feat!: add Config Swap plugin

[Tadomika-Ari]

Config Swap

• Id: tadomika_ari/config-swap
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Config Swap its a plugin for change your config with one click.
Find any configuration from the configuration bank (on GitHub) or choose any configuration you've created to apply it with one click

Supports:

• settings.toml (your Noctalia configuration)
• wallpaper.png (only one wallpaper for now)
• preview.png (a preview for the plugin)
• info.json (name, author, description for your config)

External dependencies

You need :

• cp
• noctalia
• internet

Testing

Warning: This plugin is still under development.
If you'd like to test it, here's what you need to know:

• The source files are on GitHub and available for review (feel free to submit a pull request to add your own changes)
• The program will apply a change to your current configuration based on the selected settings, so MAKE SURE YOU HAVE A COPY OF YOUR CONFIGURATION.
• It will also apply a wallpaper from GitHub. Make sure you have a copy of your current wallpaper.
• IF YOU CHANGE YOUR CONFIGURATION: the plugin may deactivate itself. MAKE SURE you know how to add a local plugin to your configuration

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against: 5.0.0
• Plugin API level: 3 (tmp)

Screenshots / Videos

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[Tadomika-Ari]

And, if you have any test configurations or advice, I'm interested

[ItsLemmy]

1. blocking - config-swap/config-swap-panel.luau:92

The plugin concatenates the remotely supplied configuration name and the user-supplied settings
path into a shell command without quoting. Configuration names originate from the GitHub API at
config-swap/config-swap-panel.luau:188 and can also come from downloaded info.json data at
config-swap/config-swap-panel.luau:296.

Noctalia executes runAsync strings through /bin/sh -c, confirmed at
../noctalia-shell/src/scripting/luau_host.cpp:1739. Spaces or shell metacharacters can break
copying, and a malicious remote configuration name can execute arbitrary commands in the user's
session. Use a direct argument API or shell-quote every dynamic argument safely.

2. blocking - config-swap/plugin.toml:9

The catalog description says this plugin applies Wallpaper Engine wallpapers from Steam Workshop.
The implementation and README instead describe downloading and applying complete Noctalia
configurations from Config-Swap-Box. This is materially incorrect store metadata and conceals the
plugin's configuration-overwrite behavior.

3. blocking - config-swap/config-swap-panel.luau:328

The installed-list Install action passes an infoConfig object to downloadConfig, but that object
has no path field. downloadConfig immediately concatenates data.path at
config-swap/config-swap-panel.luau:110, causing a nil concatenation error. The documented action
for reinstalling or refreshing an installed configuration is unusable.

4. non-blocking - config-swap/thumbnail.webp:1

The thumbnail is readable and identifies Config Swap, but its screenshot area still contains the
template's striped SCREENSHOT placeholder instead of an actual plugin screenshot. Replace it with a
representative image before publication.

5. blocking - config-swap/README.md:28

The plugin is presented as a configuration-switching tool, but it cannot save or export the
user's current configuration. Its store is hardwired to the author's Config-Swap-Box repository,
and publishing through Show Store requires contributing to that separate repository as disclosed
only at config-swap/README.md:81. Local configurations must instead be assembled manually under
~/Config-Swap.

State these limitations and the external repository trust boundary prominently. Users should not
be led to expect an in-plugin workflow for saving and switching their own configurations.

6. blocking - config-swap/config-swap-panel.luau:92

Apply immediately overwrites the user-selected settings.toml with a remotely downloaded file.
There is no runtime confirmation, automatic backup, configuration validation, atomic replacement,
or rollback. The README backup note at config-swap/README.md:30 is not sufficient protection for a
destructive action.

This does not delete separate configuration-directory files, but it permanently replaces every
setting held in the state settings.toml. For users whose setup is stored there, one click can erase
their effective configuration and potentially disable the plugin needed to recover it.

7. blocking - config-swap/README.md:37

The required settingsPath setup is inaccurate and leaves the plugin unusable by default. The
service initializes data.json with an empty settingsPath at config-swap/config-swap-service.luau:8,
while the panel treats that empty string as a valid value at config-swap/config-swap-panel.luau:72
and proceeds to a failing cp command.

The README also gives the wrong plugin-data path. The default is
~/.local/state/noctalia/plugins/data/tadomika_ari/config-swap/data.json. When NOCTALIA_STATE_HOME
is set, Noctalia additionally inserts the noctalia directory component. Replace this internal-file
editing workflow with a plugin setting or clear UI, and reject an empty path before Apply.

---

The safer design is to keep downloaded profiles as separate files and switch a small [include] selector in the Noctalia config directory instead of copying over the state settings.toml. This preserves the user's existing files, removes the shell-based cp operation, and makes rollback possible.

Because state settings.toml is applied after config-directory includes, document whether this feature switches a base profile or the complete effective configuration. If complete config-directory replacement is intended, a dedicated selector using [include].autoload = false can isolate the selected profile.