feat(system-tray): add icon tinting (#2266)

and distinguish with move columns

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,32 +7,32 @@ body:
     attributes:
       value: |
         ## DankMaterialShell Bug Report
-        Limit your report to one issue per submission unless closely related
-  - type: checkboxes
+        Limit your report to one issue per submission unless similarly related
+  - type: dropdown
     id: compositor
     attributes:
       label: Compositor
       options:
-        - label: Niri
-        - label: Hyprland
-        - label: MangoWC (dwl)
-        - label: Sway
+        - Niri
+        - Hyprland
+        - MangoWC (dwl)
+        - Sway
     validations:
       required: true
-  - type: checkboxes
+  - type: dropdown
     id: distribution
     attributes:
       label: Distribution
       options:
-        - label: Arch Linux
-        - label: CachyOS
-        - label: Fedora
-        - label: NixOS
-        - label: Debian
-        - label: Ubuntu
-        - label: Gentoo
-        - label: OpenSUSE
-        - label: Other (specify below)
+        - Arch Linux
+        - CachyOS
+        - Fedora
+        - NixOS
+        - Debian
+        - Ubuntu
+        - Gentoo
+        - OpenSUSE
+        - Other (specify below)
     validations:
       required: true
   - type: input
@@ -42,12 +42,45 @@ body:
       placeholder: e.g., PikaOS, Void Linux, etc.
     validations:
       required: false
+  - type: dropdown
+    id: installation_method
+    attributes:
+      label: Select your Installation Method
+      options:
+        - DankInstaller
+        - Distro Packaging
+        - Source
+    validations:
+      required: true
+  - type: dropdown
+    id: original_installation_method
+    attributes:
+      label: Was this your original Installation method?
+      options:
+        - "Yes"
+        - No (specify below)
+      default: 0
+    validations:
+      required: false
+  - type: input
+    id: original_installation_method_specify
+    attributes:
+      label: If no, specify
+      placeholder: e.g., Distro Packaging, then Source
+    validations:
+      required: false
   - type: textarea
     id: dms_doctor
     attributes:
-      label: dms doctor -v
-      description: Output of `dms doctor -v` command
-      placeholder: Paste the output of `dms doctor -v` here
+      label: dms doctor -vC
+      description: Output of `dms doctor -vC` command — paste between the details tags below to keep it collapsed in the issue
+      placeholder: Paste the output of `dms doctor -vC` here
+      value: |
+        <details>
+        <summary>Click to expand</summary>
+
+
+        </details>
     validations:
       required: true
   - type: textarea
@@ -69,7 +102,7 @@ body:
   - type: textarea
     id: steps_to_reproduce
     attributes:
-      label: Steps to Reproduce & Installation Method
+      label: Steps to Reproduce
       description: Please provide detailed steps to reproduce the issue
       placeholder: |
         1. ...

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -23,18 +23,25 @@ body:
       placeholder: Why is this feature important?
     validations:
       required: false
-  - type: checkboxes
+  - type: dropdown
     id: compositor
     attributes:
       label: Compositor(s)
       description: Is this feature specific to one or more compositors?
       options:
-        - label: All compositors
-        - label: Niri
-        - label: Hyprland
-        - label: MangoWC (dwl)
-        - label: Sway
-        - label: Other (specify below)
+        - All compositors
+        - Niri
+        - Hyprland
+        - MangoWC (dwl)
+        - Sway
+        - Other (specify below)
+    validations:
+      required: true
+  - type: input
+    id: compositor_other
+    attributes:
+      label: If Other, please specify
+      placeholder: e.g., Wayfire, Mutter, etc.
     validations:
       required: false
   - type: textarea

.github/ISSUE_TEMPLATE/support_request.yml

@@ -7,32 +7,87 @@ body:
     attributes:
       value: |
         ## DankMaterialShell Support Request
-  - type: checkboxes
+  - type: dropdown
     id: compositor
     attributes:
       label: Compositor
       options:
-        - label: Niri
-        - label: Hyprland
-        - label: MangoWC (dwl)
-        - label: Sway
-        - label: Other (specify below)
+        - Niri
+        - Hyprland
+        - MangoWC (dwl)
+        - Sway
+        - Other (specify below)
+    validations:
+      required: true
+  - type: input
+    id: compositor_other
+    attributes:
+      label: If Other, please specify
+      placeholder: e.g., Wayfire, Mutter, etc.
     validations:
       required: false
-  - type: input
+  - type: dropdown
     id: distribution
     attributes:
       label: Distribution
-      description: Which Linux distribution are you using? (e.g., Arch, Fedora, Debian, etc.)
-      placeholder: Your Linux distribution
+      options:
+        - Arch Linux
+        - CachyOS
+        - Fedora
+        - NixOS
+        - Debian
+        - Ubuntu
+        - Gentoo
+        - OpenSUSE
+        - Other (specify below)
+    validations:
+      required: true
+  - type: input
+    id: distribution_other
+    attributes:
+      label: If Other, please specify
+      placeholder: e.g., PikaOS, Void Linux, etc.
+    validations:
+      required: false
+  - type: dropdown
+    id: installation_method
+    attributes:
+      label: Select your Installation Method
+      options:
+        - DankInstaller
+        - Distro Packaging
+        - Source
+    validations:
+      required: true
+  - type: dropdown
+    id: original_installation_method_different
+    attributes:
+      label: Was your original Installation method different?
+      options:
+        - "Yes"
+        - No (specify below)
+      default: 0
+    validations:
+      required: false
+  - type: input
+    id: original_installation_method_specify
+    attributes:
+      label: If no, specify
+      placeholder: e.g., Distro Packaging, then Source
     validations:
       required: false
   - type: textarea
     id: dms_doctor
     attributes:
-      label: dms doctor -v
-      description: Output of `dms doctor -v` command
-      placeholder: Paste the output of `dms doctor -v` here
+      label: dms doctor -vC
+      description: Output of `dms doctor -vC` command — paste between the lines below to keep it collapsed in the issue
+      placeholder: Paste the output of `dms doctor -vC` here
+      value: |
+        <details>
+        <summary>Click to expand</summary>
+
+
+        </details>
     validations:
       required: false
   - type: textarea

.github/workflows/backup/run-obs.yml.bak

@@ -1,383 +0,0 @@
-name: Update OBS Packages
-
-on:
-  workflow_dispatch:
-    inputs:
-      package:
-        description: "Package to update (dms, dms-git, or all)"
-        required: false
-        default: "all"
-      force_upload:
-        description: "Force upload without version check"
-        required: false
-        default: "false"
-        type: choice
-        options:
-          - "false"
-          - "true"
-      rebuild_release:
-        description: "Release number for rebuilds (e.g., 2, 3, 4 to increment spec Release)"
-        required: false
-        default: ""
-  push:
-    tags:
-      - "v*"
-  schedule:
-    - cron: "0 */3 * * *" # Every 3 hours for dms-git builds
-
-jobs:
-  check-updates:
-    name: Check for updates
-    runs-on: ubuntu-latest
-
-    outputs:
-      has_updates: ${{ steps.check.outputs.has_updates }}
-      packages: ${{ steps.check.outputs.packages }}
-      version: ${{ steps.check.outputs.version }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install OSC
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y osc
-
-          mkdir -p ~/.config/osc
-          cat > ~/.config/osc/oscrc << EOF
-          [general]
-          apiurl = https://api.opensuse.org
-
-          [https://api.opensuse.org]
-          user = ${{ secrets.OBS_USERNAME }}
-          pass = ${{ secrets.OBS_PASSWORD }}
-          EOF
-          chmod 600 ~/.config/osc/oscrc
-
-      - name: Check for updates
-        id: check
-        run: |
-          if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-            echo "packages=dms" >> $GITHUB_OUTPUT
-            VERSION="${GITHUB_REF#refs/tags/}"
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-            echo "Triggered by tag: $VERSION (always update)"
-          elif [[ "${{ github.event_name }}" == "schedule" ]]; then
-            echo "packages=dms-git" >> $GITHUB_OUTPUT
-            echo "Checking if dms-git source has changed..."
-
-            # Get current commit hash (8 chars to match spec format)
-            CURRENT_COMMIT=$(git rev-parse --short=8 HEAD)
-
-            # Check OBS for last uploaded commit
-            OBS_BASE="$HOME/.cache/osc-checkouts"
-            mkdir -p "$OBS_BASE"
-            OBS_PROJECT="home:AvengeMedia:dms-git"
-
-            if [[ -d "$OBS_BASE/$OBS_PROJECT/dms-git" ]]; then
-              cd "$OBS_BASE/$OBS_PROJECT/dms-git"
-              osc up -q 2>/dev/null || true
-
-              # Extract commit hash from spec Version line & format like; 0.6.2+git2264.a679be68
-              if [[ -f "dms-git.spec" ]]; then
-                OBS_COMMIT=$(grep "^Version:" "dms-git.spec" | grep -oP '\.[a-f0-9]{8}' | tr -d '.' || echo "")
-
-                if [[ -n "$OBS_COMMIT" ]]; then
-                  if [[ "$CURRENT_COMMIT" == "$OBS_COMMIT" ]]; then
-                    echo "has_updates=false" >> $GITHUB_OUTPUT
-                    echo "📋 Commit $CURRENT_COMMIT already uploaded to OBS, skipping"
-                  else
-                    echo "has_updates=true" >> $GITHUB_OUTPUT
-                    echo "📋 New commit detected: $CURRENT_COMMIT (OBS has $OBS_COMMIT)"
-                  fi
-                else
-                  echo "has_updates=true" >> $GITHUB_OUTPUT
-                  echo "📋 Could not extract OBS commit, proceeding with update"
-                fi
-              else
-                echo "has_updates=true" >> $GITHUB_OUTPUT
-                echo "📋 No spec file in OBS, proceeding with update"
-              fi
-
-              cd "${{ github.workspace }}"
-            else
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-              echo "📋 First upload to OBS, update needed"
-            fi
-          elif [[ "${{ github.event.inputs.force_upload }}" == "true" ]]; then
-            PKG="${{ github.event.inputs.package }}"
-            if [[ -z "$PKG" || "$PKG" == "all" ]]; then
-              echo "packages=all" >> $GITHUB_OUTPUT
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-              echo "🚀 Force upload: all packages"
-            else
-              echo "packages=$PKG" >> $GITHUB_OUTPUT
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-              echo "🚀 Force upload: $PKG"
-            fi
-          elif [[ -n "${{ github.event.inputs.package }}" ]]; then
-            echo "packages=${{ github.event.inputs.package }}" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-            echo "Manual trigger: ${{ github.event.inputs.package }}"
-          else
-            echo "packages=all" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-          fi
-
-  update-obs:
-    name: Upload to OBS
-    needs: check-updates
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    if: |
-      github.event.inputs.force_upload == 'true' ||
-      github.event_name == 'workflow_dispatch' ||
-      needs.check-updates.outputs.has_updates == 'true'
-
-    steps:
-      - name: Generate GitHub App Token
-        id: generate_token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ steps.generate_token.outputs.token }}
-
-      - name: Check if last commit was automated
-        id: check-loop
-        run: |
-          LAST_COMMIT_MSG=$(git log -1 --pretty=%B | head -1)
-          if [[ "$LAST_COMMIT_MSG" == "ci: Auto-update PPA packages"* ]] || [[ "$LAST_COMMIT_MSG" == "ci: Auto-update OBS packages"* ]]; then
-            echo "⏭️ Last commit was automated ($LAST_COMMIT_MSG), skipping to prevent infinite loop"
-            echo "skip=true" >> $GITHUB_OUTPUT
-          else
-            echo "✅ Last commit was not automated, proceeding"
-            echo "skip=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Determine packages to update
-        if: steps.check-loop.outputs.skip != 'true'
-        id: packages
-        run: |
-          if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-            echo "packages=dms" >> $GITHUB_OUTPUT
-            VERSION="${GITHUB_REF#refs/tags/}"
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "Triggered by tag: $VERSION"
-          elif [[ "${{ github.event_name }}" == "schedule" ]]; then
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
-            echo "Triggered by schedule: updating git package"
-          elif [[ -n "${{ github.event.inputs.package }}" ]]; then
-            echo "packages=${{ github.event.inputs.package }}" >> $GITHUB_OUTPUT
-            echo "Manual trigger: ${{ github.event.inputs.package }}"
-          else
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Update dms-git spec version
-        if: steps.check-loop.outputs.skip != 'true' && (contains(steps.packages.outputs.packages, 'dms-git') || steps.packages.outputs.packages == 'all')
-        run: |
-          # Get commit info for dms-git versioning
-          COMMIT_HASH=$(git rev-parse --short=8 HEAD)
-          COMMIT_COUNT=$(git rev-list --count HEAD)
-          BASE_VERSION=$(grep -oP '^Version:\s+\K[0-9.]+' distro/opensuse/dms.spec | head -1 || echo "0.6.2")
-
-          NEW_VERSION="${BASE_VERSION}+git${COMMIT_COUNT}.${COMMIT_HASH}"
-          echo "📦 Updating dms-git.spec to version: $NEW_VERSION"
-
-          # Update version in spec
-          sed -i "s/^Version:.*/Version:        $NEW_VERSION/" distro/opensuse/dms-git.spec
-
-          # Add changelog entry
-          DATE_STR=$(date "+%a %b %d %Y")
-          CHANGELOG_ENTRY="* $DATE_STR Avenge Media <AvengeMedia.US@gmail.com> - ${NEW_VERSION}-1\n- Git snapshot (commit $COMMIT_COUNT: $COMMIT_HASH)"
-          sed -i "/%changelog/a\\$CHANGELOG_ENTRY" distro/opensuse/dms-git.spec
-
-      - name: Update Debian dms-git changelog version
-        if: steps.check-loop.outputs.skip != 'true' && (contains(steps.packages.outputs.packages, 'dms-git') || steps.packages.outputs.packages == 'all')
-        run: |
-          # Get commit info for dms-git versioning
-          COMMIT_HASH=$(git rev-parse --short=8 HEAD)
-          COMMIT_COUNT=$(git rev-list --count HEAD)
-          BASE_VERSION=$(grep -oP '^Version:\s+\K[0-9.]+' distro/opensuse/dms.spec | head -1 || echo "0.6.2")
-
-          # Debian version format: 0.6.2+git2256.9162e314
-          NEW_VERSION="${BASE_VERSION}+git${COMMIT_COUNT}.${COMMIT_HASH}"
-          echo "📦 Updating Debian dms-git changelog to version: $NEW_VERSION"
-
-          CHANGELOG_DATE=$(date -R)
-
-          CHANGELOG_FILE="distro/debian/dms-git/debian/changelog"
-
-          # Get current version from changelog
-          CURRENT_VERSION=$(head -1 "$CHANGELOG_FILE" | sed 's/.*(\([^)]*\)).*/\1/')
-
-          echo "Current Debian version: $CURRENT_VERSION"
-          echo "New version: $NEW_VERSION"
-
-          # Only update if version changed
-          if [ "$CURRENT_VERSION" != "$NEW_VERSION" ]; then
-            # Create new changelog entry at top
-            TEMP_CHANGELOG=$(mktemp)
-
-            cat > "$TEMP_CHANGELOG" << EOF
-          dms-git ($NEW_VERSION) nightly; urgency=medium
-
-            * Git snapshot (commit $COMMIT_COUNT: $COMMIT_HASH)
-
-           -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE
-
-          EOF
-
-            # Prepend to existing changelog
-            cat "$CHANGELOG_FILE" >> "$TEMP_CHANGELOG"
-            mv "$TEMP_CHANGELOG" "$CHANGELOG_FILE"
-
-            echo "✓ Updated Debian changelog: $CURRENT_VERSION → $NEW_VERSION"
-          else
-            echo "✓ Debian changelog already at version $NEW_VERSION"
-          fi
-
-      - name: Update dms stable version
-        if: steps.check-loop.outputs.skip != 'true' && steps.packages.outputs.version != ''
-        run: |
-          VERSION="${{ steps.packages.outputs.version }}"
-          VERSION_NO_V="${VERSION#v}"
-          echo "Updating packaging to version $VERSION_NO_V"
-
-          # Update openSUSE dms spec (stable only)
-          sed -i "s/^Version:.*/Version:        $VERSION_NO_V/" distro/opensuse/dms.spec
-
-          # Update openSUSE spec changelog
-          DATE_STR=$(date "+%a %b %d %Y")
-          CHANGELOG_ENTRY="* $DATE_STR AvengeMedia <maintainer@avengemedia.com> - ${VERSION_NO_V}-1\\n- Update to stable $VERSION release\\n- Bug fixes and improvements"
-          sed -i "/%changelog/a\\$CHANGELOG_ENTRY\\n" distro/opensuse/dms.spec
-
-          # Update Debian _service files (both tar_scm and download_url formats)
-          for service in distro/debian/*/_service; do
-            if [[ -f "$service" ]]; then
-              # Update tar_scm revision parameter (for dms-git)
-              sed -i "s|<param name=\"revision\">v[0-9.]*</param>|<param name=\"revision\">$VERSION</param>|" "$service"
-
-              # Update download_url paths (for dms stable)
-              sed -i "s|/v[0-9.]\+/|/$VERSION/|g" "$service"
-              sed -i "s|/tags/v[0-9.]\+\.tar\.gz|/tags/$VERSION.tar.gz|g" "$service"
-            fi
-          done
-
-          # Update Debian changelog for dms stable
-          if [[ -f "distro/debian/dms/debian/changelog" ]]; then
-            CHANGELOG_DATE=$(date -R)
-            TEMP_CHANGELOG=$(mktemp)
-
-            cat > "$TEMP_CHANGELOG" << EOF
-          dms ($VERSION_NO_V) stable; urgency=medium
-
-            * Update to $VERSION stable release
-            * Bug fixes and improvements
-
-           -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE
-
-          EOF
-
-            cat "distro/debian/dms/debian/changelog" >> "$TEMP_CHANGELOG"
-            mv "$TEMP_CHANGELOG" "distro/debian/dms/debian/changelog"
-
-            echo "✓ Updated Debian changelog to $VERSION_NO_V"
-          fi
-
-      - name: Install Go
-        if: steps.check-loop.outputs.skip != 'true'
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.24"
-
-      - name: Install OSC
-        if: steps.check-loop.outputs.skip != 'true'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y osc
-
-          mkdir -p ~/.config/osc
-          cat > ~/.config/osc/oscrc << EOF
-          [general]
-          apiurl = https://api.opensuse.org
-
-          [https://api.opensuse.org]
-          user = ${{ secrets.OBS_USERNAME }}
-          pass = ${{ secrets.OBS_PASSWORD }}
-          EOF
-          chmod 600 ~/.config/osc/oscrc
-
-      - name: Upload to OBS
-        if: steps.check-loop.outputs.skip != 'true'
-        env:
-          FORCE_UPLOAD: ${{ github.event.inputs.force_upload }}
-          REBUILD_RELEASE: ${{ github.event.inputs.rebuild_release }}
-        run: |
-          PACKAGES="${{ steps.packages.outputs.packages }}"
-          MESSAGE="Automated update from GitHub Actions"
-
-          if [[ -n "${{ steps.packages.outputs.version }}" ]]; then
-            MESSAGE="Update to ${{ steps.packages.outputs.version }}"
-          fi
-
-          if [[ "$PACKAGES" == "all" ]]; then
-            bash distro/scripts/obs-upload.sh dms "$MESSAGE"
-            bash distro/scripts/obs-upload.sh dms-git "Automated git update"
-          else
-            bash distro/scripts/obs-upload.sh "$PACKAGES" "$MESSAGE"
-          fi
-
-      - name: Get changed packages
-        if: steps.check-loop.outputs.skip != 'true'
-        id: changed-packages
-        run: |
-          # Check if there are any changes to commit
-          if git diff --exit-code distro/debian/ distro/opensuse/ >/dev/null 2>&1; then
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-            echo "📋 No changelog or spec changes to commit"
-          else
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-            # Get list of changed packages for commit message
-            CHANGED_DEB=$(git diff --name-only distro/debian/ 2>/dev/null | grep 'debian/changelog' | xargs dirname 2>/dev/null | xargs dirname 2>/dev/null | xargs basename 2>/dev/null | tr '\n' ', ' | sed 's/, $//' || echo "")
-            CHANGED_SUSE=$(git diff --name-only distro/opensuse/ 2>/dev/null | grep '\.spec$' | sed 's|distro/opensuse/||' | sed 's/\.spec$//' | tr '\n' ', ' | sed 's/, $//' || echo "")
-
-            PKGS=$(echo "$CHANGED_DEB,$CHANGED_SUSE" | tr ',' '\n' | grep -v '^$' | sort -u | tr '\n' ',' | sed 's/,$//')
-            echo "packages=$PKGS" >> $GITHUB_OUTPUT
-            echo "📋 Changed packages: $PKGS"
-          fi
-
-      - name: Commit packaging changes
-        if: steps.check-loop.outputs.skip != 'true' && steps.changed-packages.outputs.has_changes == 'true'
-        run: |
-          git config user.name "dms-ci[bot]"
-          git config user.email "dms-ci[bot]@users.noreply.github.com"
-          git add distro/debian/*/debian/changelog distro/opensuse/*.spec
-          git commit -m "ci: Auto-update OBS packages [${{ steps.changed-packages.outputs.packages }}]" -m "🤖 Automated by GitHub Actions"
-          git pull --rebase origin master
-          git push
-
-      - name: Summary
-        run: |
-          echo "### OBS Package Update Complete" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- **Packages**: ${{ steps.packages.outputs.packages }}" >> $GITHUB_STEP_SUMMARY
-          if [[ -n "${{ steps.packages.outputs.version }}" ]]; then
-            echo "- **Version**: ${{ steps.packages.outputs.version }}" >> $GITHUB_STEP_SUMMARY
-          fi
-          if [[ "${{ needs.check-updates.outputs.has_updates }}" == "false" ]]; then
-            echo "- **Status**: Skipped (no changes detected)" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "- **Project**: https://build.opensuse.org/project/show/home:AvengeMedia" >> $GITHUB_STEP_SUMMARY

.github/workflows/backup/run-ppa.yml.bak

@@ -1,298 +0,0 @@
-name: Update PPA Packages
-
-on:
-  workflow_dispatch:
-    inputs:
-      package:
-        description: "Package to upload (dms, dms-git, dms-greeter, or all)"
-        required: false
-        default: "dms-git"
-      force_upload:
-        description: "Force upload without version check"
-        required: false
-        default: "false"
-        type: choice
-        options:
-          - "false"
-          - "true"
-      rebuild_release:
-        description: "Release number for rebuilds (e.g., 2, 3, 4 for ppa2, ppa3, ppa4)"
-        required: false
-        default: ""
-  schedule:
-    - cron: "0 */3 * * *" # Every 3 hours for dms-git builds
-
-jobs:
-  check-updates:
-    name: Check for updates
-    runs-on: ubuntu-latest
-
-    outputs:
-      has_updates: ${{ steps.check.outputs.has_updates }}
-      packages: ${{ steps.check.outputs.packages }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Check for updates
-        id: check
-        run: |
-          if [[ "${{ github.event_name }}" == "schedule" ]]; then
-            echo "packages=dms-git" >> $GITHUB_OUTPUT
-            echo "Checking if dms-git source has changed..."
-
-            # Get current commit hash (8 chars to match changelog format)
-            CURRENT_COMMIT=$(git rev-parse --short=8 HEAD)
-
-            # Extract commit hash from changelog
-            # Format: dms-git (0.6.2+git2264.c5c5ce84) questing; urgency=medium
-            CHANGELOG_FILE="distro/ubuntu/dms-git/debian/changelog"
-
-            if [[ -f "$CHANGELOG_FILE" ]]; then
-              CHANGELOG_COMMIT=$(head -1 "$CHANGELOG_FILE" | grep -oP '\.[a-f0-9]{8}' | tr -d '.' || echo "")
-
-              if [[ -n "$CHANGELOG_COMMIT" ]]; then
-                if [[ "$CURRENT_COMMIT" == "$CHANGELOG_COMMIT" ]]; then
-                  echo "has_updates=false" >> $GITHUB_OUTPUT
-                  echo "📋 Commit $CURRENT_COMMIT already in changelog, skipping upload"
-                else
-                  echo "has_updates=true" >> $GITHUB_OUTPUT
-                  echo "📋 New commit detected: $CURRENT_COMMIT (changelog has $CHANGELOG_COMMIT)"
-                fi
-              else
-                echo "has_updates=true" >> $GITHUB_OUTPUT
-                echo "📋 Could not extract commit from changelog, proceeding with upload"
-              fi
-            else
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-              echo "📋 No changelog file found, proceeding with upload"
-            fi
-          elif [[ -n "${{ github.event.inputs.package }}" ]]; then
-            echo "packages=${{ github.event.inputs.package }}" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-            echo "Manual trigger: ${{ github.event.inputs.package }}"
-          else
-            echo "packages=dms-git" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-          fi
-
-  upload-ppa:
-    name: Upload to PPA
-    needs: check-updates
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    if: |
-      github.event.inputs.force_upload == 'true' ||
-      github.event_name == 'workflow_dispatch' ||
-      needs.check-updates.outputs.has_updates == 'true'
-
-    steps:
-      - name: Generate GitHub App Token
-        id: generate_token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ steps.generate_token.outputs.token }}
-
-      - name: Check if last commit was automated
-        id: check-loop
-        run: |
-          LAST_COMMIT_MSG=$(git log -1 --pretty=%B | head -1)
-          if [[ "$LAST_COMMIT_MSG" == "ci: Auto-update PPA packages"* ]] || [[ "$LAST_COMMIT_MSG" == "ci: Auto-update OBS packages"* ]]; then
-            echo "⏭️ Last commit was automated ($LAST_COMMIT_MSG), skipping to prevent infinite loop"
-            echo "skip=true" >> $GITHUB_OUTPUT
-          else
-            echo "✅ Last commit was not automated, proceeding"
-            echo "skip=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Set up Go
-        if: steps.check-loop.outputs.skip != 'true'
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.24"
-          cache: false
-
-      - name: Install build dependencies
-        if: steps.check-loop.outputs.skip != 'true'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            debhelper \
-            devscripts \
-            dput \
-            lftp \
-            build-essential \
-            fakeroot \
-            dpkg-dev
-
-      - name: Configure GPG
-        if: steps.check-loop.outputs.skip != 'true'
-        env:
-          GPG_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-        run: |
-          echo "$GPG_KEY" | gpg --import
-          GPG_KEY_ID=$(gpg --list-secret-keys --keyid-format LONG | grep sec | awk '{print $2}' | cut -d'/' -f2)
-          echo "DEBSIGN_KEYID=$GPG_KEY_ID" >> $GITHUB_ENV
-
-      - name: Determine packages to upload
-        if: steps.check-loop.outputs.skip != 'true'
-        id: packages
-        run: |
-          if [[ "${{ github.event.inputs.force_upload }}" == "true" ]]; then
-            PKG="${{ github.event.inputs.package }}"
-            if [[ -z "$PKG" || "$PKG" == "all" ]]; then
-              echo "packages=all" >> $GITHUB_OUTPUT
-              echo "🚀 Force upload: all packages"
-            else
-              echo "packages=$PKG" >> $GITHUB_OUTPUT
-              echo "🚀 Force upload: $PKG"
-            fi
-          elif [[ "${{ github.event_name }}" == "schedule" ]]; then
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
-            echo "Triggered by schedule: uploading git package"
-          elif [[ -n "${{ github.event.inputs.package }}" ]]; then
-            # Manual package selection should respect change detection
-            SELECTED_PKG="${{ github.event.inputs.package }}"
-            UPDATED_PKG="${{ needs.check-updates.outputs.packages }}"
-
-            # Check if manually selected package is in the updated list
-            if [[ "$UPDATED_PKG" == *"$SELECTED_PKG"* ]] || [[ "$SELECTED_PKG" == "all" ]]; then
-              echo "packages=$SELECTED_PKG" >> $GITHUB_OUTPUT
-              echo "📦 Manual selection (has updates): $SELECTED_PKG"
-            else
-              echo "packages=" >> $GITHUB_OUTPUT
-              echo "⚠️ Manual selection '$SELECTED_PKG' has no updates - skipping (use force_upload to override)"
-            fi
-          else
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Upload to PPA
-        if: steps.check-loop.outputs.skip != 'true'
-        run: |
-          PACKAGES="${{ steps.packages.outputs.packages }}"
-          REBUILD_RELEASE="${{ github.event.inputs.rebuild_release }}"
-
-          if [[ -z "$PACKAGES" ]]; then
-            echo "No packages selected for upload. Skipping."
-            exit 0
-          fi
-
-          # Build command arguments
-          BUILD_ARGS=()
-          if [[ -n "$REBUILD_RELEASE" ]]; then
-            BUILD_ARGS+=("$REBUILD_RELEASE")
-            echo "✓ Using rebuild release number: ppa$REBUILD_RELEASE"
-          fi
-
-          if [[ "$PACKAGES" == "all" ]]; then
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "Uploading dms to PPA..."
-            if [ -n "$REBUILD_RELEASE" ]; then
-              echo "🔄 Using rebuild release number: ppa$REBUILD_RELEASE"
-            fi
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            bash distro/scripts/ppa-upload.sh dms dms questing "${BUILD_ARGS[@]}"
-
-            echo ""
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "Uploading dms-git to PPA..."
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            bash distro/scripts/ppa-upload.sh dms-git dms-git questing "${BUILD_ARGS[@]}"
-
-            echo ""
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "Uploading dms-greeter to PPA..."
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            bash distro/scripts/ppa-upload.sh dms-greeter danklinux questing "${BUILD_ARGS[@]}"
-          else
-            # Map package to PPA name
-            case "$PACKAGES" in
-              dms)
-                PPA_NAME="dms"
-                ;;
-              dms-git)
-                PPA_NAME="dms-git"
-                ;;
-              dms-greeter)
-                PPA_NAME="danklinux"
-                ;;
-              *)
-                PPA_NAME="$PACKAGES"
-                ;;
-            esac
-
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "Uploading $PACKAGES to PPA..."
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            bash distro/scripts/ppa-upload.sh "$PACKAGES" "$PPA_NAME" questing "${BUILD_ARGS[@]}"
-          fi
-
-      - name: Get changed packages
-        if: steps.check-loop.outputs.skip != 'true'
-        id: changed-packages
-        run: |
-          # Check if there are any changelog changes to commit
-          if git diff --exit-code distro/ubuntu/ >/dev/null 2>&1; then
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-            echo "📋 No changelog changes to commit"
-          else
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-            # Get list of changed packages for commit message (deduplicate)
-            CHANGED=$(git diff --name-only distro/ubuntu/ | grep 'debian/changelog' | sed 's|/debian/changelog||' | xargs -I{} basename {} | sort -u | tr '\n' ',' | sed 's/,$//')
-            echo "packages=$CHANGED" >> $GITHUB_OUTPUT
-            echo "📋 Changed packages: $CHANGED"
-            echo "📋 Debug - Changed files:"
-            git diff --name-only distro/ubuntu/ | grep 'debian/changelog' || echo "No changelog files found"
-          fi
-
-      - name: Commit changelog changes
-        if: steps.check-loop.outputs.skip != 'true' && steps.changed-packages.outputs.has_changes == 'true'
-        run: |
-          git config user.name "dms-ci[bot]"
-          git config user.email "dms-ci[bot]@users.noreply.github.com"
-          git add distro/ubuntu/*/debian/changelog
-          git commit -m "ci: Auto-update PPA packages [${{ steps.changed-packages.outputs.packages }}]" -m "🤖 Automated by GitHub Actions"
-          git pull --rebase origin master
-          git push
-
-      - name: Summary
-        run: |
-          echo "### PPA Package Upload Complete" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- **Packages**: ${{ steps.packages.outputs.packages }}" >> $GITHUB_STEP_SUMMARY
-
-          if [[ "${{ needs.check-updates.outputs.has_updates }}" == "false" ]]; then
-            echo "- **Status**: Skipped (no changes detected)" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          PACKAGES="${{ steps.packages.outputs.packages }}"
-          if [[ "$PACKAGES" == "all" ]]; then
-            echo "- **PPA dms**: https://launchpad.net/~avengemedia/+archive/ubuntu/dms/+packages" >> $GITHUB_STEP_SUMMARY
-            echo "- **PPA dms-git**: https://launchpad.net/~avengemedia/+archive/ubuntu/dms-git/+packages" >> $GITHUB_STEP_SUMMARY
-            echo "- **PPA danklinux**: https://launchpad.net/~avengemedia/+archive/ubuntu/danklinux/+packages" >> $GITHUB_STEP_SUMMARY
-          elif [[ "$PACKAGES" == "dms" ]]; then
-            echo "- **PPA**: https://launchpad.net/~avengemedia/+archive/ubuntu/dms/+packages" >> $GITHUB_STEP_SUMMARY
-          elif [[ "$PACKAGES" == "dms-git" ]]; then
-            echo "- **PPA**: https://launchpad.net/~avengemedia/+archive/ubuntu/dms-git/+packages" >> $GITHUB_STEP_SUMMARY
-          elif [[ "$PACKAGES" == "dms-greeter" ]]; then
-            echo "- **PPA**: https://launchpad.net/~avengemedia/+archive/ubuntu/danklinux/+packages" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          if [[ -n "${{ steps.packages.outputs.version }}" ]]; then
-            echo "- **Version**: ${{ steps.packages.outputs.version }}" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Builds will appear once Launchpad processes the uploads." >> $GITHUB_STEP_SUMMARY

.github/workflows/run-obs.yml

@@ -10,6 +10,7 @@ on:
         options:
           - dms
           - dms-git
+          - dms-greeter
           - all
         default: "dms"
       rebuild_release:
@@ -72,12 +73,27 @@ jobs:
             fi
           }
 
+          # Helper function to check dms-greeter stable tag
+          check_dms_greeter_stable() {
+            LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
+            local OBS_SPEC=$(curl -s -u "$OBS_USERNAME:$OBS_PASSWORD" "https://api.opensuse.org/source/home:AvengeMedia:danklinux/dms-greeter/dms-greeter.spec" 2>/dev/null || echo "")
+            local OBS_VERSION=$(echo "$OBS_SPEC" | grep "^Version:" | awk '{print $2}' | xargs | sed 's/^v//')
+
+            if [[ -n "$LATEST_TAG" && "$LATEST_TAG" == "v$OBS_VERSION" ]]; then
+              echo "📋 dms-greeter: Tag $LATEST_TAG already exists, skipping"
+              return 1  # No update needed
+            else
+              echo "📋 dms-greeter: New tag ${LATEST_TAG:-unknown} (OBS has ${OBS_VERSION:-none})"
+              return 0  # Update needed
+            fi
+          }
+
           # Main logic
           REBUILD="${{ github.event.inputs.rebuild_release }}"
 
-          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-            # Tag selected or pushed - always update stable package
-            echo "packages=dms" >> $GITHUB_OUTPUT
+          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]] && [[ -z "${{ github.event.inputs.package }}" ]]; then
+            # Run from tag with no package specified - update both stable packages
+            echo "packages=dms dms-greeter" >> $GITHUB_OUTPUT
             VERSION="${GITHUB_REF#refs/tags/}"
             echo "version=$VERSION" >> $GITHUB_OUTPUT
             echo "has_updates=true" >> $GITHUB_OUTPUT
@@ -112,6 +128,10 @@ jobs:
                   echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
                 fi
               fi
+              if check_dms_greeter_stable; then
+                PACKAGES_TO_UPDATE+=("dms-greeter")
+                [[ -n "$LATEST_TAG" ]] && echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+              fi
 
               if [[ ${#PACKAGES_TO_UPDATE[@]} -gt 0 ]]; then
                 echo "packages=${PACKAGES_TO_UPDATE[*]}" >> $GITHUB_OUTPUT
@@ -144,6 +164,18 @@ jobs:
                 echo "has_updates=false" >> $GITHUB_OUTPUT
               fi
 
+            elif [[ "$PKG" == "dms-greeter" ]]; then
+              if check_dms_greeter_stable; then
+                echo "packages=$PKG" >> $GITHUB_OUTPUT
+                echo "has_updates=true" >> $GITHUB_OUTPUT
+                if [[ -n "$LATEST_TAG" ]]; then
+                  echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+                fi
+              else
+                echo "packages=" >> $GITHUB_OUTPUT
+                echo "has_updates=false" >> $GITHUB_OUTPUT
+              fi
+
             else
               # Unknown package - proceed anyway
               echo "packages=$PKG" >> $GITHUB_OUTPUT
@@ -171,15 +203,8 @@ jobs:
       - name: Determine packages to update
         id: packages
         run: |
-          # Check if GITHUB_REF points to a tag (works for both push events and workflow_dispatch with tag selected)
-          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-            # Tag selected or pushed - use the tag from GITHUB_REF
-            echo "packages=dms" >> $GITHUB_OUTPUT
-            VERSION="${GITHUB_REF#refs/tags/}"
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "Using tag from GITHUB_REF: $VERSION"
-          # Check if check-updates already determined a version (from auto-detection)
-          elif [[ -n "${{ needs.check-updates.outputs.version }}" ]]; then
+          # Use check-updates outputs when available
+          if [[ -n "${{ needs.check-updates.outputs.version }}" ]]; then
             # Use version from check-updates job
             echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
             echo "version=${{ needs.check-updates.outputs.version }}" >> $GITHUB_OUTPUT
@@ -191,40 +216,16 @@ jobs:
           elif [[ -n "${{ github.event.inputs.package }}" ]]; then
             # Manual workflow dispatch
 
-            # Determine version for dms stable
-            if [[ "${{ github.event.inputs.package }}" == "dms" ]]; then
-              # Use github.ref if tag selected, otherwise auto-detect latest
-              if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-                VERSION="${GITHUB_REF#refs/tags/}"
-                echo "version=$VERSION" >> $GITHUB_OUTPUT
-                echo "Using tag from GITHUB_REF: $VERSION"
+            # Determine version for dms stable and dms-greeter using the API
+            # GITHUB_REF is unreliable when "Use workflow from" a tag; API works from any ref
+            if [[ "${{ github.event.inputs.package }}" == "dms" ]] || [[ "${{ github.event.inputs.package }}" == "dms-greeter" ]] || [[ "${{ github.event.inputs.package }}" == "all" ]]; then
+              LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
+              if [[ -n "$LATEST_TAG" ]]; then
+                echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+                echo "Using latest release from API: $LATEST_TAG"
               else
-                # Auto-detect latest release for dms
-                LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
-                if [[ -n "$LATEST_TAG" ]]; then
-                  echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
-                  echo "Auto-detected latest release: $LATEST_TAG"
-                else
-                  echo "ERROR: Could not auto-detect latest release"
-                  exit 1
-                fi
-              fi
-            elif [[ "${{ github.event.inputs.package }}" == "all" ]]; then
-              # Use github.ref if tag selected, otherwise auto-detect latest
-              if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-                VERSION="${GITHUB_REF#refs/tags/}"
-                echo "version=$VERSION" >> $GITHUB_OUTPUT
-                echo "Using tag from GITHUB_REF: $VERSION"
-              else
-                # Auto-detect latest release for "all"
-                LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
-                if [[ -n "$LATEST_TAG" ]]; then
-                  echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
-                  echo "Auto-detected latest release: $LATEST_TAG"
-                else
-                  echo "ERROR: Could not auto-detect latest release"
-                  exit 1
-                fi
+                echo "ERROR: Could not fetch latest release from API"
+                exit 1
               fi
             fi
 
@@ -283,55 +284,66 @@ jobs:
             echo " -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE"
           } > "distro/debian/dms-git/debian/changelog"
 
-      - name: Update dms stable version
+      - name: Update stable version (dms + dms-greeter)
         if: steps.packages.outputs.version != ''
         run: |
           VERSION="${{ steps.packages.outputs.version }}"
           VERSION_NO_V="${VERSION#v}"
+          PACKAGES="${{ steps.packages.outputs.packages }}"
           echo "==> Updating packaging files to version: $VERSION_NO_V"
 
-          # Update spec file
-          sed -i "s/^Version:.*/Version:        $VERSION_NO_V/" distro/opensuse/dms.spec
+          # Update dms spec and changelog when dms is in the upload list
+          if [[ "$PACKAGES" == *"dms"* ]]; then
+            sed -i "s/^Version:.*/Version:        $VERSION_NO_V/" distro/opensuse/dms.spec
+            UPDATED_VERSION=$(grep -oP '^Version:\s+\K[0-9.]+' distro/opensuse/dms.spec | head -1)
+            echo "✓ dms spec now shows Version: $UPDATED_VERSION"
 
-          # Verify the update
-          UPDATED_VERSION=$(grep -oP '^Version:\s+\K[0-9.]+' distro/opensuse/dms.spec | head -1)
-          echo "✓ Spec file now shows Version: $UPDATED_VERSION"
+            DATE_STR=$(date "+%a %b %d %Y")
+            LOCAL_SPEC_HEAD=$(sed -n '1,/%changelog/{ /%changelog/d; p }' distro/opensuse/dms.spec)
+            {
+              echo "$LOCAL_SPEC_HEAD"
+              echo "%changelog"
+              echo "* $DATE_STR AvengeMedia <maintainer@avengemedia.com> - ${VERSION_NO_V}-1"
+              echo "- Update to stable $VERSION release"
+            } > distro/opensuse/dms.spec
 
-          # Single changelog entry (full history on OBS website)
-          DATE_STR=$(date "+%a %b %d %Y")
-          LOCAL_SPEC_HEAD=$(sed -n '1,/%changelog/{ /%changelog/d; p }' distro/opensuse/dms.spec)
-          {
-            echo "$LOCAL_SPEC_HEAD"
-            echo "%changelog"
-            echo "* $DATE_STR AvengeMedia <maintainer@avengemedia.com> - ${VERSION_NO_V}-1"
-            echo "- Update to stable $VERSION release"
-          } > distro/opensuse/dms.spec
-
-          # Update Debian _service files (both tar_scm and download_url formats)
-          for service in distro/debian/*/_service; do
-            if [[ -f "$service" ]]; then
-              # Update tar_scm revision parameter (for dms-git)
-              sed -i "s|<param name=\"revision\">v[0-9.]*</param>|<param name=\"revision\">$VERSION</param>|" "$service"
-
-              # Update download_url paths (for dms stable)
-              sed -i "s|/v[0-9.]\+/|/$VERSION/|g" "$service"
-              sed -i "s|/tags/v[0-9.]\+\.tar\.gz|/tags/$VERSION.tar.gz|g" "$service"
+            if [[ -f "distro/debian/dms/debian/changelog" ]]; then
+              CHANGELOG_DATE=$(date -R)
+              {
+                echo "dms (${VERSION_NO_V}db1) stable; urgency=medium"
+                echo ""
+                echo "  * Update to $VERSION stable release"
+                echo ""
+                echo " -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE"
+              } > "distro/debian/dms/debian/changelog"
+              echo "✓ Updated dms changelog to ${VERSION_NO_V}db1"
             fi
-          done
+          fi
 
-          # Update Debian changelog for dms stable (single entry, history on OBS website)
-          if [[ -f "distro/debian/dms/debian/changelog" ]]; then
+          # Update dms-greeter changelog when dms-greeter is in the upload list
+          if [[ "$PACKAGES" == *"dms-greeter"* ]] && [[ -f "distro/debian/dms-greeter/debian/changelog" ]]; then
             CHANGELOG_DATE=$(date -R)
             {
-              echo "dms (${VERSION_NO_V}db1) stable; urgency=medium"
+              echo "dms-greeter (${VERSION_NO_V}db1) unstable; urgency=medium"
               echo ""
               echo "  * Update to $VERSION stable release"
               echo ""
               echo " -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE"
-            } > "distro/debian/dms/debian/changelog"
-            echo "✓ Updated Debian changelog to ${VERSION_NO_V}db1"
+            } > "distro/debian/dms-greeter/debian/changelog"
+            echo "✓ Updated dms-greeter changelog to ${VERSION_NO_V}db1"
           fi
 
+          # Update Debian _service files for packages in upload list (download_url paths)
+          for service in distro/debian/*/_service; do
+            if [[ -f "$service" ]]; then
+              # Update tar_scm revision parameter (for dms-git)
+              sed -i "s|<param name=\"revision\">v[0-9.]*</param>|<param name=\"revision\">$VERSION</param>|" "$service"
+              # Update download_url paths (for dms, dms-greeter stable)
+              sed -i "s|/v[0-9.]\+/|/$VERSION/|g" "$service"
+              sed -i "s|/tags/v[0-9.]\+\.tar\.gz|/tags/$VERSION.tar.gz|g" "$service"
+            fi
+          done
+
       - name: Install Go
         uses: actions/setup-go@v5
         with:
@@ -354,6 +366,7 @@ jobs:
           chmod 600 ~/.config/osc/oscrc
 
       - name: Upload to OBS
+        id: upload
         env:
           REBUILD_RELEASE: ${{ github.event.inputs.rebuild_release }}
           TAG_VERSION: ${{ steps.packages.outputs.version }}
@@ -362,6 +375,8 @@ jobs:
 
           if [[ -z "$PACKAGES" ]]; then
             echo "✓ No packages need uploading. All up to date!"
+            echo "uploaded_packages=" >> $GITHUB_OUTPUT
+            echo "skipped_packages=" >> $GITHUB_OUTPUT
             exit 0
           fi
 
@@ -371,6 +386,9 @@ jobs:
             echo "==> Version being uploaded: ${{ steps.packages.outputs.version }}"
           fi
 
+          UPLOADED_PACKAGES=()
+          SKIPPED_PACKAGES=()
+
           # PACKAGES can be space-separated list (e.g., "dms-git dms" from "all" check)
           # Loop through each package and upload
           for PKG in $PACKAGES; do
@@ -382,13 +400,37 @@ jobs:
             fi
             echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
+            LOG_FILE=$(mktemp)
+            set +e
             if [[ "$PKG" == "dms-git" ]]; then
-              bash distro/scripts/obs-upload.sh dms-git "Automated git update"
+              bash distro/scripts/obs-upload.sh dms-git "Automated git update" >"$LOG_FILE" 2>&1
             else
-              bash distro/scripts/obs-upload.sh "$PKG" "$MESSAGE"
+              bash distro/scripts/obs-upload.sh "$PKG" "$MESSAGE" >"$LOG_FILE" 2>&1
             fi
+            STATUS=$?
+            set -e
+
+            cat "$LOG_FILE"
+
+            if [[ $STATUS -ne 0 ]]; then
+              rm -f "$LOG_FILE"
+              echo "❌ Upload failed for $PKG"
+              exit $STATUS
+            fi
+
+            if grep -Eq "Exiting gracefully \(no changes needed\)|No changes needed for this package\. Exiting gracefully\." "$LOG_FILE"; then
+              echo "ℹ️  $PKG is already up to date. Skipped."
+              SKIPPED_PACKAGES+=("$PKG")
+            else
+              UPLOADED_PACKAGES+=("$PKG")
+            fi
+
+            rm -f "$LOG_FILE"
           done
 
+          echo "uploaded_packages=${UPLOADED_PACKAGES[*]}" >> $GITHUB_OUTPUT
+          echo "skipped_packages=${SKIPPED_PACKAGES[*]}" >> $GITHUB_OUTPUT
+
       - name: Summary
         if: always()
         run: |
@@ -402,20 +444,59 @@ jobs:
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "All packages are current. Run completed successfully." >> $GITHUB_STEP_SUMMARY
           else
-            echo "**Packages Uploaded:**" >> $GITHUB_STEP_SUMMARY
+            UPLOADED_PACKAGES="${{ steps.upload.outputs.uploaded_packages }}"
+            SKIPPED_PACKAGES="${{ steps.upload.outputs.skipped_packages }}"
+            TOTAL_COUNT=$(wc -w <<<"$PACKAGES" | tr -d ' ')
+            UPLOADED_COUNT=0
+            SKIPPED_COUNT=0
+            if [[ -n "$UPLOADED_PACKAGES" ]]; then
+              UPLOADED_COUNT=$(wc -w <<<"$UPLOADED_PACKAGES" | tr -d ' ')
+            fi
+            if [[ -n "$SKIPPED_PACKAGES" ]]; then
+              SKIPPED_COUNT=$(wc -w <<<"$SKIPPED_PACKAGES" | tr -d ' ')
+            fi
+            in_list() {
+              local item="$1"
+              local list="$2"
+              [[ " $list " == *" $item "* ]]
+            }
+
+            if [[ "${{ job.status }}" == "success" ]]; then
+              echo "**Status:** ✅ Completed successfully" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "**Status:** ❌ Completed with errors" >> $GITHUB_STEP_SUMMARY
+            fi
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Processed:** $TOTAL_COUNT package(s)" >> $GITHUB_STEP_SUMMARY
+            echo "**Uploaded:** $UPLOADED_COUNT package(s)" >> $GITHUB_STEP_SUMMARY
+            echo "**Skipped (up to date):** $SKIPPED_COUNT package(s)" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Packages:**" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
 
             for PKG in $PACKAGES; do
+              STATUS_ICON="✅"
+              STATUS_TEXT="uploaded"
+              if in_list "$PKG" "$SKIPPED_PACKAGES"; then
+                STATUS_ICON="ℹ️"
+                STATUS_TEXT="up to date (skipped)"
+              elif ! in_list "$PKG" "$UPLOADED_PACKAGES"; then
+                STATUS_ICON="❌"
+                STATUS_TEXT="failed"
+              fi
+
               case "$PKG" in
                 dms)
-                  echo "- ✅ **dms** → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms/dms)" >> $GITHUB_STEP_SUMMARY
+                  echo "- $STATUS_ICON **dms** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms/dms)" >> $GITHUB_STEP_SUMMARY
                   ;;
                 dms-git)
-                  echo "- ✅ **dms-git** → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms-git/dms-git)" >> $GITHUB_STEP_SUMMARY
+                  echo "- $STATUS_ICON **dms-git** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms-git/dms-git)" >> $GITHUB_STEP_SUMMARY
+                  ;;
+                dms-greeter)
+                  echo "- $STATUS_ICON **dms-greeter** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:danklinux/dms-greeter)" >> $GITHUB_STEP_SUMMARY
                   ;;
               esac
             done
-
             echo "" >> $GITHUB_STEP_SUMMARY
 
             if [[ -n "${{ github.event.inputs.rebuild_release }}" ]]; then

.github/workflows/update-vendor-hash.yml

@@ -40,7 +40,7 @@ jobs:
             echo "Build succeeded, no hash update needed"
             exit 0
           fi
-          new_hash=$(echo "$output" | grep -oP "got:\s+\K\S+" | head -n1)
+          new_hash=$(echo "$output" | grep -oP "got:\s+\K\S+" | head -n1 || true)
           [ -n "$new_hash" ] || { echo "Could not extract new vendorHash"; echo "$output"; exit 1; }
           current_hash=$(grep -oP 'vendorHash = "\K[^"]+' flake.nix)
           [ "$current_hash" = "$new_hash" ] && { echo "vendorHash already up to date"; exit 0; }
@@ -59,8 +59,8 @@ jobs:
             git config user.email "dms-ci[bot]@users.noreply.github.com"
             git add flake.nix
             git commit -m "nix: update vendorHash for go.mod changes" || exit 0
-            git pull --rebase origin master
-            git push https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git HEAD:master
+            git pull --rebase origin ${{ github.ref_name }}
+            git push https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git HEAD:${{ github.ref_name }}
           else
             echo "No changes to flake.nix"
           fi

.pre-commit-config.yaml

@@ -5,11 +5,13 @@ repos:
       - id: trailing-whitespace
       - id: check-yaml
       - id: end-of-file-fixer
-  - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.10.0.1
+  - repo: local
     hooks:
       - id: shellcheck
-        args: [-e, SC2164, -e, SC2001, -e, SC2012, -e, SC2317]
+        name: shellcheck
+        entry: shellcheck -e SC2164 -e SC2001 -e SC2012 -e SC2317
+        language: system
+        types: [shell]
   - repo: local
     hooks:
       - id: go-mod-tidy

CONTRIBUTING.md

@@ -22,7 +22,7 @@ nix develop
 
 This will provide:
 
-- Go 1.24 toolchain (go, gopls, delve, go-tools) and GNU Make
+- Go 1.25+ toolchain (go, gopls, delve, go-tools) and GNU Make
 - Quickshell and required QML packages
 - Properly configured QML2_IMPORT_PATH
 

README.md

@@ -19,7 +19,7 @@ Built with [Quickshell](https://quickshell.org/) and [Go](https://go.dev/)
 
 </div>
 
-DankMaterialShell is a complete desktop shell for [niri](https://github.com/YaLTeR/niri), [Hyprland](https://hyprland.org/), [MangoWC](https://github.com/DreamMaoMao/mangowc), [Sway](https://swaywm.org), [labwc](https://labwc.github.io/), [Scroll](https://github.com/dawsers/scroll), and other Wayland compositors. It replaces waybar, swaylock, swayidle, mako, fuzzel, polkit, and everything else you'd normally stitch together to make a desktop.
+DankMaterialShell is a complete desktop shell for [niri](https://github.com/YaLTeR/niri), [Hyprland](https://hyprland.org/), [MangoWC](https://github.com/DreamMaoMao/mangowc), [Sway](https://swaywm.org), [labwc](https://labwc.github.io/), [Scroll](https://github.com/dawsers/scroll), [Miracle WM](https://github.com/miracle-wm-org/miracle-wm), and other Wayland compositors. It replaces waybar, swaylock, swayidle, mako, fuzzel, polkit, and everything else you'd normally stitch together to make a desktop.
 
 ## Repository Structure
 
@@ -105,7 +105,7 @@ Extend functionality with the [plugin registry](https://plugins.danklinux.com).
 
 ## Supported Compositors
 
-Works best with [niri](https://github.com/YaLTeR/niri), [Hyprland](https://hyprland.org/), [Sway](https://swaywm.org/), [MangoWC](https://github.com/DreamMaoMao/mangowc), [labwc](https://labwc.github.io/), and [Scroll](https://github.com/dawsers/scroll) with full workspace switching, overview integration, and monitor management. Other Wayland compositors work with reduced features.
+Works best with [niri](https://github.com/YaLTeR/niri), [Hyprland](https://hyprland.org/), [Sway](https://swaywm.org/), [MangoWC](https://github.com/DreamMaoMao/mangowc), [labwc](https://labwc.github.io/), [Scroll](https://github.com/dawsers/scroll), and [Miracle WM](https://github.com/miracle-wm-org/miracle-wm) with full workspace switching, overview integration, and monitor management. Other Wayland compositors work with reduced features.
 
 [Compositor configuration guide](https://danklinux.com/docs/dankmaterialshell/compositors)
 

core/README.md

@@ -96,7 +96,7 @@ The on-screen preview displays the selected format. JSON output includes hex, RG
 
 ## Building
 
-Requires Go 1.24+
+Requires Go 1.25+
 
 **Development build:**
 

core/cmd/dms/assets/cli-policy.default.json

@@ -0,0 +1,10 @@
+{
+  "policy_version": 1,
+  "blocked_commands": [
+    "greeter install",
+    "greeter enable",
+    "greeter uninstall",
+    "setup"
+  ],
+  "message": "This command is disabled on immutable/image-based systems. Use your distro-native workflow for system-level changes."
+}

core/cmd/dms/commands_blur.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/blur"
+	"github.com/spf13/cobra"
+)
+
+var blurCmd = &cobra.Command{
+	Use:   "blur",
+	Short: "Background blur utilities",
+}
+
+var blurCheckCmd = &cobra.Command{
+	Use:   "check",
+	Short: "Check if the compositor supports background blur (ext-background-effect-v1)",
+	Args:  cobra.NoArgs,
+	Run:   runBlurCheck,
+}
+
+func init() {
+	blurCmd.AddCommand(blurCheckCmd)
+}
+
+func runBlurCheck(cmd *cobra.Command, args []string) {
+	supported, err := blur.ProbeSupport()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
+
+	switch supported {
+	case true:
+		fmt.Println("supported")
+	default:
+		fmt.Println("unsupported")
+	}
+}

core/cmd/dms/commands_brightness.go

@@ -236,6 +236,7 @@ func runBrightnessSet(cmd *cobra.Command, args []string) {
 			defer ddc.Close()
 			time.Sleep(100 * time.Millisecond)
 			if err := ddc.SetBrightnessWithExponent(deviceID, percent, exponential, exponent, nil); err == nil {
+				ddc.WaitPending()
 				fmt.Printf("Set %s to %d%%\n", deviceID, percent)
 				return
 			}

core/cmd/dms/commands_clipboard.go

@@ -222,16 +222,19 @@ func init() {
 
 func runClipCopy(cmd *cobra.Command, args []string) {
 	var data []byte
+	copyFromStdin := false
 
 	switch {
 	case len(args) > 0:
 		data = []byte(args[0])
-	default:
+	case clipCopyDownload || clipCopyType == "__multi__":
 		var err error
 		data, err = io.ReadAll(os.Stdin)
 		if err != nil {
 			log.Fatalf("read stdin: %v", err)
 		}
+	default:
+		copyFromStdin = true
 	}
 
 	if clipCopyDownload {
@@ -257,6 +260,13 @@ func runClipCopy(cmd *cobra.Command, args []string) {
 		return
 	}
 
+	if copyFromStdin {
+		if err := clipboard.CopyReader(os.Stdin, clipCopyType, clipCopyForeground, clipCopyPasteOnce); err != nil {
+			log.Fatalf("copy: %v", err)
+		}
+		return
+	}
+
 	if err := clipboard.CopyOpts(data, clipCopyType, clipCopyForeground, clipCopyPasteOnce); err != nil {
 		log.Fatalf("copy: %v", err)
 	}

core/cmd/dms/commands_common.go

@@ -64,9 +64,8 @@ var killCmd = &cobra.Command{
 }
 
 var ipcCmd = &cobra.Command{
-	Use:     "ipc [target] [function] [args...]",
-	Short:   "Send IPC commands to running DMS shell",
-	PreRunE: findConfig,
+	Use:   "ipc [target] [function] [args...]",
+	Short: "Send IPC commands to running DMS shell",
 	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		_ = findConfig(cmd, args)
 		return getShellIPCCompletions(args, toComplete), cobra.ShellCompDirectiveNoFileComp
@@ -525,5 +524,7 @@ func getCommonCommands() []*cobra.Command {
 		doctorCmd,
 		configCmd,
 		dlCmd,
+		randrCmd,
+		blurCmd,
 	}
 }

core/cmd/dms/commands_doctor.go

@@ -11,6 +11,7 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/blur"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
@@ -82,7 +83,7 @@ func (ds *DoctorStatus) OKCount() int {
 }
 
 var (
-	quickshellVersionRegex = regexp.MustCompile(`quickshell (\d+\.\d+\.\d+)`)
+	quickshellVersionRegex = regexp.MustCompile(`(?i)quickshell (\d+\.\d+\.\d+)`)
 	hyprlandVersionRegex   = regexp.MustCompile(`v?(\d+\.\d+\.\d+)`)
 	niriVersionRegex       = regexp.MustCompile(`niri (\d+\.\d+)`)
 	swayVersionRegex       = regexp.MustCompile(`sway version (\d+\.\d+)`)
@@ -90,6 +91,7 @@ var (
 	wayfireVersionRegex    = regexp.MustCompile(`wayfire (\d+\.\d+)`)
 	labwcVersionRegex      = regexp.MustCompile(`labwc (\d+\.\d+\.\d+)`)
 	mangowcVersionRegex    = regexp.MustCompile(`mango (\d+\.\d+\.\d+)`)
+	miracleVersionRegex    = regexp.MustCompile(`miracle-wm v?(\d+\.\d+\.\d+)`)
 )
 
 var doctorCmd = &cobra.Command{
@@ -468,6 +470,7 @@ func checkWindowManagers() []checkResult {
 		{"Wayfire", "wayfire", "--version", wayfireVersionRegex, []string{"wayfire"}},
 		{"labwc", "labwc", "--version", labwcVersionRegex, []string{"labwc"}},
 		{"mangowc", "mango", "-v", mangowcVersionRegex, []string{"mango"}},
+		{"Miracle WM", "miracle-wm", "--version", miracleVersionRegex, []string{"miracle-wm"}},
 	}
 
 	var results []checkResult
@@ -500,7 +503,7 @@ func checkWindowManagers() []checkResult {
 		results = append(results, checkResult{
 			catCompositor, "Compositor", statusError,
 			"No supported Wayland compositor found",
-			"Install Hyprland, niri, Sway, River, or Wayfire",
+			"Install Hyprland, niri, Sway, River, Wayfire, or miracle-wm",
 			doctorDocsURL + "#compositor-checks",
 		})
 	}
@@ -509,9 +512,24 @@ func checkWindowManagers() []checkResult {
 		results = append(results, checkResult{catCompositor, "Active", statusInfo, wm, "", doctorDocsURL + "#compositor"})
 	}
 
+	results = append(results, checkCompositorBlurSupport())
+
 	return results
 }
 
+func checkCompositorBlurSupport() checkResult {
+	supported, err := blur.ProbeSupport()
+	if err != nil {
+		return checkResult{catCompositor, "Background Blur", statusInfo, "Unable to verify", err.Error(), doctorDocsURL + "#compositor-checks"}
+	}
+
+	if supported {
+		return checkResult{catCompositor, "Background Blur", statusOK, "Supported", "Compositor supports ext-background-effect-v1", doctorDocsURL + "#compositor-checks"}
+	}
+
+	return checkResult{catCompositor, "Background Blur", statusWarn, "Unsupported", "Compositor does not support ext-background-effect-v1", doctorDocsURL + "#compositor-checks"}
+}
+
 func getVersionFromCommand(cmd, arg string, regex *regexp.Regexp) string {
 	output, err := exec.Command(cmd, arg).CombinedOutput()
 	if err != nil && len(output) == 0 {
@@ -535,6 +553,8 @@ func detectRunningWM() string {
 		return "Hyprland"
 	case os.Getenv("NIRI_SOCKET") != "":
 		return "niri"
+	case os.Getenv("MIRACLESOCK") != "":
+		return "Miracle WM"
 	case os.Getenv("XDG_CURRENT_DESKTOP") != "":
 		return os.Getenv("XDG_CURRENT_DESKTOP")
 	}
@@ -553,6 +573,7 @@ func checkQuickshellFeatures() ([]checkResult, bool) {
 	qmlContent := `
 import QtQuick
 import Quickshell
+import Quickshell.Wayland
 
 ShellRoot {
 	id: root
@@ -561,6 +582,7 @@ ShellRoot {
 	property bool idleMonitorAvailable: false
 	property bool idleInhibitorAvailable: false
 	property bool shortcutInhibitorAvailable: false
+	property bool backgroundBlurAvailable: false
 
 	Timer {
 		interval: 50
@@ -578,16 +600,18 @@ ShellRoot {
 
 			try {
 				var testItem = Qt.createQmlObject(
-					'import Quickshell.Wayland; import QtQuick; QtObject { ' +
+					'import Quickshell; import Quickshell.Wayland; import QtQuick; QtObject { ' +
 					'readonly property bool hasIdleMonitor: typeof IdleMonitor !== "undefined"; ' +
 					'readonly property bool hasIdleInhibitor: typeof IdleInhibitor !== "undefined"; ' +
-					'readonly property bool hasShortcutInhibitor: typeof ShortcutInhibitor !== "undefined" ' +
+					'readonly property bool hasShortcutInhibitor: typeof ShortcutInhibitor !== "undefined"; ' +
+					'readonly property bool hasBackgroundBlur: typeof BackgroundEffect !== "undefined" ' +
 					'}',
 					root
 				)
 				root.idleMonitorAvailable = testItem.hasIdleMonitor
 				root.idleInhibitorAvailable = testItem.hasIdleInhibitor
 				root.shortcutInhibitorAvailable = testItem.hasShortcutInhibitor
+				root.backgroundBlurAvailable = testItem.hasBackgroundBlur
 				testItem.destroy()
 			} catch (e) {}
 
@@ -596,6 +620,8 @@ ShellRoot {
 			console.warn(root.idleInhibitorAvailable ? "FEATURE:IdleInhibitor:OK" : "FEATURE:IdleInhibitor:UNAVAILABLE")
 			console.warn(root.shortcutInhibitorAvailable ? "FEATURE:ShortcutInhibitor:OK" : "FEATURE:ShortcutInhibitor:UNAVAILABLE")
 
+			console.warn(root.backgroundBlurAvailable ? "FEATURE:BackgroundBlur:OK" : "FEATURE:BackgroundBlur:UNAVAILABLE")
+
 			Quickshell.execDetached(["kill", "-TERM", String(Quickshell.processId)])
 		}
 	}
@@ -616,6 +642,7 @@ ShellRoot {
 		{"IdleMonitor", "Idle detection"},
 		{"IdleInhibitor", "Prevent idle/sleep"},
 		{"ShortcutInhibitor", "Allow shortcut management (niri)"},
+		{"BackgroundBlur", "Background blur API support in Quickshell"},
 	}
 
 	var results []checkResult
@@ -649,6 +676,120 @@ func checkI2CAvailability() checkResult {
 	return checkResult{catOptionalFeatures, "I2C/DDC", statusOK, fmt.Sprintf("%d monitor(s) detected", len(devices)), "External monitor brightness control", doctorDocsURL + "#optional-features"}
 }
 
+func checkImageFormatPlugins() []checkResult {
+	url := doctorDocsURL + "#optional-features"
+
+	pluginDirs := findQtPluginDirs()
+	if len(pluginDirs) == 0 {
+		return []checkResult{
+			{catOptionalFeatures, "qt6-imageformats", statusInfo, "Cannot detect (plugin dir not found)", "WebP, TIFF, JP2 support", url},
+			{catOptionalFeatures, "kimageformats", statusInfo, "Cannot detect (plugin dir not found)", "AVIF, HEIF, JXL support", url},
+		}
+	}
+
+	type pluginCheck struct {
+		name    string
+		desc    string
+		plugins []struct{ file, format string }
+	}
+
+	checks := []pluginCheck{
+		{
+			name: "qt6-imageformats",
+			desc: "WebP, TIFF, GIF, JP2 support",
+			plugins: []struct{ file, format string }{
+				{"libqwebp.so", "WebP"},
+				{"libqtiff.so", "TIFF"},
+				{"libqgif.so", "GIF"},
+				{"libqjp2.so", "JP2"},
+				{"libqicns.so", "ICNS"},
+			},
+		},
+		{
+			name: "kimageformats",
+			desc: "AVIF, HEIF, JXL support",
+			plugins: []struct{ file, format string }{
+				{"kimg_avif.so", "AVIF"},
+				{"kimg_heif.so", "HEIF"},
+				{"kimg_jxl.so", "JXL"},
+				{"kimg_exr.so", "EXR"},
+			},
+		},
+	}
+
+	var results []checkResult
+	for _, c := range checks {
+		var found []string
+		var foundDirs []string
+		for _, pluginDir := range pluginDirs {
+			imageFormatsDir := filepath.Join(pluginDir, "imageformats")
+			for _, p := range c.plugins {
+				if _, err := os.Stat(filepath.Join(imageFormatsDir, p.file)); err == nil {
+					if !slices.Contains(found, p.format) {
+						found = append(found, p.format)
+					}
+					if !slices.Contains(foundDirs, imageFormatsDir) {
+						foundDirs = append(foundDirs, imageFormatsDir)
+					}
+				}
+			}
+		}
+
+		var result checkResult
+		switch {
+		case len(found) == 0:
+			result = checkResult{catOptionalFeatures, c.name, statusWarn, "Not installed", c.desc, url}
+		default:
+			details := ""
+			if doctorVerbose {
+				details = fmt.Sprintf("Formats: %s (%s)", strings.Join(found, ", "), strings.Join(foundDirs, ":"))
+			}
+			result = checkResult{catOptionalFeatures, c.name, statusOK, fmt.Sprintf("Installed (%d formats)", len(found)), details, url}
+		}
+		results = append(results, result)
+	}
+
+	return results
+}
+
+func findQtPluginDirs() []string {
+	var dirs []string
+
+	addDir := func(dir string) {
+		if dir != "" {
+			if _, err := os.Stat(filepath.Join(dir, "imageformats")); err == nil {
+				dirs = append(dirs, dir)
+			}
+		}
+	}
+
+	// Check all paths in QT_PLUGIN_PATH env var (used by NixOS and custom setups)
+	if envPath := os.Getenv("QT_PLUGIN_PATH"); envPath != "" {
+		for dir := range strings.SplitSeq(envPath, ":") {
+			addDir(dir)
+		}
+	}
+
+	// Try qtpaths
+	for _, cmd := range []string{"qtpaths6", "qtpaths"} {
+		if output, err := exec.Command(cmd, "-query", "QT_INSTALL_PLUGINS").Output(); err == nil {
+			addDir(strings.TrimSpace(string(output)))
+		}
+	}
+
+	// Fallback: common distro paths
+	for _, dir := range []string{
+		"/usr/lib/qt6/plugins",
+		"/usr/lib64/qt6/plugins",
+		"/usr/lib/x86_64-linux-gnu/qt6/plugins",
+		"/usr/lib/aarch64-linux-gnu/qt6/plugins",
+	} {
+		addDir(dir)
+	}
+
+	return dirs
+}
+
 func detectNetworkBackend(stackResult *network.DetectResult) string {
 	switch stackResult.Backend {
 	case network.BackendNetworkManager:
@@ -703,12 +844,17 @@ func checkOptionalDependencies() []checkResult {
 	results = append(results, checkResult{catOptionalFeatures, "cups-pk-helper", cupsPkStatus, cupsPkMsg, "Printer management", optionalFeaturesURL})
 
 	results = append(results, checkI2CAvailability())
+	results = append(results, checkImageFormatPlugins()...)
 
 	terminals := []string{"ghostty", "kitty", "alacritty", "foot", "wezterm"}
-	if idx := slices.IndexFunc(terminals, utils.CommandExists); idx >= 0 {
-		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusOK, terminals[idx], "", optionalFeaturesURL})
+	terminals = slices.DeleteFunc(terminals, func(t string) bool {
+		return !utils.CommandExists(t)
+	})
+
+	if len(terminals) > 0 {
+		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusOK, strings.Join(terminals, ", "), "", optionalFeaturesURL})
 	} else {
-		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusWarn, "None found", "Install ghostty, kitty, or alacritty", optionalFeaturesURL})
+		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusWarn, "None found", "Install ghostty, kitty, foot or alacritty", optionalFeaturesURL})
 	}
 
 	networkResult, err := network.DetectNetworkStack()

core/cmd/dms/commands_features.go

@@ -109,16 +109,41 @@ func updateArchLinux() error {
 	}
 
 	var packageName string
-	if isArchPackageInstalled("dms-shell-bin") {
-		packageName = "dms-shell-bin"
+	var isAUR bool
+	if isArchPackageInstalled("dms-shell") {
+		packageName = "dms-shell"
 	} else if isArchPackageInstalled("dms-shell-git") {
 		packageName = "dms-shell-git"
+		isAUR = true
+	} else if isArchPackageInstalled("dms-shell-bin") {
+		packageName = "dms-shell-bin"
+		isAUR = true
 	} else {
-		fmt.Println("Info: Neither dms-shell-bin nor dms-shell-git package found.")
+		fmt.Println("Info: No dms-shell package found.")
 		fmt.Println("Info: Falling back to git-based update method...")
 		return updateOtherDistros()
 	}
 
+	if !isAUR {
+		fmt.Printf("This will update %s using pacman.\n", packageName)
+		if !confirmUpdate() {
+			return errdefs.ErrUpdateCancelled
+		}
+
+		fmt.Printf("\nRunning: sudo pacman -S %s\n", packageName)
+		cmd := exec.Command("sudo", "pacman", "-S", "--noconfirm", packageName)
+		cmd.Stdin = os.Stdin
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		if err := cmd.Run(); err != nil {
+			fmt.Printf("Error: Failed to update using pacman: %v\n", err)
+			return err
+		}
+
+		fmt.Println("dms successfully updated")
+		return nil
+	}
+
 	var helper string
 	var updateCmd *exec.Cmd
 

core/cmd/dms/commands_keybinds.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"path/filepath"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/keybinds"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/keybinds/providers"
@@ -82,24 +83,35 @@ func init() {
 func initializeProviders() {
 	registry := keybinds.GetDefaultRegistry()
 
-	hyprlandProvider := providers.NewHyprlandProvider("$HOME/.config/hypr")
+	hyprlandProvider := providers.NewHyprlandProvider("")
 	if err := registry.Register(hyprlandProvider); err != nil {
 		log.Warnf("Failed to register Hyprland provider: %v", err)
 	}
 
-	mangowcProvider := providers.NewMangoWCProvider("$HOME/.config/mango")
+	mangowcProvider := providers.NewMangoWCProvider("")
 	if err := registry.Register(mangowcProvider); err != nil {
 		log.Warnf("Failed to register MangoWC provider: %v", err)
 	}
 
-	scrollProvider := providers.NewSwayProvider("$HOME/.config/scroll")
-	if err := registry.Register(scrollProvider); err != nil {
-		log.Warnf("Failed to register Scroll provider: %v", err)
+	configDir, _ := os.UserConfigDir()
+
+	if configDir != "" {
+		scrollProvider := providers.NewSwayProvider(filepath.Join(configDir, "scroll"))
+		if err := registry.Register(scrollProvider); err != nil {
+			log.Warnf("Failed to register Scroll provider: %v", err)
+		}
 	}
 
-	swayProvider := providers.NewSwayProvider("$HOME/.config/sway")
-	if err := registry.Register(swayProvider); err != nil {
-		log.Warnf("Failed to register Sway provider: %v", err)
+	miracleProvider := providers.NewMiracleProvider("")
+	if err := registry.Register(miracleProvider); err != nil {
+		log.Warnf("Failed to register Miracle WM provider: %v", err)
+	}
+
+	if configDir != "" {
+		swayProvider := providers.NewSwayProvider(filepath.Join(configDir, "sway"))
+		if err := registry.Register(swayProvider); err != nil {
+			log.Warnf("Failed to register Sway provider: %v", err)
+		}
 	}
 
 	niriProvider := providers.NewNiriProvider("")
@@ -144,6 +156,8 @@ func makeProviderWithPath(name, path string) keybinds.Provider {
 		return providers.NewSwayProvider(path)
 	case "scroll":
 		return providers.NewSwayProvider(path)
+	case "miracle":
+		return providers.NewMiracleProvider(path)
 	case "niri":
 		return providers.NewNiriProvider(path)
 	default:

core/cmd/dms/commands_matugen.go

@@ -3,7 +3,9 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"os"
 	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
@@ -95,7 +97,11 @@ func buildMatugenOptions(cmd *cobra.Command) matugen.Options {
 
 func runMatugenGenerate(cmd *cobra.Command, args []string) {
 	opts := buildMatugenOptions(cmd)
-	if err := matugen.Run(opts); err != nil {
+	err := matugen.Run(opts)
+	switch {
+	case errors.Is(err, matugen.ErrNoChanges):
+		os.Exit(2)
+	case err != nil:
 		log.Fatalf("Theme generation failed: %v", err)
 	}
 }
@@ -129,7 +135,11 @@ func runMatugenQueue(cmd *cobra.Command, args []string) {
 	if !wait {
 		if err := sendServerRequestFireAndForget(request); err != nil {
 			log.Info("Server unavailable, running synchronously")
-			if err := matugen.Run(opts); err != nil {
+			err := matugen.Run(opts)
+			switch {
+			case errors.Is(err, matugen.ErrNoChanges):
+				os.Exit(2)
+			case err != nil:
 				log.Fatalf("Theme generation failed: %v", err)
 			}
 			return
@@ -146,11 +156,15 @@ func runMatugenQueue(cmd *cobra.Command, args []string) {
 		resp, ok := tryServerRequest(request)
 		if !ok {
 			log.Info("Server unavailable, running synchronously")
-			if err := matugen.Run(opts); err != nil {
+			err := matugen.Run(opts)
+			switch {
+			case errors.Is(err, matugen.ErrNoChanges):
+				resultCh <- matugen.ErrNoChanges
+			case err != nil:
 				resultCh <- err
-				return
+			default:
+				resultCh <- nil
 			}
-			resultCh <- nil
 			return
 		}
 		if resp.Error != "" {
@@ -162,7 +176,10 @@ func runMatugenQueue(cmd *cobra.Command, args []string) {
 
 	select {
 	case err := <-resultCh:
-		if err != nil {
+		switch {
+		case errors.Is(err, matugen.ErrNoChanges):
+			os.Exit(2)
+		case err != nil:
 			log.Fatalf("Theme generation failed: %v", err)
 		}
 		fmt.Println("Theme generation completed")

core/cmd/dms/commands_randr.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/spf13/cobra"
+)
+
+var randrCmd = &cobra.Command{
+	Use:   "randr",
+	Short: "Query output display information",
+	Long:  "Query Wayland compositor for output names, scales, resolutions and refresh rates via zwlr-output-management",
+	Run:   runRandr,
+}
+
+func init() {
+	randrCmd.Flags().Bool("json", false, "Output in JSON format")
+}
+
+type randrJSON struct {
+	Outputs []randrOutput `json:"outputs"`
+}
+
+func runRandr(cmd *cobra.Command, args []string) {
+	outputs, err := queryRandr()
+	if err != nil {
+		log.Fatalf("%v", err)
+	}
+
+	jsonFlag, _ := cmd.Flags().GetBool("json")
+
+	if jsonFlag {
+		data, err := json.Marshal(randrJSON{Outputs: outputs})
+		if err != nil {
+			log.Fatalf("failed to marshal JSON: %v", err)
+		}
+		fmt.Println(string(data))
+		return
+	}
+
+	for i, out := range outputs {
+		if i > 0 {
+			fmt.Println()
+		}
+		status := "enabled"
+		if !out.Enabled {
+			status = "disabled"
+		}
+		fmt.Printf("%s (%s)\n", out.Name, status)
+		fmt.Printf("  Scale:      %.4g\n", out.Scale)
+		fmt.Printf("  Resolution: %dx%d\n", out.Width, out.Height)
+		if out.Refresh > 0 {
+			fmt.Printf("  Refresh:    %.2f Hz\n", float64(out.Refresh)/1000.0)
+		}
+	}
+}

core/cmd/dms/commands_screenshot.go

@@ -13,16 +13,16 @@ import (
 )
 
 var (
-	ssOutputName    string
-	ssIncludeCursor bool
-	ssFormat        string
-	ssQuality       int
-	ssOutputDir     string
-	ssFilename      string
-	ssNoClipboard   bool
-	ssNoFile        bool
-	ssNoNotify      bool
-	ssStdout        bool
+	ssOutputName  string
+	ssCursor      string
+	ssFormat      string
+	ssQuality     int
+	ssOutputDir   string
+	ssFilename    string
+	ssNoClipboard bool
+	ssNoFile      bool
+	ssNoNotify    bool
+	ssStdout      bool
 )
 
 var screenshotCmd = &cobra.Command{
@@ -52,7 +52,7 @@ Examples:
   dms screenshot last                # Last region (pre-selected)
   dms screenshot --no-clipboard      # Save file only
   dms screenshot --no-file           # Clipboard only
-  dms screenshot --cursor            # Include cursor
+  dms screenshot --cursor=on         # Include cursor
   dms screenshot -f jpg -q 85        # JPEG with quality 85`,
 }
 
@@ -111,7 +111,7 @@ var notifyActionCmd = &cobra.Command{
 
 func init() {
 	screenshotCmd.PersistentFlags().StringVarP(&ssOutputName, "output", "o", "", "Output name for 'output' mode")
-	screenshotCmd.PersistentFlags().BoolVar(&ssIncludeCursor, "cursor", false, "Include cursor in screenshot")
+	screenshotCmd.PersistentFlags().StringVar(&ssCursor, "cursor", "off", "Include cursor in screenshot (on/off)")
 	screenshotCmd.PersistentFlags().StringVarP(&ssFormat, "format", "f", "png", "Output format (png, jpg, ppm)")
 	screenshotCmd.PersistentFlags().IntVarP(&ssQuality, "quality", "q", 90, "JPEG quality (1-100)")
 	screenshotCmd.PersistentFlags().StringVarP(&ssOutputDir, "dir", "d", "", "Output directory")
@@ -136,7 +136,9 @@ func getScreenshotConfig(mode screenshot.Mode) screenshot.Config {
 	config := screenshot.DefaultConfig()
 	config.Mode = mode
 	config.OutputName = ssOutputName
-	config.IncludeCursor = ssIncludeCursor
+	if strings.EqualFold(ssCursor, "on") {
+		config.Cursor = screenshot.CursorOn
+	}
 	config.Clipboard = !ssNoClipboard
 	config.SaveFile = !ssNoFile
 	config.Notify = !ssNoNotify

core/cmd/dms/commands_setup.go

@@ -16,9 +16,10 @@ import (
 )
 
 var setupCmd = &cobra.Command{
-	Use:   "setup",
-	Short: "Deploy DMS configurations",
-	Long:  "Deploy compositor and terminal configurations with interactive prompts",
+	Use:               "setup",
+	Short:             "Deploy DMS configurations",
+	Long:              "Deploy compositor and terminal configurations with interactive prompts",
+	PersistentPreRunE: requireMutableSystemCommand,
 	Run: func(cmd *cobra.Command, args []string) {
 		if err := runSetup(); err != nil {
 			log.Fatalf("Error during setup: %v", err)

core/cmd/dms/immutable_policy.go

@@ -0,0 +1,271 @@
+package main
+
+import (
+	"bufio"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/spf13/cobra"
+)
+
+const (
+	cliPolicyPackagedPath = "/usr/share/dms/cli-policy.json"
+	cliPolicyAdminPath    = "/etc/dms/cli-policy.json"
+)
+
+var (
+	immutablePolicyOnce sync.Once
+	immutablePolicy     immutableCommandPolicy
+	immutablePolicyErr  error
+)
+
+//go:embed assets/cli-policy.default.json
+var defaultCLIPolicyJSON []byte
+
+type immutableCommandPolicy struct {
+	ImmutableSystem bool
+	ImmutableReason string
+	BlockedCommands []string
+	Message         string
+}
+
+type cliPolicyFile struct {
+	PolicyVersion   int       `json:"policy_version"`
+	ImmutableSystem *bool     `json:"immutable_system"`
+	BlockedCommands *[]string `json:"blocked_commands"`
+	Message         *string   `json:"message"`
+}
+
+func normalizeCommandSpec(raw string) string {
+	normalized := strings.ToLower(strings.TrimSpace(raw))
+	normalized = strings.TrimPrefix(normalized, "dms ")
+	return strings.Join(strings.Fields(normalized), " ")
+}
+
+func normalizeBlockedCommands(raw []string) []string {
+	normalized := make([]string, 0, len(raw))
+	seen := make(map[string]bool)
+
+	for _, cmd := range raw {
+		spec := normalizeCommandSpec(cmd)
+		if spec == "" || seen[spec] {
+			continue
+		}
+		seen[spec] = true
+		normalized = append(normalized, spec)
+	}
+
+	return normalized
+}
+
+func commandBlockedByPolicy(commandPath string, blocked []string) bool {
+	normalizedPath := normalizeCommandSpec(commandPath)
+	if normalizedPath == "" {
+		return false
+	}
+
+	for _, entry := range blocked {
+		spec := normalizeCommandSpec(entry)
+		if spec == "" {
+			continue
+		}
+		if normalizedPath == spec || strings.HasPrefix(normalizedPath, spec+" ") {
+			return true
+		}
+	}
+
+	return false
+}
+
+func loadPolicyFile(path string) (*cliPolicyFile, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("failed to read %s: %w", path, err)
+	}
+
+	var policy cliPolicyFile
+	if err := json.Unmarshal(data, &policy); err != nil {
+		return nil, fmt.Errorf("failed to parse %s: %w", path, err)
+	}
+
+	return &policy, nil
+}
+
+func mergePolicyFile(base *immutableCommandPolicy, path string) error {
+	policyFile, err := loadPolicyFile(path)
+	if err != nil {
+		return err
+	}
+	if policyFile == nil {
+		return nil
+	}
+
+	if policyFile.ImmutableSystem != nil {
+		base.ImmutableSystem = *policyFile.ImmutableSystem
+	}
+	if policyFile.BlockedCommands != nil {
+		base.BlockedCommands = normalizeBlockedCommands(*policyFile.BlockedCommands)
+	}
+	if policyFile.Message != nil {
+		msg := strings.TrimSpace(*policyFile.Message)
+		if msg != "" {
+			base.Message = msg
+		}
+	}
+
+	return nil
+}
+
+func readOSReleaseMap(path string) map[string]string {
+	values := make(map[string]string)
+
+	file, err := os.Open(path)
+	if err != nil {
+		return values
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		parts := strings.SplitN(line, "=", 2)
+		if len(parts) != 2 {
+			continue
+		}
+		key := strings.ToUpper(strings.TrimSpace(parts[0]))
+		value := strings.Trim(strings.TrimSpace(parts[1]), "\"")
+		values[key] = strings.ToLower(value)
+	}
+
+	return values
+}
+
+func hasAnyToken(text string, tokens ...string) bool {
+	if text == "" {
+		return false
+	}
+	for _, token := range tokens {
+		if strings.Contains(text, token) {
+			return true
+		}
+	}
+	return false
+}
+
+func detectImmutableSystem() (bool, string) {
+	if _, err := os.Stat("/run/ostree-booted"); err == nil {
+		return true, "/run/ostree-booted is present"
+	}
+
+	osRelease := readOSReleaseMap("/etc/os-release")
+	if len(osRelease) == 0 {
+		return false, ""
+	}
+
+	id := osRelease["ID"]
+	idLike := osRelease["ID_LIKE"]
+	variantID := osRelease["VARIANT_ID"]
+	name := osRelease["NAME"]
+	prettyName := osRelease["PRETTY_NAME"]
+
+	immutableIDs := map[string]bool{
+		"bluefin":       true,
+		"bazzite":       true,
+		"silverblue":    true,
+		"kinoite":       true,
+		"sericea":       true,
+		"onyx":          true,
+		"aurora":        true,
+		"fedora-iot":    true,
+		"fedora-coreos": true,
+	}
+	if immutableIDs[id] {
+		return true, "os-release ID=" + id
+	}
+
+	markers := []string{"silverblue", "kinoite", "sericea", "onyx", "bazzite", "bluefin", "aurora", "ostree", "atomic"}
+	if hasAnyToken(variantID, markers...) {
+		return true, "os-release VARIANT_ID=" + variantID
+	}
+	if hasAnyToken(idLike, "ostree", "rpm-ostree") {
+		return true, "os-release ID_LIKE=" + idLike
+	}
+	if hasAnyToken(name, markers...) || hasAnyToken(prettyName, markers...) {
+		return true, "os-release identifies an atomic/ostree variant"
+	}
+
+	return false, ""
+}
+
+func getImmutablePolicy() (*immutableCommandPolicy, error) {
+	immutablePolicyOnce.Do(func() {
+		detectedImmutable, reason := detectImmutableSystem()
+		immutablePolicy = immutableCommandPolicy{
+			ImmutableSystem: detectedImmutable,
+			ImmutableReason: reason,
+			BlockedCommands: []string{"greeter install", "greeter enable", "setup"},
+			Message:         "This command is disabled on immutable/image-based systems. Use your distro-native workflow for system-level changes.",
+		}
+
+		var defaultPolicy cliPolicyFile
+		if err := json.Unmarshal(defaultCLIPolicyJSON, &defaultPolicy); err != nil {
+			immutablePolicyErr = fmt.Errorf("failed to parse embedded default CLI policy: %w", err)
+			return
+		}
+		if defaultPolicy.BlockedCommands != nil {
+			immutablePolicy.BlockedCommands = normalizeBlockedCommands(*defaultPolicy.BlockedCommands)
+		}
+		if defaultPolicy.Message != nil {
+			msg := strings.TrimSpace(*defaultPolicy.Message)
+			if msg != "" {
+				immutablePolicy.Message = msg
+			}
+		}
+
+		if err := mergePolicyFile(&immutablePolicy, cliPolicyPackagedPath); err != nil {
+			immutablePolicyErr = err
+			return
+		}
+		if err := mergePolicyFile(&immutablePolicy, cliPolicyAdminPath); err != nil {
+			immutablePolicyErr = err
+			return
+		}
+	})
+
+	if immutablePolicyErr != nil {
+		return nil, immutablePolicyErr
+	}
+	return &immutablePolicy, nil
+}
+
+func requireMutableSystemCommand(cmd *cobra.Command, _ []string) error {
+	policy, err := getImmutablePolicy()
+	if err != nil {
+		return err
+	}
+	if !policy.ImmutableSystem {
+		return nil
+	}
+
+	commandPath := normalizeCommandSpec(cmd.CommandPath())
+	if !commandBlockedByPolicy(commandPath, policy.BlockedCommands) {
+		return nil
+	}
+
+	reason := ""
+	if policy.ImmutableReason != "" {
+		reason = "Detected immutable system: " + policy.ImmutableReason + "\n"
+	}
+
+	return fmt.Errorf("%s%s\nCommand: dms %s\nPolicy files:\n  %s\n  %s", reason, policy.Message, commandPath, cliPolicyPackagedPath, cliPolicyAdminPath)
+}

core/cmd/dms/main.go

@@ -5,6 +5,7 @@ package main
 import (
 	"os"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 )
 
@@ -16,19 +17,10 @@ func init() {
 	runCmd.Flags().Bool("session", false, "Session managed (like as a systemd unit)")
 	runCmd.Flags().MarkHidden("daemon-child")
 
-	// Add subcommands to greeter
-	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd)
-
-	// Add subcommands to setup
+	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
-
-	// Add subcommands to update
 	updateCmd.AddCommand(updateCheckCmd)
-
-	// Add subcommands to plugins
 	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
-
-	// Add common commands to root
 	rootCmd.AddCommand(getCommonCommands()...)
 
 	rootCmd.AddCommand(updateCmd)
@@ -37,7 +29,9 @@ func init() {
 }
 
 func main() {
-	if os.Geteuid() == 0 {
+	clipboard.MaybeServeAndExit()
+
+	if os.Geteuid() == 0 && !isReadOnlyCommand(os.Args) {
 		log.Fatal("This program should not be run as root. Exiting.")
 	}
 

core/cmd/dms/main_distro.go

@@ -5,36 +5,30 @@ package main
 import (
 	"os"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 )
 
 var Version = "dev"
 
 func init() {
-	// Add flags
 	runCmd.Flags().BoolP("daemon", "d", false, "Run in daemon mode")
 	runCmd.Flags().Bool("daemon-child", false, "Internal flag for daemon child process")
 	runCmd.Flags().Bool("session", false, "Session managed (like as a systemd unit)")
 	runCmd.Flags().MarkHidden("daemon-child")
 
-	// Add subcommands to greeter
-	greeterCmd.AddCommand(greeterSyncCmd, greeterEnableCmd, greeterStatusCmd)
-
-	// Add subcommands to setup
+	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
-
-	// Add subcommands to plugins
 	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
-
-	// Add common commands to root
 	rootCmd.AddCommand(getCommonCommands()...)
 
 	rootCmd.SetHelpTemplate(getHelpTemplate())
 }
 
 func main() {
-	// Block root
-	if os.Geteuid() == 0 {
+	clipboard.MaybeServeAndExit()
+
+	if os.Geteuid() == 0 && !isReadOnlyCommand(os.Args) {
 		log.Fatal("This program should not be run as root. Exiting.")
 	}
 

core/cmd/dms/randr_client.go

@@ -0,0 +1,172 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/wlr_output_management"
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
+)
+
+type randrOutput struct {
+	Name    string  `json:"name"`
+	Scale   float64 `json:"scale"`
+	Width   int32   `json:"width"`
+	Height  int32   `json:"height"`
+	Refresh int32   `json:"refresh"`
+	Enabled bool    `json:"enabled"`
+}
+
+type randrHead struct {
+	name          string
+	enabled       bool
+	scale         float64
+	currentModeID uint32
+	modeIDs       []uint32
+}
+
+type randrMode struct {
+	width   int32
+	height  int32
+	refresh int32
+}
+
+type randrClient struct {
+	display *wlclient.Display
+	ctx     *wlclient.Context
+	manager *wlr_output_management.ZwlrOutputManagerV1
+	heads   map[uint32]*randrHead
+	modes   map[uint32]*randrMode
+	done    bool
+	err     error
+}
+
+func queryRandr() ([]randrOutput, error) {
+	display, err := wlclient.Connect("")
+	if err != nil {
+		return nil, fmt.Errorf("failed to connect to Wayland: %w", err)
+	}
+
+	c := &randrClient{
+		display: display,
+		ctx:     display.Context(),
+		heads:   make(map[uint32]*randrHead),
+		modes:   make(map[uint32]*randrMode),
+	}
+	defer c.ctx.Close()
+
+	registry, err := display.GetRegistry()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get registry: %w", err)
+	}
+
+	registry.SetGlobalHandler(func(e wlclient.RegistryGlobalEvent) {
+		if e.Interface == wlr_output_management.ZwlrOutputManagerV1InterfaceName {
+			mgr := wlr_output_management.NewZwlrOutputManagerV1(c.ctx)
+			version := min(e.Version, 4)
+
+			mgr.SetHeadHandler(func(e wlr_output_management.ZwlrOutputManagerV1HeadEvent) {
+				c.handleHead(e)
+			})
+
+			mgr.SetDoneHandler(func(e wlr_output_management.ZwlrOutputManagerV1DoneEvent) {
+				c.done = true
+			})
+
+			if err := registry.Bind(e.Name, e.Interface, version, mgr); err == nil {
+				c.manager = mgr
+			}
+		}
+	})
+
+	// First roundtrip: discover globals and bind manager
+	syncCallback, err := display.Sync()
+	if err != nil {
+		return nil, fmt.Errorf("failed to sync display: %w", err)
+	}
+	syncCallback.SetDoneHandler(func(e wlclient.CallbackDoneEvent) {
+		if c.manager == nil {
+			c.err = fmt.Errorf("zwlr_output_manager_v1 protocol not supported by compositor")
+			c.done = true
+		}
+		// Otherwise wait for manager's DoneHandler
+	})
+
+	for !c.done {
+		if err := c.ctx.Dispatch(); err != nil {
+			return nil, fmt.Errorf("dispatch error: %w", err)
+		}
+	}
+
+	if c.err != nil {
+		return nil, c.err
+	}
+
+	return c.buildOutputs(), nil
+}
+
+func (c *randrClient) handleHead(e wlr_output_management.ZwlrOutputManagerV1HeadEvent) {
+	handle := e.Head
+	headID := handle.ID()
+
+	head := &randrHead{
+		modeIDs: make([]uint32, 0),
+	}
+	c.heads[headID] = head
+
+	handle.SetNameHandler(func(e wlr_output_management.ZwlrOutputHeadV1NameEvent) {
+		head.name = e.Name
+	})
+
+	handle.SetEnabledHandler(func(e wlr_output_management.ZwlrOutputHeadV1EnabledEvent) {
+		head.enabled = e.Enabled != 0
+	})
+
+	handle.SetScaleHandler(func(e wlr_output_management.ZwlrOutputHeadV1ScaleEvent) {
+		head.scale = e.Scale
+	})
+
+	handle.SetCurrentModeHandler(func(e wlr_output_management.ZwlrOutputHeadV1CurrentModeEvent) {
+		head.currentModeID = e.Mode.ID()
+	})
+
+	handle.SetModeHandler(func(e wlr_output_management.ZwlrOutputHeadV1ModeEvent) {
+		modeHandle := e.Mode
+		modeID := modeHandle.ID()
+
+		head.modeIDs = append(head.modeIDs, modeID)
+
+		mode := &randrMode{}
+		c.modes[modeID] = mode
+
+		modeHandle.SetSizeHandler(func(e wlr_output_management.ZwlrOutputModeV1SizeEvent) {
+			mode.width = e.Width
+			mode.height = e.Height
+		})
+
+		modeHandle.SetRefreshHandler(func(e wlr_output_management.ZwlrOutputModeV1RefreshEvent) {
+			mode.refresh = e.Refresh
+		})
+	})
+}
+
+func (c *randrClient) buildOutputs() []randrOutput {
+	outputs := make([]randrOutput, 0, len(c.heads))
+
+	for _, head := range c.heads {
+		out := randrOutput{
+			Name:    head.name,
+			Scale:   head.scale,
+			Enabled: head.enabled,
+		}
+
+		if mode, ok := c.modes[head.currentModeID]; ok {
+			out.Width = mode.width
+			out.Height = mode.height
+			out.Refresh = mode.refresh
+		}
+
+		outputs = append(outputs, out)
+	}
+
+	return outputs
+}

core/cmd/dms/shell.go

@@ -210,7 +210,7 @@ func runShellInteractive(session bool) {
 		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORMTHEME_QT6=gtk3")
 	}
 	if os.Getenv("QT_QPA_PLATFORM") == "" {
-		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORM=wayland")
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORM=wayland;xcb")
 	}
 
 	cmd.Stdin = os.Stdin
@@ -450,7 +450,7 @@ func runShellDaemon(session bool) {
 		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORMTHEME_QT6=gtk3")
 	}
 	if os.Getenv("QT_QPA_PLATFORM") == "" {
-		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORM=wayland")
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORM=wayland;xcb")
 	}
 
 	devNull, err := os.OpenFile("/dev/null", os.O_RDWR, 0)
@@ -616,6 +616,43 @@ func getShellIPCCompletions(args []string, _ string) []string {
 	return nil
 }
 
+func getFirstDMSPID() (int, bool) {
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return 0, false
+	}
+
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), "danklinux-") || !strings.HasSuffix(entry.Name(), ".pid") {
+			continue
+		}
+
+		data, err := os.ReadFile(filepath.Join(dir, entry.Name()))
+		if err != nil {
+			continue
+		}
+
+		pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+		if err != nil {
+			continue
+		}
+
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			continue
+		}
+
+		if proc.Signal(syscall.Signal(0)) != nil {
+			continue
+		}
+
+		return pid, true
+	}
+
+	return 0, false
+}
+
 func runShellIPCCommand(args []string) {
 	if len(args) == 0 {
 		printIPCHelp()
@@ -627,10 +664,21 @@ func runShellIPCCommand(args []string) {
 	}
 
 	cmdArgs := []string{"ipc"}
-	if qsHasAnyDisplay() {
-		cmdArgs = append(cmdArgs, "--any-display")
+
+	switch pid, ok := getFirstDMSPID(); {
+	case ok:
+		cmdArgs = append(cmdArgs, "--pid", strconv.Itoa(pid))
+	default:
+		if err := findConfig(nil, nil); err != nil {
+			log.Fatalf("Error finding config: %v", err)
+		}
+		// ! TODO - remove check when QS 0.3 is released
+		if qsHasAnyDisplay() {
+			cmdArgs = append(cmdArgs, "--any-display")
+		}
+		cmdArgs = append(cmdArgs, "-p", configPath)
 	}
-	cmdArgs = append(cmdArgs, "-p", configPath)
+
 	cmdArgs = append(cmdArgs, args...)
 	cmd := exec.Command("qs", cmdArgs...)
 	cmd.Stdin = os.Stdin

core/cmd/dms/utils.go

@@ -7,12 +7,20 @@ import (
 	"strings"
 )
 
-func findCommandPath(cmd string) (string, error) {
-	path, err := exec.LookPath(cmd)
-	if err != nil {
-		return "", fmt.Errorf("command '%s' not found in PATH", cmd)
+// isReadOnlyCommand returns true if the CLI args indicate a command that is
+// safe to run as root (e.g. shell completion, help).
+func isReadOnlyCommand(args []string) bool {
+	for _, arg := range args[1:] {
+		if strings.HasPrefix(arg, "-") {
+			continue
+		}
+		switch arg {
+		case "completion", "help", "__complete":
+			return true
+		}
+		return false
 	}
-	return path, nil
+	return false
 }
 
 func isArchPackageInstalled(packageName string) bool {

core/go.mod

@@ -19,7 +19,7 @@ require (
 	github.com/yuin/goldmark v1.7.16
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	go.etcd.io/bbolt v1.4.3
-	golang.org/x/exp v0.0.0-20260211191109-2735e65f0518
+	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a
 	golang.org/x/image v0.36.0
 )
 
@@ -27,7 +27,7 @@ require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.3.0 // indirect
 	github.com/clipperhouse/displaywidth v0.10.0 // indirect
-	github.com/clipperhouse/uax29/v2 v2.6.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/dlclark/regexp2 v1.11.5 // indirect
@@ -36,7 +36,7 @@ require (
 	github.com/go-git/go-billy/v6 v6.0.0-20260209124918-37866f83c2d3 // indirect
 	github.com/go-logfmt/logfmt v0.6.1 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
-	github.com/kevinburke/ssh_config v1.4.0 // indirect
+	github.com/kevinburke/ssh_config v1.6.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/pjbgf/sha1cd v0.5.0 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
@@ -55,7 +55,7 @@ require (
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/go-git/go-git/v6 v6.0.0-20260210102253-e4d10f0e569a
+	github.com/go-git/go-git/v6 v6.0.0-20260216160506-e6a3f881772f
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -71,7 +71,7 @@ require (
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sys v0.41.0
 	golang.org/x/text v0.34.0
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 // v0.0.1 tag is missing a LICENSE file; master has it.

core/go.sum

@@ -40,8 +40,8 @@ github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSg
 github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
 github.com/clipperhouse/displaywidth v0.10.0 h1:GhBG8WuerxjFQQYeuZAeVTuyxuX+UraiZGD4HJQ3Y8g=
 github.com/clipperhouse/displaywidth v0.10.0/go.mod h1:XqJajYsaiEwkxOj4bowCTMcT1SgvHo9flfF3jQasdbs=
-github.com/clipperhouse/uax29/v2 v2.6.0 h1:z0cDbUV+aPASdFb2/ndFnS9ts/WNXgTNNGFoKXuhpos=
-github.com/clipperhouse/uax29/v2 v2.6.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -68,8 +68,8 @@ github.com/go-git/go-billy/v6 v6.0.0-20260209124918-37866f83c2d3 h1:UU7oARtwQ5g8
 github.com/go-git/go-billy/v6 v6.0.0-20260209124918-37866f83c2d3/go.mod h1:ZW9JC5gionMP1kv5uiaOaV23q0FFmNrVOV8VW+y/acc=
 github.com/go-git/go-git-fixtures/v5 v5.1.2-0.20260122163445-0622d7459a67 h1:3hutPZF+/FBjR/9MdsLJ7e1mlt9pwHgwxMW7CrbmWII=
 github.com/go-git/go-git-fixtures/v5 v5.1.2-0.20260122163445-0622d7459a67/go.mod h1:xKt0pNHST9tYHvbiLxSY27CQWFwgIxBJuDrOE0JvbZw=
-github.com/go-git/go-git/v6 v6.0.0-20260210102253-e4d10f0e569a h1:LLju0NuXQqR4WmGl1Dm86b9ZXsvXgLYbx/aaAjdQr6w=
-github.com/go-git/go-git/v6 v6.0.0-20260210102253-e4d10f0e569a/go.mod h1:IdXOePSwsMKGpuAbpczsm+f0Uy5fdHHjwgDPOymKA78=
+github.com/go-git/go-git/v6 v6.0.0-20260216160506-e6a3f881772f h1:TBkCJv9YwPOuXq1OG0r01bcxRrvs15Hp/DtZuPt4H6s=
+github.com/go-git/go-git/v6 v6.0.0-20260216160506-e6a3f881772f/go.mod h1:B88nWzfnhTlIikoJ4d84Nc9noKS5mJoA7SgDdkt0aPU=
 github.com/go-logfmt/logfmt v0.6.1 h1:4hvbpePJKnIzH1B+8OR/JPbTx37NktoI9LE2QZBBkvE=
 github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/z6CO0XAk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
@@ -86,8 +86,8 @@ github.com/holoplot/go-evdev v0.0.0-20250804134636-ab1d56a1fe83 h1:B+A58zGFuDrvE
 github.com/holoplot/go-evdev v0.0.0-20250804134636-ab1d56a1fe83/go.mod h1:iHAf8OIncO2gcQ8XOjS7CMJ2aPbX2Bs0wl5pZyanEqk=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/kevinburke/ssh_config v1.4.0 h1:6xxtP5bZ2E4NF5tuQulISpTO2z8XbtH8cg1PWkxoFkQ=
-github.com/kevinburke/ssh_config v1.4.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
+github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
+github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -152,8 +152,8 @@ go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
 golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/exp v0.0.0-20260211191109-2735e65f0518 h1:2E1CW7v5QB+Wi3N+MXllOtVR6SFmI8iJM8EdzgxrgrU=
-golang.org/x/exp v0.0.0-20260211191109-2735e65f0518/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
+golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a h1:ovFr6Z0MNmU7nH8VaX5xqw+05ST2uO1exVfZPVqRC5o=
+golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
 golang.org/x/image v0.36.0 h1:Iknbfm1afbgtwPTmHnS2gTM/6PPZfH+z2EFuOkSbqwc=
 golang.org/x/image v0.36.0/go.mod h1:YsWD2TyyGKiIX1kZlu9QfKIsQ4nAAK9bdgdrIsE7xy4=
 golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=

core/internal/blur/probe.go

@@ -0,0 +1,35 @@
+package blur
+
+import (
+	wlhelpers "github.com/AvengeMedia/DankMaterialShell/core/internal/wayland/client"
+	client "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
+)
+
+const extBackgroundEffectInterface = "ext_background_effect_manager_v1"
+
+func ProbeSupport() (bool, error) {
+	display, err := client.Connect("")
+	if err != nil {
+		return false, err
+	}
+	defer display.Context().Close()
+
+	registry, err := display.GetRegistry()
+	if err != nil {
+		return false, err
+	}
+
+	found := false
+	registry.SetGlobalHandler(func(e client.RegistryGlobalEvent) {
+		switch e.Interface {
+		case extBackgroundEffectInterface:
+			found = true
+		}
+	})
+
+	if err := wlhelpers.Roundtrip(display, display.Context()); err != nil {
+		return false, err
+	}
+
+	return found, nil
+}

core/internal/clipboard/clipboard.go

@@ -5,55 +5,196 @@ import (
 	"io"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"syscall"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/ext_data_control"
 	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
 
+const envServe = "_DMS_CLIPBOARD_SERVE"
+const envMime = "_DMS_CLIPBOARD_MIME"
+const envPasteOnce = "_DMS_CLIPBOARD_PASTE_ONCE"
+const envCacheFile = "_DMS_CLIPBOARD_CACHE"
+
+// MaybeServeAndExit intercepts before cobra when re-exec'd as a clipboard
+// child. Reads source data into memory, deletes any cache file, then serves.
+func MaybeServeAndExit() {
+	if os.Getenv(envServe) == "" {
+		return
+	}
+
+	mimeType := os.Getenv(envMime)
+	pasteOnce := os.Getenv(envPasteOnce) == "1"
+	cachePath := os.Getenv(envCacheFile)
+
+	var data []byte
+	var err error
+
+	switch {
+	case cachePath != "":
+		data, err = os.ReadFile(cachePath)
+		os.Remove(cachePath)
+	default:
+		data, err = io.ReadAll(os.Stdin)
+	}
+
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "clipboard: read source: %v\n", err)
+		os.Exit(1)
+	}
+
+	if err := serveClipboard(data, mimeType, pasteOnce); err != nil {
+		fmt.Fprintf(os.Stderr, "clipboard: serve: %v\n", err)
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+
 func Copy(data []byte, mimeType string) error {
-	return CopyOpts(data, mimeType, false, false)
+	return copyForkCached(data, mimeType, false)
 }
 
 func CopyOpts(data []byte, mimeType string, foreground, pasteOnce bool) error {
-	if !foreground {
-		return copyFork(data, mimeType, pasteOnce)
+	if foreground {
+		return serveClipboard(data, mimeType, pasteOnce)
 	}
-	return copyServe(data, mimeType, pasteOnce)
+	return copyForkCached(data, mimeType, pasteOnce)
 }
 
-func copyFork(data []byte, mimeType string, pasteOnce bool) error {
-	args := []string{os.Args[0], "cl", "copy", "--foreground"}
-	if pasteOnce {
-		args = append(args, "--paste-once")
+func CopyReader(data io.Reader, mimeType string, foreground, pasteOnce bool) error {
+	if foreground {
+		buf, err := io.ReadAll(data)
+		if err != nil {
+			return fmt.Errorf("read source: %w", err)
+		}
+		return serveClipboard(buf, mimeType, pasteOnce)
 	}
-	args = append(args, "--type", mimeType)
+	return copyFork(data, mimeType, pasteOnce)
+}
 
-	cmd := exec.Command(args[0], args[1:]...)
-	cmd.Stdin = nil
-	cmd.Stdout = nil
+func newForkCmd(mimeType string, pasteOnce bool, extra ...string) *exec.Cmd {
+	cmd := exec.Command(os.Args[0])
 	cmd.Stderr = nil
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
-
-	stdin, err := cmd.StdinPipe()
-	if err != nil {
-		return fmt.Errorf("stdin pipe: %w", err)
+	cmd.Env = append(os.Environ(),
+		envServe+"=1",
+		envMime+"="+mimeType,
+	)
+	if pasteOnce {
+		cmd.Env = append(cmd.Env, envPasteOnce+"=1")
 	}
+	cmd.Env = append(cmd.Env, extra...)
+	return cmd
+}
 
+func waitReady(cmd *exec.Cmd) error {
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return fmt.Errorf("stdout pipe: %w", err)
+	}
 	if err := cmd.Start(); err != nil {
 		return fmt.Errorf("start: %w", err)
 	}
-
-	if _, err := stdin.Write(data); err != nil {
-		stdin.Close()
-		return fmt.Errorf("write stdin: %w", err)
+	var buf [1]byte
+	if _, err := stdout.Read(buf[:]); err != nil {
+		return fmt.Errorf("waiting for clipboard ready: %w", err)
 	}
-	stdin.Close()
-
 	return nil
 }
 
-func copyServe(data []byte, mimeType string, pasteOnce bool) error {
+func copyForkCached(data []byte, mimeType string, pasteOnce bool) error {
+	cacheFile, err := createClipboardCacheFile()
+	if err != nil {
+		return fmt.Errorf("create cache file: %w", err)
+	}
+	cachePath := cacheFile.Name()
+
+	if _, err := cacheFile.Write(data); err != nil {
+		cacheFile.Close()
+		os.Remove(cachePath)
+		return fmt.Errorf("write cache file: %w", err)
+	}
+	if err := cacheFile.Close(); err != nil {
+		os.Remove(cachePath)
+		return fmt.Errorf("close cache file: %w", err)
+	}
+
+	cmd := newForkCmd(mimeType, pasteOnce, envCacheFile+"="+cachePath)
+	cmd.Stdin = nil
+	if err := waitReady(cmd); err != nil {
+		os.Remove(cachePath)
+		return err
+	}
+	return nil
+}
+
+func copyFork(data io.Reader, mimeType string, pasteOnce bool) error {
+	cmd := newForkCmd(mimeType, pasteOnce)
+
+	switch src := data.(type) {
+	case *os.File:
+		cmd.Stdin = src
+		return waitReady(cmd)
+
+	default:
+		stdin, err := cmd.StdinPipe()
+		if err != nil {
+			return fmt.Errorf("stdin pipe: %w", err)
+		}
+
+		stdout, err := cmd.StdoutPipe()
+		if err != nil {
+			return fmt.Errorf("stdout pipe: %w", err)
+		}
+
+		if err := cmd.Start(); err != nil {
+			return fmt.Errorf("start: %w", err)
+		}
+		if _, err := io.Copy(stdin, data); err != nil {
+			stdin.Close()
+			return fmt.Errorf("write stdin: %w", err)
+		}
+		if err := stdin.Close(); err != nil {
+			return fmt.Errorf("close stdin: %w", err)
+		}
+
+		var buf [1]byte
+		if _, err := stdout.Read(buf[:]); err != nil {
+			return fmt.Errorf("waiting for clipboard ready: %w", err)
+		}
+		return nil
+	}
+}
+
+func signalReady() {
+	if os.Getenv(envServe) == "" {
+		return
+	}
+	os.Stdout.Write([]byte{1})
+}
+
+func createClipboardCacheFile() (*os.File, error) {
+	preferredDirs := []string{}
+
+	if cacheDir, err := os.UserCacheDir(); err == nil {
+		preferredDirs = append(preferredDirs, filepath.Join(cacheDir, "dms", "clipboard"))
+	}
+	preferredDirs = append(preferredDirs, "/var/tmp/dms/clipboard")
+
+	for _, dir := range preferredDirs {
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			continue
+		}
+		cachedData, err := os.CreateTemp(dir, "dms-clipboard-*")
+		if err == nil {
+			return cachedData, nil
+		}
+	}
+	return os.CreateTemp("", "dms-clipboard-*")
+}
+
+func serveClipboard(data []byte, mimeType string, pasteOnce bool) error {
 	display, err := wlclient.Connect("")
 	if err != nil {
 		return fmt.Errorf("wayland connect: %w", err)
@@ -95,12 +236,10 @@ func copyServe(data []byte, mimeType string, pasteOnce bool) error {
 	if bindErr != nil {
 		return fmt.Errorf("registry bind: %w", bindErr)
 	}
-
 	if dataControlMgr == nil {
 		return fmt.Errorf("compositor does not support ext_data_control_manager_v1")
 	}
 	defer dataControlMgr.Destroy()
-
 	if seat == nil {
 		return fmt.Errorf("no seat available")
 	}
@@ -141,10 +280,10 @@ func copyServe(data []byte, mimeType string, pasteOnce bool) error {
 	pasted := make(chan struct{}, 1)
 
 	source.SetSendHandler(func(e ext_data_control.ExtDataControlSourceV1SendEvent) {
-		defer syscall.Close(e.Fd)
+		_ = syscall.SetNonblock(e.Fd, false)
 		file := os.NewFile(uintptr(e.Fd), "pipe")
 		defer file.Close()
-		file.Write(data)
+		_, _ = file.Write(data)
 		select {
 		case pasted <- struct{}{}:
 		default:
@@ -160,6 +299,7 @@ func copyServe(data []byte, mimeType string, pasteOnce bool) error {
 	}
 
 	display.Roundtrip()
+	signalReady()
 
 	for {
 		select {
@@ -418,12 +558,10 @@ func copyMultiServe(offers []Offer, pasteOnce bool) error {
 	if bindErr != nil {
 		return fmt.Errorf("registry bind: %w", bindErr)
 	}
-
 	if dataControlMgr == nil {
 		return fmt.Errorf("compositor does not support ext_data_control_manager_v1")
 	}
 	defer dataControlMgr.Destroy()
-
 	if seat == nil {
 		return fmt.Errorf("no seat available")
 	}
@@ -451,12 +589,12 @@ func copyMultiServe(offers []Offer, pasteOnce bool) error {
 	pasted := make(chan struct{}, 1)
 
 	source.SetSendHandler(func(e ext_data_control.ExtDataControlSourceV1SendEvent) {
-		defer syscall.Close(e.Fd)
+		_ = syscall.SetNonblock(e.Fd, false)
 		file := os.NewFile(uintptr(e.Fd), "pipe")
 		defer file.Close()
 
 		if data, ok := offerMap[e.MimeType]; ok {
-			file.Write(data)
+			_, _ = file.Write(data)
 		}
 
 		select {

core/internal/config/deployer.go

@@ -644,7 +644,7 @@ func (cd *ConfigDeployer) transformHyprlandConfigForNonSystemd(config, terminalC
 		if strings.HasPrefix(trimmed, "exec-once = systemctl --user start") {
 			startupSectionFound = true
 			result = append(result, "exec-once = dms run")
-			result = append(result, "env = QT_QPA_PLATFORM,wayland")
+			result = append(result, "env = QT_QPA_PLATFORM,wayland;xcb")
 			result = append(result, "env = ELECTRON_OZONE_PLATFORM_HINT,auto")
 			result = append(result, "env = QT_QPA_PLATFORMTHEME,gtk3")
 			result = append(result, "env = QT_QPA_PLATFORMTHEME_QT6,gtk3")
@@ -659,7 +659,7 @@ func (cd *ConfigDeployer) transformHyprlandConfigForNonSystemd(config, terminalC
 			if strings.Contains(line, "STARTUP APPS") {
 				insertLines := []string{
 					"exec-once = dms run",
-					"env = QT_QPA_PLATFORM,wayland",
+					"env = QT_QPA_PLATFORM,wayland;xcb",
 					"env = ELECTRON_OZONE_PLATFORM_HINT,auto",
 					"env = QT_QPA_PLATFORMTHEME,gtk3",
 					"env = QT_QPA_PLATFORMTHEME_QT6,gtk3",
@@ -677,7 +677,7 @@ func (cd *ConfigDeployer) transformHyprlandConfigForNonSystemd(config, terminalC
 func (cd *ConfigDeployer) transformNiriConfigForNonSystemd(config, terminalCommand string) string {
 	envVars := fmt.Sprintf(`environment {
   XDG_CURRENT_DESKTOP "niri"
-  QT_QPA_PLATFORM "wayland"
+  QT_QPA_PLATFORM "wayland;xcb"
   ELECTRON_OZONE_PLATFORM_HINT "auto"
   QT_QPA_PLATFORMTHEME "gtk3"
   QT_QPA_PLATFORMTHEME_QT6 "gtk3"

core/internal/config/embedded/hypr-binds.conf

@@ -137,7 +137,7 @@ bind = SUPER, bracketright, layoutmsg, preselect r
 
 # === Sizing & Layout ===
 bind = SUPER, R, layoutmsg, togglesplit
-bind = SUPER CTRL, F, resizeactive, exact 100%
+bind = SUPER CTRL, F, resizeactive, exact 100% 100%
 
 # === Move/resize windows with mainMod + LMB/RMB and dragging ===
 bindmd = SUPER, mouse:272, Move window, movewindow

core/internal/config/embedded/hyprland.conf

@@ -94,13 +94,14 @@ windowrule = tile on, match:class ^(gnome-control-center)$
 windowrule = tile on, match:class ^(pavucontrol)$
 windowrule = tile on, match:class ^(nm-connection-editor)$
 
+windowrule = float on, match:class ^(org\.gnome\.Calculator)$
 windowrule = float on, match:class ^(gnome-calculator)$
 windowrule = float on, match:class ^(galculator)$
 windowrule = float on, match:class ^(blueman-manager)$
 windowrule = float on, match:class ^(org\.gnome\.Nautilus)$
 windowrule = float on, match:class ^(xdg-desktop-portal)$
 
-windowrule = noinitialfocus on, match:class ^(steam)$, match:title ^(notificationtoasts)
+windowrule = no_initial_focus on, match:class ^(steam)$, match:title ^(notificationtoasts)
 windowrule = pin on, match:class ^(steam)$, match:title ^(notificationtoasts)
 
 windowrule = float on, match:class ^(firefox)$, match:title ^(Picture-in-Picture)$
@@ -111,6 +112,7 @@ windowrule = float on, match:class ^(zoom)$
 # windowrule = float on, match:class ^(org.quickshell)$
 
 layerrule = no_anim on, match:namespace ^(quickshell)$
+layerrule = no_anim on, match:namespace ^dms:.*
 
 source = ./dms/colors.conf
 source = ./dms/outputs.conf

core/internal/config/embedded/niri.kdl

@@ -224,6 +224,7 @@ window-rule {
     open-floating false
 }
 window-rule {
+    match app-id=r#"^org\.gnome\.Calculator$"#
     match app-id=r#"^gnome-calculator$"#
     match app-id=r#"^galculator$"#
     match app-id=r#"^blueman-manager$"#
@@ -252,6 +253,7 @@ window-rule {
 // Open dms windows as floating by default
 window-rule {
     match app-id=r#"org.quickshell$"#
+    match app-id=r#"com.danklinux.dms$"#
     open-floating true
 }
 debug {

core/internal/distros/arch.go

@@ -26,6 +26,9 @@ func init() {
 	Register("cachyos", "#08A283", FamilyArch, func(config DistroConfig, logChan chan<- string) Distribution {
 		return NewArchDistribution(config, logChan)
 	})
+	Register("catos", "#1793D1", FamilyArch, func(config DistroConfig, logChan chan<- string) Distribution {
+		return NewArchDistribution(config, logChan)
+	})
 	Register("endeavouros", "#7F3FBF", FamilyArch, func(config DistroConfig, logChan chan<- string) Distribution {
 		return NewArchDistribution(config, logChan)
 	})
@@ -94,6 +97,7 @@ func (a *ArchDistribution) DetectDependenciesWithTerminal(ctx context.Context, w
 	dependencies = append(dependencies, a.detectGit())
 	dependencies = append(dependencies, a.detectWindowManager(wm))
 	dependencies = append(dependencies, a.detectQuickshell())
+	dependencies = append(dependencies, a.detectDMSGreeter())
 	dependencies = append(dependencies, a.detectXDGPortal())
 	dependencies = append(dependencies, a.detectAccountsService())
 
@@ -121,12 +125,52 @@ func (a *ArchDistribution) detectAccountsService() deps.Dependency {
 	return a.detectPackage("accountsservice", "D-Bus interface for user account query and manipulation", a.packageInstalled("accountsservice"))
 }
 
+func (a *ArchDistribution) detectDMSGreeter() deps.Dependency {
+	return a.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", a.packageInstalled("greetd-dms-greeter-git"))
+}
+
 func (a *ArchDistribution) packageInstalled(pkg string) bool {
 	cmd := exec.Command("pacman", "-Q", pkg)
 	err := cmd.Run()
 	return err == nil
 }
 
+// parseSRCINFODeps reads a .SRCINFO file and returns runtime dep and makedep package
+func parseSRCINFODeps(srcinfoPath string) (deps []string, makedeps []string, err error) {
+	data, err := os.ReadFile(srcinfoPath)
+	if err != nil {
+		return nil, nil, err
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		line = strings.TrimSpace(line)
+		var pkg string
+		var target *[]string
+		switch {
+		case strings.HasPrefix(line, "makedepends = "):
+			pkg = strings.TrimPrefix(line, "makedepends = ")
+			target = &makedeps
+		case strings.HasPrefix(line, "depends = "):
+			pkg = strings.TrimPrefix(line, "depends = ")
+			target = &deps
+		default:
+			continue
+		}
+		// Strip version constraint (>=, <=, >, <, =) and colon-descriptions
+		if idx := strings.IndexAny(pkg, "><:="); idx >= 0 {
+			pkg = pkg[:idx]
+		}
+		pkg = strings.TrimSpace(pkg)
+		if pkg != "" {
+			*target = append(*target, pkg)
+		}
+	}
+	return deps, makedeps, nil
+}
+
+func (a *ArchDistribution) isInSystemRepo(pkg string) bool {
+	return exec.Command("pacman", "-Si", pkg).Run() == nil
+}
+
 func (a *ArchDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
 	return a.GetPackageMappingWithVariants(wm, make(map[string]deps.PackageVariant))
 }
@@ -136,6 +180,7 @@ func (a *ArchDistribution) GetPackageMappingWithVariants(wm deps.WindowManager,
 		"dms (DankMaterialShell)": a.getDMSMapping(variants["dms (DankMaterialShell)"]),
 		"git":                     {Name: "git", Repository: RepoTypeSystem},
 		"quickshell":              a.getQuickshellMapping(variants["quickshell"]),
+		"dms-greeter":             {Name: "greetd-dms-greeter-git", Repository: RepoTypeAUR},
 		"matugen":                 a.getMatugenMapping(variants["matugen"]),
 		"dgop":                    {Name: "dgop", Repository: RepoTypeSystem},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeSystem},
@@ -197,11 +242,7 @@ func (a *ArchDistribution) getDMSMapping(variant deps.PackageVariant) PackageMap
 		return PackageMapping{Name: "dms-shell-git", Repository: RepoTypeAUR}
 	}
 
-	if a.packageInstalled("dms-shell-bin") {
-		return PackageMapping{Name: "dms-shell-bin", Repository: RepoTypeAUR}
-	}
-
-	return PackageMapping{Name: "dms-shell-bin", Repository: RepoTypeAUR}
+	return PackageMapping{Name: "dms-shell", Repository: RepoTypeSystem}
 }
 
 func (a *ArchDistribution) detectXwaylandSatellite() deps.Dependency {
@@ -283,6 +324,13 @@ func (a *ArchDistribution) InstallPackages(ctx context.Context, dependencies []d
 
 	systemPkgs, aurPkgs, manualPkgs, variantMap := a.categorizePackages(dependencies, wm, reinstallFlags, disabledFlags)
 
+	if slices.Contains(aurPkgs, "quickshell-git") && slices.Contains(systemPkgs, "dms-shell") {
+		if err := a.preinstallQuickshellGit(ctx, sudoPassword, progressChan); err != nil {
+			return fmt.Errorf("failed to preinstall quickshell-git: %w", err)
+		}
+		aurPkgs = slices.DeleteFunc(aurPkgs, func(p string) bool { return p == "quickshell-git" })
+	}
+
 	// Phase 3: System Packages
 	if len(systemPkgs) > 0 {
 		progressChan <- InstallProgressMsg{
@@ -400,6 +448,37 @@ func (a *ArchDistribution) categorizePackages(dependencies []deps.Dependency, wm
 	return systemPkgs, aurPkgs, manualPkgs, variantMap
 }
 
+func (a *ArchDistribution) preinstallQuickshellGit(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+	if a.packageInstalled("quickshell-git") {
+		return nil
+	}
+
+	if a.packageInstalled("quickshell") {
+		progressChan <- InstallProgressMsg{
+			Phase:       PhaseAURPackages,
+			Progress:    0.15,
+			Step:        "Removing stable quickshell...",
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: "sudo pacman -Rdd --noconfirm quickshell",
+			LogOutput:   "Removing stable quickshell so quickshell-git can be installed",
+		}
+		cmd := ExecSudoCommand(ctx, sudoPassword, "pacman -Rdd --noconfirm quickshell")
+		if err := a.runWithProgress(cmd, progressChan, PhaseAURPackages, 0.15, 0.18); err != nil {
+			return fmt.Errorf("failed to remove stable quickshell: %w", err)
+		}
+	}
+
+	progressChan <- InstallProgressMsg{
+		Phase:       PhaseAURPackages,
+		Progress:    0.18,
+		Step:        "Building quickshell-git before system packages...",
+		IsComplete:  false,
+		CommandInfo: "Installing quickshell-git ahead of dms-shell to avoid conflict",
+	}
+	return a.installSingleAURPackage(ctx, "quickshell-git", sudoPassword, progressChan, 0.18, 0.32)
+}
+
 func (a *ArchDistribution) installSystemPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	if len(packages) == 0 {
 		return nil
@@ -408,6 +487,9 @@ func (a *ArchDistribution) installSystemPackages(ctx context.Context, packages [
 	a.log(fmt.Sprintf("Installing system packages: %s", strings.Join(packages, ", ")))
 
 	args := []string{"pacman", "-S", "--needed", "--noconfirm"}
+	if slices.Contains(packages, "dms-shell") {
+		args = append(args, "--assume-installed", "dms-shell-compositor=1")
+	}
 	args = append(args, packages...)
 
 	progressChan <- InstallProgressMsg{
@@ -431,29 +513,10 @@ func (a *ArchDistribution) installAURPackages(ctx context.Context, packages []st
 	a.log(fmt.Sprintf("Installing AUR packages manually: %s", strings.Join(packages, ", ")))
 
 	hasNiri := false
-	hasQuickshell := false
 	for _, pkg := range packages {
 		if pkg == "niri-git" {
 			hasNiri = true
 		}
-		if pkg == "quickshell" || pkg == "quickshell-git" {
-			hasQuickshell = true
-		}
-	}
-
-	// If quickshell is in the list, always reinstall google-breakpad first
-	if hasQuickshell {
-		progressChan <- InstallProgressMsg{
-			Phase:       PhaseAURPackages,
-			Progress:    0.63,
-			Step:        "Reinstalling google-breakpad for quickshell...",
-			IsComplete:  false,
-			CommandInfo: "Reinstalling prerequisite AUR package for quickshell",
-		}
-
-		if err := a.installSingleAURPackage(ctx, "google-breakpad", sudoPassword, progressChan, 0.63, 0.65); err != nil {
-			return fmt.Errorf("failed to reinstall google-breakpad prerequisite for quickshell: %w", err)
-		}
 	}
 
 	// If niri is in the list, install makepkg-git-lfs-proto first if not already installed
@@ -514,7 +577,7 @@ func (a *ArchDistribution) reorderAURPackages(packages []string) []string {
 	var dmsShell []string
 
 	for _, pkg := range packages {
-		if pkg == "dms-shell-git" || pkg == "dms-shell-bin" {
+		if pkg == "dms-shell-git" {
 			dmsShell = append(dmsShell, pkg)
 		} else {
 			isDep := false
@@ -534,6 +597,16 @@ func (a *ArchDistribution) reorderAURPackages(packages []string) []string {
 }
 
 func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sudoPassword string, progressChan chan<- InstallProgressMsg, startProgress, endProgress float64) error {
+	return a.installSingleAURPackageInternal(ctx, pkg, sudoPassword, progressChan, startProgress, endProgress, make(map[string]bool))
+}
+
+func (a *ArchDistribution) installSingleAURPackageInternal(ctx context.Context, pkg, sudoPassword string, progressChan chan<- InstallProgressMsg, startProgress, endProgress float64, visited map[string]bool) error {
+	if visited[pkg] {
+		a.log(fmt.Sprintf("Skipping %s (already being installed, cycle detected)", pkg))
+		return nil
+	}
+	visited[pkg] = true
+
 	homeDir, err := os.UserHomeDir()
 	if err != nil {
 		return fmt.Errorf("failed to get user home directory: %w", err)
@@ -585,7 +658,7 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 		}
 	}
 
-	if pkg == "dms-shell-git" || pkg == "dms-shell-bin" {
+	if pkg == "dms-shell-git" {
 		srcinfoPath := filepath.Join(packageDir, ".SRCINFO")
 		depsToRemove := []string{
 			"depends = quickshell",
@@ -607,54 +680,66 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 		return fmt.Errorf("failed to remove optdepends from .SRCINFO for %s: %w", pkg, err)
 	}
 
-	// Skip dependency installation for dms-shell-git and dms-shell-bin
-	// since we manually manage those dependencies
-	if pkg != "dms-shell-git" && pkg != "dms-shell-bin" {
-		// Pre-install dependencies from .SRCINFO
+	srcinfoPath = filepath.Join(packageDir, ".SRCINFO")
+	{
 		progressChan <- InstallProgressMsg{
 			Phase:       PhaseAURPackages,
 			Progress:    startProgress + 0.3*(endProgress-startProgress),
-			Step:        fmt.Sprintf("Installing dependencies for %s...", pkg),
+			Step:        fmt.Sprintf("Resolving dependencies for %s...", pkg),
 			IsComplete:  false,
-			CommandInfo: "Installing package dependencies and makedepends",
+			CommandInfo: "Classifying dependencies as system or AUR",
 		}
 
-		// Install dependencies and makedepends explicitly
-		srcinfoPath = filepath.Join(packageDir, ".SRCINFO")
-
-		depsCmd := exec.CommandContext(ctx, "bash", "-c",
-			fmt.Sprintf(`
-				deps=$(grep "depends = " "%s" | grep -v "makedepends" | sed 's/.*depends = //' | tr '\n' ' ' | sed 's/[[:space:]]*$//')
-				if [[ "%s" == *"quickshell"* ]]; then
-					deps=$(echo "$deps" | sed 's/google-breakpad//g' | sed 's/  / /g' | sed 's/^ *//g' | sed 's/ *$//g')
-				fi
-				if [ ! -z "$deps" ] && [ "$deps" != " " ]; then
-					echo '%s' | sudo -S pacman -S --needed --noconfirm $deps
-				fi
-			`, srcinfoPath, pkg, sudoPassword))
-
-		if err := a.runWithProgress(depsCmd, progressChan, PhaseAURPackages, startProgress+0.3*(endProgress-startProgress), startProgress+0.35*(endProgress-startProgress)); err != nil {
-			return fmt.Errorf("FAILED to install runtime dependencies for %s: %w", pkg, err)
+		runtimeDeps, makeDeps, err := parseSRCINFODeps(srcinfoPath)
+		if err != nil {
+			return fmt.Errorf("failed to parse .SRCINFO for %s: %w", pkg, err)
 		}
 
-		makedepsCmd := exec.CommandContext(ctx, "bash", "-c",
-			fmt.Sprintf(`
-				makedeps=$(grep -E "^[[:space:]]*makedepends = " "%s" | sed 's/^[[:space:]]*makedepends = //' | tr '\n' ' ')
-				if [ ! -z "$makedeps" ]; then
-					echo '%s' | sudo -S pacman -S --needed --noconfirm $makedeps
-				fi
-			`, srcinfoPath, sudoPassword))
+		seen := make(map[string]bool)
+		var systemPkgs []string
+		var aurPkgs []string
 
-		if err := a.runWithProgress(makedepsCmd, progressChan, PhaseAURPackages, startProgress+0.35*(endProgress-startProgress), startProgress+0.4*(endProgress-startProgress)); err != nil {
-			return fmt.Errorf("FAILED to install make dependencies for %s: %w", pkg, err)
+		for _, dep := range append(runtimeDeps, makeDeps...) {
+			if seen[dep] || a.packageInstalled(dep) {
+				continue
+			}
+			seen[dep] = true
+			if a.isInSystemRepo(dep) {
+				systemPkgs = append(systemPkgs, dep)
+			} else {
+				aurPkgs = append(aurPkgs, dep)
+			}
 		}
-	} else {
-		progressChan <- InstallProgressMsg{
-			Phase:      PhaseAURPackages,
-			Progress:   startProgress + 0.35*(endProgress-startProgress),
-			Step:       fmt.Sprintf("Skipping dependency installation for %s (manually managed)...", pkg),
-			IsComplete: false,
-			LogOutput:  fmt.Sprintf("Dependencies for %s are installed separately", pkg),
+
+		if len(systemPkgs) > 0 {
+			progressChan <- InstallProgressMsg{
+				Phase:       PhaseAURPackages,
+				Progress:    startProgress + 0.32*(endProgress-startProgress),
+				Step:        fmt.Sprintf("Installing %d system dependencies for %s...", len(systemPkgs), pkg),
+				IsComplete:  false,
+				CommandInfo: fmt.Sprintf("sudo pacman -S --needed --noconfirm %s", strings.Join(systemPkgs, " ")),
+			}
+			if err := a.installSystemPackages(ctx, systemPkgs, sudoPassword, progressChan); err != nil {
+				return fmt.Errorf("failed to install system dependencies for %s: %w", pkg, err)
+			}
+		}
+
+		for _, aurDep := range aurPkgs {
+			a.log(fmt.Sprintf("Dependency %s is AUR-only, building from source...", aurDep))
+			progressChan <- InstallProgressMsg{
+				Phase:       PhaseAURPackages,
+				Progress:    startProgress + 0.35*(endProgress-startProgress),
+				Step:        fmt.Sprintf("Installing AUR dependency %s for %s...", aurDep, pkg),
+				IsComplete:  false,
+				CommandInfo: fmt.Sprintf("Building AUR dependency: %s", aurDep),
+			}
+			if err := a.installSingleAURPackageInternal(ctx, aurDep, sudoPassword, progressChan,
+				startProgress+0.35*(endProgress-startProgress),
+				startProgress+0.39*(endProgress-startProgress),
+				visited,
+			); err != nil {
+				return fmt.Errorf("failed to install AUR dependency %s for %s: %w", aurDep, pkg, err)
+			}
 		}
 	}
 
@@ -668,7 +753,7 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 
 	buildCmd := exec.CommandContext(ctx, "makepkg", "--noconfirm")
 	buildCmd.Dir = packageDir
-	buildCmd.Env = append(os.Environ(), "PKGEXT=.pkg.tar") // Disable compression for speed
+	buildCmd.Env = append(os.Environ(), "PKGEXT=.pkg.tar")
 
 	if err := a.runWithProgress(buildCmd, progressChan, PhaseAURPackages, startProgress+0.4*(endProgress-startProgress), startProgress+0.7*(endProgress-startProgress)); err != nil {
 		return fmt.Errorf("failed to build %s: %w", pkg, err)
@@ -683,42 +768,9 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 		CommandInfo: "sudo pacman -U built-package",
 	}
 
-	// Find .pkg.tar* files - for split packages, install the base and any installed compositor variants
 	var files []string
-	if pkg == "dms-shell-git" || pkg == "dms-shell-bin" {
-		// For DMS split packages, install base package
-		pattern := filepath.Join(packageDir, fmt.Sprintf("%s-%s*.pkg.tar*", pkg, "*"))
-		matches, err := filepath.Glob(pattern)
-		if err == nil {
-			for _, match := range matches {
-				basename := filepath.Base(match)
-				// Always include base package
-				if !strings.Contains(basename, "hyprland") && !strings.Contains(basename, "niri") {
-					files = append(files, match)
-				}
-			}
-		}
-
-		// Also update compositor-specific packages if they're installed
-		if strings.HasSuffix(pkg, "-git") {
-			if a.packageInstalled("dms-shell-hyprland-git") {
-				hyprlandPattern := filepath.Join(packageDir, "dms-shell-hyprland-git-*.pkg.tar*")
-				if hyprlandMatches, err := filepath.Glob(hyprlandPattern); err == nil && len(hyprlandMatches) > 0 {
-					files = append(files, hyprlandMatches[0])
-				}
-			}
-			if a.packageInstalled("dms-shell-niri-git") {
-				niriPattern := filepath.Join(packageDir, "dms-shell-niri-git-*.pkg.tar*")
-				if niriMatches, err := filepath.Glob(niriPattern); err == nil && len(niriMatches) > 0 {
-					files = append(files, niriMatches[0])
-				}
-			}
-		}
-	} else {
-		// For other packages, install all built packages
-		matches, _ := filepath.Glob(filepath.Join(packageDir, "*.pkg.tar*"))
-		files = matches
-	}
+	matches, _ := filepath.Glob(filepath.Join(packageDir, "*.pkg.tar*"))
+	files = matches
 
 	if len(files) == 0 {
 		return fmt.Errorf("no package files found after building %s", pkg)

core/internal/distros/base.go

@@ -102,6 +102,19 @@ func (b *BaseDistribution) detectPackage(name, description string, installed boo
 	}
 }
 
+func (b *BaseDistribution) detectOptionalPackage(name, description string, installed bool) deps.Dependency {
+	status := deps.StatusMissing
+	if installed {
+		status = deps.StatusInstalled
+	}
+	return deps.Dependency{
+		Name:        name,
+		Status:      status,
+		Description: description,
+		Required:    false,
+	}
+}
+
 func (b *BaseDistribution) detectGit() deps.Dependency {
 	return b.detectCommand("git", "Version control system")
 }

core/internal/distros/debian.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"os/exec"
-	"runtime"
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
@@ -61,6 +60,7 @@ func (d *DebianDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 	dependencies = append(dependencies, d.detectGit())
 	dependencies = append(dependencies, d.detectWindowManager(wm))
 	dependencies = append(dependencies, d.detectQuickshell())
+	dependencies = append(dependencies, d.detectDMSGreeter())
 	dependencies = append(dependencies, d.detectXDGPortal())
 	dependencies = append(dependencies, d.detectAccountsService())
 
@@ -86,10 +86,41 @@ func (d *DebianDistribution) detectAccountsService() deps.Dependency {
 	return d.detectPackage("accountsservice", "D-Bus interface for user account query and manipulation", d.packageInstalled("accountsservice"))
 }
 
+func (d *DebianDistribution) detectDMSGreeter() deps.Dependency {
+	return d.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", d.packageInstalled("dms-greeter"))
+}
+
 func (d *DebianDistribution) packageInstalled(pkg string) bool {
-	cmd := exec.Command("dpkg", "-l", pkg)
-	err := cmd.Run()
-	return err == nil
+	return debianPackageInstalledPrecisely(pkg)
+}
+
+func debianPackageInstalledPrecisely(pkg string) bool {
+	cmd := exec.Command("dpkg-query", "-W", "-f=${db:Status-Status}", pkg)
+	output, err := cmd.Output()
+	if err != nil {
+		return false
+	}
+	return strings.TrimSpace(string(output)) == "installed"
+}
+
+func containsString(values []string, target string) bool {
+	for _, value := range values {
+		if value == target {
+			return true
+		}
+	}
+	return false
+}
+
+func debianRepoArchitecture(arch string) string {
+	switch arch {
+	case "amd64", "x86_64":
+		return "amd64"
+	case "arm64", "aarch64":
+		return "arm64"
+	default:
+		return arch
+	}
 }
 
 func (d *DebianDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
@@ -108,6 +139,7 @@ func (d *DebianDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		// DMS packages from OBS with variant support
 		"dms (DankMaterialShell)": d.getDmsMapping(variants["dms (DankMaterialShell)"]),
 		"quickshell":              d.getQuickshellMapping(variants["quickshell"]),
+		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"dgop":                    {Name: "dgop", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
@@ -188,12 +220,12 @@ func (d *DebianDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		Step:        "Installing development dependencies...",
 		IsComplete:  false,
 		NeedsSudo:   true,
-		CommandInfo: "sudo apt-get install -y curl wget git cmake ninja-build pkg-config libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev",
+		CommandInfo: "sudo apt-get install -y curl wget git cmake ninja-build pkg-config gnupg libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev",
 		LogOutput:   "Installing additional development tools",
 	}
 
 	devToolsCmd := ExecSudoCommand(ctx, sudoPassword,
-		"DEBIAN_FRONTEND=noninteractive apt-get install -y curl wget git cmake ninja-build pkg-config libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev libjpeg-dev libpugixml-dev")
+		"DEBIAN_FRONTEND=noninteractive apt-get install -y curl wget git cmake ninja-build pkg-config gnupg libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev libjpeg-dev libpugixml-dev")
 	if err := d.runWithProgress(devToolsCmd, progressChan, PhasePrerequisites, 0.10, 0.12); err != nil {
 		return fmt.Errorf("failed to install development tools: %w", err)
 	}
@@ -373,6 +405,14 @@ func (d *DebianDistribution) extractPackageNames(packages []PackageMapping) []st
 	return names
 }
 
+func (d *DebianDistribution) aptInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"DEBIAN_FRONTEND=noninteractive", "apt-get", "install", "-y"}
+	if minimal {
+		args = append(args, "--no-install-recommends")
+	}
+	return append(args, packages...)
+}
+
 func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []PackageMapping, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	enabledRepos := make(map[string]bool)
 
@@ -430,7 +470,7 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 			}
 
 			// Add repository
-			repoLine := fmt.Sprintf("deb [signed-by=%s, arch=%s] %s/ /", keyringPath, runtime.GOARCH, baseURL)
+			repoLine := fmt.Sprintf("deb [signed-by=%s arch=%s] %s/ /", keyringPath, debianRepoArchitecture(osInfo.Architecture), baseURL)
 
 			progressChan <- InstallProgressMsg{
 				Phase:       PhaseSystemPackages,
@@ -476,20 +516,46 @@ func (d *DebianDistribution) installAPTPackages(ctx context.Context, packages []
 
 	d.log(fmt.Sprintf("Installing APT packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"DEBIAN_FRONTEND=noninteractive", "apt-get", "install", "-y"}
-	args = append(args, packages...)
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
 
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		startProgress := 0.40
+		endProgress := 0.60
+		if totalGroups > 1 {
+			if groupIndex == 1 {
+				endProgress = 0.50
+			} else {
+				startProgress = 0.50
+			}
+		}
+
+		args := d.aptInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       PhaseSystemPackages,
+			Progress:    startProgress,
+			Step:        "Installing system packages...",
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return d.runWithProgress(cmd, progressChan, PhaseSystemPackages, startProgress, endProgress)
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return d.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func (d *DebianDistribution) installBuildDependencies(ctx context.Context, manualPkgs []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {

core/internal/distros/fedora.go

@@ -13,6 +13,9 @@ func init() {
 	Register("fedora", "#0B57A4", FamilyFedora, func(config DistroConfig, logChan chan<- string) Distribution {
 		return NewFedoraDistribution(config, logChan)
 	})
+	Register("evernight", "#72B8DC", FamilyFedora, func(config DistroConfig, logChan chan<- string) Distribution {
+		return NewFedoraDistribution(config, logChan)
+	})
 	Register("nobara", "#0B57A4", FamilyFedora, func(config DistroConfig, logChan chan<- string) Distribution {
 		return NewFedoraDistribution(config, logChan)
 	})
@@ -75,6 +78,7 @@ func (f *FedoraDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 	dependencies = append(dependencies, f.detectGit())
 	dependencies = append(dependencies, f.detectWindowManager(wm))
 	dependencies = append(dependencies, f.detectQuickshell())
+	dependencies = append(dependencies, f.detectDMSGreeter())
 	dependencies = append(dependencies, f.detectXDGPortal())
 	dependencies = append(dependencies, f.detectAccountsService())
 
@@ -120,6 +124,7 @@ func (f *FedoraDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 
 		// COPR packages
 		"quickshell":              f.getQuickshellMapping(variants["quickshell"]),
+		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 		"dms (DankMaterialShell)": f.getDmsMapping(variants["dms (DankMaterialShell)"]),
 		"dgop":                    {Name: "dgop", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
@@ -191,6 +196,10 @@ func (f *FedoraDistribution) detectAccountsService() deps.Dependency {
 	}
 }
 
+func (f *FedoraDistribution) detectDMSGreeter() deps.Dependency {
+	return f.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", f.packageInstalled("dms-greeter"))
+}
+
 func (f *FedoraDistribution) getPrerequisites() []string {
 	return []string{
 		"dnf-plugins-core",
@@ -475,28 +484,7 @@ func (f *FedoraDistribution) installDNFPackages(ctx context.Context, packages []
 
 	f.log(fmt.Sprintf("Installing DNF packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"dnf", "install", "-y"}
-
-	for _, pkg := range packages {
-		if pkg == "niri" || pkg == "niri-git" {
-			args = append(args, "--setopt=install_weak_deps=False")
-			break
-		}
-	}
-
-	args = append(args, packages...)
-
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
-	}
-
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return f.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	return f.installDNFGroups(ctx, packages, sudoPassword, progressChan, PhaseSystemPackages, "Installing system packages...", 0.40, 0.60)
 }
 
 func (f *FedoraDistribution) installCOPRPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -506,26 +494,57 @@ func (f *FedoraDistribution) installCOPRPackages(ctx context.Context, packages [
 
 	f.log(fmt.Sprintf("Installing COPR packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"dnf", "install", "-y"}
+	return f.installDNFGroups(ctx, packages, sudoPassword, progressChan, PhaseAURPackages, "Installing COPR packages...", 0.70, 0.85)
+}
 
-	for _, pkg := range packages {
-		if pkg == "niri" || pkg == "niri-git" {
-			args = append(args, "--setopt=install_weak_deps=False")
-			break
+func (f *FedoraDistribution) dnfInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"dnf", "install", "-y"}
+	if minimal {
+		args = append(args, "--setopt=install_weak_deps=False")
+	}
+	return append(args, packages...)
+}
+
+func (f *FedoraDistribution) installDNFGroups(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg, phase InstallPhase, step string, startProgress float64, endProgress float64) error {
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
+
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		groupStart := startProgress
+		groupEnd := endProgress
+		if totalGroups > 1 {
+			midpoint := startProgress + ((endProgress - startProgress) / 2)
+			if groupIndex == 1 {
+				groupEnd = midpoint
+			} else {
+				groupStart = midpoint
+			}
+		}
+
+		args := f.dnfInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       phase,
+			Progress:    groupStart,
+			Step:        step,
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return f.runWithProgress(cmd, progressChan, phase, groupStart, groupEnd)
+	}
+
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
 		}
 	}
-
-	args = append(args, packages...)
-
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseAURPackages,
-		Progress:    0.70,
-		Step:        "Installing COPR packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
-	}
-
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return f.runWithProgress(cmd, progressChan, PhaseAURPackages, 0.70, 0.85)
+	return nil
 }

core/internal/distros/interface.go

@@ -55,6 +55,7 @@ const (
 	PhaseAURPackages
 	PhaseCursorTheme
 	PhaseConfiguration
+	PhaseGreeterSetup
 	PhaseComplete
 )
 

core/internal/distros/minimal_install.go

@@ -0,0 +1,44 @@
+package distros
+
+type minimalInstallGroup struct {
+	packages []string
+	minimal  bool
+}
+
+func shouldPreferMinimalInstall(pkg string) bool {
+	switch pkg {
+	case "niri", "niri-git":
+		return true
+	default:
+		return false
+	}
+}
+
+func splitMinimalInstallPackages(packages []string) (normal []string, minimal []string) {
+	for _, pkg := range packages {
+		if shouldPreferMinimalInstall(pkg) {
+			minimal = append(minimal, pkg)
+			continue
+		}
+		normal = append(normal, pkg)
+	}
+	return normal, minimal
+}
+
+func orderedMinimalInstallGroups(packages []string) []minimalInstallGroup {
+	normal, minimal := splitMinimalInstallPackages(packages)
+	groups := make([]minimalInstallGroup, 0, 2)
+	if len(minimal) > 0 {
+		groups = append(groups, minimalInstallGroup{
+			packages: minimal,
+			minimal:  true,
+		})
+	}
+	if len(normal) > 0 {
+		groups = append(groups, minimalInstallGroup{
+			packages: normal,
+			minimal:  false,
+		})
+	}
+	return groups
+}

core/internal/distros/opensuse.go

@@ -29,6 +29,8 @@ type OpenSUSEDistribution struct {
 	config DistroConfig
 }
 
+const openSUSENiriWaylandServerPackage = "libwayland-server0"
+
 func NewOpenSUSEDistribution(config DistroConfig, logChan chan<- string) *OpenSUSEDistribution {
 	base := NewBaseDistribution(logChan)
 	return &OpenSUSEDistribution{
@@ -71,6 +73,7 @@ func (o *OpenSUSEDistribution) DetectDependenciesWithTerminal(ctx context.Contex
 	dependencies = append(dependencies, o.detectGit())
 	dependencies = append(dependencies, o.detectWindowManager(wm))
 	dependencies = append(dependencies, o.detectQuickshell())
+	dependencies = append(dependencies, o.detectDMSGreeter())
 	dependencies = append(dependencies, o.detectXDGPortal())
 	dependencies = append(dependencies, o.detectAccountsService())
 
@@ -100,6 +103,10 @@ func (o *OpenSUSEDistribution) packageInstalled(pkg string) bool {
 	return err == nil
 }
 
+func (o *OpenSUSEDistribution) detectDMSGreeter() deps.Dependency {
+	return o.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", o.packageInstalled("dms-greeter"))
+}
+
 func (o *OpenSUSEDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
 	return o.GetPackageMappingWithVariants(wm, make(map[string]deps.PackageVariant))
 }
@@ -116,6 +123,7 @@ func (o *OpenSUSEDistribution) GetPackageMappingWithVariants(wm deps.WindowManag
 		// DMS packages from OBS
 		"dms (DankMaterialShell)": o.getDmsMapping(variants["dms (DankMaterialShell)"]),
 		"quickshell":              o.getQuickshellMapping(variants["quickshell"]),
+		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"dgop":                    {Name: "dgop", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
@@ -193,35 +201,7 @@ func (o *OpenSUSEDistribution) detectAccountsService() deps.Dependency {
 }
 
 func (o *OpenSUSEDistribution) getPrerequisites() []string {
-	return []string{
-		"make",
-		"unzip",
-		"gcc",
-		"gcc-c++",
-		"cmake",
-		"ninja",
-		"pkgconf-pkg-config",
-		"git",
-		"qt6-base-devel",
-		"qt6-declarative-devel",
-		"qt6-declarative-private-devel",
-		"qt6-shadertools",
-		"qt6-shadertools-devel",
-		"qt6-wayland-devel",
-		"qt6-waylandclient-private-devel",
-		"spirv-tools-devel",
-		"cli11-devel",
-		"wayland-protocols-devel",
-		"libgbm-devel",
-		"libdrm-devel",
-		"pipewire-devel",
-		"jemalloc-devel",
-		"wayland-utils",
-		"Mesa-libGLESv3-devel",
-		"pam-devel",
-		"glib2-devel",
-		"polkit-devel",
-	}
+	return []string{}
 }
 
 func (o *OpenSUSEDistribution) InstallPrerequisites(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -291,6 +271,10 @@ func (o *OpenSUSEDistribution) InstallPackages(ctx context.Context, dependencies
 		LogOutput:  "Starting prerequisite check...",
 	}
 
+	if err := o.disableInstallMediaRepos(ctx, sudoPassword, progressChan); err != nil {
+		return fmt.Errorf("failed to disable install media repositories: %w", err)
+	}
+
 	if err := o.InstallPrerequisites(ctx, sudoPassword, progressChan); err != nil {
 		return fmt.Errorf("failed to install prerequisites: %w", err)
 	}
@@ -321,7 +305,7 @@ func (o *OpenSUSEDistribution) InstallPackages(ctx context.Context, dependencies
 			NeedsSudo:  true,
 			LogOutput:  fmt.Sprintf("Installing system packages: %s", strings.Join(systemPkgs, ", ")),
 		}
-		if err := o.installZypperPackages(ctx, systemPkgs, sudoPassword, progressChan); err != nil {
+		if err := o.installZypperPackages(ctx, systemPkgs, sudoPassword, progressChan, PhaseSystemPackages, "Installing system packages...", 0.40, 0.60); err != nil {
 			return fmt.Errorf("failed to install zypper packages: %w", err)
 		}
 	}
@@ -336,7 +320,7 @@ func (o *OpenSUSEDistribution) InstallPackages(ctx context.Context, dependencies
 			IsComplete: false,
 			LogOutput:  fmt.Sprintf("Installing OBS packages: %s", strings.Join(obsPkgNames, ", ")),
 		}
-		if err := o.installZypperPackages(ctx, obsPkgNames, sudoPassword, progressChan); err != nil {
+		if err := o.installZypperPackages(ctx, obsPkgNames, sudoPassword, progressChan, PhaseAURPackages, "Installing OBS packages...", 0.70, 0.85); err != nil {
 			return fmt.Errorf("failed to install OBS packages: %w", err)
 		}
 	}
@@ -426,9 +410,32 @@ func (o *OpenSUSEDistribution) categorizePackages(dependencies []deps.Dependency
 		}
 	}
 
+	systemPkgs = o.appendMissingSystemPackages(systemPkgs, openSUSENiriRuntimePackages(wm, disabledFlags))
+
 	return systemPkgs, obsPkgs, manualPkgs, variantMap
 }
 
+func openSUSENiriRuntimePackages(wm deps.WindowManager, disabledFlags map[string]bool) []string {
+	if wm != deps.WindowManagerNiri || disabledFlags["niri"] {
+		return nil
+	}
+
+	return []string{openSUSENiriWaylandServerPackage}
+}
+
+func (o *OpenSUSEDistribution) appendMissingSystemPackages(systemPkgs []string, extraPkgs []string) []string {
+	for _, pkg := range extraPkgs {
+		if containsString(systemPkgs, pkg) || o.packageInstalled(pkg) {
+			continue
+		}
+
+		o.log(fmt.Sprintf("Adding openSUSE runtime package: %s", pkg))
+		systemPkgs = append(systemPkgs, pkg)
+	}
+
+	return systemPkgs
+}
+
 func (o *OpenSUSEDistribution) extractPackageNames(packages []PackageMapping) []string {
 	names := make([]string, len(packages))
 	for i, pkg := range packages {
@@ -508,27 +515,146 @@ func (o *OpenSUSEDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Pac
 	return nil
 }
 
-func (o *OpenSUSEDistribution) installZypperPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+func isOpenSUSEInstallMediaURI(uri string) bool {
+	normalizedURI := strings.ToLower(strings.TrimSpace(uri))
+
+	return strings.HasPrefix(normalizedURI, "cd:/") ||
+		strings.HasPrefix(normalizedURI, "dvd:/") ||
+		strings.HasPrefix(normalizedURI, "hd:/") ||
+		strings.HasPrefix(normalizedURI, "iso:/")
+}
+
+func parseZypperInstallMediaAliases(output string) []string {
+	var aliases []string
+
+	for _, line := range strings.Split(output, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || !strings.Contains(line, "|") {
+			continue
+		}
+
+		parts := strings.Split(line, "|")
+		if len(parts) < 7 {
+			continue
+		}
+
+		for i := range parts {
+			parts[i] = strings.TrimSpace(parts[i])
+		}
+
+		alias := parts[1]
+		enabled := strings.ToLower(parts[3])
+		uri := parts[len(parts)-1]
+
+		if alias == "" || strings.EqualFold(alias, "alias") {
+			continue
+		}
+		if enabled != "" && enabled != "yes" {
+			continue
+		}
+		if !isOpenSUSEInstallMediaURI(uri) {
+			continue
+		}
+
+		aliases = append(aliases, alias)
+	}
+
+	return aliases
+}
+
+func (o *OpenSUSEDistribution) disableInstallMediaRepos(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+	listCmd := exec.CommandContext(ctx, "zypper", "repos", "-u")
+	output, err := listCmd.CombinedOutput()
+	if err != nil {
+		o.log(fmt.Sprintf("Warning: failed to list zypper repositories: %s", strings.TrimSpace(string(output))))
+		return fmt.Errorf("failed to list zypper repositories: %w", err)
+	}
+
+	aliases := parseZypperInstallMediaAliases(string(output))
+	if len(aliases) == 0 {
+		return nil
+	}
+
+	o.log(fmt.Sprintf("Disabling install media repositories: %s", strings.Join(aliases, ", ")))
+	progressChan <- InstallProgressMsg{
+		Phase:       PhasePrerequisites,
+		Progress:    0.055,
+		Step:        "Disabling install media repositories...",
+		IsComplete:  false,
+		NeedsSudo:   true,
+		CommandInfo: fmt.Sprintf("sudo zypper modifyrepo -d %s", strings.Join(aliases, " ")),
+		LogOutput:   fmt.Sprintf("Disabling install media repositories: %s", strings.Join(aliases, ", ")),
+	}
+
+	for _, alias := range aliases {
+		cmd := ExecSudoCommand(ctx, sudoPassword, fmt.Sprintf("zypper modifyrepo -d '%s'", escapeSingleQuotes(alias)))
+		repoOutput, err := cmd.CombinedOutput()
+		if err != nil {
+			o.log(fmt.Sprintf("Failed to disable install media repo %s: %s", alias, strings.TrimSpace(string(repoOutput))))
+			return fmt.Errorf("failed to disable install media repo %s: %w", alias, err)
+		}
+		o.log(fmt.Sprintf("Disabled install media repo %s: %s", alias, strings.TrimSpace(string(repoOutput))))
+	}
+
+	return nil
+}
+
+func (o *OpenSUSEDistribution) zypperInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"zypper", "install", "-y"}
+	if minimal {
+		args = append(args, "--no-recommends")
+	}
+	return append(args, packages...)
+}
+
+func (o *OpenSUSEDistribution) installZypperPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg, phase InstallPhase, step string, startProgress float64, endProgress float64) error {
 	if len(packages) == 0 {
 		return nil
 	}
 
 	o.log(fmt.Sprintf("Installing zypper packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"zypper", "install", "-y"}
-	args = append(args, packages...)
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
 
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		groupStart := startProgress
+		groupEnd := endProgress
+		if totalGroups > 1 {
+			midpoint := startProgress + ((endProgress - startProgress) / 2)
+			if groupIndex == 1 {
+				groupEnd = midpoint
+			} else {
+				groupStart = midpoint
+			}
+		}
+
+		args := o.zypperInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       phase,
+			Progress:    groupStart,
+			Step:        step,
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return o.runWithProgress(cmd, progressChan, phase, groupStart, groupEnd)
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return o.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func (o *OpenSUSEDistribution) installQuickshell(ctx context.Context, variant deps.PackageVariant, sudoPassword string, progressChan chan<- InstallProgressMsg) error {

core/internal/distros/ubuntu.go

@@ -63,6 +63,7 @@ func (u *UbuntuDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 	dependencies = append(dependencies, u.detectGit())
 	dependencies = append(dependencies, u.detectWindowManager(wm))
 	dependencies = append(dependencies, u.detectQuickshell())
+	dependencies = append(dependencies, u.detectDMSGreeter())
 	dependencies = append(dependencies, u.detectXDGPortal())
 	dependencies = append(dependencies, u.detectAccountsService())
 
@@ -94,10 +95,12 @@ func (u *UbuntuDistribution) detectAccountsService() deps.Dependency {
 	return u.detectPackage("accountsservice", "D-Bus interface for user account query and manipulation", u.packageInstalled("accountsservice"))
 }
 
+func (u *UbuntuDistribution) detectDMSGreeter() deps.Dependency {
+	return u.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", u.packageInstalled("dms-greeter"))
+}
+
 func (u *UbuntuDistribution) packageInstalled(pkg string) bool {
-	cmd := exec.Command("dpkg", "-l", pkg)
-	err := cmd.Run()
-	return err == nil
+	return debianPackageInstalledPrecisely(pkg)
 }
 
 func (u *UbuntuDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
@@ -116,6 +119,7 @@ func (u *UbuntuDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		// DMS packages from PPAs
 		"dms (DankMaterialShell)": u.getDmsMapping(variants["dms (DankMaterialShell)"]),
 		"quickshell":              u.getQuickshellMapping(variants["quickshell"]),
+		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"dgop":                    {Name: "dgop", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
@@ -448,21 +452,7 @@ func (u *UbuntuDistribution) installAPTPackages(ctx context.Context, packages []
 	}
 
 	u.log(fmt.Sprintf("Installing APT packages: %s", strings.Join(packages, ", ")))
-
-	args := []string{"apt-get", "install", "-y"}
-	args = append(args, packages...)
-
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
-	}
-
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return u.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	return u.installAPTGroups(ctx, packages, sudoPassword, progressChan, PhaseSystemPackages, "Installing system packages...", 0.40, 0.60)
 }
 
 func (u *UbuntuDistribution) installPPAPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -471,21 +461,59 @@ func (u *UbuntuDistribution) installPPAPackages(ctx context.Context, packages []
 	}
 
 	u.log(fmt.Sprintf("Installing PPA packages: %s", strings.Join(packages, ", ")))
+	return u.installAPTGroups(ctx, packages, sudoPassword, progressChan, PhaseAURPackages, "Installing PPA packages...", 0.70, 0.85)
+}
 
-	args := []string{"apt-get", "install", "-y"}
-	args = append(args, packages...)
+func (u *UbuntuDistribution) aptInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"DEBIAN_FRONTEND=noninteractive", "apt-get", "install", "-y"}
+	if minimal {
+		args = append(args, "--no-install-recommends")
+	}
+	return append(args, packages...)
+}
 
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseAURPackages,
-		Progress:    0.70,
-		Step:        "Installing PPA packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+func (u *UbuntuDistribution) installAPTGroups(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg, phase InstallPhase, step string, startProgress float64, endProgress float64) error {
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
+
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		groupStart := startProgress
+		groupEnd := endProgress
+		if totalGroups > 1 {
+			midpoint := startProgress + ((endProgress - startProgress) / 2)
+			if groupIndex == 1 {
+				groupEnd = midpoint
+			} else {
+				groupStart = midpoint
+			}
+		}
+
+		args := u.aptInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       phase,
+			Progress:    groupStart,
+			Step:        step,
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return u.runWithProgress(cmd, progressChan, phase, groupStart, groupEnd)
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return u.runWithProgress(cmd, progressChan, PhaseAURPackages, 0.70, 0.85)
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func (u *UbuntuDistribution) installBuildDependencies(ctx context.Context, manualPkgs []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {

core/internal/greeter/assets/apparmor/usr.bin.dms-greeter

@@ -0,0 +1,91 @@
+# AppArmor profile for dms-greeter
+#
+# Managed by DMS — regenerated on every `dms greeter install` / `dms greeter sync`.
+# Manual edits will be overwritten on next sync.
+#
+# Mode: complain  (denials are logged, nothing is blocked)
+# To switch to enforce after validating with `aa-logprof`:
+#   sudo aa-enforce /etc/apparmor.d/usr.bin.dms-greeter
+#
+#include <tunables/global>
+
+profile dms-greeter /usr/bin/dms-greeter flags=(complain) {
+  #include <abstractions/base>
+  #include <abstractions/bash>
+
+  # The launcher script itself
+  /usr/bin/dms-greeter r,
+
+  # Cache directory — created by dms greeter sync/enable with greeter:greeter ownership
+  /var/cache/dms-greeter/     rw,
+  /var/cache/dms-greeter/**   rwlk,
+
+  # DMS config — packaged path
+  /usr/share/quickshell/dms-greeter/    r,
+  /usr/share/quickshell/dms-greeter/**  r,
+  /usr/share/quickshell/               r,
+  /usr/share/quickshell/**             r,
+
+  # DMS config — system and user overrides
+  /etc/dms/    r,
+  /etc/dms/**  r,
+  /usr/share/dms/    r,
+  /usr/share/dms/**  r,
+  /home/*/.config/quickshell/    r,
+  /home/*/.config/quickshell/**  r,
+  /root/.config/quickshell/     r,
+  /root/.config/quickshell/**   r,
+
+  # greetd / PAM — read-only for session setup
+  /etc/greetd/    r,
+  /etc/greetd/**  r,
+  /etc/pam.d/     r,
+  /etc/pam.d/**   r,
+  /usr/lib/pam.d/ r,
+  /usr/lib/pam.d/** r,
+
+  # Compositor binaries — run unconfined so each compositor uses its own profile
+  /usr/bin/niri        Ux,
+  /usr/bin/hyprland    Ux,
+  /usr/bin/Hyprland    Ux,
+  /usr/bin/sway        Ux,
+  /usr/bin/labwc       Ux,
+  /usr/bin/scroll      Ux,
+  /usr/bin/miracle-wm  Ux,
+  /usr/bin/mango       Ux,
+
+  # Quickshell — run unconfined (has its own compositor profile on some distros)
+  /usr/bin/qs          Ux,
+  /usr/bin/quickshell  Ux,
+
+  # Wayland / XDG runtime (pipewire, wireplumber, wayland socket)
+  /run/user/[0-9]*/               rw,
+  /run/user/[0-9]*/**             rw,
+
+  # DRM / GPU devices (required for Wayland compositor startup)
+  /dev/dri/      r,
+  /dev/dri/*     rw,
+  /dev/udmabuf   rw,
+
+  # Input devices
+  /dev/input/    r,
+  /dev/input/*   r,
+
+  # Systemd journal / logging
+  /run/systemd/journal/socket  rw,
+  /dev/log                     rw,
+
+  # Shell helper binaries invoked by the launcher script
+  /usr/bin/env      ix,
+  /usr/bin/mkdir    ix,
+  /usr/bin/cat      ix,
+  /usr/bin/grep     ix,
+  /usr/bin/dirname  ix,
+  /usr/bin/basename ix,
+  /usr/bin/command  ix,
+  /bin/env          ix,
+  /bin/mkdir        ix,
+
+  # Signal management (compositor lifecycle)
+  signal (send, receive) set=("term", "int", "hup", "kill"),
+}

core/internal/greeter/installer_test.go

@@ -0,0 +1,98 @@
+package greeter
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeTestJSON(t *testing.T, path string, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("failed to create parent dir for %s: %v", path, err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("failed to write %s: %v", path, err)
+	}
+}
+
+func TestResolveGreeterThemeSyncState(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		settingsJSON            string
+		sessionJSON             string
+		wantSourcePath          string
+		wantResolvedWallpaper   string
+		wantDynamicOverrideUsed bool
+	}{
+		{
+			name: "dynamic theme with greeter wallpaper override uses generated greeter colors",
+			settingsJSON: `{
+  "currentThemeName": "dynamic",
+  "greeterWallpaperPath": "Pictures/blue.jpg",
+  "matugenScheme": "scheme-tonal-spot",
+  "iconTheme": "Papirus"
+}`,
+			sessionJSON:             `{"isLightMode":true}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "greeter-colors", "dms-colors.json"),
+			wantResolvedWallpaper:   filepath.Join("Pictures", "blue.jpg"),
+			wantDynamicOverrideUsed: true,
+		},
+		{
+			name: "dynamic theme without override uses desktop colors",
+			settingsJSON: `{
+  "currentThemeName": "dynamic",
+  "greeterWallpaperPath": ""
+}`,
+			sessionJSON:             `{"isLightMode":false}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "dms-colors.json"),
+			wantResolvedWallpaper:   "",
+			wantDynamicOverrideUsed: false,
+		},
+		{
+			name: "non-dynamic theme keeps desktop colors even with override wallpaper",
+			settingsJSON: `{
+  "currentThemeName": "purple",
+  "greeterWallpaperPath": "/tmp/blue.jpg"
+}`,
+			sessionJSON:             `{"isLightMode":false}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "dms-colors.json"),
+			wantResolvedWallpaper:   "/tmp/blue.jpg",
+			wantDynamicOverrideUsed: false,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			homeDir := t.TempDir()
+			writeTestJSON(t, filepath.Join(homeDir, ".config", "DankMaterialShell", "settings.json"), tt.settingsJSON)
+			writeTestJSON(t, filepath.Join(homeDir, ".local", "state", "DankMaterialShell", "session.json"), tt.sessionJSON)
+
+			state, err := resolveGreeterThemeSyncState(homeDir)
+			if err != nil {
+				t.Fatalf("resolveGreeterThemeSyncState returned error: %v", err)
+			}
+
+			if got := state.effectiveColorsSource(homeDir); got != filepath.Join(homeDir, tt.wantSourcePath) {
+				t.Fatalf("effectiveColorsSource = %q, want %q", got, filepath.Join(homeDir, tt.wantSourcePath))
+			}
+
+			wantResolvedWallpaper := tt.wantResolvedWallpaper
+			if wantResolvedWallpaper != "" && !filepath.IsAbs(wantResolvedWallpaper) {
+				wantResolvedWallpaper = filepath.Join(homeDir, wantResolvedWallpaper)
+			}
+			if state.ResolvedGreeterWallpaperPath != wantResolvedWallpaper {
+				t.Fatalf("ResolvedGreeterWallpaperPath = %q, want %q", state.ResolvedGreeterWallpaperPath, wantResolvedWallpaper)
+			}
+
+			if state.UsesDynamicWallpaperOverride != tt.wantDynamicOverrideUsed {
+				t.Fatalf("UsesDynamicWallpaperOverride = %v, want %v", state.UsesDynamicWallpaperOverride, tt.wantDynamicOverrideUsed)
+			}
+		})
+	}
+}

core/internal/keybinds/providers/miracle.go

@@ -0,0 +1,95 @@
+package providers
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/keybinds"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
+)
+
+type MiracleProvider struct {
+	configPath string
+}
+
+func NewMiracleProvider(configPath string) *MiracleProvider {
+	if configPath == "" {
+		configDir, err := os.UserConfigDir()
+		if err == nil {
+			configPath = filepath.Join(configDir, "miracle-wm")
+		}
+	}
+	return &MiracleProvider{configPath: configPath}
+}
+
+func (m *MiracleProvider) Name() string {
+	return "miracle"
+}
+
+func (m *MiracleProvider) GetCheatSheet() (*keybinds.CheatSheet, error) {
+	config, err := ParseMiracleConfig(m.configPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse miracle-wm config: %w", err)
+	}
+
+	bindings := MiracleConfigToBindings(config)
+	categorizedBinds := make(map[string][]keybinds.Keybind)
+
+	for _, kb := range bindings {
+		category := m.categorizeAction(kb.Action)
+		bind := keybinds.Keybind{
+			Key:         m.formatKey(kb),
+			Description: kb.Comment,
+			Action:      kb.Action,
+		}
+		categorizedBinds[category] = append(categorizedBinds[category], bind)
+	}
+
+	return &keybinds.CheatSheet{
+		Title:    "Miracle WM Keybinds",
+		Provider: m.Name(),
+		Binds:    categorizedBinds,
+	}, nil
+}
+
+func (m *MiracleProvider) GetOverridePath() string {
+	expanded, err := utils.ExpandPath(m.configPath)
+	if err != nil {
+		return filepath.Join(m.configPath, "config.yaml")
+	}
+	return filepath.Join(expanded, "config.yaml")
+}
+
+func (m *MiracleProvider) formatKey(kb MiracleKeyBinding) string {
+	parts := make([]string, 0, len(kb.Mods)+1)
+	parts = append(parts, kb.Mods...)
+	parts = append(parts, kb.Key)
+	return strings.Join(parts, "+")
+}
+
+func (m *MiracleProvider) categorizeAction(action string) string {
+	switch {
+	case strings.HasPrefix(action, "select_workspace_") || strings.HasPrefix(action, "move_to_workspace_"):
+		return "Workspace"
+	case strings.Contains(action, "select_") || strings.Contains(action, "move_"):
+		return "Window"
+	case action == "toggle_resize" || strings.HasPrefix(action, "resize_"):
+		return "Window"
+	case action == "fullscreen" || action == "toggle_floating" || action == "quit_active_window" || action == "toggle_pinned_to_workspace":
+		return "Window"
+	case action == "toggle_tabbing" || action == "toggle_stacking" || action == "request_vertical" || action == "request_horizontal":
+		return "Layout"
+	case action == "quit_compositor":
+		return "System"
+	case action == "terminal":
+		return "Execute"
+	case strings.HasPrefix(action, "magnifier_"):
+		return "Accessibility"
+	case strings.HasPrefix(action, "dms ") || strings.Contains(action, "dms ipc"):
+		return "Execute"
+	default:
+		return "Execute"
+	}
+}

core/internal/keybinds/providers/miracle_parser.go

@@ -0,0 +1,320 @@
+package providers
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
+	"gopkg.in/yaml.v3"
+)
+
+type MiracleConfig struct {
+	Terminal               string                  `yaml:"terminal"`
+	ActionKey              string                  `yaml:"action_key"`
+	DefaultActionOverrides []MiracleActionOverride `yaml:"default_action_overrides"`
+	CustomActions          []MiracleCustomAction   `yaml:"custom_actions"`
+}
+
+type MiracleActionOverride struct {
+	Name      string   `yaml:"name"`
+	Action    string   `yaml:"action"`
+	Modifiers []string `yaml:"modifiers"`
+	Key       string   `yaml:"key"`
+}
+
+type MiracleCustomAction struct {
+	Command   string   `yaml:"command"`
+	Action    string   `yaml:"action"`
+	Modifiers []string `yaml:"modifiers"`
+	Key       string   `yaml:"key"`
+}
+
+type MiracleKeyBinding struct {
+	Mods    []string
+	Key     string
+	Action  string
+	Comment string
+}
+
+var miracleDefaultBinds = []MiracleKeyBinding{
+	{Mods: []string{"Super"}, Key: "Return", Action: "terminal", Comment: "Open terminal"},
+	{Mods: []string{"Super"}, Key: "v", Action: "request_vertical", Comment: "Layout windows vertically"},
+	{Mods: []string{"Super"}, Key: "h", Action: "request_horizontal", Comment: "Layout windows horizontally"},
+	{Mods: []string{"Super"}, Key: "Up", Action: "select_up", Comment: "Select window above"},
+	{Mods: []string{"Super"}, Key: "Down", Action: "select_down", Comment: "Select window below"},
+	{Mods: []string{"Super"}, Key: "Left", Action: "select_left", Comment: "Select window left"},
+	{Mods: []string{"Super"}, Key: "Right", Action: "select_right", Comment: "Select window right"},
+	{Mods: []string{"Super", "Shift"}, Key: "Up", Action: "move_up", Comment: "Move window up"},
+	{Mods: []string{"Super", "Shift"}, Key: "Down", Action: "move_down", Comment: "Move window down"},
+	{Mods: []string{"Super", "Shift"}, Key: "Left", Action: "move_left", Comment: "Move window left"},
+	{Mods: []string{"Super", "Shift"}, Key: "Right", Action: "move_right", Comment: "Move window right"},
+	{Mods: []string{"Super"}, Key: "r", Action: "toggle_resize", Comment: "Toggle resize mode"},
+	{Mods: []string{"Super"}, Key: "f", Action: "fullscreen", Comment: "Toggle fullscreen"},
+	{Mods: []string{"Super", "Shift"}, Key: "q", Action: "quit_active_window", Comment: "Close window"},
+	{Mods: []string{"Super", "Shift"}, Key: "e", Action: "quit_compositor", Comment: "Exit compositor"},
+	{Mods: []string{"Super"}, Key: "Space", Action: "toggle_floating", Comment: "Toggle floating"},
+	{Mods: []string{"Super", "Shift"}, Key: "p", Action: "toggle_pinned_to_workspace", Comment: "Toggle pinned to workspace"},
+	{Mods: []string{"Super"}, Key: "w", Action: "toggle_tabbing", Comment: "Toggle tabbing layout"},
+	{Mods: []string{"Super"}, Key: "s", Action: "toggle_stacking", Comment: "Toggle stacking layout"},
+	{Mods: []string{"Super"}, Key: "1", Action: "select_workspace_0", Comment: "Workspace 1"},
+	{Mods: []string{"Super"}, Key: "2", Action: "select_workspace_1", Comment: "Workspace 2"},
+	{Mods: []string{"Super"}, Key: "3", Action: "select_workspace_2", Comment: "Workspace 3"},
+	{Mods: []string{"Super"}, Key: "4", Action: "select_workspace_3", Comment: "Workspace 4"},
+	{Mods: []string{"Super"}, Key: "5", Action: "select_workspace_4", Comment: "Workspace 5"},
+	{Mods: []string{"Super"}, Key: "6", Action: "select_workspace_5", Comment: "Workspace 6"},
+	{Mods: []string{"Super"}, Key: "7", Action: "select_workspace_6", Comment: "Workspace 7"},
+	{Mods: []string{"Super"}, Key: "8", Action: "select_workspace_7", Comment: "Workspace 8"},
+	{Mods: []string{"Super"}, Key: "9", Action: "select_workspace_8", Comment: "Workspace 9"},
+	{Mods: []string{"Super"}, Key: "0", Action: "select_workspace_9", Comment: "Workspace 10"},
+	{Mods: []string{"Super", "Shift"}, Key: "1", Action: "move_to_workspace_0", Comment: "Move to workspace 1"},
+	{Mods: []string{"Super", "Shift"}, Key: "2", Action: "move_to_workspace_1", Comment: "Move to workspace 2"},
+	{Mods: []string{"Super", "Shift"}, Key: "3", Action: "move_to_workspace_2", Comment: "Move to workspace 3"},
+	{Mods: []string{"Super", "Shift"}, Key: "4", Action: "move_to_workspace_3", Comment: "Move to workspace 4"},
+	{Mods: []string{"Super", "Shift"}, Key: "5", Action: "move_to_workspace_4", Comment: "Move to workspace 5"},
+	{Mods: []string{"Super", "Shift"}, Key: "6", Action: "move_to_workspace_5", Comment: "Move to workspace 6"},
+	{Mods: []string{"Super", "Shift"}, Key: "7", Action: "move_to_workspace_6", Comment: "Move to workspace 7"},
+	{Mods: []string{"Super", "Shift"}, Key: "8", Action: "move_to_workspace_7", Comment: "Move to workspace 8"},
+	{Mods: []string{"Super", "Shift"}, Key: "9", Action: "move_to_workspace_8", Comment: "Move to workspace 9"},
+	{Mods: []string{"Super", "Shift"}, Key: "0", Action: "move_to_workspace_9", Comment: "Move to workspace 10"},
+}
+
+func ParseMiracleConfig(configPath string) (*MiracleConfig, error) {
+	expanded, err := utils.ExpandPath(configPath)
+	if err != nil {
+		return nil, err
+	}
+
+	info, err := os.Stat(expanded)
+	if err != nil {
+		return nil, err
+	}
+
+	var configFile string
+	if info.IsDir() {
+		configFile = filepath.Join(expanded, "config.yaml")
+	} else {
+		configFile = expanded
+	}
+
+	data, err := os.ReadFile(configFile)
+	if err != nil {
+		return nil, err
+	}
+
+	var config MiracleConfig
+	if err := yaml.Unmarshal(data, &config); err != nil {
+		return nil, err
+	}
+
+	if config.ActionKey == "" {
+		config.ActionKey = "meta"
+	}
+
+	return &config, nil
+}
+
+func resolveMiracleModifier(mod, actionKey string) string {
+	switch mod {
+	case "primary":
+		return resolveActionKey(actionKey)
+	case "alt", "alt_left", "alt_right":
+		return "Alt"
+	case "shift", "shift_left", "shift_right":
+		return "Shift"
+	case "ctrl", "ctrl_left", "ctrl_right":
+		return "Ctrl"
+	case "meta", "meta_left", "meta_right":
+		return "Super"
+	default:
+		return mod
+	}
+}
+
+func resolveActionKey(actionKey string) string {
+	switch actionKey {
+	case "meta":
+		return "Super"
+	case "alt":
+		return "Alt"
+	case "ctrl":
+		return "Ctrl"
+	default:
+		return "Super"
+	}
+}
+
+func miracleKeyCodeToName(keyCode string) string {
+	name := strings.TrimPrefix(keyCode, "KEY_")
+	name = strings.ToLower(name)
+
+	switch name {
+	case "enter":
+		return "Return"
+	case "space":
+		return "Space"
+	case "up":
+		return "Up"
+	case "down":
+		return "Down"
+	case "left":
+		return "Left"
+	case "right":
+		return "Right"
+	case "tab":
+		return "Tab"
+	case "escape", "esc":
+		return "Escape"
+	case "delete":
+		return "Delete"
+	case "backspace":
+		return "BackSpace"
+	case "home":
+		return "Home"
+	case "end":
+		return "End"
+	case "pageup":
+		return "Page_Up"
+	case "pagedown":
+		return "Page_Down"
+	case "print":
+		return "Print"
+	case "pause":
+		return "Pause"
+	case "volumeup":
+		return "XF86AudioRaiseVolume"
+	case "volumedown":
+		return "XF86AudioLowerVolume"
+	case "mute":
+		return "XF86AudioMute"
+	case "micmute":
+		return "XF86AudioMicMute"
+	case "brightnessup":
+		return "XF86MonBrightnessUp"
+	case "brightnessdown":
+		return "XF86MonBrightnessDown"
+	case "kbdillumup":
+		return "XF86KbdBrightnessUp"
+	case "kbdillumdown":
+		return "XF86KbdBrightnessDown"
+	case "comma":
+		return "comma"
+	case "minus":
+		return "minus"
+	case "equal":
+		return "equal"
+	}
+
+	if len(name) == 1 {
+		return name
+	}
+
+	return name
+}
+
+func MiracleConfigToBindings(config *MiracleConfig) []MiracleKeyBinding {
+	overridden := make(map[string]bool)
+	var bindings []MiracleKeyBinding
+
+	for _, override := range config.DefaultActionOverrides {
+		mods := make([]string, 0, len(override.Modifiers))
+		for _, mod := range override.Modifiers {
+			mods = append(mods, resolveMiracleModifier(mod, config.ActionKey))
+		}
+
+		bindings = append(bindings, MiracleKeyBinding{
+			Mods:    mods,
+			Key:     miracleKeyCodeToName(override.Key),
+			Action:  override.Name,
+			Comment: miracleActionDescription(override.Name),
+		})
+		overridden[override.Name] = true
+	}
+
+	for _, def := range miracleDefaultBinds {
+		if overridden[def.Action] {
+			continue
+		}
+		bindings = append(bindings, def)
+	}
+
+	for _, custom := range config.CustomActions {
+		mods := make([]string, 0, len(custom.Modifiers))
+		for _, mod := range custom.Modifiers {
+			mods = append(mods, resolveMiracleModifier(mod, config.ActionKey))
+		}
+
+		bindings = append(bindings, MiracleKeyBinding{
+			Mods:    mods,
+			Key:     miracleKeyCodeToName(custom.Key),
+			Action:  custom.Command,
+			Comment: custom.Command,
+		})
+	}
+
+	return bindings
+}
+
+func miracleActionDescription(action string) string {
+	switch action {
+	case "terminal":
+		return "Open terminal"
+	case "request_vertical":
+		return "Layout windows vertically"
+	case "request_horizontal":
+		return "Layout windows horizontally"
+	case "select_up":
+		return "Select window above"
+	case "select_down":
+		return "Select window below"
+	case "select_left":
+		return "Select window left"
+	case "select_right":
+		return "Select window right"
+	case "move_up":
+		return "Move window up"
+	case "move_down":
+		return "Move window down"
+	case "move_left":
+		return "Move window left"
+	case "move_right":
+		return "Move window right"
+	case "toggle_resize":
+		return "Toggle resize mode"
+	case "fullscreen":
+		return "Toggle fullscreen"
+	case "quit_active_window":
+		return "Close window"
+	case "quit_compositor":
+		return "Exit compositor"
+	case "toggle_floating":
+		return "Toggle floating"
+	case "toggle_pinned_to_workspace":
+		return "Toggle pinned to workspace"
+	case "toggle_tabbing":
+		return "Toggle tabbing layout"
+	case "toggle_stacking":
+		return "Toggle stacking layout"
+	case "magnifier_on":
+		return "Enable magnifier"
+	case "magnifier_off":
+		return "Disable magnifier"
+	case "magnifier_increase_size":
+		return "Increase magnifier area"
+	case "magnifier_decrease_size":
+		return "Decrease magnifier area"
+	case "magnifier_increase_scale":
+		return "Increase magnifier scale"
+	case "magnifier_decrease_scale":
+		return "Decrease magnifier scale"
+	}
+
+	if num, ok := strings.CutPrefix(action, "select_workspace_"); ok {
+		return "Workspace " + num
+	}
+	if num, ok := strings.CutPrefix(action, "move_to_workspace_"); ok {
+		return "Move to workspace " + num
+	}
+
+	return action
+}

core/internal/keybinds/providers/niri.go

@@ -10,7 +10,6 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/keybinds"
-	"github.com/sblinch/kdl-go"
 	"github.com/sblinch/kdl-go/document"
 )
 
@@ -292,7 +291,7 @@ func (n *NiriProvider) loadOverrideBinds() (map[string]*overrideBind, error) {
 	parser := NewNiriParser(filepath.Dir(overridePath))
 	parser.currentSource = overridePath
 
-	doc, err := kdl.Parse(strings.NewReader(string(data)))
+	doc, err := parseKDL(data)
 	if err != nil {
 		return nil, err
 	}
@@ -341,6 +340,8 @@ func (n *NiriProvider) buildActionFromNode(bindNode *document.Node) string {
 		val := arg.ValueString()
 		if val == "" {
 			parts = append(parts, `""`)
+		} else if strings.ContainsAny(val, " \t") {
+			parts = append(parts, `"`+strings.ReplaceAll(val, `"`, `\"`)+`"`)
 		} else {
 			parts = append(parts, val)
 		}

core/internal/keybinds/providers/niri_parser.go

@@ -50,6 +50,103 @@ type NiriParser struct {
 	conflictingConfigs map[string]*NiriKeyBinding
 }
 
+func parseKDL(data []byte) (*document.Document, error) {
+	return kdl.Parse(strings.NewReader(normalizeKDLBraces(string(data))))
+}
+
+func normalizeKDLBraces(input string) string {
+	var sb strings.Builder
+	sb.Grow(len(input))
+
+	var prev byte
+	n := len(input)
+	for i := 0; i < n; {
+		c := input[i]
+
+		switch {
+		case c == '"':
+			end := findStringEnd(input, i)
+			sb.WriteString(input[i:end])
+			prev = '"'
+			i = end
+		case c == '/' && i+1 < n && input[i+1] == '/':
+			end := findLineCommentEnd(input, i)
+			sb.WriteString(input[i:end])
+			prev = '\n'
+			i = end
+		case c == '/' && i+1 < n && input[i+1] == '*':
+			end := findBlockCommentEnd(input, i)
+			sb.WriteString(input[i:end])
+			prev = '/'
+			i = end
+		case c == '{' && prev != 0 && !isBraceAdjacentSpace(prev):
+			sb.WriteByte(' ')
+			sb.WriteByte(c)
+			prev = c
+			i++
+		default:
+			sb.WriteByte(c)
+			prev = c
+			i++
+		}
+	}
+
+	return sb.String()
+}
+
+func findStringEnd(s string, start int) int {
+	n := len(s)
+	for i := start + 1; i < n; {
+		switch s[i] {
+		case '\\':
+			i += 2
+		case '"':
+			return i + 1
+		default:
+			i++
+		}
+	}
+	return n
+}
+
+func findLineCommentEnd(s string, start int) int {
+	for i := start + 2; i < len(s); i++ {
+		if s[i] == '\n' {
+			return i
+		}
+	}
+	return len(s)
+}
+
+func findBlockCommentEnd(s string, start int) int {
+	n := len(s)
+	depth := 1
+	for i := start + 2; i < n && depth > 0; {
+		switch {
+		case i+1 < n && s[i] == '/' && s[i+1] == '*':
+			depth++
+			i += 2
+		case i+1 < n && s[i] == '*' && s[i+1] == '/':
+			depth--
+			i += 2
+			if depth == 0 {
+				return i
+			}
+		default:
+			i++
+		}
+	}
+	return n
+}
+
+func isBraceAdjacentSpace(b byte) bool {
+	switch b {
+	case ' ', '\t', '\n', '\r', '{':
+		return true
+	}
+	return false
+}
+
 func NewNiriParser(configDir string) *NiriParser {
 	return &NiriParser{
 		configDir:          configDir,
@@ -91,7 +188,7 @@ func (p *NiriParser) parseDMSBindsDirectly(dmsBindsPath string, section *NiriSec
 		return
 	}
 
-	doc, err := kdl.Parse(strings.NewReader(string(data)))
+	doc, err := parseKDL(data)
 	if err != nil {
 		return
 	}
@@ -159,7 +256,7 @@ func (p *NiriParser) parseFile(filePath, sectionName string) (*NiriSection, erro
 		return nil, fmt.Errorf("failed to read %s: %w", absPath, err)
 	}
 
-	doc, err := kdl.Parse(strings.NewReader(string(data)))
+	doc, err := parseKDL(data)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse KDL in %s: %w", absPath, err)
 	}

core/internal/keybinds/providers/niri_parser_test.go

@@ -3,9 +3,74 @@ package providers
 import (
 	"os"
 	"path/filepath"
+	"slices"
 	"testing"
 )
 
+func TestNiriParse_NoSpaceBeforeBrace(t *testing.T) {
+	config := `recent-windows {
+    binds {
+        Alt+Tab         { next-window scope="output"; }
+        Alt+Shift+Tab   { previous-window scope="output"; }
+        Alt+grave       { next-window filter="app-id"; }
+        Alt+Shift+grave { previous-window filter="app-id"; }
+        Alt+Escape      { next-window scope="all"; }
+        Alt+Shift+Escape{ previous-window scope="all"; }
+    }
+}
+`
+	tmpDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(tmpDir, "config.kdl"), []byte(config), 0o644); err != nil {
+		t.Fatalf("Failed to write test config: %v", err)
+	}
+
+	result, err := ParseNiriKeys(tmpDir)
+	if err != nil {
+		t.Fatalf("ParseNiriKeys failed on valid niri config: %v", err)
+	}
+
+	var found *NiriKeyBinding
+	for i := range result.Section.Keybinds {
+		kb := &result.Section.Keybinds[i]
+		if kb.Key == "Escape" && slices.Contains(kb.Mods, "Alt") && slices.Contains(kb.Mods, "Shift") {
+			found = kb
+			break
+		}
+	}
+	if found == nil {
+		t.Fatal("Alt+Shift+Escape bind missing — '{' without preceding space was not handled")
+	}
+	if found.Action != "previous-window" {
+		t.Errorf("Action = %q, want %q", found.Action, "previous-window")
+	}
+}
+
+func TestNormalizeKDLBraces(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		out  string
+	}{
+		{"already spaced", "node { child }\n", "node { child }\n"},
+		{"missing space", "node{ child }\n", "node { child }\n"},
+		{"niri keybind", "Alt+Shift+Escape{ previous-window; }", "Alt+Shift+Escape { previous-window; }"},
+		{"brace inside string", `node "a{b" { child }`, `node "a{b" { child }`},
+		{"brace in line comment", "// foo{bar\nnode { }", "// foo{bar\nnode { }"},
+		{"brace in block comment", "/* foo{bar */ node{ }", "/* foo{bar */ node { }"},
+		{"escaped quote in string", `node "a\"b{c" { }`, `node "a\"b{c" { }`},
+		{"leading brace", "{ child }", "{ child }"},
+		{"nested missing space", "a{b{ c }}", "a {b { c }}"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := normalizeKDLBraces(tc.in)
+			if got != tc.out {
+				t.Errorf("normalizeKDLBraces(%q) = %q, want %q", tc.in, got, tc.out)
+			}
+		})
+	}
+}
+
 func TestNiriParseKeyCombo(t *testing.T) {
 	tests := []struct {
 		combo        string

core/internal/keybinds/providers/sway.go

@@ -3,6 +3,7 @@ package providers
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/keybinds"
@@ -18,14 +19,21 @@ func NewSwayProvider(configPath string) *SwayProvider {
 	_, scrollEnvSet := os.LookupEnv("SCROLLSOCK")
 
 	if configPath == "" {
+		configDir, err := os.UserConfigDir()
+		if err != nil {
+			configDir = ""
+		}
 		if scrollEnvSet {
-			configPath = "$HOME/.config/scroll"
+			if configDir != "" {
+				configPath = filepath.Join(configDir, "scroll")
+			}
 			isScroll = true
 		} else {
-			configPath = "$HOME/.config/sway"
+			if configDir != "" {
+				configPath = filepath.Join(configDir, "sway")
+			}
 		}
 	} else {
-		// Determine isScroll based on the provided config path
 		isScroll = strings.Contains(configPath, "scroll")
 	}
 
@@ -36,16 +44,16 @@ func NewSwayProvider(configPath string) *SwayProvider {
 }
 
 func (s *SwayProvider) Name() string {
-	if s != nil && s.isScroll {
-		return "scroll"
-	}
 	if s == nil {
-		_, ok := os.LookupEnv("SCROLLSOCK")
-		if ok {
+		if os.Getenv("SCROLLSOCK") != "" {
 			return "scroll"
 		}
+		return "sway"
 	}
 
+	if s.isScroll {
+		return "scroll"
+	}
 	return "sway"
 }
 

core/internal/keybinds/providers/sway_test.go

@@ -15,8 +15,13 @@ func TestSwayProviderName(t *testing.T) {
 
 func TestSwayProviderDefaultPath(t *testing.T) {
 	provider := NewSwayProvider("")
-	if provider.configPath != "$HOME/.config/sway" {
-		t.Errorf("configPath = %q, want %q", provider.configPath, "$HOME/.config/sway")
+	configDir, err := os.UserConfigDir()
+	if err != nil {
+		t.Skip("UserConfigDir not available")
+	}
+	expected := filepath.Join(configDir, "sway")
+	if provider.configPath != expected {
+		t.Errorf("configPath = %q, want %q", provider.configPath, expected)
 	}
 }
 

core/internal/matugen/matugen.go

@@ -1,7 +1,9 @@
 package matugen
 
 import (
+	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"math"
 	"os"
@@ -19,6 +21,8 @@ import (
 	"github.com/lucasb-eyer/go-colorful"
 )
 
+var ErrNoChanges = errors.New("no color changes")
+
 type ColorMode string
 
 const (
@@ -33,6 +37,7 @@ const (
 	TemplateKindTerminal
 	TemplateKindGTK
 	TemplateKindVSCode
+	TemplateKindEmacs
 )
 
 type TemplateDef struct {
@@ -53,7 +58,7 @@ var templateRegistry = []TemplateDef{
 	{ID: "qt6ct", Commands: []string{"qt6ct"}, ConfigFile: "qt6ct.toml"},
 	{ID: "firefox", Commands: []string{"firefox"}, ConfigFile: "firefox.toml"},
 	{ID: "pywalfox", Commands: []string{"pywalfox"}, ConfigFile: "pywalfox.toml"},
-	{ID: "zenbrowser", Commands: []string{"zen", "zen-browser"}, Flatpaks: []string{"app.zen_browser.zen"}, ConfigFile: "zenbrowser.toml"},
+	{ID: "zenbrowser", Commands: []string{"zen", "zen-browser", "zen-beta", "zen-twilight"}, Flatpaks: []string{"app.zen_browser.zen"}, ConfigFile: "zenbrowser.toml"},
 	{ID: "vesktop", Commands: []string{"vesktop"}, Flatpaks: []string{"dev.vencord.Vesktop"}, ConfigFile: "vesktop.toml"},
 	{ID: "equibop", Commands: []string{"equibop"}, ConfigFile: "equibop.toml"},
 	{ID: "ghostty", Commands: []string{"ghostty"}, ConfigFile: "ghostty.toml", Kind: TemplateKindTerminal},
@@ -65,7 +70,8 @@ var templateRegistry = []TemplateDef{
 	{ID: "dgop", Commands: []string{"dgop"}, ConfigFile: "dgop.toml"},
 	{ID: "kcolorscheme", ConfigFile: "kcolorscheme.toml", RunUnconditionally: true},
 	{ID: "vscode", Kind: TemplateKindVSCode},
-	{ID: "emacs", Commands: []string{"emacs"}, ConfigFile: "emacs.toml"},
+	{ID: "emacs", Commands: []string{"emacs"}, ConfigFile: "emacs.toml", Kind: TemplateKindEmacs},
+	{ID: "zed", Commands: []string{"zed", "zeditor", "zedit"}, ConfigFile: "zed.toml"},
 }
 
 func (c *ColorMode) GTKTheme() string {
@@ -78,7 +84,8 @@ func (c *ColorMode) GTKTheme() string {
 }
 
 var (
-	matugenVersionOnce sync.Once
+	matugenVersionMu   sync.Mutex
+	matugenVersionOK   bool
 	matugenSupportsCOE bool
 	matugenIsV4        bool
 )
@@ -93,6 +100,7 @@ type Options struct {
 	IconTheme           string
 	MatugenType         string
 	RunUserTemplates    bool
+	ColorsOnly          bool
 	StockColors         string
 	SyncModeWithPortal  bool
 	TerminalsAlwaysDark bool
@@ -158,8 +166,14 @@ func Run(opts Options) error {
 
 	log.Infof("Building theme: %s %s (%s)", opts.Kind, opts.Value, opts.Mode)
 
-	if err := buildOnce(&opts); err != nil {
-		return err
+	changed, buildErr := buildOnce(&opts)
+	if buildErr != nil {
+		return buildErr
+	}
+
+	if !changed {
+		log.Info("No color changes detected, skipping refresh")
+		return ErrNoChanges
 	}
 
 	if opts.SyncModeWithPortal {
@@ -170,25 +184,27 @@ func Run(opts Options) error {
 	return nil
 }
 
-func buildOnce(opts *Options) error {
+func buildOnce(opts *Options) (bool, error) {
 	cfgFile, err := os.CreateTemp("", "matugen-config-*.toml")
 	if err != nil {
-		return fmt.Errorf("failed to create temp config: %w", err)
+		return false, fmt.Errorf("failed to create temp config: %w", err)
 	}
 	defer os.Remove(cfgFile.Name())
 	defer cfgFile.Close()
 
 	tmpDir, err := os.MkdirTemp("", "matugen-templates-*")
 	if err != nil {
-		return fmt.Errorf("failed to create temp dir: %w", err)
+		return false, fmt.Errorf("failed to create temp dir: %w", err)
 	}
 	defer os.RemoveAll(tmpDir)
 
 	if err := buildMergedConfig(opts, cfgFile, tmpDir); err != nil {
-		return fmt.Errorf("failed to build config: %w", err)
+		return false, fmt.Errorf("failed to build config: %w", err)
 	}
 	cfgFile.Close()
 
+	oldColors, _ := os.ReadFile(opts.ColorsOutput())
+
 	var primaryDark, primaryLight, surface string
 	var dank16JSON string
 	var importArgs []string
@@ -200,7 +216,7 @@ func buildOnce(opts *Options) error {
 		surface = extractNestedColor(opts.StockColors, "surface", "dark")
 
 		if primaryDark == "" {
-			return fmt.Errorf("failed to extract primary dark from stock colors")
+			return false, fmt.Errorf("failed to extract primary dark from stock colors")
 		}
 		if primaryLight == "" {
 			primaryLight = primaryDark
@@ -214,14 +230,14 @@ func buildOnce(opts *Options) error {
 		args := []string{"color", "hex", primaryDark, "-m", string(opts.Mode), "-t", opts.MatugenType, "-c", cfgFile.Name()}
 		args = append(args, importArgs...)
 		if err := runMatugen(args); err != nil {
-			return err
+			return false, err
 		}
 	} else {
 		log.Infof("Using dynamic theme from %s: %s", opts.Kind, opts.Value)
 
 		matJSON, err := runMatugenDryRun(opts)
 		if err != nil {
-			return fmt.Errorf("matugen dry-run failed: %w", err)
+			return false, fmt.Errorf("matugen dry-run failed: %w", err)
 		}
 
 		primaryDark = extractMatugenColor(matJSON, "primary", "dark")
@@ -229,7 +245,7 @@ func buildOnce(opts *Options) error {
 		surface = extractMatugenColor(matJSON, "surface", "dark")
 
 		if primaryDark == "" {
-			return fmt.Errorf("failed to extract primary color")
+			return false, fmt.Errorf("failed to extract primary color")
 		}
 		if primaryLight == "" {
 			primaryLight = primaryDark
@@ -250,10 +266,19 @@ func buildOnce(opts *Options) error {
 		args = append(args, "-m", string(opts.Mode), "-t", opts.MatugenType, "-c", cfgFile.Name())
 		args = append(args, importArgs...)
 		if err := runMatugen(args); err != nil {
-			return err
+			return false, err
 		}
 	}
 
+	newColors, _ := os.ReadFile(opts.ColorsOutput())
+	if bytes.Equal(oldColors, newColors) && len(oldColors) > 0 {
+		return false, nil
+	}
+
+	if opts.ColorsOnly {
+		return true, nil
+	}
+
 	if isDMSGTKActive(opts.ConfigDir) {
 		switch opts.Mode {
 		case ColorModeLight:
@@ -271,7 +296,7 @@ func buildOnce(opts *Options) error {
 
 	signalTerminals(opts)
 
-	return nil
+	return true, nil
 }
 
 func buildMergedConfig(opts *Options, cfgFile *os.File, tmpDir string) error {
@@ -311,6 +336,10 @@ output_path = '%s'
 
 `, opts.ShellDir, opts.ColorsOutput())
 
+	if opts.ColorsOnly {
+		return nil
+	}
+
 	homeDir, _ := os.UserHomeDir()
 	for _, tmpl := range templateRegistry {
 		if opts.ShouldSkipTemplate(tmpl.ID) {
@@ -334,6 +363,10 @@ output_path = '%s'
 			appendVSCodeConfig(cfgFile, "cursor", filepath.Join(homeDir, ".cursor/extensions"), opts.ShellDir)
 			appendVSCodeConfig(cfgFile, "windsurf", filepath.Join(homeDir, ".windsurf/extensions"), opts.ShellDir)
 			appendVSCodeConfig(cfgFile, "vscode-insiders", filepath.Join(homeDir, ".vscode-insiders/extensions"), opts.ShellDir)
+		case TemplateKindEmacs:
+			if utils.EmacsConfigDir() != "" {
+				appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
+			}
 		default:
 			appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
 		}
@@ -491,6 +524,9 @@ func substituteVars(content, shellDir string) string {
 	result = strings.ReplaceAll(result, "'CONFIG_DIR/", "'"+utils.XDGConfigHome()+"/")
 	result = strings.ReplaceAll(result, "'DATA_DIR/", "'"+utils.XDGDataHome()+"/")
 	result = strings.ReplaceAll(result, "'CACHE_DIR/", "'"+utils.XDGCacheHome()+"/")
+	if emacsDir := utils.EmacsConfigDir(); emacsDir != "" {
+		result = strings.ReplaceAll(result, "'EMACS_DIR/", "'"+emacsDir+"/")
+	}
 	return result
 }
 
@@ -511,79 +547,160 @@ func extractTOMLSection(content, startMarker, endMarker string) string {
 	return content[startIdx : startIdx+endIdx]
 }
 
-func checkMatugenVersion() {
-	matugenVersionOnce.Do(func() {
-		cmd := exec.Command("matugen", "--version")
-		output, err := cmd.Output()
-		if err != nil {
-			return
-		}
-
-		versionStr := strings.TrimSpace(string(output))
-		versionStr = strings.TrimPrefix(versionStr, "matugen ")
-
-		parts := strings.Split(versionStr, ".")
-		if len(parts) < 2 {
-			return
-		}
-
-		major, err := strconv.Atoi(parts[0])
-		if err != nil {
-			return
-		}
-
-		minor, err := strconv.Atoi(parts[1])
-		if err != nil {
-			return
-		}
-
-		matugenSupportsCOE = major > 3 || (major == 3 && minor >= 1)
-		matugenIsV4 = major >= 4
-		if matugenSupportsCOE {
-			log.Infof("Matugen %s supports --continue-on-error", versionStr)
-		}
-		if matugenIsV4 {
-			log.Infof("Matugen %s: using v4 flags", versionStr)
-		}
-	})
+type matugenFlags struct {
+	supportsCOE bool
+	isV4        bool
 }
 
-func runMatugen(args []string) error {
-	checkMatugenVersion()
+func detectMatugenVersion() (matugenFlags, error) {
+	matugenVersionMu.Lock()
+	defer matugenVersionMu.Unlock()
+
+	if matugenVersionOK {
+		return matugenFlags{matugenSupportsCOE, matugenIsV4}, nil
+	}
+
+	return detectMatugenVersionLocked()
+}
+
+func redetectMatugenVersion(old matugenFlags) (matugenFlags, bool) {
+	matugenVersionMu.Lock()
+	defer matugenVersionMu.Unlock()
+
+	matugenVersionOK = false
+	flags, err := detectMatugenVersionLocked()
+	if err != nil {
+		return old, false
+	}
+	changed := flags.supportsCOE != old.supportsCOE || flags.isV4 != old.isV4
+	return flags, changed
+}
+
+func detectMatugenVersionLocked() (matugenFlags, error) {
+	cmd := exec.Command("matugen", "--version")
+	output, err := cmd.Output()
+	if err != nil {
+		return matugenFlags{}, fmt.Errorf("failed to get matugen version: %w", err)
+	}
+
+	versionStr := strings.TrimSpace(string(output))
+	versionStr = strings.TrimPrefix(versionStr, "matugen ")
+
+	parts := strings.Split(versionStr, ".")
+	if len(parts) < 2 {
+		return matugenFlags{}, fmt.Errorf("unexpected matugen version format: %q", versionStr)
+	}
+
+	major, err := strconv.Atoi(parts[0])
+	if err != nil {
+		return matugenFlags{}, fmt.Errorf("failed to parse matugen major version %q: %w", parts[0], err)
+	}
+
+	minor, err := strconv.Atoi(parts[1])
+	if err != nil {
+		return matugenFlags{}, fmt.Errorf("failed to parse matugen minor version %q: %w", parts[1], err)
+	}
+
+	matugenSupportsCOE = major > 3 || (major == 3 && minor >= 1)
+	matugenIsV4 = major >= 4
+	matugenVersionOK = true
 
 	if matugenSupportsCOE {
-		args = append([]string{"--continue-on-error"}, args...)
+		log.Debugf("Matugen %s detected: continue-on-error support enabled", versionStr)
 	}
 	if matugenIsV4 {
+		log.Debugf("Matugen %s detected: using v4 compatibility flags", versionStr)
+	}
+	return matugenFlags{matugenSupportsCOE, matugenIsV4}, nil
+}
+
+func buildMatugenArgs(baseArgs []string, flags matugenFlags) []string {
+	args := make([]string, 0, len(baseArgs)+4)
+	if flags.supportsCOE {
+		args = append(args, "--continue-on-error")
+	}
+	args = append(args, baseArgs...)
+	if flags.isV4 {
 		args = append(args, "--source-color-index", "0")
 	}
+	return args
+}
 
+func runMatugen(baseArgs []string) error {
+	flags, err := detectMatugenVersion()
+	if err != nil {
+		return err
+	}
+
+	args := buildMatugenArgs(baseArgs, flags)
 	cmd := exec.Command("matugen", args...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
-	return cmd.Run()
+	runErr := cmd.Run()
+	if runErr == nil {
+		return nil
+	}
+
+	log.Warnf("Matugen failed (v4=%v): %v", flags.isV4, runErr)
+
+	newFlags, changed := redetectMatugenVersion(flags)
+	if !changed {
+		return runErr
+	}
+
+	log.Warnf("Matugen version changed (v4: %v -> %v), retrying", flags.isV4, newFlags.isV4)
+	args = buildMatugenArgs(baseArgs, newFlags)
+	retryCmd := exec.Command("matugen", args...)
+	retryCmd.Stdout = os.Stdout
+	retryCmd.Stderr = os.Stderr
+	return retryCmd.Run()
 }
 
 func runMatugenDryRun(opts *Options) (string, error) {
-	checkMatugenVersion()
-
-	var args []string
-	switch opts.Kind {
-	case "hex":
-		args = []string{"color", "hex", opts.Value}
-	default:
-		args = []string{opts.Kind, opts.Value}
-	}
-	args = append(args, "-m", "dark", "-t", opts.MatugenType, "--json", "hex", "--dry-run")
-	if matugenIsV4 {
-		args = append(args, "--source-color-index", "0", "--old-json-output")
-	}
-
-	cmd := exec.Command("matugen", args...)
-	output, err := cmd.Output()
+	flags, err := detectMatugenVersion()
 	if err != nil {
 		return "", err
 	}
+
+	output, dryErr := execDryRun(opts, flags)
+	if dryErr == nil {
+		return output, nil
+	}
+
+	log.Warnf("Matugen dry-run failed (v4=%v): %v", flags.isV4, dryErr)
+
+	newFlags, changed := redetectMatugenVersion(flags)
+	if !changed {
+		return "", dryErr
+	}
+
+	log.Warnf("Matugen version changed (v4: %v -> %v), retrying dry-run", flags.isV4, newFlags.isV4)
+	return execDryRun(opts, newFlags)
+}
+
+func execDryRun(opts *Options, flags matugenFlags) (string, error) {
+	var baseArgs []string
+	switch opts.Kind {
+	case "hex":
+		baseArgs = []string{"color", "hex", opts.Value}
+	default:
+		baseArgs = []string{opts.Kind, opts.Value}
+	}
+	baseArgs = append(baseArgs, "-m", "dark", "-t", opts.MatugenType, "--json", "hex", "--dry-run")
+	if flags.isV4 {
+		baseArgs = append(baseArgs, "--source-color-index", "0", "--old-json-output")
+	}
+
+	cmd := exec.Command("matugen", baseArgs...)
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	output, err := cmd.Output()
+	if err != nil {
+		if stderr.Len() > 0 {
+			return "", fmt.Errorf("matugen %v failed (v4=%v): %s", baseArgs, flags.isV4, strings.TrimSpace(stderr.String()))
+		}
+		return "", fmt.Errorf("matugen %v failed (v4=%v): %w", baseArgs, flags.isV4, err)
+	}
 	return strings.ReplaceAll(string(output), "\n", ""), nil
 }
 
@@ -819,6 +936,8 @@ func CheckTemplates(checker utils.AppChecker) []TemplateCheck {
 			detected = true
 		case tmpl.Kind == TemplateKindVSCode:
 			detected = checkVSCodeExtension(homeDir)
+		case tmpl.Kind == TemplateKindEmacs:
+			detected = appExists(checker, tmpl.Commands, tmpl.Flatpaks) && utils.EmacsConfigDir() != ""
 		default:
 			detected = appExists(checker, tmpl.Commands, tmpl.Flatpaks)
 		}

core/internal/matugen/matugen_test.go

@@ -3,6 +3,7 @@ package matugen
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	mocks_utils "github.com/AvengeMedia/DankMaterialShell/core/internal/mocks/utils"
@@ -392,3 +393,51 @@ func TestSubstituteVars(t *testing.T) {
 		})
 	}
 }
+
+func TestBuildMergedConfigColorsOnly(t *testing.T) {
+	tempDir := t.TempDir()
+
+	shellDir := filepath.Join(tempDir, "shell")
+	configsDir := filepath.Join(shellDir, "matugen", "configs")
+	if err := os.MkdirAll(configsDir, 0o755); err != nil {
+		t.Fatalf("failed to create configs dir: %v", err)
+	}
+
+	baseConfig := "[config]\ncustom_keywords = []\n"
+	if err := os.WriteFile(filepath.Join(configsDir, "base.toml"), []byte(baseConfig), 0o644); err != nil {
+		t.Fatalf("failed to write base config: %v", err)
+	}
+
+	cfgFile, err := os.CreateTemp(tempDir, "merged-*.toml")
+	if err != nil {
+		t.Fatalf("failed to create temp config: %v", err)
+	}
+	defer os.Remove(cfgFile.Name())
+	defer cfgFile.Close()
+
+	opts := &Options{
+		ShellDir:   shellDir,
+		ConfigDir:  filepath.Join(tempDir, "config"),
+		StateDir:   filepath.Join(tempDir, "state"),
+		ColorsOnly: true,
+	}
+
+	if err := buildMergedConfig(opts, cfgFile, filepath.Join(tempDir, "templates")); err != nil {
+		t.Fatalf("buildMergedConfig failed: %v", err)
+	}
+
+	if err := cfgFile.Close(); err != nil {
+		t.Fatalf("failed to close merged config: %v", err)
+	}
+
+	output, err := os.ReadFile(cfgFile.Name())
+	if err != nil {
+		t.Fatalf("failed to read merged config: %v", err)
+	}
+
+	content := string(output)
+	assert.Contains(t, content, "[templates.dank]")
+	assert.Contains(t, content, "output_path = '"+filepath.Join(opts.StateDir, "dms-colors.json")+"'")
+	assert.NotContains(t, content, "[templates.gtk]")
+	assert.False(t, strings.Contains(content, "output_path = 'CONFIG_DIR/"), "colors-only config should not emit app template outputs")
+}

core/internal/matugen/queue.go

@@ -2,6 +2,7 @@ package matugen
 
 import (
 	"context"
+	"errors"
 	"sync"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
@@ -93,10 +94,13 @@ func (q *Queue) runWorker() {
 		err := Run(job.Options)
 
 		var result Result
-		if err != nil {
-			result = Result{Success: false, Error: err}
-		} else {
+		switch {
+		case err == nil:
 			result = Result{Success: true}
+		case errors.Is(err, ErrNoChanges):
+			result = Result{Success: true}
+		default:
+			result = Result{Success: false, Error: err}
 		}
 
 		q.finishJob(result)

core/internal/notify/notify.go

@@ -6,6 +6,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"syscall"
 
 	"github.com/godbus/dbus/v5"
@@ -15,6 +16,9 @@ const (
 	notifyDest      = "org.freedesktop.Notifications"
 	notifyPath      = "/org/freedesktop/Notifications"
 	notifyInterface = "org.freedesktop.Notifications"
+
+	maxSummaryLen = 29
+	maxBodyLen    = 80
 )
 
 type Notification struct {
@@ -39,6 +43,13 @@ func Send(n Notification) error {
 		n.Timeout = 5000
 	}
 
+	if len(n.Summary) > maxSummaryLen {
+		n.Summary = n.Summary[:maxSummaryLen-3] + "..."
+	}
+	if len(n.Body) > maxBodyLen {
+		n.Body = n.Body[:maxBodyLen-3] + "..."
+	}
+
 	var actions []string
 	if n.FilePath != "" {
 		actions = []string{
@@ -49,7 +60,11 @@ func Send(n Notification) error {
 
 	hints := map[string]dbus.Variant{}
 	if n.FilePath != "" {
-		hints["image_path"] = dbus.MakeVariant(n.FilePath)
+		imgPath := n.FilePath
+		if !strings.HasPrefix(imgPath, "file://") {
+			imgPath = "file://" + imgPath
+		}
+		hints["image_path"] = dbus.MakeVariant(imgPath)
 	}
 
 	obj := conn.Object(notifyDest, notifyPath)

core/internal/proto/ext_workspace/workspace.go

@@ -258,7 +258,7 @@ func (i *ExtWorkspaceManagerV1) Dispatch(opcode uint32, fd int, data []byte) {
 		l := 0
 		objectID := client.Uint32(data[l : l+4])
 		proxy := i.Context().GetProxy(objectID)
-		if proxy != nil {
+		if proxy != nil && !proxy.IsZombie() {
 			e.WorkspaceGroup = proxy.(*ExtWorkspaceGroupHandleV1)
 		} else {
 			groupHandle := &ExtWorkspaceGroupHandleV1{}
@@ -278,7 +278,7 @@ func (i *ExtWorkspaceManagerV1) Dispatch(opcode uint32, fd int, data []byte) {
 		l := 0
 		objectID := client.Uint32(data[l : l+4])
 		proxy := i.Context().GetProxy(objectID)
-		if proxy != nil {
+		if proxy != nil && !proxy.IsZombie() {
 			e.Workspace = proxy.(*ExtWorkspaceHandleV1)
 		} else {
 			wsHandle := &ExtWorkspaceHandleV1{}

core/internal/screenshot/compositor.go

@@ -21,6 +21,7 @@ const (
 	CompositorNiri
 	CompositorDWL
 	CompositorScroll
+	CompositorMiracle
 )
 
 var detectedCompositor Compositor = -1
@@ -34,6 +35,7 @@ func DetectCompositor() Compositor {
 	niriSocket := os.Getenv("NIRI_SOCKET")
 	swaySocket := os.Getenv("SWAYSOCK")
 	scrollSocket := os.Getenv("SCROLLSOCK")
+	miracleSocket := os.Getenv("MIRACLESOCK")
 
 	switch {
 	case niriSocket != "":
@@ -46,7 +48,11 @@ func DetectCompositor() Compositor {
 			detectedCompositor = CompositorScroll
 			return detectedCompositor
 		}
-
+	case miracleSocket != "":
+		if _, err := os.Stat(miracleSocket); err == nil {
+			detectedCompositor = CompositorMiracle
+			return detectedCompositor
+		}
 	case swaySocket != "":
 		if _, err := os.Stat(swaySocket); err == nil {
 			detectedCompositor = CompositorSway
@@ -260,6 +266,25 @@ func getScrollFocusedMonitor() string {
 	return ""
 }
 
+func getMiracleFocusedMonitor() string {
+	output, err := exec.Command("miraclemsg", "-t", "get_workspaces").Output()
+	if err != nil {
+		return ""
+	}
+
+	var workspaces []swayWorkspace
+	if err := json.Unmarshal(output, &workspaces); err != nil {
+		return ""
+	}
+
+	for _, ws := range workspaces {
+		if ws.Focused {
+			return ws.Output
+		}
+	}
+	return ""
+}
+
 type niriWorkspace struct {
 	Output    string `json:"output"`
 	IsFocused bool   `json:"is_focused"`
@@ -407,6 +432,8 @@ func GetFocusedMonitor() string {
 		return getSwayFocusedMonitor()
 	case CompositorScroll:
 		return getScrollFocusedMonitor()
+	case CompositorMiracle:
+		return getMiracleFocusedMonitor()
 	case CompositorNiri:
 		return getNiriFocusedMonitor()
 	case CompositorDWL:
@@ -417,20 +444,21 @@ func GetFocusedMonitor() string {
 
 type outputInfo struct {
 	x, y      int32
+	scale     float64
 	transform int32
 }
 
-func getOutputInfo(outputName string) (*outputInfo, bool) {
+func getAllOutputInfos() map[string]*outputInfo {
 	display, err := client.Connect("")
 	if err != nil {
-		return nil, false
+		return nil
 	}
 	ctx := display.Context()
 	defer ctx.Close()
 
 	registry, err := display.GetRegistry()
 	if err != nil {
-		return nil, false
+		return nil
 	}
 
 	var outputManager *wlr_output_management.ZwlrOutputManagerV1
@@ -449,16 +477,17 @@ func getOutputInfo(outputName string) (*outputInfo, bool) {
 	})
 
 	if err := wlhelpers.Roundtrip(display, ctx); err != nil {
-		return nil, false
+		return nil
 	}
 
 	if outputManager == nil {
-		return nil, false
+		return nil
 	}
 
 	type headState struct {
 		name      string
 		x, y      int32
+		scale     float64
 		transform int32
 	}
 	heads := make(map[*wlr_output_management.ZwlrOutputHeadV1]*headState)
@@ -474,6 +503,9 @@ func getOutputInfo(outputName string) (*outputInfo, bool) {
 			state.x = pe.X
 			state.y = pe.Y
 		})
+		e.Head.SetScaleHandler(func(se wlr_output_management.ZwlrOutputHeadV1ScaleEvent) {
+			state.scale = se.Scale
+		})
 		e.Head.SetTransformHandler(func(te wlr_output_management.ZwlrOutputHeadV1TransformEvent) {
 			state.transform = te.Transform
 		})
@@ -484,21 +516,32 @@ func getOutputInfo(outputName string) (*outputInfo, bool) {
 
 	for !done {
 		if err := ctx.Dispatch(); err != nil {
-			return nil, false
+			return nil
 		}
 	}
 
+	result := make(map[string]*outputInfo, len(heads))
 	for _, state := range heads {
-		if state.name == outputName {
-			return &outputInfo{
-				x:         state.x,
-				y:         state.y,
-				transform: state.transform,
-			}, true
+		if state.name == "" {
+			continue
+		}
+		result[state.name] = &outputInfo{
+			x:         state.x,
+			y:         state.y,
+			scale:     state.scale,
+			transform: state.transform,
 		}
 	}
+	return result
+}
 
-	return nil, false
+func getOutputInfo(outputName string) (*outputInfo, bool) {
+	infos := getAllOutputInfos()
+	if infos == nil {
+		return nil, false
+	}
+	info, ok := infos[outputName]
+	return info, ok
 }
 
 func getDWLActiveWindow() (*WindowGeometry, error) {

core/internal/screenshot/region.go

@@ -108,7 +108,7 @@ func NewRegionSelector(s *Screenshoter) *RegionSelector {
 		screenshoter:       s,
 		outputs:            make(map[uint32]*WaylandOutput),
 		preCapture:         make(map[*WaylandOutput]*PreCapture),
-		showCapturedCursor: true,
+		showCapturedCursor: s.config.Cursor == CursorOn,
 	}
 }
 

core/internal/screenshot/screenshot.go

@@ -2,6 +2,7 @@ package screenshot
 
 import (
 	"fmt"
+	"math"
 	"sync"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
@@ -298,22 +299,20 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 	if len(outputs) == 0 {
 		return nil, fmt.Errorf("no outputs available")
 	}
-
 	if len(outputs) == 1 {
 		return s.captureWholeOutput(outputs[0])
 	}
 
-	// Capture all outputs first to get actual buffer sizes
-	type capturedOutput struct {
-		output *WaylandOutput
-		result *CaptureResult
-		physX  int
-		physY  int
-	}
-	captured := make([]capturedOutput, 0, len(outputs))
+	wlrInfos := getAllOutputInfos()
 
-	var minX, minY, maxX, maxY int
-	first := true
+	type pendingOutput struct {
+		result *CaptureResult
+		logX   float64
+		logY   float64
+		scale  float64
+	}
+	var pending []pendingOutput
+	maxScale := 1.0
 
 	for _, output := range outputs {
 		result, err := s.captureWholeOutput(output)
@@ -322,50 +321,74 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 			continue
 		}
 
-		outX, outY := output.x, output.y
+		logX, logY := float64(output.x), float64(output.y)
 		scale := float64(output.scale)
+
 		switch DetectCompositor() {
 		case CompositorHyprland:
 			if hx, hy, _, _, ok := GetHyprlandMonitorGeometry(output.name); ok {
-				outX, outY = hx, hy
+				logX, logY = float64(hx), float64(hy)
 			}
-			if s := GetHyprlandMonitorScale(output.name); s > 0 {
-				scale = s
+			if hs := GetHyprlandMonitorScale(output.name); hs > 0 {
+				scale = hs
 			}
-		case CompositorDWL:
-			if info, ok := getOutputInfo(output.name); ok {
-				outX, outY = info.x, info.y
+		default:
+			if wlrInfos != nil {
+				if info, ok := wlrInfos[output.name]; ok {
+					logX, logY = float64(info.x), float64(info.y)
+					if info.scale > 0 {
+						scale = info.scale
+					}
+				}
 			}
 		}
+
 		if scale <= 0 {
 			scale = 1.0
 		}
 
-		physX := int(float64(outX) * scale)
-		physY := int(float64(outY) * scale)
+		pending = append(pending, pendingOutput{result: result, logX: logX, logY: logY, scale: scale})
+		if scale > maxScale {
+			maxScale = scale
+		}
+	}
 
-		captured = append(captured, capturedOutput{
-			output: output,
-			result: result,
-			physX:  physX,
-			physY:  physY,
-		})
+	if len(pending) == 0 {
+		return nil, fmt.Errorf("failed to capture any outputs")
+	}
+	if len(pending) == 1 {
+		return pending[0].result, nil
+	}
 
-		right := physX + result.Buffer.Width
-		bottom := physY + result.Buffer.Height
+	type layoutEntry struct {
+		result  *CaptureResult
+		canvasX int
+		canvasY int
+		canvasW int
+		canvasH int
+	}
+	entries := make([]layoutEntry, len(pending))
+	var minX, minY, maxX, maxY int
 
-		if first {
-			minX, minY = physX, physY
-			maxX, maxY = right, bottom
-			first = false
+	for i, p := range pending {
+		cx := int(math.Round(p.logX * maxScale))
+		cy := int(math.Round(p.logY * maxScale))
+		cw := int(math.Round(float64(p.result.Buffer.Width) * maxScale / p.scale))
+		ch := int(math.Round(float64(p.result.Buffer.Height) * maxScale / p.scale))
+
+		entries[i] = layoutEntry{result: p.result, canvasX: cx, canvasY: cy, canvasW: cw, canvasH: ch}
+
+		right := cx + cw
+		bottom := cy + ch
+		if i == 0 {
+			minX, minY, maxX, maxY = cx, cy, right, bottom
 			continue
 		}
-
-		if physX < minX {
-			minX = physX
+		if cx < minX {
+			minX = cx
 		}
-		if physY < minY {
-			minY = physY
+		if cy < minY {
+			minY = cy
 		}
 		if right > maxX {
 			maxX = right
@@ -375,35 +398,26 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 		}
 	}
 
-	if len(captured) == 0 {
-		return nil, fmt.Errorf("failed to capture any outputs")
-	}
-
-	if len(captured) == 1 {
-		return captured[0].result, nil
-	}
-
 	totalW := maxX - minX
 	totalH := maxY - minY
-
-	compositeStride := totalW * 4
-	composite, err := CreateShmBuffer(totalW, totalH, compositeStride)
+	composite, err := CreateShmBuffer(totalW, totalH, totalW*4)
 	if err != nil {
-		for _, c := range captured {
-			c.result.Buffer.Close()
+		for _, e := range entries {
+			e.result.Buffer.Close()
 		}
 		return nil, fmt.Errorf("create composite buffer: %w", err)
 	}
-
 	composite.Clear()
 
 	var format uint32
-	for _, c := range captured {
+	for _, e := range entries {
 		if format == 0 {
-			format = c.result.Format
+			format = e.result.Format
 		}
-		s.blitBuffer(composite, c.result.Buffer, c.physX-minX, c.physY-minY, c.result.YInverted)
-		c.result.Buffer.Close()
+		s.blitBufferScaled(composite, e.result.Buffer,
+			e.canvasX-minX, e.canvasY-minY, e.canvasW, e.canvasH,
+			e.result.YInverted)
+		e.result.Buffer.Close()
 	}
 
 	return &CaptureResult{
@@ -413,32 +427,44 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 	}, nil
 }
 
-func (s *Screenshoter) blitBuffer(dst, src *ShmBuffer, dstX, dstY int, yInverted bool) {
+func (s *Screenshoter) blitBufferScaled(dst, src *ShmBuffer, dstX, dstY, dstW, dstH int, yInverted bool) {
+	if dstW <= 0 || dstH <= 0 {
+		return
+	}
+
 	srcData := src.Data()
 	dstData := dst.Data()
 
-	for srcY := 0; srcY < src.Height; srcY++ {
-		actualSrcY := srcY
-		if yInverted {
-			actualSrcY = src.Height - 1 - srcY
-		}
-
-		dy := dstY + srcY
-		if dy < 0 || dy >= dst.Height {
+	for dy := 0; dy < dstH; dy++ {
+		canvasY := dstY + dy
+		if canvasY < 0 || canvasY >= dst.Height {
 			continue
 		}
 
-		srcRowOff := actualSrcY * src.Stride
-		dstRowOff := dy * dst.Stride
+		srcY := dy * src.Height / dstH
+		if yInverted {
+			srcY = src.Height - 1 - srcY
+		}
+		if srcY < 0 || srcY >= src.Height {
+			continue
+		}
 
-		for srcX := 0; srcX < src.Width; srcX++ {
-			dx := dstX + srcX
-			if dx < 0 || dx >= dst.Width {
+		srcRowOff := srcY * src.Stride
+		dstRowOff := canvasY * dst.Stride
+
+		for dx := 0; dx < dstW; dx++ {
+			canvasX := dstX + dx
+			if canvasX < 0 || canvasX >= dst.Width {
+				continue
+			}
+
+			srcX := dx * src.Width / dstW
+			if srcX >= src.Width {
 				continue
 			}
 
 			si := srcRowOff + srcX*4
-			di := dstRowOff + dx*4
+			di := dstRowOff + canvasX*4
 
 			if si+3 >= len(srcData) || di+3 >= len(dstData) {
 				continue
@@ -453,10 +479,7 @@ func (s *Screenshoter) blitBuffer(dst, src *ShmBuffer, dstX, dstY int, yInverted
 }
 
 func (s *Screenshoter) captureWholeOutput(output *WaylandOutput) (*CaptureResult, error) {
-	cursor := int32(0)
-	if s.config.IncludeCursor {
-		cursor = 1
-	}
+	cursor := int32(s.config.Cursor)
 
 	frame, err := s.screencopy.CaptureOutput(cursor, output.wlOutput)
 	if err != nil {
@@ -624,10 +647,7 @@ func (s *Screenshoter) captureRegionOnOutput(output *WaylandOutput, region Regio
 		}
 	}
 
-	cursor := int32(0)
-	if s.config.IncludeCursor {
-		cursor = 1
-	}
+	cursor := int32(s.config.Cursor)
 
 	frame, err := s.screencopy.CaptureOutputRegion(cursor, output.wlOutput, localX, localY, w, h)
 	if err != nil {

core/internal/screenshot/types.go

@@ -19,6 +19,13 @@ const (
 	FormatPPM
 )
 
+type CursorMode int
+
+const (
+	CursorOff CursorMode = iota
+	CursorOn
+)
+
 type Region struct {
 	X      int32  `json:"x"`
 	Y      int32  `json:"y"`
@@ -42,29 +49,29 @@ type Output struct {
 }
 
 type Config struct {
-	Mode          Mode
-	OutputName    string
-	IncludeCursor bool
-	Format        Format
-	Quality       int
-	OutputDir     string
-	Filename      string
-	Clipboard     bool
-	SaveFile      bool
-	Notify        bool
-	Stdout        bool
+	Mode       Mode
+	OutputName string
+	Cursor     CursorMode
+	Format     Format
+	Quality    int
+	OutputDir  string
+	Filename   string
+	Clipboard  bool
+	SaveFile   bool
+	Notify     bool
+	Stdout     bool
 }
 
 func DefaultConfig() Config {
 	return Config{
-		Mode:          ModeRegion,
-		IncludeCursor: false,
-		Format:        FormatPNG,
-		Quality:       90,
-		OutputDir:     "",
-		Filename:      "",
-		Clipboard:     true,
-		SaveFile:      true,
-		Notify:        true,
+		Mode:      ModeRegion,
+		Cursor:    CursorOff,
+		Format:    FormatPNG,
+		Quality:   90,
+		OutputDir: "",
+		Filename:  "",
+		Clipboard: true,
+		SaveFile:  true,
+		Notify:    true,
 	}
 }

core/internal/server/bluez/manager.go

@@ -311,6 +311,10 @@ func (m *Manager) handleDevicePropertiesChanged(path dbus.ObjectPath, changed ma
 				select {
 				case m.eventQueue <- func() {
 					time.Sleep(300 * time.Millisecond)
+					log.Infof("[Bluetooth] Auto-trusting newly paired device: %s", devicePath)
+					if err := m.TrustDevice(devicePath, true); err != nil {
+						log.Warnf("[Bluetooth] Auto-trust failed: %v", err)
+					}
 					log.Infof("[Bluetooth] Auto-connecting newly paired device: %s", devicePath)
 					if err := m.ConnectDevice(devicePath); err != nil {
 						log.Warnf("[Bluetooth] Auto-connect failed: %v", err)

core/internal/server/brightness/ddc.go

@@ -215,31 +215,34 @@ func (b *DDCBackend) SetBrightnessWithExponent(id string, value int, exponential
 		callback: callback,
 	}
 
-	if timer, exists := b.debounceTimers[id]; exists {
-		timer.Reset(200 * time.Millisecond)
-	} else {
-		b.debounceTimers[id] = time.AfterFunc(200*time.Millisecond, func() {
-			b.debounceMutex.Lock()
-			pending, exists := b.debouncePending[id]
-			if exists {
-				delete(b.debouncePending, id)
-			}
-			b.debounceMutex.Unlock()
-
-			if !exists {
-				return
-			}
-
-			err := b.setBrightnessImmediateWithExponent(id, pending.percent)
-			if err != nil {
-				log.Debugf("Failed to set brightness for %s: %v", id, err)
-			}
-
-			if pending.callback != nil {
-				pending.callback()
-			}
-		})
+	if existing, exists := b.debounceTimers[id]; exists {
+		if existing.Stop() {
+			b.debounceWg.Done()
+		}
 	}
+
+	b.debounceWg.Add(1)
+	b.debounceTimers[id] = time.AfterFunc(200*time.Millisecond, func() {
+		defer b.debounceWg.Done()
+
+		b.debounceMutex.Lock()
+		pending, hasPending := b.debouncePending[id]
+		delete(b.debouncePending, id)
+		delete(b.debounceTimers, id)
+		b.debounceMutex.Unlock()
+
+		if !hasPending {
+			return
+		}
+
+		if err := b.setBrightnessImmediateWithExponent(id, pending.percent); err != nil {
+			log.Debugf("Failed to set brightness for %s: %v", id, err)
+		}
+
+		if pending.callback != nil {
+			pending.callback()
+		}
+	})
 	b.debounceMutex.Unlock()
 
 	return nil
@@ -490,5 +493,19 @@ func (b *DDCBackend) valueToPercent(value int, max int, exponential bool) int {
 	return percent
 }
 
+func (b *DDCBackend) WaitPending() {
+	done := make(chan struct{})
+	go func() {
+		b.debounceWg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		log.Debug("WaitPending timed out waiting for DDC writes")
+	}
+}
+
 func (b *DDCBackend) Close() {
 }

core/internal/server/brightness/types.go

@@ -84,6 +84,7 @@ type DDCBackend struct {
 	debounceMutex   sync.Mutex
 	debounceTimers  map[string]*time.Timer
 	debouncePending map[string]ddcPendingSet
+	debounceWg      sync.WaitGroup
 }
 
 type ddcPendingSet struct {

core/internal/server/clipboard/manager.go

@@ -212,9 +212,10 @@ func (m *Manager) setupDataDeviceSync() {
 		}
 
 		var offer any
-		if e.Id != nil {
+		switch {
+		case e.Id != nil:
 			offer = e.Id
-		} else if e.OfferId != 0 {
+		case e.OfferId != 0:
 			m.offerMutex.RLock()
 			offer = m.offerRegistry[e.OfferId]
 			m.offerMutex.RUnlock()
@@ -224,16 +225,21 @@ func (m *Manager) setupDataDeviceSync() {
 		wasOwner := m.isOwner
 		m.ownerLock.Unlock()
 
-		if offer == nil {
-			return
-		}
-
 		if wasOwner {
 			return
 		}
 
+		prevOffer := m.currentOffer
 		m.currentOffer = offer
 
+		if prevOffer != nil && prevOffer != offer {
+			m.releaseOffer(prevOffer)
+		}
+
+		if offer == nil {
+			return
+		}
+
 		m.offerMutex.RLock()
 		mimes := m.offerMimeTypes[offer]
 		m.offerMutex.RUnlock()
@@ -285,6 +291,33 @@ func (m *Manager) setupDataDeviceSync() {
 	log.Info("Data device setup complete")
 }
 
+func (m *Manager) releaseOffer(offer any) {
+	if offer == nil {
+		return
+	}
+	typedOffer, ok := offer.(*ext_data_control.ExtDataControlOfferV1)
+	if !ok {
+		return
+	}
+	m.offerMutex.Lock()
+	delete(m.offerMimeTypes, offer)
+	delete(m.offerRegistry, typedOffer.ID())
+	m.offerMutex.Unlock()
+	typedOffer.Destroy()
+}
+
+func (m *Manager) releaseCurrentSource() {
+	if m.currentSource == nil {
+		return
+	}
+	source, ok := m.currentSource.(*ext_data_control.ExtDataControlSourceV1)
+	m.currentSource = nil
+	if !ok {
+		return
+	}
+	source.Destroy()
+}
+
 func (m *Manager) readAndStore(r *os.File, mimeType string) {
 	defer r.Close()
 
@@ -388,7 +421,7 @@ func (m *Manager) deduplicateInTx(b *bolt.Bucket, hash uint64) error {
 		if extractHash(v) != hash {
 			continue
 		}
-		entry, err := decodeEntry(v)
+		entry, err := decodeEntryMeta(v)
 		if err == nil && entry.Pinned {
 			continue
 		}
@@ -406,7 +439,7 @@ func (m *Manager) trimLengthInTx(b *bolt.Bucket) error {
 	c := b.Cursor()
 	var count int
 	for k, v := c.Last(); k != nil; k, v = c.Prev() {
-		entry, err := decodeEntry(v)
+		entry, err := decodeEntryMeta(v)
 		if err == nil && entry.Pinned {
 			continue
 		}
@@ -449,6 +482,14 @@ func encodeEntry(e Entry) ([]byte, error) {
 }
 
 func decodeEntry(data []byte) (Entry, error) {
+	return decodeEntryFields(data, true)
+}
+
+func decodeEntryMeta(data []byte) (Entry, error) {
+	return decodeEntryFields(data, false)
+}
+
+func decodeEntryFields(data []byte, withData bool) (Entry, error) {
 	buf := bytes.NewReader(data)
 	var e Entry
 
@@ -456,8 +497,15 @@ func decodeEntry(data []byte) (Entry, error) {
 
 	var dataLen uint32
 	binary.Read(buf, binary.BigEndian, &dataLen)
-	e.Data = make([]byte, dataLen)
-	buf.Read(e.Data)
+	switch {
+	case withData:
+		e.Data = make([]byte, dataLen)
+		buf.Read(e.Data)
+	default:
+		if _, err := buf.Seek(int64(dataLen), io.SeekCurrent); err != nil {
+			return e, err
+		}
+	}
 
 	var mimeLen uint32
 	binary.Read(buf, binary.BigEndian, &mimeLen)
@@ -587,20 +635,26 @@ func (m *Manager) uriListPreview(data []byte) (string, bool) {
 		uris = strings.Split(text, "\n")
 	}
 
+	if len(uris) > 1 {
+		return fmt.Sprintf("[[ %d files ]]", len(uris)), false
+	}
+
 	if len(uris) == 1 && strings.HasPrefix(uris[0], "file://") {
 		filePath := strings.TrimPrefix(uris[0], "file://")
-		if info, err := os.Stat(filePath); err == nil && !info.IsDir() {
+		info, err := os.Stat(filePath)
+		if err != nil || info.IsDir() {
+			return m.textPreview(data), false
+		}
+
+		cfg := m.getConfig()
+		if info.Size() <= cfg.MaxEntrySize {
 			if imgData, err := os.ReadFile(filePath); err == nil {
 				if config, imgFmt, err := image.DecodeConfig(bytes.NewReader(imgData)); err == nil {
 					return fmt.Sprintf("[[ file %s %s %dx%d ]]", filepath.Base(filePath), imgFmt, config.Width, config.Height), true
 				}
 			}
-			return fmt.Sprintf("[[ file %s ]]", filepath.Base(filePath)), false
 		}
-	}
-
-	if len(uris) > 1 {
-		return fmt.Sprintf("[[ %d files ]]", len(uris)), false
+		return fmt.Sprintf("[[ file %s ]]", filepath.Base(filePath)), false
 	}
 
 	return m.textPreview(data), false
@@ -623,6 +677,11 @@ func (m *Manager) tryReadImageFromURI(data []byte) ([]byte, string, bool) {
 		return nil, "", false
 	}
 
+	cfg := m.getConfig()
+	if info.Size() > cfg.MaxEntrySize {
+		return nil, "", false
+	}
+
 	imgData, err := os.ReadFile(filePath)
 	if err != nil {
 		return nil, "", false
@@ -650,14 +709,9 @@ func sizeStr(size int) string {
 func (m *Manager) updateState() {
 	history := m.GetHistory()
 
-	for i := range history {
-		history[i].Data = nil
-	}
-
 	var current *Entry
 	if len(history) > 0 {
 		c := history[0]
-		c.Data = nil
 		current = &c
 	}
 
@@ -732,7 +786,7 @@ func (m *Manager) GetHistory() []Entry {
 		c := b.Cursor()
 
 		for k, v := c.Last(); k != nil; k, v = c.Prev() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil {
 				continue
 			}
@@ -917,7 +971,7 @@ func (m *Manager) ClearHistory() {
 		var toDelete [][]byte
 		c := b.Cursor()
 		for k, v := c.First(); k != nil; k, v = c.Next() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil || !entry.Pinned {
 				toDelete = append(toDelete, k)
 			}
@@ -940,7 +994,7 @@ func (m *Manager) ClearHistory() {
 		if b != nil {
 			c := b.Cursor()
 			for k, v := c.First(); k != nil; k, v = c.Next() {
-				entry, _ := decodeEntry(v)
+				entry, _ := decodeEntryMeta(v)
 				if entry.Pinned {
 					pinnedCount++
 				}
@@ -1048,6 +1102,7 @@ func (m *Manager) SetClipboard(data []byte, mimeType string) error {
 			m.ownerLock.Unlock()
 		})
 
+		m.releaseCurrentSource()
 		m.currentSource = source
 		m.sourceMutex.Lock()
 		m.sourceMimeTypes = []string{mimeType}
@@ -1127,9 +1182,11 @@ func (m *Manager) Close() {
 	m.subscribers = make(map[string]chan State)
 	m.subMutex.Unlock()
 
-	if m.currentSource != nil {
-		source := m.currentSource.(*ext_data_control.ExtDataControlSourceV1)
-		source.Destroy()
+	m.releaseCurrentSource()
+
+	if m.currentOffer != nil {
+		m.releaseOffer(m.currentOffer)
+		m.currentOffer = nil
 	}
 
 	if m.dataDevice != nil {
@@ -1173,11 +1230,10 @@ func (m *Manager) clearOldEntries(days int) error {
 		var toDelete [][]byte
 		c := b.Cursor()
 		for k, v := c.First(); k != nil; k, v = c.Next() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil {
 				continue
 			}
-			// Skip pinned entries
 			if entry.Pinned {
 				continue
 			}
@@ -1292,7 +1348,7 @@ func (m *Manager) Search(params SearchParams) SearchResult {
 
 		c := b.Cursor()
 		for k, v := c.Last(); k != nil; k, v = c.Prev() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil {
 				continue
 			}
@@ -1317,7 +1373,6 @@ func (m *Manager) Search(params SearchParams) SearchResult {
 				continue
 			}
 
-			entry.Data = nil
 			all = append(all, entry)
 		}
 		return nil
@@ -1492,7 +1547,7 @@ func (m *Manager) PinEntry(id uint64) error {
 		}
 		c := b.Cursor()
 		for k, v := c.First(); k != nil; k, v = c.Next() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil || !entry.Pinned {
 				continue
 			}
@@ -1510,7 +1565,6 @@ func (m *Manager) PinEntry(id uint64) error {
 		return nil
 	}
 
-	// Check pinned count
 	cfg := m.getConfig()
 	pinnedCount := 0
 	if err := m.db.View(func(tx *bolt.Tx) error {
@@ -1520,7 +1574,7 @@ func (m *Manager) PinEntry(id uint64) error {
 		}
 		c := b.Cursor()
 		for k, v := c.First(); k != nil; k, v = c.Next() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err == nil && entry.Pinned {
 				pinnedCount++
 			}
@@ -1611,12 +1665,11 @@ func (m *Manager) GetPinnedEntries() []Entry {
 
 		c := b.Cursor()
 		for k, v := c.Last(); k != nil; k, v = c.Prev() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil {
 				continue
 			}
 			if entry.Pinned {
-				entry.Data = nil
 				pinned = append(pinned, entry)
 			}
 		}
@@ -1642,7 +1695,7 @@ func (m *Manager) GetPinnedCount() int {
 
 		c := b.Cursor()
 		for k, v := c.First(); k != nil; k, v = c.Next() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err == nil && entry.Pinned {
 				count++
 			}
@@ -1761,6 +1814,7 @@ func (m *Manager) CopyFile(filePath string) error {
 			m.ownerLock.Unlock()
 		})
 
+		m.releaseCurrentSource()
 		m.currentSource = source
 
 		m.ownerLock.Lock()

core/internal/server/freedesktop/constants.go

@@ -16,4 +16,8 @@ const (
 	dbusScreensaverPath      = "/ScreenSaver"
 	dbusScreensaverPath2     = "/org/freedesktop/ScreenSaver"
 	dbusScreensaverInterface = "org.freedesktop.ScreenSaver"
+
+	dbusGnomeScreensaverName      = "org.gnome.ScreenSaver"
+	dbusGnomeScreensaverPath      = "/org/gnome/ScreenSaver"
+	dbusGnomeScreensaverInterface = "org.gnome.ScreenSaver"
 )

core/internal/server/freedesktop/manager.go

@@ -191,6 +191,12 @@ func (m *Manager) Close() {
 		return true
 	})
 
+	m.screensaverSubscribers.Range(func(key string, ch chan ScreensaverState) bool {
+		close(ch)
+		m.screensaverSubscribers.Delete(key)
+		return true
+	})
+
 	if m.systemConn != nil {
 		m.systemConn.Close()
 	}

core/internal/server/freedesktop/screensaver.go

@@ -1,6 +1,7 @@
 package freedesktop
 
 import (
+	"fmt"
 	"path/filepath"
 	"strings"
 	"sync/atomic"
@@ -15,6 +16,51 @@ type screensaverHandler struct {
 	manager *Manager
 }
 
+func screensaverIntrospectIface(ifaceName string) introspect.Interface {
+	return introspect.Interface{
+		Name: ifaceName,
+		Methods: []introspect.Method{
+			{
+				Name: "Inhibit",
+				Args: []introspect.Arg{
+					{Name: "application_name", Type: "s", Direction: "in"},
+					{Name: "reason_for_inhibit", Type: "s", Direction: "in"},
+					{Name: "cookie", Type: "u", Direction: "out"},
+				},
+			},
+			{
+				Name: "UnInhibit",
+				Args: []introspect.Arg{
+					{Name: "cookie", Type: "u", Direction: "in"},
+				},
+			},
+			{
+				Name: "GetActive",
+				Args: []introspect.Arg{
+					{Name: "active", Type: "b", Direction: "out"},
+				},
+			},
+			{
+				Name: "SetActive",
+				Args: []introspect.Arg{
+					{Name: "active", Type: "b", Direction: "in"},
+				},
+			},
+			{
+				Name: "Lock",
+			},
+		},
+		Signals: []introspect.Signal{
+			{
+				Name: "ActiveChanged",
+				Args: []introspect.Arg{
+					{Name: "new_value", Type: "b"},
+				},
+			},
+		},
+	}
+}
+
 func (m *Manager) initializeScreensaver() error {
 	if m.sessionConn == nil {
 		m.stateMutex.Lock()
@@ -23,66 +69,71 @@ func (m *Manager) initializeScreensaver() error {
 		return nil
 	}
 
-	reply, err := m.sessionConn.RequestName(dbusScreensaverName, dbus.NameFlagDoNotQueue)
-	if err != nil {
-		log.Warnf("Failed to request screensaver name: %v", err)
-		m.stateMutex.Lock()
-		m.state.Screensaver.Available = false
-		m.stateMutex.Unlock()
-		return nil
-	}
-
-	if reply != dbus.RequestNameReplyPrimaryOwner {
-		log.Warnf("Screensaver name already owned by another process")
-		m.stateMutex.Lock()
-		m.state.Screensaver.Available = false
-		m.stateMutex.Unlock()
-		return nil
-	}
-
 	handler := &screensaverHandler{manager: m}
 
-	if err := m.sessionConn.Export(handler, dbusScreensaverPath, dbusScreensaverInterface); err != nil {
-		log.Warnf("Failed to export screensaver on %s: %v", dbusScreensaverPath, err)
+	m.screensaverFreedesktopClaimed = m.claimScreensaverName(handler,
+		dbusScreensaverName, dbusScreensaverInterface, dbusScreensaverPath, dbusScreensaverPath2)
+	m.screensaverGnomeClaimed = m.claimScreensaverName(handler,
+		dbusGnomeScreensaverName, dbusGnomeScreensaverInterface, dbusGnomeScreensaverPath)
+
+	if !m.screensaverFreedesktopClaimed && !m.screensaverGnomeClaimed {
+		log.Warn("No screensaver interface could be claimed")
+		m.stateMutex.Lock()
+		m.state.Screensaver.Available = false
+		m.stateMutex.Unlock()
 		return nil
 	}
 
-	if err := m.sessionConn.Export(handler, dbusScreensaverPath2, dbusScreensaverInterface); err != nil {
-		log.Warnf("Failed to export screensaver on %s: %v", dbusScreensaverPath2, err)
-		return nil
-	}
-
-	introNode := &introspect.Node{
-		Name: dbusScreensaverPath,
-		Interfaces: []introspect.Interface{
-			introspect.IntrospectData,
-			{Name: dbusScreensaverInterface},
-		},
-	}
-	if err := m.sessionConn.Export(introspect.NewIntrospectable(introNode), dbusScreensaverPath, "org.freedesktop.DBus.Introspectable"); err != nil {
-		log.Warnf("Failed to export introspectable on %s: %v", dbusScreensaverPath, err)
-	}
-
-	introNode2 := &introspect.Node{
-		Name: dbusScreensaverPath2,
-		Interfaces: []introspect.Interface{
-			introspect.IntrospectData,
-			{Name: dbusScreensaverInterface},
-		},
-	}
-	if err := m.sessionConn.Export(introspect.NewIntrospectable(introNode2), dbusScreensaverPath2, "org.freedesktop.DBus.Introspectable"); err != nil {
-		log.Warnf("Failed to export introspectable on %s: %v", dbusScreensaverPath2, err)
-	}
-
 	go m.watchPeerDisconnects()
 
 	m.stateMutex.Lock()
 	m.state.Screensaver.Available = true
+	m.state.Screensaver.Active = false
 	m.state.Screensaver.Inhibited = false
 	m.state.Screensaver.Inhibitors = []ScreensaverInhibitor{}
 	m.stateMutex.Unlock()
 
-	log.Info("Screensaver inhibit listener initialized")
+	log.Info("Screensaver listener initialized")
+	return nil
+}
+
+func (m *Manager) claimScreensaverName(handler *screensaverHandler, name, iface string, paths ...dbus.ObjectPath) bool {
+	reply, err := m.sessionConn.RequestName(name, dbus.NameFlagDoNotQueue)
+	if err != nil {
+		log.Warnf("Failed to request screensaver name %s: %v", name, err)
+		return false
+	}
+	if reply != dbus.RequestNameReplyPrimaryOwner {
+		log.Warnf("Screensaver name %s already owned by another process", name)
+		return false
+	}
+	if err := m.exportScreensaverOnPaths(handler, iface, paths...); err != nil {
+		log.Warnf("Failed to export screensaver on %s: %v", name, err)
+		return false
+	}
+	log.Infof("Claimed %s on session bus", name)
+	return true
+}
+
+// exportScreensaverOnPaths exports the handler and introspection on the given
+// paths under the specified interface name.
+func (m *Manager) exportScreensaverOnPaths(handler *screensaverHandler, ifaceName string, paths ...dbus.ObjectPath) error {
+	iface := screensaverIntrospectIface(ifaceName)
+	for _, path := range paths {
+		if err := m.sessionConn.Export(handler, path, ifaceName); err != nil {
+			return fmt.Errorf("export handler on %s: %w", path, err)
+		}
+		node := &introspect.Node{
+			Name: string(path),
+			Interfaces: []introspect.Interface{
+				introspect.IntrospectData,
+				iface,
+			},
+		}
+		if err := m.sessionConn.Export(introspect.NewIntrospectable(node), path, "org.freedesktop.DBus.Introspectable"); err != nil {
+			log.Warnf("Failed to export introspectable on %s: %v", path, err)
+		}
+	}
 	return nil
 }
 
@@ -248,3 +299,51 @@ func (m *Manager) NotifyScreensaverSubscribers() {
 		return true
 	})
 }
+
+func (h *screensaverHandler) GetActive() (bool, *dbus.Error) {
+	h.manager.stateMutex.RLock()
+	active := h.manager.state.Screensaver.Active
+	h.manager.stateMutex.RUnlock()
+	return active, nil
+}
+
+func (h *screensaverHandler) SetActive(active bool) *dbus.Error {
+	h.manager.SetScreenLockActive(active)
+	return nil
+}
+
+func (h *screensaverHandler) Lock() *dbus.Error {
+	h.manager.SetScreenLockActive(true)
+	return nil
+}
+
+func (m *Manager) SetScreenLockActive(active bool) {
+	m.stateMutex.Lock()
+	changed := m.state.Screensaver.Active != active
+	m.state.Screensaver.Active = active
+	m.stateMutex.Unlock()
+
+	if !changed {
+		return
+	}
+
+	log.Infof("Screen lock active changed: %v", active)
+	defer m.NotifyScreensaverSubscribers()
+
+	if m.sessionConn == nil {
+		return
+	}
+	if m.screensaverFreedesktopClaimed {
+		if err := m.sessionConn.Emit(dbusScreensaverPath, dbusScreensaverInterface+".ActiveChanged", active); err != nil {
+			log.Warnf("Failed to emit ActiveChanged on %s: %v", dbusScreensaverPath, err)
+		}
+		if err := m.sessionConn.Emit(dbusScreensaverPath2, dbusScreensaverInterface+".ActiveChanged", active); err != nil {
+			log.Warnf("Failed to emit ActiveChanged on %s: %v", dbusScreensaverPath2, err)
+		}
+	}
+	if m.screensaverGnomeClaimed {
+		if err := m.sessionConn.Emit(dbusGnomeScreensaverPath, dbusGnomeScreensaverInterface+".ActiveChanged", active); err != nil {
+			log.Warnf("Failed to emit ActiveChanged on %s: %v", dbusGnomeScreensaverPath, err)
+		}
+	}
+}

core/internal/server/freedesktop/screensaver_test.go

@@ -0,0 +1,102 @@
+package freedesktop
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSetScreenLockActive_ChangesState(t *testing.T) {
+	manager := &Manager{
+		state: &FreedeskState{
+			Screensaver: ScreensaverState{Available: true},
+		},
+		stateMutex: sync.RWMutex{},
+	}
+
+	assert.False(t, manager.GetScreensaverState().Active)
+
+	manager.SetScreenLockActive(true)
+	assert.True(t, manager.GetScreensaverState().Active)
+
+	manager.SetScreenLockActive(false)
+	assert.False(t, manager.GetScreensaverState().Active)
+}
+
+func TestSetScreenLockActive_NoChangeNoDuplicate(t *testing.T) {
+	ch := make(chan ScreensaverState, 64)
+	manager := &Manager{
+		state: &FreedeskState{
+			Screensaver: ScreensaverState{Available: true, Active: false},
+		},
+		stateMutex: sync.RWMutex{},
+	}
+	manager.screensaverSubscribers.Store("test", ch)
+	defer manager.screensaverSubscribers.Delete("test")
+
+	// Setting to same value should not notify
+	manager.SetScreenLockActive(false)
+
+	select {
+	case <-ch:
+		t.Fatal("should not have received notification for no-change")
+	case <-time.After(50 * time.Millisecond):
+		// Expected: no notification
+	}
+}
+
+func TestSetScreenLockActive_NotifiesSubscribers(t *testing.T) {
+	ch := make(chan ScreensaverState, 64)
+	manager := &Manager{
+		state: &FreedeskState{
+			Screensaver: ScreensaverState{Available: true, Active: false},
+		},
+		stateMutex: sync.RWMutex{},
+	}
+	manager.screensaverSubscribers.Store("test", ch)
+	defer manager.screensaverSubscribers.Delete("test")
+
+	manager.SetScreenLockActive(true)
+
+	select {
+	case state := <-ch:
+		assert.True(t, state.Active)
+	case <-time.After(time.Second):
+		t.Fatal("timeout waiting for subscriber notification")
+	}
+}
+
+func TestSetScreenLockActive_NilSessionConn(t *testing.T) {
+	manager := &Manager{
+		state: &FreedeskState{
+			Screensaver: ScreensaverState{Available: true},
+		},
+		stateMutex: sync.RWMutex{},
+	}
+
+	assert.NotPanics(t, func() {
+		manager.SetScreenLockActive(true)
+	})
+	assert.True(t, manager.GetScreensaverState().Active)
+}
+
+func TestGetActive_ReturnsCurrentState(t *testing.T) {
+	manager := &Manager{
+		state: &FreedeskState{
+			Screensaver: ScreensaverState{Available: true, Active: true},
+		},
+		stateMutex: sync.RWMutex{},
+	}
+
+	handler := &screensaverHandler{manager: manager}
+	active, dbusErr := handler.GetActive()
+	assert.Nil(t, dbusErr)
+	assert.True(t, active)
+}
+
+func TestScreensaverState_ActiveDefaultsFalse(t *testing.T) {
+	state := ScreensaverState{}
+	assert.False(t, state.Active)
+}

core/internal/server/freedesktop/types.go

@@ -39,6 +39,7 @@ type ScreensaverInhibitor struct {
 
 type ScreensaverState struct {
 	Available  bool                   `json:"available"`
+	Active     bool                   `json:"active"`
 	Inhibited  bool                   `json:"inhibited"`
 	Inhibitors []ScreensaverInhibitor `json:"inhibitors"`
 }
@@ -50,14 +51,16 @@ type FreedeskState struct {
 }
 
 type Manager struct {
-	state                    *FreedeskState
-	stateMutex               sync.RWMutex
-	systemConn               *dbus.Conn
-	sessionConn              *dbus.Conn
-	accountsObj              dbus.BusObject
-	settingsObj              dbus.BusObject
-	currentUID               uint64
-	subscribers              syncmap.Map[string, chan FreedeskState]
-	screensaverSubscribers   syncmap.Map[string, chan ScreensaverState]
-	screensaverCookieCounter uint32
+	state                         *FreedeskState
+	stateMutex                    sync.RWMutex
+	systemConn                    *dbus.Conn
+	sessionConn                   *dbus.Conn
+	accountsObj                   dbus.BusObject
+	settingsObj                   dbus.BusObject
+	currentUID                    uint64
+	subscribers                   syncmap.Map[string, chan FreedeskState]
+	screensaverSubscribers        syncmap.Map[string, chan ScreensaverState]
+	screensaverCookieCounter      uint32
+	screensaverFreedesktopClaimed bool
+	screensaverGnomeClaimed       bool
 }

core/internal/server/loginctl/constants.go

@@ -5,5 +5,6 @@ const (
 	dbusPath             = "/org/freedesktop/login1"
 	dbusManagerInterface = "org.freedesktop.login1.Manager"
 	dbusSessionInterface = "org.freedesktop.login1.Session"
+	dbusUserInterface    = "org.freedesktop.login1.User"
 	dbusPropsInterface   = "org.freedesktop.DBus.Properties"
 )

core/internal/server/loginctl/manager.go

@@ -17,15 +17,8 @@ func NewManager() (*Manager, error) {
 		return nil, fmt.Errorf("failed to connect to system bus: %w", err)
 	}
 
-	sessionID := os.Getenv("XDG_SESSION_ID")
-	if sessionID == "" {
-		sessionID = "self"
-	}
-
 	m := &Manager{
-		state: &SessionState{
-			SessionID: sessionID,
-		},
+		state:      &SessionState{},
 		stateMutex: sync.RWMutex{},
 
 		stopChan: make(chan struct{}),
@@ -60,12 +53,13 @@ func (m *Manager) initialize() error {
 
 	m.initializeFallbackDelay()
 
-	sessionPath, err := m.getSession(m.state.SessionID)
+	sessionID, sessionPath, err := m.discoverSession()
 	if err != nil {
 		return fmt.Errorf("failed to get session path: %w", err)
 	}
 
 	m.stateMutex.Lock()
+	m.state.SessionID = sessionID
 	m.state.SessionPath = string(sessionPath)
 	m.sessionPath = sessionPath
 	m.stateMutex.Unlock()
@@ -79,6 +73,41 @@ func (m *Manager) initialize() error {
 	return nil
 }
 
+func (m *Manager) discoverSession() (string, dbus.ObjectPath, error) {
+	// 1. Explicit XDG_SESSION_ID
+	if id := os.Getenv("XDG_SESSION_ID"); id != "" {
+		if path, err := m.getSession(id); err == nil {
+			fmt.Fprintf(os.Stderr, "loginctl: using XDG_SESSION_ID=%s\n", id)
+			return id, path, nil
+		}
+	}
+
+	// 2. PID-based lookup (works when caller is inside a session cgroup)
+	if id, path, err := m.getSessionByPID(uint32(os.Getpid())); err == nil {
+		fmt.Fprintf(os.Stderr, "loginctl: found session %s via PID\n", id)
+		return id, path, nil
+	}
+
+	// 3. User's primary display session (handles UWSM and similar)
+	if id, path, err := m.getUserDisplaySession(); err == nil {
+		fmt.Fprintf(os.Stderr, "loginctl: found session %s via User.Display\n", id)
+		return id, path, nil
+	}
+
+	// 4. Score all sessions for current UID
+	if id, path, err := m.findBestSession(); err == nil {
+		fmt.Fprintf(os.Stderr, "loginctl: found session %s via ListSessions scoring\n", id)
+		return id, path, nil
+	}
+
+	// 5. Last resort: "self"
+	path, err := m.getSession("self")
+	if err != nil {
+		return "", "", fmt.Errorf("%w", err)
+	}
+	return "self", path, nil
+}
+
 func (m *Manager) getSession(id string) (dbus.ObjectPath, error) {
 	var out dbus.ObjectPath
 	err := m.managerObj.Call(dbusManagerInterface+".GetSession", 0, id).Store(&out)
@@ -88,6 +117,166 @@ func (m *Manager) getSession(id string) (dbus.ObjectPath, error) {
 	return out, nil
 }
 
+func (m *Manager) getSessionByPID(pid uint32) (string, dbus.ObjectPath, error) {
+	var path dbus.ObjectPath
+	if err := m.managerObj.Call(dbusManagerInterface+".GetSessionByPID", 0, pid).Store(&path); err != nil {
+		return "", "", err
+	}
+
+	sessionObj := m.conn.Object(dbusDest, path)
+	var id dbus.Variant
+	if err := sessionObj.Call(dbusPropsInterface+".Get", 0, dbusSessionInterface, "Id").Store(&id); err != nil {
+		return "", "", err
+	}
+	return id.Value().(string), path, nil
+}
+
+func (m *Manager) getUserDisplaySession() (string, dbus.ObjectPath, error) {
+	uid := uint32(os.Getuid())
+
+	var userPath dbus.ObjectPath
+	if err := m.managerObj.Call(dbusManagerInterface+".GetUser", 0, uid).Store(&userPath); err != nil {
+		return "", "", err
+	}
+
+	userObj := m.conn.Object(dbusDest, userPath)
+	var display dbus.Variant
+	if err := userObj.Call(dbusPropsInterface+".Get", 0, dbusUserInterface, "Display").Store(&display); err != nil {
+		return "", "", err
+	}
+
+	pair, ok := display.Value().([]any)
+	if !ok || len(pair) < 2 {
+		return "", "", fmt.Errorf("unexpected Display format")
+	}
+
+	sessionID, _ := pair[0].(string)
+	sessionPath, _ := pair[1].(dbus.ObjectPath)
+	if sessionID == "" || sessionPath == "" {
+		return "", "", fmt.Errorf("empty Display session")
+	}
+
+	return sessionID, sessionPath, nil
+}
+
+type sessionCandidate struct {
+	id   string
+	path dbus.ObjectPath
+}
+
+func (m *Manager) findBestSession() (string, dbus.ObjectPath, error) {
+	// ListSessions returns a(susso): [][]any where each entry is [id, uid, name, seat, path]
+	var raw [][]any
+	if err := m.managerObj.Call(dbusManagerInterface+".ListSessions", 0).Store(&raw); err != nil {
+		return "", "", err
+	}
+
+	uid := uint32(os.Getuid())
+	var candidates []sessionCandidate
+	for _, entry := range raw {
+		if len(entry) < 5 {
+			continue
+		}
+		entryUID, _ := entry[1].(uint32)
+		if entryUID != uid {
+			continue
+		}
+		id, _ := entry[0].(string)
+		path, _ := entry[4].(dbus.ObjectPath)
+		if id != "" && path != "" {
+			candidates = append(candidates, sessionCandidate{id: id, path: path})
+		}
+	}
+	if len(candidates) == 0 {
+		return "", "", fmt.Errorf("no sessions for uid %d", uid)
+	}
+
+	bestScore := -1
+	var best sessionCandidate
+	for _, c := range candidates {
+		score := m.scoreSession(c.path)
+		if score > bestScore {
+			bestScore = score
+			best = c
+		}
+	}
+	if bestScore < 0 {
+		return "", "", fmt.Errorf("no viable session found")
+	}
+	return best.id, best.path, nil
+}
+
+func (m *Manager) scoreSession(path dbus.ObjectPath) int {
+	obj := m.conn.Object(dbusDest, path)
+	var props map[string]dbus.Variant
+	if err := obj.Call(dbusPropsInterface+".GetAll", 0, dbusSessionInterface).Store(&props); err != nil {
+		return -1
+	}
+
+	getStr := func(key string) string {
+		if v, ok := props[key]; ok {
+			if s, ok := v.Value().(string); ok {
+				return s
+			}
+		}
+		return ""
+	}
+	getBool := func(key string) bool {
+		if v, ok := props[key]; ok {
+			if b, ok := v.Value().(bool); ok {
+				return b
+			}
+		}
+		return false
+	}
+	getUint32 := func(key string) uint32 {
+		if v, ok := props[key]; ok {
+			if u, ok := v.Value().(uint32); ok {
+				return u
+			}
+		}
+		return 0
+	}
+
+	class := getStr("Class")
+	if class != "user" {
+		return -1
+	}
+	if getBool("Remote") {
+		return -1
+	}
+
+	score := 0
+
+	if getBool("Active") {
+		score += 100
+	}
+
+	switch getStr("Type") {
+	case "wayland", "x11":
+		score += 80
+	case "tty":
+		score += 10
+	}
+
+	if v, ok := props["Seat"]; ok {
+		if seatArr, ok := v.Value().([]any); ok && len(seatArr) >= 1 {
+			if seat, ok := seatArr[0].(string); ok && seat != "" {
+				score += 40
+				if seat == "seat0" {
+					score += 10
+				}
+			}
+		}
+	}
+
+	if getUint32("VTNr") > 0 {
+		score += 20
+	}
+
+	return score
+}
+
 func (m *Manager) refreshSessionBinding() error {
 	if m.managerObj == nil || m.conn == nil {
 		return fmt.Errorf("manager not fully initialized")

core/internal/server/network/agent_networkmanager.go

@@ -32,8 +32,10 @@ type SecretAgent struct {
 	backend *NetworkManagerBackend
 }
 
-type nmVariantMap map[string]dbus.Variant
-type nmSettingMap map[string]nmVariantMap
+type (
+	nmVariantMap map[string]dbus.Variant
+	nmSettingMap map[string]nmVariantMap
+)
 
 const introspectXML = `
 <node>
@@ -308,6 +310,63 @@ func (a *SecretAgent) GetSecrets(
 			return out, nil
 		}
 		a.backend.cachedVPNCredsMu.Unlock()
+
+		a.backend.cachedGPSamlMu.Lock()
+		cachedGPSaml := a.backend.cachedGPSamlCookie
+		if cachedGPSaml != nil && cachedGPSaml.ConnectionUUID == connUuid {
+			a.backend.cachedGPSamlMu.Unlock()
+
+			log.Infof("[SecretAgent] Using cached GlobalProtect SAML cookie for %s", connUuid)
+
+			return buildGPSamlSecretsResponse(settingName, cachedGPSaml.Cookie, cachedGPSaml.Host, cachedGPSaml.Fingerprint), nil
+		}
+		a.backend.cachedGPSamlMu.Unlock()
+
+		if len(fields) == 1 && fields[0] == "gp-saml" {
+			gateway := ""
+			protocol := ""
+			if vpnSettings, ok := conn["vpn"]; ok {
+				if dataVariant, ok := vpnSettings["data"]; ok {
+					if dataMap, ok := dataVariant.Value().(map[string]string); ok {
+						if gw, ok := dataMap["gateway"]; ok {
+							gateway = gw
+						}
+						if proto, ok := dataMap["protocol"]; ok && proto != "" {
+							protocol = proto
+						}
+					}
+				}
+			}
+
+			if protocol != "gp" {
+				return nil, dbus.MakeFailedError(fmt.Errorf("gp-saml auth only supported for GlobalProtect (protocol=gp), got: %s", protocol))
+			}
+
+			log.Infof("[SecretAgent] Starting GlobalProtect SAML authentication for gateway=%s", gateway)
+
+			samlCtx, samlCancel := context.WithTimeout(context.Background(), 5*time.Minute)
+			defer samlCancel()
+
+			authResult, err := a.backend.runGlobalProtectSAMLAuth(samlCtx, gateway, protocol)
+			if err != nil {
+				log.Warnf("[SecretAgent] GlobalProtect SAML authentication failed: %v", err)
+				return nil, dbus.MakeFailedError(fmt.Errorf("GlobalProtect SAML authentication failed: %w", err))
+			}
+
+			log.Infof("[SecretAgent] GlobalProtect SAML authentication successful, returning cookie to NetworkManager")
+
+			a.backend.cachedGPSamlMu.Lock()
+			a.backend.cachedGPSamlCookie = &cachedGPSamlCookie{
+				ConnectionUUID: connUuid,
+				Cookie:         authResult.Cookie,
+				Host:           authResult.Host,
+				User:           authResult.User,
+				Fingerprint:    authResult.Fingerprint,
+			}
+			a.backend.cachedGPSamlMu.Unlock()
+
+			return buildGPSamlSecretsResponse(settingName, authResult.Cookie, authResult.Host, authResult.Fingerprint), nil
+		}
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
@@ -659,12 +718,25 @@ func inferVPNFields(conn map[string]nmVariantMap, vpnService string) []string {
 
 	switch {
 	case strings.Contains(vpnService, "openconnect"):
+		protocol := dataMap["protocol"]
 		authType := dataMap["authtype"]
-		userCert := dataMap["usercert"]
-		if authType == "cert" && strings.HasPrefix(userCert, "pkcs11:") {
+		username := dataMap["username"]
+
+		if authType == "cert" && strings.HasPrefix(dataMap["usercert"], "pkcs11:") {
 			return []string{"key_pass"}
 		}
-		if dataMap["username"] == "" {
+
+		if needsExternalBrowserAuth(protocol, authType, username, dataMap) {
+			switch protocol {
+			case "gp":
+				log.Infof("[SecretAgent] GlobalProtect SAML auth detected")
+				return []string{"gp-saml"}
+			default:
+				log.Infof("[SecretAgent] External browser auth detected for protocol '%s' but only GlobalProtect (gp) SAML is currently supported, falling back to credentials", protocol)
+			}
+		}
+
+		if username == "" {
 			fields = []string{"username", "password"}
 		}
 	case strings.Contains(vpnService, "openvpn"):
@@ -683,8 +755,31 @@ func inferVPNFields(conn map[string]nmVariantMap, vpnService string) []string {
 	return fields
 }
 
+func needsExternalBrowserAuth(protocol, authType, username string, data map[string]string) bool {
+	if method, ok := data["saml-auth-method"]; ok {
+		if method == "REDIRECT" || method == "POST" {
+			return true
+		}
+	}
+
+	if authType != "" && authType != "password" && authType != "cert" {
+		return true
+	}
+
+	switch protocol {
+	case "gp":
+		if authType == "" && username == "" {
+			return true
+		}
+	}
+
+	return false
+}
+
 func vpnFieldMeta(field, vpnService string) (label string, isSecret bool) {
 	switch field {
+	case "gp-saml":
+		return "GlobalProtect SAML/SSO", false
 	case "key_pass":
 		return "PIN", true
 	case "password":
@@ -785,3 +880,18 @@ func reasonFromFlags(flags uint32) string {
 	}
 	return "required"
 }
+
+func buildGPSamlSecretsResponse(settingName, cookie, host, fingerprint string) nmSettingMap {
+	out := nmSettingMap{}
+	vpnSec := nmVariantMap{}
+
+	secrets := map[string]string{
+		"cookie":  cookie,
+		"gateway": host,
+		"gwcert":  fingerprint,
+	}
+	vpnSec["secrets"] = dbus.MakeVariant(secrets)
+
+	out[settingName] = vpnSec
+	return out
+}

core/internal/server/network/agent_networkmanager_test.go

@@ -0,0 +1,355 @@
+package network
+
+import (
+	"testing"
+
+	"github.com/godbus/dbus/v5"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNeedsExternalBrowserAuth(t *testing.T) {
+	tests := []struct {
+		name     string
+		protocol string
+		authType string
+		username string
+		data     map[string]string
+		expected bool
+	}{
+		{
+			name:     "GP with saml-auth-method REDIRECT",
+			protocol: "gp",
+			authType: "password",
+			username: "user",
+			data:     map[string]string{"saml-auth-method": "REDIRECT"},
+			expected: true,
+		},
+		{
+			name:     "GP with saml-auth-method POST",
+			protocol: "gp",
+			authType: "password",
+			username: "user",
+			data:     map[string]string{"saml-auth-method": "POST"},
+			expected: true,
+		},
+		{
+			name:     "GP with no authtype and no username",
+			protocol: "gp",
+			authType: "",
+			username: "",
+			data:     map[string]string{},
+			expected: true,
+		},
+		{
+			name:     "GP with username and password authtype",
+			protocol: "gp",
+			authType: "password",
+			username: "john",
+			data:     map[string]string{},
+			expected: false,
+		},
+		{
+			name:     "GP with username but no authtype",
+			protocol: "gp",
+			authType: "",
+			username: "john",
+			data:     map[string]string{},
+			expected: false,
+		},
+		{
+			name:     "GP with authtype but no username - should detect SAML",
+			protocol: "gp",
+			authType: "",
+			username: "",
+			data:     map[string]string{},
+			expected: true,
+		},
+		{
+			name:     "pulse with SAML",
+			protocol: "pulse",
+			authType: "",
+			username: "",
+			data:     map[string]string{"saml-auth-method": "REDIRECT"},
+			expected: true,
+		},
+		{
+			name:     "fortinet with non-password authtype",
+			protocol: "fortinet",
+			authType: "saml",
+			username: "",
+			data:     map[string]string{},
+			expected: true,
+		},
+		{
+			name:     "anyconnect with cert",
+			protocol: "anyconnect",
+			authType: "cert",
+			username: "",
+			data:     map[string]string{},
+			expected: false,
+		},
+		{
+			name:     "anyconnect with password",
+			protocol: "anyconnect",
+			authType: "password",
+			username: "user",
+			data:     map[string]string{},
+			expected: false,
+		},
+		{
+			name:     "empty protocol",
+			protocol: "",
+			authType: "",
+			username: "",
+			data:     map[string]string{},
+			expected: false,
+		},
+		{
+			name:     "GP with cert authtype",
+			protocol: "gp",
+			authType: "cert",
+			username: "",
+			data:     map[string]string{},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := needsExternalBrowserAuth(tt.protocol, tt.authType, tt.username, tt.data)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestBuildGPSamlSecretsResponse(t *testing.T) {
+	tests := []struct {
+		name        string
+		settingName string
+		cookie      string
+		host        string
+		fingerprint string
+	}{
+		{
+			name:        "all fields populated",
+			settingName: "vpn",
+			cookie:      "authcookie=abc123&portal=GATE",
+			host:        "vpn.example.com",
+			fingerprint: "pin-sha256:ABCD1234",
+		},
+		{
+			name:        "empty fingerprint",
+			settingName: "vpn",
+			cookie:      "authcookie=xyz",
+			host:        "10.0.0.1",
+			fingerprint: "",
+		},
+		{
+			name:        "complex cookie with special chars",
+			settingName: "vpn",
+			cookie:      "authcookie=077058d3bc81&portal=PANGP_GW_01-N&user=john.doe@example.com&domain=Default&preferred-ip=192.168.1.100",
+			host:        "connect.seclore.com",
+			fingerprint: "pin-sha256:xp3scfzy3rOgQEXnfPiYKrUk7D66a8b8O+gEXaMPleE=",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := buildGPSamlSecretsResponse(tt.settingName, tt.cookie, tt.host, tt.fingerprint)
+
+			assert.NotNil(t, result)
+			assert.Contains(t, result, tt.settingName)
+
+			vpnSec := result[tt.settingName]
+			assert.NotNil(t, vpnSec)
+
+			secretsVariant, ok := vpnSec["secrets"]
+			assert.True(t, ok, "secrets key should exist")
+
+			secrets, ok := secretsVariant.Value().(map[string]string)
+			assert.True(t, ok, "secrets should be map[string]string")
+
+			assert.Equal(t, tt.cookie, secrets["cookie"])
+			assert.Equal(t, tt.host, secrets["gateway"])
+			assert.Equal(t, tt.fingerprint, secrets["gwcert"])
+		})
+	}
+}
+
+func TestVpnFieldMeta_GPSaml(t *testing.T) {
+	label, isSecret := vpnFieldMeta("gp-saml", "org.freedesktop.NetworkManager.openconnect")
+
+	assert.Equal(t, "GlobalProtect SAML/SSO", label)
+	assert.False(t, isSecret, "gp-saml should not be marked as secret")
+}
+
+func TestVpnFieldMeta_StandardFields(t *testing.T) {
+	tests := []struct {
+		field          string
+		vpnService     string
+		expectedLabel  string
+		expectedSecret bool
+	}{
+		{
+			field:          "username",
+			vpnService:     "org.freedesktop.NetworkManager.openconnect",
+			expectedLabel:  "Username",
+			expectedSecret: false,
+		},
+		{
+			field:          "password",
+			vpnService:     "org.freedesktop.NetworkManager.openconnect",
+			expectedLabel:  "Password",
+			expectedSecret: true,
+		},
+		{
+			field:          "key_pass",
+			vpnService:     "org.freedesktop.NetworkManager.openconnect",
+			expectedLabel:  "PIN",
+			expectedSecret: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.field, func(t *testing.T) {
+			label, isSecret := vpnFieldMeta(tt.field, tt.vpnService)
+			assert.Equal(t, tt.expectedLabel, label)
+			assert.Equal(t, tt.expectedSecret, isSecret)
+		})
+	}
+}
+
+func TestInferVPNFields_GPSaml(t *testing.T) {
+	tests := []struct {
+		name        string
+		vpnService  string
+		dataMap     map[string]string
+		expectedLen int
+		shouldHave  []string
+	}{
+		{
+			name:       "GP with no authtype and no username - should require SAML",
+			vpnService: "org.freedesktop.NetworkManager.openconnect",
+			dataMap: map[string]string{
+				"protocol": "gp",
+				"gateway":  "vpn.example.com",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"gp-saml"},
+		},
+		{
+			name:       "GP with saml-auth-method REDIRECT",
+			vpnService: "org.freedesktop.NetworkManager.openconnect",
+			dataMap: map[string]string{
+				"protocol":         "gp",
+				"gateway":          "vpn.example.com",
+				"saml-auth-method": "REDIRECT",
+				"username":         "john",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"gp-saml"},
+		},
+		{
+			name:       "GP with saml-auth-method POST",
+			vpnService: "org.freedesktop.NetworkManager.openconnect",
+			dataMap: map[string]string{
+				"protocol":         "gp",
+				"gateway":          "vpn.example.com",
+				"saml-auth-method": "POST",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"gp-saml"},
+		},
+		{
+			name:       "GP with username and password authtype - should use credentials",
+			vpnService: "org.freedesktop.NetworkManager.openconnect",
+			dataMap: map[string]string{
+				"protocol": "gp",
+				"gateway":  "vpn.example.com",
+				"authtype": "password",
+				"username": "john",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"password"},
+		},
+		{
+			name:       "GP with username but no authtype - password only",
+			vpnService: "org.freedesktop.NetworkManager.openconnect",
+			dataMap: map[string]string{
+				"protocol": "gp",
+				"gateway":  "vpn.example.com",
+				"username": "john",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"password"},
+		},
+		{
+			name:       "GP with PKCS11 cert",
+			vpnService: "org.freedesktop.NetworkManager.openconnect",
+			dataMap: map[string]string{
+				"protocol": "gp",
+				"gateway":  "vpn.example.com",
+				"authtype": "cert",
+				"usercert": "pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"key_pass"},
+		},
+		{
+			name:       "non-GP protocol (anyconnect)",
+			vpnService: "org.freedesktop.NetworkManager.openconnect",
+			dataMap: map[string]string{
+				"protocol": "anyconnect",
+				"gateway":  "vpn.example.com",
+			},
+			expectedLen: 2,
+			shouldHave:  []string{"username", "password"},
+		},
+		{
+			name:       "OpenVPN with username",
+			vpnService: "org.freedesktop.NetworkManager.openvpn",
+			dataMap: map[string]string{
+				"connection-type": "password",
+				"username":        "john",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"password"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Convert dataMap to nmVariantMap
+			vpnSettings := make(nmVariantMap)
+			vpnSettings["data"] = dbus.MakeVariant(tt.dataMap)
+			vpnSettings["service-type"] = dbus.MakeVariant(tt.vpnService)
+
+			conn := make(map[string]nmVariantMap)
+			conn["vpn"] = vpnSettings
+
+			fields := inferVPNFields(conn, tt.vpnService)
+
+			assert.Len(t, fields, tt.expectedLen, "unexpected number of fields")
+			if len(tt.shouldHave) > 0 {
+				for _, expected := range tt.shouldHave {
+					assert.Contains(t, fields, expected, "should contain field: %s", expected)
+				}
+			}
+		})
+	}
+}
+
+func TestNmVariantMap(t *testing.T) {
+	// Test that nmVariantMap and nmSettingMap work correctly
+	settingMap := make(nmSettingMap)
+	variantMap := make(nmVariantMap)
+
+	variantMap["test-key"] = dbus.MakeVariant("test-value")
+	settingMap["test-setting"] = variantMap
+
+	assert.Contains(t, settingMap, "test-setting")
+	assert.Contains(t, settingMap["test-setting"], "test-key")
+
+	value := settingMap["test-setting"]["test-key"].Value()
+	assert.Equal(t, "test-value", value)
+}

core/internal/server/network/backend_networkmanager.go

@@ -69,12 +69,14 @@ type NetworkManagerBackend struct {
 	lastFailedTime int64
 	failedMutex    sync.RWMutex
 
-	pendingVPNSave   *pendingVPNCredentials
-	pendingVPNSaveMu sync.Mutex
-	cachedVPNCreds   *cachedVPNCredentials
-	cachedVPNCredsMu sync.Mutex
-	cachedPKCS11PIN  *cachedPKCS11PIN
-	cachedPKCS11Mu   sync.Mutex
+	pendingVPNSave     *pendingVPNCredentials
+	pendingVPNSaveMu   sync.Mutex
+	cachedVPNCreds     *cachedVPNCredentials
+	cachedVPNCredsMu   sync.Mutex
+	cachedPKCS11PIN    *cachedPKCS11PIN
+	cachedPKCS11Mu     sync.Mutex
+	cachedGPSamlCookie *cachedGPSamlCookie
+	cachedGPSamlMu     sync.Mutex
 
 	onStateChange func()
 }
@@ -97,6 +99,14 @@ type cachedPKCS11PIN struct {
 	PIN            string
 }
 
+type cachedGPSamlCookie struct {
+	ConnectionUUID string
+	Cookie         string
+	Host           string
+	User           string
+	Fingerprint    string
+}
+
 func NewNetworkManagerBackend(nmConn ...gonetworkmanager.NetworkManager) (*NetworkManagerBackend, error) {
 	var nm gonetworkmanager.NetworkManager
 	var err error

core/internal/server/network/backend_networkmanager_gp_saml.go

@@ -0,0 +1,203 @@
+package network
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"os/exec"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+)
+
+type gpSamlAuthResult struct {
+	Cookie      string
+	Host        string
+	User        string
+	Fingerprint string
+}
+
+// runGlobalProtectSAMLAuth handles GlobalProtect SAML/SSO authentication using gp-saml-gui.
+// Only supports protocol=gp. Other protocols need their own implementations.
+func (b *NetworkManagerBackend) runGlobalProtectSAMLAuth(ctx context.Context, gateway, protocol string) (*gpSamlAuthResult, error) {
+	if gateway == "" {
+		return nil, fmt.Errorf("GP SAML auth: gateway is empty")
+	}
+	if protocol != "gp" {
+		return nil, fmt.Errorf("only GlobalProtect (protocol=gp) SAML is supported, got: %s", protocol)
+	}
+
+	log.Infof("[GP-SAML] Starting GlobalProtect SAML authentication with gp-saml-gui for gateway=%s", gateway)
+
+	gpSamlPath, err := exec.LookPath("gp-saml-gui")
+	if err != nil {
+		return nil, fmt.Errorf("GlobalProtect SAML requires gp-saml-gui (install: pip install gp-saml-gui): %w", err)
+	}
+
+	args := []string{
+		"--gateway",
+		"--allow-insecure-crypto",
+		gateway,
+	}
+
+	cmd := exec.CommandContext(ctx, gpSamlPath, args...)
+
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, fmt.Errorf("GP SAML auth: failed to create stdout pipe: %w", err)
+	}
+
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, fmt.Errorf("GP SAML auth: failed to create stderr pipe: %w", err)
+	}
+
+	if err := cmd.Start(); err != nil {
+		return nil, fmt.Errorf("GP SAML auth: failed to start gp-saml-gui: %w", err)
+	}
+
+	go func() {
+		scanner := bufio.NewScanner(stderr)
+		for scanner.Scan() {
+			log.Debugf("[GP-SAML] gp-saml-gui: %s", scanner.Text())
+		}
+	}()
+
+	result := &gpSamlAuthResult{Host: gateway}
+	var allOutput []string
+
+	scanner := bufio.NewScanner(stdout)
+	for scanner.Scan() {
+		line := scanner.Text()
+		allOutput = append(allOutput, line)
+		log.Infof("[GP-SAML] stdout: %s", line)
+
+		switch {
+		case strings.HasPrefix(line, "COOKIE="):
+			result.Cookie = unshellQuote(strings.TrimPrefix(line, "COOKIE="))
+		case strings.HasPrefix(line, "HOST="):
+			result.Host = unshellQuote(strings.TrimPrefix(line, "HOST="))
+		case strings.HasPrefix(line, "USER="):
+			result.User = unshellQuote(strings.TrimPrefix(line, "USER="))
+		case strings.HasPrefix(line, "FINGERPRINT="):
+			result.Fingerprint = unshellQuote(strings.TrimPrefix(line, "FINGERPRINT="))
+		default:
+			parseGPSamlFromCommandLine(line, result)
+		}
+	}
+
+	if err := cmd.Wait(); err != nil {
+		if ctx.Err() != nil {
+			return nil, fmt.Errorf("GP SAML auth timed out or was cancelled: %w", ctx.Err())
+		}
+		if result.Cookie == "" {
+			return nil, fmt.Errorf("GP SAML auth failed: %w (output: %s)", err, strings.Join(allOutput, "\n"))
+		}
+		log.Warnf("[GP-SAML] gp-saml-gui exited with error but cookie was captured: %v", err)
+	}
+
+	if result.Cookie == "" {
+		return nil, fmt.Errorf("GP SAML auth: no cookie in gp-saml-gui output")
+	}
+
+	log.Infof("[GP-SAML] Got prelogin-cookie from gp-saml-gui, converting to openconnect cookie via --authenticate")
+
+	// Convert prelogin-cookie to full openconnect cookie format
+	ocResult, err := convertGPPreloginCookie(ctx, gateway, result.Cookie, result.User)
+	if err != nil {
+		return nil, fmt.Errorf("GP SAML auth: failed to convert prelogin-cookie: %w", err)
+	}
+
+	result.Cookie = ocResult.Cookie
+	result.Host = ocResult.Host
+	result.Fingerprint = ocResult.Fingerprint
+
+	log.Infof("[GP-SAML] Authentication successful: user=%s, host=%s, cookie_len=%d, has_fingerprint=%v",
+		result.User, result.Host, len(result.Cookie), result.Fingerprint != "")
+	return result, nil
+}
+
+func convertGPPreloginCookie(ctx context.Context, gateway, preloginCookie, user string) (*gpSamlAuthResult, error) {
+	ocPath, err := exec.LookPath("openconnect")
+	if err != nil {
+		return nil, fmt.Errorf("openconnect not found: %w", err)
+	}
+
+	args := []string{
+		"--protocol=gp",
+		"--usergroup=gateway:prelogin-cookie",
+		"--user=" + user,
+		"--passwd-on-stdin",
+		"--allow-insecure-crypto",
+		"--authenticate",
+		gateway,
+	}
+
+	cmd := exec.CommandContext(ctx, ocPath, args...)
+	cmd.Stdin = strings.NewReader(preloginCookie)
+
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return nil, fmt.Errorf("openconnect --authenticate failed: %w\noutput: %s", err, string(output))
+	}
+
+	result := &gpSamlAuthResult{}
+	for _, line := range strings.Split(string(output), "\n") {
+		line = strings.TrimSpace(line)
+		switch {
+		case strings.HasPrefix(line, "COOKIE="):
+			result.Cookie = unshellQuote(strings.TrimPrefix(line, "COOKIE="))
+		case strings.HasPrefix(line, "HOST="):
+			result.Host = unshellQuote(strings.TrimPrefix(line, "HOST="))
+		case strings.HasPrefix(line, "FINGERPRINT="):
+			result.Fingerprint = unshellQuote(strings.TrimPrefix(line, "FINGERPRINT="))
+		case strings.HasPrefix(line, "CONNECT_URL="):
+			connectURL := unshellQuote(strings.TrimPrefix(line, "CONNECT_URL="))
+			if connectURL != "" && result.Host == "" {
+				result.Host = connectURL
+			}
+		}
+	}
+
+	if result.Cookie == "" {
+		return nil, fmt.Errorf("no COOKIE in openconnect --authenticate output: %s", string(output))
+	}
+
+	log.Infof("[GP-SAML] openconnect --authenticate: cookie_len=%d, host=%s, fingerprint=%s",
+		len(result.Cookie), result.Host, result.Fingerprint)
+
+	return result, nil
+}
+
+func unshellQuote(s string) string {
+	if len(s) >= 2 {
+		if (s[0] == '\'' && s[len(s)-1] == '\'') ||
+			(s[0] == '"' && s[len(s)-1] == '"') {
+			return s[1 : len(s)-1]
+		}
+	}
+	return s
+}
+
+func parseGPSamlFromCommandLine(line string, result *gpSamlAuthResult) {
+	if !strings.Contains(line, "openconnect") {
+		return
+	}
+
+	for _, part := range strings.Fields(line) {
+		switch {
+		case strings.HasPrefix(part, "--cookie="):
+			if result.Cookie == "" {
+				result.Cookie = strings.TrimPrefix(part, "--cookie=")
+			}
+		case strings.HasPrefix(part, "--servercert="):
+			if result.Fingerprint == "" {
+				result.Fingerprint = strings.TrimPrefix(part, "--servercert=")
+			}
+		case strings.HasPrefix(part, "--user="):
+			if result.User == "" {
+				result.User = strings.TrimPrefix(part, "--user=")
+			}
+		}
+	}
+}

core/internal/server/network/backend_networkmanager_gp_saml_test.go

@@ -0,0 +1,169 @@
+package network
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUnshellQuote(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "single quoted",
+			input:    "'hello world'",
+			expected: "hello world",
+		},
+		{
+			name:     "double quoted",
+			input:    `"hello world"`,
+			expected: "hello world",
+		},
+		{
+			name:     "unquoted",
+			input:    "hello",
+			expected: "hello",
+		},
+		{
+			name:     "empty single quotes",
+			input:    "''",
+			expected: "",
+		},
+		{
+			name:     "empty double quotes",
+			input:    `""`,
+			expected: "",
+		},
+		{
+			name:     "single quote only",
+			input:    "'",
+			expected: "'",
+		},
+		{
+			name:     "mismatched quotes",
+			input:    "'hello\"",
+			expected: "'hello\"",
+		},
+		{
+			name:     "with special chars",
+			input:    "'cookie=abc123&user=john'",
+			expected: "cookie=abc123&user=john",
+		},
+		{
+			name:     "complex cookie",
+			input:    `'authcookie=077058d3bc81&portal=PANGP_GW_01-N&user=john.doe@example.com&domain=Default&preferred-ip=192.168.1.100'`,
+			expected: "authcookie=077058d3bc81&portal=PANGP_GW_01-N&user=john.doe@example.com&domain=Default&preferred-ip=192.168.1.100",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := unshellQuote(tt.input)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestParseGPSamlFromCommandLine(t *testing.T) {
+	tests := []struct {
+		name           string
+		line           string
+		initialResult  *gpSamlAuthResult
+		expectedCookie string
+		expectedUser   string
+		expectedFP     string
+	}{
+		{
+			name:           "full openconnect command",
+			line:           "openconnect --protocol=gp --cookie=AUTH123 --servercert=pin-sha256:ABC --user=john",
+			initialResult:  &gpSamlAuthResult{},
+			expectedCookie: "AUTH123",
+			expectedUser:   "john",
+			expectedFP:     "pin-sha256:ABC",
+		},
+		{
+			name:           "with equals signs in cookie",
+			line:           "openconnect --cookie=authcookie=xyz123&portal=GATE --user=jane",
+			initialResult:  &gpSamlAuthResult{},
+			expectedCookie: "authcookie=xyz123&portal=GATE",
+			expectedUser:   "jane",
+			expectedFP:     "",
+		},
+		{
+			name:           "non-openconnect line",
+			line:           "some other output",
+			initialResult:  &gpSamlAuthResult{},
+			expectedCookie: "",
+			expectedUser:   "",
+			expectedFP:     "",
+		},
+		{
+			name:           "preserves existing values",
+			line:           "openconnect --user=newuser",
+			initialResult:  &gpSamlAuthResult{Cookie: "existing", Fingerprint: "existing-fp"},
+			expectedCookie: "existing",
+			expectedUser:   "newuser",
+			expectedFP:     "existing-fp",
+		},
+		{
+			name:           "only updates empty fields",
+			line:           "openconnect --cookie=NEW --user=NEW",
+			initialResult:  &gpSamlAuthResult{Cookie: "OLD"},
+			expectedCookie: "OLD",
+			expectedUser:   "NEW",
+			expectedFP:     "",
+		},
+		{
+			name:           "real gp-saml-gui output",
+			line:           "openconnect --protocol=gp --user=john.doe@example.com --os=linux-64 --usergroup=gateway:prelogin-cookie --passwd-on-stdin",
+			initialResult:  &gpSamlAuthResult{},
+			expectedCookie: "",
+			expectedUser:   "john.doe@example.com",
+			expectedFP:     "",
+		},
+		{
+			name:           "with server cert flag",
+			line:           "openconnect --servercert=pin-sha256:xp3scfzy3rOgQEXnfPiYKrUk7D66a8b8O+gEXaMPleE= vpn.example.com",
+			initialResult:  &gpSamlAuthResult{},
+			expectedCookie: "",
+			expectedUser:   "",
+			expectedFP:     "pin-sha256:xp3scfzy3rOgQEXnfPiYKrUk7D66a8b8O+gEXaMPleE=",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.initialResult
+			parseGPSamlFromCommandLine(tt.line, result)
+
+			assert.Equal(t, tt.expectedCookie, result.Cookie, "cookie mismatch")
+			assert.Equal(t, tt.expectedUser, result.User, "user mismatch")
+			assert.Equal(t, tt.expectedFP, result.Fingerprint, "fingerprint mismatch")
+		})
+	}
+}
+
+func TestParseGPSamlFromCommandLine_MultipleLines(t *testing.T) {
+	// Simulate gp-saml-gui output with command line suggestion
+	lines := []string{
+		"",
+		"SAML REDIRECT",
+		"Got SAML Login URL",
+		"POST to ACS endpoint...",
+		"Got 'prelogin-cookie': 'FAKE_cookie_12345'",
+		"openconnect --protocol=gp --user=john.doe@example.com --usergroup=gateway:prelogin-cookie --passwd-on-stdin vpn.example.com",
+		"",
+	}
+
+	result := &gpSamlAuthResult{}
+	for _, line := range lines {
+		parseGPSamlFromCommandLine(line, result)
+	}
+
+	assert.Equal(t, "john.doe@example.com", result.User)
+	assert.Empty(t, result.Cookie, "cookie should not be parsed from command line")
+	assert.Empty(t, result.Fingerprint)
+}

core/internal/server/network/backend_networkmanager_vpn.go

@@ -304,6 +304,51 @@ func (b *NetworkManagerBackend) ConnectVPN(uuidOrName string, singleActive bool)
 		if err := b.handleOpenVPNUsernameAuth(targetConn, connName, targetUUID, vpnServiceType); err != nil {
 			return err
 		}
+	case "gp_saml":
+		gateway := vpnData["gateway"]
+		protocol := vpnData["protocol"]
+		if protocol != "gp" {
+			return fmt.Errorf("GlobalProtect SAML authentication only supported for protocol=gp, got: %s", protocol)
+		}
+
+		log.Infof("[ConnectVPN] GlobalProtect SAML/SSO authentication required for %s (gateway=%s)", connName, gateway)
+
+		samlCtx, samlCancel := context.WithTimeout(context.Background(), 5*time.Minute)
+		authResult, err := b.runGlobalProtectSAMLAuth(samlCtx, gateway, protocol)
+		samlCancel()
+		if err != nil {
+			errMsg := err.Error()
+			switch {
+			case strings.Contains(errMsg, "not installed"):
+				return fmt.Errorf("gp-saml-gui is not installed (required for GlobalProtect SAML/SSO VPN)")
+			case strings.Contains(errMsg, "timed out") || strings.Contains(errMsg, "cancelled"):
+				return fmt.Errorf("GlobalProtect SAML authentication timed out — please try again")
+			case strings.Contains(errMsg, "no cookie"):
+				return fmt.Errorf("GlobalProtect SAML login did not complete — browser was closed before authentication finished")
+			case strings.Contains(errMsg, "convert prelogin-cookie"):
+				return fmt.Errorf("GlobalProtect VPN authentication succeeded but cookie exchange failed: %w", err)
+			default:
+				return fmt.Errorf("GlobalProtect SAML authentication failed: %w", err)
+			}
+		}
+
+		b.cachedGPSamlMu.Lock()
+		b.cachedGPSamlCookie = &cachedGPSamlCookie{
+			ConnectionUUID: targetUUID,
+			Cookie:         authResult.Cookie,
+			Host:           authResult.Host,
+			User:           authResult.User,
+			Fingerprint:    authResult.Fingerprint,
+		}
+		b.cachedGPSamlMu.Unlock()
+
+		if err := targetConn.ClearSecrets(); err != nil {
+			log.Warnf("[ConnectVPN] ClearSecrets failed (non-fatal): %v", err)
+		} else {
+			log.Infof("[ConnectVPN] Cleared stale stored secrets for %s", connName)
+		}
+
+		log.Infof("[ConnectVPN] GlobalProtect SAML cookie cached for %s, proceeding with activation", connName)
 	}
 
 	b.stateMutex.Lock()
@@ -339,6 +384,16 @@ func detectVPNAuthAction(serviceType string, data map[string]string) string {
 	}
 
 	switch {
+	case strings.Contains(serviceType, "openconnect"):
+		protocol := data["protocol"]
+		if needsExternalBrowserAuth(protocol, data["authtype"], data["username"], data) {
+			switch protocol {
+			case "gp":
+				return "gp_saml"
+			default:
+				log.Infof("[VPN] External browser auth detected for protocol '%s' but only GlobalProtect (gp) is currently supported", protocol)
+			}
+		}
 	case strings.Contains(serviceType, "openvpn"):
 		connType := data["connection-type"]
 		username := data["username"]
@@ -670,10 +725,13 @@ func (b *NetworkManagerBackend) updateVPNConnectionState() {
 				b.state.LastError = ""
 				b.stateMutex.Unlock()
 
-				// Clear cached PKCS11 PIN on success
+				// Clear cached PKCS11 PIN and SAML cookie on success
 				b.cachedPKCS11Mu.Lock()
 				b.cachedPKCS11PIN = nil
 				b.cachedPKCS11Mu.Unlock()
+				b.cachedGPSamlMu.Lock()
+				b.cachedGPSamlCookie = nil
+				b.cachedGPSamlMu.Unlock()
 
 				b.pendingVPNSaveMu.Lock()
 				pending := b.pendingVPNSave
@@ -692,10 +750,13 @@ func (b *NetworkManagerBackend) updateVPNConnectionState() {
 				b.state.LastError = "VPN connection failed"
 				b.stateMutex.Unlock()
 
-				// Clear cached PKCS11 PIN on failure
+				// Clear cached PKCS11 PIN and SAML cookie on failure
 				b.cachedPKCS11Mu.Lock()
 				b.cachedPKCS11PIN = nil
 				b.cachedPKCS11Mu.Unlock()
+				b.cachedGPSamlMu.Lock()
+				b.cachedGPSamlCookie = nil
+				b.cachedGPSamlMu.Unlock()
 				return
 			}
 		}
@@ -709,10 +770,13 @@ func (b *NetworkManagerBackend) updateVPNConnectionState() {
 		b.state.LastError = "VPN connection failed"
 		b.stateMutex.Unlock()
 
-		// Clear cached PKCS11 PIN
+		// Clear cached PKCS11 PIN and SAML cookie
 		b.cachedPKCS11Mu.Lock()
 		b.cachedPKCS11PIN = nil
 		b.cachedPKCS11Mu.Unlock()
+		b.cachedGPSamlMu.Lock()
+		b.cachedGPSamlCookie = nil
+		b.cachedGPSamlMu.Unlock()
 	}
 }
 

core/internal/server/network/backend_networkmanager_wifi.go

@@ -158,18 +158,26 @@ func (b *NetworkManagerBackend) GetWiFiNetworkDetails(ssid string) (*NetworkInfo
 
 		channel := frequencyToChannel(freq)
 
+		isConnected := ssid == currentSSID && bssid == currentBSSID
+		rate := maxBitrate / 1000
+		if isConnected {
+			if devBitrate, err := w.GetPropertyBitrate(); err == nil && devBitrate > 0 {
+				rate = devBitrate / 1000
+			}
+		}
+
 		network := WiFiNetwork{
 			SSID:        ssid,
 			BSSID:       bssid,
 			Signal:      strength,
 			Secured:     secured,
 			Enterprise:  enterprise,
-			Connected:   ssid == currentSSID && bssid == currentBSSID,
+			Connected:   isConnected,
 			Saved:       savedSSIDs[ssid],
 			Autoconnect: autoconnectMap[ssid],
 			Frequency:   freq,
 			Mode:        modeStr,
-			Rate:        maxBitrate / 1000,
+			Rate:        rate,
 			Channel:     channel,
 		}
 
@@ -455,19 +463,27 @@ func (b *NetworkManagerBackend) updateWiFiNetworks() ([]WiFiNetwork, error) {
 
 		channel := frequencyToChannel(freq)
 
+		isConnected := ssid == currentSSID
+		rate := maxBitrate / 1000
+		if isConnected {
+			if devBitrate, err := w.GetPropertyBitrate(); err == nil && devBitrate > 0 {
+				rate = devBitrate / 1000
+			}
+		}
+
 		network := WiFiNetwork{
 			SSID:        ssid,
 			BSSID:       bssid,
 			Signal:      strength,
 			Secured:     secured,
 			Enterprise:  enterprise,
-			Connected:   ssid == currentSSID,
+			Connected:   isConnected,
 			Saved:       savedSSIDs[ssid],
 			Autoconnect: autoconnectMap[ssid],
 			Hidden:      hiddenSSIDs[ssid],
 			Frequency:   freq,
 			Mode:        modeStr,
-			Rate:        maxBitrate / 1000,
+			Rate:        rate,
 			Channel:     channel,
 		}
 
@@ -1003,19 +1019,27 @@ func (b *NetworkManagerBackend) updateAllWiFiDevices() {
 
 				channel := frequencyToChannel(freq)
 
+				isConnected := connected && apSSID == ssid
+				rate := maxBitrate / 1000
+				if isConnected {
+					if devBitrate, err := devInfo.wireless.GetPropertyBitrate(); err == nil && devBitrate > 0 {
+						rate = devBitrate / 1000
+					}
+				}
+
 				network := WiFiNetwork{
 					SSID:        apSSID,
 					BSSID:       apBSSID,
 					Signal:      strength,
 					Secured:     secured,
 					Enterprise:  enterprise,
-					Connected:   connected && apSSID == ssid,
+					Connected:   isConnected,
 					Saved:       savedSSIDs[apSSID],
 					Autoconnect: autoconnectMap[apSSID],
 					Hidden:      hiddenSSIDs[apSSID],
 					Frequency:   freq,
 					Mode:        modeStr,
-					Rate:        maxBitrate / 1000,
+					Rate:        rate,
 					Channel:     channel,
 					Device:      name,
 				}

core/internal/server/network/detect_test.go

@@ -1,6 +1,7 @@
 package network
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -28,7 +29,13 @@ func TestDetectResult_HasNetworkdField(t *testing.T) {
 
 func TestDetectNetworkStack_Integration(t *testing.T) {
 	result, err := DetectNetworkStack()
+
+	if err != nil && strings.Contains(err.Error(), "connect system bus") {
+		t.Skipf("system D-Bus unavailable: %v", err)
+	}
+
 	assert.NoError(t, err)
-	assert.NotNil(t, result)
-	assert.NotEmpty(t, result.ChosenReason)
+	if assert.NotNil(t, result) {
+		assert.NotEmpty(t, result.ChosenReason)
+	}
 }

core/internal/server/server.go

@@ -1516,7 +1516,11 @@ func Start(printDocs bool) error {
 		}
 	}()
 
+	loginctlReady := make(chan struct{})
+	freedesktopReady := make(chan struct{})
+
 	go func() {
+		defer close(loginctlReady)
 		if err := InitializeLoginctlManager(); err != nil {
 			log.Warnf("Loginctl manager unavailable: %v", err)
 		} else {
@@ -1525,6 +1529,7 @@ func Start(printDocs bool) error {
 	}()
 
 	go func() {
+		defer close(freedesktopReady)
 		if err := InitializeFreedeskManager(); err != nil {
 			log.Warnf("Freedesktop manager unavailable: %v", err)
 		} else if freedesktopManager != nil {
@@ -1533,6 +1538,31 @@ func Start(printDocs bool) error {
 		}
 	}()
 
+	// Bridge loginctl lock state to the freedesktop/gnome screensaver
+	// ActiveChanged signal so apps like Bitwarden can detect screen lock.
+	go func() {
+		<-loginctlReady
+		<-freedesktopReady
+
+		if loginctlManager == nil || freedesktopManager == nil {
+			return
+		}
+
+		ch := loginctlManager.Subscribe("dms-lock-bridge")
+		defer loginctlManager.Unsubscribe("dms-lock-bridge")
+
+		initial := loginctlManager.GetState()
+		lastLocked := initial.Locked
+		freedesktopManager.SetScreenLockActive(lastLocked)
+
+		for state := range ch {
+			if state.Locked != lastLocked {
+				lastLocked = state.Locked
+				freedesktopManager.SetScreenLockActive(lastLocked)
+			}
+		}
+	}()
+
 	if err := InitializeWaylandManager(); err != nil {
 		log.Warnf("Wayland manager unavailable: %v", err)
 	}
@@ -1569,6 +1599,13 @@ func Start(printDocs bool) error {
 		log.Warnf("Theme mode manager unavailable: %v", err)
 	} else {
 		notifyCapabilityChange()
+		go func() {
+			<-loginctlReady
+			if loginctlManager == nil {
+				return
+			}
+			themeModeManager.WatchLoginctl(loginctlManager)
+		}()
 	}
 
 	fatalErrChan := make(chan error, 1)

core/internal/server/server_test.go

@@ -162,7 +162,7 @@ func TestCleanupStaleSockets(t *testing.T) {
 	tempDir := t.TempDir()
 	t.Setenv("XDG_RUNTIME_DIR", tempDir)
 
-	staleSocket := filepath.Join(tempDir, "danklinux-999999.sock")
+	staleSocket := filepath.Join(tempDir, "danklinux-4194305.sock")
 	err := os.WriteFile(staleSocket, []byte{}, 0o600)
 	require.NoError(t, err)
 

core/internal/server/thememode/manager.go

@@ -5,6 +5,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/loginctl"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/wayland"
 	"github.com/AvengeMedia/DankMaterialShell/core/pkg/syncmap"
 )
@@ -187,6 +188,29 @@ func (m *Manager) Close() {
 	})
 }
 
+func (m *Manager) WatchLoginctl(lm *loginctl.Manager) {
+	ch := lm.Subscribe("thememode")
+	m.wg.Add(1)
+	go func() {
+		defer m.wg.Done()
+		defer lm.Unsubscribe("thememode")
+		for {
+			select {
+			case <-m.stopChan:
+				return
+			case state, ok := <-ch:
+				if !ok {
+					return
+				}
+				if state.PreparingForSleep {
+					continue
+				}
+				m.TriggerUpdate()
+			}
+		}
+	}()
+}
+
 func (m *Manager) schedulerLoop() {
 	defer m.wg.Done()
 
@@ -327,10 +351,12 @@ func statesEqual(a, b *State) bool {
 }
 
 func (m *Manager) computeSchedule(now time.Time, config Config) (bool, time.Time) {
-	if config.Mode == "location" {
+	switch config.Mode {
+	case "location":
 		return m.computeLocationSchedule(now, config)
+	default:
+		return computeTimeSchedule(now, config)
 	}
-	return computeTimeSchedule(now, config)
 }
 
 func computeTimeSchedule(now time.Time, config Config) (bool, time.Time) {
@@ -381,10 +407,10 @@ func (m *Manager) computeLocationSchedule(now time.Time, config Config) (bool, t
 	}
 
 	times, cond := wayland.CalculateSunTimesWithTwilight(*lat, *lon, now, config.ElevationTwilight, config.ElevationDaylight)
-	if cond != wayland.SunNormal {
-		if cond == wayland.SunMidnightSun {
-			return true, startOfNextDay(now)
-		}
+	switch cond {
+	case wayland.SunMidnightSun:
+		return true, startOfNextDay(now)
+	case wayland.SunPolarNight:
 		return false, startOfNextDay(now)
 	}
 
@@ -397,10 +423,10 @@ func (m *Manager) computeLocationSchedule(now time.Time, config Config) (bool, t
 
 	nextDay := startOfNextDay(now)
 	nextTimes, nextCond := wayland.CalculateSunTimesWithTwilight(*lat, *lon, nextDay, config.ElevationTwilight, config.ElevationDaylight)
-	if nextCond != wayland.SunNormal {
-		if nextCond == wayland.SunMidnightSun {
-			return true, startOfNextDay(nextDay)
-		}
+	switch nextCond {
+	case wayland.SunMidnightSun:
+		return true, startOfNextDay(nextDay)
+	case wayland.SunPolarNight:
 		return false, startOfNextDay(nextDay)
 	}
 
@@ -413,13 +439,7 @@ func startOfNextDay(t time.Time) time.Time {
 }
 
 func validateHourMinute(hour, minute int) bool {
-	if hour < 0 || hour > 23 {
-		return false
-	}
-	if minute < 0 || minute > 59 {
-		return false
-	}
-	return true
+	return hour >= 0 && hour <= 23 && minute >= 0 && minute <= 59
 }
 
 func (m *Manager) ValidateSchedule(startHour, startMinute, endHour, endMinute int) error {

core/internal/server/wlcontext/context.go

@@ -2,10 +2,10 @@ package wlcontext
 
 import (
 	"fmt"
+	"golang.org/x/sys/unix"
 	"os"
 	"sync"
-
-	"golang.org/x/sys/unix"
+	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/errdefs"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
@@ -123,6 +123,9 @@ func (sc *SharedContext) eventDispatcher() {
 		{Fd: int32(sc.wakeR), Events: unix.POLLIN},
 	}
 
+	consecutiveErrors := 0
+	const maxConsecutiveErrors = 20
+
 	for {
 		sc.drainCmdQueue()
 
@@ -153,9 +156,19 @@ func (sc *SharedContext) eventDispatcher() {
 		}
 
 		if err := ctx.Dispatch(); err != nil && !os.IsTimeout(err) {
-			log.Errorf("Wayland connection error: %v", err)
-			return
+			consecutiveErrors++
+			log.Warnf("Wayland connection error (%d/%d): %v", consecutiveErrors, maxConsecutiveErrors, err)
+
+			if consecutiveErrors >= maxConsecutiveErrors {
+				log.Errorf("Fatal: Wayland connection unrecoverable after %d attempts. Exiting dispatcher.", maxConsecutiveErrors)
+				return
+			}
+
+			time.Sleep(100 * time.Millisecond * time.Duration(consecutiveErrors))
+			continue
 		}
+
+		consecutiveErrors = 0
 	}
 }
 

core/internal/server/wlroutput/manager.go

@@ -13,7 +13,7 @@ func NewManager(display wlclient.WaylandDisplay) (*Manager, error) {
 	m := &Manager{
 		display:    display,
 		ctx:        display.Context(),
-		cmdq:       make(chan cmd, 128),
+		cmdq:       make(chan cmd, 512),
 		stopChan:   make(chan struct{}),
 		dirty:      make(chan struct{}, 1),
 		fatalError: make(chan error, 1),

core/internal/tui/views_dependencies.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/greeter"
 	tea "github.com/charmbracelet/bubbletea"
 )
 
@@ -80,19 +81,24 @@ func (m Model) viewDependencyReview() string {
 				}
 			}
 
+			note := ""
+			if dep.Name == "dms-greeter" {
+				note = m.styles.Subtle.Render(" (selection replaces your current display manager)")
+			}
+
 			var line string
 			if i == m.selectedDep {
 				line = fmt.Sprintf("▶ %s%s%-25s %s", reinstallMarker, variantMarker, dep.Name, status)
 				if dep.Version != "" {
 					line += fmt.Sprintf(" (%s)", dep.Version)
 				}
-				line = m.styles.SelectedOption.Render(line)
+				line = m.styles.SelectedOption.Render(line) + note
 			} else {
 				line = fmt.Sprintf("  %s%s%-25s %s", reinstallMarker, variantMarker, dep.Name, status)
 				if dep.Version != "" {
 					line += fmt.Sprintf(" (%s)", dep.Version)
 				}
-				line = m.styles.Normal.Render(line)
+				line = m.styles.Normal.Render(line) + note
 			}
 
 			b.WriteString(line)
@@ -115,6 +121,13 @@ func (m Model) updateDetectingDepsState(msg tea.Msg) (tea.Model, tea.Cmd) {
 			m.state = StateError
 		} else {
 			m.dependencies = depsMsg.deps
+			// dms-greeter is opt-in skipped by default
+			for _, dep := range depsMsg.deps {
+				if dep.Name == "dms-greeter" {
+					m.disabledItems["dms-greeter"] = true
+					break
+				}
+			}
 			m.state = StateDependencyReview
 		}
 		return m, m.listenForLogs()
@@ -230,6 +243,41 @@ func (m Model) installPackages() tea.Cmd {
 		// Convert installer messages to TUI messages
 		go func() {
 			for msg := range installerProgressChan {
+				// Run optional greeter setup
+				if msg.Phase == distros.PhaseComplete && msg.IsComplete && msg.Error == nil {
+					greeterSelected := false
+					for _, dep := range m.dependencies {
+						if dep.Name == "dms-greeter" && !m.disabledItems["dms-greeter"] {
+							greeterSelected = true
+							break
+						}
+					}
+					if greeterSelected {
+						compositorName := "niri"
+						if m.selectedWM == 1 {
+							compositorName = "Hyprland"
+						}
+						m.packageProgressChan <- packageInstallProgressMsg{
+							progress:  0.92,
+							step:      "Configuring DMS greeter...",
+							logOutput: "Starting automated greeter setup...",
+						}
+						greeterLogFunc := func(line string) {
+							m.packageProgressChan <- packageInstallProgressMsg{
+								progress:  0.94,
+								step:      "Configuring DMS greeter...",
+								logOutput: line,
+							}
+						}
+						if err := greeter.AutoSetupGreeter(compositorName, m.sudoPassword, greeterLogFunc); err != nil {
+							m.packageProgressChan <- packageInstallProgressMsg{
+								progress:  0.96,
+								step:      "Greeter setup warning",
+								logOutput: fmt.Sprintf("⚠ Greeter auto-setup warning (non-fatal): %v", err),
+							}
+						}
+					}
+				}
 				tuiMsg := packageInstallProgressMsg{
 					progress:    msg.Progress,
 					step:        msg.Step,

core/internal/tui/views_install.go

@@ -139,7 +139,7 @@ func dmsPackageName(distroID string, dependencies []deps.Dependency) string {
 		if isGit {
 			return "dms-shell-git"
 		}
-		return "dms-shell-bin"
+		return "dms-shell"
 	case distros.FamilyFedora, distros.FamilyUbuntu, distros.FamilyDebian, distros.FamilySUSE:
 		if isGit {
 			return "dms-git"

core/internal/utils/group.go

@@ -0,0 +1,37 @@
+package utils
+
+import (
+	"os"
+	"strings"
+)
+
+func HasGroup(groupName string) bool {
+	return HasGroupIn(groupName, "/etc/group")
+}
+
+func HasGroupIn(groupName, path string) bool {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return false
+	}
+	return HasGroupData(groupName, string(data))
+}
+
+func HasGroupData(groupName, data string) bool {
+	prefix := groupName + ":"
+	for line := range strings.SplitSeq(data, "\n") {
+		if strings.HasPrefix(line, prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func FindGroupData(data string, candidates ...string) (string, bool) {
+	for _, candidate := range candidates {
+		if HasGroupData(candidate, data) {
+			return candidate, true
+		}
+	}
+	return "", false
+}

core/internal/utils/group_test.go

@@ -0,0 +1,142 @@
+package utils
+
+import "testing"
+
+const testGroupData = `root:x:0:brltty,root
+sys:x:3:bin,testuser
+mem:x:8:
+ftp:x:11:
+mail:x:12:
+log:x:19:
+smmsp:x:25:
+proc:x:26:
+games:x:50:
+lock:x:54:
+network:x:90:
+floppy:x:94:
+scanner:x:96:
+power:x:98:
+nobody:x:65534:
+adm:x:999:daemon
+wheel:x:998:testuser
+utmp:x:997:
+audio:x:996:brltty
+disk:x:995:
+input:x:994:brltty,testuser,greeter
+kmem:x:993:
+kvm:x:992:libvirt-qemu,qemu,testuser
+lp:x:991:cups,testuser
+optical:x:990:
+render:x:989:
+sgx:x:988:
+storage:x:987:
+tty:x:5:brltty
+uucp:x:986:brltty
+video:x:985:cosmic-greeter,greeter,testuser
+users:x:984:
+groups:x:983:
+systemd-journal:x:982:
+rfkill:x:981:
+bin:x:1:daemon
+daemon:x:2:bin
+http:x:33:
+dbus:x:81:
+systemd-coredump:x:980:
+systemd-network:x:979:
+systemd-oom:x:978:
+systemd-journal-remote:x:977:
+systemd-resolve:x:976:
+systemd-timesync:x:975:
+tss:x:974:
+uuidd:x:973:
+alpm:x:972:
+polkitd:x:102:
+testuser:x:1000:
+avahi:x:971:
+git:x:970:
+nvidia-persistenced:x:143:
+i2c:x:969:testuser
+seat:x:968:
+rtkit:x:133:
+brlapi:x:967:brltty
+gdm:x:120:
+brltty:x:966:
+colord:x:965:
+flatpak:x:964:
+geoclue:x:963:testuser
+gnome-remote-desktop:x:962:
+saned:x:961:
+usbmux:x:140:
+cosmic-greeter:x:960:
+greeter:x:959:testuser
+openvpn:x:958:
+nm-openvpn:x:957:
+named:x:40:
+_talkd:x:956:
+keyd:x:955:
+cups:x:209:testuser
+docker:x:954:testuser
+mysql:x:953:
+radicale:x:952:
+onepassword:x:1001:
+nixbld:x:951:nixbld01,nixbld02,nixbld03,nixbld04,nixbld05,nixbld06,nixbld07,nixbld08,nixbld09,nixbld10
+virtlogin:x:940:
+libvirt:x:939:testuser
+libvirt-qemu:x:938:
+qemu:x:937:
+dnsmasq:x:936:
+clock:x:935:
+dms-greeter:x:1002:greeter,testuser
+pcscd:x:934:
+test:x:1003:
+empower:x:933:
+`
+
+func TestHasGroupData(t *testing.T) {
+	tests := []struct {
+		group string
+		want  bool
+	}{
+		{"greeter", true},
+		{"root", true},
+		{"docker", true},
+		{"cosmic-greeter", true},
+		{"dms-greeter", true},
+		{"nonexistent", false},
+		{"greet", false},
+	}
+
+	for _, tt := range tests {
+		if got := HasGroupData(tt.group, testGroupData); got != tt.want {
+			t.Errorf("HasGroupData(%q) = %v, want %v", tt.group, got, tt.want)
+		}
+	}
+}
+
+func TestFindGroupData(t *testing.T) {
+	tests := []struct {
+		name       string
+		candidates []string
+		wantGroup  string
+		wantFound  bool
+	}{
+		{"first match wins", []string{"greeter", "greetd", "_greeter"}, "greeter", true},
+		{"fallback to second", []string{"greetd", "greeter"}, "greeter", true},
+		{"none found", []string{"_greetd", "greetd"}, "", false},
+		{"single match", []string{"docker"}, "docker", true},
+	}
+
+	for _, tt := range tests {
+		got, found := FindGroupData(testGroupData, tt.candidates...)
+		if got != tt.wantGroup || found != tt.wantFound {
+			t.Errorf("%s: FindGroupData(%v) = (%q, %v), want (%q, %v)",
+				tt.name, tt.candidates, got, found, tt.wantGroup, tt.wantFound)
+		}
+	}
+}
+
+func TestHasGroupDataEmpty(t *testing.T) {
+	if HasGroupData("greeter", "") {
+		t.Error("expected false for empty data")
+	}
+}

core/internal/utils/paths.go

@@ -38,6 +38,22 @@ func XDGConfigHome() string {
 	return filepath.Join(home, ".config")
 }
 
+func EmacsConfigDir() string {
+	home, _ := os.UserHomeDir()
+
+	emacsD := filepath.Join(home, ".emacs.d")
+	if info, err := os.Stat(emacsD); err == nil && info.IsDir() {
+		return emacsD
+	}
+
+	xdgEmacs := filepath.Join(XDGConfigHome(), "emacs")
+	if info, err := os.Stat(xdgEmacs); err == nil && info.IsDir() {
+		return xdgEmacs
+	}
+
+	return ""
+}
+
 func ExpandPath(path string) (string, error) {
 	expanded := os.ExpandEnv(path)
 	expanded = filepath.Clean(expanded)

core/internal/windowrules/providers/niri_parser.go

@@ -864,10 +864,12 @@ func (p *NiriWritableProvider) formatRule(rule windowrules.WindowRule) string {
 
 func formatSizeProperty(name, value string) string {
 	parts := strings.SplitN(value, " ", 2)
-	if len(parts) != 2 {
-		return fmt.Sprintf("    %s { }", name)
+	if len(parts) == 2 {
+		return fmt.Sprintf("    %s { %s %s; }", name, parts[0], parts[1])
 	}
-	sizeType := parts[0]
-	sizeValue := parts[1]
-	return fmt.Sprintf("    %s { %s %s; }", name, sizeType, sizeValue)
+	// Bare number without type prefix — default to "fixed"
+	if _, err := strconv.Atoi(value); err == nil {
+		return fmt.Sprintf("    %s { fixed %s; }", name, value)
+	}
+	return fmt.Sprintf("    %s { }", name)
 }

distro/debian/dms-git/debian/control

@@ -29,6 +29,7 @@ Depends: ${misc:Depends},
          qml6-module-qtquick-templates,
          qml6-module-qtquick-window,
          qt6ct
+Suggests: cups-pk-helper
 Provides: dms
 Conflicts: dms
 Replaces: dms

distro/debian/dms-greeter/_service

@@ -0,0 +1,9 @@
+<services>
+  <!-- Download dms-qml source tarball from GitHub releases (greeter + quickshell content) -->
+  <service name="download_url">
+    <param name="protocol">https</param>
+    <param name="host">github.com</param>
+    <param name="path">/AvengeMedia/DankMaterialShell/releases/download/v1.4.2/dms-qml.tar.gz</param>
+    <param name="filename">dms-qml.tar.gz</param>
+  </service>
+</services>

distro/debian/dms-greeter/debian/changelog

@@ -0,0 +1,6 @@
+dms-greeter (1.4.2db8) unstable; urgency=medium
+
+  * Initial Debian OBS package
+  * Port from Ubuntu/Fedora packaging
+
+ -- Avenge Media <AvengeMedia.US@gmail.com>  Sat, 21 Feb 2026 00:00:00 +0000

distro/debian/dms-greeter/debian/control

@@ -0,0 +1,23 @@
+Source: dms-greeter
+Section: x11
+Priority: optional
+Maintainer: Avenge Media <AvengeMedia.US@gmail.com>
+Build-Depends: debhelper-compat (= 13)
+Standards-Version: 4.6.2
+Homepage: https://github.com/AvengeMedia/DankMaterialShell
+Vcs-Browser: https://github.com/AvengeMedia/DankMaterialShell
+Vcs-Git: https://github.com/AvengeMedia/DankMaterialShell.git
+
+Package: dms-greeter
+Architecture: any
+Depends: ${misc:Depends},
+  greetd,
+  quickshell-git | quickshell
+Suggests: niri | hyprland | sway
+Description: DankMaterialShell greeter for greetd
+  DankMaterialShell greeter for greetd login manager. A modern, Material Design 3
+  inspired greeter interface built with Quickshell for Wayland compositors.
+  .
+  Supports multiple compositors including Niri, Hyprland, and Sway with automatic
+  compositor detection and configuration. Features session selection, user
+  authentication, and dynamic theming.

distro/debian/dms-greeter/debian/copyright

@@ -0,0 +1,27 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: dms-greeter
+Upstream-Contact: Avenge Media LLC <AvengeMedia.US@gmail.com>
+Source: https://github.com/AvengeMedia/DankMaterialShell
+
+Files: *
+Copyright: 2026 Avenge Media LLC
+License: MIT
+
+License: MIT
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.