fix(nix/greeter): skip invalid customThemeFile in preStart (#1997)

* fix(nix/greeter): skip invalid customThemeFile in preStart

Avoid attempting to copy a null/empty/missing customThemeFile path by validating the jq result and file existence before cp.

Update distro/nix/greeter.nix

Co-authored-by: Lucas <43530291+LuckShiba@users.noreply.github.com>

* nix/greeter: update customTheme verification

---------

Co-authored-by: Lucas <43530291+LuckShiba@users.noreply.github.com>
Co-authored-by: LuckShiba <luckshiba@protonmail.com>

distro/nix/greeter.nix

@@ -24,6 +24,7 @@ let
       lib.makeBinPath [
         cfg.quickshell.package
         compositorPackage
+        pkgs.glib  # provides gdbus, used by the fprintd hardware probe in GreeterContent.qml
       ]
     }
     ${
@@ -195,7 +196,9 @@ in
       fi
 
       if [ -f settings.json ]; then
-          if cp "$(${jq} -r '.customThemeFile' settings.json)" custom-theme.json; then
+          theme_file="$(${jq} -r '.customThemeFile // empty' settings.json)"
+          if [ -f "$theme_file" ] && [ -r "$theme_file" ]; then
+              cp "$theme_file" custom-theme.json
               mv settings.json settings.orig.json
               ${jq} '.customThemeFile = "${cacheDir}/custom-theme.json"' settings.orig.json > settings.json
           fi

distro/nix/niri.nix

@@ -2,11 +2,9 @@
   config,
   lib,
   ...
-}:
-let
+}: let
   cfg = config.programs.dank-material-shell;
-in
-{
+in {
   imports = [
     ./dms-rename.nix
   ];
@@ -16,9 +14,11 @@ in
       enableKeybinds = lib.mkEnableOption "DankMaterialShell niri keybinds";
       enableSpawn = lib.mkEnableOption "DankMaterialShell niri spawn-at-startup";
       includes = {
-        enable = (lib.mkEnableOption "includes for niri-flake") // {
-          default = true;
-        };
+        enable =
+          (lib.mkEnableOption "includes for niri-flake")
+          // {
+            default = true;
+          };
         override = lib.mkOption {
           type = lib.types.bool;
           description = ''
@@ -44,8 +44,10 @@ in
             "alttab"
             "binds"
             "colors"
+            "cursor"
             "layout"
             "outputs"
+            "windowrules"
             "wpblur"
           ];
           example = [
@@ -70,24 +72,21 @@ in
       let
         cfg' = cfg.niri.includes;
 
-        withOriginalConfig =
-          dmsFiles:
-          if cfg'.override then
-            [ cfg'.originalFileName ] ++ dmsFiles
-          else
-            dmsFiles ++ [ cfg'.originalFileName ];
+        withOriginalConfig = dmsFiles:
+          if cfg'.override
+          then [cfg'.originalFileName] ++ dmsFiles
+          else dmsFiles ++ [cfg'.originalFileName];
 
         fixes = map (fix: "\n${fix}") (
           lib.optional (cfg'.enable && config.programs.niri.settings.layout.border.enable)
-            # kdl
-            ''
-              // Border fix
-              // See https://yalter.github.io/niri/Configuration%3A-Include.html#border-special-case for details
-              layout { border { on; }; }
-            ''
+          # kdl
+          ''
+            // Border fix
+            // See https://yalter.github.io/niri/Configuration%3A-Include.html#border-special-case for details
+            layout { border { on; }; }
+          ''
         );
-      in
-      {
+      in {
         niri-config.target = lib.mkForce "niri/${cfg'.originalFileName}.kdl";
         niri-config-dms = {
           target = "niri/config.kdl";
@@ -104,11 +103,9 @@ in
 
     programs.niri.settings = lib.mkMerge [
       (lib.mkIf cfg.niri.enableKeybinds {
-        binds =
-          with config.lib.niri.actions;
-          let
-            dms-ipc = spawn "dms" "ipc";
-          in
+        binds = with config.lib.niri.actions; let
+          dms-ipc = spawn "dms" "ipc";
+        in
           {
             "Mod+Space" = {
               action = dms-ipc "spotlight" "toggle";

quickshell/Modules/Greetd/GreeterContent.qml

@@ -56,7 +56,10 @@ Item {
     property string externalAuthAutoStartedForUser: ""
     property int passwordSessionTransitionRetryCount: 0
     property int maxPasswordSessionTransitionRetries: 2
-    readonly property bool greeterPamHasFprint: greeterPamStackHasModule("pam_fprintd")
+    property bool fprintdProbeComplete: false
+    property bool fprintdHasDevice: false
+    // Falls back to PAM-only detection until the fprintd D-Bus probe completes.
+    readonly property bool greeterPamHasFprint: greeterPamStackHasModule("pam_fprintd") && (!fprintdProbeComplete || fprintdHasDevice)
     readonly property bool greeterPamHasU2f: greeterPamStackHasModule("pam_u2f")
     readonly property bool greeterExternalAuthAvailable: (greeterPamHasFprint && GreetdSettings.greeterEnableFprint) || (greeterPamHasU2f && GreetdSettings.greeterEnableU2f)
     readonly property bool greeterPamHasExternalAuth: greeterPamHasFprint || greeterPamHasU2f
@@ -430,6 +433,8 @@ Item {
 
         if (CompositorService.isHyprland)
             updateHyprlandLayout();
+
+        fprintdDeviceProbe.running = true;
     }
 
     function applyLastSuccessfulUser() {
@@ -527,9 +532,8 @@ Item {
         pendingPasswordResponse = false;
         passwordSubmitRequested = submitPassword;
         awaitingExternalAuth = !submitPassword && !hasPasswordBuffer && root.greeterExternalAuthAvailable;
-        // Included PAM stacks (system-auth/common-auth/password-auth) may still run
-        // biometric/U2F modules before password even when DMS toggles are off.
-        const waitingOnPamExternalBeforePassword = submitPassword && root.greeterPamHasExternalAuth;
+        // Use greeterExternalAuthAvailable so systems with pam_fprintd but no hardware don't incur the 30 s wait.
+        const waitingOnPamExternalBeforePassword = submitPassword && root.greeterExternalAuthAvailable;
         authTimeout.interval = (awaitingExternalAuth || waitingOnPamExternalBeforePassword) ? externalAuthTimeoutMs : defaultAuthTimeoutMs;
         authTimeout.restart();
         Greetd.createSession(GreeterState.username);
@@ -599,6 +603,34 @@ Item {
         }
     }
 
+    // Probe fprintd D-Bus for physically enrolled scanners to eliminate PAM stack false-positives.
+    Process {
+        id: fprintdDeviceProbe
+        running: false
+        // sh wrapper: emits PROBE_UNAVAILABLE if gdbus is absent or fprintd unreachable,
+        // keeping the PAM-only fallback active in those cases.
+        command: ["sh", "-c",
+                  "command -v gdbus >/dev/null 2>&1 || { echo PROBE_UNAVAILABLE; exit 0; }; " +
+                  "gdbus call --system " +
+                  "--dest net.reactivated.Fprint " +
+                  "--object-path /net/reactivated/Fprint/Manager " +
+                  "--method net.reactivated.Fprint.Manager.GetDevices 2>/dev/null " +
+                  "|| echo PROBE_UNAVAILABLE"]
+        stdout: StdioCollector {
+            onStreamFinished: {
+                if (text.includes("PROBE_UNAVAILABLE"))
+                    return; // PAM-only fallback stays active
+                root.fprintdHasDevice = text.includes("objectpath");
+                root.fprintdProbeComplete = true;
+                root.maybeAutoStartExternalAuth();
+            }
+        }
+        onExited: function(exitCode, exitStatus) {
+            if (!root.fprintdProbeComplete)
+                root.maybeAutoStartExternalAuth(); // PAM-only fallback stays active
+        }
+    }
+
     Connections {
         target: CompositorService.isHyprland ? Hyprland : null
         enabled: CompositorService.isHyprland

quickshell/Modules/Greetd/assets/dms-greeter

@@ -224,6 +224,19 @@ export XDG_STATE_HOME="$CACHE_DIR/.local/state"
 export XDG_DATA_HOME="$CACHE_DIR/.local/share"
 export XDG_CACHE_HOME="$CACHE_DIR/.cache"
 
+# Propagate correct XDG dirs into the systemd user session so socket-activated
+# services (e.g. wireplumber) don't inherit HOME=/ from /etc/passwd.
+if command -v systemctl >/dev/null 2>&1; then
+    systemctl --user set-environment \
+        HOME="$CACHE_DIR" \
+        XDG_STATE_HOME="$CACHE_DIR/.local/state" \
+        XDG_DATA_HOME="$CACHE_DIR/.local/share" \
+        XDG_CACHE_HOME="$CACHE_DIR/.cache" 2>/dev/null || true
+    if systemctl --user is-active --quiet wireplumber.service 2>/dev/null; then
+        systemctl --user restart wireplumber.service 2>/dev/null || true
+    fi
+fi
+
 # Keep greeter VT clean by default; callers can override via env or --debug.
 if [[ -z "${RUST_LOG:-}" ]]; then
     export RUST_LOG=warn
@@ -336,6 +349,7 @@ misc {
     disable_hyprland_logo = true
 }
 
+exec-once = systemctl --user import-environment HOME XDG_STATE_HOME XDG_DATA_HOME XDG_CACHE_HOME 2>/dev/null || true
 exec-once = sh -c "$QS_CMD; hyprctl dispatch exit"
 HYPRLAND_EOF
             COMPOSITOR_CONFIG="$TEMP_CONFIG"
@@ -348,6 +362,7 @@ env = HOME,$CACHE_DIR
 env = XDG_STATE_HOME,$CACHE_DIR/.local/state
 env = XDG_DATA_HOME,$CACHE_DIR/.local/share
 env = XDG_CACHE_HOME,$CACHE_DIR/.cache
+exec-once = systemctl --user import-environment HOME XDG_STATE_HOME XDG_DATA_HOME XDG_CACHE_HOME 2>/dev/null || true
 exec-once = sh -c "$QS_CMD; hyprctl dispatch exit"
 HYPRLAND_EOF
             COMPOSITOR_CONFIG="$TEMP_CONFIG"