docs: translate CLAUDE.md to English

Per the committed=English rule.

.gitea/workflows/update-pkgver.yaml

@@ -1,22 +1,22 @@
-# ABOUTME: Updates pkgver in moonarch-pkgbuilds after a push to main.
+# ABOUTME: Updates pkgver in moonarch-pkgbuilds when a new moongreet tag is pushed.
-# ABOUTME: Ensures paru detects new versions of this package.
+# ABOUTME: Reads the latest version tag and bumps the PKGBUILD + .SRCINFO.
 
 name: Update PKGBUILD version
 
 on:
   push:
-    branches:
+    tags:
-      - main
+      - 'v*'
 
 jobs:
   update-pkgver:
     runs-on: moonarch
     steps:
-      - name: Checkout source repo
+      - name: Determine pkgver from latest tag
         run: |
           git clone --bare http://gitea:3000/nevaforget/greetd-moongreet.git source.git
           cd source.git
-          PKGVER=$(git describe --long --tags | sed 's/^v//;s/-/.r/;s/-/./')
+          PKGVER=$(git describe --tags --abbrev=0 | sed 's/^v//')
           echo "New pkgver: $PKGVER"
           echo "$PKGVER" > /tmp/pkgver
 
@@ -26,18 +26,18 @@ jobs:
           git clone http://gitea:3000/nevaforget/moonarch-pkgbuilds.git pkgbuilds
           cd pkgbuilds
 
-          OLD_VER=$(grep '^pkgver=' moongreet-git/PKGBUILD | cut -d= -f2)
+          OLD_VER=$(grep '^pkgver=' moongreet/PKGBUILD | cut -d= -f2)
           if [ "$OLD_VER" = "$PKGVER" ]; then
             echo "pkgver already up to date ($PKGVER)"
             exit 0
           fi
 
-          sed -i "s/^pkgver=.*/pkgver=$PKGVER/" moongreet-git/PKGBUILD
+          sed -i "s/^pkgver=.*/pkgver=$PKGVER/" moongreet/PKGBUILD
-          sed -i "s/^\tpkgver = .*/\tpkgver = $PKGVER/" moongreet-git/.SRCINFO
+          sed -i "s/^\tpkgver = .*/\tpkgver = $PKGVER/" moongreet/.SRCINFO
           echo "Updated pkgver: $OLD_VER → $PKGVER"
 
           git config user.name "pkgver-bot"
           git config user.email "gitea@moonarch.de"
-          git add moongreet-git/PKGBUILD moongreet-git/.SRCINFO
+          git add moongreet/PKGBUILD moongreet/.SRCINFO
-          git commit -m "chore(moongreet-git): bump pkgver to $PKGVER"
+          git commit -m "chore(moongreet): bump pkgver to $PKGVER"
           git -c http.extraHeader="Authorization: token ${{ secrets.PKGBUILD_TOKEN }}" push

CLAUDE.md

@@ -1,69 +1,69 @@
 # Moongreet
 
-## Projekt
+## Project
 
-Moongreet ist ein greetd-Greeter für Wayland, gebaut mit Rust + gtk4-rs + gtk4-layer-shell.
+Moongreet is a greetd greeter for Wayland, built with Rust + gtk4-rs + gtk4-layer-shell.
-Teil des Moonarch-Ökosystems.
+Part of the Moonarch ecosystem.
 
-## Tech-Stack
+## Tech Stack
 
-- Rust (Edition 2024), gtk4-rs 0.11, glib 0.22
+- Rust (edition 2024), gtk4-rs 0.11, glib 0.22
-- gtk4-layer-shell 0.8 für Wayland Layer Shell (TOP Layer)
+- gtk4-layer-shell 0.8 for the Wayland Layer Shell (TOP layer)
-- greetd IPC über Unix Domain Socket (length-prefixed JSON)
+- greetd IPC over a Unix domain socket (length-prefixed JSON)
-- `cargo test` für Unit-Tests
+- `cargo test` for unit tests
 
-## Projektstruktur
+## Project Structure
 
-- `src/` — Rust-Quellcode (main.rs, greeter.rs, ipc.rs, config.rs, users.rs, sessions.rs, i18n.rs, power.rs)
+- `src/` — Rust source code (main.rs, greeter.rs, ipc.rs, config.rs, users.rs, sessions.rs, i18n.rs, power.rs)
-- `resources/` — GResource-Assets (style.css, default-avatar.svg)
+- `resources/` — GResource assets (style.css, default-avatar.svg)
-- `config/` — Beispiel-Konfigurationsdateien für `/etc/moongreet/` und `/etc/greetd/`
+- `config/` — example configuration files for `/etc/moongreet/` and `/etc/greetd/`
-- `pkg/` — PKGBUILD für Arch-Linux-Paketierung (`makepkg -sf`)
+- `pkg/` — PKGBUILD for Arch Linux packaging (`makepkg -sf`)
 
-## Kommandos
+## Commands
 
 ```bash
-# Tests ausführen
+# Run tests
 cargo test
 
-# Release-Build
+# Release build
 cargo build --release
 
-# Greeter im Fenster starten (ohne greetd/Layer Shell)
+# Start the greeter in a window (without greetd/Layer Shell)
 MOONGREET_NO_LAYER_SHELL=1 ./target/release/moongreet
 
-# Paket bauen und installieren
+# Build and install the package
 cd pkg && makepkg -sf && sudo pacman -U moongreet-git-<version>-x86_64.pkg.tar.zst
 ```
 
-## Architektur
+## Architecture
 
-- `ipc.rs` — greetd Socket-Kommunikation (4-byte LE header + JSON)
+- `ipc.rs` — greetd socket communication (4-byte LE header + JSON)
-- `users.rs` — Benutzer aus /etc/passwd, Avatare (AccountsService + ~/.face), Symlink-Rejection
+- `users.rs` — users from /etc/passwd, avatars (AccountsService + ~/.face), symlink rejection
-- `sessions.rs` — Wayland/X11 Sessions aus .desktop Files
+- `sessions.rs` — Wayland/X11 sessions from .desktop files
-- `power.rs` — Reboot/Shutdown via systemctl (`--no-ask-password`)
+- `power.rs` — reboot/shutdown via systemctl (`--no-ask-password`)
-- `i18n.rs` — Locale-Erkennung (LANG / /etc/locale.conf) und String-Tabellen (DE/EN), alle UI- und Login-Fehlermeldungen
+- `i18n.rs` — locale detection (LANG / /etc/locale.conf) and string tables (DE/EN), all UI and login error messages
-- `fingerprint.rs` — fprintd D-Bus Probe (gio::DBusProxy) — Geräteerkennung und Enrollment-Check für UI-Feedback
+- `fingerprint.rs` — fprintd D-Bus probe (gio::DBusProxy) — device detection and enrollment check for UI feedback
-- `config.rs` — TOML-Config ([appearance] background, gtk-theme, cursor-theme, cursor-size, fingerprint-enabled) + Wallpaper-Fallback + Blur-Validierung (finite, clamp 0–200) + Cursor-Size-Validierung (range 1–256)
+- `config.rs` — TOML config ([appearance] background, gtk-theme, cursor-theme, cursor-size, fingerprint-enabled) + wallpaper fallback + blur validation (finite, clamp 0–200) + cursor-size validation (range 1–256)
-- `greeter.rs` — GTK4 UI (Overlay-Layout), Login-Flow via greetd IPC (Multi-Stage-Auth für fprintd), Faillock-Warnung, Avatar-Cache, Last-User/Last-Session Persistence (0o700 Dirs, 0o600 Files)
+- `greeter.rs` — GTK4 UI (overlay layout), login flow via greetd IPC (multi-stage auth for fprintd), faillock warning, power confirm (inline confirmation before reboot/shutdown, like moonlock), avatar cache, last-user/last-session persistence (0o700 dirs, 0o600 files)
-- `main.rs` — Entry Point, GTK App, Layer Shell Setup, ein Greeter-Fenster auf dem fokussierten Output (kein `set_monitor`), `KeyboardMode::Exclusive`, systemd-journal-logger
+- `main.rs` — entry point, GTK app, Layer Shell setup, one greeter window on the focused output (no `set_monitor`), `KeyboardMode::Exclusive`, systemd-journal-logger
-- `resources/style.css` — Catppuccin-inspiriertes Theme
+- `resources/style.css` — Catppuccin-inspired theme
 
 ## Design Decisions
 
-- **TOP Layer statt OVERLAY**: Greeter läuft unter greetd, nicht über Waybar
+- **TOP layer instead of OVERLAY**: the greeter runs under greetd, not above Waybar
-- **GResource-Bundle**: CSS, Wallpaper und Default-Avatar sind in die Binary kompiliert
+- **GResource bundle**: CSS, wallpaper and default avatar are compiled into the binary
-- **Async Login**: `glib::spawn_future_local` + `gio::spawn_blocking` statt raw Threads
+- **Async login**: `glib::spawn_future_local` + `gio::spawn_blocking` instead of raw threads
-- **Socket-Cancellation**: `Arc<Mutex<Option<UnixStream>>>` + `AtomicBool` für saubere Abbrüche
+- **Socket cancellation**: `Arc<Mutex<Option<UnixStream>>>` + `AtomicBool` for clean cancellation
-- **Avatar-Cache**: `HashMap<String, gdk::Texture>` in `Rc<RefCell<GreeterState>>`
+- **Avatar cache**: `HashMap<String, gdk::Texture>` in `Rc<RefCell<GreeterState>>`
-- **GPU-Blur via GskBlurNode**: `Snapshot::push_blur()` + `GskRenderer::render_texture()` im `connect_realize` Callback — kein CPU-Blur, kein Disk-Cache, kein `image`-Crate. Blurred Texture wird per `Rc<RefCell<Option<gdk::Texture>>>` über alle Monitore gecacht (1x GPU-Renderpass statt N).
+- **GPU blur via GskBlurNode**: `Snapshot::push_blur()` + `GskRenderer::render_texture()` in the `connect_realize` callback — no CPU blur, no disk cache, no `image` crate. The blurred texture is cached across all monitors via `Rc<RefCell<Option<gdk::Texture>>>` (1 GPU render pass instead of N).
-- **Fingerprint via greetd Multi-Stage PAM**: fprintd D-Bus nur als Probe (Gerät/Enrollment), eigentliche Verifizierung läuft über PAM im greetd-Auth-Loop. `auth_message_type: "secret"` → Passwort, alles andere → `None` (PAM entscheidet). 60s Socket-Timeout bei fprintd. Device-Proxy in `GreeterState` gecacht, Generation-Counter gegen Race Conditions bei schnellem User-Switch.
+- **Fingerprint via greetd multi-stage PAM**: fprintd D-Bus only as a probe (device/enrollment), the actual verification runs through PAM in the greetd auth loop. `auth_message_type: "secret"` → password, everything else → `None` (PAM decides). 60s socket timeout for fprintd. Device proxy cached in `GreeterState`, generation counter against race conditions on fast user switch.
-- **Symmetrie mit moonlock/moonset**: Gleiche Patterns (i18n, config, users, power, GResource, GPU-Blur)
+- **Symmetry with moonlock/moonset**: same patterns (i18n, config, users, power, GResource, GPU blur)
-- **Session-Validierung**: Relative Pfade erlaubt (greetd löst PATH auf), nur `..`/Null-Bytes werden abgelehnt
+- **Session validation**: relative paths allowed (greetd resolves PATH), only `..`/null bytes are rejected
-- **GTK-Theme-Validierung**: Nur alphanumerisch + `_-+.` erlaubt, verhindert Path-Traversal über Config
+- **GTK theme validation**: only alphanumeric + `_-+.` allowed, prevents path traversal via config
-- **Cursor-Theme via GtkSettings**: GTK4 unter greetd liest `XCURSOR_THEME` env nicht zuverlässig — Cursor wird via `gtk::Settings::set_gtk_cursor_theme_name()` gesetzt, analog zu `gtk-theme`. Gleiche Validierung (`is_valid_gtk_theme`) gegen Path-Traversal.
+- **Cursor theme via GtkSettings**: GTK4 under greetd does not read the `XCURSOR_THEME` env reliably — the cursor is set via `gtk::Settings::set_gtk_cursor_theme_name()`, analogous to `gtk-theme`. Same validation (`is_valid_gtk_theme`) against path traversal.
-- **Journal-Logging**: `systemd-journal-logger` statt File-Logging — `journalctl -t moongreet`, Debug-Level per `MOONGREET_DEBUG` Env-Var
+- **Journal logging**: `systemd-journal-logger` instead of file logging — `journalctl -t moongreet`, debug level via the `MOONGREET_DEBUG` env var
-- **File Permissions**: Cache-Verzeichnisse 0o700 via `DirBuilder::mode()`, Cache-Dateien 0o600
+- **File permissions**: cache directories 0o700 via `DirBuilder::mode()`, cache files 0o600
-- **Testbare Persistence**: `save_*_to`/`load_*_from` Varianten mit konfigurierbarem Pfad für Unit-Tests
+- **Testable persistence**: `save_*_to`/`load_*_from` variants with a configurable path for unit tests
-- **Shared Wallpaper Texture**: `gdk::Texture` wird einmal in `load_background_texture()` dekodiert und per Ref-Count an alle Fenster geteilt — vermeidet redundante JPEG-Dekodierung pro Monitor
+- **Shared wallpaper texture**: the `gdk::Texture` is decoded once in `load_background_texture()` and shared by ref-count across all windows — avoids redundant JPEG decoding per monitor
-- **Wallpaper-Validierung**: GResource-Zweig via `resources_lookup_data()` + `from_bytes()` (kein Abort bei fehlendem Pfad), Dateigröße-Limit 50 MB, non-UTF-8-Pfade → `None`
+- **Wallpaper validation**: GResource branch via `resources_lookup_data()` + `from_bytes()` (no abort on a missing path), file-size limit 50 MB, non-UTF-8 paths → `None`
-- **Error-Detail-Filterung**: GDK/greetd-Fehlerdetails nur auf `debug!`-Level, `warn!` ohne interne Details — verhindert Systeminfo-Leak ins Journal
+- **Error-detail filtering**: GDK/greetd error details only at `debug!` level, `warn!` without internal details — prevents system-info leak into the journal

Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "moongreet"
-version = "0.9.0"
+version = "0.10.1"
 dependencies = [
  "gdk-pixbuf",
  "gdk4",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "moongreet"
-version = "0.9.0"
+version = "0.10.1"
 edition = "2024"
 description = "A greetd greeter for Wayland with GTK4 and Layer Shell"
 license = "MIT"

DECISIONS.md

@@ -1,5 +1,19 @@
 # Decisions
 
+## 2026-06-02 – Align power-confirm to moonset's ActionDef pattern (v0.10.1)
+
+- **Who**: ClaudeCode, Dom
+- **Why**: Code review of v0.10.0 flagged the power-confirm code (ported verbatim from moonlock) as lower-altitude than moonset's: two near-identical reboot/shutdown handlers and a `show_power_confirm` taking loose `message`/`action_fn`/`error_message` params that can drift apart. moonset already solved this with an `ActionDef` table + button factory.
+- **Tradeoffs**: A `PowerAction` struct + `power_actions()` table + `create_power_button` factory is slightly more machinery for just two actions, but couples icon/prompt/error/action into one value (mismatch becomes unrepresentable) and makes a third action a one-line table entry. Kept in lockstep with moonlock (same change landed there). Did NOT touch `confirm_box: Rc<RefCell<Option<gtk::Box>>>` — moonset uses the same, it is the shared convention.
+- **How**: Replaced the two hand-wired handlers with a loop over `power_actions()`; `show_power_confirm`/`execute_power_action` now take `PowerAction` (Copy) instead of three loose strings. Re-introduced the in-flight re-trigger guard via `power_box.set_sensitive(false)` (re-enabled on failure) — this restores the protection that v0.10.0 dropped, superseding that entry's "no guard" tradeoff.
+
+## 2026-06-02 – Inline power confirmation before reboot/shutdown (v0.10.0)
+
+- **Who**: ClaudeCode, Dom
+- **Why**: Reboot/Shutdown buttons triggered the action immediately on click — one misclick rebooted the machine from the greeter. moonlock already guards power actions with an inline confirm; moongreet should match.
+- **Tradeoffs**: Ported moonlock's `show_power_confirm`/`dismiss_power_confirm` verbatim instead of inventing a new widget — keeps the two codebases symmetric (i18n, CSS classes, focus-on-Cancel behaviour all identical). Dropped the `button` parameter from `execute_power_action`: the old per-button `set_sensitive(false)` double-click guard is now redundant because the confirm box itself blocks accidental re-trigger, and after "Yes" there is no button left to re-enable.
+- **How**: Inline confirm box appended to the central `login_box` (mirrors moonlock placement). Reboot/Shutdown handlers call `show_power_confirm`; "Yes" dismisses and runs the action, "Cancel" (focused by default) just dismisses. New i18n strings (`reboot_confirm`, `shutdown_confirm`, `confirm_yes`, `confirm_no`) and `.confirm-*` CSS classes ported from moonlock; `.confirm-no` background adapted to moongreet's `alpha(@theme_fg_color, …)` idiom.
+
 ## 2026-06-02 – Cursor theme via GtkSettings, salvaged from unpushed work (v0.9.0)
 
 - **Who**: ClaudeCode, Dom

resources/style.css

@@ -82,6 +82,38 @@ window.wallpaper {
     background-color: alpha(@theme_fg_color, 0.2);
 }
 
+/* Power confirmation prompt */
+.confirm-label {
+    font-size: 16px;
+    color: @theme_fg_color;
+    margin-bottom: 4px;
+}
+
+.confirm-yes {
+    padding: 8px 24px;
+    border-radius: 8px;
+    background-color: @error_color;
+    color: @theme_bg_color;
+    border: none;
+    font-weight: bold;
+}
+
+.confirm-yes:hover {
+    background-color: lighter(@error_color);
+}
+
+.confirm-no {
+    padding: 8px 24px;
+    border-radius: 8px;
+    background-color: alpha(@theme_fg_color, 0.15);
+    color: @theme_fg_color;
+    border: none;
+}
+
+.confirm-no:hover {
+    background-color: alpha(@theme_fg_color, 0.25);
+}
+
 /* Power buttons on the bottom right */
 .power-button {
     min-width: 48px;

src/greeter.rs

@@ -373,6 +373,12 @@ pub fn create_greeter_window(
     error_label.set_visible(false);
     login_box.append(&error_label);
 
+    // Confirm box area (for power confirm)
+    let confirm_area = gtk::Box::new(gtk::Orientation::Vertical, 0);
+    confirm_area.set_halign(gtk::Align::Center);
+    login_box.append(&confirm_area);
+    let confirm_box: Rc<RefCell<Option<gtk::Box>>> = Rc::new(RefCell::new(None));
+
     // Fingerprint label (hidden until probe confirms availability)
     let fp_label = gtk::Label::new(None);
     fp_label.add_css_class("fingerprint-label");
@@ -428,7 +434,12 @@ pub fn create_greeter_window(
             state,
             #[strong]
             sessions_rc,
+            #[weak]
+            confirm_area,
+            #[strong]
+            confirm_box,
             move |_| {
+                dismiss_power_confirm(&confirm_area, &confirm_box);
                 cancel_pending_session(&state);
                 switch_to_user(
                     &user_clone,
@@ -461,33 +472,17 @@ pub fn create_greeter_window(
     power_box.set_halign(gtk::Align::End);
     power_box.set_valign(gtk::Align::End);
 
-    let reboot_btn = gtk::Button::new();
+    for action in power_actions() {
-    reboot_btn.set_icon_name("system-reboot-symbolic");
+        let button = create_power_button(
-    reboot_btn.add_css_class("power-button");
+            action,
-    reboot_btn.set_tooltip_text(Some(strings.reboot_tooltip));
+            strings,
-    reboot_btn.connect_clicked(clone!(
+            &power_box,
-        #[weak]
+            &confirm_area,
-        error_label,
+            &confirm_box,
-        move |btn| {
+            &error_label,
-            btn.set_sensitive(false);
+        );
-            execute_power_action(power::reboot, strings.reboot_failed, &error_label, btn);
+        power_box.append(&button);
-        }
+    }
-    ));
-    power_box.append(&reboot_btn);
-
-    let shutdown_btn = gtk::Button::new();
-    shutdown_btn.set_icon_name("system-shutdown-symbolic");
-    shutdown_btn.add_css_class("power-button");
-    shutdown_btn.set_tooltip_text(Some(strings.shutdown_tooltip));
-    shutdown_btn.connect_clicked(clone!(
-        #[weak]
-        error_label,
-        move |btn| {
-            btn.set_sensitive(false);
-            execute_power_action(power::shutdown, strings.shutdown_failed, &error_label, btn);
-        }
-    ));
-    power_box.append(&shutdown_btn);
 
     bottom_bar.append(&power_box);
     overlay.add_overlay(&bottom_bar);
@@ -539,17 +534,22 @@ pub fn create_greeter_window(
         }
     ));
 
-    // Keyboard handling — Escape clears password and error
+    // Keyboard handling — Escape clears password, error, and any open power confirm
     let key_controller = gtk::EventControllerKey::new();
     key_controller.connect_key_pressed(clone!(
         #[weak]
         password_entry,
         #[weak]
         error_label,
+        #[weak]
+        confirm_area,
+        #[strong]
+        confirm_box,
         #[upgrade_or]
         glib::Propagation::Proceed,
         move |_, keyval, _, _| {
             if keyval == gdk::Key::Escape {
+                dismiss_power_confirm(&confirm_area, &confirm_box);
                 password_entry.set_text("");
                 error_label.set_visible(false);
                 glib::Propagation::Stop
@@ -1314,18 +1314,156 @@ fn login_worker(
     })
 }
 
-/// Execute a power action in a background thread.
+/// Definition for a single power-action button (reboot, shutdown).
-fn execute_power_action(
+/// Couples icon, prompt, error text and action so a button cannot be wired
+/// with a mismatched prompt/action pair. Mirrors moonset's `ActionDef`.
+#[derive(Clone, Copy)]
+struct PowerAction {
+    icon_name: &'static str,
+    tooltip_attr: fn(&Strings) -> &'static str,
+    confirm_attr: fn(&Strings) -> &'static str,
+    error_attr: fn(&Strings) -> &'static str,
     action_fn: fn() -> Result<(), PowerError>,
-    error_message: &'static str,
+}
+
+/// The power actions offered by the greeter.
+fn power_actions() -> [PowerAction; 2] {
+    [
+        PowerAction {
+            icon_name: "system-reboot-symbolic",
+            tooltip_attr: |s| s.reboot_tooltip,
+            confirm_attr: |s| s.reboot_confirm,
+            error_attr: |s| s.reboot_failed,
+            action_fn: power::reboot,
+        },
+        PowerAction {
+            icon_name: "system-shutdown-symbolic",
+            tooltip_attr: |s| s.shutdown_tooltip,
+            confirm_attr: |s| s.shutdown_confirm,
+            error_attr: |s| s.shutdown_failed,
+            action_fn: power::shutdown,
+        },
+    ]
+}
+
+/// Build a power-action icon button wired to the confirmation flow.
+fn create_power_button(
+    action: PowerAction,
+    strings: &'static Strings,
+    power_box: &gtk::Box,
+    confirm_area: &gtk::Box,
+    confirm_box: &Rc<RefCell<Option<gtk::Box>>>,
     error_label: &gtk::Label,
-    button: &gtk::Button,
+) -> gtk::Button {
-) {
+    let button = gtk::Button::new();
-    glib::spawn_future_local(clone!(
+    button.set_icon_name(action.icon_name);
+    button.add_css_class("power-button");
+    button.set_tooltip_text(Some((action.tooltip_attr)(strings)));
+    button.connect_clicked(clone!(
+        #[weak]
+        power_box,
+        #[weak]
+        confirm_area,
+        #[strong]
+        confirm_box,
         #[weak]
         error_label,
+        move |_| {
+            show_power_confirm(action, strings, &power_box, &confirm_area, &confirm_box, &error_label);
+        }
+    ));
+    button
+}
+
+/// Show an inline confirmation prompt before executing a power action.
+fn show_power_confirm(
+    action: PowerAction,
+    strings: &'static Strings,
+    power_box: &gtk::Box,
+    confirm_area: &gtk::Box,
+    confirm_box: &Rc<RefCell<Option<gtk::Box>>>,
+    error_label: &gtk::Label,
+) {
+    dismiss_power_confirm(confirm_area, confirm_box);
+    error_label.set_visible(false);
+
+    let new_box = gtk::Box::new(gtk::Orientation::Vertical, 8);
+    new_box.set_halign(gtk::Align::Center);
+    new_box.set_margin_top(16);
+
+    let confirm_label = gtk::Label::new(Some((action.confirm_attr)(strings)));
+    confirm_label.add_css_class("confirm-label");
+    new_box.append(&confirm_label);
+
+    let button_row = gtk::Box::new(gtk::Orientation::Horizontal, 8);
+    button_row.set_halign(gtk::Align::Center);
+
+    let yes_btn = gtk::Button::with_label(strings.confirm_yes);
+    yes_btn.add_css_class("confirm-yes");
+    yes_btn.connect_clicked(clone!(
         #[weak]
-        button,
+        power_box,
+        #[weak]
+        confirm_area,
+        #[strong]
+        confirm_box,
+        #[weak]
+        error_label,
+        move |_| {
+            execute_power_action(action, strings, &power_box, &confirm_area, &confirm_box, &error_label);
+        }
+    ));
+    button_row.append(&yes_btn);
+
+    let no_btn = gtk::Button::with_label(strings.confirm_no);
+    no_btn.add_css_class("confirm-no");
+    no_btn.connect_clicked(clone!(
+        #[weak]
+        confirm_area,
+        #[strong]
+        confirm_box,
+        move |_| {
+            dismiss_power_confirm(&confirm_area, &confirm_box);
+        }
+    ));
+    button_row.append(&no_btn);
+
+    new_box.append(&button_row);
+    confirm_area.append(&new_box);
+    *confirm_box.borrow_mut() = Some(new_box);
+    no_btn.grab_focus();
+}
+
+/// Remove the power confirmation prompt.
+fn dismiss_power_confirm(confirm_area: &gtk::Box, confirm_box: &Rc<RefCell<Option<gtk::Box>>>) {
+    if let Some(box_widget) = confirm_box.borrow_mut().take() {
+        confirm_area.remove(&box_widget);
+    }
+}
+
+/// Execute a power action in a background thread, guarding against re-trigger.
+fn execute_power_action(
+    action: PowerAction,
+    strings: &'static Strings,
+    power_box: &gtk::Box,
+    confirm_area: &gtk::Box,
+    confirm_box: &Rc<RefCell<Option<gtk::Box>>>,
+    error_label: &gtk::Label,
+) {
+    dismiss_power_confirm(confirm_area, confirm_box);
+
+    let action_fn = action.action_fn;
+    let error_message = (action.error_attr)(strings);
+
+    // Desensitize the power buttons so a double-click or keyboard repeat cannot
+    // fire the same action twice while it is in flight.
+    power_box.set_sensitive(false);
+
+    glib::spawn_future_local(clone!(
+        #[weak]
+        power_box,
+        #[weak]
+        error_label,
         async move {
             let result = gio::spawn_blocking(action_fn).await;
 
@@ -1335,13 +1473,13 @@ fn execute_power_action(
                     log::error!("Power action failed: {e}");
                     error_label.set_text(error_message);
                     error_label.set_visible(true);
-                    button.set_sensitive(true);
+                    power_box.set_sensitive(true);
                 }
                 Err(_) => {
                     log::error!("Power action panicked");
                     error_label.set_text(error_message);
                     error_label.set_visible(true);
-                    button.set_sensitive(true);
+                    power_box.set_sensitive(true);
                 }
             }
         }

src/i18n.rs

@@ -16,6 +16,12 @@ pub struct Strings {
     pub reboot_tooltip: &'static str,
     pub shutdown_tooltip: &'static str,
 
+    // Power confirmation prompts
+    pub reboot_confirm: &'static str,
+    pub shutdown_confirm: &'static str,
+    pub confirm_yes: &'static str,
+    pub confirm_no: &'static str,
+
     // Error messages
     pub no_session_selected: &'static str,
     pub greetd_sock_not_set: &'static str,
@@ -39,6 +45,10 @@ const STRINGS_DE: Strings = Strings {
     password_placeholder: "Passwort",
     reboot_tooltip: "Neustart",
     shutdown_tooltip: "Herunterfahren",
+    reboot_confirm: "Wirklich neu starten?",
+    shutdown_confirm: "Wirklich herunterfahren?",
+    confirm_yes: "Ja",
+    confirm_no: "Abbrechen",
     no_session_selected: "Keine Session ausgewählt",
     greetd_sock_not_set: "GREETD_SOCK nicht gesetzt",
     greetd_sock_not_absolute: "GREETD_SOCK ist kein absoluter Pfad",
@@ -59,6 +69,10 @@ const STRINGS_EN: Strings = Strings {
     password_placeholder: "Password",
     reboot_tooltip: "Reboot",
     shutdown_tooltip: "Shut down",
+    reboot_confirm: "Really reboot?",
+    shutdown_confirm: "Really shut down?",
+    confirm_yes: "Yes",
+    confirm_no: "Cancel",
     no_session_selected: "No session selected",
     greetd_sock_not_set: "GREETD_SOCK not set",
     greetd_sock_not_absolute: "GREETD_SOCK is not an absolute path",
@@ -276,6 +290,10 @@ mod tests {
             assert!(!s.password_placeholder.is_empty(), "{locale}: password_placeholder");
             assert!(!s.reboot_tooltip.is_empty(), "{locale}: reboot_tooltip");
             assert!(!s.shutdown_tooltip.is_empty(), "{locale}: shutdown_tooltip");
+            assert!(!s.reboot_confirm.is_empty(), "{locale}: reboot_confirm");
+            assert!(!s.shutdown_confirm.is_empty(), "{locale}: shutdown_confirm");
+            assert!(!s.confirm_yes.is_empty(), "{locale}: confirm_yes");
+            assert!(!s.confirm_no.is_empty(), "{locale}: confirm_no");
             assert!(!s.no_session_selected.is_empty(), "{locale}: no_session_selected");
             assert!(!s.greetd_sock_not_set.is_empty(), "{locale}: greetd_sock_not_set");
             assert!(!s.auth_failed.is_empty(), "{locale}: auth_failed");