fix(cua-driver): decode GNOME window snapshots through typed D-Bus - #4809

Summary

• Problem this solves: an apostrophe or escaped quotation mark in any GNOME window title can prevent the driver from parsing the complete WinRects window snapshot. Discovery then loses authoritative IDs and geometry for unrelated windows too, and window capture or activation can fail even though full-desktop capture still works.
• What changed: read GetRects as its declared D-Bus string using the existing zbus dependency. Parse the decoded JSON directly for listing, geometry, trusted window lookup and focus verification. Preserve the verified unique helper owner, browser-helper version checks and bounded call behavior. Declare D-Bus as a native test dependency in the Nix unit-check derivation so the private-session transport test can execute in its sandbox.

Reproduction and user impact

On GNOME/Wayland with the WinRects helper active:

1. Keep a terminal window open and set its title to Tomorrow's meeting.
2. Open another application, such as Feishu, and ask the driver to list its windows, capture its window or activate it.
3. GetRects still returns both windows, but gdbus call renders the JSON inside a GVariant string with an additional escaping layer. The existing first-[/last-] extraction leaves that escaping intact, so serde_json rejects the entire snapshot before PID filtering.
4. Rename the terminal to Plain title and repeat: the parser succeeds.

This pattern was observed in a real GNOME session: punctuation in a terminal title broke discovery and window targeting for an unrelated Feishu window. Titles and IDs above are synthetic. No private session data is included.

A headless reproduction using GLib-generated GVariant replies and the actual upstream Rust parse_window_origin function confirms the bug in both cua-driver-rs-v0.34.0 and current main:

The replacement regression uses a mock D-Bus service and checks that punctuation, backslashes, newlines and Unicode survive the transport, and that a separate target window can still be filtered and located.

Before / after illustration

These AI-generated diagrams explain the reproduced parser behavior. They are not desktop screenshots or evidence of a live Feishu replay. The desktop stays visible in both; only authoritative window metadata becomes unavailable/available. Assets live on a separate fork branch and are not part of the source diff.

Before	Proposed fix

Related work

No duplicate parsing fix was found in the reviewed open and closed PRs. #2995 changes GNOME compatibility/geometry but retains display-text parsing; #4011 changes cursor dispatch; #3887 addresses fractional scaling. This PR does not resolve those separate issues.

RFC: not required; this repairs decoding of an existing native D-Bus reply without changing a public SDK, CLI, MCP, helper protocol, compatibility policy or permission boundary. This is a small, unselected contribution pending maintainer review.

Compatibility and risk

• User-visible, API/CLI/MCP, migration, permission, or platform impact: scoped to the Linux GNOME helper path used for Wayland discovery and targeting. macOS, Windows, X11 and other compositor adapters are not modified. No new dependency or helper installation is needed. The wire method remains GetRects() -> string containing JSON.
• Risk and rollback: replaces the snapshot transport, so helper connection failure, timeout, exact owner identity and synchronous calls from an existing Tokio runtime need validation. The separate-thread runtime follows the existing KDE adapter pattern; the snapshot operation retains an 800 ms timeout. Revert this file to roll back.

Validation

Candidate: 7dc974445297fd0408878efe520651c963cc6670, based on main a7524cfd1d3e959963b43954d43f27c4bd260f08. Rust 1.97.1; no dependency changes.

The original Rust checks below ran on 613e10ea97d637de9e16af20f2f4d53b2c5b326f. Commit 69476a44bdcc69512f05806c9e7f08b10244025d corrected only the committer identity/signature and retained its tree. The current candidate adds only nativeCheckInputs = [ pkgs.dbus ]; and its explanatory comment in the Nix unit-test derivation; all Rust sources remain identical. GitHub verifies both follow-up signatures as valid.

• cargo fmt --all -- --check and git diff --check: passed.
• Focused cargo test --locked -p platform-linux --lib wayland::shell_helper::tests -- --nocapture: eight ordinary tests passed; the private-bus child regression also passed.
• cargo test --locked -p platform-linux --lib: 637 passed, one failed, 11 ignored. The normal private-bus regression passed and invokes its ignored transport owner test under dbus-run-session; CI's whole-crate test command therefore exercises the regression without a desktop bus or extra runner filter.
• cargo test --locked -p platform-linux --all-targets -- --test-threads=1: the same unchanged overlay::tests::unreported_arrival_releases_the_waiter_after_the_cap assertion failed at overlay.rs:3853. The overlay test also failed when rerun alone with --exact. Cargo stopped after the library suite, so subsequent targets are not claimed as passing.
• Strict cargo clippy --locked -p platform-linux --lib --tests --no-deps -- -D warnings: failed on six distinct diagnostics in unchanged tools/impl_.rs, input/mod.rs, wayland/mod.rs and wayland/hyprland.rs (11 emitted diagnostics across targets). None points to the changed helper. No clean lint pass is claimed.
• Manual/platform evidence: the actual upstream parser rejects both GLib-generated quoted-title fixtures while accepting normal-title controls. The isolated D-Bus regression verifies the decoded string, exact title, focus, geometry and an unrelated target PID. This proves the transport/parser contract, not delivery to a live application.
• CI on 69476a4: the ordinary Linux Rust job passed, including typed_window_snapshot_runs_on_private_bus. The Nix unit job stopped before decoder assertions because dbus-run-session was absent (637 passed, 1 failed, 11 ignored). The previously observed local overlay failure passed in CI. The current candidate supplies the missing executable as a check-only dependency and keeps the transport regression enabled.
• Follow-up validation on 7dc9744: nixfmt --check nix/cua-driver/tests/rust-unit.nix, cargo fmt --all -- --check, and git diff --check passed. Nix is unavailable locally. The new Nix CI run is awaiting upstream maintainer approval for the fork update; no successful Nix result is claimed yet.
• Known gaps: ordinary PR CI, the affected live GNOME lane and the required representative desktop matrix must run on the final candidate before marking ready or merging. No live Feishu replay or cross-platform desktop certification is claimed. The overlay failure and strict-lint diagnostics in unchanged files remain visible rather than expanding this one-file fix.

Contributor and release checks

• The PR is focused and the description matches the helper change and its Nix test dependency.
• This change does not require an RFC.
• Tests and platform-evidence gaps are explained.
• The PR title is a Conventional Commit describing the production change.
• No external contribution was transplanted; implementation follows existing repository SDK facilities.
• Commit authorship uses the contributor's GitHub-linked email and verified signing key.
• Before merge: required CI, desktop validation and CLA checks pass.
• Release: user-visible bug fix; a patch release is intended, so no-release does not apply.

Agent assistance was used for investigation, drafting and validation. The human submitter remains responsible for reviewing the diff and the evidence.