feat: add whyoolw/dropwall — drag-and-drop wallpapers

[wioletowa]

Plugin

• Id: whyoolw/dropwall
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

DropWall turns the bare Wayland desktop into an image drop target. Dropping a local JPG, PNG, WebP, BMP, or GIF applies it through noctalia.setWallpaper(), with optional per-monitor targeting and an optional non-overwriting copy into Noctalia's wallpaper directory.

The drop target is fully transparent at rest and shows a subtle dashed highlight during a drag. Monitor hotplug is handled by the GTK worker.

External dependencies

• python3: runs the local supervisor and GTK worker with bytecode writes disabled.
• python-gobject: Python bindings for GTK/GDK.
• gtk3: drag-and-drop surface.
• gtk-layer-shell: one desktop-layer drop surface per output.

Process and I/O disclosure:

• One noctalia.runStream() starts dropwall_supervisor.py; it owns one dropwall_helper.py child and restarts that child after an unexpected exit.
• The worker writes a mode-0600 PID/lock file at $XDG_RUNTIME_DIR/noctalia-dropwall.lock to prevent duplicate instances.
• When Copy into wallpaper directory is enabled, each drop starts one short-lived dropwall_copy.py process. The current theme-mode directory is resolved at drop time. A Linux pidfd ties the copier to the exact GTK worker that accepted the drop, so stopping or reloading the plugin aborts the copy and removes its temporary file. The copier writes a private temporary file, flushes/fsyncs it, and atomically hard-links the complete inode to a non-existing final name; existing files are never overwritten and collisions receive a numeric suffix. A failed copy falls back to the original file. Before copying, it deletes only owned .dropwall-copy-*.tmp files older than 24 hours that an unclean shutdown may have left in that directory.
• Wallpaper persistence itself goes through Noctalia's in-process wallpaper API.
• There are no network requests and no downloaded or remotely executed code.

Testing

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against: v5.0.0-beta2-39-g9261d918b5f4
• Plugin API level: 3

Checks performed:

• Community validator with current upstream schema: Validated 16 plugin manifest(s).
• GitHub Actions validate: pass.
• Live Niri 26.04 session: one supervisor and one GTK worker started; the worker held the runtime lock and created the output drop surfaces.
• Terminated the GTK worker: the same supervisor replaced it with exactly one new worker and updated the lock PID.
• Disabled the plugin: both processes exited and no DropWall process remained.
• Exercised atomic collision-safe copying, private destination permissions, interrupted-copy cleanup, worker-lease expiry, and percent-encoded paths containing spaces, quotes, %, tabs, newlines, and Unicode; remote-host file URIs and NUL paths were rejected.
• Thumbnail verified as a 960×540 WebP (42,012 bytes).

Screenshots / Videos

The runtime surface is transparent except for its dashed drag-hover highlight. Store card generated at the required 960×540 size:

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the README template, documents every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[ItsLemmy]

The README lacks the required ## Plugin and ## Usage sections. Consequently, it also fails to document the manifest ID whyoolw/dropwall and service entry service in the required Plugin section.

You can take a look at the other plugin for inspiration.

[wioletowa]

updated!