capture = kwin cannot satisfy KWin's permission check under Flatpak

Is there an existing issue for this?

• I have searched the existing issues

Is your issue described in the documentation?

• I have read the documentation

Is your issue present in the latest beta/pre-release?

None

Describe the Bug

Setting capture = kwin in the Flatpak build can never work while KWin's permission system is enabled, because the executable path KWin uses to match a permission desktop file is only valid inside the Flatpak sandbox.

#5009 documents the requirement:

a desktop file granting the necessary interface permission for zkde_screencast_unstable_v1 to Sunshine's process executable (as given by readlink /proc/<pid-of-sunshine>/exe) and KWin being able to determine the executable is required for kwingrab to work.

Under Flatpak, that path is sandbox-internal:

$ readlink /proc/$(pgrep -x sunshine)/exe
/app/bin/sunshine

/app/bin/sunshine does not exist on the host filesystem, so KWin — which runs outside the sandbox — cannot resolve it and cannot match it against any desktop file, whether in /usr/share/applications or ~/.local/share/applications.

The retry path added in #5212 ("Trying again after dropping ALL elevated privileges") also cannot help here: the Flatpak process holds no capabilities to begin with.

$ grep -E 'CapPrm|CapEff' /proc/$(pgrep -x sunshine)/status
CapPrm:	0000000000000000
CapEff:	0000000000000000

Reproduced across a full stack update. The same host was updated between two runs and the failure was identical:

Component	Run 1	Run 2
Bazzite image	44.20260515.0	44.20260914.0
Kernel	6.19.14	7.2.4
Plasma / KWin	6.6.4	6.7.5
xdg-desktop-portal-kde	6.6.4	6.7.5
Mesa	26.0.5	26.2.2
PipeWire	1.6.5	1.6.8
Sunshine (Flatpak)	2026.906.222525	2026.906.222525

Both runs: zkde_screencast_unstable_v1 not found in registry, no permission desktop file created, same fatal exit.

Plasma 6.7 did relax screencast permissions — per the changelog, a granted permission no longer requires the screen setup to be identical to when it was granted. That change applies to permission persistence; this failure happens earlier, at executable identification, and is unaffected.

Two additional observations:

1. No permission desktop file was created. After each failed run, neither ~/.local/share/applications nor /usr/share/applications contained any Sunshine/KWin permission file. The automatic setup described in #5009 appears not to run, or to bail out before writing. The Flatpak does have filesystems=home, so ~/.local/share/applications is writable from the sandbox.

2. capture = kwin has no fallback. When kwingrab fails, Sunshine does not fall back to another capture method and instead dies at startup:

   Error: Couldn't find any working encoder that meets HEVC/AV1 requirements
   Fatal: Unable to find display or encoder during startup.
   

   The error message points at the GPU and monitor, which is misleading — the actual failure is the capture backend. Removing the capture line restores normal operation via the XDG portal within about five seconds.

Notably, kwingrab does enumerate the output correctly before failing, and reports the full physical resolution (3840x2160) where portalgrab reports the scaled logical size (1707x960) on this fractional-scaling setup.

Expected Behavior

One of:

• kwingrab resolves a host-visible executable path under Flatpak (or uses another identifier KWin accepts) so the permission desktop file mechanism can work; or
• the documentation states that capture = kwin is unsupported in the Flatpak package while KWin's permission system is enabled; and
• forcing an unavailable capture method produces an error naming the capture backend rather than "Unable to find display or encoder", and/or falls back to an available method.

Additional Context

The motivation for trying capture = kwin was HDR. On this host every other prerequisite is met — Sunshine >= 2026.516.143833 (which added feat(linux/pipewire): Handle HDR(Rec. 2020/SMPTE 2084 PQ) visuals), an AMD GPU advertising VAProfileHEVCMain10, and Plasma with HDR enabled on the output — but the XDG portal path negotiates SPA_VIDEO_FORMAT_BGRA (8-bit) with unset colorimetry. This is unchanged on Plasma 6.7.5 with PipeWire 1.6.8, across ten negotiations in a single startup:

[pipewire] Video format: 12
[pipewire] Color primaries: 0
[pipewire] Transfer function: 0
...
Color coding: SDR (Rec. 709)
Color depth: 10-bit

so the stream is an 8-bit capture encoded into a 10-bit HEVC container, never HDR. kwingrab was the only untried capture path, and it is unreachable in this package. Filing this separately from the format question, since the permission failure blocks testing it at all.

Host Operating System

Linux

Operating System Version

Bazzite 44.20260914.0 (Kinoite) — Fedora 44 atomic base, KDE Plasma 6.7.5 on Wayland, kernel 7.2.4. Also reproduced on Bazzite 44.20260515.0 with Plasma 6.6.4 and kernel 6.19.14.

Architecture

amd64/x86_64

Package

Linux - flathub/flatpak

GPU Type

AMD

GPU Model

AMD Radeon RX 9070 XT (Navi 48, gfx1201)

GPU Driver/Mesa Version

26.2.2 (radeonsi) — also reproduced on 26.0.5

Capture Method

None

Apps

Log output

# Run 2 — Plasma 6.7.5, kernel 7.2.4, Mesa 26.2.2, PipeWire 1.6.8
[2026-09-14 13:57:20.174]: Info: config: 'capture' = kwin
[2026-09-14 13:57:20.175]: Info: [kwingrab] Found output: DP-2 order: 0 position: 0x0 resolution: 3840x2160
[2026-09-14 13:57:20.186]: Info: Screencasting with KWin ScreenCast
[2026-09-14 13:57:20.198]: Warning: [kwingrab] KWin screencasting unavailable after init. Trying again after dropping ALL elevated privileges.
[2026-09-14 13:57:20.198]: Error: [kwingrab] zkde_screencast_unstable_v1 not found in registry. Check permission desktop file for sunshine binary or set KWIN_WAYLAND_NO_PERMISSION_CHECKS=1 to fully disable permission checks.
[2026-09-14 13:57:20.399]: Info: Screencasting with KWin ScreenCast
[2026-09-14 13:57:20.407]: Warning: [kwingrab] KWin screencasting unavailable after init. Trying again after dropping ALL elevated privileges.
[2026-09-14 13:57:20.408]: Error: [kwingrab] zkde_screencast_unstable_v1 not found in registry. Check permission desktop file for sunshine binary or set KWIN_WAYLAND_NO_PERMISSION_CHECKS=1 to fully disable permission checks.
(the Warning/Error pair repeats for each encoder probe — 8 occurrences total)
[2026-09-14 13:57:21.865]: Fatal: Unable to find display or encoder during startup.
[2026-09-14 13:57:21.865]: Fatal: Please ensure your manually chosen GPU and monitor are connected and powered on.

# Run 1 — Plasma 6.6.4, kernel 6.19.14, Mesa 26.0.5, PipeWire 1.6.5
[2026-09-14 13:20:58.670]: Info: Sunshine version: 2026.906.222525 commit: cb72dffa3233c5815cd5ba88f09f049dd679ba75
[2026-09-14 13:20:58.670]: Info: config: 'capture' = kwin
[2026-09-14 13:20:58.671]: Info: [kwingrab] Found output: DP-2 order: 0 position: 0x0 resolution: 3840x2160
[2026-09-14 13:20:58.680]: Info: Screencasting with KWin ScreenCast
[2026-09-14 13:20:58.689]: Warning: [kwingrab] KWin screencasting unavailable after init. Trying again after dropping ALL elevated privileges.
[2026-09-14 13:20:58.689]: Error: [kwingrab] zkde_screencast_unstable_v1 not found in registry. Check permission desktop file for sunshine binary or set KWIN_WAYLAND_NO_PERMISSION_CHECKS=1 to fully disable permission checks.
[2026-09-14 13:20:59.096]: Error: Couldn't find any working encoder matching [vaapi]
(same pattern — 16 occurrences total on this run)
[2026-09-14 13:21:00.332]: Error: Couldn't find any working encoder that meets HEVC/AV1 requirements
[2026-09-14 13:21:00.332]: Fatal: Unable to find display or encoder during startup.
[2026-09-14 13:21:00.332]: Fatal: Please ensure your manually chosen GPU and monitor are connected and powered on.

Online logs

No response

Start at the kwingrab capture path and the handling of capture = kwin; reproduce the Flatpak failure with KWin permission checks enabled and compare its logs with the working portal path. Done means the package either enables a KWin-compatible permission flow, documents the unsupported configuration, or reports the unavailable capture backend clearly or falls back as specified.