Arch package: start the service and let the GUI reach the agent

The control socket is now opened to the tsunagi group (unit), the Arch
package enables and starts the service on install, adds the installing user
to the group, restarts a running agent on upgrade, and depends on the
libraries the tray loads at run time. The tray looks for the agent's socket
again on every poll instead of once at start, and a missing indicator
library is reported instead of panicking. Repository URLs unified.

Co-Authored-By: Claude <noreply@anthropic.com>

dist/arch/README.md

@@ -37,10 +37,15 @@ creates and owns its directories:
 | cache | `/var/cache/tsunagi` |
 | control socket | `/run/tsunagi/agent.sock` |
 
-The polkit rule lets anyone in the `tsunagi` group configure systemd-resolved
-for the overlay zones (the service user is in that group). To run the agent as
-your own user as well, add yourself to the group: `sudo usermod -aG tsunagi
-"$USER"`.
+Installing the package enables and starts the service, and adds the user who ran
+pacman to the `tsunagi` group (log out and in again for it to apply). The
+control socket is open to that group, so members can run `tsunagi status`, the
+CLI and the tray GUI without sudo; anyone else adds themselves with `sudo
+usermod -aG tsunagi "$USER"`. The group also lets its members configure
+systemd-resolved for the overlay zones through the polkit rule.
+
+The GUI package depends on `gtk3`, `libayatana-appindicator` (the tray icon),
+`xdotool` (its `libxdo`), and the usual windowing libraries.
 
 ## Removal
 

dist/arch/build-pkg.sh

@@ -50,6 +50,11 @@ if [ -n "$tray" ]; then
     pkgname=tsunagi-gui
     pkgdesc="Serverless private mesh networking agent, with the tray GUI"
     relations=$'conflict = tsunagi\nprovides = tsunagi\nreplaces = tsunagi\n'
+    # What the tray and its window load at run time; none of it is linked in
+    # statically, so pacman has to be told.
+    for dep in gtk3 libayatana-appindicator xdotool libxkbcommon wayland libx11 libglvnd; do
+        relations+="depend = ${dep}"$'\n'
+    done
     install -D -m 0755 "$tray" "$root/usr/bin/tsunagi-tray"
     install -D -m 0644 "$here/../linux/tsunagi-tray.desktop" \
         "$root/usr/share/applications/tsunagi-tray.desktop"
@@ -64,7 +69,7 @@ cat > "$root/.PKGINFO" <<PKGINFO
 pkgname = ${pkgname}
 pkgver = ${pkgver}-${pkgrel}
 pkgdesc = ${pkgdesc}
-url = https://github.com/Ultradesu/tsunagi
+url = https://github.com/house-of-vanity/tsunagi
 builddate = $(date +%s)
 packager = AB <ab@hexor.cy>
 size = ${size}
@@ -72,21 +77,50 @@ arch = ${arch}
 ${relations}license = WTFPL
 PKGINFO
 
-# Scriptlet: create the dedicated system user the service runs as, keep systemd
-# in step, and refresh the desktop/icon caches (a no-op without a GUI payload).
+# Scriptlet: create the dedicated system user the service runs as, start the
+# service, and let whoever ran pacman use it. The control socket belongs to the
+# `tsunagi` group, so the tray and the CLI work for any member of it; the
+# person installing is added, since the package cannot know anyone else.
 cat > "$root/.INSTALL" <<'INSTALL'
 post_install() {
     getent group tsunagi >/dev/null 2>&1 || groupadd -r tsunagi
     getent passwd tsunagi >/dev/null 2>&1 || \
         useradd -r -g tsunagi -d /var/lib/tsunagi -s /usr/bin/nologin -c "tsunagi agent" tsunagi
-    systemctl daemon-reload >/dev/null 2>&1 || true
     command -v update-desktop-database >/dev/null 2>&1 && \
         update-desktop-database -q /usr/share/applications >/dev/null 2>&1 || true
     command -v gtk-update-icon-cache >/dev/null 2>&1 && \
         gtk-update-icon-cache -q -t /usr/share/icons/hicolor >/dev/null 2>&1 || true
+
+    # Whoever ran pacman through sudo or pkexec (an AUR helper does too).
+    installer="${SUDO_USER:-}"
+    if [ -z "$installer" ] && [ -n "${PKEXEC_UID:-}" ]; then
+        installer="$(getent passwd "$PKEXEC_UID" | cut -d: -f1)"
+    fi
+    if [ -n "$installer" ] && [ "$installer" != root ] && id "$installer" >/dev/null 2>&1; then
+        usermod -aG tsunagi "$installer" >/dev/null 2>&1 || true
+        echo ":: $installer was added to the tsunagi group; log out and in again so the"
+        echo "   tray and the CLI can reach the agent without sudo."
+    else
+        echo ":: add yourself to the tsunagi group to use the tray and the CLI without"
+        echo "   sudo: sudo usermod -aG tsunagi \$USER, then log out and in again."
+    fi
+
+    if [ -d /run/systemd/system ]; then
+        systemctl daemon-reload >/dev/null 2>&1 || true
+        systemctl enable --now tsunagi.service >/dev/null 2>&1 || \
+            echo ":: could not start tsunagi.service; see: systemctl status tsunagi"
+    fi
 }
 post_upgrade() {
-    post_install
+    # Not enabled again: it may have been turned off on purpose. A running
+    # agent is restarted, because the control protocol changes between builds
+    # and a new client cannot talk to an old agent.
+    command -v update-desktop-database >/dev/null 2>&1 && \
+        update-desktop-database -q /usr/share/applications >/dev/null 2>&1 || true
+    if [ -d /run/systemd/system ]; then
+        systemctl daemon-reload >/dev/null 2>&1 || true
+        systemctl try-restart tsunagi.service >/dev/null 2>&1 || true
+    fi
 }
 pre_remove() {
     systemctl disable --now tsunagi.service >/dev/null 2>&1 || true