libs/ · Kotlin · Java · C

Libraries

The code the apps share, kept under libs/ and built into each app that needs it: floating windows, a zero-copy path for GPU frames from a Linux environment into an Android window, a terminal, window blur, a private remote-control listener, the protocol apps use to cooperate with Flotilla, folder-based profile sync and startup diagnostics.

Most of them describe their limits as carefully as their features: what a protocol will not carry, what a log will not record. Those limits are quoted below because they are the design.

floating-overlay

Floating windows

How a floating window is put together The floating-window pieces. An app keeps its own content, sessions and input. floating-overlay's window host wraps that content in a system overlay window with a title bar for dragging, minimising, docking and closing, and a corner for resizing. A per-app window manager tracks the app's windows: focus, front-to-back order and where new windows cascade. Apps that cooperate with Flotilla also talk to it through flotilla-api, a small versioned protocol for layout, workspaces and launching, which carries no text input, shell commands or screen capture. app contentsessions · input · rendering FloatingWindowHosttitle bar · resize corner FloatingWindowManagerfocus · order · cascade flotilla-apiversioned, bounded FlotillaBSP layout · workspaces
The app keeps its content. The library supplies the window, its chrome and the bookkeeping; Flotilla, when present, decides layout.

NOD Term, X11 Droid and Waylandroid used to build the same system overlay window three times. FloatingWindowHost is that window once: the overlay parameters, a focus-aware container, a title bar for dragging, minimising, docking and closing, and a corner for resizing. FloatingWindowManager keeps each app's registry of windows, focus, front-to-back order and the cascade for new windows, and leaves content, sessions and teardown to the app.

It also holds the pure binary-space-partition layout that Flotilla uses to tile windows, the shared "Nord Midnight" glass components that make the display hosts look like the rest of the suite, and a runtime that prepares the guest-side tools the display apps need from sources carried inside the APK, fetching only the pinned public nixpkgs.

The keyboard peer protocol lets floating windows and the Omni keyboard stay out of each other's way. It is deliberately narrow:

"No prefix trust, text, shell commands, geometry writes or InputConnection forwarding. Z-order requests stay owned by the IME."

A floating app (NOD Term, X11 Droid, Waylandroid, Flotsam, Flotilla) may ask the keyboard to raise its own presentation and nothing else, and every caller is checked by matching its installed package to its Linux user id.

glass

Window blur

Translucency and background blur for any Android window, with one policy and three backends chosen per window: Samsung's own window blur on One UI devices (it works even where Android's public blur is unavailable), Android 12's cross-window blur where the system enables it, and a denser translucent tint everywhere else. It listens for the system turning blur off, under battery saver or a "reduce blur" setting, and falls back to tint while the window is open.

Backends
SamsungOne UI window blur on a plane behind the content
AndroidWindow.setBackgroundBlurRadius, Android 12+, when cross-window blur is on
Tinta denser translucent fill, so text stays readable

Released on its own as a Maven bundle: each release is built twice and must produce identical bytes, and a test project compiles against the bundle alone. It adds no permissions or components. None of the apps on this site build against it yet; their floating windows get blur from floating-overlay.

terminal-emulator · terminal-view

The terminal

NOD Term's terminal is derived from Termux's terminal-emulator and terminal-view libraries (it keeps their com.termux.terminal package): an xterm-compatible emulator in Java with a small C part for the pseudo-terminal, and an Android view that draws it and handles touch, selection and scaling.

The largest addition is the kitty graphics protocol, about two thousand lines on its own: images can be transmitted, displayed, placed, queried and deleted, and animated, with the terminal's own frame clock driving looping playback. That is what lets terminal programs that draw images, such as image viewers and plotting tools, work in NOD Term.

The view adds stylus input with mouse semantics, handled separately from finger gestures, so a pen behaves like a mouse in terminal programs that use one.

native-bridge

Zero-copy GPU frames

Zero-copy frames from Linux to an Android window native-bridge. The Android app (Waylandroid or X11 Droid) owns a small ring of GPU buffers allocated with gralloc. A helper started inside the Linux environment, accepted only with this session's token and an allowed user id, renders frames into the same memory. Over the socket between them travel only buffer handles, frame indices and release notices, never pixels. The app presents each finished buffer on a child SurfaceControl layer of its window, so Android composites it directly, and hands the buffer back when the next one replaces it. Linux environmentcompositor or X server bridge helpersession token · allowed UID gralloc ringfour RGBA buffers Android appowns the ring SurfaceControl layersetBuffer, no copy renders into handles · indices · releases
Pixels never cross the socket. Only buffer handles, frame indices and release notices do; the frame is drawn into memory Android then composites directly.

Waylandroid and X11 Droid use it to show a desktop rendered inside a Linux environment without copying each frame through the CPU. A ticket per submission, rather than a slot number, stops a stale release from a previous ring freeing a buffer in a new one, and only a helper started with the session's token and an allowed Linux user id is accepted.

app-control

Remote control, off by default

X11 Droid and Waylandroid can be started and driven from another machine through a small HTTP listener on a private network, authenticated with a bearer token (compared in constant time) and rate-limited. It is off until enabled; enabling it runs a non-exported foreground service with an ongoing notification and a Disable action. The token stays the same across restarts and upgrades until you generate a new one.

The listener binds only to the private network's address. A worker checks that address every five seconds: if the network is down it waits, if the address changes or disappears it closes the old listener, and there is no fallback to every interface or the local network, no busy loop and no wake lock. Restarts after boot or an upgrade restore only a saved opt-in; they never enable control themselves.

flotilla-api

Cooperating with Flotilla

A small Java SDK that apps (and the Omni keyboard, which compiles it in directly) use to talk to Flotilla, the window manager: a "versioned, bounded first-party WM contract" with "no text input, shell, capture or arbitrary intents". Launch recipes let an app offer Flotilla things to start without handing over how: only identifiers, labels and launch capabilities cross between apps, while command lines, URLs and profiles stay in the app. Each recipe is approved separately, per installed window manager, and can be revoked.

profile-sync

Profiles in a folder

Mirrors an app's portable settings into a folder you choose, one subfolder per named profile, with conflicts set aside in their own folder. Point it at a Syncthing share and every device that selects the same profile converges, with no account or server. Each synced item is one human-editable file; databases, credentials and consent decisions are never synced. Flotilla and Flotsam use it.

startup-diagnostics

What happened last time

Records evidence of the last failure before an app's complicated start-up (its UI, network or native code), so a crash at launch can still be diagnosed from the device. The record is private to the app, bounded and never leaves the phone, and it leaves out exception messages, terminal and audio content, credentials and intent extras.