Own user accounts and sharing

Two of the panels this desktop still handed to GNOME Settings.

Users manages the account through accountsservice -- the same daemon
GNOME's panel drives, so a name or picture set here is what the login
screen and lock screen read. Name, picture, account type, password,
automatic login, and adding or removing other accounts. Every change is
authorized by polkit through the agent this session already runs; a
dismissed prompt is a normal outcome and says so.

A new password is read from the helper's stdin, hashed by openssl
reading its own stdin, and handed over D-Bus from inside that process.
It is never an argument: argv is world-readable through /proc, so a
password passed that way is published to every process on the machine.
Removing an account takes two presses and says it destroys their files;
the last administrator cannot be removed or demoted, because a machine
nobody can administer is not a state to offer.

Sharing reports what is actually true, including "the software for this
is not installed" -- the honest answer for Samba here, and the case the
panel it replaces shows as a switch that does nothing. Password sign-in
is reported from sshd's configuration rather than assumed: claiming
"keys only" when the file is silent would state a security property that
cannot be backed up.

The Control Center now draws the account's real picture and name. A
generic glyph sat there while a real avatar was already set, which made
the desktop look like it did not know whose it was.

Also here: the KDE Connect contract no longer requires a phone to be
awake. kdeconnectd drops its device objects for a phone it has not seen
recently while the pairing survives in its config, so demanding one
failed whenever the phone was off.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/dot/quickshell/services/SettingsSearch.qml

@@ -64,6 +64,16 @@ Singleton {
         { label: "Bluetooth", detail: "Managed by GNOME Settings", page: "connectivity" },
         { label: "Printers", detail: "Managed by GNOME Settings", page: "connectivity" },
         { label: "Default applications", detail: "Browser, mail, files", page: "applications" },
+        { label: "User account", detail: "Your name, picture, and password", page: "users" },
+        { label: "Profile picture", detail: "The avatar shown on the lock screen and in the Control Center", page: "users" },
+        { label: "Change password", detail: "Set a new password for signing in", page: "users" },
+        { label: "Add a user", detail: "Create another account on this machine", page: "users" },
+        { label: "Automatic login", detail: "Sign in without typing a password", page: "users" },
+        { label: "Administrator", detail: "Which accounts can manage this machine", page: "users" },
+        { label: "Remote login", detail: "Sign in to this machine over SSH", page: "sharing" },
+        { label: "Remote desktop", detail: "See and control this desktop from elsewhere", page: "sharing" },
+        { label: "Network name", detail: "The name other machines see", page: "sharing" },
+        { label: "File sharing", detail: "Share folders on the network", page: "sharing" },
         { label: "Free space", detail: "How full each drive and filesystem is", page: "storage" },
         { label: "Disk usage", detail: "What is using the space on this machine", page: "storage" },
         { label: "Drive health", detail: "Temperature, hours powered on, and reported warnings", page: "storage" },

config/dot/quickshell/services/Sharing.qml

@@ -0,0 +1,113 @@
+pragma Singleton
+
+// What this machine offers to other machines: remote login, remote desktop,
+// and the two services that would provide file and media sharing if they were
+// installed.
+//
+// A service that is absent is reported as absent rather than shown as a switch
+// that would do nothing -- which is the failure mode of the panel this replaces.
+//
+// Turning remote login on is a system-wide change and goes through pkexec, so
+// it prompts. Remote desktop is a user service and does not.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-sharing"
+
+    property string hostname: ""
+    property string prettyHostname: ""
+    property var remoteLogin: ({})
+    property var remoteDesktop: ({})
+    property var fileSharing: ({})
+    property var mediaSharing: ({})
+    property bool scanned: false
+    property string lastError: ""
+
+    // Guards read the Process objects directly; a derived binding is stale
+    // inside the handler that changes it. See DefaultApps.qml.
+    readonly property bool busy: query.running || mutation.running
+
+    // The name someone types to reach this machine.
+    readonly property string networkName: root.hostname !== "" ? root.hostname : "this machine"
+
+    readonly property bool remoteLoginOn: root.remoteLogin?.active === true
+    readonly property bool remoteDesktopOn: root.remoteDesktop?.active === true
+
+    // sshd's configuration only sometimes states this. Saying "keys only" when
+    // the file is silent would be a security claim that cannot be backed up.
+    function passwordLoginSummary(): string {
+        const stated = String(root.remoteLogin?.passwordAuthentication ?? "");
+        if (stated === "")
+            return "Not configured, so the system default applies";
+        return stated.toLowerCase() === "no"
+            ? "Refused; keys only"
+            : "Allowed";
+    }
+
+    function refresh(): void {
+        if (query.running)
+            return;
+        query.command = [root.helperPath, "snapshot"];
+        query.running = true;
+    }
+
+    function absorb(text: string): void {
+        try {
+            const parsed = JSON.parse(text);
+            root.hostname = String(parsed.hostname ?? "");
+            root.prettyHostname = String(parsed.prettyHostname ?? "");
+            root.remoteLogin = parsed.remoteLogin ?? ({});
+            root.remoteDesktop = parsed.remoteDesktop ?? ({});
+            root.fileSharing = parsed.fileSharing ?? ({});
+            root.mediaSharing = parsed.mediaSharing ?? ({});
+            root.lastError = String(parsed.error ?? "");
+        } catch (error) {
+            root.lastError = "Could not read the sharing helper's answer.";
+            console.warn("Sharing: could not parse helper output:", error);
+        }
+        root.scanned = true;
+    }
+
+    function run(arguments: var): void {
+        if (mutation.running)
+            return;
+        root.lastError = "";
+        mutation.command = [root.helperPath].concat(arguments);
+        mutation.running = true;
+    }
+
+    function setRemoteLogin(enabled: bool): void {
+        root.run(["set-remote-login", enabled ? "true" : "false"]);
+    }
+
+    function setRemoteDesktop(enabled: bool): void {
+        root.run(["set-remote-desktop", enabled ? "true" : "false"]);
+    }
+
+    function setHostname(name: string): void {
+        root.run(["set-hostname", name]);
+    }
+
+    Process {
+        id: query
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+    }
+
+    Process {
+        id: mutation
+        // Answers with the fresh state, so the page updates from the change
+        // itself rather than asking again afterwards.
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+    }
+}

config/dot/quickshell/services/ShellState.qml

@@ -92,7 +92,7 @@ Singleton {
     }
 
     function openSettings(page: string): void {
-        const allowed = ["home", "appearance", "displays", "connectivity", "home-phone", "desktop", "sound", "notifications", "screen-intelligence", "shortcuts", "mouse", "privacy", "region", "accounts", "accessibility", "power", "datetime", "applications", "storage", "services", "about"];
+        const allowed = ["home", "appearance", "displays", "connectivity", "home-phone", "desktop", "sound", "notifications", "screen-intelligence", "shortcuts", "mouse", "privacy", "region", "accounts", "accessibility", "power", "datetime", "applications", "storage", "users", "sharing", "services", "about"];
         root.settingsPage = allowed.indexOf(page) >= 0 ? page : "home";
         DesktopPreferences.set("lastPage", root.settingsPage);
         root.settingsOpen = true;

config/dot/quickshell/services/UserAccounts.qml

@@ -0,0 +1,162 @@
+pragma Singleton
+
+// User accounts, through accountsservice -- the daemon GNOME's Users panel
+// drives, so what this changes is what every other login surface reads.
+//
+// Every change is authorized by polkit, which prompts through the agent this
+// session already runs. A refused prompt is a normal outcome, not an error to
+// apologize for, and it comes back as a plain sentence.
+//
+// No password ever crosses this file. Setting one writes it to the helper's
+// stdin, which is the only path that keeps it off a command line.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-users"
+
+    property var users: []
+    property string currentUser: ""
+    property int administratorCount: 0
+    property bool scanned: false
+    property string lastError: ""
+
+    // Guards read the Process objects rather than a derived "busy" binding. A
+    // binding hands back its cached value inside the handler that changes it,
+    // which silently turns a refresh after a successful change into a no-op --
+    // the write lands and the page never notices. See DefaultApps.qml.
+    readonly property bool busy: query.running || mutation.running || passwordWrite.running
+
+    readonly property var me: {
+        for (const user of root.users) {
+            if (user.userName === root.currentUser)
+                return user;
+        }
+        return root.users.length > 0 ? root.users[0] : null;
+    }
+
+    readonly property var others: root.users.filter(user => user.userName !== root.currentUser)
+
+    // The avatar, as a URL the shell can draw, or "" when none is set.
+    readonly property string avatarUrl: root.me && String(root.me.iconFile ?? "") !== ""
+        ? "file://" + root.me.iconFile
+        : ""
+
+    function displayName(user: var): string {
+        const real = String(user?.realName ?? "").trim();
+        return real !== "" ? real : String(user?.userName ?? "");
+    }
+
+    function refresh(): void {
+        if (query.running)
+            return;
+        query.command = [root.helperPath, "snapshot"];
+        query.running = true;
+    }
+
+    function absorb(text: string): void {
+        try {
+            const parsed = JSON.parse(text);
+            root.users = Array.isArray(parsed.users) ? parsed.users : [];
+            root.currentUser = String(parsed.currentUser ?? "");
+            root.administratorCount = Number(parsed.administratorCount ?? 0);
+            root.lastError = String(parsed.error ?? "");
+        } catch (error) {
+            root.lastError = "Could not read the account service's answer.";
+            console.warn("Accounts: could not parse helper output:", error);
+        }
+        root.scanned = true;
+    }
+
+    function run(arguments: var): void {
+        if (mutation.running)
+            return;
+        root.lastError = "";
+        mutation.command = [root.helperPath].concat(arguments);
+        mutation.running = true;
+    }
+
+    function setRealName(userName: string, name: string): void {
+        root.run(["set-real-name", userName, name]);
+    }
+
+    function setIcon(userName: string, path: string): void {
+        root.run(["set-icon", userName, path]);
+    }
+
+    function setAccountType(userName: string, kind: string): void {
+        root.run(["set-account-type", userName, kind]);
+    }
+
+    function setAutomaticLogin(userName: string, enabled: bool): void {
+        root.run(["set-automatic-login", userName, enabled ? "true" : "false"]);
+    }
+
+    function createUser(userName: string, realName: string, kind: string): void {
+        root.run(["create-user", userName, realName, kind]);
+    }
+
+    function deleteUser(userName: string, removeFiles: bool): void {
+        root.run(["delete-user", userName, removeFiles ? "remove-files" : "keep-files"]);
+    }
+
+    // The password goes to the helper's stdin and nowhere else: never an
+    // argument, because argv is readable by every process on this machine.
+    //
+    // It is written from onStarted rather than here, because a process has no
+    // stdin to write to until it is actually running. The same pattern
+    // HomeAssistantConfig uses for its token.
+    property string pendingPassword: ""
+
+    function setPassword(userName: string, password: string): void {
+        if (passwordWrite.running)
+            return;
+        root.lastError = "";
+        root.pendingPassword = password;
+        passwordWrite.command = [root.helperPath, "set-password", userName];
+        passwordWrite.running = true;
+    }
+
+    // Self-initializing: the Control Center draws the avatar too, and a
+    // singleton is constructed on first use, so whichever surface asks first
+    // gets a populated service without having to know to ask.
+    Component.onCompleted: root.refresh()
+
+    Process {
+        id: query
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+    }
+
+    Process {
+        id: passwordWrite
+        stdinEnabled: true
+        onStarted: {
+            passwordWrite.write(root.pendingPassword + "\n");
+            // Held for as long as it takes to hand over, and no longer.
+            root.pendingPassword = "";
+            passwordWrite.stdinEnabled = false;
+        }
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+        onExited: root.pendingPassword = ""
+    }
+
+    Process {
+        id: mutation
+        // The helper answers with the fresh state, so the page updates from the
+        // mutation itself and never has to ask again.
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+    }
+}