9bc68ba358ccf4ccf2cc4a5808c5a8a90b4a58d5
62
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Gabriel Brown
|
f8f5b25510 |
Make Shell a category, the bar legible, and the dock a real dock
Desktop & Dock becomes Shell — Bar, Dock, Control Center, Tiling, Workspaces — the home for everything Quickshell draws. The settings- management cluster moves to System as Sync & Backup, Appearance's Shell tab dissolves, and 24-hour time finally lives on Date & Time, which always owned it. The bar gets what it never had: a way to survive the wallpaper. A second neutral text family (follow theme, or forced light or dark), a one-layer shadow under every glyph, and a gradient scrim for wallpapers nothing else survives — all off by default, pixel-identical until asked. Widgets earn toggles (weather, media, clipboard, calendar countdown), the vitals cluster stops leaving a dead pill behind, and Control Center's sections learn to step aside. The dock graduates from MVP: a context menu with window rows, pin, unpin, quit and new-window; scroll an icon to cycle its windows; drag to reorder on the dock itself; hover previews with one-shot captures; and "Add App to Dock" in the launcher. Three real bugs died en route — menus that slid away with the autohide, a readonly-property crash on every menu open, and a drag that drifted half a slot per icon on side docks. The pinned-apps editor in Settings becomes a drag strip. 166 contracts; the full suite is green except two live display and switcher tests that cannot run behind a locked session — re-verified on unlock. Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8 |
||
|
Gabriel Brown
|
cb7c09d208 |
Give the desktop real themes, video wallpapers, and honest titlebars
Appearance now opens on Themes: light and dark side by side, each remembering its own choice, over galleries of ten shipped themes — Tokyo Moon and Day joined by Moon Rose, Catppuccin, Nord, Gruvbox and Everforest in both modes. A theme is a complete palette: the catalog lives in themes.json, Theme.qml reads every color token from the active record, and one render pipeline carries it to kitty, tmux, btop, GTK, Vicinae, Firefox's chrome, and the lock screen. The Theme editor builds new ones from four wells — wheel, hex, or eyedropper — with derived surfaces, a saturation slider, debounced fine-tune, and effects that save with the theme. Custom edits finally keep GNOME's accent, kitty's border, and hyprlock in sync. Wallpapers can be video: mpvpaper per output, hardware-decoded, muted and looped, supervised and respawned. Panama owns the pausing — games, battery, and a bar pill for right now — because the compositor rebuilds full-screen blur for every frame a video wallpaper draws. The lock screen gets a still frame. Titlebars stop lying. GNOME apps get close-only on your chosen side, the maximize and double-click settings are gone, the Settings window obeys the same rules, and its titlebar can be turned off entirely. Typography becomes five labeled dropdowns instead of a wall of samples. Contracts updated and written throughout (165 now); per the redesign workflow none were executed — the full sweep runs once at the end. Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8 |
||
|
Gabriel Brown
|
c0eee076b4 |
Stop installing ffmpeg over ffmpeg-free, which a fresh machine refuses
A clean Fedora Workstation ships ffmpeg-free, and desktop-packages listed ffmpeg (RPM Fusion). Those two conflict rather than add: dnf will not erase the preinstalled ffmpeg-free to make room, so the WHOLE desktop transaction failed to resolve and no desktop package installed. The codec section already does the trade correctly -- `dnf swap ffmpeg-free ffmpeg --allowerasing` -- so ffmpeg simply does not belong in the eager list. A machine that already had ffmpeg (every one this repo was ever run on) sailed past this; the first genuinely fresh Workstation install is what surfaced it. Also: report_missing false-warned that awk was unavailable. rpm -q --whatprovides matches a package's named provides, but awk is provided as the file path /usr/bin/awk (by gawk), which that query misses. Fall back to command -v so a capability provided by path is not reported as missing. Found by a fresh-VM certification run, which is exactly the failure mode a re-run on an already-configured machine cannot reproduce. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh |
||
|
Gabriel Brown
|
9530e32326 |
Give a laptop its first week: the keys, the lid, the battery's endgame
The audit's fourth tier -- what a Framework owner reaches for in the first week and found missing. The power button stops being an instant, unconfirmed poweroff: a shipped logind drop-in tells the daemon to stand down and the compositor binds the key to the power menu, the way GNOME turns it into a question. Holding it still hard-cuts through firmware. change-settings restarts logind so the change applies without waiting for a boot, and the Power page says what the button does now. The function row fills in: F10 (XF86RFKill) toggles airplane mode through a new panama-osd verb that blocks or unblocks every radio and says which way it went; F9 (XF86Display) opens the Displays page, the honest action until mirroring exists. And the lid becomes a switch bind: closing a docked lid turns the internal panel off so nothing renders inside a closed shell and no workspace strands on an invisible output, and opening it restores the panel with the mode and scale chosen in Settings. panama-lid owns both decisions; undocked machines suspend via logind before any of it matters. The battery gets an endgame. On battery the screen dims to 30% two-thirds of the way to blanking -- GNOME's single largest idle battery saver -- and restores exactly the level it saved. At the urgent threshold the machine suspends after a fifteen-second grace, cancelled by plugging in, because a suspend preserves the session for days and a hard cut at 0% preserves nothing; "Only warn" remains a choice on the Power page. Hibernate joins the power menu, but only where logind answers CanHibernate with yes -- an entry that fails silently is worse than none. And brightness stops being two code paths: the Displays page now embeds the same control the quick-settings panel uses, so the built-in backlight and DDC/CI monitors share one surface that withdraws itself where neither exists. The lid contract narrows to what its principle protects -- a HandleLidSwitch drop-in -- so deliberate policy for other keys can ship. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh |
||
|
Gabriel Brown
|
153554b5df |
Make ./install something you could hand a stranger
The audit's third tier: everything between this installer and a fresh machine it has never met. The one path that could cost a person their display: the interview probes Secure Boot with mokutil, which install-packages had not installed yet, so on a minimal base the MOK question silently never fired -- and install-hardware still installed akmod-nvidia and blacklisted nouveau, arming a reboot into an unloadable driver with its fallback disabled. The probe tools (pciutils, mokutil, fwupd) now bootstrap beside gum, and install-hardware re-checks Secure Boot for itself and refuses the driver rather than the display. Secrets leave the checkout: the personal environment moves to ~/.config/panama/env at mode 600 by migration, and .bashrc sources it with a permission check that quietly re-tightens drift. change-settings no longer overwrites /etc/dnf/dnf.conf -- two performance keys are set additively, the defaultyes=True that made every `dnf remove` treat Enter as yes is gone, and a migration strips it from machines that already received it. Package installation survives the world changing: the initial and desktop lists run with --skip-unavailable and a report_missing pass that names what was skipped (resolved through --whatprovides, so capability names like awk do not cry wolf); the openh264, appstream and core-group extras go through soft; RustDesk resolves its RPM for the machine's own architecture; and the Claude Desktop repository script is fetched to a kept file and run, never piped from the network into root. The hardware predicates stop guessing: a wireless mouse's scope=Device battery no longer turns a tower into a laptop, USB-PD-only machines read their power state from the battery's own status instead of being permanently "on AC", the lid falls back to logind's LidClosed where ACPI is silent, and charge limits reach every pack of a two-battery machine in one authorization -- with the reported percentage summed across packs. And the parsers stop assuming this machine: snapper is read through --machine-readable csv with named columns instead of a localized box-drawing table, and reports whether snapshots are even possible so ext4 and unconfigured-btrfs stop looking identical; fprintd is parsed under LC_ALL=C; the hypridle drop-in resolves the binary it points at; the recorder's render node became an "auto" token resolved at record time; update-grub writes the config its firmware actually boots; the nvm prompt hook and the SSH tmux takeover are guarded; hipblas and rocm-opencl move to an opt-in gpu-compute category; and the two interactive python tools' libraries are declared. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh |
||
|
Gabriel Brown
|
44124d72fa |
Take one machine's fingerprints off everyone's desktop
The audit's second tier: values that were measurements of the author's desktop, shipped to every machine as if they were defaults. Settings greeted every human as Gabriel; it now greets whoever accountsservice says is signed in, and nobody when it says nothing. The weather shipped his home coordinates and confidently reported his forecast anywhere on earth; it now ships unset, fetches nothing until a location is chosen, and the location row says so. The GTK bookmarks carried seven /home/gib paths and his file server into every file dialog; they are now generated per machine from a template and gitignored -- Nautilus edits the instance freely, the way settings.ini already worked one file over. Web search routed through his personal bang redirector; the engine is now the webSearchUrl preference with a DuckDuckGo default, read by both the script command and the suggestions extension, which the launcher-search contract already pins to one another. The GPU vitals path defaulted to his card1 and lost the readout on any machine enumerated differently; a machine with exactly one GPU now adopts it. And the Containers and Snapshots pages hide once a scan proves their backing stack absent, instead of rendering permanently empty on machines that never had podman or snapper. Lesser residue swept in the same pass: the DP-2 hyprpaper block one machine needed, the author's username-typo expansions (moved to his personal seed in user/, where personal content belongs), a capture fallback into /home/gib, and a parity table asserting one machine's hardware as fact. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh |
||
|
Gabriel Brown
|
3d21e20041 |
Make every control tell the truth
The audit's first tier, in one change: every case found where the interface
asserted something the system did not do.
Twenty-one compositor-owned preferences -- the whole Mouse & Touchpad page,
plus window layout, snapping, dim-inactive and the magnifier -- had the live
half (hyprctl eval) and not the config-time half, so they quietly reverted on
every hyprctl reload. All 70 hypr-backed keys now have a prefs.get() in the
Lua, and hypr-prefs-contract pins both the presence and that the Lua fallback
equals the schema default, which is how the touchpad page misreported natural
scrolling on first boot.
The idle generator fell back from unwritten battery keys to the AC values
while the Power page displayed the schema defaults: a fresh laptop showed
"suspend at 20 minutes" and generated no suspend listener, then discharged to
zero in a bag. Unwritten keys now use the defaults the page shows
(idle-defaults-contract pins generator to schema; idle-config-contract
re-pinned to the new rule with the tradeoff recorded), and change-settings
enables managed idle on any machine with a battery -- without starting
hypridle in whatever session the installer runs under.
The per-app lock-screen notification switches wrote fields nothing read:
hyprlock cannot render notifications. Removed, with the rule model shrunk to
{enabled}, stale stored fields dropped at normalization, and the contract now
forbidding the page from growing lock-screen switches it cannot honor.
The battery warning thresholds were searchable, documented as "Found on
Power & Lock", and rendered nowhere -- and crossing the low threshold changed
only a glyph's color. Both sliders now exist where search was already sending
people, and low battery publishes a real notification at important priority.
Three handoffs opened GNOME panels that are inert in a Hyprland session. The
keyboard handoff is gone (that panel writes gsettings nothing here reads, and
the working controls sat on the same page); Connectivity gains a Wi-Fi row
that opens GNOME's actual Wi-Fi panel -- hidden SSIDs and 802.1X finally have
a road -- beside the network row that legitimately drives NetworkManager; the
universal-access handoff is gone, its few working toggles being controls this
app already owns. And the accessibility page now gives the true reason sticky
keys are missing: each Wayland compositor implements its own and Hyprland
does not yet -- not "an X11 feature with no Wayland equivalent," which sent
people to the wrong conclusion about the platform.
Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh
|
||
|
Gabriel Brown
|
dfc0c49877 |
Let the laptop say what it is doing: battery percentage, the lid, a fingerprint
Three surfaces the first laptop install showed were missing. The bar's battery icon gets an optional exact number beside it -- GNOME's "Show Battery Percentage", off by default for GNOME's reason, one color with the icon so it reads as one indicator. The Power page says what closing the lid does. The policy already existed (LidPolicy holds a suspend inhibitor while an external display is connected) but was surfaced nowhere, so the machine's most physical behavior was undiscoverable -- and the deliberate absence of an override deserves stating rather than leaving someone to hunt for a switch that does not exist. And the Users page grows a Fingerprint card, because fingerprint login is two systems that fail silently when they disagree: fprintd holds the enrolled prints, authselect decides whether PAM ever asks the reader. This machine arrived with a finger enrolled from its GNOME days and with-fingerprint off, which reads as "the reader is broken". The card shows both facts, flips the authselect feature through polkit with a stated reason, and hands enrollment to GNOME's Users panel, which owns the only good capture dialog -- a named exception in the handoff contract. Everything through scripts/panama-fingerprint, pinned by a stub-driven contract. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh |
||
|
Gabriel Brown
|
c2eddc2c5b |
Ask for the password once, and own the plugin the COPR needs
Two ways a fresh machine's unattended run could still stall. The stages call sudo dozens of times across twenty-plus minutes, and the timestamp expires five minutes after whichever call came last -- so any single dnf step that outlasted it turned the next stage into a password prompt nobody was there to answer. ./install now authenticates once, right after the interview, and a refresher holds the timestamp for exactly as long as the script lives; cleanup() kills it on every exit path, so nothing outlives the install with ambient credentials. And `dnf copr` comes from dnf5-plugins, which a machine that has used copr carries and a fresh Workstation does not -- a missing plugin there would have cost the entire desktop. Declared in initial-packages, where the repositories stage can rely on it. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh |
||
|
Gabriel Brown
|
a95c480c6a |
Drop the packages Fedora 44 stopped shipping, and never let a migration wait for a prompt
Two more things the Framework's install surfaced. gstreamer1-plugin-fmp4 and gstreamer1-plugin-mp4 no longer exist in any repo this configuration enables — not Fedora 44, not RPM Fusion, not the Hyprland COPR. Machines installed on older Fedora carry them as orphans, which is why the list looked fine from one. dnf5 refuses a whole transaction over one missing name, and desktop-packages runs above the Hyprland block, so two dead codec entries cost the entire desktop. The solopasha migration preferred panama-sudo, and pkexec with no polkit agent to answer it does not fail — it waits forever, which held an unattended ./install hostage at the one stage that promised never to ask. The stated reason is now reserved for a terminal someone is sitting at; a non-interactive run takes plain sudo, which either succeeds quietly or fails fast enough for panama-migrate to retry at the next login, as it promises. Verified by running install-packages end to end on the machine that broke it: Terra guard holds, desktop packages resolve, Hyprland 0.56.2 lands, and the stage reaches its stepped-over report. All 22 setup contracts pass. Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh |
||
|
Gabriel Brown
|
78db2d5689 |
Let a stepped-over step say why, and let sudo ask
soft() swallowed stderr, which hid both halves of what matters: the dnf error explaining the failure, and the sudo password prompt on a machine that asks for one. stdout only. |
||
|
Gabriel Brown
|
669a228286 |
Install the desktop before anything allowed to fail, and let Terra be installed twice
Two bugs, one story: ./install on a machine that had been half set up before produced no Hyprland at all, and said so in one line among twenty minutes of scrollback. Terra bootstraps itself with --repofrompath, which defines a throwaway repo id just long enough to install terra-release. Run it again on a machine that already has terra-release and dnf5 refuses the whole transaction -- the throwaway id collides with the real one. That step sits above everything, so set -e ended the stage before a single package was considered. It is skipped now when terra-release is already installed. The rest is the reason one failed repo cost the desktop. Hyprland was installed near the bottom of the stage, below a codec swap, two group updates and a GStreamer glob, any one of which can fail for reasons outside this repository. It now installs directly after the packages it needs and before anything optional, and everything fragile below it runs through a soft helper that logs and continues rather than ending the run. What was stepped over is listed at the end, because tolerating a failure only beats aborting on it if somebody is told. A missing Hyprland is still fatal, and now says so in words. Also removes the leftover disabled solopasha/hyprland COPR, which would mix with lionheartp's the moment anyone enabled it while debugging. Fixes the usage widget reading 1500%: the endpoint reports percentages, not 0..1 fractions. Clamped as well, and the widget answers a click now -- it set interactive:false, which disables the mouse area its own handler needed. |
||
|
Gabriel Brown
|
89761a7da3 |
Keep the personal half of the desktop in one place, and ask before installing it
Agent instructions, skills, SSH host aliases and expansion triggers are worth having identical on every machine one person owns, and belong in none of the shared configuration. They live in user/ now, with a manifest saying where each piece goes and a link-user stage that puts it there. That stage does nothing unless the machine said yes. Somebody who clones Panama to try the desktop keeps their own ~/.claude/CLAUDE.md exactly where it was; the question names the destinations and defaults to no. Anything displaced goes to config/old rather than being deleted. ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md were byte-identical copies of one file, which is the drift this exists to prevent. Also adds the vitals toggles for the battery and Claude usage readouts, which had preferences and no way to reach them. |
||
|
Gabriel Brown
|
7a5e990439 |
Let somebody extend this without forking it, and say when things die
Two of Section F. Hooks are the pressure valve. "Can Panama also do X when the theme changes" is now a five-line file in ~/.config/panama/hooks rather than a fork, a feature request, or a patch somebody rebases forever. Each name takes a single file and a .d directory so several things can react without fighting over one, and a broken hook is reported and stepped over: somebody's script must never cost a theme change, an upgrade or a login. Wired at theme-set, post-upgrade and post-migrate. This is the thirty-line version of the plugin host the upstream ledger defers, and it has no API to keep stable beyond "we will run your script and tell you what happened". Testing it caught a real bug the reading would not have: run_one captured the script path but never shifted it off, so every hook got its own filename as $1 and the real arguments arrived one place late. A hook reading $1 as the colour scheme got a path. The crash watcher notices when a program dumps core and says so. Under GNOME, ABRT does this; here nothing did, and applications died silently, which is most of how "Linux is flaky" gets earned. Once per program per session is the entire design, not a nicety. This machine's portal backend crashes between eleven and sixty times a day, and a notification per crash would be one every few minutes for something nobody can act on. The first is news; the fortieth is why people turn notifications off. The health page keeps the running count. It waits for the notification server before reporting, because the crash most worth hearing about is the one that took the shell with it, and it names the executable rather than the kernel's comm field, which truncates at fifteen characters. Verified against real segfaults. |
||
|
Gabriel Brown
|
68cbf892e9 |
Teach the file manager to send and to shrink
Right-click a file to send it to your phone, or a video to make it smaller. macOS has both behind the Share sheet and Quick Actions; Windows has "Send to"; a stock Linux file manager has neither, and the usual answer for the second one is a web uploader or an ffmpeg incantation looked up again every time. Neither adds machinery. Sending reuses panama-kdeconnect, the same helper the Home & Phone page and quick settings already drive, so there is one way to talk to a phone rather than two. The entry appears only when a phone is actually reachable: an item that is present and fails is worse than one that is absent, because the absence explains itself. The transcoder's two rules are both about not losing work. It never writes to its input, and it never writes over an earlier output -- a second run produces -2 rather than eating the first result. Verified against a real encode: 1920x1080 became 854x480, with an even width because H.264 rejects an odd one at the very end of a long encode, which is the worst possible moment to find out. Menus decide by mime type rather than extension, act on one file at a time, and refuse anything that is not a local path. nautilus-python turned out to be declared already; it now says it carries Panama's own extensions too. |
||
|
Gabriel Brown
|
c02329ac3c |
Copy a password without leaving a trace of it
The launcher's Copy Password command, built alone and last as the plan required, because every line of it is the security design: the secret travels rbw to wl-copy through a pipe -- never argv, never a file -- and the copy carries wl-clipboard's --sensitive hint, which vicinae's clipboard history documents it ignores. That claim was not taken on faith: a plain probe landed in the live history database and a sensitive one did not, before any of this was written. A transient timer clears the clipboard after thirty seconds. An unconfigured rbw gets a setup message; a vault that locks between list and get gets an honest failure instead of an empty copy claiming success. rbw joins desktop-packages, and the contract pins the whole journey with a stub vault, including that the secret never appears on a command line. |
||
|
Gabriel Brown
|
25e2328658 |
Your name is an answer, not a constant
The :fn/:em espanso triggers hardcoded one person's name and email in a match file shipped to every user -- a misfire that lands inside their own prose, where they are least likely to notice. setup-identity now seeds match/identity.yml, per-machine and gitignored, from the same interview answers that already configure git. |
||
|
Gabriel Brown
|
7d633eb06e |
Alias only what the machine will actually have
vim aliased to vimx, which no list installed; bat invoked by its Debian name, which Fedora does not ship; sunshine restarted by an alias when nothing here installs sunshine. vim-X11 is now declared so vimx exists, ff previews with bat, and the sunshine alias moved to the gitignored env of the one machine that has it. |
||
|
Gabriel Brown
|
6d1f3f3763 |
Keep the MOK password off the command line it was promised off of
The comment above the prompt says the password never reaches a command line; --generate-hash="$first" put it on one, world-readable in /proc/<pid>/cmdline while mokutil ran. It now arrives on stdin, and the hash is taken from the last output line because mokutil prints its prompts to stdout too. |
||
|
Gabriel Brown
|
de923cb4d5 |
Honor PANAMA_PATH in the two stages that clobbered it
install and link-dotfiles treat it as a default; install-packages and change-settings overwrote an exported override, so a clone anywhere but ~/.local/share/Panama sourced the extras catalog from a path that does not exist and copied config/copy from the wrong tree. |
||
|
Gabriel Brown
|
bd9a55c8eb |
Fail when failing, stop when stopped, and survive what is neither
Four installer bugs, all in the space between exit codes and intent: - A flatpak-only extras category -- most of them -- died at the grep that filters out its dnf half, because grep exits 1 on zero matches and set -e read that as failure. sed deletes lines without editorial comment. The extras contract now runs a flatpak-only category under the installer's own strict options so this stays fixed. - A rate-limited GitHub API call aborted the whole package stage while resolving the RustDesk URL, even though the empty-result fallback was sitting right below it. The pipeline is now guarded so the fallback is reachable. - Ctrl-C did not stop the install: the INT trap ran cleanup and bash carried on with the remaining stages, MOK enrollment and firmware included. INT and TERM now exit explicitly; cleanup rides EXIT. - change-settings and link-dotfiles ran without set -e, so a failed copy over / or a failed symlink fell through to guarded no-ops and the stage reported success. Turning strictness on immediately caught what it had been hiding: link-dotfiles never created ~/.config, so on a truly fresh HOME every symlink was failing silently. |
||
|
Gabriel Brown
|
cab7699711 |
Start the text expander that was only ever installed
espanso-wayland was installed and its config linked, and then nothing anywhere launched it -- the RPM ships no unit, autostart.lua started every session daemon except this one, and the seed machine only worked because the service had once been registered by hand. change-settings now runs `espanso service register` (upstream's own mechanism, and unlike hypridle it conflicts with nothing GNOME runs), and autostart.lua starts the unit so the first Hyprland login after a fresh install expands text rather than the second. |
||
|
Gabriel Brown
|
86825e7327 |
Judge the document portal by its mount, not by its service
No flatpak would launch. Every one of them failed in bwrap with "Can't find
source path /run/user/1000/doc/by-app/<id>", because xdg-document-portal's fuse
mount was gone -- /run/user/1000/doc was a plain empty directory. That mount is
bound into every sandbox bwrap builds, so losing it takes out all 34 flatpaks at
once, never a subset.
It had been gone for three days. The shipped unit is Type=dbus with Restart=no,
so nothing retries it on failure: after it exited 21 it came back only because a
flatpak called its bus name two seconds later, and that activation landed on the
dying instance's mountpoint and came up with no mount at all. systemctl reports
active (running) either way -- the fusermount3 helper is still sitting there as a
child, in this case for two and a half days without ever completing the mount.
Nothing running notices, which is what makes it so quiet. A sandbox needs the
mount only while it is being constructed, so everything already open keeps
working and the symptom arrives whenever you next open a flatpak you had not
opened yet. Here that was three days later, and it presented as "gearlever is
missing" -- an application that was installed, healthy, and entirely innocent.
Two changes, because there are two failures: it does not recover, and nothing
says so.
The drop-in clears the mountpoint before each start, so an activation that
follows a crash lands on clean ground. ExecStartPre rather than ExecStopPost
precisely because nothing restarts this unit -- the next start is whenever
something next wants it, and that is the moment that has to be safe. `-` because
a clean start has nothing to unmount and fusermount3 exits 1 saying so.
/etc/systemd/user rather than a per-user drop-in so it covers every account, and
change-settings reloads the user manager so it applies without a re-login.
The check asks the mount table whether $XDG_RUNTIME_DIR/doc is mounted
fuse.portal. Deliberately not a service probe, and deliberately not folded into
desktop.portals: that one asks about xdg-desktop-portal, a different service
which was up and healthy throughout. Service state is exactly the question that
lied here, so asking it again in a new place would have been no check at all.
Warning carries a restart repair, verified end to end rather than assumed.
The mount table is injectable, like every other path this script reads, so the
contract covers unmounted, wrong-filesystem-at-the-right-path, and unreadable
against written fixtures rather than against whatever /proc happens to say --
coupling the test to this machine's live flatpak state is the same mistake in
miniature. Stubbing the check to always return ok fails the contract, which was
confirmed rather than hoped.
What is not fixed is the crash itself: one occurrence, and restarting the
service to get the desktop working destroyed the evidence. The exit was 21, it
landed 21 seconds after xdg-desktop-portal restarted, and that is one sample and
not a theory. What this buys is that the next one is a two-second blip the
doctor names, rather than three silent days.
Second time for this bug.
|
||
|
Gabriel Brown
|
89417cd6d4 |
Take Claude Desktop from the repository that now carries it
It was `panama app claude-desktop`: a source build, because nothing packaged it. Upstream publishes an RPM repository now, so the exception shrinks to adding that repository -- and the result upgrades with `dnf upgrade` along with everything else instead of needing a slow rebuild every time a version ships. That moves it out of setup/apps/ and into the third-party section of install-packages, beside Bun, Claude Code and RustDesk. It also means it is part of ./install for the first time. The reason it was kept out was the build: slow, wants the network throughout, and fails on an upstream that moved, which is the failure the interview exists to prevent. A dnf install is none of those, and the default dock pins com.anthropic.Claude, so a fresh machine was shipping a pin for something the install had never put there. The repository is added with upstream's own setup script rather than a .repo file written out here. A baseurl copied into this repository is a pin by another name; the script is the part upstream keeps correct. Both halves are skipped when already present, so a re-run costs nothing. The desktop entry id does not change -- it is still com.anthropic.Claude -- so the dock pin and the notification rules carry over untouched. The new package drops the nodejs dependency, which is what used to hide the missing-npm bug the launcher search contract guards; its comment said "depends" in the present tense and now says what actually happened. |
||
|
Gabriel Brown
|
033d5b21f8 |
Build the launcher's extension on a machine that has only nvm
The search extension is compiled, and the stage that compiles it checked for npm and skipped quietly when it found none. On this machine it always found one -- but only because Claude Desktop depends on nodejs and dragged a system npm in. Nowhere else would. Node moved to nvm when the shell config turned out to have been assuming it for months, and nvm is a shell function in a file only an interactive shell sources; a stage is not one. So a fresh install would have set up the launcher, printed one line about extensions not being built, and left somebody wondering why typing in it suggested nothing. The stage sources nvm before looking, and the contract pins that it does -- checking for npm is not the same as being able to find it. Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1 |
||
|
Gabriel Brown
|
7cd4131327 |
Hold a key, speak, and the words are typed
Super+D holds the microphone open, releasing it transcribes on the GPU and types the result wherever the cursor is. Roughly 150ms for a normal utterance once the model is resident, measured rather than hoped for. Getting there meant discarding two approaches. Fedora 44 cannot install any GPU-capable Whisper for Python -- openai-whisper needs a numba that needs an llvmlite that does not exist for 3.14, and faster-whisper needs a ctranslate2 nobody packaged. The whisper-cpp package IS built with HIP but ships libraries with no binary and no bindings, and hand-writing ctypes for a large by-value struct is a segfault waiting for a version bump. So a container, as suggested. Vulkan rather than ROCm, and upstream's image rather than one built here. ROCm is seven gigabytes and serves AMD alone; Vulkan compute runs on the AMD, Intel and NVIDIA machines this config is used on, in a twentieth of the space. The Vulkan tag already contains whisper-server, so there is no Containerfile to keep working -- an earlier draft of this commit had one, and it was strictly worse. Two bugs found by using it rather than by reading it. Whisper describes silence as the literal text "[BLANK_AUDIO]", and the first working version pasted that string into the clipboard; a transcription that is nothing but such markers is now discarded. And the server answers with a line per segment, which typed into a window is an Enter press -- sending the half-written message, submitting the form. Whitespace is collapsed to one line. Neither the image nor the model is installed by ./install. Together they are over two gigabytes that want the network, and Settings offers both as one action instead. Nothing starts at login either: whisper-server holds the model from the moment it starts, so the first press of the key is what brings it up. The contract pins both text bugs, that the server stays on loopback, and that it does not start at login. Reverting the [BLANK_AUDIO] guard did not fail it at first -- the check was still correct, it had simply stopped being called -- so it now checks the call site too. Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1 |
||
|
Gabriel Brown
|
9092a80f66 |
Search from the launcher, and give the touchpad something to do
Four things a Hyprland desktop can do that this one was not. Searching from the launcher needed no launcher work at all: Vicinae already models it, so this is a script command with one percent-encoded argument. Make it the fallback command and anything typed that matches nothing else offers to search it. Bangs come free -- they are a property of where the query is sent, not of the launcher -- so !yt reaches YouTube without a line of bang parsing. Suggestions could not be a script command. They need a view that reacts as you type, which is an extension: TypeScript, compiled, querying the same endpoint Firefox's address bar uses. It debounces, and aborts the request in flight on every keystroke -- typing is faster than the network, and an older answer landing after a newer one leaves the list describing a query that is no longer on screen. A bang skips suggestions entirely, because Google has no useful guesses about "!yt". The engine is now written down twice, once in each. The contract pins that they agree, since searching from the fallback and searching from the suggestions reaching different places is the kind of wrong that looks fine. Gestures mirror GNOME: three fingers sideways for workspaces, up for the overview, down to dismiss it. Open and close rather than toggle both ways -- toggling means swiping up from an open overview closes it, which is not what the fingers meant. Hyprland reads gesture registrations at startup so they cannot be a setting, but distance and direction can be, and are. Window swallowing is off by default and a preference like every other misc setting here. A terminal that vanishes when you did not ask for it is confusing rather than broken, which is worse. Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1 |
||
|
Gabriel Brown
|
725e274ef4 |
Install the Node this shell config has always assumed
config/bash/shell sources /etc/profile.d/nvm.sh, switches Node per project from .nvmrc, and puts PNPM_HOME on PATH. None of it worked on a fresh machine. nvm was never installed -- it is a Terra package, present here since before Panama -- and the source was unconditional, so every shell on a new box opened with an error before it got as far as failing to find nvm. That is the second instance of the same bug. $HOME/.cargo/env was the first, and fixing it one file at a time is why this one survived: the dependency contract scanned setup/scripts, bin and the quickshell helpers, but never config/bash -- the one place in this repository whose entire job is to name tools and source the files that provide them. So it scans it now, and checks the shape rather than the instance: a literal path sourced without testing it exists is a finding, wherever it appears. It found the nvm line, and authselect behind the fingerprint aliases. Node and pnpm move to nvm with it. They were declared as dnf packages while the machine ran them from ~/.nvm, which is not a preference so much as a contradiction -- a system Node earlier on PATH wins every `nvm use`, so the per-project switching this shell config sets up could never have worked. nvm install --lts, then pnpm inside it, so pnpm travels with the Node version it belongs to instead of outliving it. Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1 |
||
|
Gabriel Brown
|
215da285f3 |
Let applications be chosen a few at a time
The catalog held fourteen applications. This machine runs thirty-four flatpaks, so most of what is actually used had no way to be installed from here at all -- Zoom, Slack, Obsidian, Spotify, LibreOffice, OBS and its sixteen plugins. So the catalog is seeded from the machine, and `panama apps` opens it: pick a category, tick what you want, install just those. ./install still offers the same catalog as whole categories, because during a first install you want coarse and fast. Both read setup/lib/extras-catalog. Two parsers would eventually disagree about what a category contains, and the one that disagreed quietly would be the one that runs unattended. Two pieces of syntax earn their keep. A `| Name` suffix gives the menu something readable, since com.obsproject.Studio is not a name anybody wants to pick from a list. An indented line belongs to the entry above it, which is how OBS carries its plugins as one thing to tick rather than seventeen -- they are extensions of the flatpak, useless alone. That is also why creative moved from dnf to Flathub: the plugins attach only to the flatpak, so the dnf build cannot have them. The rest of the category followed rather than leave one machine with GIMP from dnf and its neighbour from Flathub. The contract now reads the catalog through the same parser instead of keeping a third idea of the format, and checks the two things this syntax can break silently: a label leaking into an install command, and a bundle that installs the application without its plugins. It caught a typo in the Pixelorama id on the first run. It also got slow enough to be worth fixing -- fifty-one names, each its own network call. One bulk query per manager took it from minutes to four seconds. That query needs `flatpak remote-ls --all`: without it, end-of-life applications are hidden and read as missing, which reported yuzu as gone from Flathub when it installs perfectly well. Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1 |
||
|
Gabriel Brown
|
f457c1eb9f |
Build the two applications nobody packages, on purpose rather than in passing
Claude Desktop and ChatGPT Desktop ship for macOS and Windows. The Linux path for both is a community wrapper that converts the official build into an RPM -- so what lands is still a package dnf owns and can remove, which is the part of the dnf/flatpak rule that actually matters. What they need an exception for is the build itself, and there is no packaged form to prefer over it. `panama app` builds one by name, and is deliberately not part of ./install. A source build is slow, wants the network throughout, and depends on an upstream that moves -- twenty minutes in, an error, with nobody at the keyboard, which is the exact failure the interview exists to prevent. Asking for one is something you do on purpose, and it is also the rebuild path when a new version ships. Nothing is pinned. Each build takes the current default branch and the current upstream release, and reports a failure rather than working around it, leaving the tree where the error can be read. sunhat pinned versions and every pin was a 404 within a release cycle. Adding one is adding a file to setup/apps/, and the file has to say why the exception exists -- the contract fails a definition that does not, because the guard against this list growing by habit is having to write the reason down. sunhat had seventy-odd installers and a reason recorded for none of them. The contract had a bug worth recording: `while read` on the right of a pipe runs in a subshell, so two of its three per-definition checks recorded findings into an array that went out of scope at the end of the loop. It reported PASS on a definition with no description and no build function. Found by standing one in deliberately and noticing only the third check spoke up. Also: nautilus-open-any-terminal is now declared, and Panama's copy of the extension is gone. Fedora packages that extension AND its gsettings schema, and Panama shipped its own fork of the .py over the same path while declaring neither -- so a fresh machine got an extension whose schema did not exist. It worked here only because the RPM has been installed since sunhat. The fork was also 63 lines behind the packaged version, missing its newer Nautilus and Caja handling. Auditing the rest of config/copy for the same shape found nothing else: dnf.conf is a config file its package expects to be replaced, and the GPU udev rules are Panama's own. 125 contracts pass. Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj |
||
|
Gabriel Brown
|
47f29f9fa9 |
Stop describing a desktop this repository does not install
Phase 5. The README advertised two desktops that coexist -- GNOME with Forge, Dash-to-Dock, Openbar and Vitals, alongside Hyprland -- and nothing in setup/ installed or configured any of the first one. Panama configures one desktop, and now says so. config/dot/forge is deleted along with its entry in link-dotfiles. It was the hedge from when the GNOME session was still the fallback and Hyprland was being built beside it; the hedge has been paid off. Nine files, six of which were Forge's own editor backups that should never have been committed. Searching for the rest of GNOME found nothing else to cut, which is recorded in the spec so nobody goes looking again. change-settings never enabled an extension. The mentions of Dash-to-Dock, Openbar and Vitals through the shell are comments saying what a component was modelled on -- which intellihide behaviour the dock reproduces, where a colour came from -- and DESKTOP-PARITY.md is the table of what replaced what. That is provenance, and it is the reason those components behave the way they do. Vitals in services/ is Panama's own bar service and merely shares a name with the extension it replaced. The handoff panel list was wrong in two places. It named Wacom, which nothing hands off to, and Region, which is a subpage of System rather than a panel. The nine real ones are read off the call sites and the allow-list that gates them. The spec said it, the comment on gnome-control-center repeated it, and the README would have made it three. One test gap turned up and is closed. The assets contract caught a directory under config/dot/ that nothing links, but not the inverse: a name left in the dirs array with nothing behind it, which makes link-dotfiles point ~/.config/<name> at a path that does not exist. Deleting Forge is the exact move that introduces that, and nothing would have failed if the array entry had been left. A dangling symlink is worse than a missing one, because everything that looks there finds something. Verified by putting the entry back and watching it fail. The audit of docs/settings.md this phase asked for needed nothing: it is generated from PreferenceSchema.qml, a contract already fails when it goes stale, and it carries no claim about GNOME or Forge. The README gained the section it was missing instead -- the 121 contracts under tests/ were the main safety net in this repository and went entirely unmentioned in it. Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj |
||
|
Gabriel Brown
|
88497826ec |
Let a machine say what it is for, and give Firefox its face back
Phase 4: the optional application categories, and the Firefox chrome. Everything Panama installed until now was what every machine gets, which meant a work laptop acquired emulators and a desktop that wanted Steam had to be told about it by hand. The interview now offers the categories in setup/packages/extras/ as a checklist -- gaming, creative, communication, virtualization -- and nothing is preselected, because a default here installs applications nobody chose on a machine whose owner answered a question they thought was about something else. A category is one file, and a category mixes both package managers because the applications do: Steam is in RPM Fusion, Slack publishes only a flatpak. So a bare line is a dnf package and a flatpak: line is a Flathub ID, and one file holds the whole answer rather than splitting each category across two. The menu is read from the directory rather than written down, so adding a category is adding a file. Every name in all four was resolved against the actual repositories before being written down, and the contract re-resolves them -- the point of admitting applications one at a time is that they stay installable, and a typo here fails on somebody else's machine, not this one. Firefox is declared, and its chrome is Edge-Frfox, vendored into config/firefox. sunhat carried that theme with no license and no attribution; it is MIT, and now it says so and says whose it is. It is the only piece of Panama's configuration that does not go to a path this repository chooses. Firefox owns the profile directory, names it with a random salt, and does not create one until the browser has been run -- so link-dotfiles finds or creates a profile and links both halves into it. Both, or neither works: chrome/ is the CSS and user.js sets the preference that makes Firefox read chrome/ at all, without which the theme is a directory of dead files. Two assumptions there were wrong, and the contract exists for both. Firefox has moved to the XDG directories -- the profile root is ~/.config/mozilla/firefox on this build, not ~/.mozilla/firefox, and writing to the wrong one themes nothing and says nothing about it. And -CreateProfile turns out to be non-interactive, so a fresh machine gets the theme on the first install rather than the second. The contract runs link-dotfiles for real against a throwaway home with no profile in it and looks at what came out; it was checked by pointing the search at the legacy path only and watching it fail. Also: the enrolment/enrollment spellings from the last commit are corrected. This repository is US-spelled everywhere else -- color 1131 times against colour never -- and consistency in prose is worth as much as it is in code. Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj |
||
|
Gabriel Brown
|
b319d1a5e1 |
Stop handing dnf the comments that explain the package lists
Every list in setup/packages/ is annotated -- which package exists for which settings page, why an exception was made -- and install-packages passed the whole file to dnf, comment lines included. dnf does not ignore an argument it cannot match. It reports "No match for argument: #" and exits 1, and with set -euo pipefail at the top of that script the first annotated list ends the stage. initial-packages carries four comments and is the first list read, so a fresh machine got the repositories, the group updates, and then nothing. Two things hid it. On a machine that already has everything, a re-run matches every real name and fails only on the comments, so the failure looks like noise rather than the stage dying. And every contract that reads these lists strips comments with sed before comparing -- the tests were reading a file the installer was not, which is why a repository with a dependency contract, an assets contract and a doctor still reported PASS across the board. The fix is one filter used at all five call sites. The contract lifts that filter out of the script and runs it, rather than describing what it should do, so deleting or renaming it fails here instead of passing quietly. It also checks the inverse -- that stripping comments does not strip packages -- because trading a loud failure for a silent one would be worse than the bug. Found while adding the extras lists for phase 4, which are annotated the same way and would have hit the same wall. Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj |
||
|
Gabriel Brown
|
13f3648e4d |
Install the driver, enrol the key, and still never ask twice
Phase 3 of the fresh-install spec: the parts of a run that depend on what the machine actually is. NVIDIA, Secure Boot, Fedora's preinstalled extras, firmware. Two of these looked like they would force a compromise, and neither did. sunhat opened an editor in the middle of its run so grub could be hand-corrected, and that single step is why walking away from an install did not work. The step existed to delete duplicated kernel arguments -- and grubby replaces an argument that already exists rather than appending a second copy, so the duplicates cannot accumulate and there is nothing to correct. The editor was load-bearing for a problem that a different tool does not have. MOK enrolment needs a password now and the same password at the next boot's blue screen, which reads like a prompt that has to happen mid-run. mokutil has --generate-hash and --hash-file for exactly this: the interview asks, hashes it on the spot, and records only the hash. The plaintext never reaches the answers file, the environment, or a command line, and the stage runs without asking. The stage runs last rather than fourth as the spec's table had it. The constraint was always "late" and fourth of eight is not late: enrolment arms a prompt for the next boot and firmware may want a reboot, so a machine that reboots out of this stage should already be completely configured. Every question names what was found -- the card, the packages actually installed -- and is not asked at all on a machine it would do nothing to. sunhat's debloat list no longer describes Fedora 44: totem became showtime and LibreOffice is not preinstalled, so the list is curated and a package that is not installed is never passed to dnf, which is what lets it outlive a release. This stage cannot be verified by running it. It installs a proprietary driver and queues a Secure Boot enrolment, and this machine is an AMD desktop. So every privileged command is stood in on PATH and the contract asserts which answer led to which call: that no answers means no commands, that a failed driver install is not followed by arguments and services for a driver that is not there, that the hash reaches mokutil through a file and never a command line, and that removal is offered only for packages that are installed. The contract was checked by breaking the stage three ways and confirming it caught each. It does not verify that akmod-nvidia builds, and says so where a reader would otherwise assume it did. The README's stage table listed three of seven stages; the interview and identity work never reached it. Corrected rather than extended, since a table that lists three of seven is worse than one that lists none. The Desktops section still describes a GNOME session nothing installs -- that is phase 5. Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj |
||
|
Gabriel Brown
|
359fb922aa |
Install the four applications this desktop assumed you had
Helium was already declared. Podman Desktop is on Flathub, so it joins the flatpak list beside the podman it fronts. RustDesk was the interesting one. panama-doctor has checked `rustdesk.service` for as long as it has existed, and autostart.lua works around the tray that service spawns -- so RustDesk was already part of this desktop, installed by nothing. The flatpak cannot register a root-owned system service, so unattended access needs the RPM. Claude Code has no RPM and no flatpak either, so it takes the official installer and keeps itself updated afterwards. Neither pins a version. sunhat pinned upscayl 2.11.5, LACT 0.5.4 and a fedora-40 RPM, and every one of those was a 404 within a release cycle; the RustDesk URL is resolved from whatever the latest release happens to be. Both are skipped when already present, and a failure is logged and stepped over rather than aborting a stage that has already installed the desktop. That leaves three exceptions to the dnf-or-flatpak rule, all named in one place with a reason each. The dependency contract now knows they are installed out of band, so probing for them with `command -v` is not read as an undeclared dependency -- narrowly, per command, so a genuine omission still fails. Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1 |
||
|
Gabriel Brown
|
15d54b16f6 |
Ask everything first, then run without needing anybody
sunhat's failure mode was a question twenty minutes into a run. Walking away from an install meant coming back to a prompt that had been waiting an hour. So the questions move to the front. A new interview stage asks what Panama needs to be told -- hostname, git identity, whether to sign in to GitHub, whether to make an SSH key -- shows the answers back, and asks once to proceed. After that nothing asks again. gum is bootstrapped before it runs, because the interview is built on gum and gum arrives with a stage that has not run yet. Answers reach the stages through a mktemp file that install sources and the existing trap deletes, since a child process cannot export into its siblings. They are not remembered between runs: there is no state file to go stale, and one of the answers is an email address. The interview asks only what a stage in this repository actually consumes. Extras, hardware and debloat questions arrive with the stages that act on them -- a prompt whose answer nothing reads is a control that lies. The new contract pins that in both directions, and four deliberate mutations confirmed it catches a question nobody reads, a stage reading something nobody asks, an answers file left on disk, and a declined interview that fails to stop the run. The run now ends with panama-doctor, because a failed-stage count says nothing about a service that did not start. It never changes the exit code: on a fresh machine, unconfigured is the honest answer, not a failure. espanso and oh-my-posh stop being exceptions -- Terra packages espanso-wayland and Fedora packages oh-my-posh, so the curl installer is gone. bun is now the only remaining one. Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1 |
||
|
Gabriel Brown
|
96e4085919 |
Install the desktop this repository already describes
The shell named a font, a pointer theme and a wallpaper that no package list installed and no stage placed. It went unnoticed because this machine collected all three under sunhat and never lost them; a fresh Fedora box would have come up with tofu for every shell glyph, the default pointer, and no wallpaper -- while Wallpaper.qml called that missing file `shippedPath`. The dependency contract reported PASS throughout, because it reads commands that scripts invoke and none of these are one. The new assets contract covers what it structurally cannot: fonts and pointer themes named in configs and gsettings, a shipped wallpaper that must exist, commands launched from QML, and directories nothing puts into service. Written against the broken tree first, where it found ten faults. Four of those were packages nobody had noticed were missing -- gnome-calendar, podman, pipewire-utils and flatpak -- alongside gnome-control-center, which backs fifteen rows of Panama's own Settings and is commented so it is not mistaken for GNOME-session residue later. Fonts turned out to need no install stage at all. Terra, which install-packages already enables, packages every Nerd Font, so sunhat's wget-and-unzip is replaced by five lines in a package list. The pointer theme had no such luck: it is packaged nowhere, so it is vendored rather than downloaded from a URL that can rot. espanso stays undeclared. It is in no enabled repository, and building it from source is the install method this repository is trying to stop using. Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1 |
||
|
Gabriel Brown
|
8f0fe23377 |
Add Software Update, across packages, applications and firmware
Three sources that fail independently, so they are counted and applied separately: a flatpak mirror being down says nothing about whether a kernel security fix is waiting. Blending them into one number would hide exactly the case that matters. Checking costs about nine seconds, which is too long to spend every time a page opens, so the page opens on the last result and says when it was taken. A first visit with nothing cached goes and finds out rather than showing a confident "up to date" it has no basis for. Installing packages takes a snapshot first, named after what is about to happen, so Snapshots shows "before 32 package updates" rather than a timestamp. Best effort: a machine without snapper still updates, because an update that refuses to run when a nicety fails would be worse than one without a restore point. Automatic updates cover applications only, through a Panama-owned user timer running daily with a randomized delay. Packages still ask, and dnf-automatic is reported as absent rather than offered, because installing software is not a settings action. Health gained a check, and that is where the bug was: it first returned status "degraded", which is not in the doctor's vocabulary of ok, warning, error and unconfigured. It was counted as nothing at all while the summary still said healthy -- the same silent no-op this codebase keeps relearning. A contract now asserts every status a check can return is one the doctor counts, and the doctor's own contract knows about the new check rather than failing on its arrival. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
2b3b762793 |
Install what the default-application roles are curated to
Seeding is deliberately conservative: a role whose preferred applications are all missing is left alone rather than forced. That is right, and it is also silent -- so a curated handler nobody installs presents as the machine quietly going back to deciding defaults by installation order, which is the problem seeding exists to fix. None of Loupe, Papers, Decibels, Nautilus, mpv or sushi was declared anywhere. Preview works, on org.gnome.NautilusPreviewer2 rather than the interface its bus name suggests, but it opened tiled -- shoving the file manager aside for something meant to be an overlay -- so it gets a float and center rule sized to leave the file underneath visible. xdg-utils and desktop-file-utils were undeclared too; seeding from link-dotfiles started calling them, and the dependency contract said so. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
b4ce148caf |
Give each default-application role a whole family of types
Every role carried a single representative type, so setting "Images" changed image/png and left image/jpeg wherever it landed. That is how this desktop ended up opening PDFs in GIMP, PNGs in a pixel-art editor and MP3s in a video transcoder: nobody chose any of it, applications registered themselves for everything they could read, and the roles governed one type each. Roles now own families and write every type when set, the settings page exposes the documents, text and archives roles it never offered, and a new seed command curates a fresh machine during setup while always keeping a choice the user has already made. The shipped editor entry launches kitty explicitly. The stock nvim.desktop sets Terminal=true, which defers to whatever the system considers default rather than the terminal this desktop themes. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
d96863b687 |
Convert British spellings to American across the repo
colour -> color, behaviour -> behavior, centre -> center, favourite -> favorite, and about twenty other pairs, applied consistently across comments, docs, error/UI copy, and a handful of QML identifiers that used the British spelling as their actual name: SystemSettings' serialiseValue/serialiseTable/normaliseGradient, Displays' normaliseModes, Wallpaper's normalisePolicy, SettingsBackup's serialiseHomeState, DateTime's ntpSynchronised property, Clipboard's _normalise helper, and ShortcutCapture's cancelled signal (with its onCancelled handler in ShortcutsPage.qml). Every call site and the two tests that assert on the literal source text (settings-ownership and settings-backup-live contracts) were updated in lockstep. Left untouched: config/dot/espanso/match/packages/misspell-en/ is a vendored third-party autocorrect dictionary -- its entries are typo corrections, not our prose, and rewriting them would fight the package's own purpose (and any future re-sync from upstream). The already-American `favorites` property (Home page pinned accessories) was never actually misspelled -- only nearby comments and error strings said "favourites" -- so no data migration was needed there. Claude-Session: https://claude.ai/code/session_01E6TJUAh41HaP25MVHWkhRZ |
||
|
Gabriel Brown
|
70d8d32ee2 |
Fix the install pipeline and an idle-lock startup race
The initial package list was quoted into a single bogus dnf argument and every dnf error was discarded, so a fresh install silently skipped most of it. Two package lists were never wired into the pipeline at all, and change-settings ran before install-packages, so the vicinae theme step was permanently skipped. Fixed the ordering, the quoting, and stopped swallowing errors. Separately, hypridle could start with its WAYLAND_DISPLAY condition unmet if it raced the env-publish call, silently never starting -- and it's the only listener for the logind Lock signal. Made the start wait on the environment synchronously. panama-idle also wrote its generated config to a fixed temp path with no locking, so concurrent applies could interleave into a corrupt file; switched to mktemp plus an atomic mv. Claude-Session: https://claude.ai/code/session_01E6TJUAh41HaP25MVHWkhRZ |
||
|
Gabriel Brown
|
2d69ce7648 |
Make the lock screen follow the colour scheme
hyprlock.conf shipped with Tokyo Night Moon hardcoded in six places, so choosing light mode left the lock screen dark. Every other surface had been taught to follow the scheme this week -- kitty, GTK, the launcher, btop, tmux, neovim -- and this was the one left, which is unfortunate, because it is the screen a user sees most often and the worst possible place to find a theming bug: you discover it while locked out of the machine and cannot fix it from there. It is now generated from a template on every scheme change, the same shape kitty, GTK, tmux and btop already use, and seeded by link-dotfiles so the first lock of a fresh install is themed rather than falling back to hyprlock's bare grey default. hyprlock is launched fresh on each lock (`pidof hyprlock || hyprlock`), so it picks the file up with no restart. The dark output is byte-identical to the file it replaces, ignoring comments -- verified by diff -- so nothing changes for anyone already in dark mode. One detail worth recording: hyprlock takes rgba(r, g, b, a) in DECIMAL, not hex, so the template carries "R, G, B" triples where every other theme file in this repository uses hex. Two values are the exception, sitting inside Pango markup where hyprlock wants ##rrggbb. Getting either wrong is not a parse error -- hyprlock ignores the value and uses its own default, silently. Which is why this has a contract. It generates both schemes into a fixture, never the live config, and checks that no placeholder survives substitution, that every colour is a well-formed decimal triple, that the Pango values are well-formed hex, that a light lock screen is actually light, and that the two schemes differ at all. Verified it catches a hardcoded colour left in the template and a light mode built from the dark palette, which is the original bug exactly. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
1f62256024 |
Make a fresh install actually produce a working desktop
Two things stood between this repository and a machine that could install it. The installer aborted on its own first question. The hostname prompt defaults to N, and the N branch ran `exit` -- so pressing Enter, the obvious answer when you do not want to rename your machine, skipped the entire installation and said nothing about it. Declining now just declines. The installer is also safe to re-run, which is the upgrade path too: it reports which stages failed instead of scrolling the failure past twenty minutes ago, and restores the idle settings on every exit path rather than only on success. The package lists had drifted badly from what the configs and helpers actually use. jq alone has thirty-one call sites across the helpers and the contracts; kitty has a full shipped config and a dock pin; tmux and btop have shipped themes the colour scheme switches; ddcutil, qrencode and orca back features added today. None were declared. Neither were fontconfig, pciutils, libselinux-utils, libnotify, wireplumber, fwupd or python3-dnf, all of which shipped scripts invoke by name. A fresh machine following this repository's own instructions would have got a desktop whose features quietly were not there -- the helpers report "not installed" rather than crashing, which is good behaviour and completely silent. So the lists are corrected and a contract now checks that every external command Panama's scripts invoke is installed by Panama's packages. Writing it was instructive about its own blind spots. The first version reported `then`, `esac` and `done` as missing packages, burying the real findings. The second passed while jq was undeclared, because the pattern required three characters and jq is two -- a dependency checker with a blind spot for short names is worse than none, since it reports PASS. The third missed ddcutil, which is only ever invoked as `timeout 10 ddcutil` and so never appears statement-initial. It now also reads `command -v X`, which is how these helpers probe for a tool and therefore the clearest statement of a dependency there is. Verified it catches jq, ddcutil and qrencode individually. Also replaced a fixed 0.3s sleep in the write contract with a bounded wait. It was failing about one run in three with "a rejected value did not surface an error" when the error had simply not arrived yet, which reads as a missing guard rather than a slow one. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
27af4fd443 |
Carry the colour scheme into btop and tmux
Two more applications that keep their own palette and so never followed the desktop. btop was on "Default" and had never been themed at all; tmux had Tokyo Night Moon hardcoded across seventeen lines, which meant a dark status bar sitting under a light terminal in light mode. Both themes are authored rather than borrowed. btop ships a "tokyo-night" theme, but it is the Night variant (#1a1b26) where the rest of this desktop is Moon (#222436), and two Tokyo Nights side by side read as a mistake; it ships no Tokyo Night light theme at all. Colours come from kitty's theme files so a terminal and what runs inside it cannot disagree. tmux follows kitty's shape: the colours move to themes/, tmux.conf sources a generated current-theme.conf, and running servers are re-sourced so an open session changes immediately rather than at next launch. btop is different -- it OWNS btop.conf and rewrites it on exit, so only the color_theme line is edited in place and the file is not symlinked into the repository. btop reads its theme once at startup, so a running instance keeps the old colours; forcing a restart would kill a process the user is watching. The tmux light theme took two passes. Mapping the palette role-for-role put the standard Day accents on a mid-grey panel at 2.74:1 and 2.94:1 -- under the 3:1 floor, on a bar you read at a glance. It now uses Day's darker accent variants on a lighter panel: 4.42:1 and 4.17:1, and 5.01:1 / 4.73:1 for the light text inside the inverted blocks. The helper also now reports every target rather than only kitty. Saying "kitty: applied" while silently skipping three other applications is how a half-applied theme goes unnoticed. Not changed: bat is configured with --theme ansi, which follows the terminal's own palette, so it already tracks kitty with nothing to do. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
f0321432b4 |
Fix dark mode: the GTK theme it asked for does not exist
Reported symptom: Electron applications and a Chromium-based browser, all set to follow the system, went light when the desktop went light and never came back. Nothing reported an error, and the portal was serving the correct value the whole time. Cause: ColorScheme set gtk-theme to "Adwaita-dark" for dark and "Adwaita" for light. Neither is installed on Fedora 44 -- only adw-gtk3 and adw-gtk3-dark are. GTK responds to an unknown theme name by falling back to its built-in default, which is LIGHT. So asking for light worked by accident, asking for dark silently produced light, and anything that takes its cue from the GTK theme rather than the portal stayed light no matter what org.freedesktop.appearance said. Verified: the portal emits correctly in both directions, so this was never the portal's fault. Second cause, the mirror of the first: gtk-3.0/settings.ini and gtk-4.0/settings.ini were pinned to adw-gtk3-dark and prefer-dark=1 and never regenerated. Under GNOME that file is ignored because gnome-settings-daemon publishes over XSETTINGS; under Hyprland nothing does, so for GTK3 it is authoritative -- and it contradicted the scheme in light mode. They are now generated from a template on every switch, gitignored as machine state, and seeded by link-dotfiles, the same shape kitty's current-theme.conf already uses. These directories are symlinked into the repository, so writing the live file directly would dirty the working tree on every theme switch. The failure was silent by construction, so it gets a test rather than a comment: gtk-theme-contract asserts every theme name Panama sets is actually installed, and that the generated GTK config agrees with the scheme in both directions. Verified it catches both original bugs. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
b1f9891849 |
Add multitasking controls, and a light theme for the launcher
Two things, both closing gaps in work that was already reported done. GNOME's Multitasking panel, in Hyprland's terms: tiling layout, split behaviour, floating-window snapping, workspace wrap-around and back-and-forth, whether applications may take focus, and whether the pointer changes the active display. Hyprland creates and destroys workspaces as you use them, so there is no fixed count to expose, and the page says so rather than leaving a conspicuous absence. The Desktop page described the first two of these as read-only facts -- "Layout: Tiling", "Workspace movement: Dynamic" -- which was never true. Both are ordinary Hyprland options that happened to have no controls, and TextRow's own documentation says a setting the user could reasonably change does not belong in it. Schema defaults are Panama's shipped values from looks.lua rather than Hyprland's own, so restoring defaults returns the desktop to how it ships. 43 mapped options now, from 35. The launcher had no light theme. vicinae.json already selected a theme per system appearance, but both entries pointed at Moon, so choosing light mode left the most frequently opened window on the desktop dark -- a hole in the light/dark work, not a missing feature. Day is authored from the same palette as the kitty Day theme so the two cannot drift, and link-dotfiles now installs every authored theme rather than only the dark one, which is why the gap survived being noticed. Its placeholder colour is not Tokyo Night Day's own: that measures 2.54:1 against the background, below the 3:1 floor for secondary text. This is 3.25:1, the same value used for neovim's light comments. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
19063a3e02 |
Carry the colour scheme into terminals and the editor
The scheme switch already reached everything that reads org.freedesktop.appearance -- GTK4, Qt6, Chromium, Electron -- because ColorScheme.qml writes the gsettings key those all watch. Applications carrying their own palettes did not follow, so choosing light mode left the two windows actually used all day, kitty and neovim, still dark. kitty: the 32 colours move out of kitty.conf into themes/, and kitty.conf ends with `include current-theme.conf`. The generated file is machine state rather than configuration, so it is gitignored and link-dotfiles seeds it on install -- otherwise a fresh checkout starts by complaining about a missing include. Running terminals are re-coloured in place over their control sockets; a restart is not needed. neovim: reads settings.json directly, since it neither watches the portal nor keeps a socket open. Tokyo Night ships Day in the same family as Moon, so light mode keeps the editor's identity instead of turning it into a different-looking application. The existing readability overrides were written against Moon and are now dark-only -- applied to Day they would have put light grey on a light background, the same problem they exist to fix, inverted. Light mode gets one override of its own: tokyonight's shipped comment colour measures 2.54:1 against Day's background, under the 3:1 floor for secondary text, so it is replaced with 3.25:1 -- readable, still dimmer than Normal's 4.52:1. An editor already open when the scheme flips re-applies on FocusGained, which is cheap and fires exactly when the mismatch would be noticed. Verified both directions: kitty re-coloured 4 live terminals, and neovim starts as tokyonight-day with background=light and tokyonight-moon with background=dark. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L |
||
|
Gabriel Brown
|
ca64d4b9b6 | Harden Panama launcher actions | ||
|
Gabriel Brown
|
b28edcd01f | Add Panama commands to the launcher |