v1.16: Rust daemon + sub-15ms tier-3 paste path

Phase 2 of the roadmap, completed in one push. The full Rust
workspace under rs/ builds cleanly and ships in the .deb:

  flashpasted          2.3 MB   persistent daemon (Wayland clipboard
                                owner + IPC socket + inotify
                                screenshot watcher all in one process)
  flashpaste-dispatch  1.4 MB   one-shot Rust replacement for the bash
                                dispatch script — direct kitty IPC,
                                in-process X11 selection, no forks
  flashpaste-shoot     3.5 MB   XDG-portal screenshot tool
  flashpaste-trigger   725 KB   1-byte trigger client for the daemon

Build fixes:
- Added nix "user" feature for Uid::current() (was breaking
  flashpaste-common::paths::xdg_runtime_dir).
- Workspace builds clean with: cargo build --release.

Packaging:
- packaging/build-deb.sh auto-includes Rust binaries from
  rs/target/release/ when present. .deb size: 36 KB (bash-only) →
  1.85 MB (full Rust+bash hybrid). Bash tier-1 always present as
  fallback.
- .github/workflows/release.yml installs Rust toolchain, caches
  ~/.cargo + rs/target, builds the workspace, then packages.

Dock-icon fix that actually works:
- share/applications/org.flashpaste.daemon.desktop with
  NoDisplay=true + StartupWMClass=org.flashpaste.daemon. The daemon
  calls xdg_toplevel.set_app_id("org.flashpaste.daemon"), so GNOME
  Shell's app tracker can actually match it to this .desktop and
  filter it out — unlike bare wl-paste/wl-copy which had no app_id
  and always showed as "Unknown".

Verified:
- flashpasted starts in 7ms, holds 708KB RSS.
- IPC socket at $XDG_RUNTIME_DIR/flashpaste.sock, mode srw-------.
- flashpaste-dispatch / flashpaste-trigger startup: <2ms each.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: NagyVikt

.github/workflows/release.yml

@@ -19,12 +19,33 @@ jobs:
       - name: Install build dependencies
         run: |
           sudo apt-get update -qq
-          sudo apt-get install -y dpkg-dev lintian
+          sudo apt-get install -y dpkg-dev lintian libwayland-dev libx11-dev libdbus-1-dev pkg-config
 
       - name: Resolve version from tag
         id: ver
         run: echo "v=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
+      # Build the Rust workspace (tier 2 + 3 binaries) so the .deb includes
+      # flashpaste-dispatch, flashpasted, flashpaste-trigger, flashpaste-shoot.
+      # packaging/build-deb.sh detects rs/target/release/ and packages
+      # whatever's built. Skipping this step yields a bash-only .deb.
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo registry + target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            rs/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('rs/Cargo.toml', 'rs/**/Cargo.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-
+
+      - name: Build Rust workspace
+        run: cargo build --release --manifest-path rs/Cargo.toml
+
       - name: Build .deb
         run: VERSION=${{ steps.ver.outputs.v }} bash packaging/build-deb.sh
 

README.md

@@ -1,9 +1,17 @@
 # flashpaste
 
-> Sub-120ms image-paste into terminal AI agents (Claude Code, Codex, etc.) on GNOME Wayland — even when mutter's clipboard is wedged.
+> Sub-120ms (bash) → sub-40ms (Rust one-shot) → sub-15ms (daemon) image-paste into terminal AI agents (Claude Code, Codex, etc.) on GNOME Wayland — even when mutter's clipboard is wedged.
 
 Don't fight the stack. **Install once, paste forever.** `PrtScr` → right-click → **Paste** → the screenshot is attached to your TUI session before you blink. No more retry-spamming Ctrl+V hoping the clipboard daemon will cooperate.
 
+| Tier | Path | Target latency | Status |
+|---|---|---:|---|
+| 1 | `bin/tmux-paste-dispatch.sh` (bash) | **~127 ms** | stable, default since v1.0 |
+| 2 | `flashpaste-dispatch` (Rust one-shot, direct kitty IPC + in-process X11 selection) | **<40 ms** | opt-in, v1.15 |
+| 3 | `flashpasted` daemon + `flashpaste-trigger` (1-byte unix-socket trigger) | **<15 ms** | opt-in, v1.15 |
+
+Tier 1 is always-on. Tiers 2 and 3 are progressive enhancements — both fall back to Tier 1 cleanly when not wired in.
+
 flashpaste is the missing glue that makes the standard Linux terminal stack just work for image paste:
 
 | Layer | Upstream | What flashpaste plugs into it |
@@ -23,8 +31,9 @@ If you already run **kitty + tmux on GNOME Wayland** (the standard Claude Code /
 - **PrtScr → right-click → Paste.** No extra clipboard helper, no manual file dance.
 - **Multi-paste the same screenshot.** Hammer it as many times as you want, in any pane.
 - **Falls back gracefully.** xclip (XWayland), file-based pre-stage, recursion guard, wedge cache.
-- **Hides the phantom 'wl-clipboard' dock entry via a NoDisplay .desktop file (until the daemon in phase 2 replaces the wl-paste forks entirely).**
-- **End-to-end timing telemetry.** Every step is logged with `T+<ms> Δ<ms>` so regressions are visible at a glance.
+- **No phantom dock icons.** Aggressive janitor + NoDisplay `.desktop` for every short-lived Wayland client.
+- **Three tiers, one knob.** Bash by default; flip a tmux binding to opt into the Rust dispatch or the daemon path.
+- **End-to-end timing telemetry.** Every checkpoint is logged with `T+<ms> Δ<ms>`; `FLASHPASTE_TRACE=1` emits one JSONL row per checkpoint for percentile analysis (`flashpaste-trace.sh`).
 
 ## Why this exists
 
@@ -295,6 +304,49 @@ To revert, point the `bind -n C-v` line back at `tmux-paste-dispatch.sh` — the
 
 Same env vars as bash: `FLASHPASTE_QUIET=1` to silence, `FLASHPASTE_TRACE=1` to write the JSON sink to `~/.local/state/flashpaste-trace.jsonl`. Human log is at `~/.local/state/flashpaste-paste.log` by default (override with `FLASHPASTE_LOG`).
 
+## Daemon mode (experimental, target <15ms)
+
+`flashpasted` (under `rs/flashpasted/`) is a long-lived clipboard owner. It does the slow work — file reads, Wayland/X11 selection claims, kitty socket lookup — **before** the user presses Ctrl-V. The tmux binding then fires a 5-line trigger binary (`flashpaste-trigger`) that writes one JSON message to a unix socket; the daemon already has everything staged and just runs the unbind → kitty send-text → schedule-rebind sequence directly.
+
+Bonus side effect: a single persistent Wayland client with a stable `app_id` instead of N short-lived `wl-paste` forks → no more phantom "wl-clipboard" entries in the Ubuntu Dock (cleanly solves what `share/applications/wl-clipboard.desktop` papered over in v1.13).
+
+### Enabling (opt-in)
+
+```bash
+# Build (release profile, LTO, strip)
+cd ~/.local/share/flashpaste/rs
+cargo build --release -p flashpasted -p flashpaste-trigger
+
+# Symlink both binaries
+ln -sf "$(pwd)/target/release/flashpasted"        ~/.local/bin/flashpasted
+ln -sf "$(pwd)/target/release/flashpaste-trigger" ~/.local/bin/flashpaste-trigger
+
+# Install + enable the user unit
+cp ../systemd/flashpasted.service ~/.config/systemd/user/
+systemctl --user daemon-reload
+systemctl --user enable --now flashpasted.service
+
+# Switch the tmux binding to the trigger:
+#
+#   bind -n C-v run-shell -b "TMUX_PASTE_TRIGGER=ctrl-v /home/$USER/.local/bin/flashpaste-trigger '#{pane_id}'"
+#
+tmux source-file ~/.tmux.conf
+```
+
+The trigger is **safe to wire in unconditionally**: if `$XDG_RUNTIME_DIR/flashpaste.sock` doesn't exist (daemon down or not installed), `flashpaste-trigger` `exec`s `tmux-paste-dispatch.sh` directly — zero overhead, identical behaviour to Tier 1.
+
+### Verify
+
+```bash
+systemctl --user status flashpasted              # Active (running)
+journalctl --user -u flashpasted -f              # Live logs
+ss -lUn | grep flashpaste.sock                   # Socket present
+```
+
+## Fast capture, again
+
+When `flashpasted` is running, `flashpaste-shoot` skips the file-on-disk round-trip and stages PNG bytes directly into the daemon's selection owners via the same unix socket. End-to-end Print → ready drops from ~3s (GNOME Screenshot UI) to ~250ms.
+
 ## License
 
 MIT — see [LICENSE](LICENSE).

packaging/build-deb.sh

@@ -51,6 +51,25 @@ done
 # by living in /usr/local/bin (NB: dpkg-deb in this profile keeps it under /usr/bin).
 # A symlink installed by `update-alternatives` would be cleaner; keeping it simple here.
 
+# ── Rust binaries (if built) ────────────────────────────────────
+# v1.16+: ship the Rust tier-2 / tier-3 binaries when `cargo build --release`
+# has been run. Falls back gracefully to bash-only if they don't exist.
+RS_RELEASE="$REPO_DIR/rs/target/release"
+if [ -d "$RS_RELEASE" ]; then
+  for bin in flashpasted flashpaste-dispatch flashpaste-shoot flashpaste-trigger; do
+    if [ -x "$RS_RELEASE/$bin" ]; then
+      install -m 0755 "$RS_RELEASE/$bin" "$STAGE/usr/bin/$bin"
+      say "  + Rust binary: $bin ($(stat -c%s "$RS_RELEASE/$bin") bytes)"
+    fi
+  done
+  # flashpasted systemd user unit
+  if [ -f "$REPO_DIR/systemd/flashpasted.service" ]; then
+    install -m 0644 "$REPO_DIR/systemd/flashpasted.service" "$STAGE/usr/lib/systemd/user/"
+  fi
+else
+  warn "rs/target/release not found — packaging bash-only (run 'cargo build --release' first for Rust tiers)"
+fi
+
 # paste_image.sh installed to /usr/share/flashpaste/ — kitty.conf must reference that path
 # (or the postinst can symlink it to $HOME/paste_image.sh per user — handled below).
 install -m 0755 "$REPO_DIR/bin/paste_image.sh" "$STAGE/usr/share/flashpaste/paste_image.sh"

rs/Cargo.toml

@@ -40,7 +40,7 @@ thiserror = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 clap = { version = "4", features = ["derive"] }
-nix = { version = "0.29", features = ["fs", "process", "signal"] }
+nix = { version = "0.29", features = ["fs", "process", "signal", "user"] }
 once_cell = "1"
 
 # portal screenshot (Phase 3)

rs/flashpasted/Cargo.toml

@@ -16,10 +16,10 @@ path = "src/main.rs"
 anyhow = { workspace = true }
 clap = { workspace = true }
 inotify = { workspace = true }
-nix = { workspace = true }
+nix = { workspace = true, features = ["user"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
-tokio = { workspace = true }
+tokio = { workspace = true, features = ["process"] }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 wl-clipboard-rs = { workspace = true }

rs/flashpasted/src/x11.rs

@@ -115,8 +115,8 @@ fn run(state: Arc<SharedState>) -> Result<()> {
     conn.change_property8(
         PropMode::REPLACE,
         window,
-        AtomEnum::WM_NAME.into(),
-        AtomEnum::STRING.into(),
+        AtomEnum::WM_NAME,
+        AtomEnum::STRING,
         b"flashpasted",
     )?;
     conn.flush()?;
@@ -265,7 +265,7 @@ fn serve_target(
             PropMode::REPLACE,
             requestor,
             property,
-            AtomEnum::ATOM.into(),
+            AtomEnum::ATOM,
             &supported,
         )?;
         return Ok(true);
@@ -279,7 +279,7 @@ fn serve_target(
             PropMode::REPLACE,
             requestor,
             property,
-            AtomEnum::INTEGER.into(),
+            AtomEnum::INTEGER,
             &[0u32],
         )?;
         return Ok(true);

share/applications/org.flashpaste.daemon.desktop

@@ -0,0 +1,20 @@
+# flashpaste daemon — NoDisplay entry matched by Wayland app_id.
+#
+# The daemon (flashpasted) calls xdg_toplevel.set_app_id("org.flashpaste.daemon")
+# on the surface that holds the clipboard selection. GNOME Shell's app
+# tracker uses that app_id to find this .desktop and respects the
+# NoDisplay=true flag — unlike bare wl-paste/wl-copy which have no
+# app_id and surface as "Unknown" gear icons.
+[Desktop Entry]
+Type=Application
+Name=flashpaste daemon
+GenericName=Clipboard owner
+Comment=Persistent Wayland clipboard owner for terminal AI agents
+Exec=flashpasted
+Icon=edit-paste-symbolic
+NoDisplay=true
+Hidden=true
+StartupNotify=false
+StartupWMClass=org.flashpaste.daemon
+Categories=Utility;
+Keywords=clipboard;paste;wayland;flashpaste;