feat: add arch-updater plugin

[rael2pac]

Plugin

• Id: rael2pac/arch-updater
• New plugin

What it does

Bar widget, panel, and launcher for managing Arch Linux system, AUR, and Flatpak updates. Shows update count in the bar and provides a full update manager in the panel.

External dependencies

• checkupdates (from pacman-contrib) for system update checks
• yay for AUR update checks
• flatpak for Flatpak updates (optional)

Testing

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Noctalia version tested against: v5 latest
• Plugin API level: 3

Screenshots / Videos

Checklist

• Directory name matches the part of id after / in plugin.toml exactly.
• Ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the README template.
• Created thumbnail.webp with the thumbnail generator. (TODO)
• version follows semver; plugin_api is the oldest API level required.
• Did not edit catalog.toml.
• This PR touches exactly one plugin directory.

Code review attestation

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is accounted for above.
• I have the right to publish this code under the license declared in plugin.toml.

[ItsLemmy]

1. blocking - arch-updater/translations/en.json:2

Translation keys use dotted, camelCase top-level keys. The manifest references the same invalid keys at arch-updater/plugin.toml:23. This introduces repository validator failures while clean main passes.

2. blocking - arch-updater/service.luau:218

Every update unconditionally performs destructive cleanup, including removing orphan packages, deleting unused Flatpaks and their data, vacuuming journals, and recursively deleting most of ~/.cache. arch-updater/plugin.toml:95 defaults cleanupAfterUpdate to false, but that setting is never read. arch-updater/README.md:37 only describes optional yay cache cleanup. This can unexpectedly delete user data and packages.

3. blocking - arch-updater/service.luau:190

cachePreserveList values are interpolated without quoting into a terminal script at arch-updater/service.luau:260. Shell syntax in this ordinary string setting can escape the assignment and execute arbitrary commands when an update runs.

4. blocking - arch-updater/launcher.luau:95

Result IDs contain two colon-separated fields after "pkg:", but activation requires at least three and reads source from parts[3]. Consequently, activating any package result does nothing, breaking launcher result activation.

5. non-blocking - arch-updater/panel.luau:36

The panel references three icons under icons/, but the plugin contains no icons directory or SVG assets. Update rows will have missing images.

6. non-blocking - arch-updater/plugin.toml:79

Several advertised settings are ineffective. refreshInterval is ignored in favor of a hardcoded interval at arch-updater/service.luau:410, showToasts is never read, and boldText and noctaliaHighlight are not consulted by arch-updater/widget.luau:28.

You did not use the thumbnail generator, so this should not be marked as ready for review.