syncthing: Syncthing status & control (port of the v4 syncthing-status plugin)

[rylos]

What

rylos/syncthing — Syncthing status and control. A port of the v4 syncthing-status plugin by Pir0c0pter0 (credited in the README, MIT) to the v5 Luau plugin API, with the v4 Python helper replaced by direct REST calls.

Entries: bar widget, panel (Folders | Devices tabs, Syncthing Tray-style), headless poller service, global-pause control-center shortcut, /st launcher provider (Enter = rescan folder), desktop widget.

Beyond the v4 feature set: per-folder pause/resume + rescan, per-device pause/resume, sync completion % (bar + per-folder progress bars), transfer rates, last-activity per folder, event notifications (folder done/error, device connect/disconnect), open-web-GUI button.

Every network call, file access, and spawned process

• Network: only the Syncthing REST API at the configured/autodetected GUI URL (default http://127.0.0.1:8384), via noctalia.http with the X-API-Key header. Endpoints: GET /rest/noauth/health, /rest/system/status, /rest/config, /rest/system/connections, /rest/system/error, /rest/stats/folder, /rest/db/status; actions: PATCH /rest/config/folders/<id>, PATCH /rest/config/devices/<id>, POST /rest/db/scan, POST /rest/system/pause, POST /rest/system/resume. Nothing else.
• Filesystem: reads ~/.local/state/syncthing/config.xml (or ~/.config/syncthing/config.xml, or a user-set path) to autodetect the GUI URL and API key. No writes.
• Processes: curl -k only when the user enables the advanced insecure_tls setting on an HTTPS URL (noctalia.http has no way to skip certificate verification); gio open/xdg-open for the "Open web GUI" button.
• The API key is only ever sent to the Syncthing endpoint it belongs to.

Testing

Developed and tested live on Noctalia 5.0.0_beta.3 (Arch, niri) against a real Syncthing instance (1 folder, 5 devices): polling, panel tabs, pause/resume/rescan actions, notifications, launcher, desktop widget. noctalia plugins lint: 0 errors, 0 warnings. plugin_api = 3 — the plugin uses no capability beyond level 3.

Happy to adjust anything (naming, tags, thumbnail) per review.

🤖 Generated with Claude Code

[ItsLemmy]

1. blocking - syncthing/service.luau:134

The curl fallback interpolates cfg.apiKey and cfg.baseUrl directly into a command executed through /bin/sh -c. Double quotes still permit command substitutions such as $() and backticks, while embedded quotes can escape the intended argument. syncthing/service.luau:142 and the GUI opener at syncthing/service.luau:564 have the same unsafe interpolation problem.

Noctalia main now provides allow_insecure_tls through noctalia.http at plugin API 7. Remove the curl branch and use noctalia.http for every request, passing allow_insecure_tls = cfg.insecure. Update syncthing/plugin.toml:9 to plugin_api = 7 and remove the curl-specific claims from syncthing/README.md:61, syncthing/README.md:82, and syncthing/translations/en.json:25.

The remaining GUI opener must robustly shell-quote cfg.baseUrl or use a shell-free opener API.

2. blocking - syncthing/plugin.toml:12

The manifest declares only syncthing, but syncthing/service.luau:564 spawns gio and xdg-open. Repository policy requires external commands to be declared and documented under Requirements.

After migrating insecure TLS to noctalia.http, curl no longer needs to be declared. Declare the remaining opener commands, or simplify the implementation to one safely invoked and declared opener.

[ItsLemmy]

3. Use the thumbnail generator, and use the proper PR template. you skipped all the checklist and important stuff