Add Xtream Deck desklet by sentinela-one · Pull Request #1902 · linuxmint/cinnamon-spices-desklets

sentinela-one · 2026-09-10T06:19:15Z

Summary

Adds Xtream Deck, a Stream Deck-style button grid desklet for Cinnamon: full button editor embedded in the panel (no separate settings window), bundled Font Awesome icon set with search, custom PNG/JPG/GIF icon upload, custom background colors, and drag-and-drop reordering between slots.

Source repo: https://github.com/sentinela-one/xtream-desklet-deck

Checklist

Ran ./validate-spice xtream-desklet-deck@sentinela-one locally - no errors
icon.png present and square
metadata.json has no icon/dangerous/last-edited fields, ASCII only
No compiled/minified assets or runtime external code fetches

Stream Deck-style button grid for Cinnamon: full button editor embedded in the panel, bundled Font Awesome icon set, custom icon upload, custom colors, drag-and-drop reordering. Source: https://github.com/sentinela-one/xtream-desklet-deck

github-actions · 2026-09-10T06:19:41Z

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Most findings
are advisory and do not automatically disqualify a pull request.

This check is not perfect and will not replace a normal review.

Found 9 potential issue(s):

⚠️ WARNING

⚠️ sync_file_get_contents

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:197

let [ok, contents] = GLib.file_get_contents(path);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:562

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:586

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

⚠️ sync_file_query_exists

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:560

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:584

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

⚠️ hardcoded_config_dir

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:675

let destDir = GLib.get_home_dir() + "/.config/xtream-desklet-deck/custom_icons";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:704

this._statePath = GLib.get_home_dir() + "/.config/xtream-desklet-deck/instances/" + desklet_id + ".json";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

ℹ️ INFO

ℹ️ shell_string_spawn

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:817

Util.spawnCommandLine(command);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:825

Util.spawnCommandLine("xdg-open " + DONATE_URL);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

github-actions · 2026-09-10T06:27:21Z

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Most findings
are advisory and do not automatically disqualify a pull request.

This check is not perfect and will not replace a normal review.

Found 9 potential issue(s):

⚠️ WARNING

⚠️ sync_file_get_contents

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:197

let [ok, contents] = GLib.file_get_contents(path);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:562

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:586

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

⚠️ sync_file_query_exists

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:560

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:584

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

⚠️ hardcoded_config_dir

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:675

let destDir = GLib.get_home_dir() + "/.config/xtream-desklet-deck/custom_icons";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:704

this._statePath = GLib.get_home_dir() + "/.config/xtream-desklet-deck/instances/" + desklet_id + ".json";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

ℹ️ INFO

ℹ️ shell_string_spawn

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:817

Util.spawnCommandLine(command);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:825

Util.spawnCommandLine("xdg-open " + DONATE_URL);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

github-actions · 2026-09-10T06:34:09Z

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Most findings
are advisory and do not automatically disqualify a pull request.

This check is not perfect and will not replace a normal review.

Found 9 potential issue(s):

⚠️ WARNING

⚠️ sync_file_get_contents

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:197

let [ok, contents] = GLib.file_get_contents(path);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:562

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:586

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

⚠️ sync_file_query_exists

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:560

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:584

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

⚠️ hardcoded_config_dir

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:675

let destDir = GLib.get_home_dir() + "/.config/xtream-desklet-deck/custom_icons";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:704

this._statePath = GLib.get_home_dir() + "/.config/xtream-desklet-deck/instances/" + desklet_id + ".json";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

ℹ️ INFO

ℹ️ shell_string_spawn

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:817

Util.spawnCommandLine(command);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:825

Util.spawnCommandLine("xdg-open " + DONATE_URL);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

github-actions · 2026-09-10T06:41:44Z

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Most findings
are advisory and do not automatically disqualify a pull request.

This check is not perfect and will not replace a normal review.

Found 9 potential issue(s):

⚠️ WARNING

⚠️ sync_file_get_contents

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:197

let [ok, contents] = GLib.file_get_contents(path);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:562

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:586

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

⚠️ sync_file_query_exists

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:560

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:584

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

⚠️ hardcoded_config_dir

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:675

let destDir = GLib.get_home_dir() + "/.config/xtream-desklet-deck/custom_icons";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:704

this._statePath = GLib.get_home_dir() + "/.config/xtream-desklet-deck/instances/" + desklet_id + ".json";

Avoid hardcoding .config in paths. Use GLib.get_user_config_dir() instead,
which respects the XDG_CONFIG_HOME environment variable.

ℹ️ INFO

ℹ️ shell_string_spawn

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:817

Util.spawnCommandLine(command);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:825

Util.spawnCommandLine("xdg-open " + DONATE_URL);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

github-actions · 2026-09-10T12:40:06Z

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Most findings
are advisory and do not automatically disqualify a pull request.

This check is not perfect and will not replace a normal review.

Found 6 potential issue(s):

⚠️ WARNING

⚠️ sync_file_get_contents

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:197

let [ok, contents] = GLib.file_get_contents(path);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:562

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:586

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

⚠️ sync_file_query_exists

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:560

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:584

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

ℹ️ INFO

ℹ️ shell_string_spawn

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:817

Util.spawnCommandLine(command);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

…wn via shell string)

github-actions · 2026-09-10T13:03:56Z

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Most findings
are advisory and do not automatically disqualify a pull request.

This check is not perfect and will not replace a normal review.

Found 6 potential issue(s):

⚠️ WARNING

⚠️ sync_file_get_contents

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:197

let [ok, contents] = GLib.file_get_contents(path);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:562

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:586

let [ok, contents] = GLib.file_get_contents(srcPath);

Synchronous file_get_contents() blocks the main loop.
Use Gio.File.load_contents_async() instead.

⚠️ sync_file_query_exists

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:560

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:584

if (!cacheFile.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

ℹ️ INFO

ℹ️ shell_string_spawn

xtream-desklet-deck@sentinela-one/files/xtream-desklet-deck@sentinela-one/desklet.js:817

Util.spawnCommandLine(command);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

Add Xtream Deck desklet

3db5359

Stream Deck-style button grid for Cinnamon: full button editor embedded in the panel, bundled Font Awesome icon set, custom icon upload, custom colors, drag-and-drop reordering. Source: https://github.com/sentinela-one/xtream-desklet-deck

Adiciona screenshots ao README (grid, editor, seletor de icone)

e3fcea6

Corrige README do desklet: modo de edicao por engrenagem foi removido

624901c

Adiciona screenshot geral e do menu de contexto ao README da submissao

bd52a67

Corrige avisos do scanner de boas praticas (config dir hardcoded, spa…

8ee296a

…wn via shell string)

sentinela-one force-pushed the add-xtream-desklet-deck branch from 4810f00 to 8ee296a Compare September 10, 2026 13:03

Navigation Menu

Uh oh!

Add Xtream Deck desklet - #1902

Add Xtream Deck desklet#1902
sentinela-one wants to merge 5 commits into
linuxmint:masterfrom
sentinela-one:add-xtream-desklet-deck

sentinela-one commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

sentinela-one commented Sep 10, 2026

Summary

Checklist

Uh oh!

github-actions Bot commented Sep 10, 2026

Best-practices scanner

This check is not perfect and will not replace a normal review.

⚠️ WARNING

⚠️ sync_file_get_contents

⚠️ sync_file_query_exists

⚠️ hardcoded_config_dir

ℹ️ INFO

ℹ️ shell_string_spawn

Uh oh!

github-actions Bot commented Sep 10, 2026

Best-practices scanner

This check is not perfect and will not replace a normal review.

⚠️ WARNING

⚠️ sync_file_get_contents

⚠️ sync_file_query_exists

⚠️ hardcoded_config_dir

ℹ️ INFO

ℹ️ shell_string_spawn

Uh oh!

github-actions Bot commented Sep 10, 2026

Best-practices scanner

This check is not perfect and will not replace a normal review.

⚠️ WARNING

⚠️ sync_file_get_contents

⚠️ sync_file_query_exists

⚠️ hardcoded_config_dir

ℹ️ INFO

ℹ️ shell_string_spawn

Uh oh!

github-actions Bot commented Sep 10, 2026

Best-practices scanner

This check is not perfect and will not replace a normal review.

⚠️ WARNING

⚠️ sync_file_get_contents

⚠️ sync_file_query_exists

⚠️ hardcoded_config_dir

ℹ️ INFO

ℹ️ shell_string_spawn

Uh oh!

github-actions Bot commented Sep 10, 2026

Best-practices scanner

This check is not perfect and will not replace a normal review.

⚠️ WARNING

⚠️ sync_file_get_contents

⚠️ sync_file_query_exists

ℹ️ INFO

ℹ️ shell_string_spawn

Uh oh!

github-actions Bot commented Sep 10, 2026

Best-practices scanner

This check is not perfect and will not replace a normal review.

⚠️ WARNING

⚠️ sync_file_get_contents

⚠️ sync_file_query_exists

ℹ️ INFO

ℹ️ shell_string_spawn

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant