fix: Add single user no password option with SDDM, fetch newest Vapor presets

- One wizard question: "single user, no password, like SteamOS" switches
  to SDDM (autologin via CachyOS's own steam-set-session, no workarounds)
  and removes lock screen, user switching and log out (launcher shows only
  Sleep/Restart/Shut Down; Meta+L and Ctrl+Alt+Del unbound). Declining
  keeps the current login manager and KDE's defaults
- Look up the newest steamdeck-kde-presets from Valve's release repos and
  verify its SHA-256; take over the new SteamOS 3.9 defaults
- Restart plasmashell through systemd so the desktop keeps the session's
  dark theme; drop the bundled icon in favour of Valve's and Steam's
- README and AGENTS.md updated

lib/common.sh

@@ -26,6 +26,18 @@ require_root_helper() {
     fi
 }
 
+plasma_applets() {
+    # Print "containment:applet" for every applet of plugin $1 in the
+    # user's Plasma layout, for kwriteconfig6 --group paths.
+    local conf="$HOME/.config/plasma-org.kde.plasma.desktop-appletsrc"
+    [[ -f "$conf" ]] || return 0
+    awk -v plugin="$1" '
+        /^\[Containments\]\[[0-9]+\]\[Applets\]\[[0-9]+\]$/ { split($0, p, /[][]+/); sect = p[3] ":" p[5] }
+        /^\[/ && !/\]\[Applets\]\[[0-9]+\]$/ { sect = "" }
+        $0 == "plugin=" plugin && sect != "" { print sect }
+    ' "$conf"
+}
+
 backup_file() {
     local f="$1"
     if [[ -f "$f" && ! -f "${f}.bak-gamescope-wizard" ]]; then

lib/desktop-shortcut.sh

@@ -17,21 +17,29 @@ create_desktop_shortcut() {
 
     mkdir -p "$desktop_dir"
 
-    # Let the shortcut restart the login manager without a password prompt
-    # (it runs with Terminal=false, so sudo can't ask). Scoped to exactly
-    # the two commands the shortcut needs, for this user only.
-    local sudoers_tmp
-    sudoers_tmp="$(mktemp)"
-    cat > "$sudoers_tmp" << EOF
+    # On SDDM, steamos-session-select logging out is enough: Relogin=true
+    # logs straight back in to the newly selected session, like SteamOS.
+    # plasma-login-manager needs the sync bridge run and a restart, which
+    # the shortcut can't sudo for interactively (Terminal=false), so it gets
+    # a password-less rule scoped to exactly those two commands.
+    local exec_line="steamos-session-select gamescope"
+    if [[ "$LOGIN_MANAGER" == "plasmalogin" ]]; then
+        exec_line="sh -c 'steamos-session-select gamescope && sudo -n /usr/bin/systemctl start sync-steamos-session.service && sudo -n /usr/bin/systemctl restart plasmalogin'"
+        local sudoers_tmp
+        sudoers_tmp="$(mktemp)"
+        cat > "$sudoers_tmp" << EOF
 $TARGET_USER ALL=(root) NOPASSWD: /usr/bin/systemctl start sync-steamos-session.service, /usr/bin/systemctl restart plasmalogin
 EOF
-    if sudo visudo -cf "$sudoers_tmp" >/dev/null; then
-        sudo install -m 0440 -o root -g root "$sudoers_tmp" /etc/sudoers.d/gamescope-session-switch
-        ok "Installed /etc/sudoers.d/gamescope-session-switch for the shortcut."
+        if sudo visudo -cf "$sudoers_tmp" >/dev/null; then
+            sudo install -m 0440 -o root -g root "$sudoers_tmp" /etc/sudoers.d/gamescope-session-switch
+            ok "Installed /etc/sudoers.d/gamescope-session-switch for the shortcut."
+        else
+            warn "Generated sudoers rule failed validation; the shortcut will not be able to restart plasmalogin."
+        fi
+        rm -f "$sudoers_tmp"
     else
-        warn "Generated sudoers rule failed validation; the shortcut will not be able to restart plasmalogin."
+        sudo rm -f /etc/sudoers.d/gamescope-session-switch
     fi
-    rm -f "$sudoers_tmp"
 
     # SteamOS itself uses Valve's "gaming-return" icon (Steam logo with a
     # return arrow; the Deck-style arrow is only used on Steam Deck
@@ -48,7 +56,7 @@ EOF
 [Desktop Entry]
 Name=Return to Gaming Mode
 Comment=Switch session back to Gamescope
-Exec=sh -c 'steamos-session-select gamescope && sudo -n /usr/bin/systemctl start sync-steamos-session.service && sudo -n /usr/bin/systemctl restart plasmalogin'
+Exec=$exec_line
 Icon=$shortcut_icon
 Terminal=false
 Type=Application

lib/login-manager.sh

@@ -4,21 +4,113 @@
 
 BASE_CONF="/etc/plasmalogin.conf"
 
-check_display_manager() {
-    # Step 1: warn when the login manager is not plasma-login-manager.
-    local DM
-    DM="$(systemctl show -p Id --value display-manager 2>/dev/null | sed 's/\.service$//')"
-    info "Detected display manager: ${DM:-none}"
+choose_setup_mode() {
+    # Step 1: one question decides both the login manager and locking.
+    # "Single user, no password" is SteamOS: SDDM (which CachyOS's session
+    # tools support directly, no workarounds) plus no lock screen, user
+    # switching or log out. Otherwise keep the current login manager
+    # (CachyOS's default plasma-login-manager gets the sync bridge below)
+    # and KDE's normal locking. Sets SINGLE_USER and LOGIN_MANAGER.
+    local current
+    current="$(systemctl show -p Id --value display-manager 2>/dev/null | sed 's/\.service$//')"
+    info "Detected display manager: ${current:-none}"
 
-    if [[ "$DM" != "plasmalogin" ]]; then
-        warn "This wizard was built and tested against plasma-login-manager (plasmalogin)."
-        warn "Detected display manager is '${DM:-unknown}'. SDDM setups don't need"
-        warn "most of these workarounds (SDDM's own Autologin works out of the box);"
-        warn "this script will still try, but review the output carefully."
+    echo "SteamOS is a single-user console without passwords: no login screen, no"
+    echo "lock screen, no user switching or logging out - typing a password with a"
+    echo "controller is no fun. It uses the SDDM login manager for that."
+    if ask_yn "Single user, no password, like SteamOS? (switches to SDDM)" y; then
+        SINGLE_USER=true
+        LOGIN_MANAGER="sddm"
+        return
+    fi
+
+    SINGLE_USER=false
+    if [[ "$current" == "sddm" ]]; then
+        LOGIN_MANAGER="sddm"
+        return
+    fi
+    LOGIN_MANAGER="plasmalogin"
+    if [[ "$current" != "plasmalogin" ]]; then
+        warn "The workarounds are built for plasma-login-manager, but '${current:-unknown}' is active."
         ask_yn "Continue anyway?" n || exit 0
     fi
 }
 
+setup_login_manager() {
+    # Steps 3-8 for whichever login manager was chosen in step 1.
+    case "$LOGIN_MANAGER" in
+        sddm)
+            switch_to_sddm || exit 1
+            configure_sddm_autologin
+            remove_session_sync
+            ;;
+        plasmalogin)
+            configure_autologin
+            install_session_sync
+            ;;
+    esac
+}
+
+switch_to_sddm() {
+    # Takes effect at the next boot; the running session is left alone.
+    info "Installing and enabling SDDM..."
+    sudo pacman -S --needed --noconfirm sddm || { err "Installing sddm failed."; return 1; }
+    local current
+    current="$(systemctl show -p Id --value display-manager 2>/dev/null)"
+    if [[ -n "$current" && "$current" != "sddm.service" ]]; then
+        sudo systemctl disable "$current"
+    fi
+    sudo systemctl enable -f sddm.service || { err "Enabling sddm failed."; return 1; }
+    ok "SDDM is the login manager from the next boot on."
+    echo
+}
+
+configure_sddm_autologin() {
+    # User= and Relogin= live in our own fragment; steam-set-session keeps
+    # Session= up to date in zz-steamos-autologin.conf, which sorts later
+    # and so wins. /etc/sddm.conf is read last, so any [Autologin] there
+    # would override both and is removed.
+    local conf="/etc/sddm.conf.d/10-gamescope-autologin.conf"
+    info "Configuring SDDM autologin for $TARGET_USER into gamescope (Relogin=true)"
+    sudo mkdir -p /etc/sddm.conf.d
+    sudo tee "$conf" > /dev/null << EOF
+[Autologin]
+User=$TARGET_USER
+Session=gamescope-session.desktop
+Relogin=true
+EOF
+
+    if [[ -f /etc/sddm.conf ]] && grep -q '^\[Autologin\]' /etc/sddm.conf; then
+        backup_file /etc/sddm.conf
+        sudo awk '
+            /^\[Autologin\]/ { skip=1; next }
+            /^\[/ { skip=0 }
+            !skip { print }
+        ' /etc/sddm.conf | sudo tee /etc/sddm.conf.tmp > /dev/null &&
+            sudo mv /etc/sddm.conf.tmp /etc/sddm.conf
+        info "Removed [Autologin] from /etc/sddm.conf (backup kept)."
+    fi
+
+    # Start in gamescope, through CachyOS's own tool so its file is current.
+    sudo /usr/lib/steamos/steam-set-session gamescope-session.desktop
+
+    ok "SDDM autologin configured:"
+    cat "$conf"
+    echo
+}
+
+remove_session_sync() {
+    # The plasmalogin sync bridge from an earlier run isn't needed on SDDM.
+    if [[ -f /etc/systemd/system/sync-steamos-session.path ]]; then
+        info "Removing the plasma-login-manager sync bridge (not needed with SDDM)..."
+        sudo systemctl disable --now sync-steamos-session.path 2>/dev/null
+        sudo rm -f /etc/systemd/system/sync-steamos-session.path \
+            /etc/systemd/system/sync-steamos-session.service \
+            /usr/local/bin/sync-steamos-session.sh
+        sudo systemctl daemon-reload
+    fi
+}
+
 configure_autologin() {
     # Steps 3-5: plasmalogin.conf.d, the base [Autologin] section, stray fragments.
     # 3. Ensure plasmalogin.conf.d exists (fixes Switch-to-Desktop crash)

lib/steam-desktop.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
-# Steam in the Plasma desktop session: gamepad UI args, virtual keyboard, autostart.
+# Steam in the Plasma desktop session: gamepad UI args, virtual keyboard,
+# autostart, and no screen locking (like SteamOS).
 # Sourced by setup-gamescope-boot.sh; not meant to be run on its own.
 
 setup_steam_desktop() {
@@ -52,3 +53,71 @@ EOF
 
     ok "Steam UI parameters and keyboard autostart deployed successfully."
 }
+
+setup_single_user() {
+    # With SINGLE_USER (chosen in step 1), like SteamOS: one user and no
+    # password prompts, since typing a password with a controller is
+    # miserable. Hides Lock / Switch User / Log Out
+    # everywhere (launcher, Meta+L, Ctrl+Alt+Del) and never locks on idle or
+    # resume; "Return to Gaming Mode" is the way out of the desktop. Declining
+    # restores KDE's defaults.
+    local action allow=true
+    [[ "$SINGLE_USER" == true ]] && allow=false
+    for action in lock_screen switch_user start_new_session; do
+        kwriteconfig6 --file kdeglobals --group "KDE Action Restrictions" --key "action/$action" "$allow"
+    done
+    if [[ "$allow" == false ]]; then
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key Autolock false
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key LockOnResume false
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key Timeout 0
+        # The action restriction hides Lock in menus but not the Meta+L
+        # shortcut; unbind it (format: current,default,description).
+        kwriteconfig6 --file kglobalshortcutsrc --group ksmserver --key "Lock Session" \
+            $'none,Screensaver\tMeta+L,Lock Session'
+        kwriteconfig6 --file kglobalshortcutsrc --group ksmserver --key "Log Out" \
+            'none,Ctrl+Alt+Del,Show Logout Screen'
+        set_launcher_leave_buttons single
+        ok "Screen locking, user switching and logging out disabled."
+    else
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key Autolock --delete
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key LockOnResume --delete
+        kwriteconfig6 --file kscreenlockerrc --group Daemon --key Timeout --delete
+        kwriteconfig6 --file kglobalshortcutsrc --group ksmserver --key "Lock Session" \
+            $'Screensaver\tMeta+L,Screensaver\tMeta+L,Lock Session'
+        kwriteconfig6 --file kglobalshortcutsrc --group ksmserver --key "Log Out" \
+            'Ctrl+Alt+Del,Ctrl+Alt+Del,Show Logout Screen'
+        set_launcher_leave_buttons default
+        ok "Keeping KDE's normal screen locking and user switching."
+    fi
+}
+
+set_launcher_leave_buttons() {
+    # "single": only Sleep / Restart / Shut Down buttons in the launcher, no
+    # Session dropdown (that's where Log Out lives). Restricting the
+    # "logout" action instead would also hide Restart and Shut Down.
+    # "default": Plasma's own buttons.
+    local mode="$1" applet
+    for applet in $(plasma_applets org.kde.plasma.kickoff); do
+        local -a grp=(--file plasma-org.kde.plasma.desktop-appletsrc --group Containments
+            --group "${applet%%:*}" --group Applets --group "${applet#*:}"
+            --group Configuration --group General)
+        if [[ "$mode" == single ]]; then
+            kwriteconfig6 "${grp[@]}" --key primaryActions 3
+            kwriteconfig6 "${grp[@]}" --key systemFavorites 'suspend,reboot,shutdown'
+        else
+            kwriteconfig6 "${grp[@]}" --key primaryActions --delete
+            kwriteconfig6 "${grp[@]}" --key systemFavorites --delete
+        fi
+    done
+    if pgrep -u "$USER" -x plasmashell >/dev/null; then
+        local js
+        if [[ "$mode" == single ]]; then
+            js="w.writeConfig('primaryActions', 3); w.writeConfig('systemFavorites', 'suspend,reboot,shutdown');"
+        else
+            js="w.writeConfig('primaryActions', 0); w.writeConfig('systemFavorites', 'suspend,hibernate,reboot,shutdown');"
+        fi
+        qdbus6 org.kde.plasmashell /PlasmaShell org.kde.PlasmaShell.evaluateScript \
+            "panels().forEach(function (p) { p.widgets('org.kde.plasma.kickoff').forEach(function (w) { w.currentConfigGroup = ['General']; $js w.reloadConfig(); }); })" \
+            >/dev/null 2>&1 || true
+    fi
+}

lib/vapor-theme.sh

@@ -103,12 +103,13 @@ install_vapor_theme() {
     [[ -d "${tmp_dir}/usr/share/plasma/avatars" ]] && cp -r "${tmp_dir}/usr/share/plasma/avatars/"* ~/.local/share/plasma/avatars/
 
     # Valve's SteamOS desktop defaults (fonts, Steam keyboard window rule,
-    # no screen locking, no welcome screen, light file indexing, GTK theme).
+    # no welcome screen, light file indexing, GTK theme).
     # Left out on purpose: autostart entries (Steam is started by our user
     # unit), sddm/profile.d, and files hardcoding /home/deck or SteamOS tools.
     info "Applying SteamOS desktop defaults..."
     local f
-    for f in kdeglobals kwinrc kwinrulesrc kscreenlockerrc kded5rc baloofilerc kcminputrc; do
+    # kscreenlockerrc is left to the single-user question.
+    for f in kdeglobals kwinrc kwinrulesrc kded5rc baloofilerc kcminputrc; do
         [[ -f "${tmp_dir}/etc/xdg/$f" ]] && merge_kde_config "${tmp_dir}/etc/xdg/$f" "$f"
     done
     [[ -f "${tmp_dir}/etc/xdg/kded5rc" ]] && merge_kde_config "${tmp_dir}/etc/xdg/kded5rc" kded6rc