07db1068f17793090fd29932fc5ad15d4acaa24c
380
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Gabriel Brown
|
c148bae4ac |
Let Ethernet be switched off and on
Wi-Fi had a switch and wired did not, which left no way to take the cable down without reaching for nmcli -- and this machine has two interfaces on one subnet, so turning one off is a genuinely useful thing to be able to do. Both halves are needed to turn it off. Disconnecting alone survives the session but not a carrier event or a reboot, because NetworkManager brings an autoconnecting device straight back; the switch sets the device's autoconnect alongside it. The device property rather than the connection profile, so a toggle here does not quietly rewrite a saved connection somebody expects to come up at boot. The first version built a trap door. It decided whether the switch was usable from hasLink, which reads false while a device is merely disconnected even though NetworkManager still reports the carrier as on -- so turning Ethernet off made the switch disable itself, blame the cable, and offer no way back. A wired device that exists can always be asked to come up; if there is really no cable the attempt fails and says so, which is the honest failure. The word "off" is used where the old text guessed "no cable", because nothing available here can tell those apart. Verified as a round trip against the real device, including that off stays off through eight seconds rather than reconnecting a moment later, and that the mechanism tested is the one the code uses -- the first test drove the connection profile while the code drives the device, which are different things. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
4cbab01ae2 |
Show what has actually been installed
Automatic updates leave no other trace. The Flatpak that sat here as "1 update available" installed itself at 00:14 this morning and nothing on the machine would have said so. Both sources are asked in their own machine-readable form and merged on time, so the answer reads as one history rather than two lists to interleave by eye. Two parsing traps worth recording next to the code. flatpak's --json prints timestamps as "Aug 20 08:07:46" with no year in them, so the year is inferred and a date that would land in the future is read as last year's. And dnf5's start_time is epoch UTC while its own history table prints that same value as though it were local -- checked against rpm, and the local rendering here is the correct one. The contract asserts entries are newest first, that none is dated in the future, and that both sources parse; it was verified to fail by breaking the year inference so every flatpak entry landed tomorrow. Loaded on demand rather than with the page, because it reads both full transaction logs. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
de45f205ad |
Carry settings between machines by allow-list, not by stripping
panama-settings-backup already snapshots this machine so it can be put back exactly as it was, arrangement and all. This is the other thing: an export meant to travel, carrying the preferences that describe taste rather than hardware. The export is an allow-list read from the preference schema rather than a deny-list of things to remove. A key added later that happens to hold a token cannot leak into a file somebody emails to themselves; being wrong in this direction loses a setting, being wrong the other way publishes a secret. It earned that immediately -- this machine's store holds an orphaned shadowOffset from a setting that no longer exists anywhere in the source, and it was left behind without anyone having to know about it. Three settings stay: the display arrangement, which is keyed by output names that mean nothing elsewhere; the last page opened, which is session noise; and schemaVersion, which belongs to the store rather than to a person. Import is a merge, so settings a file does not mention are left alone, and it is idempotent. Two bugs made and caught here, in opposite directions. Validation missed 36 settings because "real" was spelled "float" and enums fell through entirely, so an out-of-range or nonsense value would have been written straight into the store. Correcting that then broke numeric enums -- vrrPolicy is an enum of 0..3 and the options were read with a regex that only matched quoted values, so those settings had no known choices, were declared unverifiable and were refused: valid settings dropped silently in transit. The contract could not see the second one. It checked only that bad values are refused, and when numeric enums were unreadable they never reached the bundle at all, so every "did it arrive" assertion was satisfied by their absence. It now requires the export to carry what it should as well as withhold what it should not, and was verified to fail in both directions. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
52e2a83a78 |
Add an SSH Keys page, and refuse the one control that would lie
The page shows which keys exist, what the agent is holding, and the hosts this machine has met, with a two-press forget for a host whose key has changed. Nothing here reads private key material. Fingerprints and comments come from the .pub file, and "does this key need a passphrase" is answered by asking ssh-keygen to derive the public half with an empty one -- it succeeds for an unencrypted key and fails for an encrypted one, and either way the only thing it can emit is public. The contract checks that against the payload that actually reaches the page rather than against the source, because what the code intends and what it ships are different claims. Unloading a key from the agent is refused, with its reason. On this desktop `ssh-add -d` prints "Identity removed" and the key is still offered a second later: gnome-keyring's agent lists every key it finds in ~/.ssh, so a removed one comes straight back off disk. That was measured rather than assumed -- a plain ssh-agent removes durably, this one does not -- and a button reporting success while changing nothing is worse than no button. The page says so and names the thing that does work: move the file out of ~/.ssh. SSH_AUTH_SOCK is not set in a normal shell here, so a naive check reports "no agent" while one is plainly running. The helper falls back to the keyring socket, and an agent started by hand still wins. That gap is the same one that made reaching these servers awkward in the first place. Generating a key is deliberately absent. A passphrase cannot reach ssh-keygen without going somewhere it should not -- -N puts it in argv, which every process on the machine can read -- and driving the prompt over a pty did not work. Offering to generate an unencrypted key instead would be a downgrade dressed as a feature, so the page does not offer to generate at all. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
79b3d5cb85 |
Close the sweep's last blind spot, and stop shortcuts silently colliding
gapsIn and gapsOut were the only two compositor settings the write sweep had never verified: Hyprland answers for them in CSS shorthand, "5 5 5 5", and the sweep had no way to compare that. The preference behind each is a single int that Hyprland expands to four sides, so a uniform reading compares exactly. A non-uniform one is not something the preference can express, and is skipped rather than collapsed to a number it never wrote. 63 of 63 verified live now, none skipped. Wallpaper thumbnails are cached. The report that five of them sat at "Loading…" was a screenshot taken 1.1 seconds after the page opened -- decoding one of these at tile size takes between 1.2 and 2.6 seconds and about ten start at once, which the code already said. Measuring it did turn up something real though: without a cache, scrolling back up pays that decode again for every tile. The tradeoff is a wallpaper replaced in place showing a stale thumbnail until restart, which is worth it for a directory of files that are added rather than edited. A chord already in use is now named rather than taken: "Super+Q is already Terminal". Two actions on one chord means whichever Hyprland reads last wins, which is not a thing to find out later by pressing it. Rebinding a shortcut to the chord it already holds is correctly not a conflict. Also: Open Appearance lands on the Windows tab now that the page has tabs, Storage points at reclaimable container space, and a dock row shows its desktop id only when two pinned applications share a name -- it is developer text, and repeating it under fifteen recognisable names made the list harder to scan. Written down because it cost the shell: QML has no default parameter values, and `function openSettings(page: string, section: string = "")` fails the entire configuration rather than the one function -- so the bar and dock went with it, and 43 contracts failed at once pointing at the same line. qmllint --bare passes that, which is why the usual check before touching the running shell did not catch it. openSettingsSection exists as a separate function for that reason. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
1b845c0126 |
Rebuild Home around what this desktop already knows
Home led with a diagram of the attached monitor -- DP-2, 4500 x 3000, 1.13x scale, XRGB2101010 -- which is Displays-page data, was the largest thing on the screen, and has never been needed there. Under it sat a permanently open search field for a weather location that is set about once a year, and then roughly half a page of nothing. It now opens with the two or three things somebody would open Home to do: starting or ending a focus session, Do Not Disturb, and what is running. The Do Not Disturb switch is disabled and says why while a mode is holding it, so it cannot appear to be a control that is being ignored. Findings sit above a reassurance line, the same shape the Firewall and Containers pages use. Each finding names the page that can resolve it, because a home page reporting a problem it cannot help with is only an alarm. On this machine that is one finding today -- PostgreSQL and Redis reachable from the network -- above "27 health checks pass, 522 GB free, snapshots ran at 02:00". "Do next" appears only when there is something in it. Weather stays, as the greeting's second line rather than a card with a search box open, and its picker is collapsed behind the current location. FocusModes was missing `import qs.config`, so DesktopPreferences was undefined and the modes list came back undefined with it -- shipped two commits ago with nothing noticing, because until Home referenced the service no isolated shell had ever instantiated it. Focus modes would have quietly had no modes. Pulling these services together on one page is what surfaced it. LocationPicker gained a picked signal, the same way DisplayModePicker did, so a container can put the search away without reaching into it. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
f53ca16392 |
Make the focus exception list real, or it was a page telling a lie
The mode data model shipped with an allow list and nothing that read it. The summary would say "2 apps may interrupt" while notification delivery never consulted the list and no editor could set it. That is the dead row this work has spent its time removing, introduced by the work itself. The banner gate consults the mode in force now, and the list can be edited from the applications that have actually sent a notification -- an exception for something that never notifies is not a choice worth offering. Exceptions belong to a mode. allowedApps is empty whenever no mode is active, so a Do Not Disturb switched on by hand stays absolute and nothing can leak into it. That scoping is asserted, not just written. Verifying this took three attempts, and the second was a real defect in the guard rather than in the code. The contract grep for FocusModes.allows matched the comment that explains it, so the check passed with the enforcement deleted. It matches the gate expression now. A guard a comment can satisfy is not a guard, and this is the third time prose has satisfied one here. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
6dc606b872 |
Give focus modes conditions rather than alarms, and let Gaming hand over
A mode is on because something is true right now: a game is running, a window is fullscreen on a given display, a workspace is focused, the clock is inside a window. That is asked again rather than fired once, and it is the whole reason schedules could be included here without the usual failure modes. A machine asleep at 23:30, rebooted at 02:00, or opened at 08:00 into a window that has already passed all reach the right answer by being asked again; an alarm gets all three wrong. The midnight-crossing rule is the part worth being careful about: a window belongs to the day it STARTS on, so a Friday-only 23:30-07:00 covers Saturday morning and must not cover Saturday night. That arithmetic was tested as pure logic before anything was built on it, including every malformed input failing closed -- silencing someone because a time string was wrong is the worst way this could fail. This does not take over the manual timed session. FocusSession already owns that, with its capsule, shortcut, Quick Settings entry and contracts, so modes defer entirely while one runs. Two writers of Do Not Disturb would each restore whatever the other happened to leave behind. Gaming hands over rather than being duplicated. The hook was silencing notifications itself, which would have made exactly those two owners -- and Gaming.active only polls while its settings page is open, so a mode could not have seen a game reliably in any case. The hook reports the game over IPC now and the mode decides what that means, the Gaming page points at it, and gamingSilenceNotifications is retired from the schema, since a setting nothing reads is the dead row this work keeps removing. Sleep ships disabled. A desktop that starts silencing someone on first boot has overstepped, whatever the default hour. Three contracts moved with it. gaming-contract asserted the hook uses setDnd, which was right before and wrong now; the shell-side assertions that setDnd and dndState exist stay, because a toggle would flip an already-silent machine back on. The new contract is proven to fail by breaking the midnight rule and by letting modes run alongside a manual session. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
32fab59d24 |
Let a sound device be heard, and the Dock's icons be sized
Nine outputs named after their chipsets cannot be told apart by reading, so each one gets a Test button that plays a short sample out of that device. Targeted by node name rather than by making it the default first, because finding out which is which should not move where everything else is playing. That belongs in its own service rather than in AudioDevices. sound-page-contract forbids Process, pactl and wpctl in the files that own device state, and it is right to: shelling out there races the PipeWire service that owns those same objects. Playback is a different thing -- pw-play opens its own stream and mutates no device, so there is nothing to race -- but the rule's letter covered it, and weakening a guard to fit a new case is how guards stop meaning anything. SoundTest exists so AudioDevices stays native bindings only. Worth recording next to the call: pw-play falls back to the default output for a target it cannot find, rather than failing. A stale node name would play from the wrong device and look exactly like a successful test, which is why the name is taken straight from the live node. The Dock's icon size was a constant in Theme. It goes through the preference schema like everything else, so validation, search, the generated docs and the write sweep all pick it up without being told about it separately -- and two contracts duly failed until docs/settings.md and the per-page commands were regenerated. Dock position is deliberately not here. It is not a setting but a rework: the dock is anchored bottom, and the reveal strip, tooltip placement, intellihide and the qs-dock rule in hypr/rules.lua all assume that. Doing it properly means changing compositor rules on a machine somebody uses daily, which is not something to start as a side effect of adding a slider. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
f6b970da21 |
Turn the rows that only reported things into controls
Autostart entries showed "Enabled" or "Disabled" as plain text. The row did toggle on click the whole time, so this is an affordance rather than a missing capability -- but a control that reads as static text is one nobody knows they have. It is a switch now, with removal alongside it behind a confirmation: disabling writes Hidden=true and can be undone, deleting the file cannot. remove-autostart is confined to files the autostart directory owns. It resolves the path and compares the parent, so a name like "../../.bashrc" cannot escape, and it refuses symlinks rather than following them -- deleting through one would remove whatever it points at, which is somewhere else and not ours. Each refusal was tested against a fixture directory, including a symlink aimed at /etc/hostname, which survived. Sharing says who is signed in from another machine: user, origin and since when. An empty list on this machine proves nothing, so the parser was checked against sample `who` output -- it picks out remote sessions and leaves out local seats and the :0 display, which would otherwise report the person at the keyboard as a remote login. Media sharing was "Available" and nothing else: rygel installed, rygel.service disabled, no way to change that from here. It is a switch now, and it says what it does before you touch it rather than afterwards -- turning it on publishes media folders to every device on the network with no password in front of them. Per-application camera and microphone permissions come from the portal's permission store, which is where an application that asked through the portal has its answer recorded. The page states the limit plainly instead of implying a protection that does not exist: a program installed outside the portal opens the device directly and nothing here stands in its way. Anything that is not an explicit "yes" is treated as withheld, because guessing generously about a camera is the wrong way to be wrong. The first version of the write silently did nothing -- SetPermission takes an array of strings and was being handed one string -- and the test did not notice, because it discarded the helper's output and only checked that state was unchanged afterwards, which was trivially true. The contract now requires the value to move, and was proven to fail by putting that exact bug back. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
7e1c85b094 |
Group the long pages by what you are trying to do
Notifications repeated both lock-screen switch labels for every application, so twenty apps meant sixty rows of the same two sentences and the page could not be scanned at all. Each app is one row now, carrying what its switches add up to -- "On, lock screen shows the sender only", "On, hidden on the lock screen", "Notifications off" -- with the switches behind it, one app open at a time. The identifier only appears while an app is open, which is the only time it disambiguates anything, and the content switch dims when the app cannot reach the lock screen at all, because there it means nothing. Shortcuts were already grouped; the problem was that "Windows" caught focus, movement, splitting, resizing and window state alike and held 43 of the 93 binds. A section that long is a list, not a grouping. They are separated by intent now -- Focus, Move & split, Size, Window state -- and the split was checked against the binds this machine actually has rather than trusted from the keywords. Order matters in two places worth naming: "Next window splits down" is about splitting rather than focus, and "Focus session" is quiet mode bound to a workspace rather than window focus, so both are settled before the general checks. Refresh rate gets its own row. That need was created by collapsing the resolution list: the rates for a resolution were only ever reachable by opening it, so changing nothing but the rate meant going through the mode you already had. It appears only when the current resolution offers more than one. Default-application rows carry a chevron, having previously opened a chooser while looking completely inert. The notification contract asserted the literal Notifs.appRule(app.id).enabled, which moved when the rows collapsed. The rule is still read through a binding on Notifs.appRule, so a rule changed elsewhere still reaches the row -- the assertion now requires that, rather than requiring one particular spelling of it. The power profile rows were left alone. A three-way choice in three rows looks wasteful until you notice each row explains what the profile does, and that page has empty space to spare; a segmented control would trade information for space that is not scarce. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
0c364f38e6 |
Stop sending people to GNOME for pages this app already has
Panama absorbed Users, Sharing, Printers and Online Accounts one page at a time. Each time, the row pointing at GNOME's equivalent stayed exactly where it was -- so an app whose stated purpose is to make GNOME Settings unnecessary shipped four doors back to it, two of them inside a card headed "these areas remain owned by Fedora and GNOME's mature system panels". Nothing failed. Every row worked as written. They were simply no longer true, and no test could notice, because none of them knew what Panama had come to own in the meantime. gnome-handoff-contract reads the sidebar for the pages that exist and the pages for the panels they hand off, and fails on any overlap -- derived from both sides rather than a hand-kept list, so absorbing the next page cannot leave a stale door behind. Adding an online account is allow-listed with its reason: it genuinely requires GOA's own dialog. health-ui-contract asserted those handoffs were present, which is how they survived. The assertion is inverted rather than deleted, so reintroducing one fails loudly. The Home Assistant "Light entities" box is gone. It was a multi-line list of comma-separated Zigbee entity IDs, and the light catalog does not come from it -- the helper discovers that live. It is a one-time migration seed for the Control Center selection, so saving now passes the stored value back untouched: setting a URL or a token cannot disturb it. Deleting the control naively would have written an empty list over it. Sharing showed two "Port" rows for RDP, same label and value, one read-only and one editable, separated by a switch. The read-only leftover is gone. The SSH port stays read-only because sshd's port is not ours to write. About reported "488G free of 1.9T" where Storage said "523 GB free of 2.0 TB" -- the same drive, binary against decimal. About uses decimal now, matching how drives are sold. Memory and swap stay in GiB, which is how RAM is sold. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
1aa1324083 |
Lead Appearance with light and dark, and stop pages listing whole datasets
Appearance was six cards deep and Light/Dark was the third of them, below the wallpaper grid and the entire lock screen -- so the control reached most often was the last one you got to. It is five tabs now, Theme first. The mock showed four; the page turned out to have eleven cards, so Titlebars and Windows became Windows, and Clock and vitals became Shell, rather than pretending four would hold them. Region, Date & Time and Displays each rendered a complete dataset as rows: every installed locale, the whole tz database, every mode the monitor advertises. The chooser was never the problem -- SearchPicker already existed and worked. It was simply rendered always-expanded, so the one line saying what is currently set sat under hundreds that were not. PickerRow collapses each behind its current value and closes again once something is picked. The avatar never appeared to change because accountsservice writes every picture to the same path, leaving the URL byte-identical while Qt served its cached image. cache:false was already set and could not have helped: an unchanged source is never re-read at all. avatarUrl now carries a revision fragment, bumped only when a write actually succeeds. Pictures are cropped before they are set, in the picture's own pixel coordinates so the result does not depend on the size it happened to be displayed at, and written out at 512x512 through GdkPixbuf -- already a dependency here, so nothing new is required. Snapshots listed nothing. The timeline and its Delete buttons existed the whole time, behind a row labelled "Browse...", a word that promises a file browser. The three most recent points are shown inline now, with the rest one press away. qmldir-registration-contract exists because an unregistered component is not a quiet problem: Quickshell fails the entire configuration on it, so the settings window dies and the bar and dock go with it. That happened twice while writing this, both times on a machine somebody was using. It is pure file inspection, so it runs before a change ever reaches the running shell. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
ac5e6e2130 |
Add a Containers page, grouped by project and led by what is exposed
Every container on this machine is created by rootless podman-compose and
labelled with the project it belongs to, so the grouping is read from the
labels rather than invented. State then decides prominence within that
grouping -- running containers get rows, stopped ones collapse to a line --
which is why neither axis had to be chosen over the other.
Acting on a stack uses plain podman over the labelled set, never
`podman-compose down`, which would remove containers this shell did not
create. The compose file is the source of truth for what exists and belongs
to the repository. Nothing here needs privilege.
The findings on top are the crossing the Firewall page reports, seen from the
side that can close it: the firewall knows only that something is listening,
while this page knows which container, which compose file, and which token is
missing from it. So `bind-local` prepends a loopback address and leaves the
line byte-for-byte -- variables, quoting and style intact -- then re-parses and
rolls back unless exactly those ports moved. It refuses anything ambiguous
rather than guessing. Rewriting the mapping to the port podman reports today
would have deleted the ${POSTGRES_PORT} indirection that makes it
configurable at all.
Unused volumes are read from podman's own dangling filter. The first version
used MountCount, which is a runtime lock counter and not a usage signal: it
reads zero for a volume a running container has mounted this second, so
"remove unused volumes" offered to delete the live Command Center database.
The cross-check against `podman system df` is what exposed it. The contract
reintroduces that bug deliberately and fails if the guard does not catch it,
because a guard nobody has seen fail proves nothing.
Every mutation in the contract runs against a stubbed podman. Nothing in the
suite starts, stops or removes a real container, image or volume.
Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L
|
||
|
Gabriel Brown
|
536958430f |
Fix the polkit unit's ignored rate limit
systemd logged "Unknown key 'StartLimitIntervalSec'" on every start: rate limiting belongs in [Unit], not [Service], so both keys were ignored and the restart limit they were meant to impose did not exist. An agent that failed repeatedly would have flapped rather than stopping. Found while investigating reported prompt failures, which turned out not to be a defect: the trace showed both authentications succeeding on the first attempt. The failures came from testing -- prompts raised by background pkexec runs and then cancelled seconds later, while someone was trying to type into them. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
fd99569666 |
Add a Firewall page, led by what is actually reachable
Listing zones and services is what firewall-cmd already does. The question it does not answer needs both halves at once: a port is reachable only when something is LISTENING on a network address AND the firewall permits it. On this machine that crossing is the whole story. The rules look unremarkable -- one zone, three services, a port range -- and what they mean is that PostgreSQL and Redis, published by rootless containers on every interface, are reachable by anyone on the network. Neither half says that alone, which is exactly how a tidy rules list coexists with an open database. Nothing was misconfigured: Fedora's default zone met podman's default publish behaviour. Ephemeral client sockets are excluded. A browser's outbound UDP port is indistinguishable from a service in ss, and listing twenty of them buried the two rows that mattered. Closing the port range names what it would cut off, by service, before doing it, and removing ssh says so when someone is connected over it. Rich rules are shown and never edited: a syntax is not a setting, but hiding it would misrepresent the configuration. The contract needed a recorded firewall, and the reason is worth keeping. The rule this page exists for cannot be tested against this machine -- its zone permits everything above 1024, so "listening" and "listening and permitted" give identical answers, and a blocked listener needs a port below 1024, which needs root. With the crossing deleted, the contract passed. It now runs against a fixture where two listeners are blocked, and catches it. Also here: polkit response files are written 0600 rather than at the default mask, the agent sweeps requests left by an instance that did not exit cleanly, and the write sweep waits for its harness to be ready instead of reporting the startup race as settings that failed. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
a412e3d894 |
Fix the compositor write contract properly, not by waiting longer
Widening its waits earlier treated the symptom. It still failed about one run in three, on an idle machine, taking eighteen seconds to do so -- which was the clue: nothing was in flight to wait for. SystemSettings verifies each write before storing it and serializes overlapping ones, so the restore arriving while the previous batch was still settling was being dropped outright. Waiting longer for a write that was never queued cannot help. It is issued up to three times now, and the run where a retry fires visibly takes eight seconds instead of two. Retrying cannot hide a broken write path: with the write stubbed out the contract still reports exactly which policy failed to reach the compositor. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
4cbe3b882a |
Add a Gaming page, and let the desktop react to games
Live first, because unlike every other page here this one has a live dimension: card temperature, power draw, whether Game Mode actually engaged. It polls only while it is open, since a settings page nobody is looking at has no business waking the CPU. The part that makes it Panama's page rather than a gamemode config editor is the hook. gamemode runs a script when a game asks for it and another when the game exits, so the power profile switches to performance and notifications go quiet for exactly the duration of a game -- and afterwards both go back to what they WERE, not to a default. A Do Not Disturb someone set by hand survives a game; a power profile someone chose is restored rather than replaced. Verified against real gamemode activation, not merely by calling the hook. Two things the page reports rather than hides. Game Mode's headline trick is switching the CPU governor to performance, and this machine already runs performance, so it says so instead of implying it helps. And Proton builds are listed but never chosen: Steam picks the runtime per game, and a control here would claim an authority this page does not have. The hook first called a notifications function that did not exist, and the one that did was a TOGGLE -- the wrong primitive entirely, since toggling at game start would unsilence notifications that were already silent. The shell gained an explicit setter and reader. search-routing-contract kept its own hand-written list of every page, which made adding one fail as "not a known page" -- a sixth place to register a page and a sixth chance to forget. It now derives the mapping from the shell, which already knows it. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
edc504af2e |
Drop the self-hosted integration batch, and say why
The machine runs essentially every popular self-hosted service, and on looking at them the batch was revised once and then dropped. Almost all of it is infrastructure for other services rather than anything a desktop consumes -- whisper there feeds Bazarr subtitles, not dictation here -- the desktop has the better GPU anyway, and the one genuinely desktop-shaped idea is already solved by an installed application. Recorded rather than deleted so it is not proposed again, with the lesson that matters: a service existing is not a reason to integrate it. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
a15f019c17 |
Offer automatic package downloads, now that the machinery is installed
The page had a row for the case where dnf-automatic is absent and nothing for the case where it is present, so installing it made the setting disappear rather than appear. The switch enables downloading only, which is the shipped default and the right one to keep: a machine that installs packages unattended can reboot into a kernel nobody chose. Downloading ahead of time is what makes the install quick when someone does choose it, and the row says exactly that rather than implying updates apply themselves. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
116510caa8 |
Draw the authentication prompt ourselves
hyprpolkitagent's dialog is compiled into its binary -- no config, no stylesheet, nothing to theme -- and it was the one window on this desktop that looked like it belonged to something else. The split between the two halves is the security design, not an implementation detail. A small agent process owns the D-Bus side: it registers with polkitd, receives the request, and hands the shell the action, the message, who may answer, and a one-time cookie. It never sees a password. The shell draws the prompt and, on submit, spawns the setuid polkit-agent-helper-1 itself and writes the password to that helper's stdin; the helper runs the PAM conversation and reports to polkitd directly. The password exists in the shell and in the helper's stdin and nowhere else -- never on a command line, never over D-Bus, never through IPC arguments. The prompt takes exclusive keyboard focus, because a password field that lets keystrokes reach the window behind it is a keylogger with extra steps. The request travels as a file created 0600 with O_EXCL inside a 0700 runtime directory: a cookie is not a password, but it is a capability, and capabilities do not belong in a process listing either. Three things cost real time. polkitd calls back on the same connection that registered, so exporting the object on the session bus while registering from the system bus failed every request as "Not authorized" with no error anywhere. XDG_SESSION_ID is absent in a systemd user unit, which runs under [email protected] and belongs to no login session, so the session comes from logind's Display property instead. And PyGObject does not accept the @ placeholder in variant format strings. hyprpolkitagent stays installed as the fallback, only one agent is started, and the comment beside the autostart says how to get the stock prompt back. Verified end to end, including a real password accepted and three cancellations refused. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
b10f8e2593 |
Stop the compositor write contract failing under load
It passed alone in two seconds and failed in a full suite run at six, which is the worst way for a test to be wrong: the code was fine and the report said otherwise. Each of its waits polls until the compositor reflects a write, and four seconds was enough on an idle machine and not enough on a busy one. They are fifteen now. A longer bound cannot mask a dead write, because a write that never lands never matches -- verified by stubbing the write path out and watching it still report exactly which policy failed. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
8f0fe23377 |
Add Software Update, across packages, applications and firmware
Three sources that fail independently, so they are counted and applied separately: a flatpak mirror being down says nothing about whether a kernel security fix is waiting. Blending them into one number would hide exactly the case that matters. Checking costs about nine seconds, which is too long to spend every time a page opens, so the page opens on the last result and says when it was taken. A first visit with nothing cached goes and finds out rather than showing a confident "up to date" it has no basis for. Installing packages takes a snapshot first, named after what is about to happen, so Snapshots shows "before 32 package updates" rather than a timestamp. Best effort: a machine without snapper still updates, because an update that refuses to run when a nicety fails would be worse than one without a restore point. Automatic updates cover applications only, through a Panama-owned user timer running daily with a randomized delay. Packages still ask, and dnf-automatic is reported as absent rather than offered, because installing software is not a settings action. Health gained a check, and that is where the bug was: it first returned status "degraded", which is not in the doctor's vocabulary of ok, warning, error and unconfigured. It was counted as nothing at all while the summary still said healthy -- the same silent no-op this codebase keeps relearning. A contract now asserts every status a check can return is one the doctor counts, and the doctor's own contract knows about the new check rather than failing on its arrival. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
89cf0f8c29 |
Plan the settings work beyond GNOME parity
Parity is done except for Color, which the platform blocks. This is the other direction: what a settings application should own on a machine whose owner runs the servers. Every item was checked against this machine before being written down, including the one that was dropped -- a VPN page, because the WireGuard tunnel lives on the router and neither wg nor tailscale is installed here, so it would have had nothing to drive. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
e290a262f3 |
Make notifications legible, and follow windows that ask for focus
The notification background was a 6% foreground tint over a transparent window, which meant it had nothing behind it at all: the card sat directly on whatever was on screen and the text competed with it. Notifications are the one surface someone reads without having chosen to look at it, so it now uses a real popover surface -- a little lighter than one you opened deliberately, because a toast arrives unbidden and full popover weight reads as a dialog demanding an answer. Windows that ask for attention are now switched to rather than merely highlighted, so a link opening on another workspace takes you there. That setting already existed and was simply off; it is a preference rather than a hardcoded behaviour, so it can be turned back off on the Desktop & Dock page. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
6997dd535f |
Add high contrast, and make remote desktop configurable
Two of the three panels still handed to GNOME, having actually checked each rather than repeating that they were not worth owning. Universal Access turned out to be mostly ours already: the magnifier, pointer size, text scale, motion and dimming were all present. High contrast was the real gap. It reaches GTK4 applications through the desktop portal, which republishes GNOME's accessibility setting as org.freedesktop.appearance contrast -- so no high-contrast theme is involved, and none is installed here. Verified end to end: committing the preference drove gsettings and the portal reported contrast 1. Sticky, slow and bounce keys stay absent. There is no Wayland or Hyprland implementation, and the compositor would store the XKB option while nothing ever acted on it. Remote desktop gained port, view-only, and clearing stored credentials. SETTING credentials opens a terminal running grdctl, which prompts for the password itself. That is not a hand-off for lack of effort: grdctl takes the password on a terminal and core-dumps without one, and the only alternative -- passing it as an argument -- would publish it through /proc to every process on this machine. Typed into grdctl directly it never passes through Panama, and a contract now fails if it ever appears on a command line. Color stays with GNOME, and not for lack of effort either. colord runs here with seven profiles and zero devices registered, because the daemons that register displays do not run under this session, and Hyprland exposes no ICC, gamma, or color-management option at all. A Color page could import a profile, attach it to nothing, and change nothing -- the same failure refused for rollback and printer drivers. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
1f40f8e136 |
Add a snapshot manager, and start covering home
The machine already had snapper running hourly on btrfs, so the tool was never missing. What was missing is that snapper's only configuration covered / -- and /home is a separate subvolume with no configuration at all. Six hundred and forty-three snapshots existed and not one of them contained a document. Anyone reaching for file history would have found their system and none of their files. /home now has a configuration on the same hourly timeline, with deliberately conservative retention: Steam's 1.2 TB lives on that subvolume and churns on every game update, so keeping five hourly and seven daily bounds what those updates can pin. Per volume, because on this machine "one is covered and the important one is not" was the news, and a timeline opening on system snapshots would have buried it. Inside a volume the timeline is the familiar view: points in time, newest first, each openable as a folder tree to take a file out of. Restoring sets the current version aside as .before-restore-N rather than overwriting it. A restore that destroys the thing you were about to compare against is how someone loses the work they were trying to save. Rollback is deliberately absent. snapper's rollback changes the btrfs default subvolume, and this system's fstab pins subvol= explicitly, which overrides it -- so a rollback would report success and change nothing after a reboot. A recovery feature that silently does nothing is worse than not having one, and making it work means editing fstab and the bootloader, whose failure cannot be repaired from inside the desktop. Per-snapshot size is reported as not measured, because measuring it needs btrfs quotas that cost performance on every write. Free space is shown instead, which is the number that decides anything. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
e9d567aa72 |
Own printers, driverless only
The fourth panel this desktop handed to GNOME Settings, and the last one worth owning. Driverless only, deliberately. Adding a printer that describes its own capabilities over IPP is supported; choosing a PPD or fetching a vendor driver is not, and the page says so rather than pretending. That restraint is the whole design: a wrong driver produces a printer that accepts jobs, reports success, and prints nothing, which is the worst failure this page could ship because it looks like it worked. A printer old enough to need a PPD stays a job for the system printer tool. Printers and the queue are separate cards because they answer separate questions. Which printers exist is one; where a document went is the other, and it is the one that actually brings someone here -- so the queue is a single list across every printer. Device URIs are validated by scheme before reaching CUPS, whose backends run as root. file: and pipe: do not lead to a printer and are refused here rather than further down. This machine has no printer, so the page was built against a temporary CUPS queue that was created, exercised through the service, and removed; the service was confirmed to observe the removal rather than merely perform it. Discovery and the driverless add path are verified by their refusals rather than against hardware. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
914d58f52b |
Record which GNOME panels are owned and which are not
Which panels we own is a question that otherwise gets answered one panel at a time, and forgotten between them. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
a23b42841a |
Own user accounts and sharing
Two of the panels this desktop still handed to GNOME Settings. Users manages the account through accountsservice -- the same daemon GNOME's panel drives, so a name or picture set here is what the login screen and lock screen read. Name, picture, account type, password, automatic login, and adding or removing other accounts. Every change is authorized by polkit through the agent this session already runs; a dismissed prompt is a normal outcome and says so. A new password is read from the helper's stdin, hashed by openssl reading its own stdin, and handed over D-Bus from inside that process. It is never an argument: argv is world-readable through /proc, so a password passed that way is published to every process on the machine. Removing an account takes two presses and says it destroys their files; the last administrator cannot be removed or demoted, because a machine nobody can administer is not a state to offer. Sharing reports what is actually true, including "the software for this is not installed" -- the honest answer for Samba here, and the case the panel it replaces shows as a switch that does nothing. Password sign-in is reported from sshd's configuration rather than assumed: claiming "keys only" when the file is silent would state a security property that cannot be backed up. The Control Center now draws the account's real picture and name. A generic glyph sat there while a real avatar was already set, which made the desktop look like it did not know whose it was. Also here: the KDE Connect contract no longer requires a phone to be awake. kdeconnectd drops its device objects for a phone it has not seen recently while the pairing survives in its config, so demanding one failed whenever the phone was off. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
e0c0e53ae0 |
Say what the sweep helper is, when run on its own
A suite runner walking the tests directory executes it with no arguments and gets an IndexError, which reads as a failing test rather than a helper being used wrongly. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
180308135a |
Verify every setting actually does something
The audit that followed "some things in the settings app don't work". Sixty-five settings reach the compositor and five of them were checked against it. The rest were covered only by tests that read source text, which is exactly where a dead setting hides: the write no-ops, nothing fails, nothing logs, and the row simply does nothing. The sweep drives each setting through SystemSettings.commitPreference -- the entry point a settings row uses -- flips it to a value it does not hold, reads it back from the live compositor, and puts it straight back before touching the next one. Settings Panama stores itself get the same treatment against the store, since a value that fails to persist is the same dead row from the outside. Result: 61 of 63 compositor settings verified against the running compositor, and 51 stored settings round-tripped. No failures. The breakage was confined to the Applications page, which is fixed. Proven able to fail before being trusted: with commitPreference stubbed to return true without applying, 61 settings are reported; with the store stubbed to return nothing, 51 are. A one-second settle window keeps a slow read from being reported as a dead write, which it briefly was. Also here: control-center-contract asserted the literal margin expression that made the panel hang 38 pixels below the bar, so the contract and the code agreed and the bug was invisible to both. And settings-page-registry-contract is deleted -- settings-nav-contract already checked those files and more. It would have caught the Storage page omission if I had run the suite instead of a hand-picked subset. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
b743f44c5b |
Make changing a default application actually take effect
Three bugs, all silent, all in the same feature. The write always worked. What failed was the refresh after it. That refresh is called from the mutation's own onExited handler and was guarded on `busy`, a binding over both processes -- and a binding hands back its cached value until the change notification feeding it has been delivered, which inside that handler has not happened yet. So `busy` read true, refresh returned immediately, and the page kept showing the old application with no error anywhere. Guards now read the Process objects directly, where the value is current, and a refresh is no longer blocked by the mutation that asked for it. The service also kept its own list of which roles it would accept. It stayed at seven when the helper and the page grew documents, text and archives, so choosing a PDF viewer set an error and changed nothing. It is derived from the snapshot now. And category matching never worked. DesktopEntries returns a QML list, for which Array.isArray is false, so the code stringified it into "Network,WebBrowser" and split on ";" alone -- one token matching no category. Browsers still appeared because their generic name contains "web browser" and the terms fallback carried the role by itself. Archives matched nothing at all, so that row could only ever offer the application it already had. The harness that should have caught the first bug passed while it was live: it set each role to the value it already had and asserted no error appeared, and the bug produces no error. It now changes a role to a genuinely different application, requires the service to observe the new value, and changes it back -- with the contract restoring the original from the outside however the run ends. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
2528edfddc |
Stop every popover double-counting the bar height
The control center fix applies to five more surfaces: the date menu, the clipboard panel, the activity panel, notification toasts, and the signal glass all opened 48 pixels under the bar while their own expression asked for 12. wlr-layer-shell has three behaviors and only the middle one is subtle. A positive exclusiveZone reserves space; a negative one ignores what others reserved; zero reserves nothing but RESPECTS what others reserved. Every popover here uses zero, so the compositor had already placed them below the bar before their own margin applied, and adding Theme.barHeight counted the bar twice. It is not a crash or a warning -- the surface simply opens lower than written -- so a contract now holds the rule mechanically: a surface with exclusiveZone 0 may not name Theme.barHeight in a margin. It also checks the premise it rests on, and fails if the bar ever stops reserving its own height rather than quietly checking the wrong thing. Measured after: date menu and clipboard at 12px, control center at 2px, each matching what its code asks for. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
dbd1472e6b |
Read busctl as JSON so device names keep their characters
A phone named "Gib's iPhone" with a typographic apostrophe was shown as "Gib\342\200\231s iPhone". busctl's default text output escapes every non-ASCII byte in octal, and escapes it into the output rather than into a quoted string a shell-style parser can undo, so shlex handed back the escape sequences as literal characters and they went straight to the page. Apostrophes were only the visible case: accents, emoji, quotes and backslashes were all affected, and a name containing a quote could have split a field. Property and method reads now use --json=short, which returns real UTF-8, and the parsers read a document rather than splitting words. That removes the class rather than unescaping octal by hand. The fixtures were the reason this stayed invisible: every test fed the text form and passed against output the helper is no longer asking for. They now carry what busctl actually emits in the mode used, plus a case for a non-ASCII name and one asserting the old text form is refused rather than parsed wrongly. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
eeb49c5aff |
Hang the control center under the bar instead of below it
The panel opened 38 pixels beneath the bar while its own comment said two. margins.top added Theme.barHeight to the gap, but an exclusiveZone of 0 means "reserve nothing, respect what others reserved" -- so the surface already began below the bar's 36px zone and the bar height was counted twice. The margin is now the gap alone, which also means the panel follows the bar: if the bar ever stops reserving space, this closes up against the top edge rather than hanging under nothing. Measured before and after against hyprctl layers: bar bottom at y=36, panel top from y=74 to y=38. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
8e93f08977 |
Show what the keyring holds, without showing what it holds
Managing a stored credential meant installing Seahorse. The keyring rows on Privacy could say whether it was locked and nothing about what was in it. Four rules, each pinned by a contract, because each is a way this could leak the thing it exists to protect: Listing never reads values. Enumerating reports labels and attributes; it does not ask the keyring to hand over what it is protecting. A secret never reaches a command line. /proc makes argv readable by every process on this machine, so a password passed as an argument is published to all of them. The helper reads the value in process and writes it to wl-copy on stdin. A secret never reaches an error message, a log, or a QML property. An exception raised while holding a password does not get to choose what text is printed, so the clipboard tool's stderr is discarded rather than echoed. Forgetting one is irreversible, so the first press asks and the second does it, and the confirming button is the only one wearing danger. The list is collapsed until asked for: opening Privacy should not enumerate someone's passwords as a side effect. A copied value clears itself about a minute later, but only if the clipboard still holds it -- the guard compares a SHA-256, so the waiting process never has the password. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
99433c0e8e |
Add a Storage page
Nothing showed what was using the drive, and removable media was handled by a tray helper with no surface in Settings at all. One scroll rather than tabs: space above, the device below. Every other settings page is a scrolling card stack, and a tab would not be deep-linkable from the launcher command or from search. Three things the page has to get right, each now pinned by a contract, because each is a way it could quietly lie. / and /home are one btrfs filesystem sharing one pool of free space, and a page that copies df shows double the free space that exists. zram is a block device and is not storage; counting it as a drive overstates this machine by 8 GB. Unmount and eject refuse anything not on a removable drive, because the UI is what asks and a UI can be wrong. The cheap read -- layout, usage, health -- runs when the page opens, at around 90ms. Measuring what is filling the drive means walking every file, so it happens on request and says so rather than showing an empty list that reads as "nothing here". Partitioning and formatting are deliberately absent. A settings pane is the wrong place to put erasing a disk two clicks deep; the page opens GNOME Disks for that. Adding the page found a fourth hard-coded page list in ShellState. A page missing from it does not error -- openSettings() falls back to "home", so the launcher opens the wrong page and logs nothing. A registry contract now holds the three lists together. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
a68e4f6dcd |
Make every settings page reachable from the launcher
Settings had a search index and the launcher had script commands, and neither knew about the other: finding a setting meant opening Settings first and searching there. One command per page is now generated from the same sources the in-app search reads -- the sidebar page list, the group routing, and the schema labels -- so a setting searchable inside Settings is searchable from the launcher without a second list to maintain. Generating it surfaced a gap in the in-app search as well. Six pages had no vocabulary at all, because their contents come from the system rather than our schema, so searching "volume" found nothing in Settings either. They now carry entries, which improves both surfaces. The product prefix is dropped from every hand-written command title. The generated ones are qualified "Settings: <page>" instead: a bare page label collides with the feature of the same name, and two commands sharing a title are indistinguishable in a launcher. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
2b3b762793 |
Install what the default-application roles are curated to
Seeding is deliberately conservative: a role whose preferred applications are all missing is left alone rather than forced. That is right, and it is also silent -- so a curated handler nobody installs presents as the machine quietly going back to deciding defaults by installation order, which is the problem seeding exists to fix. None of Loupe, Papers, Decibels, Nautilus, mpv or sushi was declared anywhere. Preview works, on org.gnome.NautilusPreviewer2 rather than the interface its bus name suggests, but it opened tiled -- shoving the file manager aside for something meant to be an overlay -- so it gets a float and center rule sized to leave the file underneath visible. xdg-utils and desktop-file-utils were undeclared too; seeding from link-dotfiles started calling them, and the dependency contract said so. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
91306ce810 |
Give libadwaita applications the desktop's accent
Files, Papers, Loupe and every other libadwaita application read their accent from the Settings portal, so they rendered in GNOME blue no matter which accent this desktop was set to -- correct on our own surfaces, wrong on half the screen. xdg-desktop-portal-gtk cannot serve org.freedesktop.appearance accent-color at all; the string does not appear in the 1.15.3 binary. The gnome backend serves it, so Settings now routes to gnome with gtk still listed behind it -- the frontend merges Settings backends in order, so color-scheme keeps resolving if the gnome backend is ever unavailable. GNOME's accent-color is a fixed enum of nine names rather than a color, so each of our eight accents carries its nearest member. Nearest by hue rather than by name: rose maps to red, because it is the red role in this palette. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
1b94af1163 |
Plan the desktop integration work
Six areas an OS is expected to own that this desktop still delegates: preview, GTK accent cohesion, storage, launcher search, secrets, and backups. Ordered so each is useful the day it lands. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
b4ce148caf |
Give each default-application role a whole family of types
Every role carried a single representative type, so setting "Images" changed image/png and left image/jpeg wherever it landed. That is how this desktop ended up opening PDFs in GIMP, PNGs in a pixel-art editor and MP3s in a video transcoder: nobody chose any of it, applications registered themselves for everything they could read, and the roles governed one type each. Roles now own families and write every type when set, the settings page exposes the documents, text and archives roles it never offered, and a new seed command curates a fresh machine during setup while always keeping a choice the user has already made. The shipped editor entry launches kitty explicitly. The stock nvim.desktop sets Terminal=true, which defers to whatever the system considers default rather than the terminal this desktop themes. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
2fcaada7e8 |
Snapshot automatically before restoring defaults
Restoring defaults clears every preference and the Home accessory store, and nothing in the app can undo it. Snapshots existed but were entirely manual, so the one irreversible action Panama offers was also the one with no safety net. It now snapshots first. Not fatal if that fails: someone who asked to reset gets their reset, and a snapshot that could not be written is reported rather than allowed to block what they asked for. The wiring is inverted deliberately. SettingsBackup already references SystemSettings, so referencing it back would make two singletons depend on each other, which is an initialisation-order problem waiting to happen. Instead SystemSettings exposes a seam defaulting to a no-op and SettingsBackup installs itself into it at startup -- the same shape as the seams the reset path already uses for test isolation. The contract asserts the snapshot is FIRST in the call sequence, not merely present. A snapshot taken after the stores were cleared would faithfully record the wiped state as the user's own, which is worse than no snapshot: it looks like a safety net and is a copy of the damage. Verified against both mutations -- removing the snapshot, and moving it after the wipe. One trap, hit for the third time today: QML allows only one Component.onCompleted per object, and SettingsBackup already had one. Adding a second does not fail locally -- it poisons the entire services module, so every singleton reports "Type X unavailable" and the real error is the last line of a forty-line cascade. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
588dec4adc |
Generate the settings reference from the schema
Every other form of documentation here has drifted at least once today: search routing that pointed at a page not containing the setting, a contract that pinned the bug the same commit fixed, and a comment in shell.qml that failed to stop me making the exact mistake it described. Prose describing 127 settings would drift the day after it was written. So docs/settings.md is generated, and a contract fails the moment the committed copy stops matching the schema. The document cannot be wrong for longer than it takes to run the suite. It reads the schema by parsing rather than importing, since there is no QML interpreter here and requiring a compositor to build documentation would be worse. That parser is the risk, so it FAILS LOUDLY: if it stops recognising the file it exits non-zero with the reason and writes nothing, because a partial reference is worse than a stale one -- stale is caught by --check, partial reads as complete. Verified: with the entry pattern broken it reports "only 0 entries parsed" and leaves the committed file untouched. The contract also proves --check actually compares content, by appending a line and confirming it fails, rather than trusting a command that returns success to mean anything. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
d96863b687 |
Convert British spellings to American across the repo
colour -> color, behaviour -> behavior, centre -> center, favourite -> favorite, and about twenty other pairs, applied consistently across comments, docs, error/UI copy, and a handful of QML identifiers that used the British spelling as their actual name: SystemSettings' serialiseValue/serialiseTable/normaliseGradient, Displays' normaliseModes, Wallpaper's normalisePolicy, SettingsBackup's serialiseHomeState, DateTime's ntpSynchronised property, Clipboard's _normalise helper, and ShortcutCapture's cancelled signal (with its onCancelled handler in ShortcutsPage.qml). Every call site and the two tests that assert on the literal source text (settings-ownership and settings-backup-live contracts) were updated in lockstep. Left untouched: config/dot/espanso/match/packages/misspell-en/ is a vendored third-party autocorrect dictionary -- its entries are typo corrections, not our prose, and rewriting them would fight the package's own purpose (and any future re-sync from upstream). The already-American `favorites` property (Home page pinned accessories) was never actually misspelled -- only nearby comments and error strings said "favourites" -- so no data migration was needed there. Claude-Session: https://claude.ai/code/session_01E6TJUAh41HaP25MVHWkhRZ |
||
|
Gabriel Brown
|
8156fc47ca |
Fix a false Nextcloud health warning
Two compounding bugs: the check looked for an autostart entry named "nextcloud.desktop", but current nextcloud-client packages ship it Title-cased as "Nextcloud.desktop" -- a case-sensitive filesystem never matched, so it always reported "autostart is not configured" even with autostart genuinely on. Made the lookup case-insensitive so a future package rename doesn't reintroduce this. Second, even past that, it ran systemctl against "nextcloud.service" -- a unit that doesn't exist in either scope, because the client is a plain autostarted process with no systemd unit behind it at all (same reasoning as the RustDesk autostart.lua comment, different shape: no service to query rather than the wrong scope). Added a process_check helper alongside the existing service_check and switched Nextcloud to it; confirmed live it now reports "Process is running." Claude-Session: https://claude.ai/code/session_01E6TJUAh41HaP25MVHWkhRZ |
||
|
Gabriel Brown
|
9bc771bcca |
Fix a false RustDesk health warning
The check queried `systemctl --user is-active rustdesk.service`, but RustDesk ships an enabled *system* service (root-owned, spawns the session --server/--tray on its own -- see autostart.lua's comment on why Panama doesn't start it a second time). No user-scope unit by that name exists, so the check always reported inactive regardless of whether RustDesk was actually running. Dropped --user; confirmed live that a plain `systemctl is-active` correctly reads the system unit without needing root, and the doctor now reports "Service is active." Claude-Session: https://claude.ai/code/session_01E6TJUAh41HaP25MVHWkhRZ |
||
|
Gabriel Brown
|
fe74a82a46 |
Route the Background portal to xdg-desktop-portal-gnome
Nothing served org.freedesktop.impl.portal.Background under Hyprland:
gnome.portal implements it but is UseIn=gnome, same situation the
Secret mapping below already solves for gnome-keyring. Every Flatpak
app's own "run/start on login" toggle goes through this portal, so it
silently failed for all of them -- Bitwarden logged the failure on
every launch.
Verified live rather than assumed: xdg-desktop-portal-gnome starts as
a standalone backend process with no dependency on GNOME Shell or
gnome-session, and after adding the mapping and restarting the portal,
Bitwarden's own autostart request succeeded end to end
(response=Background { background: true, autostart: true }) where it
previously errored with "portal frontend ... was not found".
Claude-Session: https://claude.ai/code/session_01E6TJUAh41HaP25MVHWkhRZ
|
||
|
Gabriel Brown
|
ac231eeb54 |
Stop double-launching Nextcloud and Bitwarden at session start
Both already have a ~/.config/autostart/*.desktop entry, and systemd's own xdg-autostart generator turns that into a graphical-session.target unit that fires on its own -- confirmed live via `systemctl --user list-units 'app-*@autostart.service'`. autostart.lua was also launching both explicitly, on the (apparently outdated) assumption that nothing else would. For Bitwarden this was actively harmful: each `flatpak run` gets its own sandbox instance, so the duplicate launch left two processes fighting over the app's single-instance lock, with neither reliably owning a usable window -- this is what "can't open Bitwarden" traced back to, alongside a live document-portal fuse mount that had silently died (fixed by restarting xdg-document-portal.service; not a config issue, so nothing to commit there). Claude-Session: https://claude.ai/code/session_01E6TJUAh41HaP25MVHWkhRZ |