Merge nucleic/lucid-lunar-wren-wxyw into dev

2026-07-21 01:19:00 -07:00
parent e48c604421
commit ee401ff5b4
16 changed files with 275 additions and 6 deletions
@@ -0,0 +1,14 @@
+Package: naros-desktop-config
+Version: @VERSION@
+Architecture: all
+Maintainer: Nucleic <[email protected]>
+Section: misc
+Priority: optional
+Depends: gdm3, dconf-cli, dbus, at-spi2-core, nash
+Description: narOS VM desktop configuration (NAROS.md §7.4 N5; LINUX_VM_SEMANTIC_AGENT.md)
+ The Nucleic desktop policy the old Ubuntu provisioner applied by hand, packaged:
+ the `agent` auto-login account (uid 501, nash shell, passwordless sudo), GDM
+ Wayland auto-login, system dconf defaults (AT-SPI on, integer scale = 1, no
+ idle/lock/blank, GNOME welcome suppressed, the Mutter geometry-helper extension
+ enabled), the geometry-helper GNOME Shell extension itself, QT_ACCESSIBILITY, and
+ boot-to-graphical. Installing it turns the naros base into the computer-use guest.
@@ -0,0 +1,32 @@
+# System-wide dconf defaults for the naros-vm desktop guest (NAROS.md §7.4 N5). Applied to the
+# auto-login agent session without a per-user seed. Ported from the old Ubuntu provisioner's
+# dconf block (docs/LINUX_VM_SEMANTIC_AGENT.md Phase 2). `dconf update` (postinst) compiles this.
+[org/gnome/desktop/interface]
+# Turn the AT-SPI bridge on for GTK/GNOME apps so the semantic agent sees their trees — the
+# whole point of the desktop flavor.
+toolkit-accessibility=true
+# Integer display scale = 1 (no fractional scaling): the invariant that makes the compositor's
+# window coordinates equal the virtio-gpu scanout pixels the host captures 1:1, so ax_dump
+# frames are directly clickable.
+scaling-factor=uint32 1
+
+[org/gnome/mutter]
+# Do NOT enable fractional scaling — keep logical == physical pixels.
+experimental-features=@as []
+
+[org/gnome/desktop/session]
+idle-delay=uint32 0
+
+[org/gnome/desktop/screensaver]
+lock-enabled=false
+idle-activation-enabled=false
+
+[org/gnome/settings-daemon/plugins/power]
+sleep-inactive-ac-type='nothing'
+sleep-inactive-battery-type='nothing'
+
+[org/gnome/shell]
+welcome-dialog-last-shown-version='99.0'
+disable-user-extensions=false
+# The Nucleic Mutter geometry helper (focused-window global origin for the AT-SPI agent).
+enabled-extensions=['[email protected]']
@@ -0,0 +1,2 @@
+user-db:user
+system-db:local
@@ -0,0 +1,4 @@
+# Qt apps read this to enable their AT-SPI bridge (GTK does so automatically once the a11y bus
+# is up). systemd's user session sources /etc/environment.d/*.conf into the graphical session.
+# Chromium/Electron still need a per-launch --force-renderer-accessibility (the agent handles it).
+QT_ACCESSIBILITY=1
@@ -0,0 +1,3 @@
+# narOS agent user (NAROS.md §6.1): frictionless escalation for `apt install` etc.,
+# non-interactive. The disposable, NAT-isolated VM is the isolation boundary.
+agent ALL=(ALL) NOPASSWD:ALL
@@ -0,0 +1,42 @@
+#!/bin/sh
+# Realize the naros-vm desktop policy (NAROS.md §7.4 N5). Runs at image-build configure time in
+# the mmdebstrap chroot (no running systemd) — every step is offline-safe.
+set -e
+[ "$1" = "configure" ] || exit 0
+
+# 1. The narOS `agent` user GDM auto-logs into. uid 501 is in lockstep with the sandbox/agent
+#    tiers (the uid ContainerEngine execs as); login shell is the contract nash path.
+if ! id -u agent >/dev/null 2>&1; then
+  useradd --uid 501 --user-group --create-home --home-dir /home/agent \
+    --shell /usr/local/bin/nash agent
+fi
+for g in video input render sudo; do
+  getent group "$g" >/dev/null 2>&1 && usermod -aG "$g" agent || true
+done
+passwd -l agent >/dev/null 2>&1 || true   # auto-login only, no password
+
+# 2. sudoers drop-in must be 0440 (git can't track that mode).
+chmod 0440 /etc/sudoers.d/naros-agent 2>/dev/null || true
+
+# 3. GDM auto-login into the agent's Wayland session, so the host surface sees a live screen.
+#    (Debian gdm3 reads /etc/gdm3/daemon.conf; we own the desktop policy, so write it whole.)
+mkdir -p /etc/gdm3
+cat > /etc/gdm3/daemon.conf <<'GDM'
+[daemon]
+WaylandEnable=true
+AutomaticLoginEnable=true
+AutomaticLogin=agent
+GDM
+
+# 4. Compile the system dconf defaults (AT-SPI on, scale=1, no idle/lock, geometry ext enabled).
+dconf update 2>/dev/null || true
+
+# 5. Boot to the graphical session.
+systemctl set-default graphical.target >/dev/null 2>&1 || true
+
+# 6. Skip GNOME's first-run tour so the first host screenshot is a usable desktop.
+mkdir -p /home/agent/.config
+echo yes > /home/agent/.config/gnome-initial-setup-done
+chown -R agent:agent /home/agent/.config 2>/dev/null || true
+
+exit 0
@@ -0,0 +1,11 @@
+# Stage the Mutter geometry-helper GNOME Shell extension (guest/mutter-geometry-helper) into
+# the system extensions dir. It exposes the focused window's true global origin over a private
+# D-Bus name for the AT-SPI agent (AT-SPI loses the window origin on Wayland) — enabled via the
+# dconf default in files/etc/dconf/db/local.d/00-nucleic. Arch-independent (JS + metadata).
+stage() {
+  local dest="$1"
+  local ext="$dest/usr/share/gnome-shell/extensions/[email protected]"
+  local src="$OS_DIR/../guest/mutter-geometry-helper"
+  install -D -m 0644 "$src/metadata.json" "$ext/metadata.json"
+  install -D -m 0644 "$src/extension.js" "$ext/extension.js"
+}