test: avoid unchecked option parsing in Flatpak regression

The seccomp list named libc::SYS_kexec_file_load, which libc (0.2.190) defines for x86_64 and
aarch64 but not riscv64, so the release's Linux riscv64 build stopped with E0425. riscv64 takes
the number from the kernel's generic table, 294, as aarch64 does; the test checks libc's aarch64
value against it.

Cargo.lock

@@ -2022,7 +2022,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "arboard",
  "chrono",
@@ -2050,7 +2050,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-calc"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "gridcraft-core",
  "gridcraft-formula",
@@ -2062,7 +2062,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-chart"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "gridcraft-calc",
  "gridcraft-core",
@@ -2073,7 +2073,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-cli"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "gridcraft-engine",
  "gridcraft-mcp",
@@ -2086,7 +2086,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-core"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "chrono",
  "js-sys",
@@ -2097,7 +2097,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-engine"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "gridcraft-calc",
  "gridcraft-chart",
@@ -2120,7 +2120,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-formula"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "gridcraft-core",
  "serde",
@@ -2129,7 +2129,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-functions"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "gridcraft-core",
  "regex",
@@ -2137,7 +2137,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-math"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "ratex-font",
  "ratex-layout",
@@ -2147,7 +2147,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-mcp"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "gridcraft-engine",
  "log",
@@ -2156,7 +2156,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-model"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "gridcraft-core",
  "gridcraft-formula",
@@ -2169,18 +2169,18 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-numfmt"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "gridcraft-core",
 ]
 
 [[package]]
 name = "gridcraft-pdf"
-version = "0.16.0"
+version = "0.19.1"
 
 [[package]]
 name = "gridcraft-sandbox"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "landlock",
  "libc",
@@ -2191,7 +2191,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-ui-egui"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "craft-ui",
  "craft-update",
@@ -2218,7 +2218,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-web"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "craft-web-api",
  "craft-web-host",
@@ -2237,7 +2237,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-xlsx"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "aes",
  "gridcraft-core",
@@ -6708,7 +6708,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.16.0"
+version = "0.19.1"
 dependencies = [
  "gridcraft-engine",
  "serde_json",

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/gridcraft", "apps/gridcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.16.0"
+version = "0.19.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"

crates/sandbox/src/linux.rs

@@ -31,6 +31,12 @@ const SYS_SETXATTRAT: libc::c_long = 463;
 const SYS_REMOVEXATTRAT: libc::c_long = 466;
 const SYS_OPEN_TREE_ATTR: libc::c_long = 467;
 const SYS_FILE_SETATTR: libc::c_long = 469;
+// `libc` names no kexec_file_load on riscv64 (0.2.190). It takes 294 from the kernel's generic
+// table there, as on aarch64, where `libc` names it.
+#[cfg(target_arch = "riscv64")]
+const SYS_KEXEC_FILE_LOAD: libc::c_long = 294;
+#[cfg(not(target_arch = "riscv64"))]
+const SYS_KEXEC_FILE_LOAD: libc::c_long = libc::SYS_kexec_file_load;
 
 pub fn support() -> Support {
     match arch() {
@@ -223,7 +229,7 @@ fn denied_calls() -> Vec<libc::c_long> {
         libc::SYS_finit_module,
         libc::SYS_delete_module,
         libc::SYS_kexec_load,
-        libc::SYS_kexec_file_load,
+        SYS_KEXEC_FILE_LOAD,
         libc::SYS_swapon,
         libc::SYS_swapoff,
         libc::SYS_reboot,
@@ -455,6 +461,9 @@ mod tests {
         #[cfg(target_arch = "x86_64")]
         assert_eq!(SYS_FCHMODAT2, libc::SYS_fchmodat2);
         assert_eq!((SYS_SETXATTRAT, SYS_REMOVEXATTRAT, SYS_OPEN_TREE_ATTR, SYS_FILE_SETATTR), (463, 466, 467, 469));
+        // The generic table's number, which riscv64 writes here, is the one `libc` gives aarch64.
+        #[cfg(target_arch = "aarch64")]
+        assert_eq!(libc::SYS_kexec_file_load, 294);
     }
 
     #[test]

crates/ui-egui/tests/flatpak_updates.rs

@@ -0,0 +1,27 @@
+//! Release and source Flatpaks must allow release checks and host update helpers.
+fn finish_args(manifest: &str) -> Vec<&str> {
+    manifest
+        .split("finish-args:")
+        .nth(1)
+        .unwrap_or_default()
+        .lines()
+        .take_while(|line| line.is_empty() || line.starts_with(' ') || line.starts_with('#'))
+        .filter_map(|line| line.trim().strip_prefix("- "))
+        .map(|arg| arg.trim_matches(['\'', '"']))
+        .collect()
+}
+
+#[test]
+fn flatpak_update_permissions() {
+    let manifests = [
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml"),
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.gridcraft.yml"),
+    ];
+    let args = manifests.map(finish_args);
+    assert_eq!(args[0], args[1], "source and release permissions must agree");
+    for permissions in args {
+        for required in ["--share=network", "--talk-name=org.freedesktop.Flatpak"] {
+            assert!(permissions.contains(&required), "missing update permission: {required}");
+        }
+    }
+}

packaging/linux/flatpak/ai.storyteller.gridcraft.bundle.yml

@@ -17,6 +17,8 @@ runtime-version: '25.08'
 sdk: org.freedesktop.Sdk
 command: gridcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
   - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland

packaging/linux/flatpak/ai.storyteller.gridcraft.yml

@@ -18,6 +18,8 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: gridcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
   - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland