arch-updater 2.1.0: maintenance section (cache prune, orphans, fwupd), keyring-first, free-space gate, sleep inhibitor, run-log analysis

[UmedjonBA]

Plugin

• Id: yuuto/arch-updater
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Adds a maintenance layer around the updater, 2.0.1 → 2.1.0:

• Maintenance section under the package list, refreshed with every check (all scans unprivileged): package cache size with a one-click prune (paccache keeps a configurable number of versions; the dry-run count and freed space are shown up front), orphaned packages (pacman -Qtdq) with a confirmed pacman -Rns removal (same two-click arm as rollback), and a firmware-updates shortcut when fwupdmgr is installed (opens a terminal — firmware flashing is interactive by nature).
• Keyring first (toggleable, on by default): each update run starts with pacman -Sy --needed archlinux-keyring, so a machine that skipped updates for a few weeks doesn't die on "signature is unknown trust".
• Free-space gate: an update is refused up front when root has less than a configurable minimum (default 1 GiB) plus twice the estimated download size free — better than pacman hitting ENOSPC mid-transaction.
• Sleep inhibitor: background runs are wrapped in systemd-inhibit --what=sleep:idle, so a closed laptop lid can't interrupt a transaction.
• Run-log analysis: when a run finishes, its log is scanned for known failure signatures — a failed initramfs generation (shown in red and raised as a critical notification: a run can exit 0 with a broken initramfs, and the user must see that before rebooting), a failed pacman transaction, and signature errors.

Everything is behind settings (maintenance_enabled, cache_keep, keyring_first, inhibit_sleep, min_free_mib) with the behavior-preserving defaults documented in the README; min_free_mib = 0 disables the gate, and turning the maintenance section off skips its scans entirely.

External dependencies

All declared in dependencies: existing ones plus du, df, cut (cache/free-space measurements), systemd-inhibit (sleep inhibitor, skipped when absent). paccache comes with the already-required pacman-contrib. fwupdmgr is deliberately not in dependencies: it is optional, feature-gated on commandExists, and documented as such in the README.

Testing

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against: v5.0.0-beta.10 (noctalia-git 5.0.0.r5344.g74e6c2790)
• Plugin API level: 9

Exercised live on a real system (Arch, niri): full check cycle with the maintenance scan (panel reported a 12.2 GiB cache with 397 prunable versions / 7 GiB reclaimable, 17 orphans, correct absence of the fwupd row on a machine without fwupd), prune_cache / remove_orphans / maintenance IPC actions, settings toggles for the new keys, noctalia plugins lint (0/0) and luau-analyze clean. The free-space gate and log-analysis grep patterns were additionally verified against real command output (paccache -dk2 dry-run format, df -Pk, pacman transaction/mkinitcpio log lines).

Screenshots / Videos

Checklist

Ready-for-review requirement: Every box in this section must be checked. If any statement is not true, keep the
pull request as Draft. An explanation does not replace a required check.

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:
Ready-for-review requirement: Every attestation below must be checked.

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[github-actions]

CC @Reiling-Jeff