fix: resolve touch input with keyring flag + libinput driver

Two genuinely separate root causes were behind the dead touchscreen:

1. GNOME keyring grab — under LightDM autologin the keyring stays locked.
   When Chromium accessed it, the gcr-prompter unlock dialog grabbed all
   keyboard and touch input at the X level. The app rendered (timers ran)
   but ignored every tap and keypress. Fix: --password-store=basic stops
   Electron from using the keyring, so the dialog never appears.

2. Wacom driver single-touch emulation — the wacom X driver only does
   single-touch pointer emulation and never passes real multitouch to
   Chromium, so 1-finger and 2-finger swipe gestures could not fire.
   Fix: force the finger touch device to the libinput driver via
   /etc/X11/xorg.conf.d/99-finger-libinput.conf. libinput delivers proper
   XI2 multitouch which Chromium turns into real JS touch events. The
   pen/stylus stays on the wacom driver.

Removed the earlier dead-end attempts (xsetwacom MapToOutput / CTM reset,
Wacom Enable Touch Gesture, 99-wacom-touch.conf) which were all chasing the
wrong cause while the keyring grab masked any real testing. The upgrade path
removes the stale 99-wacom-touch.conf so it can't override libinput.

https://claude.ai/code/session_01EyjEQLWbTXcZgbMDarf7NU

Readme.md

@@ -1087,7 +1087,8 @@ See the LICENSE file in the repository for full terms.
 **Current Version:** 1.0.3
 
 **Recent Updates (v1.0.3):**
-- **Touch screen detection:** startup now auto-detects any touch screen (Wacom, ELAN, eGalax, Goodix, etc.) instead of requiring a hardcoded device name
+- **Touch input fix (keyring):** added `--password-store=basic` to the Electron launch. Under LightDM autologin the GNOME keyring stays locked; when Chromium accessed it, the keyring unlock dialog grabbed all keyboard/touch input — the kiosk rendered fine but ignored every tap and keypress. This flag stops Electron from using the keyring, so the dialog never appears.
+- **Touch gesture fix (libinput):** finger touch screens are now forced to the `libinput` driver via `/etc/X11/xorg.conf.d/99-finger-libinput.conf`. The `wacom` driver only does single-touch pointer emulation and never passes real multitouch to Chromium, so 1-finger and 2-finger swipe gestures could not fire. libinput delivers proper multitouch; the pen/stylus stays on the wacom driver.
 - **Upgrade reliability:** `start.sh` is now refreshed on every upgrade alongside `main.js` and `preload.js`
 - **Upgrade fix:** node_modules no longer wiped during upgrade — preserves the ~120MB Electron binary so upgrades don't fail on slow/unreliable connections
 - **Authelia fix:** 10-second timeout on Authelia login fetch prevents white screen when Authelia is slow to respond

ubuntu-based-kiosk-v1.0.3.sh

@@ -7346,26 +7346,11 @@ for i in {1..10}; do
     sleep 1
 done
 
-# Fix touch device coordinate mapping and enable multi-touch gestures.
-# Find the primary connected display (e.g. eDP1, HDMI1, DP1).
-_primary_output=$(xrandr 2>/dev/null | grep " connected primary" | head -1 | cut -d' ' -f1)
-
-# Loop over all touch/finger input devices (excludes touchpads).
-while IFS= read -r dev; do
-  # Use xsetwacom MapToOutput to fix the Coordinate Transformation Matrix.
-  # The Wacom driver initialises the CTM to all-zeros when it cannot auto-detect
-  # the active output, making every touch map to (0,0) and appear dead.
-  # xsetwacom MapToOutput recalculates the CTM correctly for the given output.
-  # xinput set-prop on the CTM is overridden by the driver, so xsetwacom is needed.
-  [ -n "$_primary_output" ] && xsetwacom set "$dev" MapToOutput "$_primary_output" 2>/dev/null || true
-  # Enable multi-touch gesture mode (Wacom-specific; ignored by other drivers).
-  xinput set-prop "$dev" "Wacom Enable Touch Gesture" 1 2>/dev/null || true
-done < <(xinput list --name-only 2>/dev/null | grep -i "touch\|finger" | grep -iv "touchpad\|trackpad")
-
 exec node_modules/electron/dist/electron . \
   --no-sandbox --disable-gpu-sandbox --disable-dev-shm-usage \
   --enable-features=UseOzonePlatform --ozone-platform=x11 \
   --enable-audio-service-sandbox=false --autoplay-policy=no-user-gesture-required \
+  --password-store=basic \
   2>&1 | tee -a /home/kiosk/electron.log
 LAUNCHER
     sudo chmod +x "$KIOSK_DIR/start.sh"
@@ -7373,20 +7358,21 @@ LAUNCHER
     echo "[18/27] Configuring Openbox with AGGRESSIVE screen keep-alive..."
     sudo -u "$KIOSK_USER" mkdir -p "$KIOSK_HOME/.config/openbox" "$KIOSK_HOME/.config/pulse"
 
-    # Configure Wacom touch devices to start in touch event mode (not pointer emulation).
-    # Without this, the driver initialises in pointer mode and generates mouse events
-    # instead of XI2 TouchBegin/TouchEnd events — which means Electron never sees touch.
-    # The MatchProduct is Wacom-specific; non-Wacom touch screens work natively.
+    # Force finger touch screens to use the libinput driver instead of wacom.
+    # The wacom driver does single-touch pointer emulation and does NOT pass
+    # real multitouch through to Chromium, so app gestures (2-finger swipe,
+    # 1-finger swipe) never fire. libinput delivers proper XI2 multitouch
+    # which Chromium turns into real JS touch events. The pen/stylus is left
+    # on the wacom driver (this rule only matches "Finger" touch screens).
     sudo mkdir -p /etc/X11/xorg.conf.d
-    sudo tee /etc/X11/xorg.conf.d/99-wacom-touch.conf > /dev/null <<'WACFG'
+    sudo tee /etc/X11/xorg.conf.d/99-finger-libinput.conf > /dev/null <<'TOUCHCFG'
 Section "InputClass"
-  Identifier "Wacom Touch Settings"
-  MatchProduct "Wacom*Finger*"
-  Driver "wacom"
-  Option "Gesture" "on"
-  Option "Touch" "on"
+  Identifier "Finger touch use libinput"
+  MatchProduct "Finger"
+  MatchIsTouchscreen "on"
+  Driver "libinput"
 EndSection
-WACFG
+TOUCHCFG
 
     # Create empty xbindkeysrc to prevent errors
     sudo -u "$KIOSK_USER" touch "$KIOSK_HOME/.xbindkeysrc"
@@ -11308,17 +11294,19 @@ upgrade_kiosk() {
         sudo rm -f "$config_backup"
     fi
 
-    # Ensure Wacom touch devices start in touch event mode (not pointer emulation)
+    # Force finger touch screens to use libinput (proper multitouch for Chromium).
+    # Remove the old wacom-touch override from earlier versions — it sorts after
+    # this file and would otherwise win and re-bind the device to the wacom driver.
     sudo mkdir -p /etc/X11/xorg.conf.d
-    sudo tee /etc/X11/xorg.conf.d/99-wacom-touch.conf > /dev/null <<'WACFG'
+    sudo rm -f /etc/X11/xorg.conf.d/99-wacom-touch.conf
+    sudo tee /etc/X11/xorg.conf.d/99-finger-libinput.conf > /dev/null <<'TOUCHCFG'
 Section "InputClass"
-  Identifier "Wacom Touch Settings"
-  MatchProduct "Wacom*Finger*"
-  Driver "wacom"
-  Option "Gesture" "on"
-  Option "Touch" "on"
+  Identifier "Finger touch use libinput"
+  MatchProduct "Finger"
+  MatchIsTouchscreen "on"
+  Driver "libinput"
 EndSection
-WACFG
+TOUCHCFG
 
     # Install simplified power button handler
     echo "  Updating power button handler..."