server.xkb_state = xkb_state_new(server.xkb_keymap);
    server.xkb_alt_mod =
        xkb_keymap_mod_get_index(server.xkb_keymap, XKB_MOD_NAME_ALT);
}

static void host_kbd_keymap(void *data, struct wl_keyboard *kbd, uint32_t format,
                            int32_t fd, uint32_t size)
{
    (void)data; (void)kbd;
    if (format != WL_KEYBOARD_KEYMAP_FORMAT_XKB_V1 || size == 0 || !server.xkb_ctx) {
        close(fd);
        return;
    }
    tabbed_log(TABBED_LOG_DEBUG, "tabbed-wlroots: host keymap: format=%u size=%u\n",
               format, size);

    /* The keymap is an shm file (size includes the trailing NUL), so mmap it
       like wlroots' own clients do; fall back to a plain read loop. */
    char *buf = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
    bool mapped = buf != MAP_FAILED;
    size_t total = mapped ? size : 0;
    if (!mapped) {
        buf = malloc(size + 1);
        if (!buf) {
            close(fd);
            return;
        }
        while (total < size) {
            ssize_t rd = read(fd, buf + total, size - total);
            if (rd > 0) {
                total += rd;
            } else if (rd < 0 && (errno == EAGAIN || errno == EINTR)) {
                struct timespec ts = { .tv_sec = 0, .tv_nsec = 1000000 };
                nanosleep(&ts, NULL);
            } else {
                break;
            }
        }
        buf[total] = '\0';
        if (total < size)
            tabbed_log(TABBED_LOG_DEBUG,
                       "tabbed-wlroots: host keymap: short read %zu/%u bytes\n",
                       total, size);
    }

    struct xkb_keymap *km = xkb_keymap_new_from_string(
        server.xkb_ctx, buf, XKB_KEYMAP_FORMAT_TEXT_V1, 0);
    if (km) {
        wlr_keyboard_set_keymap(&server.keyboard, km);
        if (server.xkb_keymap)
            xkb_keymap_unref(server.xkb_keymap);
        server.xkb_keymap = km;
        xkb_state_reload();
        tabbed_log(TABBED_LOG_DEBUG, "tabbed-wlroots: host keymap parsed OK\n");
    } else {
        tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: failed to parse host "
                "keymap (%u bytes); keeping fallback keymap\n", size);
        if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
            char hex[129];
            size_t n = total < 64 ? total : 64;
            for (size_t i = 0; i < n; i++)
                snprintf(hex + i * 2, sizeof(hex) - i * 2, "%02x",
                         (unsigned char)buf[i]);
            tabbed_log(TABBED_LOG_DEBUG, "tabbed-wlroots: keymap head (%zu/%u "
                    "bytes): %s\n", n, size, hex);
        }
    }

    if (mapped)
        munmap(buf, size);
    else
        free(buf);
    close(fd);
}

static void host_kbd_enter(void *data, struct wl_keyboard *kbd, uint32_t serial,
                           struct wl_surface *surface, struct wl_array *keys)
{
    (void)data; (void)kbd; (void)surface; (void)keys;
    /* Remember the enter serial for host clipboard set_selection.  Only the
       focus-based wl_data_device backend can hold a stale echo guard (a
       set_selection sent with a no-longer-valid serial gets no reply): drop it
       on refocus there.  The data-control backend echoes independently of
       focus, so its in-flight guard must be preserved here, or the host's echo
       of our own set_selection is mistaken for a real selection and mirrored
       back into an endless set_selection/receive loop. */
    bridge.kbd_serial = serial;
    if (bridge.backend == BRIDGE_BACKEND_WL_DATA_DEVICE) {
        bridge.dc_pending_echo = false;
        bridge.dd_pending_echo = false;
    }
    if (bridge.host_set_pending && server.seat->selection_source &&
            server.seat->selection_source->impl != &bridge_inner_source_impl) {
        bridge.host_set_pending = false;
        bridge_host_set_selection(server.seat->selection_source);
    }
    if (server.active)
        wlr_seat_keyboard_notify_enter(server.seat,
            server.active->base->surface,
            server.keyboard.keycodes, server.keyboard.num_keycodes,
            &server.keyboard.modifiers);
}

static void host_kbd_leave(void *data, struct wl_keyboard *kbd, uint32_t serial,
                           struct wl_surface *surface)
{
    (void)data; (void)kbd; (void)serial; (void)surface;
    wlr_seat_keyboard_notify_clear_focus(server.seat);
}

/* Temporary grey-band diagnosis: dump the scene buffer (client content as
   wlroots rendered it) to /tmp/scene_N.ppm. The buffer memory is top-down,
   XRGB8888. */
static void dump_scene_buffer(struct wlr_buffer *buf) {
    if (!buf) return;
    void *data;
    uint32_t format;
    size_t stride;
    if (!wlr_buffer_begin_data_ptr_access(buf, WLR_BUFFER_DATA_PTR_ACCESS_READ,
                                          &data, &format, &stride)) {
        tabbed_log(TABBED_LOG_INFO, "[dump] scene buffer not CPU-readable "
                "(%dx%d)\n", buf->width, buf->height);
        return;
    }
    /* [diag] classify the buffer: count non-black pixels so we can tell
       "client painted nothing" from "we failed to import". */
    int w = buf->width, h = buf->height;
    unsigned long nonblack = 0, lum = 0;
    unsigned char *p = data;
    for (int y = 0; y < h; y++) {
        unsigned char *row = p + (size_t)y * stride;
        for (int x = 0; x < w; x++) {
            uint32_t b = row[x*4+0];
            unsigned long v = b + row[x*4+1] + row[x*4+2];
            lum += v;
            if (v > 12) nonblack++;
        }
    }
    tabbed_log(TABBED_LOG_INFO, "[dump] scene %dx%d fmt=0x%x "
            "nonblack=%lu/%lu mean=%lu\n", w, h, format, nonblack,
            (unsigned long)w * h, lum / ((unsigned long)w * h + 1));
    char path[64];
    snprintf(path, sizeof(path), "/tmp/scene_%d.ppm", dump_seq);
    FILE *f = fopen(path, "wb");
    if (f) {
        int w = buf->width, h = buf->height;
        fprintf(f, "P6\n%d %d\n255\n", w, h);
        unsigned char *p = data;
        for (int y = 0; y < h; y++) {
            unsigned char *row = p + (size_t)y * stride;
            for (int x = 0; x < w; x++) {
                fputc(row[x*4+0], f);
                fputc(row[x*4+1], f);
                fputc(row[x*4+2], f);
            }
        }
        fclose(f);
        tabbed_log(TABBED_LOG_INFO, "[dump] scene buffer -> %s (%dx%d, "
                "fmt=0x%x)\n", path, w, h, format);
    }
    wlr_buffer_end_data_ptr_access(buf);
    dump_seq++;
}

/* Dump what we are about to present to the host (our composited back buffer).
   Must be called with the host EGL context current and back buffer freshly
   drawn. GL readback is bottom-up, so flip vertically. */
static void dump_host_back(void) {
    int w = host.width, h = host.height;
    unsigned char *px = malloc((size_t)w * h * 4);
    if (!px) return;
    glReadPixels(0, 0, w, h, GL_RGBA, GL_UNSIGNED_BYTE, px);
    unsigned long nonblack = 0, lum = 0;
    for (int y = 0; y < h * w; y++) {
        unsigned long v = px[y*4+0] + px[y*4+1] + px[y*4+2];
        lum += v;
        if (v > 12) nonblack++;
    }
    tabbed_log(TABBED_LOG_INFO, "[dump] host %dx%d nonblack=%lu/%lu mean=%lu\n",
            w, h, nonblack, (unsigned long)w * h,
            lum / ((unsigned long)w * h + 1));
    char path[64];
    snprintf(path, sizeof(path), "/tmp/host_%d.ppm", dump_seq);
    FILE *f = fopen(path, "wb");
    if (f) {
        fprintf(f, "P6\n%d %d\n255\n", w, h);
        for (int y = h - 1; y >= 0; y--) {
            unsigned char *row = px + (size_t)y * w * 4;
            for (int x = 0; x < w; x++) {
                fputc(row[x*4+0], f);
                fputc(row[x*4+1], f);
                fputc(row[x*4+2], f);
            }
        }
        fclose(f);
        tabbed_log(TABBED_LOG_INFO, "[dump] host back buffer -> %s (%dx%d)\n",
                path, w, h);
    }
    free(px);
    dump_seq++;
}

/* TABBED_SYNTH_INPUT=1: ignore the real host keyboard entirely and accept
   input only from the stdin event feed (the test/driver channel).  The host
   keyboard listener stays attached (its enter/leave events still drive the
   clipboard bridge), but key and modifier events from the real host are
   dropped so a stray physical press can't cancel a synthesized repeat or
   clobber the injected modifier state. */
static bool synth_input_only;

static void host_kbd_key(void *data, struct wl_keyboard *kbd, uint32_t serial,
                         uint32_t time, uint32_t key, uint32_t state)
{
    (void)data;
    if (synth_input_only && kbd)
        return;
    (void)kbd;
    bridge.kbd_serial = serial;
    if (server.xkb_state)
        xkb_state_update_key(server.xkb_state, key + 8,
                             state == WL_KEYBOARD_KEY_STATE_PRESSED
                                 ? XKB_KEY_DOWN : XKB_KEY_UP);
    xkb_keysym_t sym = server.xkb_state
        ? xkb_state_key_get_one_sym(server.xkb_state, key + 8)
        : XKB_KEY_NoSymbol;
    /* With no compiled keymap (xkb init failed) fall back to the raw
       evdev keycodes for the hotkey matching below. */
    bool alt = server.xkb_state
        ? xkb_state_mod_index_is_active(server.xkb_state,
                server.xkb_alt_mod, XKB_STATE_MODS_EFFECTIVE)
        : (host.host_mods_depressed & (1u << 3)) != 0;
    if (alt != host.overlay_visible) {
        host.overlay_visible = alt;
        needs_redraw = true;
    }
    char symbuf[32];
    xkb_keysym_get_name(sym, symbuf, sizeof(symbuf));
    tabbed_log(TABBED_LOG_DEBUG,
        "[kbd] key=%u state=%u sym=%s ctrl=%d alt=%d repeat_key=%u\n",
        key, state, sym ? symbuf : "-",
        (host.host_mods_depressed & (1u << 2)) != 0, alt, host.repeat_key);
    /* Function keys (F9/F10/F11) are not grabbed: they pass through to the
       focused client, which may have its own bindings (e.g. a browser's F11
       fullscreen request, which handle_request_fullscreen mirrors onto the
       host window).  Frame dumps are available via SIGUSR1 instead. */
    /* Alt+Up / Alt+Down cycle tabs.  The host sends a single physical
       press, so repeats are synthesized by kbd_repeat_start(); subsequent
       host presses of an already-held key are ignored so a host-sent
       repeat never cycles twice.  Plain arrow keys (not Fn+arrow) are used
       because many laptop firmwares swallow Alt+Fn+PageUp (the Fn key
       reports as XF86WakeUp there), which makes Alt+PageUp/PageDown
       unreliable. */
    bool prev, next;
    if (server.xkb_state) {
        prev = sym == XKB_KEY_Up;
        next = sym == XKB_KEY_Down;
    } else {
        prev = key == 103;
        next = key == 108;
    }
    if (alt && (prev || next)) {
        if (state == WL_KEYBOARD_KEY_STATE_PRESSED) {
            if (host.repeat_key != key) {
                int dir = next ? 1 : -1;
                cycle_tab(dir);
                kbd_repeat_start(key, dir);
            }
        } else {
            kbd_repeat_cancel();
        }
        return;
    }
    /* Ctrl+Shift+T opens a new terminal tab ($TERMINAL, default alacritty).
       The tab is inserted right after the current one and becomes active when
       it maps.  Grabbed here so the focused client never sees it; a latch
       drops host-synthesized repeats so one hold can't open a terminal per
       repeat. */
    {
        bool ctrl = (host.host_mods_depressed & (1u << 2)) != 0;
        bool shift = (host.host_mods_depressed & (1u << 0)) != 0;
        bool is_t = server.xkb_state
            ? (sym == XKB_KEY_t || sym == XKB_KEY_T)
            : key == 20;
        if (ctrl && shift && is_t) {
            kbd_repeat_cancel();
            if (state == WL_KEYBOARD_KEY_STATE_PRESSED) {
                if (!term_key_held) {
                    term_key_held = true;
                    add_tab(term_cmd);
                }
            } else {
                term_key_held = false;
            }
            return;
        }
    }
    /* any other key activity stops the tab-switch repeat */
    kbd_repeat_cancel();
    struct wlr_keyboard_key_event event = {
        .time_msec = time,
        .keycode = key,
        .update_state = true,
        .state = state,
    };
    wlr_keyboard_notify_key(&server.keyboard, &event);
    wlr_seat_set_keyboard(server.seat, &server.keyboard);
    wlr_seat_keyboard_notify_key(server.seat, time, key, state);
}

static void host_kbd_modifiers(void *data, struct wl_keyboard *kbd, uint32_t serial,
                               uint32_t mods_depressed, uint32_t mods_latched,
                               uint32_t mods_locked, uint32_t group)
{
    (void)data; (void)serial;
    if (synth_input_only && kbd)
        return;
    (void)kbd;
    host.host_mods_depressed = mods_depressed;
    if (server.xkb_state)
        xkb_state_update_mask(server.xkb_state, mods_depressed,
                              mods_latched, mods_locked, group, group, group);
    bool alt = server.xkb_state
        ? xkb_state_mod_index_is_active(server.xkb_state,
            server.xkb_alt_mod, XKB_STATE_MODS_EFFECTIVE)
        : (mods_depressed & (1u << 3)) != 0;
    if (alt != host.overlay_visible) {
        host.overlay_visible = alt;
        needs_redraw = true;
    }
    if (host.repeat_key && !alt)
        kbd_repeat_cancel();
    wlr_keyboard_notify_modifiers(&server.keyboard, mods_depressed,
                                  mods_latched, mods_locked, group);
    wlr_seat_keyboard_notify_modifiers(server.seat, &server.keyboard.modifiers);
}

static void host_kbd_repeat_info(void *data, struct wl_keyboard *kbd,
                                 int32_t rate, int32_t delay)
{
    (void)data; (void)kbd;
    wlr_keyboard_set_repeat_info(&server.keyboard, rate, delay);
}

static const struct wl_keyboard_listener host_kbd_listener = {
    .keymap = host_kbd_keymap,
    .enter = host_kbd_enter,
    .leave = host_kbd_leave,
    .key = host_kbd_key,
    .modifiers = host_kbd_modifiers,
    .repeat_info = host_kbd_repeat_info,
};

/* ============ stdin event feed (test/driver channel) ============
   Reads raw keyboard events from stdin and dispatches them into the
   same host_kbd_key / host_kbd_modifiers handlers a real host would
   deliver, so the key handler itself stays under test.  Two records:

       1 | u32 key  | u32 state        (WL_KEYBOARD_KEY_STATE_*)
       2 | u32 mods | u32 latched | u32 locked | u32 group
*/
#define CTL_CMD_KEY  1
#define CTL_CMD_MODS 2

#define CTL_MAX_MSG  20          /* 1 + 4 + 4 (or 1 + 16) after padding */
#define CTL_BUF_SIZE 512

static uint32_t ctl_serial;
static uint32_t ctl_time;

static void ctl_dispatch(const uint8_t *msg, size_t len) {
    uint32_t u32[4];
    if (len < 5) return;
    switch (msg[0]) {
    case CTL_CMD_KEY:
        if (len < 9) return;
        memcpy(u32, msg + 1, 8);
        ctl_time += 1;
        host_kbd_key(NULL, NULL, ++ctl_serial, ctl_time, u32[0], u32[1]);
        break;
    case CTL_CMD_MODS:
        if (len < 17) return;
        memcpy(u32, msg + 1, 16);
        ctl_time += 1;
        host_kbd_modifiers(NULL, NULL, ++ctl_serial, u32[0], u32[1],
                           u32[2], u32[3]);
        break;
    }
}

static int ctl_cb(int fd, uint32_t mask, void *data) {
    static uint8_t buf[CTL_BUF_SIZE];
    static size_t have = 0;
    (void)data;

    /* stdin closed: stop watching but keep the compositor running */
    if (mask & (WL_EVENT_HANGUP | WL_EVENT_ERROR)) {
        wl_event_source_remove(server.ctl_source);
        server.ctl_source = NULL;
        return 0;
    }

    ssize_t n = read(fd, buf + have, sizeof(buf) - have);
    if (n <= 0) {
        if (n == 0) {
            wl_event_source_remove(server.ctl_source);
            server.ctl_source = NULL;
        }
        return 0;
    }
    have += (size_t)n;

    uint8_t msg[CTL_MAX_MSG];
    while (have >= 5) {
        size_t need = (buf[0] == CTL_CMD_MODS) ? 17 : 9;
        if (have < need) break;
        memcpy(msg, buf, need);
        ctl_dispatch(msg, need);
        memmove(buf, buf + need, have - need);
        have -= need;
    }
    return 0;
}

/* ---------- host pointer ---------- */

static struct wlr_surface *surface_at(double x, double y,
                                      double *sx, double *sy)
{
    struct wlr_scene_node *node = wlr_scene_node_at(
        &server.scene->tree.node, x, y, sx, sy);
    if (node && node->type == WLR_SCENE_NODE_BUFFER) {
        struct wlr_scene_buffer *buffer = wlr_scene_buffer_from_node(node);
        struct wlr_scene_surface *scene_surface =
            wlr_scene_surface_try_from_buffer(buffer);
        if (scene_surface)
            return scene_surface->surface;
    }
    return NULL;
}

static void host_ptr_motion(uint32_t time, double sx, double sy) {
    if (!server.seat) return;
    double nx = 0.0, ny = 0.0;
    struct wlr_surface *surface = surface_at(sx, sy, &nx, &ny);
    if (surface) {
        wlr_seat_pointer_notify_enter(server.seat, surface, nx, ny);
        wlr_seat_pointer_notify_motion(server.seat, time, nx, ny);
    } else {
        wlr_seat_pointer_notify_clear_focus(server.seat);
    }
    wlr_seat_pointer_notify_frame(server.seat);
}

static void host_ptr_enter(void *data, struct wl_pointer *p, uint32_t serial,
                           struct wl_surface *surface, wl_fixed_t sx, wl_fixed_t sy)
{
    (void)data; (void)p; (void)serial; (void)surface;
    host_ptr_motion(0, wl_fixed_to_double(sx), wl_fixed_to_double(sy));
}

static void host_ptr_leave(void *data, struct wl_pointer *p, uint32_t serial,
                           struct wl_surface *surface)
{
    (void)data; (void)p; (void)serial; (void)surface;
    if (server.seat) {
        wlr_seat_pointer_notify_clear_focus(server.seat);
        wlr_seat_pointer_notify_frame(server.seat);
    }
}

static void host_ptr_motion_event(void *data, struct wl_pointer *p, uint32_t time,
                                  wl_fixed_t sx, wl_fixed_t sy)
{
    (void)data; (void)p;
    host_ptr_motion(time, wl_fixed_to_double(sx), wl_fixed_to_double(sy));
}

static void host_ptr_button(void *data, struct wl_pointer *p, uint32_t serial,
                            uint32_t time, uint32_t button, uint32_t state)
{
    (void)data; (void)p; (void)serial;
    if (!server.seat) return;
    wlr_seat_pointer_notify_button(server.seat, time, button, state);
    wlr_seat_pointer_notify_frame(server.seat);
}

static void host_ptr_axis(void *data, struct wl_pointer *p, uint32_t time,
                          uint32_t axis, wl_fixed_t value)
{
    (void)data; (void)p;
    if (!server.seat) return;
    int32_t discrete = axis < 2 ? host.axis_discrete[axis] : 0;
    host.axis_discrete[axis] = 0;
    wlr_seat_pointer_notify_axis(server.seat, time, axis,
                                 wl_fixed_to_double(value), discrete,
                                 host.axis_source,
                                 WL_POINTER_AXIS_RELATIVE_DIRECTION_IDENTICAL);
    wlr_seat_pointer_notify_frame(server.seat);
}

static void host_ptr_axis_source(void *data, struct wl_pointer *p, uint32_t source)
{
    (void)data; (void)p;
    host.axis_source = source;
}

static void host_ptr_axis_discrete(void *data, struct wl_pointer *p, uint32_t axis,
                                   int32_t discrete)
{
    (void)data; (void)p;
    if (axis < 2)
        host.axis_discrete[axis] += discrete;
}

static void host_ptr_axis_stop(void *data, struct wl_pointer *p, uint32_t time,
                               uint32_t axis)
{
    (void)data; (void)p; (void)time; (void)axis;
}

static void host_ptr_frame(void *data, struct wl_pointer *p) {
    (void)data; (void)p;
}

static const struct wl_pointer_listener host_ptr_listener = {
    .enter = host_ptr_enter,
    .leave = host_ptr_leave,
    .motion = host_ptr_motion_event,
    .button = host_ptr_button,
    .axis = host_ptr_axis,
    .frame = host_ptr_frame,
    .axis_source = host_ptr_axis_source,
    .axis_stop = host_ptr_axis_stop,
    .axis_discrete = host_ptr_axis_discrete,
};

/* ===================== Host init / EGL ===================== */

static bool host_init(void) {
    const char *disp = getenv("WAYLAND_DISPLAY");
    if (!disp)
        disp = "wayland-0";
    host.display = wl_display_connect(NULL);
    if (!host.display) {
        fprintf(stderr, "tabbed-wlroots: cannot connect to host compositor "
                "(WAYLAND_DISPLAY=%s). Run me inside a running Wayland session.\n",
                disp);
        return false;
    }

    host.registry = wl_display_get_registry(host.display);
    wl_registry_add_listener(host.registry, &host_registry_listener, NULL);
    wl_display_roundtrip(host.display);

    if (!host.compositor || !host.wm_base) {
        fprintf(stderr, "tabbed-wlroots: host lacks compositor/xdg_wm_base\n");
        return false;
    }

    host.surface = wl_compositor_create_surface(host.compositor);
    host.xdg_surface = xdg_wm_base_get_xdg_surface(host.wm_base, host.surface);
    host.toplevel = xdg_surface_get_toplevel(host.xdg_surface);
    xdg_toplevel_set_title(host.toplevel, "tabbed-wlroots");
    if (host.decoration) {
        /* Ask the host compositor (labwc) for a server-side title bar, so
           the nested window always has a host-drawn decoration above our
           own tab content (including full-bleed clients like the test). */
        host.decoration_obj = zxdg_decoration_manager_v1_get_toplevel_decoration(
            host.decoration, host.toplevel);
        zxdg_toplevel_decoration_v1_add_listener(host.decoration_obj,
            &host_decoration_listener, NULL);
        zxdg_toplevel_decoration_v1_set_mode(host.decoration_obj,
            ZXDG_TOPLEVEL_DECORATION_V1_MODE_SERVER_SIDE);
    }
    xdg_surface_add_listener(host.xdg_surface, &host_xdg_surface_listener, NULL);
    xdg_toplevel_add_listener(host.toplevel, &host_xdg_toplevel_listener, NULL);
    xdg_wm_base_add_listener(host.wm_base, &host_xdg_wm_listener, NULL);
    wl_surface_commit(host.surface);
    wl_display_roundtrip(host.display);

    if (host.seat) {
        host.keyboard = wl_seat_get_keyboard(host.seat);
        host.pointer = wl_seat_get_pointer(host.seat);
        if (host.keyboard)
            wl_keyboard_add_listener(host.keyboard, &host_kbd_listener, NULL);
        if (host.pointer)
            wl_pointer_add_listener(host.pointer, &host_ptr_listener, NULL);
    }
    bridge_init();

    /* Try EGL on the host wayland platform */
    pfn_eglGetPlatformDisplayEXT = (PFNEGLGETPLATFORMDISPLAYEXTPROC)
        eglGetProcAddress("eglGetPlatformDisplayEXT");
    if (!pfn_eglGetPlatformDisplayEXT) {
        fprintf(stderr, "tabbed-wlroots: no EGL platform support; "
                "falling back to software rendering\n");
        host.egl_ok = false;
        return true;
    }

    host.egl_display = pfn_eglGetPlatformDisplayEXT(EGL_PLATFORM_WAYLAND_EXT,
                                                    host.display, NULL);
    if (host.egl_display == EGL_NO_DISPLAY) {
        fprintf(stderr, "tabbed-wlroots: EGL display failed; "
                "falling back to software rendering\n");
        host.egl_ok = false;
        return true;
    }
    if (!eglInitialize(host.egl_display, NULL, NULL)) {
        fprintf(stderr, "tabbed-wlroots: eglInitialize failed; "
                "falling back to software rendering\n");
        host.egl_ok = false;
        return true;
    }

    eglBindAPI(EGL_OPENGL_ES_API);

    const EGLint config_attribs[] = {
        EGL_SURFACE_TYPE, EGL_WINDOW_BIT,
        EGL_RENDERABLE_TYPE, EGL_OPENGL_ES2_BIT,
        EGL_RED_SIZE, 8,
        EGL_GREEN_SIZE, 8,
        EGL_BLUE_SIZE, 8,
        EGL_ALPHA_SIZE, 0,
        EGL_NONE
    };
    EGLint ncfg = 0;
    if (!eglChooseConfig(host.egl_display, config_attribs, &host.egl_config,
                         1, &ncfg) || ncfg < 1) {
        fprintf(stderr, "tabbed-wlroots: no EGL config; software fallback\n");
        host.egl_ok = false;
        return true;
    }

    const EGLint ctx_attribs[] = {
        EGL_CONTEXT_CLIENT_VERSION, 2,
        EGL_NONE
    };
    host.egl_context = eglCreateContext(host.egl_display, host.egl_config,
                                        EGL_NO_CONTEXT, ctx_attribs);
    if (host.egl_context == EGL_NO_CONTEXT) {
        fprintf(stderr, "tabbed-wlroots: EGL context failed; software fallback\n");
        host.egl_ok = false;
        return true;
    }

    host.width = 1280;
    host.height = 800;
    host.egl_window = wl_egl_window_create(host.surface, host.width, host.height);
    host.egl_surface = eglCreateWindowSurface(host.egl_display, host.egl_config,
                                              (EGLNativeWindowType)host.egl_window, NULL);
    if (host.egl_surface == EGL_NO_SURFACE) {
        fprintf(stderr, "tabbed-wlroots: EGL window surface failed; software fallback\n");
        host.egl_ok = false;
        return true;
    }

    if (!eglMakeCurrent(host.egl_display, host.egl_surface, host.egl_surface,
                        host.egl_context)) {
        fprintf(stderr, "tabbed-wlroots: eglMakeCurrent failed; software fallback\n");
        host.egl_ok = false;
        return true;
    }
    eglSwapInterval(host.egl_display, 0);

    pfn_eglCreateImageKHR = (PFNEGLCREATEIMAGEKHRPROC)egl_proc("eglCreateImageKHR");
    pfn_eglDestroyImageKHR = (PFNEGLDESTROYIMAGEKHRPROC)egl_proc("eglDestroyImageKHR");
    pfn_glEGLImageTargetTexture2DOES = (PFNGLEGLIMAGETARGETTEXTURE2DOESPROC)
        egl_proc("glEGLImageTargetTexture2DOES");

    if (!gl_setup()) {
        fprintf(stderr, "tabbed-wlroots: GL setup failed; software fallback\n");
        host.egl_ok = false;
        return true;
    }
    overlay_font_init();

    host.egl_ok = true;
    tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: EGL (GPU) rendering enabled\n");
    return true;
}

/* ===================== Scene buffer -> host blit ===================== */

static bool import_scene_buffer(struct wlr_buffer *buf, GLuint tex) {
    struct wlr_dmabuf_attributes attrs;
    if (wlr_buffer_get_dmabuf(buf, &attrs)) {
        if (attrs.n_planes < 1) return false;

        EGLint att[48];
        int n = 0;
        att[n++] = EGL_WIDTH;  att[n++] = attrs.width;
        att[n++] = EGL_HEIGHT; att[n++] = attrs.height;
        att[n++] = EGL_LINUX_DRM_FOURCC_EXT; att[n++] = (EGLint)attrs.format;
        for (int p = 0; p < attrs.n_planes; p++) {
            att[n++] = EGL_DMA_BUF_PLANE0_FD_EXT + p * 3;     att[n++] = attrs.fd[p];
            att[n++] = EGL_DMA_BUF_PLANE0_OFFSET_EXT + p * 3; att[n++] = (EGLint)attrs.offset[p];
            att[n++] = EGL_DMA_BUF_PLANE0_PITCH_EXT + p * 3;  att[n++] = (EGLint)attrs.stride[p];
        }
        if (attrs.modifier != DRM_FORMAT_MOD_INVALID) {
            att[n++] = EGL_DMA_BUF_PLANE0_MODIFIER_LO_EXT;
            att[n++] = (EGLint)(attrs.modifier & 0xffffffff);
            att[n++] = EGL_DMA_BUF_PLANE0_MODIFIER_HI_EXT;
            att[n++] = (EGLint)(attrs.modifier >> 32);
        }
        att[n++] = EGL_NONE;

        EGLImageKHR img = pfn_eglCreateImageKHR(host.egl_display, EGL_NO_CONTEXT,
                                                EGL_LINUX_DMA_BUF_EXT,
                                                (EGLClientBuffer)NULL, att);
        if (img == EGL_NO_IMAGE_KHR) {
            tabbed_log(TABBED_LOG_DEBUG, "[import] eglCreateImageKHR failed "
                    "(format 0x%x modifier 0x%llx)\n", attrs.format,
                    (unsigned long long)attrs.modifier);
            return false;
        }
        glBindTexture(GL_TEXTURE_2D, tex);
        pfn_glEGLImageTargetTexture2DOES(GL_TEXTURE_2D, img);
        pfn_eglDestroyImageKHR(host.egl_display, img);
        return true;
    }

    /* Fallback for non-dmabuf buffers (on a headless backend the allocator
       yields shm buffers). Upload via CPU read so shm clients and the shm
       swapchain both render into the host window. */
    void *data;
    uint32_t fmt;
    size_t stride;
    if (!wlr_buffer_begin_data_ptr_access(buf, WLR_BUFFER_DATA_PTR_ACCESS_READ,
                                          &data, &fmt, &stride)) {
        tabbed_log(TABBED_LOG_DEBUG, "[import] buffer is neither dmabuf nor "
                "CPU-readable\n");
        return false;
    }
    glBindTexture(GL_TEXTURE_2D, tex);
    glPixelStorei(GL_UNPACK_ALIGNMENT, 1);
    switch (fmt) {
    case DRM_FORMAT_XRGB8888:
    case DRM_FORMAT_ARGB8888:
        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, buf->width, buf->height, 0,
                     GL_BGRA_EXT, GL_UNSIGNED_BYTE, data);
        break;
    default:
        tabbed_log(TABBED_LOG_DEBUG, "[import] unsupported CPU fallback format "
                "0x%x\n", fmt);
        wlr_buffer_end_data_ptr_access(buf);
        return false;
    }
    wlr_buffer_end_data_ptr_access(buf);
    return true;
}

/* Pace presents to the host compositor: this fires after the host has shown
   the buffer we queued, so we know we may queue the next one. Any frame drawn
   while a present is still pending is coalesced into the back buffer and
   presented here, keeping exactly one outstanding buffer (no burst, no
   tearing on busy repainters like terminals). */
static const struct wl_callback_listener host_frame_listener;
/* Request a host frame callback and present the drawing in the back buffer.
   The callback must be requested *before* the swap: frame requests are part
   of the state committed by eglSwapBuffers, so requesting it after would wait
   on a commit that never comes. */
static void present_to_host(void) {
    host.frame_cb = wl_surface_frame(host.surface);
    wl_callback_add_listener(host.frame_cb, &host_frame_listener, NULL);
    eglSwapBuffers(host.egl_display, host.egl_surface);
    host.present_pending = true;
}

static void host_frame_done(void *data, struct wl_callback *callback,
                            uint32_t callback_data)
{
    (void)data; (void)callback; (void)callback_data;
    if (host.frame_cb) {
        wl_callback_destroy(host.frame_cb);
        host.frame_cb = NULL;
    }
    host.present_pending = false;

    if (host.back_dirty) {
        host.back_dirty = false;
        present_to_host();
    }
}

static const struct wl_callback_listener host_frame_listener = {
    .done = host_frame_done,
};

/* The scene is rendered by the wlroots GLES2 renderer, which owns its own
   EGL display/context, while we sample that buffer from a *different* EGL
   context (host.egl_display). Without an explicit barrier the GPU may still
   be executing the renderer's draw commands when we import+read the dmabuf,
   which shows as flicker/tearing on content that repaints continuously.
   Make the renderer's context current on this thread and glFinish() so the
   buffer is guaranteed fully rendered before we blit it. */
static void sync_renderer_context(void) {
    struct wlr_egl *src = wlr_gles2_renderer_get_egl(server.renderer);
    if (!src) return;
    EGLDisplay d = wlr_egl_get_display(src);
    EGLContext c = wlr_egl_get_context(src);
    if (d == EGL_NO_DISPLAY || c == EGL_NO_CONTEXT) return;
    if (d == host.egl_display && c == host.egl_context) return;
    eglMakeCurrent(d, EGL_NO_SURFACE, EGL_NO_SURFACE, c);
    glFinish();
    eglMakeCurrent(host.egl_display, host.egl_surface, host.egl_surface,
                   host.egl_context);
}

static void blit_scene_buffer(struct wlr_buffer *buf) {
    int w = host.width, h = host.height;
    glViewport(0, 0, w, h);
    glClearColor(0.0f, 0.0f, 0.0f, 1.0f);
    glClear(GL_COLOR_BUFFER_BIT);

    bool imported = buf && import_scene_buffer(buf, host.import_tex);
    if (imported) {
        static const GLfloat white[4] = { 1, 1, 1, 1 };
        glEnable(GL_BLEND);
        glBlendFunc(GL_SRC_ALPHA, GL_ONE_MINUS_SRC_ALPHA);
        draw_texture_rect(host.import_tex, buf->width, buf->height,
                          0, 0, buf->width, buf->height, 0, 0,
                          buf->width, buf->height, w, h, white);
        draw_tab_overlay();
        glDisable(GL_BLEND);
    }
    if (dump_host_req) {
        dump_host_req = false;
        dump_host_back();
    }

    if (!imported) {
        /* Never present a frame that is only the clear colour: keep the last
           good frame on the host. A later frame with a good import presents
           normally. */
        return;
    }

    if (host.present_pending) {
        /* Host hasn't shown the previous buffer yet: redraw into the back
           buffer and coalesce the swap until the frame callback arrives. */
        host.back_dirty = true;
    } else {
        present_to_host();
    }
}

static void render_and_present(void) {
    if (!host.egl_ok || !host.configured) return;
    if (!server.scene_output || !server.swapchain) return;

    struct wlr_scene_output_state_options options = {
        .swapchain = server.swapchain,
    };
    struct wlr_output_state state;
    wlr_output_state_init(&state);
    bool rendered = wlr_scene_output_build_state(server.scene_output, &state,
                                                 &options);
    if (!rendered || !state.buffer) {
        tabbed_log(TABBED_LOG_DEBUG, "[render] build_state failed\n");
        wlr_output_state_finish(&state);
        goto frame_done;
    }

    /* [diag] What did wlroots composite? A swapchain-sized buffer means we
       composited the scene; anything else implies direct scanout of a client
       buffer (which our blit may or may not import). */
    if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
        struct wlr_output *out = server.output;
        tabbed_log(TABBED_LOG_DEBUG, "[diag] frame buffer %dx%d (output %dx%d)\n",
                state.buffer->width, state.buffer->height,
                out ? out->width : 0, out ? out->height : 0);
    }

    /* Barrier between the wlr renderer's context and our host blit. */
    sync_renderer_context();

    if (dump_scene_req) {
        dump_scene_req = false;
        dump_scene_buffer(state.buffer);
    }

    static int autodump = -1;
    if (autodump < 0)
        autodump = getenv("TABBED_AUTODUMP") ? 1 : 0;
    if (autodump > 0 && client_dumped && --autodump == 0) {
        dump_scene_req = true;
        dump_host_req = true;
    }

    blit_scene_buffer(state.buffer);

    if (!wlr_output_commit_state(server.output, &state))
        tabbed_log(TABBED_LOG_DEBUG, "[render] output commit failed\n");

frame_done:
    struct timespec now;
    clock_gettime(CLOCK_MONOTONIC, &now);
    wlr_scene_output_send_frame_done(server.scene_output, &now);

    wlr_output_state_finish(&state);
}

/* ===================== Launch client ===================== */

static void launch_client(int idx) {
    pid_t pid = fork();
    if (pid == 0) {
        /* Own process group so we can kill the whole client tree on exit. */
        setpgid(0, 0);
        const char *xdg_runtime = getenv("XDG_RUNTIME_DIR");
        if (!xdg_runtime) xdg_runtime = "/tmp";
        setenv("WAYLAND_DISPLAY", tabbed_socket, 1);
        setenv("XDG_RUNTIME_DIR", xdg_runtime, 1);
        setenv("GDK_BACKEND", "wayland", 1);
        setenv("QT_QPA_PLATFORM", "wayland", 1);
        unsetenv("DISPLAY");
        /* Unless debugging, don't let client chatter spill onto the launching
           terminal; the client inherits our stdout/stderr. */
        if (tabbed_log_level() < TABBED_LOG_DEBUG) {
            int nullfd = open("/dev/null", O_WRONLY);
            if (nullfd >= 0) {
                dup2(nullfd, STDOUT_FILENO);
                dup2(nullfd, STDERR_FILENO);
                if (nullfd > STDERR_FILENO) close(nullfd);
            }
        }
        execlp("/bin/sh", "sh", "-c", server.apps[idx]->cmd, NULL);
        _exit(127);
    }
    if (pid > 0) {
        server.apps[idx]->pid = pid;
        tabbed_log(TABBED_LOG_INFO, "[launch] app=%d pid=%d cmd=%s\n",
                idx, pid, server.apps[idx]->cmd);
    }
}

/* Add a new tab launching `cmd` and start it, exactly as if `cmd` had been
   given as a command-line argument.  The tab is inserted in the slot order
   right after the currently active tab (falling back to the far right if
   none is active), so the new tab sits to its right in the cycle.  Returns
   the new app index, or -1 on allocation failure. */
static int add_tab(const char *cmd) {
    if (apps_ensure_cap(server.num_apps + 1) != 0) return -1;
    struct tabbed_app *app = calloc(1, sizeof(*app));
    if (!app) return -1;
    app->cmd = strdup(cmd);
    app->pid = -1;
    app->pending_claim = true;

    int at = server.num_apps;
    struct tabbed_app *active_app = app_for_toplevel(server.active);
    if (active_app)
        for (int i = 0; i < server.num_apps; i++)
            if (server.apps[i] == active_app) {
                at = i + 1;
                break;
            }
    if (at < server.num_apps)
        memmove(&server.apps[at + 1], &server.apps[at],
                (server.num_apps - at) * sizeof(*server.apps));
    server.apps[at] = app;

    int idx = at;
    server.num_apps++;
    launch_client(idx);
    return idx;
}

/* ===================== Crash handler ===================== */

static void crash_handler(int sig, siginfo_t *info, void *ctx) {
    (void)sig; (void)info; (void)ctx;
    void *bt[64];
    int n = backtrace(bt, 64);
    write(2, "\n=== BACKTRACE ===\n", 19);
    backtrace_symbols_fd(bt, n, 2);
    remove_socket_file();
    _exit(139);
}

static void sigchld_handler(int sig) {
    (void)sig;
    int status;
    pid_t pid;
    if (tabbed_log_level() >= TABBED_LOG_DEBUG) {
        /* snprintf()/write() are async-signal-safe; fprintf() is not (it
           takes the FILE lock, which can deadlock if we interrupt a logging
           fprintf in the main loop). */
        char buf[64];
        while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {
            int n = snprintf(buf, sizeof(buf),
                             "[child] pid %d exited status 0x%x\n", pid, status);
            if (n > 0 && (size_t)n < sizeof(buf))
                (void)!write(STDERR_FILENO, buf, (size_t)n);
        }
    } else {
        while (waitpid(-1, &status, WNOHANG) > 0)
            ;
    }
}

/* On SIGTERM or Ctrl-C (SIGINT), take down the clients and exit cleanly
   rather than leaving them orphaned when the compositor dies.  The clients
   live in their own process groups, so a terminal Ctrl-C only reaches us.

   These signals are delivered through the event loop (wl_event_loop_add_signal
   in main) rather than a raw sigaction handler: the full teardown calls
   malloc/free and libwayland proxy destroys, which are not async-signal-safe
   and deadlock if the signal interrupts fork()/malloc()/logging (observed:
   SIGTERM landing inside launch_client's fork() left libc's allocator lock
   held, and shutdown_cleanup() -> bridge_cleanup() -> calloc() blocked on it
   forever).  Running it from a normal loop callback makes that impossible. */
static int close_signal_cb(int sig, void *data) {
    (void)sig;
    (void)data;
    shutdown_cleanup();
    _exit(0);
    return 0;
}

/* SIGUSR1: save the current scene buffer and host back buffer on the next
   frame, for inspecting what the client has actually drawn so far. */
static void sigusr1_handler(int sig) {
    (void)sig;
    dump_scene_req = 1;
    dump_host_req = 1;
    needs_redraw = 1;
}

/* ===================== Main ===================== */

int main(int argc, char *argv[]) {
    snprintf(tabbed_socket, sizeof(tabbed_socket), "tabbed-wayland-%d",
             (int)getpid());
    const char *runtime = getenv("XDG_RUNTIME_DIR");
    if (!runtime) runtime = "/tmp";
    snprintf(socket_path, sizeof(socket_path), "%s/%s", runtime, tabbed_socket);
    /* Clear a stale leftover (e.g. from a crashed previous run with the same
       name) before we try to bind; harmless if there is none. */
    remove_socket_file();

    /* Resolve TABBED_LOG up front so signal handlers can read the cached
       level without touching non-async-signal-safe functions. */
    tabbed_log_level_init();

    /* TABBED_SYNTH_INPUT: keep real host keyboard events out of the test
       channel so the stdin feed is the only source of key/modifier input. */
    {
        const char *v = getenv("TABBED_SYNTH_INPUT");
        synth_input_only = v && v[0] && v[0] != '0';
    }

    struct sigaction crash_sa = {
        .sa_sigaction = crash_handler,
        .sa_flags = SA_SIGINFO | SA_NODEFER,
    };
    sigaction(SIGSEGV, &crash_sa, NULL);
    sigaction(SIGABRT, &crash_sa, NULL);
    signal(SIGCHLD, sigchld_handler);
    signal(SIGUSR1, sigusr1_handler);

    /* wlroots logs follow TABBED_LOG: quiet keeps only errors, info drops
       protocol noise, debug shows everything. */
    switch (tabbed_log_level()) {
    case TABBED_LOG_DEBUG:
        wlr_log_init(WLR_DEBUG, NULL);
        break;
    case TABBED_LOG_INFO:
        wlr_log_init(WLR_INFO, NULL);
        break;
    default:
        wlr_log_init(WLR_ERROR, NULL);
        break;
    }

    server.wl_display = wl_display_create();
    if (!server.wl_display) {
        fprintf(stderr, "tabbed-wlroots: failed to create Wayland display\n");
        return 1;
    }
    server.loop = wl_display_get_event_loop(server.wl_display);

    /* Route SIGTERM/SIGINT through the event loop (signalfd) so shutdown runs
       in normal context; see close_signal_cb for why a raw handler is unsafe. */
    wl_event_loop_add_signal(server.loop, SIGTERM, close_signal_cb, NULL);
    wl_event_loop_add_signal(server.loop, SIGINT, close_signal_cb, NULL);

    /* stdin event feed: lets tests/drivers inject raw keyboard events
       into the real host key handlers without a host compositor. */
    server.ctl_source = wl_event_loop_add_fd(server.loop, STDIN_FILENO,
                                             WL_EVENT_READABLE,
                                             ctl_cb, NULL);

    server.backend = wlr_headless_backend_create(server.loop);
    if (!server.backend) {
        fprintf(stderr, "tabbed-wlroots: failed to create headless backend\n");
        return 1;
    }

    server.renderer = wlr_renderer_autocreate(server.backend);
    if (!server.renderer) {
        fprintf(stderr, "tabbed-wlroots: no GPU renderer available\n");
        return 1;
    }
    wlr_renderer_init_wl_display(server.renderer, server.wl_display);

    server.allocator = wlr_allocator_autocreate(server.backend, server.renderer);
    if (!server.allocator) {
        fprintf(stderr, "tabbed-wlroots: failed to create allocator\n");
        return 1;
    }

    /* wl_surface at v4: legacy clients (e.g. VLC's Wayland vout) place video
       via non-zero wl_surface.attach offsets, which is a protocol violation
       from v5 on. Advertise v4 so those offsets are accepted and ignored,
       like before the v5 breaking change. */
    wlr_compositor_create(server.wl_display, 4, server.renderer);
    wlr_subcompositor_create(server.wl_display);
    wlr_shm_create_with_renderer(server.wl_display, 1, server.renderer);
    wlr_linux_dmabuf_v1_create_with_renderer(server.wl_display, 5, server.renderer);
    wlr_data_device_manager_create(server.wl_display);
    wlr_data_control_manager_v1_create(server.wl_display);

    /* Never let wlroots present a client buffer to the headless output
       directly (direct scanout). We must composite into our own swapchain so
       the nested frame is exactly what the host window shows; scanout of a
       client buffer hands us a buffer our host blit can't keep in sync and the
       window goes black (seen with Firefox). The scene field is WLR_PRIVATE,
       so the supported way is this env var, parsed at wlr_scene_create(). */
    setenv("WLR_SCENE_DISABLE_DIRECT_SCANOUT", "1", 1);

    server.scene = wlr_scene_create();
    server.xdg_shell = wlr_xdg_shell_create(server.wl_display, 6);

    server.seat = wlr_seat_create(server.wl_display, "tabbed");
    wlr_seat_set_capabilities(server.seat,
        WL_SEAT_CAPABILITY_POINTER | WL_SEAT_CAPABILITY_KEYBOARD);
    bridge_attach_seat();

    /* virtual keyboard fed from the host keyboard */
    static const struct wlr_keyboard_impl keyboard_impl = {
        .name = "tabbed-keyboard",
    };
    wlr_keyboard_init(&server.keyboard, &keyboard_impl, "tabbed-keyboard");

    /* fallback keymap until the host sends one */
    server.xkb_ctx = xkb_context_new(XKB_CONTEXT_NO_FLAGS);
    if (server.xkb_ctx) {
        xkb_context_set_log_level(server.xkb_ctx, XKB_LOG_LEVEL_DEBUG);
        xkb_context_set_log_fn(server.xkb_ctx, tabbed_xkb_log);
        struct xkb_rule_names names = {
            .rules = NULL, .model = "pc105",
            .layout = "us", .variant = NULL, .options = NULL,
        };
        server.xkb_keymap = xkb_keymap_new_from_names(
            server.xkb_ctx, &names, XKB_KEYMAP_COMPILE_NO_FLAGS);
        if (server.xkb_keymap) {
            wlr_keyboard_set_keymap(&server.keyboard, server.xkb_keymap);
            xkb_state_reload();
        }
    }
    wlr_seat_set_keyboard(server.seat, &server.keyboard);

    server.new_output.notify = handle_new_output;
    wl_signal_add(&server.backend->events.new_output, &server.new_output);
    server.new_toplevel.notify = handle_new_toplevel;
    wl_signal_add(&server.xdg_shell->events.new_toplevel, &server.new_toplevel);
    server.new_popup.notify = handle_new_popup;
    wl_signal_add(&server.xdg_shell->events.new_popup, &server.new_popup);

    /* headless output; new_output fires during backend start */
    host.width = 1280;
    host.height = 800;
    wlr_headless_add_output(server.backend, host.width, host.height);

    if (!wlr_backend_start(server.backend)) {
        fprintf(stderr, "tabbed-wlroots: failed to start backend\n");
        return 1;
    }

    if (wl_display_add_socket(server.wl_display, tabbed_socket) < 0) {
        fprintf(stderr, "tabbed-wlroots: failed to add socket '%s': %s\n",
                tabbed_socket, strerror(errno));
        return 1;
    }

    /* Now connect to the host compositor and present inside it. */
    if (!host_init()) {
        fprintf(stderr, "tabbed-wlroots: could not start nested session\n");
        remove_socket_file();
        return 1;
    }

    tabbed_log(TABBED_LOG_INFO, "Wayland socket: %s\n", tabbed_socket);

    /* Ctrl+Shift+T opens a terminal named by $TERMINAL when set, else the
       alacritty default.  Every command-line argument is one tab launcher. */
    {
        const char *env_term = getenv("TERMINAL");
        if (env_term && env_term[0])
            term_cmd = env_term;
    }
    int total_apps = argc - 1;
    if (total_apps == 0) {
        fprintf(stderr, "usage: %s <prog> [prog...]\n"
                "       Each <prog> is one shell command; quote it when it "
                "takes args, e.g. \"firefox -no-remote\".\n"
                "       Arguments written bare (starting with '-') launch a "
                "bogus extra tab.\n"
                "       $TERMINAL names the terminal Ctrl+Shift+T opens; "
                "default alacritty.\n", argv[0]);
        remove_socket_file();
        return 1;
    }
    server.apps = calloc((size_t)total_apps, sizeof(*server.apps));
    if (!server.apps) {
        fprintf(stderr, "tabbed-wlroots: out of memory for %d apps\n",
                total_apps);
        remove_socket_file();
        return 1;
    }
    server.apps_cap = total_apps;

    for (int i = 0; i < total_apps; i++) {
        struct tabbed_app *app = calloc(1, sizeof(*app));
        if (!app) {
            remove_socket_file();
            return 1;
        }
        app->cmd = strdup(argv[i + 1]);
        app->pid = -1;
        server.apps[i] = app;
    }
    server.num_apps = total_apps;

    for (int i = 0; i < server.num_apps; i++) {
        if (server.apps[i]->cmd[0] == '-') {
            if (i > 0) {
                fprintf(stderr,
                        "tabbed-wlroots: warning: %s starts with '-'; it is "
                        "run as its own tab, not an option to %s\n"
                        "                If intended, quote it: \"%s %s\"\n",
                        server.apps[i]->cmd, server.apps[i - 1]->cmd,
                        server.apps[i - 1]->cmd, server.apps[i]->cmd);
            } else {
                fprintf(stderr,
                        "tabbed-wlroots: warning: %s starts with '-'; if this "
                        "is meant for a first command, quote them together, "
                        "e.g. \"%s\"\n",
                        server.apps[i]->cmd, server.apps[i]->cmd);
            }
        }
        launch_client(i);
    }

    tabbed_log(TABBED_LOG_INFO, "tabbed-wlroots: running. "
            "Alt+Up/Down switches tabs; Ctrl+Shift+T opens a terminal "
            "(%s).\n", term_cmd);

    /* Main event loop: service both the server and the host displays */
    int server_fd = wl_event_loop_get_fd(server.loop);
    int host_fd = wl_display_get_fd(host.display);

    for (;;) {
        wl_display_dispatch_pending(host.display);

        /* Never block in a host read: use the non-blocking prepare/read
           pattern so the server loop (headless frame timer) is always
           serviced while waiting on the host socket. */
        if (wl_display_prepare_read(host.display) == 0) {
            wl_display_flush(host.display);
            struct pollfd fds[2] = {
                { .fd = server_fd, .events = POLLIN },
                { .fd = host_fd, .events = POLLIN },
            };
            int ret;
            do {
                ret = poll(fds, 2, -1);
            } while (ret < 0 && errno == EINTR);

            if (ret > 0 && (fds[1].revents & (POLLIN | POLLERR)))
                wl_display_read_events(host.display);
            else
                wl_display_cancel_read(host.display);

            if (ret > 0 && (fds[0].revents & (POLLIN | POLLERR)))
                wl_event_loop_dispatch(server.loop, 0);
        } else {
            wl_event_loop_dispatch(server.loop, 0);
        }
        wl_display_flush_clients(server.wl_display);
        wl_display_dispatch_pending(host.display);

        /* The headless output fires a frame signal at ~60Hz; render then
           (also when a redraw was requested directly). */
        if (frame_pending || needs_redraw) {
            frame_pending = false;
            needs_redraw = false;
            render_and_present();
        }
        wl_display_flush(host.display);
    }

    /* Unreachable in practice: every shutdown path exits via
       shutdown_cleanup(). Kept for completeness. */
    shutdown_cleanup();
    return 0;
}