Own user accounts and sharing

Two of the panels this desktop still handed to GNOME Settings.

Users manages the account through accountsservice -- the same daemon
GNOME's panel drives, so a name or picture set here is what the login
screen and lock screen read. Name, picture, account type, password,
automatic login, and adding or removing other accounts. Every change is
authorized by polkit through the agent this session already runs; a
dismissed prompt is a normal outcome and says so.

A new password is read from the helper's stdin, hashed by openssl
reading its own stdin, and handed over D-Bus from inside that process.
It is never an argument: argv is world-readable through /proc, so a
password passed that way is published to every process on the machine.
Removing an account takes two presses and says it destroys their files;
the last administrator cannot be removed or demoted, because a machine
nobody can administer is not a state to offer.

Sharing reports what is actually true, including "the software for this
is not installed" -- the honest answer for Samba here, and the case the
panel it replaces shows as a switch that does nothing. Password sign-in
is reported from sshd's configuration rather than assumed: claiming
"keys only" when the file is silent would state a security property that
cannot be backed up.

The Control Center now draws the account's real picture and name. A
generic glyph sat there while a real avatar was already set, which made
the desktop look like it did not know whose it was.

Also here: the KDE Connect contract no longer requires a phone to be
awake. kdeconnectd drops its device objects for a phone it has not seen
recently while the pairing survives in its config, so demanding one
failed whenever the phone was off.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/dot/quickshell/modules/quicksettings/QuickSettingsPanel.qml

@@ -304,15 +304,45 @@ Item {
             width: content.width
             height: 36
 
-            ThemedIcon {
+            // The account's own picture, the same file the lock screen and the
+            // login screen read. A generic glyph sat here while a real avatar
+            // was already set, which made the desktop look like it did not know
+            // whose it was.
+            Item {
                 id: avatar
                 anchors.left: parent.left
                 anchors.leftMargin: 4
                 anchors.verticalCenter: parent.verticalCenter
+                width: 22
+                height: 22
+
+                ClippingRectangle {
+                    anchors.fill: parent
+                    radius: width / 2
+                    color: "transparent"
+                    visible: UserAccounts.avatarUrl !== ""
+
+                    Image {
+                        anchors.fill: parent
+                        source: UserAccounts.avatarUrl
+                        fillMode: Image.PreserveAspectCrop
+                        // Replaced in place when the picture changes, so the
+                        // cache has to be told to let go of the old one.
+                        cache: false
+                        asynchronous: true
+                        sourceSize.width: 44
+                        sourceSize.height: 44
+                    }
+                }
+
+                ThemedIcon {
+                    anchors.centerIn: parent
+                    visible: UserAccounts.avatarUrl === ""
                     size: 20
                     icon: "avatar-default-symbolic"
                     iconFallback: "user-info-symbolic"
                 }
+            }
 
             Text {
                 anchors.left: avatar.right
@@ -320,7 +350,9 @@ Item {
                 anchors.right: actions.left
                 anchors.rightMargin: 8
                 anchors.verticalCenter: parent.verticalCenter
-                text: Quickshell.env("USER") || "user"
+                text: UserAccounts.me
+                    ? UserAccounts.displayName(UserAccounts.me)
+                    : (Quickshell.env("USER") || "user")
                 color: Theme.fg
                 elide: Text.ElideRight
                 font.family: Theme.fontFamily

config/dot/quickshell/modules/settings/AvatarPicker.qml

@@ -0,0 +1,32 @@
+// Choosing a profile picture.
+//
+// A thin wrapper on the same FileDialog the phone controls use, so picking a
+// picture is the ordinary file chooser rather than something this desktop
+// invented. Nothing privileged happens here -- reading a file the user selected
+// needs no authorization; only setting it on the account does.
+
+import QtQuick
+import QtQuick.Dialogs
+
+Item {
+    id: root
+
+    signal picked(path: string)
+
+    function open(): void {
+        dialog.open();
+    }
+
+    FileDialog {
+        id: dialog
+        title: "Choose a profile picture"
+        fileMode: FileDialog.OpenFile
+        nameFilters: ["Pictures (*.png *.jpg *.jpeg *.webp *.gif *.bmp)", "All files (*)"]
+        onAccepted: {
+            const value = String(dialog.selectedFile);
+            if (!value.startsWith("file://"))
+                return;
+            root.picked(decodeURIComponent(value.slice(7)));
+        }
+    }
+}

config/dot/quickshell/modules/settings/PasswordRow.qml

@@ -0,0 +1,26 @@
+// A row whose trailing control is a masked password field.
+//
+// Reports every keystroke rather than committing on Enter, because the page it
+// serves has to compare two fields as they are typed and say whether they match
+// before offering to set anything.
+
+import QtQuick
+import qs.config
+
+SettingRow {
+    id: root
+
+    property string placeholder: "Password"
+
+    signal changed(value: string)
+
+    controlWidth: 220
+
+    PasswordField {
+        anchors.right: parent.right
+        anchors.verticalCenter: parent.verticalCenter
+        width: root.controlWidth
+        placeholder: root.placeholder
+        onTextChanged: root.changed(this.text)
+    }
+}

config/dot/quickshell/modules/settings/SegmentRow.qml

@@ -0,0 +1,69 @@
+// A segmented choice that is NOT schema-bound.
+//
+// ChoiceRow reads its options from the preference schema. This one is handed
+// them, for choices that describe system state rather than a Panama setting.
+
+import QtQuick
+import qs.config
+
+SettingRow {
+    id: root
+
+    // [{ value, label }]
+    property var options: []
+    property var value: null
+    property bool enabled: true
+
+    signal selected(value: var)
+
+    controlWidth: Math.max(150, root.options.length * 92)
+
+    Row {
+        anchors.right: parent.right
+        anchors.verticalCenter: parent.verticalCenter
+        spacing: 6
+        opacity: root.enabled ? 1 : 0.45
+
+        Repeater {
+            model: root.options
+
+            delegate: Rectangle {
+                id: segment
+
+                required property var modelData
+
+                readonly property bool current: root.value === segment.modelData.value
+
+                width: Math.max(84, segmentLabel.implicitWidth + 22)
+                height: 30
+                radius: 9
+                color: segment.current
+                    ? Theme.alpha(Theme.accent, 0.22)
+                    : Theme.alpha(Theme.fg, segmentMouse.containsMouse ? 0.12 : 0.06)
+                border.width: 1
+                border.color: segment.current
+                    ? Theme.alpha(Theme.accent, 0.5)
+                    : Theme.alpha(Theme.fg, 0.08)
+
+                Text {
+                    id: segmentLabel
+                    anchors.centerIn: parent
+                    text: String(segment.modelData.label ?? "")
+                    color: segment.current ? Theme.fg : Theme.fgDim
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSizeSmall
+                    font.weight: segment.current ? Font.DemiBold : Font.Medium
+                }
+
+                MouseArea {
+                    id: segmentMouse
+                    anchors.fill: parent
+                    hoverEnabled: true
+                    enabled: root.enabled && !segment.current
+                    cursorShape: Qt.PointingHandCursor
+                    onClicked: root.selected(segment.modelData.value)
+                }
+            }
+        }
+    }
+}

config/dot/quickshell/modules/settings/SettingsShell.qml

@@ -121,6 +121,8 @@ Rectangle {
             case "datetime": return dateTimePage;
             case "applications": return applicationsPage;
             case "storage": return storagePage;
+            case "users": return usersPage;
+            case "sharing": return sharingPage;
             case "services": return healthPage;
             case "about": return aboutPage;
             default: return homePage;
@@ -160,6 +162,8 @@ Rectangle {
     Component { id: homePage; HomePage {} }
     Component { id: applicationsPage; ApplicationsPage {} }
     Component { id: storagePage; StoragePage {} }
+    Component { id: usersPage; UsersPage {} }
+    Component { id: sharingPage; SharingPage {} }
     Component { id: accessibilityPage; AccessibilityPage {} }
     Component { id: powerPage; PowerPage {} }
     Component { id: dateTimePage; DateTimePage {} }

config/dot/quickshell/modules/settings/SettingsSidebar.qml

@@ -26,6 +26,7 @@ Rectangle {
         { page: "appearance", label: "Appearance", icon: "\u{F0E0D}" },
         { page: "displays", label: "Displays", icon: "\u{F0379}" },
         { page: "connectivity", label: "Network & Devices", icon: "\u{F08D4}" },
+        { page: "sharing", label: "Sharing", icon: "\u{F04E6}" },
         { page: "home-phone", label: "Home & Phone", icon: "\u{F02DC}" },
         { page: "desktop", label: "Desktop & Dock", icon: "\u{F04A4}" },
         { page: "sound", label: "Sound", icon: "\u{F057E}" },
@@ -41,6 +42,7 @@ Rectangle {
         { page: "datetime", label: "Date & Time", icon: "\u{F0954}" },
         { page: "applications", label: "Applications", icon: "\u{F003B}" },
         { page: "storage", label: "Storage", icon: "\u{F02CA}" },
+        { page: "users", label: "Users", icon: "\u{F0004}" },
         { page: "services", label: "System Health", icon: "\u{F0493}" },
         { page: "about", label: "About", icon: "\u{F02FD}" }
     ]

config/dot/quickshell/modules/settings/SharingPage.qml

@@ -0,0 +1,149 @@
+// What this machine offers to other machines on the network.
+//
+// Every row states what is true right now, including "the software for this is
+// not installed" -- which is the honest answer for file sharing here, and is
+// what the panel this replaces hides behind a switch that silently does
+// nothing.
+//
+// Turning remote login on changes the whole system and prompts. Remote desktop
+// is a user service and does not.
+
+import Quickshell
+import QtQuick
+import qs.config
+import qs.services
+
+SettingsPage {
+    id: root
+
+    objectName: "sharing"
+    title: "Sharing"
+    lede: "What this machine offers to other machines on the network."
+
+    Component.onCompleted: Sharing.refresh()
+
+    TextRow {
+        visible: Sharing.lastError !== ""
+        label: "Sharing needs attention"
+        detail: Sharing.lastError
+        value: ""
+        divider: false
+    }
+
+    SettingsCard {
+        title: "This machine"
+        subtitle: "The name other machines see."
+
+        TextFieldRow {
+            label: "Network name"
+            detail: "Used for ssh and for anything else that finds this machine by name"
+            text: Sharing.hostname
+            placeholder: "desktop"
+            enabled: !Sharing.busy
+            divider: false
+            onAccepted: value => Sharing.setHostname(value)
+        }
+    }
+
+    SettingsCard {
+        title: "Remote login"
+        subtitle: "Sign in to a terminal on this machine over SSH."
+
+        SwitchRow {
+            label: "Allow remote login"
+            detail: Sharing.remoteLogin?.installed === true
+                ? (Sharing.remoteLoginOn
+                    ? "Running, and starts automatically at boot"
+                    : "Not running")
+                : "OpenSSH server is not installed"
+            checked: Sharing.remoteLoginOn
+            enabled: !Sharing.busy && Sharing.remoteLogin?.installed === true
+            onToggled: value => Sharing.setRemoteLogin(value)
+        }
+
+        TextRow {
+            visible: Sharing.remoteLoginOn
+            label: "Connect with"
+            detail: "From another machine on your network"
+            value: "ssh " + Sharing.networkName
+        }
+
+        TextRow {
+            visible: Sharing.remoteLoginOn
+            label: "Port"
+            detail: "Where the SSH server is listening"
+            value: String(Sharing.remoteLogin?.port ?? "22")
+        }
+
+        // Reported from the configuration rather than assumed. Saying "keys
+        // only" on a machine that actually accepts passwords would be a
+        // security claim this page cannot back up.
+        TextRow {
+            visible: Sharing.remoteLoginOn
+            label: "Password sign-in"
+            detail: Sharing.passwordLoginSummary()
+            value: ""
+            divider: false
+        }
+    }
+
+    SettingsCard {
+        title: "Remote desktop"
+        subtitle: "See and control this desktop from another machine."
+
+        SwitchRow {
+            label: "Allow remote desktop"
+            detail: Sharing.remoteDesktop?.available === true
+                ? (Sharing.remoteDesktopOn
+                    ? "Running for your session"
+                    : (Sharing.remoteDesktop?.hasCredentials === true
+                        ? "Not running"
+                        : "Set a username and password before turning this on"))
+                : "Remote desktop support is not installed"
+            checked: Sharing.remoteDesktopOn
+            enabled: !Sharing.busy
+                && Sharing.remoteDesktop?.available === true
+                && Sharing.remoteDesktop?.hasCredentials === true
+            onToggled: value => Sharing.setRemoteDesktop(value)
+        }
+
+        TextRow {
+            visible: Sharing.remoteDesktop?.available === true
+            label: "Port"
+            detail: "The RDP port other machines connect to"
+            value: String(Sharing.remoteDesktop?.port ?? "")
+        }
+
+        TextRow {
+            visible: Sharing.remoteDesktop?.available === true
+            label: "Credentials"
+            detail: Sharing.remoteDesktop?.hasCredentials === true
+                ? "Stored in the login keyring, where Privacy & Security can manage them"
+                : "None stored yet"
+            value: Sharing.remoteDesktop?.hasCredentials === true ? "Stored" : "Not set"
+            divider: false
+        }
+    }
+
+    SettingsCard {
+        title: "File and media sharing"
+        subtitle: "Sharing folders and media needs software this machine does not necessarily have."
+
+        TextRow {
+            label: "Share folders on the network"
+            detail: Sharing.fileSharing?.installed === true
+                ? "Samba is installed"
+                : "Needs Samba, which is not installed. Settings does not install software."
+            value: Sharing.fileSharing?.installed === true ? "Available" : "Not installed"
+        }
+
+        TextRow {
+            label: "Share music and video to devices"
+            detail: Sharing.mediaSharing?.installed === true
+                ? "Rygel is installed"
+                : "Needs Rygel, which is not installed."
+            value: Sharing.mediaSharing?.installed === true ? "Available" : "Not installed"
+            divider: false
+        }
+    }
+}

config/dot/quickshell/modules/settings/SwitchRow.qml

@@ -0,0 +1,50 @@
+// A toggle that is NOT schema-bound.
+//
+// ToggleRow reads and writes a preference key. Some switches govern system
+// state instead -- an account flag, a systemd unit -- which lives outside
+// Panama's settings file and is read back from the system that owns it.
+
+import QtQuick
+import qs.config
+
+SettingRow {
+    id: root
+
+    property bool checked: false
+    property bool enabled: true
+
+    signal toggled(value: bool)
+
+    controlWidth: 54
+
+    Rectangle {
+        anchors.right: parent.right
+        anchors.verticalCenter: parent.verticalCenter
+        width: 44
+        height: 26
+        radius: height / 2
+        color: root.checked ? Theme.accent : Theme.alpha(Theme.fg, 0.14)
+        opacity: root.enabled ? 1 : 0.45
+
+        Rectangle {
+            x: root.checked ? parent.width - width - 3 : 3
+            anchors.verticalCenter: parent.verticalCenter
+            width: 20
+            height: 20
+            radius: height / 2
+            color: root.checked ? Theme.bgDark : Theme.fg
+
+            // Short and non-repeating: this animates only when someone acts.
+            Behavior on x {
+                NumberAnimation { duration: 120; easing.type: Easing.OutCubic }
+            }
+        }
+
+        MouseArea {
+            anchors.fill: parent
+            enabled: root.enabled
+            cursorShape: Qt.PointingHandCursor
+            onClicked: root.toggled(!root.checked)
+        }
+    }
+}

config/dot/quickshell/modules/settings/TextFieldRow.qml

@@ -0,0 +1,88 @@
+// A row whose trailing control is a free-text field, NOT bound to a schema key.
+//
+//   TextFieldRow {
+//       label: "Full name"
+//       text: Accounts.me.realName
+//       onAccepted: value => Accounts.setRealName("gib", value)
+//   }
+//
+// TextEntryRow is the schema-bound one, and is the right choice for anything
+// that is a Panama setting. This is for values that live in the system rather
+// than in settings.json -- an account's real name, the machine's hostname --
+// where the label, the validation, and the write all belong to whoever owns
+// that value.
+//
+// Committed on Enter or when focus leaves, never per keystroke: these drive
+// privileged calls that prompt, and prompting once per typed character would be
+// unusable.
+
+import QtQuick
+import qs.config
+
+SettingRow {
+    id: root
+
+    property string text: ""
+    property string placeholder: ""
+    property bool enabled: true
+
+    signal accepted(value: string)
+
+    controlWidth: 220
+
+    // An external change replaces what is shown, unless it would yank the field
+    // out from under someone mid-edit.
+    onTextChanged: if (!input.activeFocus) input.text = root.text
+
+    Rectangle {
+        anchors.right: parent.right
+        anchors.verticalCenter: parent.verticalCenter
+        width: root.controlWidth
+        height: 32
+        radius: 9
+        color: Theme.alpha(Theme.fg, root.enabled ? 0.06 : 0.03)
+        border.width: input.activeFocus ? 2 : 1
+        border.color: input.activeFocus
+            ? Theme.alpha(Theme.accent, 0.55)
+            : Theme.alpha(Theme.fg, 0.1)
+        opacity: root.enabled ? 1 : 0.5
+
+        TextInput {
+            id: input
+            anchors.fill: parent
+            anchors.leftMargin: 11
+            anchors.rightMargin: 11
+            enabled: root.enabled
+            activeFocusOnTab: true
+            text: root.text
+            color: Theme.fg
+            selectionColor: Theme.alpha(Theme.accent, 0.5)
+            selectedTextColor: Theme.fg
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSize
+            verticalAlignment: TextInput.AlignVCenter
+            clip: true
+
+            onAccepted: if (input.text !== root.text) root.accepted(input.text)
+
+            onActiveFocusChanged: {
+                if (input.activeFocus)
+                    return;
+                if (input.text !== root.text)
+                    root.accepted(input.text);
+                else
+                    input.text = root.text;
+            }
+
+            Text {
+                anchors.fill: parent
+                visible: input.text === ""
+                text: root.placeholder
+                color: Theme.fgMuted
+                font: input.font
+                verticalAlignment: Text.AlignVCenter
+                elide: Text.ElideRight
+            }
+        }
+    }
+}

config/dot/quickshell/modules/settings/UsersPage.qml

@@ -0,0 +1,379 @@
+// Your account, and anyone else who signs in to this machine.
+//
+// The layout puts your own account first because that is what someone opens
+// this page for, and the avatar leads because it is the thing that shows up
+// elsewhere in the desktop -- the Control Center draws it, and the lock screen
+// and login screen read the same file.
+//
+// Everything privileged here prompts through polkit. A prompt that is dismissed
+// is a normal outcome and says so plainly rather than reporting a failure.
+
+import Quickshell
+import Quickshell.Widgets
+import QtQuick
+import qs.config
+import qs.services
+
+SettingsPage {
+    id: root
+
+    objectName: "users"
+    title: "Users"
+    lede: "Your account, and anyone else who signs in to this machine."
+
+    // One panel open at a time: changing a password and adding an account are
+    // both multi-field, and two open at once reads as a form with no shape.
+    property string openPanel: ""
+    property string newPassword: ""
+    property string confirmPassword: ""
+    property string newUserName: ""
+    property string newRealName: ""
+    property bool newUserIsAdministrator: false
+    property string confirmingRemoval: ""
+
+    readonly property var me: UserAccounts.me
+
+    readonly property string passwordProblem: {
+        if (root.newPassword === "")
+            return "";
+        if (root.newPassword.length < 6)
+            return "Use at least six characters.";
+        if (root.confirmPassword !== "" && root.newPassword !== root.confirmPassword)
+            return "The two entries do not match.";
+        return "";
+    }
+
+    readonly property bool passwordReady: root.newPassword.length >= 6
+        && root.newPassword === root.confirmPassword
+
+    function closePanels(): void {
+        root.openPanel = "";
+        root.newPassword = "";
+        root.confirmPassword = "";
+        root.newUserName = "";
+        root.newRealName = "";
+        root.newUserIsAdministrator = false;
+    }
+
+    Component.onCompleted: UserAccounts.refresh()
+
+    TextRow {
+        visible: UserAccounts.lastError !== ""
+        label: "Accounts need attention"
+        detail: UserAccounts.lastError
+        value: ""
+        divider: false
+    }
+
+    // ── You ──────────────────────────────────────────────────────────────────
+
+    SettingsCard {
+        visible: root.me !== null
+
+        Row {
+            width: parent.width
+            spacing: 20
+
+            Item {
+                width: 96
+                height: 96
+
+                ClippingRectangle {
+                    anchors.fill: parent
+                    radius: width / 2
+                    color: Theme.alpha(Theme.fg, 0.08)
+
+                    Image {
+                        anchors.fill: parent
+                        source: UserAccounts.avatarUrl
+                        visible: UserAccounts.avatarUrl !== ""
+                        fillMode: Image.PreserveAspectCrop
+                        // The file is replaced in place when the picture
+                        // changes, so the cache has to be told to let go.
+                        cache: false
+                        asynchronous: true
+                        sourceSize.width: 192
+                        sourceSize.height: 192
+                    }
+
+                    Text {
+                        anchors.centerIn: parent
+                        visible: UserAccounts.avatarUrl === ""
+                        text: UserAccounts.displayName(root.me).slice(0, 1).toUpperCase()
+                        color: Theme.fgDim
+                        font.family: Theme.fontFamily
+                        font.pixelSize: 38
+                        font.weight: Font.DemiBold
+                    }
+                }
+            }
+
+            Column {
+                width: parent.width - 116
+                spacing: 4
+                anchors.verticalCenter: parent.verticalCenter
+
+                Text {
+                    text: UserAccounts.displayName(root.me)
+                    color: Theme.fg
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSizeTitle
+                    font.weight: Font.DemiBold
+                }
+
+                Text {
+                    text: String(root.me?.userName ?? "") + " · "
+                        + (root.me?.administrator ? "Administrator" : "Standard account")
+                    color: Theme.fgDim
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSize
+                }
+
+                Item { width: 1; height: 6 }
+
+                SettingsButton {
+                    text: "Change picture…"
+                    enabled: !UserAccounts.busy
+                    onClicked: avatarPicker.open()
+                }
+            }
+        }
+    }
+
+    SettingsCard {
+        title: "Account"
+        visible: root.me !== null
+
+        TextFieldRow {
+            label: "Full name"
+            detail: "Shown on the lock screen and in the Control Center"
+            text: String(root.me?.realName ?? "")
+            placeholder: "Your name"
+            enabled: !UserAccounts.busy
+            onAccepted: value => UserAccounts.setRealName(String(root.me?.userName ?? ""), value)
+        }
+
+        TextRow {
+            label: "Username"
+            detail: "Fixed when the account was created, because files and permissions are keyed to it"
+            value: String(root.me?.userName ?? "")
+        }
+
+        SegmentRow {
+            label: "Account type"
+            detail: root.me?.administrator && UserAccounts.administratorCount <= 1
+                ? "This is the only administrator, so it cannot be changed"
+                : "Administrators can install software and manage other accounts"
+            options: [
+                { value: "standard", label: "Standard" },
+                { value: "administrator", label: "Administrator" }
+            ]
+            value: root.me?.administrator ? "administrator" : "standard"
+            enabled: !UserAccounts.busy
+                && !(root.me?.administrator && UserAccounts.administratorCount <= 1)
+            onSelected: value => UserAccounts.setAccountType(String(root.me?.userName ?? ""), value)
+        }
+
+        ActionRow {
+            label: "Password"
+            detail: root.openPanel === "password"
+                ? "Changing it asks for authorization first"
+                : "Change the password used to sign in and to unlock the screen"
+            action: root.openPanel === "password" ? "Cancel" : "Change…"
+            enabled: !UserAccounts.busy
+            divider: root.openPanel === "password"
+            onTriggered: {
+                if (root.openPanel === "password")
+                    root.closePanels();
+                else {
+                    root.closePanels();
+                    root.openPanel = "password";
+                }
+            }
+        }
+
+        Column {
+            width: parent.width
+            visible: root.openPanel === "password"
+
+            PasswordRow {
+                width: parent.width
+                label: "New password"
+                detail: "At least six characters"
+                onChanged: value => root.newPassword = value
+            }
+
+            PasswordRow {
+                width: parent.width
+                label: "Confirm"
+                detail: root.passwordProblem !== ""
+                    ? root.passwordProblem
+                    : "Type it a second time"
+                onChanged: value => root.confirmPassword = value
+            }
+
+            ActionRow {
+                width: parent.width
+                label: "Set this password"
+                detail: "You will be asked to authorize the change"
+                action: "Set password"
+                enabled: root.passwordReady && !UserAccounts.busy
+                divider: false
+                onTriggered: {
+                    UserAccounts.setPassword(String(root.me?.userName ?? ""), root.newPassword);
+                    root.closePanels();
+                }
+            }
+        }
+
+        SwitchRow {
+            label: "Automatic login"
+            detail: "Sign in without typing a password. The login keyring stays locked when this is on, so stored passwords are unavailable until something asks for them."
+            checked: root.me?.automaticLogin === true
+            enabled: !UserAccounts.busy
+            divider: false
+            onToggled: value => UserAccounts.setAutomaticLogin(String(root.me?.userName ?? ""), value)
+        }
+    }
+
+    // ── Everyone else ────────────────────────────────────────────────────────
+
+    SettingsCard {
+        title: "Other accounts"
+        subtitle: UserAccounts.others.length === 0
+            ? "Only your account exists on this machine."
+            : UserAccounts.others.length + " other account"
+              + (UserAccounts.others.length === 1 ? "" : "s")
+
+        Repeater {
+            model: UserAccounts.others
+
+            delegate: Column {
+                id: otherBlock
+
+                required property var modelData
+
+                width: parent.width
+
+                readonly property string userName: String(otherBlock.modelData.userName ?? "")
+                readonly property bool confirming: root.confirmingRemoval === otherBlock.userName
+
+                SettingRow {
+                    width: otherBlock.width
+                    label: UserAccounts.displayName(otherBlock.modelData)
+                    detail: otherBlock.userName + " · "
+                        + (otherBlock.modelData.administrator ? "Administrator" : "Standard account")
+                    controlWidth: 210
+                    divider: false
+
+                    Row {
+                        anchors.right: parent.right
+                        anchors.verticalCenter: parent.verticalCenter
+                        spacing: 8
+
+                        SettingsButton {
+                            text: otherBlock.confirming ? "Keep" : "Remove…"
+                            enabled: !UserAccounts.busy
+                            onClicked: root.confirmingRemoval = otherBlock.confirming
+                                ? "" : otherBlock.userName
+                        }
+
+                        SettingsButton {
+                            visible: otherBlock.confirming
+                            text: "Delete account and files"
+                            tone: "danger"
+                            enabled: !UserAccounts.busy
+                            onClicked: {
+                                root.confirmingRemoval = "";
+                                UserAccounts.deleteUser(otherBlock.userName, true);
+                            }
+                        }
+                    }
+                }
+
+                TextRow {
+                    width: otherBlock.width
+                    visible: otherBlock.confirming
+                    label: "This cannot be undone"
+                    detail: "Their home directory and everything in it is deleted."
+                    value: ""
+                    divider: false
+                }
+
+                Item { width: 1; height: 6 }
+            }
+        }
+
+        ActionRow {
+            label: "Add an account"
+            detail: "Creating an account asks for authorization first"
+            action: root.openPanel === "newUser" ? "Cancel" : "Add…"
+            enabled: !UserAccounts.busy
+            divider: root.openPanel === "newUser"
+            onTriggered: {
+                if (root.openPanel === "newUser")
+                    root.closePanels();
+                else {
+                    root.closePanels();
+                    root.openPanel = "newUser";
+                }
+            }
+        }
+
+        Column {
+            width: parent.width
+            visible: root.openPanel === "newUser"
+
+            TextFieldRow {
+                width: parent.width
+                label: "Full name"
+                placeholder: "Their name"
+                detail: "Shown on the login screen"
+                text: root.newRealName
+                onAccepted: value => root.newRealName = value
+            }
+
+            TextFieldRow {
+                width: parent.width
+                label: "Username"
+                placeholder: "lowercase, no spaces"
+                detail: "Their home directory is named after this and cannot be changed later"
+                text: root.newUserName
+                onAccepted: value => root.newUserName = value
+            }
+
+            SegmentRow {
+                width: parent.width
+                label: "Account type"
+                detail: "Standard accounts cannot install software or manage other accounts"
+                options: [
+                    { value: "standard", label: "Standard" },
+                    { value: "administrator", label: "Administrator" }
+                ]
+                value: root.newUserIsAdministrator ? "administrator" : "standard"
+                onSelected: value => root.newUserIsAdministrator = value === "administrator"
+            }
+
+            ActionRow {
+                width: parent.width
+                label: "Create the account"
+                detail: "They set their own password the first time they sign in"
+                action: "Create"
+                enabled: !UserAccounts.busy && /^[a-z_][a-z0-9_-]*$/.test(root.newUserName)
+                divider: false
+                onTriggered: {
+                    UserAccounts.createUser(root.newUserName, root.newRealName,
+                                        root.newUserIsAdministrator ? "administrator" : "standard");
+                    root.closePanels();
+                }
+            }
+        }
+    }
+
+    // Picking a picture goes through the desktop portal, which is the same
+    // chooser every other application gets and needs no privilege of its own.
+    AvatarPicker {
+        id: avatarPicker
+        onPicked: path => UserAccounts.setIcon(String(root.me?.userName ?? ""), path)
+    }
+}

config/dot/quickshell/modules/settings/qmldir

@@ -1,6 +1,7 @@
 module qs.modules.settings
 AboutPage 1.0 AboutPage.qml
 AppearancePage 1.0 AppearancePage.qml
+AvatarPicker 1.0 AvatarPicker.qml
 ConnectivityPage 1.0 ConnectivityPage.qml
 HomePhonePage 1.0 HomePhonePage.qml
 HomeFavoriteCard 1.0 HomeFavoriteCard.qml
@@ -9,10 +10,12 @@ DesktopPage 1.0 DesktopPage.qml
 DisplaysPage 1.0 DisplaysPage.qml
 HomePage 1.0 HomePage.qml
 NotificationsPage 1.0 NotificationsPage.qml
+PasswordRow 1.0 PasswordRow.qml
 ScreenIntelligencePage 1.0 ScreenIntelligencePage.qml
 HealthPage 1.0 HealthPage.qml
 HealthSummary 1.0 HealthSummary.qml
 HealthCheckRow 1.0 HealthCheckRow.qml
+SegmentRow 1.0 SegmentRow.qml
 SettingRow 1.0 SettingRow.qml
 SettingsCard 1.0 SettingsCard.qml
 SettingsButton 1.0 SettingsButton.qml
@@ -20,10 +23,12 @@ SettingsShell 1.0 SettingsShell.qml
 SettingsSidebar 1.0 SettingsSidebar.qml
 SettingsToggle 1.0 SettingsToggle.qml
 SettingsWindow 1.0 SettingsWindow.qml
+SharingPage 1.0 SharingPage.qml
 ShortcutsPage 1.0 ShortcutsPage.qml
 SoundPage 1.0 SoundPage.qml
 SettingsPage 1.0 SettingsPage.qml
 StoragePage 1.0 StoragePage.qml
+SwitchRow 1.0 SwitchRow.qml
 ToggleRow 1.0 ToggleRow.qml
 SliderRow 1.0 SliderRow.qml
 ChoiceRow 1.0 ChoiceRow.qml
@@ -34,6 +39,7 @@ LockScreenPreview 1.0 LockScreenPreview.qml
 PowerPage 1.0 PowerPage.qml
 DateTimePage 1.0 DateTimePage.qml
 AccessibilityPage 1.0 AccessibilityPage.qml
+UsersPage 1.0 UsersPage.qml
 WallpaperPicker 1.0 WallpaperPicker.qml
 WallpaperControls 1.0 WallpaperControls.qml
 ApplicationsPage 1.0 ApplicationsPage.qml
@@ -63,3 +69,4 @@ RegionPage 1.0 RegionPage.qml
 SearchPicker 1.0 SearchPicker.qml
 OnlineAccountsPage 1.0 OnlineAccountsPage.qml
 AccentPicker 1.0 AccentPicker.qml
+TextFieldRow 1.0 TextFieldRow.qml

config/dot/quickshell/scripts/panama-sharing

@@ -0,0 +1,188 @@
+#!/usr/bin/env python3
+
+"""What this machine offers to other machines, and switches for it.
+
+Every row reports what is actually true, including "the software for this is not
+installed". GNOME's Sharing panel shows switches for services that are absent,
+which is how a switch ends up doing nothing at all.
+
+Enabling remote login is a system-wide change and goes through pkexec, which
+prompts with the polkit agent this desktop already runs. Remote desktop is a
+user service and needs no privilege.
+
+    panama-sharing snapshot
+    panama-sharing set-remote-login true|false
+    panama-sharing set-remote-desktop true|false
+    panama-sharing set-hostname NAME
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+HOSTNAME = re.compile(r"^[A-Za-z0-9][A-Za-z0-9-]{0,62}$")
+
+
+class BoundaryError(RuntimeError):
+    """A user-visible validation or permission failure."""
+
+
+def run(command: list[str], timeout: float = 25.0) -> subprocess.CompletedProcess:
+    try:
+        return subprocess.run(command, capture_output=True, text=True,
+                              timeout=timeout, check=False)
+    except (OSError, subprocess.TimeoutExpired) as error:
+        raise BoundaryError(f"{command[0]} did not answer.") from error
+
+
+def unit_state(unit: str, user: bool = False) -> dict:
+    scope = ["--user"] if user else []
+    active = run(["systemctl", *scope, "is-active", unit]).stdout.strip()
+    enabled = run(["systemctl", *scope, "is-enabled", unit]).stdout.strip()
+    return {
+        "installed": enabled not in ("", "not-found"),
+        "active": active == "active",
+        "enabled": enabled == "enabled",
+    }
+
+
+def ssh_setting(name: str) -> str:
+    """What sshd's own configuration says, or "" when it says nothing.
+
+    `sshd -T` would be authoritative but needs root. Reading the files means
+    reporting "not configured" rather than guessing a default -- which matters,
+    because claiming "keys only" on a machine that actually accepts passwords
+    would be a security claim this cannot back up.
+    """
+    paths = [Path("/etc/ssh/sshd_config")]
+    paths.extend(sorted(Path("/etc/ssh/sshd_config.d").glob("*.conf"))
+                 if Path("/etc/ssh/sshd_config.d").is_dir() else [])
+    pattern = re.compile(rf"^\s*{name}\s+(\S+)", re.IGNORECASE)
+    for path in paths:
+        try:
+            for line in path.read_text(encoding="utf-8", errors="replace").splitlines():
+                found = pattern.match(line)
+                if found:
+                    return found.group(1)
+        except OSError:
+            continue
+    return ""
+
+
+def remote_desktop() -> dict:
+    state = unit_state("gnome-remote-desktop.service", user=True)
+    state["available"] = bool(shutil.which("grdctl"))
+    state["rdpEnabled"] = False
+    state["port"] = ""
+    state["hasCredentials"] = False
+    if not state["available"]:
+        return state
+
+    status = run(["grdctl", "status"]).stdout
+    section = status.split("RDP:", 1)
+    if len(section) > 1:
+        block = section[1].split("VNC:", 1)[0]
+        state["rdpEnabled"] = re.search(r"Status:\s*enabled", block) is not None
+        port = re.search(r"Port:\s*(\d+)", block)
+        state["port"] = port.group(1) if port else ""
+        # grdctl prints "(hidden)" when a credential is stored and nothing when
+        # it is not, so this reads presence without ever reading the value.
+        state["hasCredentials"] = "(hidden)" in block
+    return state
+
+
+def snapshot() -> dict:
+    static_name = run(["hostnamectl", "--static"]).stdout.strip()
+    pretty_name = run(["hostnamectl", "--pretty"]).stdout.strip()
+
+    login = unit_state("sshd.service")
+    login["port"] = ssh_setting("Port") or "22"
+    login["passwordAuthentication"] = ssh_setting("PasswordAuthentication")
+    login["rootLogin"] = ssh_setting("PermitRootLogin")
+
+    return {
+        "hostname": static_name,
+        "prettyHostname": pretty_name,
+        "remoteLogin": login,
+        "remoteDesktop": remote_desktop(),
+        # Reported as absent rather than offered as a switch that would do
+        # nothing. Installing software is not this page's job.
+        "fileSharing": {"installed": bool(shutil.which("smbd")), "package": "samba"},
+        "mediaSharing": {"installed": bool(shutil.which("rygel")), "package": "rygel"},
+        "error": "",
+    }
+
+
+def set_remote_login(enabled: bool) -> None:
+    if not unit_state("sshd.service")["installed"]:
+        raise BoundaryError("OpenSSH server is not installed.")
+    action = ["enable", "--now"] if enabled else ["disable", "--now"]
+    result = run(["pkexec", "systemctl", *action, "sshd.service"], timeout=120)
+    if result.returncode != 0:
+        raise BoundaryError(_refusal(result, "Remote login could not be changed."))
+
+
+def set_remote_desktop(enabled: bool) -> None:
+    state = remote_desktop()
+    if not state["available"]:
+        raise BoundaryError("Remote desktop support is not installed.")
+    if enabled and not state["hasCredentials"]:
+        raise BoundaryError("Set a remote desktop username and password first.")
+
+    toggle = run(["grdctl", "rdp", "enable" if enabled else "disable"])
+    if toggle.returncode != 0:
+        raise BoundaryError(_refusal(toggle, "Remote desktop could not be changed."))
+
+    action = ["enable", "--now"] if enabled else ["disable", "--now"]
+    result = run(["systemctl", "--user", *action, "gnome-remote-desktop.service"], timeout=60)
+    if result.returncode != 0:
+        raise BoundaryError(_refusal(result, "The remote desktop service could not be changed."))
+
+
+def set_hostname(name: str) -> None:
+    if not HOSTNAME.fullmatch(name or ""):
+        raise BoundaryError("A name may use letters, digits and hyphens.")
+    result = run(["hostnamectl", "set-hostname", name], timeout=60)
+    if result.returncode != 0:
+        raise BoundaryError(_refusal(result, "The name could not be changed."))
+
+
+def _refusal(result: subprocess.CompletedProcess, fallback: str) -> str:
+    text = (result.stderr or "").strip().splitlines()
+    if text and ("not authorized" in text[-1].lower() or "dismissed" in text[-1].lower()):
+        return "That change was not authorized."
+    return text[-1][:200] if text else fallback
+
+
+def main(arguments: list[str]) -> int:
+    try:
+        if arguments == ["snapshot"]:
+            print(json.dumps(snapshot(), separators=(",", ":")))
+            return 0
+        if len(arguments) == 2 and arguments[0] == "set-remote-login":
+            set_remote_login(arguments[1] == "true")
+        elif len(arguments) == 2 and arguments[0] == "set-remote-desktop":
+            set_remote_desktop(arguments[1] == "true")
+        elif len(arguments) == 2 and arguments[0] == "set-hostname":
+            set_hostname(arguments[1])
+        else:
+            raise BoundaryError(
+                "Usage: panama-sharing snapshot | set-remote-login true|false | "
+                "set-remote-desktop true|false | set-hostname NAME")
+    except BoundaryError as error:
+        state = snapshot()
+        state["error"] = str(error)
+        print(json.dumps(state, separators=(",", ":")))
+        return 0
+
+    print(json.dumps(snapshot(), separators=(",", ":")))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

config/dot/quickshell/scripts/panama-users

@@ -0,0 +1,272 @@
+#!/usr/bin/env python3
+
+"""User accounts, through accountsservice -- the same daemon GNOME's Users panel
+drives.
+
+Everything here that changes something is authorized by polkit, which prompts
+through the agent this desktop already runs. This script never asks for a
+password itself and never holds an administrator credential.
+
+The one credential it does handle is a NEW password being set. That is read
+from stdin, hashed by openssl reading its own stdin, and handed to
+accountsservice over D-Bus from inside this process. It is never an argument:
+argv is world-readable through /proc, so a password -- or even its hash --
+passed that way is published to every process on the machine.
+
+    panama-accounts snapshot
+    panama-accounts set-real-name USER NAME
+    panama-accounts set-icon USER PATH
+    panama-accounts set-account-type USER standard|administrator
+    panama-accounts set-automatic-login USER true|false
+    panama-accounts set-password USER          (new password on stdin)
+    panama-accounts create-user USERNAME REALNAME standard|administrator
+    panama-accounts delete-user USERNAME [keep-files|remove-files]
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import sys
+
+ACCOUNTS = "org.freedesktop.Accounts"
+ACCOUNTS_PATH = "/org/freedesktop/Accounts"
+USER_INTERFACE = "org.freedesktop.Accounts.User"
+
+# Account types as accountsservice numbers them.
+STANDARD, ADMINISTRATOR = 0, 1
+
+USERNAME = re.compile(r"^[a-z_][a-z0-9_-]{0,31}$")
+
+
+class BoundaryError(RuntimeError):
+    """A user-visible validation or permission failure."""
+
+
+def bus():
+    try:
+        import gi
+
+        gi.require_version("Gio", "2.0")
+        from gi.repository import Gio, GLib
+
+        return Gio, GLib, Gio.bus_get_sync(Gio.BusType.SYSTEM, None)
+    except Exception as error:  # noqa: BLE001 - no bus is a legitimate state
+        raise BoundaryError("The account service is not answering.") from error
+
+
+def call(path: str, interface: str, method: str, parameters=None, reply=None):
+    Gio, GLib, connection = bus()
+    try:
+        result = connection.call_sync(
+            ACCOUNTS, path, interface, method, parameters,
+            GLib.VariantType(reply) if reply else None,
+            Gio.DBusCallFlags.NONE, 120000, None)
+    except Exception as error:  # noqa: BLE001
+        message = str(error)
+        # Polkit's own refusal is the common case and deserves plain words
+        # rather than a D-Bus error string.
+        if "not authorized" in message.lower() or "dismissed" in message.lower():
+            raise BoundaryError("That change was not authorized.") from error
+        raise BoundaryError(_clean(message)) from error
+    return result.unpack() if result is not None else None
+
+
+def _clean(message: str) -> str:
+    """The last useful sentence of a D-Bus error, without the type prefix."""
+    trimmed = re.sub(r"^GDBus\.Error:[^:]+:\s*", "", message).strip()
+    return trimmed.splitlines()[0][:200] if trimmed else "That change failed."
+
+
+def properties(path: str) -> dict:
+    Gio, GLib, connection = bus()
+    result = connection.call_sync(
+        ACCOUNTS, path, "org.freedesktop.DBus.Properties", "GetAll",
+        GLib.Variant("(s)", (USER_INTERFACE,)), GLib.VariantType("(a{sv})"),
+        Gio.DBusCallFlags.NONE, 20000, None)
+    return result.unpack()[0]
+
+
+def user_path(username: str) -> str:
+    if not USERNAME.fullmatch(username or ""):
+        raise BoundaryError("That is not a user name.")
+    from gi.repository import GLib
+
+    return call(ACCOUNTS_PATH, ACCOUNTS, "FindUserByName",
+                GLib.Variant("(s)", (username,)), "(o)")[0]
+
+
+def describe(path: str) -> dict:
+    values = properties(path)
+    icon = str(values.get("IconFile") or "")
+    return {
+        "path": path,
+        "userName": str(values.get("UserName") or ""),
+        "realName": str(values.get("RealName") or ""),
+        # Reported only when it is actually there: accountsservice keeps the
+        # path in its database whether or not a file exists, so a deleted
+        # avatar otherwise shows as a broken image.
+        "iconFile": icon if icon and os.path.isfile(icon) else "",
+        "administrator": int(values.get("AccountType") or 0) == ADMINISTRATOR,
+        "locked": bool(values.get("Locked")),
+        "automaticLogin": bool(values.get("AutomaticLogin")),
+        "loginTime": int(values.get("LoginTime") or 0),
+        "shell": str(values.get("Shell") or ""),
+        "homeDirectory": str(values.get("HomeDirectory") or ""),
+        "systemAccount": bool(values.get("SystemAccount")),
+        "uid": int(values.get("Uid") or 0),
+    }
+
+
+def snapshot() -> dict:
+    paths = call(ACCOUNTS_PATH, ACCOUNTS, "ListCachedUsers", None, "(ao)")[0]
+    users = [describe(path) for path in paths]
+    users = [user for user in users if not user["systemAccount"]]
+    users.sort(key=lambda user: user["uid"])
+    me = os.environ.get("USER") or ""
+    return {
+        "users": users,
+        "currentUser": me,
+        # Removing the only administrator would leave a machine nobody can
+        # administer, so the page needs to know rather than find out.
+        "administratorCount": sum(1 for user in users if user["administrator"]),
+        "error": "",
+    }
+
+
+def set_real_name(username: str, name: str) -> None:
+    from gi.repository import GLib
+
+    if len(name) > 128 or "\n" in name or ":" in name:
+        raise BoundaryError("That name cannot be used.")
+    call(user_path(username), USER_INTERFACE, "SetRealName",
+         GLib.Variant("(s)", (name,)))
+
+
+def set_icon(username: str, path: str) -> None:
+    from gi.repository import GLib
+
+    if not os.path.isfile(path):
+        raise BoundaryError("That picture no longer exists.")
+    call(user_path(username), USER_INTERFACE, "SetIconFile",
+         GLib.Variant("(s)", (path,)))
+
+
+def set_account_type(username: str, kind: str) -> None:
+    from gi.repository import GLib
+
+    if kind not in ("standard", "administrator"):
+        raise BoundaryError("That is not an account type.")
+    call(user_path(username), USER_INTERFACE, "SetAccountType",
+         GLib.Variant("(i)", (ADMINISTRATOR if kind == "administrator" else STANDARD,)))
+
+
+def set_automatic_login(username: str, enabled: bool) -> None:
+    from gi.repository import GLib
+
+    call(user_path(username), USER_INTERFACE, "SetAutomaticLogin",
+         GLib.Variant("(b)", (enabled,)))
+
+
+def set_password(username: str) -> None:
+    """Set a new password, read from stdin and never named on a command line."""
+    secret = sys.stdin.buffer.read()
+    # A trailing newline from a pipe is not part of the password.
+    if secret.endswith(b"\n"):
+        secret = secret[:-1]
+    if not secret:
+        raise BoundaryError("No password was provided.")
+    if len(secret) < 6:
+        raise BoundaryError("That password is too short.")
+
+    # openssl reads the password on ITS stdin too, so the cleartext never
+    # appears in a process listing at any point in the chain.
+    hashed = subprocess.run(["openssl", "passwd", "-6", "-stdin"],
+                            input=secret, capture_output=True, timeout=30, check=False)
+    if hashed.returncode != 0 or not hashed.stdout.strip():
+        raise BoundaryError("The password could not be prepared.")
+
+    from gi.repository import GLib
+
+    call(user_path(username), USER_INTERFACE, "SetPassword",
+         GLib.Variant("(ss)", (hashed.stdout.decode().strip(), "")))
+
+
+def create_user(username: str, real_name: str, kind: str) -> None:
+    from gi.repository import GLib
+
+    if not USERNAME.fullmatch(username or ""):
+        raise BoundaryError("A user name may use lowercase letters, digits, - and _.")
+    if kind not in ("standard", "administrator"):
+        raise BoundaryError("That is not an account type.")
+    call(ACCOUNTS_PATH, ACCOUNTS, "CreateUser",
+         GLib.Variant("(ssi)", (username, real_name,
+                                ADMINISTRATOR if kind == "administrator" else STANDARD)),
+         "(o)")
+
+
+def delete_user(username: str, files: str) -> None:
+    from gi.repository import GLib
+
+    if files not in ("keep-files", "remove-files"):
+        raise BoundaryError("Say whether to keep or remove the home directory.")
+    if username == (os.environ.get("USER") or ""):
+        raise BoundaryError("You cannot delete the account you are signed in to.")
+
+    state = snapshot()
+    target = next((user for user in state["users"] if user["userName"] == username), None)
+    if target is None:
+        raise BoundaryError("That account no longer exists.")
+    if target["administrator"] and state["administratorCount"] <= 1:
+        raise BoundaryError("That is the only administrator; the machine would have none.")
+
+    call(ACCOUNTS_PATH, ACCOUNTS, "DeleteUser",
+         GLib.Variant("(xb)", (target["uid"], files == "remove-files")))
+
+
+def main(arguments: list[str]) -> int:
+    try:
+        if arguments == ["snapshot"]:
+            print(json.dumps(snapshot(), separators=(",", ":")))
+            return 0
+
+        if len(arguments) == 3 and arguments[0] == "set-real-name":
+            set_real_name(arguments[1], arguments[2])
+        elif len(arguments) == 3 and arguments[0] == "set-icon":
+            set_icon(arguments[1], arguments[2])
+        elif len(arguments) == 3 and arguments[0] == "set-account-type":
+            set_account_type(arguments[1], arguments[2])
+        elif len(arguments) == 3 and arguments[0] == "set-automatic-login":
+            set_automatic_login(arguments[1], arguments[2] == "true")
+        elif len(arguments) == 2 and arguments[0] == "set-password":
+            set_password(arguments[1])
+        elif len(arguments) == 4 and arguments[0] == "create-user":
+            create_user(arguments[1], arguments[2], arguments[3])
+        elif len(arguments) == 3 and arguments[0] == "delete-user":
+            delete_user(arguments[1], arguments[2])
+        else:
+            raise BoundaryError(
+                "Usage: panama-accounts snapshot | set-real-name USER NAME | "
+                "set-icon USER PATH | set-account-type USER standard|administrator | "
+                "set-automatic-login USER true|false | set-password USER | "
+                "create-user USERNAME REALNAME standard|administrator | "
+                "delete-user USERNAME keep-files|remove-files")
+    except BoundaryError as error:
+        # Answers with the fresh state plus the message, so a page never has to
+        # ask twice to find out what happened.
+        try:
+            state = snapshot()
+        except BoundaryError:
+            state = {"users": [], "currentUser": "", "administratorCount": 0}
+        state["error"] = str(error)
+        print(json.dumps(state, separators=(",", ":")))
+        return 0
+
+    print(json.dumps(snapshot(), separators=(",", ":")))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

config/dot/quickshell/services/SettingsSearch.qml

@@ -64,6 +64,16 @@ Singleton {
         { label: "Bluetooth", detail: "Managed by GNOME Settings", page: "connectivity" },
         { label: "Printers", detail: "Managed by GNOME Settings", page: "connectivity" },
         { label: "Default applications", detail: "Browser, mail, files", page: "applications" },
+        { label: "User account", detail: "Your name, picture, and password", page: "users" },
+        { label: "Profile picture", detail: "The avatar shown on the lock screen and in the Control Center", page: "users" },
+        { label: "Change password", detail: "Set a new password for signing in", page: "users" },
+        { label: "Add a user", detail: "Create another account on this machine", page: "users" },
+        { label: "Automatic login", detail: "Sign in without typing a password", page: "users" },
+        { label: "Administrator", detail: "Which accounts can manage this machine", page: "users" },
+        { label: "Remote login", detail: "Sign in to this machine over SSH", page: "sharing" },
+        { label: "Remote desktop", detail: "See and control this desktop from elsewhere", page: "sharing" },
+        { label: "Network name", detail: "The name other machines see", page: "sharing" },
+        { label: "File sharing", detail: "Share folders on the network", page: "sharing" },
         { label: "Free space", detail: "How full each drive and filesystem is", page: "storage" },
         { label: "Disk usage", detail: "What is using the space on this machine", page: "storage" },
         { label: "Drive health", detail: "Temperature, hours powered on, and reported warnings", page: "storage" },

config/dot/quickshell/services/Sharing.qml

@@ -0,0 +1,113 @@
+pragma Singleton
+
+// What this machine offers to other machines: remote login, remote desktop,
+// and the two services that would provide file and media sharing if they were
+// installed.
+//
+// A service that is absent is reported as absent rather than shown as a switch
+// that would do nothing -- which is the failure mode of the panel this replaces.
+//
+// Turning remote login on is a system-wide change and goes through pkexec, so
+// it prompts. Remote desktop is a user service and does not.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-sharing"
+
+    property string hostname: ""
+    property string prettyHostname: ""
+    property var remoteLogin: ({})
+    property var remoteDesktop: ({})
+    property var fileSharing: ({})
+    property var mediaSharing: ({})
+    property bool scanned: false
+    property string lastError: ""
+
+    // Guards read the Process objects directly; a derived binding is stale
+    // inside the handler that changes it. See DefaultApps.qml.
+    readonly property bool busy: query.running || mutation.running
+
+    // The name someone types to reach this machine.
+    readonly property string networkName: root.hostname !== "" ? root.hostname : "this machine"
+
+    readonly property bool remoteLoginOn: root.remoteLogin?.active === true
+    readonly property bool remoteDesktopOn: root.remoteDesktop?.active === true
+
+    // sshd's configuration only sometimes states this. Saying "keys only" when
+    // the file is silent would be a security claim that cannot be backed up.
+    function passwordLoginSummary(): string {
+        const stated = String(root.remoteLogin?.passwordAuthentication ?? "");
+        if (stated === "")
+            return "Not configured, so the system default applies";
+        return stated.toLowerCase() === "no"
+            ? "Refused; keys only"
+            : "Allowed";
+    }
+
+    function refresh(): void {
+        if (query.running)
+            return;
+        query.command = [root.helperPath, "snapshot"];
+        query.running = true;
+    }
+
+    function absorb(text: string): void {
+        try {
+            const parsed = JSON.parse(text);
+            root.hostname = String(parsed.hostname ?? "");
+            root.prettyHostname = String(parsed.prettyHostname ?? "");
+            root.remoteLogin = parsed.remoteLogin ?? ({});
+            root.remoteDesktop = parsed.remoteDesktop ?? ({});
+            root.fileSharing = parsed.fileSharing ?? ({});
+            root.mediaSharing = parsed.mediaSharing ?? ({});
+            root.lastError = String(parsed.error ?? "");
+        } catch (error) {
+            root.lastError = "Could not read the sharing helper's answer.";
+            console.warn("Sharing: could not parse helper output:", error);
+        }
+        root.scanned = true;
+    }
+
+    function run(arguments: var): void {
+        if (mutation.running)
+            return;
+        root.lastError = "";
+        mutation.command = [root.helperPath].concat(arguments);
+        mutation.running = true;
+    }
+
+    function setRemoteLogin(enabled: bool): void {
+        root.run(["set-remote-login", enabled ? "true" : "false"]);
+    }
+
+    function setRemoteDesktop(enabled: bool): void {
+        root.run(["set-remote-desktop", enabled ? "true" : "false"]);
+    }
+
+    function setHostname(name: string): void {
+        root.run(["set-hostname", name]);
+    }
+
+    Process {
+        id: query
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+    }
+
+    Process {
+        id: mutation
+        // Answers with the fresh state, so the page updates from the change
+        // itself rather than asking again afterwards.
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+    }
+}

config/dot/quickshell/services/ShellState.qml

@@ -92,7 +92,7 @@ Singleton {
     }
 
     function openSettings(page: string): void {
-        const allowed = ["home", "appearance", "displays", "connectivity", "home-phone", "desktop", "sound", "notifications", "screen-intelligence", "shortcuts", "mouse", "privacy", "region", "accounts", "accessibility", "power", "datetime", "applications", "storage", "services", "about"];
+        const allowed = ["home", "appearance", "displays", "connectivity", "home-phone", "desktop", "sound", "notifications", "screen-intelligence", "shortcuts", "mouse", "privacy", "region", "accounts", "accessibility", "power", "datetime", "applications", "storage", "users", "sharing", "services", "about"];
         root.settingsPage = allowed.indexOf(page) >= 0 ? page : "home";
         DesktopPreferences.set("lastPage", root.settingsPage);
         root.settingsOpen = true;

config/dot/quickshell/services/UserAccounts.qml

@@ -0,0 +1,162 @@
+pragma Singleton
+
+// User accounts, through accountsservice -- the daemon GNOME's Users panel
+// drives, so what this changes is what every other login surface reads.
+//
+// Every change is authorized by polkit, which prompts through the agent this
+// session already runs. A refused prompt is a normal outcome, not an error to
+// apologize for, and it comes back as a plain sentence.
+//
+// No password ever crosses this file. Setting one writes it to the helper's
+// stdin, which is the only path that keeps it off a command line.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-users"
+
+    property var users: []
+    property string currentUser: ""
+    property int administratorCount: 0
+    property bool scanned: false
+    property string lastError: ""
+
+    // Guards read the Process objects rather than a derived "busy" binding. A
+    // binding hands back its cached value inside the handler that changes it,
+    // which silently turns a refresh after a successful change into a no-op --
+    // the write lands and the page never notices. See DefaultApps.qml.
+    readonly property bool busy: query.running || mutation.running || passwordWrite.running
+
+    readonly property var me: {
+        for (const user of root.users) {
+            if (user.userName === root.currentUser)
+                return user;
+        }
+        return root.users.length > 0 ? root.users[0] : null;
+    }
+
+    readonly property var others: root.users.filter(user => user.userName !== root.currentUser)
+
+    // The avatar, as a URL the shell can draw, or "" when none is set.
+    readonly property string avatarUrl: root.me && String(root.me.iconFile ?? "") !== ""
+        ? "file://" + root.me.iconFile
+        : ""
+
+    function displayName(user: var): string {
+        const real = String(user?.realName ?? "").trim();
+        return real !== "" ? real : String(user?.userName ?? "");
+    }
+
+    function refresh(): void {
+        if (query.running)
+            return;
+        query.command = [root.helperPath, "snapshot"];
+        query.running = true;
+    }
+
+    function absorb(text: string): void {
+        try {
+            const parsed = JSON.parse(text);
+            root.users = Array.isArray(parsed.users) ? parsed.users : [];
+            root.currentUser = String(parsed.currentUser ?? "");
+            root.administratorCount = Number(parsed.administratorCount ?? 0);
+            root.lastError = String(parsed.error ?? "");
+        } catch (error) {
+            root.lastError = "Could not read the account service's answer.";
+            console.warn("Accounts: could not parse helper output:", error);
+        }
+        root.scanned = true;
+    }
+
+    function run(arguments: var): void {
+        if (mutation.running)
+            return;
+        root.lastError = "";
+        mutation.command = [root.helperPath].concat(arguments);
+        mutation.running = true;
+    }
+
+    function setRealName(userName: string, name: string): void {
+        root.run(["set-real-name", userName, name]);
+    }
+
+    function setIcon(userName: string, path: string): void {
+        root.run(["set-icon", userName, path]);
+    }
+
+    function setAccountType(userName: string, kind: string): void {
+        root.run(["set-account-type", userName, kind]);
+    }
+
+    function setAutomaticLogin(userName: string, enabled: bool): void {
+        root.run(["set-automatic-login", userName, enabled ? "true" : "false"]);
+    }
+
+    function createUser(userName: string, realName: string, kind: string): void {
+        root.run(["create-user", userName, realName, kind]);
+    }
+
+    function deleteUser(userName: string, removeFiles: bool): void {
+        root.run(["delete-user", userName, removeFiles ? "remove-files" : "keep-files"]);
+    }
+
+    // The password goes to the helper's stdin and nowhere else: never an
+    // argument, because argv is readable by every process on this machine.
+    //
+    // It is written from onStarted rather than here, because a process has no
+    // stdin to write to until it is actually running. The same pattern
+    // HomeAssistantConfig uses for its token.
+    property string pendingPassword: ""
+
+    function setPassword(userName: string, password: string): void {
+        if (passwordWrite.running)
+            return;
+        root.lastError = "";
+        root.pendingPassword = password;
+        passwordWrite.command = [root.helperPath, "set-password", userName];
+        passwordWrite.running = true;
+    }
+
+    // Self-initializing: the Control Center draws the avatar too, and a
+    // singleton is constructed on first use, so whichever surface asks first
+    // gets a populated service without having to know to ask.
+    Component.onCompleted: root.refresh()
+
+    Process {
+        id: query
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+    }
+
+    Process {
+        id: passwordWrite
+        stdinEnabled: true
+        onStarted: {
+            passwordWrite.write(root.pendingPassword + "\n");
+            // Held for as long as it takes to hand over, and no longer.
+            root.pendingPassword = "";
+            passwordWrite.stdinEnabled = false;
+        }
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+        onExited: root.pendingPassword = ""
+    }
+
+    Process {
+        id: mutation
+        // The helper answers with the fresh state, so the page updates from the
+        // mutation itself and never has to ask again.
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+    }
+}

config/local/share/vicinae/scripts/settings-sharing.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Generated by scripts/panama-settings-commands -- do not edit by hand.
+# @vicinae.schemaVersion 1
+# @vicinae.title Settings: Sharing
+# @vicinae.mode silent
+# @vicinae.icon ../../icons/hicolor/scalable/apps/panama-settings.svg
+# @vicinae.description Open Sharing in Settings.
+# @vicinae.keywords ["settings", "remote login", "remote desktop", "network name", "file sharing"]
+
+exec "$HOME/.config/quickshell/scripts/panama-action" settings-page sharing

config/local/share/vicinae/scripts/settings-users.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Generated by scripts/panama-settings-commands -- do not edit by hand.
+# @vicinae.schemaVersion 1
+# @vicinae.title Settings: Users
+# @vicinae.mode silent
+# @vicinae.icon ../../icons/hicolor/scalable/apps/panama-settings.svg
+# @vicinae.description Open Users in Settings.
+# @vicinae.keywords ["settings", "user account", "profile picture", "change password", "add a user", "automatic login", "administrator"]
+
+exec "$HOME/.config/quickshell/scripts/panama-action" settings-page users

tests/quickshell/kdeconnect-helper-contract.sh

@@ -13,13 +13,25 @@ helper="$project_root/config/dot/quickshell/scripts/panama-kdeconnect"
 [[ -x "$helper" ]] || fail 'helper is missing or not executable'
 
 status="$($helper status)"
+
+# The shape is checked whenever a device is present, but a device being present
+# is not itself required. kdeconnectd drops its device objects for a phone it
+# has not seen recently -- the pairing survives in its config, the D-Bus object
+# does not -- so demanding one makes this fail whenever the phone is off, out of
+# range, or simply has not opened the app today. That is the machine's state,
+# not a defect in the helper.
+jq -e '.available == true and (.devices | type == "array")' <<<"$status" >/dev/null \
+    || fail 'live status is not a readable device list'
+
+if [[ "$(jq -r '.devices | length' <<<"$status")" == "0" ]]; then
+    printf 'KDE Connect helper contract: PASS (no device visible to the daemon right now; shape checks skipped)\n'
+    exit 0
+fi
+
 jq -e '
-    .available == true and
-    (.devices | type == "array" and length >= 1) and
     ([.devices[] | (keys | sort) == (["actions", "id", "name", "paired", "reachable", "type"] | sort)] | all) and
     ([.devices[] | (.id | test("^[A-Fa-f0-9]{32,64}$"))] | all) and
-    ([.devices[].actions[] | . == "clipboard" or . == "ping" or . == "ring" or . == "share"] | all) and
+    ([.devices[].actions[] | . == "clipboard" or . == "ping" or . == "ring" or . == "share"] | all)
-    ([.devices[] | select(.paired)] | length >= 1)
 ' <<<"$status" >/dev/null || fail 'live status shape is invalid'
 
 paired_count="$(jq '[.devices[] | select(.paired)] | length' <<<"$status")"

tests/quickshell/sharing-contract.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+
+# The Sharing page must report what is true, and never claim a security
+# property it cannot back up.
+#
+# The two failures worth a test:
+#
+#   A service that is not installed shown as a switch. That is what the panel
+#   this replaces does, and the switch does nothing.
+#
+#   "Keys only" claimed for SSH when the configuration is silent. OpenSSH's
+#   default accepts passwords, so stating the stronger thing without evidence
+#   would tell someone their machine is safer than it is.
+#
+# Read-only: this reads service state and never enables or disables anything.
+
+set -uo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+helper="$repo_dir/config/dot/quickshell/scripts/panama-sharing"
+service="$repo_dir/config/dot/quickshell/services/Sharing.qml"
+page="$repo_dir/config/dot/quickshell/modules/settings/SharingPage.qml"
+
+fail() {
+    printf 'sharing contract: %s\n' "$1" >&2
+    exit 1
+}
+
+for path in "$helper" "$service" "$page"; do
+    [[ -r "$path" ]] || fail "missing $path"
+done
+[[ -x "$helper" ]] || fail 'panama-sharing is not executable'
+
+# ── The password-authentication claim is evidence-based ─────────────────────
+summary="$(sed -n '/function passwordLoginSummary/,/^    }/p' "$service")"
+[[ -n "$summary" ]] || fail 'the service does not summarize password sign-in'
+grep -q 'stated === ""' <<<"$summary" \
+    || fail 'the summary does not distinguish "configured" from "silent"'
+grep -qE 'system default' <<<"$summary" \
+    || fail 'a silent configuration is not reported as the system default'
+# "Keys only" may only be said when the file actually says no.
+keys_line="$(grep -n 'keys only' <<<"$summary" | head -1)"
+[[ -n "$keys_line" ]] || fail 'the summary never reports keys-only'
+grep -q 'toLowerCase() === "no"' <<<"$summary" \
+    || fail 'keys-only is claimed without checking what the configuration says'
+
+# ── Absent software is reported, not offered ────────────────────────────────
+grep -q 'is not installed' "$page" \
+    || fail 'the page does not say when the software for a row is missing'
+# A switch for a service that is not installed must be disabled.
+grep -q 'Sharing.remoteLogin?.installed === true' "$page" \
+    || fail 'the remote login switch is enabled regardless of whether SSH is installed'
+grep -q 'Sharing.remoteDesktop?.available === true' "$page" \
+    || fail 'the remote desktop switch is enabled regardless of whether it is available'
+
+# Turning on remote desktop without credentials would start a service nobody
+# can connect to; the page must require them first.
+grep -q 'hasCredentials === true' "$page" \
+    || fail 'remote desktop can be enabled with no credentials set'
+grep -q 'hasCredentials' "$helper" \
+    || fail 'the helper does not know whether credentials exist'
+grep -qiE 'grdctl.*(password|username)[^)]*\)' "$helper" \
+    && fail 'the helper passes remote desktop credentials on a command line'
+
+# ── Privilege boundaries ────────────────────────────────────────────────────
+# Remote login is system-wide and must go through a prompt; remote desktop is a
+# user service and must not ask for one.
+login_body="$(sed -n '/^def set_remote_login/,/^def /p' "$helper")"
+grep -q 'pkexec' <<<"$login_body" \
+    || fail 'changing a system-wide service does not ask for authorization'
+desktop_body="$(sed -n '/^def set_remote_desktop/,/^def /p' "$helper")"
+grep -q 'pkexec' <<<"$desktop_body" \
+    && fail 'a user service asks for administrator rights it does not need'
+grep -q '"--user"' <<<"$desktop_body" \
+    || fail 'remote desktop is not managed as a user service'
+
+# ── The snapshot reflects the machine ───────────────────────────────────────
+command -v jq >/dev/null 2>&1 || { printf 'sharing contract: SKIP (no jq)\n'; exit 0; }
+snapshot="$("$helper" snapshot 2>/dev/null)" || fail 'snapshot failed'
+jq -e '.hostname | length > 0' <<<"$snapshot" >/dev/null || fail 'no hostname reported'
+jq -e '.remoteLogin | has("installed") and has("active") and has("enabled")' <<<"$snapshot" >/dev/null \
+    || fail 'remote login state is incomplete'
+jq -e '.remoteDesktop | has("available") and has("hasCredentials")' <<<"$snapshot" >/dev/null \
+    || fail 'remote desktop state is incomplete'
+
+# Installed-ness must match what is actually on this machine, not a guess.
+expected_samba=$(command -v smbd >/dev/null 2>&1 && echo true || echo false)
+actual_samba="$(jq -r '.fileSharing.installed' <<<"$snapshot")"
+[[ "$expected_samba" == "$actual_samba" ]] \
+    || fail "file sharing reports installed=$actual_samba but smbd presence is $expected_samba"
+
+# No credential may appear in the snapshot.
+offenders="$(jq -r '[paths | map(tostring) | join(".")] | map(select(test("(password|secret|credential)$";"i"))) | join(", ")' <<<"$snapshot")"
+[[ -z "$offenders" ]] || fail "the snapshot carries credential-shaped fields: $offenders"
+
+printf 'sharing contract: PASS (remote login %s, remote desktop %s)\n' \
+    "$(jq -r 'if .remoteLogin.active then "on" else "off" end' <<<"$snapshot")" \
+    "$(jq -r 'if .remoteDesktop.active then "on" else "off" end' <<<"$snapshot")"

tests/quickshell/user-accounts-contract.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+
+# Managing a LOCAL user account (see online-accounts for the other kind).
+#
+# Managing an account must not leak the credential it sets, and must not let
+# someone lock themselves out of their own machine.
+#
+# Nothing here creates, deletes, or modifies a real account. It reads the
+# account state, which is safe, and exercises the refusals, which are the part
+# that has to hold.
+
+set -uo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+helper="$repo_dir/config/dot/quickshell/scripts/panama-users"
+service="$repo_dir/config/dot/quickshell/services/UserAccounts.qml"
+page="$repo_dir/config/dot/quickshell/modules/settings/UsersPage.qml"
+
+fail() {
+    printf 'user accounts contract: %s\n' "$1" >&2
+    exit 1
+}
+
+for path in "$helper" "$service" "$page"; do
+    [[ -r "$path" ]] || fail "missing $path"
+done
+[[ -x "$helper" ]] || fail 'panama-users is not executable'
+
+# ── A new password never reaches a command line ─────────────────────────────
+# argv is world-readable through /proc, so a password passed as an argument is
+# published to every process on the machine. It is read from stdin, and the
+# hashing step reads ITS stdin too, so the cleartext exists only inside these
+# two processes.
+password_body="$(sed -n '/^def set_password/,/^def /p' "$helper")"
+[[ -n "$password_body" ]] || fail 'set_password is missing'
+grep -q 'sys.stdin.buffer.read()' <<<"$password_body" \
+    || fail 'the new password is not read from stdin'
+grep -q 'input=secret' <<<"$password_body" \
+    || fail 'the password is not handed to the hashing tool on stdin'
+grep -qE '"openssl", "passwd"[^]]*secret' <<<"$password_body" \
+    && fail 'the password appears in the hashing command line'
+grep -qE '^\s*print\((secret|hashed)' <<<"$password_body" \
+    && fail 'the password or its hash is printed'
+
+# The service must not hold one either, beyond the moment it hands it over.
+grep -q 'stdinEnabled' "$service" \
+    || fail 'the service does not write the password over stdin'
+grep -qE 'command:.*set-password.*password' "$service" \
+    && fail 'the service puts the password in the command line'
+grep -q 'root.pendingPassword = ""' "$service" \
+    || fail 'the service never clears the password it was holding'
+
+# ── Refusals that keep a machine administrable ──────────────────────────────
+delete_body="$(sed -n '/^def delete_user/,/^def /p' "$helper")"
+grep -q 'You cannot delete the account you are signed in to' <<<"$delete_body" \
+    || fail 'the helper would delete the account running it'
+grep -q 'only administrator' <<<"$delete_body" \
+    || fail 'the helper would remove the last administrator, leaving nobody able to administer the machine'
+
+# The page must not offer to change the type of the only administrator either.
+grep -q 'administratorCount <= 1' "$page" \
+    || fail 'the page offers to demote the only administrator'
+
+# ── Deleting is confirmed, and says what it destroys ────────────────────────
+grep -q 'confirmingRemoval' "$page" \
+    || fail 'the page deletes an account without a confirmation step'
+grep -q 'This cannot be undone' "$page" \
+    || fail 'the page does not say that deleting an account destroys their files'
+
+# ── The snapshot is real, and reports no secrets ────────────────────────────
+command -v jq >/dev/null 2>&1 || { printf 'user accounts contract: SKIP (no jq)\n'; exit 0; }
+snapshot="$("$helper" snapshot 2>/dev/null)" || fail 'snapshot failed'
+jq -e '.users | type == "array" and length > 0' <<<"$snapshot" >/dev/null \
+    || fail 'no accounts were reported'
+jq -e '[.users[] | (.userName | length > 0)] | all' <<<"$snapshot" >/dev/null \
+    || fail 'an account has no user name'
+jq -e '.currentUser | length > 0' <<<"$snapshot" >/dev/null \
+    || fail 'the snapshot does not say which account is signed in'
+
+offenders="$(jq -r '[paths | map(tostring) | join(".")] | map(select(test("(password|secret|hash)$";"i"))) | join(", ")' <<<"$snapshot")"
+[[ -z "$offenders" ]] || fail "the snapshot carries credential-shaped fields: $offenders"
+
+# System accounts are not people and must not be offered for management.
+jq -e '[.users[] | .uid >= 1000] | all' <<<"$snapshot" >/dev/null \
+    || fail 'a system account is listed as a manageable user'
+
+# ── Input validation ────────────────────────────────────────────────────────
+for bad in "root; rm -rf /" "../escape" "UPPER" ""; do
+    result="$("$helper" set-real-name "$bad" "Test" 2>/dev/null | jq -r '.error // ""')"
+    [[ -n "$result" ]] || fail "the helper accepted \"$bad\" as a user name"
+done
+
+printf 'user accounts contract: PASS (%d account(s), credentials never on a command line)\n' \
+    "$(jq '.users | length' <<<"$snapshot")"