Fix notifications tray URL handling

nixos/notifications-tray-icon.nix

@@ -22,6 +22,8 @@ makeEnable config "myModules.notifications-tray-icon" true {
                   (oldAttrs.patches or [])
                   ++ [
                     ./patches/notifications-tray-icon-gmail-oauth-detached-browser.patch
+                    ./patches/notifications-tray-icon-github-menu-item-id.patch
+                    ./patches/notifications-tray-icon-open-url-systemd-run.patch
                   ];
               });
           });
@@ -54,6 +56,9 @@ makeEnable config "myModules.notifications-tray-icon" true {
       };
       Service = {
         ExecStart = execStart;
+        # URL handlers can outlive the tray process. Keep restarts from killing
+        # unrelated GUI apps if a handler ever leaks into this service cgroup.
+        KillMode = "process";
         Restart = "always";
         RestartSec = 3;
       };

nixos/patches/notifications-tray-icon-github-menu-item-id.patch

@@ -0,0 +1,12 @@
+diff --git a/src/StatusNotifier/Item/Notifications/GitHub.hs b/src/StatusNotifier/Item/Notifications/GitHub.hs
+index 5d7e118..56a243b 100644
+--- a/src/StatusNotifier/Item/Notifications/GitHub.hs
++++ b/src/StatusNotifier/Item/Notifications/GitHub.hs
+@@ -148,7 +148,7 @@
+       markAsRead = executeRequest auth $ markNotificationAsReadR thisNotificationId
+ 
+-  menuItem <- menuitemNewWithId $ fromIntegral $ untagId thisNotificationId
++  menuItem <- menuitemNew
+   textVariant <- liftIO $ toGVariant notificationText
+   menuitemPropertySetVariant menuItem "label" textVariant
+ 

nixos/patches/notifications-tray-icon-open-url-systemd-run.patch

@@ -0,0 +1,43 @@
+diff --git a/src/StatusNotifier/Item/Notifications/Util.hs b/src/StatusNotifier/Item/Notifications/Util.hs
+index 87f73aa..bb5513e 100644
+--- a/src/StatusNotifier/Item/Notifications/Util.hs
++++ b/src/StatusNotifier/Item/Notifications/Util.hs
+@@ -45,9 +45,37 @@
+ passGetMain name = do
+   Right (value, _) <- passGet name
+   return value
+ 
++runDetached :: [String] -> IO (Either String String)
++runDetached args = do
++  logM "System.Taffybar.Util" INFO $
++       printf "Starting detached command with args %s" (show args)
++  (_, _, _, _) <-
++    P.createProcess
++      (P.proc "/usr/bin/env" args)
++        { P.std_in = P.NoStream
++        , P.std_out = P.NoStream
++        , P.std_err = P.NoStream
++        , P.close_fds = True
++        }
++  return $ Right ""
++
+ xdgOpen :: MonadIO m => [String] -> m (Either String String)
+-xdgOpen args = runCommandFromPath ("xdg-open":args)
++xdgOpen args = liftIO $ do
++  -- Route URL handlers through systemd so browsers are not parented to the
++  -- long-running tray icon service. Otherwise xdg-open can pull Chrome/Electron
++  -- into this service's cgroup and make restarts kill unrelated GUI apps.
++  result <- runCommandFromPath
++    ( [ "systemd-run"
++      , "--user"
++      , "--collect"
++      , "--quiet"
++      , "/usr/bin/env"
++      , "xdg-open"
++      ]
++      ++ args
++    )
++  either (const $ runDetached ("xdg-open":args)) (const $ return result) result
+ 
+ openURL :: MonadIO m => String -> m (Either String String)
+ openURL = xdgOpen . return