sasquatch

A Windows-11-style task manager for CachyOS/KDE Wayland that honours the Ctrl+Alt+Del contract — it answers regardless of what the foreground program or desktop environment is doing.

There is no Linux equivalent of the Windows Ctrl+Alt+Del guarantee: KDE's System Monitor is a normal window on a normal compositor shortcut, and it dies with the session it is supposed to police. sasquatch (after the SAS — the Secure Attention Sequence, Ctrl+Alt+Del's formal name) closes that gap with two tiers behind one muscle memory: a Win11-parity task-manager GUI (Slint) summoned above fullscreen apps, and a root daemon that reads the keyboard hardware directly (evdev) and rescues to a text-mode process killer on another VT even when KWin or plasmashell is frozen.

The sasquatch binary is the GUI; sasquatchd is the root daemon; sasquatch-rescue is the VT rescue TUI.

Table of Contents

• Background
• Architecture
• Install
• Usage
• Security model
• Development
• Maintainers
• Contributing
• License

Background

A task manager's whole value is the moment everything else is misbehaving — which is exactly when a compositor-registered shortcut and a normal window can't be trusted. Windows solves this with the SAS: Ctrl+Alt+Del is intercepted below the shell, and Task Manager runs on a plane ordinary programs can't cover. sasquatch rebuilds that contract on Linux plumbing: evdev for the chord (works when compositor input handling is gone), a KWin window rule for above-fullscreen summoning (keep-above + forced focus-stealing-prevention None), and logind-backed VT switching for the rescue tier (logind force-revokes DRM from a hung compositor, so the text VT still lands).

The full architecture is the source of truth in docs/superpowers/specs/2026-07-09-sasquatch-design.md; the milestone plan that builds it is ROADMAP.md.

Architecture

Five crates, with the only root code isolated to one of them:

Crate	Kind	Role
sasquatch-core	lib	The sampling engine: /proc + /sys parsing, per-process CPU/RSS/state, per-core CPU, memory/disk/net, the cgroup Apps/Background/System classifier, 1 Hz delta math, ring buffers. Sync; no GUI/D-Bus/tokio deps.
sasquatch-proto	lib	The D-Bus contract (system + session bus): bus topology, escalation constants, wire types. Data only — never commands or paths-to-execute.
sasquatch-gui	bin	sasquatch — the Slint GUI: Win11 chrome and tabs, resident-hidden at login, single-instance, summoned by the daemon. Unprivileged.
sasquatchd	bin	The only code that runs as root. systemd system service: evdev Ctrl+Alt+Del watchdog, summon/ack/escalation state machine, VT rescue spawner, polkit-gated process executor. No exec API.
sasquatch-rescue	bin	The ratatui process killer on the rescue VT (tty9). Deliberately no D-Bus dependency — it must work when the session stack is what broke.

Win11 tab parity in v1: Processes (grouped, heat-mapped), Performance (CPU/memory/disk/network/GPU), Users, Details, Services, Startup apps, Run new task, End task, Efficiency mode, dark/light themes. The one deliberate omission is App history (needs an OS-grade metering store; possible post-1.0).

Install

Status: pre-alpha. 0.1.0 ships M1 — the core sampling engine (sasquatch-core): the real /proc samplers (per-core CPU, process table with the Apps/Background/System classifier, disk, network), the 1 Hz delta math, and the 60-sample history rings, all fixture-tested through procfs. It is a library with no user-facing surface yet — the binaries still only answer --version. The first usable GUI arrives with Phase B (M3–M8); the guarantee tier lands in Phase C (M9–M11); v1.0.0 is the packaged, dogfooded terminus (M18) with a PKGBUILD, hardened systemd unit, and full install/uninstall of the system integration (chord rebind, reboot-safety mask, KWin rule).

Until packaging lands, build from source:

git clone https://codeberg.org/alan090/sasquatch.git
cd sasquatch
cargo build --release --workspace

Targets Arch/CachyOS on KDE Plasma Wayland (developed against an NVIDIA box; nvidia-drm.fbdev=1 — the driver default since 570 — keeps the rescue VT usable).

Usage

The contract, once shipped:

• Ctrl+Alt+Del — summons the task manager above whatever is fullscreen, read straight from the keyboard hardware by sasquatchd. No ack from the session tier within 1.5 s (or repeated chords, because pixels never came) escalates to the rescue VT.
• Ctrl+Shift+Esc — the compositor-blessed secondary (Windows muscle memory); also the summon path when the daemon isn't installed.
• Ctrl+Alt+Shift+Del — the hard chord: straight to the text-mode rescue killer on tty9. Exit it and you're back in your session.

At 0.1.0 the binaries only answer --version (the engine is a library the GUI consumes from M3):

cargo run -p sasquatch-gui -- --version    # sasquatch 0.1.0
cargo run -p sasquatchd -- --version       # sasquatchd 0.1.0
cargo run -p sasquatch-rescue -- --version # sasquatch-rescue 0.1.0

Security model

• Unprivileged by default; one root binary. Only sasquatchd runs as root (a systemd system service). The GUI and rescue TUI never do.
• The contract is data-only. sasquatch-proto carries pids, enum-named signals, and counters — never shell commands or paths-to-execute. The daemon exposes no exec API.
• polkit gates every privileged action, per action class (org.sasquatch.daemon.{kill,tune,observe}), with validation before any privileged step. The Services and Users tabs don't use the daemon at all — they call systemd and logind, which enforce their own polkit interactively.
• Reboot safety: installing the daemon masks ctrl-alt-del.target and sets CtrlAltDelBurstAction=none so text-VT chords reach sasquatch instead of force-rebooting; uninstall reverts both.

Development

Requires Rust 1.97 (pinned via rust-toolchain.toml; edition 2024).

cargo build --workspace
cargo test --workspace
cargo clippy --workspace --all-targets -- -D warnings
cargo fmt --all --check

One locked build invariant worth knowing before adding dependencies: zbus stays on its async-io backend; the zbus/tokio feature is banned workspace-wide (cargo feature unification would flip it for every consumer — the precedent SIGABRTed accesskit inside a Slint GUI). CI greps cargo tree for it on every push.

Maintainers

Alan Gaudet (alan.c.gaudet@gmail.com).

Contributing

Issues and pull requests are welcome on Codeberg (primary) or GitHub (mirror). This project follows standard-readme and Keep a Changelog.

License

GPL-3.0-or-later © Alan Gaudet.