SellPL
a79d262986
The first enforcement-path code. CLAUDE.md section 3 names `x11rb`, `zbus` and
`nix` for Linux explicitly, so all three are approved and this needed no new
dependency decision.
**KWin backend (primary).** Wayland has no portable focus API (section 6.3), and
this machine runs Plasma 6.6.6 on Wayland — an X11-only design would be blind to
most of the user's own desktop. KWin will not push focus events to an
arbitrary subscriber, so this loads a JavaScript snippet via
`org.kde.KWin /Scripting`, which hooks `workspace.windowActivated` and calls
back over D-Bus with KWin's `callDBus` helper. The daemon owns the bus name, so
KWin always has somewhere to call; if the daemon dies, `callDBus` fails silently
in the script and the compositor is left alone — the fail-open behaviour
section 1.5.4 requires.
The D-Bus surface was introspected on the live session, not read from docs:
$ busctl --user introspect org.kde.KWin /Scripting org.kde.kwin.Scripting
.loadScript method s->i .start method - .unloadScript method s->b
**X11 backend (fallback).** `_NET_ACTIVE_WINDOW` property subscription, resolved
through `_NET_WM_PID` to `/proc/<pid>/exe`. Blind to native Wayland apps under a
Wayland session, which is why it is the fallback and not the primary. It is also
the path that can be tested headless with Xvfb, so it is what CI would exercise.
**No polling anywhere.** Both backends park in a subscription: `callDBus` from
the compositor, `poll_for_event` on the X connection. Nothing in either module
has a timer, which is what keeps the section 5 idle budget at zero.
**zbus is blocking on async-io, deliberately.** `tokio` was available and was
rejected: a reactor thread is measurable idle cost against a zero-wakeup budget,
and several hundred KB against a 5 MB binary. Noted in the manifest so the
decision is visible next to the version pin.
**Size, measured rather than assumed:** the stripped daemon goes 1.364 MB ->
**2.237 MB**, so D-Bus, X11 and the signal handling cost ~870 KB. 2.9 MB of the
5 MB budget remains.
**What is verified, and what is not.** The D-Bus interface is introspected from
the live session. The KWin *JavaScript* API — `workspace.windowActivated`,
`client.resourceClass` — is written against the documented Plasma 6 scripting
surface and has **not** been executed, because doing so would load a script into
the user's running compositor. That is the honest status and LIMITATIONS.md
records it. Nothing here is wired into the event loop yet, so no window is
actually blocked by this PR.
Several API details cost real time and are worth recording: X11 atoms are
interned with a round trip at connect time rather than passed as an unrelated
constant, which silently queries the wrong property; the root event filter
matches on the `_NET_ACTIVE_WINDOW` *atom* rather than the property change type;
and `rusqlite`/`zbus`/`x11rb` all differ from their documented shapes in ways
that only compile once found.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Blocker
A cross-platform app and website blocker for Android, Windows and Linux.
One shared Rust core owns every decision. Platform code observes the OS and
enforces what the core decides. That is what makes the same schedule behave
identically on all three, and it is testable rather than aspirational — the golden
decision tables in tests/ are the parity contract, so a platform disagreeing
with the core fails the build instead of producing a bug report.
Status
M0 — repository bootstrap. The core engine exists and is tested; nothing enforces anything yet. No platform has a working build.
| Milestone | State |
|---|---|
| M0 repo bootstrap | in progress |
| M1 core engine | engine, lock timers and safety guarantees written and tested; SQLite persistence landed in storage/ |
| M2-Linux | not started — daemon is a placeholder |
| M3-Android | not started |
| M4 conditions | not started |
| M5 websites | not started |
| M6 Strict Mode + friction | not started |
| M7 statistics, settings, releases | not started |
Milestone order is Linux-first rather than Android-first. See ADR-15.
What it will do
- Schedules of apps, websites and keywords, with time windows, usage limits, launch counts, Wi-Fi and location conditions
- Blocklist and allowlist modes, with strictest-wins when schedules overlap
- QuickBlock: block a chosen set for a chosen duration
- Strict Mode and a configurable friction ladder, so turning blocking off takes deliberate effort in a weak moment while remaining always possible
- Local usage statistics
What it will not do
This is a friction tool, not a wall. A user with root, ADB, safe mode, a factory reset, or desktop admin rights can always remove it, and that is intended. Factory reset, safe mode and OS recovery are never interfered with. The goal is to outlast an impulse, not to defeat a determined decision.
There is also a hardcoded list of things that can never be blocked — the phone and dialler, emergency calls and alerts, and on desktop the OS shell and the Settings basics needed to keep the machine usable. There is no setting that changes it.
See docs/LIMITATIONS.md for all eight platform limits,
stated plainly, plus the shortfalls in the current code.
Build and test
Requires a stable Rust toolchain. The toolchain is pinned in rust-toolchain.toml.
scripts/ci.sh # everything, stops at the first failure
scripts/ci.sh --keep-going # everything, summarises all failures
cargo test --workspace # tests only
cargo build --workspace # build only
scripts/size-check.sh # the 5 MB stripped daemon gate
Build artifacts go to $HOME/.blocker-target, outside the repository, so target/
never shows up in git status and can be deleted in one command. Override with
CARGO_TARGET_DIR.
Two checks skip on a machine without the relevant toolchain — Android without an SDK, the secret scan without gitleaks. Both skip loudly and are listed in the summary as not-passes. A skip is never reported as a pass.
Layout
core/ the decision engine — pure, no OS calls, no dependencies
storage/ SQLite persistence (rusqlite, bundled), fail-open recovery
tests/ golden decision tables, and the engine purity check
desktop/daemon/ long-lived observer and enforcer (5 MB budget)
desktop/ui/ block-screen window, launched on demand
desktop/platform-linux/ ForegroundWatcher backends, enforcement
desktop/platform-windows/ same, Windows
android/ not started
docs/ architecture, ADRs, limitations, permissions, perf, testing
scripts/ ci.sh, size-check.sh
Documentation
| Document | What it is for |
|---|---|
docs/ARCHITECTURE.md |
The purity contract, next_wakeup, and why the engine has no dependencies |
docs/DECISIONS.md |
17 ADRs, including the two still awaiting a decision |
docs/LIMITATIONS.md |
What the OS will not let us do, and what is not built yet |
docs/PERMISSIONS.md |
Every permission, and what degrades without it |
docs/PERF.md |
Section 5 budgets, and the measurements taken so far |
docs/TESTING.md |
The golden-table contract and the manual checklists |
CLAUDE.md |
The project specification. It governs. |
Performance budgets
| Metric | Target |
|---|---|
| Idle CPU | ~0%, no wakeups without events |
| Idle RAM (daemon) | ≤ 15 MB RSS |
| Block latency | ≤ 150 ms |
| Daemon binary | ≤ 5 MB stripped |
| APK size | ≤ 10 MB |
Currently measured: 1.364 MB stripped daemon, which includes bundled SQLite.
Of the 5 MB budget that leaves 3.8 MB for D-Bus, X11 and a UI toolkit — a real
margin rather than a comfortable one. Enforced in CI from the first commit by
scripts/size-check.sh.
Licence
Not yet chosen. See ADR-17. Choosing a licence is the owner's decision, and it interacts with the UI toolkit choice in ADR-6 (Slint is GPL-3.0 or commercial), so it is not something to settle by accident.
A note on origin
Blocker is a functional reimplementation of the behaviour of existing app blockers. It reuses no third-party name, logo, icon, copy, or screenshot — only behaviour.