From 0eaf97d13432089971d41d7b5363304d123c7433 Mon Sep 17 00:00:00 2001
From: rope <fredrik@nordhammer.it>
Date: Mon, 14 Sep 2026 19:37:31 +0100
Subject: [PATCH] Make boot greeter frameless and match Gaming display mode

---
 docs/failure-path-fixes.md      |  4 ++++
 scripts/greeter-check.py        | 24 ++++++++++++++++++++++--
 settings/auth.nix               | 20 +++++++++++++++++++-
 settings/quickshell/Greeter.qml |  2 ++
 4 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/docs/failure-path-fixes.md b/docs/failure-path-fixes.md
index 0ae7ede..4f41db7 100644
--- a/docs/failure-path-fixes.md
+++ b/docs/failure-path-fixes.md
@@ -61,6 +61,10 @@ nix eval --raw path:.#nixosConfigurations.FredOS-Mediaserver.config.networking.n
 
 The new greeter takes effect on the next login or boot. It supports the configured password authentication; unusual PAM conversations such as forced password changes require a text console. The independent locker starts on the first lock request. Restarting that locker reacquires the lock, while ordinary bar reloads leave it alone.
 
+The boot greeter explicitly disables window decorations and rejects window-close requests. On Gaming, its Cage client applies the first desktop monitor rule's output, mode and scale before launching Quickshell (currently DP-3, 3440x1440 at 180 Hz, scale 1). This avoids maintaining separate greeter and desktop mode settings. The mode command is bounded to five seconds plus a one-second kill grace; an unavailable connector or mode is logged and login continues using Cage's current mode. MacBook retains its preferred-mode behavior. Switching compositors can still cause a brief display transition.
+
+The greeter test verifies close rejection, frameless flags, password failure/retry and authenticated exit. The generated Gaming client was also checked with successful and failed mode-command fixtures to verify ordering and fallback. Both desktop configurations evaluate and both auth bundles build; the physical 180 Hz handover still needs checking on Gaming after deployment.
+
 If media storage is unavailable, restore and verify the missing disks first, then start the affected media services. Their dependencies retry mounts and directory preparation. Services deliberately stay stopped after losing storage; they do not automatically resume merely because a disk returns. Inspect `journalctl -u media-storage-ready` and `systemctl status mnt-storage.mount` when diagnosing this.
 
 The shared deployment transaction is documented separately in [deployment.md](deployment.md).
diff --git a/scripts/greeter-check.py b/scripts/greeter-check.py
index 76d4523..227ec64 100644
--- a/scripts/greeter-check.py
+++ b/scripts/greeter-check.py
@@ -21,7 +21,14 @@ s = (
 )
 s = (
     s.rstrip()[:-1]
-    + """    IpcHandler { target: "test"; function submit(password: string): void { auth.submitted(password); } }
+    + """    IpcHandler {
+        target: "test"
+        function submit(password: string): void { auth.submitted(password); }
+        function closeCheck(): bool {
+            root.close();
+            return root.visible && (root.flags & Qt.FramelessWindowHint) !== 0;
+        }
+    }
 }
 """
 )
@@ -62,6 +69,19 @@ try:
         data = json.dumps(value).encode()
         conn.sendall(struct.pack("<I", len(data)) + data)
 
+    for _ in range(30):
+        result = sp.run(
+            [qs, "ipc", "--pid", str(proc.pid), "call", "test", "closeCheck"],
+            env=env, capture_output=True, text=True,
+        )
+        if result.returncode == 0:
+            assert result.stdout.strip() == "true", result.stdout
+            break
+        time.sleep(0.1)
+    else:
+        raise AssertionError(result.stderr)
+    assert proc.poll() is None, "Closing the greeter must not exit it"
+
     def submit():
         for _ in range(30):
             result = sp.run(
@@ -120,7 +140,7 @@ try:
             send({"type": "success"})
             time.sleep(0.3)
     print(
-        "Greeter: failed password does not launch; retry and authenticated launch pass"
+        "Greeter: frameless window rejects close; failed password does not launch; retry and authenticated launch pass"
     )
 finally:
     proc.terminate()
diff --git a/settings/auth.nix b/settings/auth.nix
index b5e1532..c1f1282 100644
--- a/settings/auth.nix
+++ b/settings/auth.nix
@@ -10,6 +10,23 @@ let
     { name = "qmldir"; path = pkgs.writeText "qmldir" "singleton Theme 1.0 Theme.qml\nAuthView 1.0 AuthView.qml\n"; }
   ];
   greeter = bundle "fred-greeter" ./quickshell/Greeter.qml;
+  # Reuse the desktop's explicit mode instead of keeping a second 180 Hz
+  # setting here. The MacBook uses automatic/preferred output configuration.
+  gamingMonitor = builtins.head config.home-manager.users.fred.wayland.windowManager.hyprland.settings.monitor;
+  greeterClient = pkgs.writeShellScript "fred-greeter-client" ''
+    ${lib.optionalString (config.networking.hostName == "FredOS-Gaming") ''
+      # Run inside Cage, where its Wayland output-management socket exists.
+      # A missing connector or unsupported mode must not prevent login.
+      if ! ${pkgs.coreutils}/bin/timeout -k 1s 5s ${pkgs.wlr-randr}/bin/wlr-randr \
+        --output ${lib.escapeShellArg gamingMonitor.output} \
+        --mode ${lib.escapeShellArg gamingMonitor.mode} \
+        --scale ${lib.escapeShellArg (toString gamingMonitor.scale)}; then
+        echo "Greeter: desktop display mode unavailable; keeping Cage's current mode" >&2
+      fi
+    ''}
+    export QT_WAYLAND_DISABLE_WINDOWDECORATION=1
+    exec ${pkgs.quickshell}/bin/qs -p ${greeter}
+  '';
   locker = bundle "fred-lock" ./quickshell/SessionLock.qml;
   session = pkgs.writeShellScript "hyprland-session" ''
     exec ${config.programs.hyprland.package}/bin/start-hyprland >/dev/null 2>&1
@@ -25,6 +42,7 @@ in {
       { name = "greeter"; path = greeter; }
       { name = "lock"; path = locker; }
       { name = "bin"; path = "${lockCommand}/bin"; }
+      { name = "greeter-client"; path = greeterClient; }
     ];
     services.greetd = {
       enable = true;
@@ -37,7 +55,7 @@ in {
           export QML2_IMPORT_PATH=${pkgs.qt6.qt5compat}/lib/qt-6/qml
           export XKB_DEFAULT_LAYOUT=gb,no
           export XKB_DEFAULT_OPTIONS=${lib.escapeShellArg ("grp:win_space_toggle" + lib.optionalString (config.networking.hostName == "FredOS-Gaming") ",altwin:swap_lalt_lwin")}
-          exec ${pkgs.dbus}/bin/dbus-run-session -- ${pkgs.cage}/bin/cage -s -- ${pkgs.quickshell}/bin/qs -p ${greeter}
+          exec ${pkgs.dbus}/bin/dbus-run-session -- ${pkgs.cage}/bin/cage -s -- ${greeterClient}
         '');
       };
     };
diff --git a/settings/quickshell/Greeter.qml b/settings/quickshell/Greeter.qml
index 4d0821f..9452af8 100644
--- a/settings/quickshell/Greeter.qml
+++ b/settings/quickshell/Greeter.qml
@@ -7,6 +7,8 @@ Window {
     id: root
     visible: true
     visibility: Window.FullScreen
+    flags: Qt.Window | Qt.FramelessWindowHint
+    onClosing: close => { close.accepted = false; }
     color: "black"
     property string password: ""
     property string errorMessage: ""