Fix host-run and profile input, and make gateway egress diagnosable

[pjbgf]

Running things in a profile

• host-run no longer carries the launching session's DESKTOP_STARTUP_ID and
  XDG_ACTIVATION_TOKEN into the profile. They were placing windows on the
  profile's default workspace instead of the one being looked at.
• host-run returns once the command starts, and is authorised against the
  profile's display.
• The profile's window manager is given the profile's DISPLAY by name rather
  than inheriting the host's, which the profile container holds so the
  compositor can present through it.
• The keyboard layout is taken from the running X server on X11 and from
  localectl on Wayland, instead of always preferring the configured one. A
  profile was coming up on a layout its user does not type on.
• The host timezone travels as TZ rather than a mount.

Seeing what the gateway is doing

• The gateway writes to a session log instead of whichever terminal happened to
  start it, read back with qubesome gateway logs, narrowed with -profile
  and -workload.
• qubesome doctor reports the gateway's egress: refused hosts are named at
  ok, since a denial is the policy working, and gateway errors warn.
• gateway status no longer reports a config the running gateway may not have
  come from.

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain in gateway shutdown, log handling, and configuration or diagnostic attribution.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This pull request improves profile-aware execution and display/input propagation while adding gateway logging, lifecycle controls, and egress diagnostics.

Changes:

• Routes host-run and profile windows to the correct display.
• Propagates keyboard layout, timezone, and gateway proxy settings.
• Adds gateway logs, status/stop commands, summaries, and doctor checks.

File summaries

File	Reviewed change and final review note
internal/util/xkb/xkb.go	Selects keyboard layout based on the session type.
internal/util/xkb/xkb_test.go	Tests layout source preference and fallback.
internal/util/tz/tz.go	Resolves host timezone data for sandboxes. Final finding: nit (1 vote) on the malformed validation sentence.
internal/util/tz/tz_test.go	Tests timezone resolution.
internal/runners/bwrap/testdata/supervised.golden	Updates supervised Bubblewrap expectations.
internal/runners/bwrap/testdata/plain.golden	Updates plain Bubblewrap expectations.
internal/runners/bwrap/testdata/hostnet.golden	Updates host-network Bubblewrap expectations.
internal/runners/bwrap/testdata/granted.golden	Updates granted-access Bubblewrap expectations.
internal/runners/bwrap/spec.go	Adds timezone mounts and gateway proxy environment.
internal/runners/bwrap/run.go	Resolves timezone and proxy inputs for workloads.
internal/runners/bwrap/run_test.go	Tests updated sandbox inputs.
internal/runners/bwrap/proxyenv_test.go	Tests gateway proxy environment behavior.
internal/profiles/profiles.go	Propagates profile timezone and session settings.
internal/profiles/profiles_test.go	Tests profile environment propagation.
internal/profiles/display.go	Targets the profile display explicitly.
internal/profiles/display_test.go	Tests display environment and arguments.
internal/gateway/summary.go	Summarizes gateway decisions and errors.
internal/gateway/summary_test.go	Tests gateway summaries.
internal/gateway/stop.go	Implements gateway shutdown. Final finding: critical (1 vote) because teardown is not coordinated before restart.
internal/gateway/stop_test.go	Tests gateway stopping behavior.
internal/gateway/status.go	Reports gateway configuration and runtime state.
internal/gateway/status_test.go	Tests gateway status reporting.
internal/gateway/run.go	Redirects gateway output and records lifecycle state.
internal/gateway/proxyaddr_test.go	Tests proxy endpoint calculation.
internal/gateway/logs.go	Reads, filters, tails, and follows logs. Findings: critical (1 vote) for unbounded -n allocation, also at line 241; moderate (1 vote) for unbounded unterminated-line allocation, O(total lines × K) tailing, and missing retention limits; nit (1 vote) for the misleading missing-log error.
internal/gateway/logs_test.go	Tests gateway log handling.
internal/gateway/logline.go	Parses and filters gateway log fields. Final finding: moderate (1 vote) because quoted escape sequences are not decoded.
internal/gateway/logline_test.go	Tests log parsing and selectors.
internal/gateway/attach.go	Computes workload gateway proxy endpoints.
internal/files/files.go	Adds session gateway log paths.
internal/doctor/session.go	Adds gateway egress diagnostics. Final finding: moderate (1 vote) because ambiguous config resolution can suppress the active gateway checks.
internal/doctor/session_test.go	Tests session diagnostics.
internal/doctor/environment_test.go	Extends doctor environment support.
internal/doctor/env.go	Reads gateway log summaries.
cmd/cli/root.go	Registers gateway commands.
cmd/cli/host_run.go	Filters session variables and launches host commands asynchronously. Final finding: moderate (1 vote) because the Wayland session type is preserved instead of forcing X11.
cmd/cli/host_run_test.go	Tests host-run environment filtering.
cmd/cli/gateway.go	Implements gateway status, stop, and logs commands. Findings: moderate (3 votes) for falling back to unrelated user config, and moderate (1 vote) for silently omitting unresolved active profile links.
cmd/cli/gateway_test.go	Tests gateway configuration selection.

Review details

Suppressed comments (11)

cmd/cli/gateway.go:106

• This silently discards an active profile whose config symlink cannot be resolved. If another profile resolves, the code can treat that one config as authoritative; if all fail, it reaches the unrelated fallback below. Treat any unresolved active link as unknown/ambiguous instead of omitting it, otherwise gateway status can attribute the running gateway to the wrong config.

		target, err := filepath.EvalSymlinks(path)
		if err != nil {
			continue

cmd/cli/host_run.go:49

• hostRunEnv removes WAYLAND_DISPLAY, but it preserves the launching session's XDG_SESSION_TYPE=wayland. On a Wayland host this still lets GUI toolkits select the host Wayland backend and bypass the profile's X server; the profile environment itself explicitly forces XDG_SESSION_TYPE=X11 in internal/profiles/profiles.go:861. Set the session type to X11 along with DISPLAY so host-run is consistently directed to the profile display.

	return append(env,
		"DISPLAY=:"+strconv.Itoa(int(display)),
		"XAUTHORITY="+cookie,
	)

internal/doctor/session.go:40

• This branch treats the caller's config as authoritative, but bare doctor still loads it through profileConfigOrDefault(""); when multiple active profiles come from different configs, that helper falls through to the user-level config. If that fallback has no gateway (or a different one), this early return suppresses the real session gateway and egress checks even when a gateway is running. The session check needs an explicit unknown/ambiguous-config path, or the CLI must use the same session-config resolution as gateway status.

	checks := []Check{holder, gateway}
	if gateway.Status == OK {
		// Readiness and egress only say something once there is a
		// gateway to ask about. Piling a second failure on top of the
		// same cause would bury the one worth reading.
		checks = append(checks, checkGatewayReady(env), checkGatewayEgress(env))

internal/gateway/logline.go:60

• logValue recognizes quoted slog fields but does not decode their escape sequences; it drops the backslash and copies only the following byte. An error such as msg="dial failed\nretry" is therefore summarized as dial failednretry (and escaped tabs or other characters are also corrupted), so doctor can report the wrong LastError. Decode the complete quoted token with the same escaping rules as the slog/text format before returning it.

			case '\\':
				if i+1 < len(rest) {
					i++
					b.WriteByte(rest[i])

internal/gateway/logs.go:182

• ReadString reads and allocates the entire unterminated suffix before returning io.EOF, so the maxLineLen check runs only after an arbitrarily large chunk has already been allocated. A long partial gateway line can therefore make gateway logs -f consume unbounded memory despite the documented limit; read bounded fragments and retain an explicit oversized-line discard state across follow ticks.

	for {

internal/gateway/logs.go:241

• -f keeps an open descriptor and leaves its reader at the old EOF. Truncating this same inode when a new gateway starts does not reset that reader, so a follow running across gateway stop and the next launch skips the new gateway's initial output until enough bytes pass the old offset (and may miss it entirely). The follower needs to detect truncation and seek/reset before reading the new log.

func openLog(path string) (*os.File, error) {

internal/gateway/logs.go:241

• The gateway sandbox writes through the descriptor installed as cmd.Stdout/cmd.Stderr, while the uplink opens the same path with O_APPEND in appendLog. This descriptor is not append-only, so after the uplink appends a record the gateway's stale file offset can overwrite it and lose the very diagnostics this log is meant to preserve. Keep the initial truncation but also open this descriptor with O_APPEND so both writers append atomically.

func openLog(path string) (*os.File, error) {

internal/gateway/logs.go:124

• This is described as a ring, but it shifts every retained line for every input line. gateway logs -n K therefore becomes O(total_lines*K), which can make a large session log very slow; use a circular index or queue so eviction is O(1).

		if len(ring) == last {
			ring = append(ring[:0], ring[1:]...)

internal/gateway/logs.go:70

• This error says the session never started a gateway, but a gateway started by an older qubesome version can be running without the new log; doctor already treats that as a missing-log case. The message should describe the unavailable log rather than incorrectly asserting that no gateway was started.

		if errors.Is(err, os.ErrNotExist) {

internal/gateway/logs.go:224

• The session log is opened in append mode for the uplink and is only truncated when a new gateway starts; no size or retention bound is applied. A long-lived or busy browser session can therefore accumulate one line per proxy decision until it consumes the user's run-directory disk space. Add a bounded/rotated log policy (or another explicit retention limit) before making this the persistent gateway output.

// explaining a gateway that had trouble coming up.
func appendLog(path string) (*os.File, error) {
	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_APPEND, files.FileMode)
	if err != nil {

internal/util/tz/tz.go:29

• The sentence "A path that does not match names no zone" is grammatically malformed and obscures the validation rule. Rephrase it to state that a path which does not match a zone name does not name a zone.

• Files reviewed: 42/42 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Six moderate findings remain unresolved across gateway status, host-run isolation, log following, gateway cleanup, and timezone mounting.

Review details

Suppressed comments (6)

Previously missed (1) — in code that hasn't changed since the last review.

cmd/cli/host_run.go:48

• Removing WAYLAND_DISPLAY alone does not prevent a Wayland client from connecting to the host compositor: libwayland falls back to $XDG_RUNTIME_DIR/wayland-0 when the variable is unset, and this function deliberately preserves both XDG_RUNTIME_DIR and the host XDG_SESSION_TYPE. On a Wayland host, a GTK/Qt command can therefore still ignore DISPLAY=:... and open on the host desktop instead of the profile. Force the launched command onto X11 and make the host Wayland socket unavailable in this environment.

cmd/cli/gateway.go:126

• This fallback guesses the user-level config whenever no active config symlink can be resolved. Ordinary local starts do not create an entry in activeConfigs, and a gateway also outlives the profile that started it, so gateway status can report the user config's image, policy, and subnet for a gateway started from a project or Git config. Persist the source config with the gateway when it starts, or report the configuration as unknown instead of inferring it here.

	// No profile running, or one whose config no longer reads. The
	// user-level file is the only thing left that describes a gateway.
	return profileConfigOrDefault(""), ""

internal/gateway/logs.go:109

• bufio.Scanner returns the final unterminated token as a line. If the gateway is writing a record while the initial read runs, this emits only the prefix and leaves follow at EOF; the remainder is then treated as a new line, so filters can split or permanently miss that record. Preserve an unterminated tail and combine it with the next read, as followOnce already does.

	scanner := bufio.NewScanner(f)
	scanner.Buffer(make([]byte, 0, bufio.MaxScanTokenSize), maxLineLen)

	for scanner.Scan() {

internal/gateway/logs.go:170

• Follow keeps one file descriptor and its offset for the entire command, but restarting the gateway truncates this same log path with O_TRUNC and writes the new log from offset 0. The follower then remains past the new EOF and skips the new gateway's initial records (only resuming after the file grows beyond the old offset). Detect truncation and reset/reopen the reader when the file shrinks.

func follow(ctx context.Context, w io.Writer, f *os.File, selects func(string) bool) error {
	ticker := time.NewTicker(followInterval)
	defer ticker.Stop()

	reader := bufio.NewReader(f)
	var pending strings.Builder

	for {
		select {
		case <-ctx.Done():
			// The only way a follow ends is by being asked to stop, so
			// that is not an error to report.
			return nil
		case <-ticker.C:
			if err := followOnce(w, reader, &pending, selects); err != nil {

internal/gateway/stop.go:86

• waitGone only observes the inner sandbox PID; the reap goroutine still waits for the outer bwrap and then unconditionally removes this shared state path. Once this method removes the record and releases the lock, a replacement gateway can start and write a new record before the old reaper runs, after which the old reaper deletes the replacement's state. Coordinate with the outer-process reaper or make cleanup conditional on the PID/start time that it originally recorded.

	if err := waitGone(g.StatePath, stopGrace, stopPoll); err != nil {
		return st.PID, err
	}

	// A qubesome run at a terminal exits long before the gateway it started

internal/util/tz/tz.go:47

• SandboxPath is a nested file under /usr/share/zoneinfo, but the workload and profile mount builders pass it directly to bubblewrap without creating the destination. An image without the host's exact zone file (common for minimal images) makes the bind fail and prevents the sandbox from starting, so the new timezone propagation does not work for those images. Create the destination in the sandbox setup or mount the host file at a guaranteed existing path before setting TZ.

• Files reviewed: 42/42 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain in tunnel output, sandbox mounts, gateway state, and diagnostics.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (8)

Previously missed (1) — in code that hasn't changed since the last review.

cmd/cli/gateway.go:114

• sessionConfig treats the currently active profile config as the source of the already-running session gateway, but Gateway.Up reuses an existing gateway and reload only asks that process to reread its already-mounted policy; it never replaces the image or policy mount. If gateway A is running and a profile from config B remains active, status reports B's image, policy, and subnet for gateway A. Persist the gateway's source configuration when starting it and read that record here, or report the source as unknown when it cannot be established.

cmd/cli/gateway.go:126

• This fallback is not authoritative when no profile is active, or when the active profile's config can no longer be read: a session gateway can outlive the profile that started it, so the user-level config may describe a different image, policy, and subnet. Returning that config makes gateway status claim details about a gateway it did not come from. Use a persisted gateway source record, otherwise leave the configuration unknown.

	// No profile running, or one whose config no longer reads. The
	// user-level file is the only thing left that describes a gateway.
	return profileConfigOrDefault(""), ""

internal/doctor/session.go:212

• When a log contains both a gateway error and policy denials, this early return drops the denied count and host names entirely. A denial is still the useful explanation for a workload that cannot reach a host, even when an unrelated error also occurred; the documented egress report should retain both facts (with an overall warning for the error) instead of forcing the user to reconstruct the denials from the raw log.

	if summary.Errors > 0 {
		return Check{
			Name:   name,
			Status: Warn,
			Detail: fmt.Sprintf("the gateway reported %s, most recently %q",
				plural(summary.Errors, "error"), summary.LastError),
			Fix: "Read `qubesome gateway logs` for the whole of it. `-workload` and `-profile` " +
				"narrow it to one workload.",
		}

internal/gateway/logs.go:289

• -f treats any nondecreasing file size as the same log. If a replacement gateway truncates this path and writes at least the old size before the next 200 ms poll, the reader stays at the old offset and skips the beginning of the new gateway's log, including early decisions. Detect the truncation/restart using file metadata or reopen/reset the reader rather than relying only on fi.Size() < size.

	if fi.Size() >= size {
		return false, nil

internal/gateway/stop.go:89

• Because waitGone treats a zombie as exited, this removal can happen before the profile process that launched the gateway has reaped its outer bwrap and its reap goroutine. If a new launch writes a new gateway state after Stop returns, the old reaper unconditionally removes the same path and erases the new gateway's record. Coordinate the outer reaper or make state removal conditional on the recorded PID/start time before removing it here.

	if err := os.Remove(g.StatePath); err != nil && !errors.Is(err, os.ErrNotExist) {

internal/gateway/tunnel.go:110

• CONNECT establishes a tunnel for any 2xx response, not only 200 OK. A proxy returning another successful status (for example 201 or 204) is treated here as a policy refusal, so SSH is rejected even though the tunnel was established.

	if resp.StatusCode != http.StatusOK {

internal/profiles/profiles.go:776

• This host-zone mount is unconditional even when profile.Timezone is set. A profile configured for a zone such as UTC can therefore fail because the image lacks the host's zone file/path, although that file is not needed for the configured timezone. Only add the host zone mount when the profile timezone is empty.
  internal/runners/bwrap/spec.go:373
• This host-zone mount is unconditional even when profile.Timezone overrides the host. A workload using a configured zone can fail because its image lacks the host's zone file/path, despite never using this mount. Guard the mount on profile.Timezone == "" (and still handle missing destination parents).

• Files reviewed: 48/48 changed files
• Comments generated: 4
• Review effort level: Lite