flake: let module callers supply pkgs so overlays reach the build (#2244)

The nixosModule/homeModule path previously called `buildDmsPkgs pkgs` but
internally referenced `self.packages.${system}.default`, which was
instantiated via `nixpkgs.legacyPackages`, an unoverlayed pkgs. That
meant downstream flakes couldn't reach through their own overlays to
the dms-shell build (e.g. to swap `kdePackages.sonnet` or trim perl
out of the aspell closure).

Extract the derivation as `mkDmsShell = pkgs: ...` at the top-level
`let`, and call it from both `packages.${system}.dms-shell` (for
direct consumers of the flake) and `buildDmsPkgs pkgs` (for module
consumers, which now pass in the system's overlayed pkgs).

Also re-checks overrideAttrs / .override still work: `mkDmsShell pkgs`
is the same `pkgs.lib.makeOverridable` wrapper as before, just
parameterized on the caller's pkgs instance.

Co-authored-by: Lucas <43530291+LuckShiba@users.noreply.github.com>

core/cmd/dms/assets/cli-policy.default.json

@@ -0,0 +1,10 @@
+{
+  "policy_version": 1,
+  "blocked_commands": [
+    "greeter install",
+    "greeter enable",
+    "greeter uninstall",
+    "setup"
+  ],
+  "message": "This command is disabled on immutable/image-based systems. Use your distro-native workflow for system-level changes."
+}

core/cmd/dms/commands_blur.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/blur"
+	"github.com/spf13/cobra"
+)
+
+var blurCmd = &cobra.Command{
+	Use:   "blur",
+	Short: "Background blur utilities",
+}
+
+var blurCheckCmd = &cobra.Command{
+	Use:   "check",
+	Short: "Check if the compositor supports background blur (ext-background-effect-v1)",
+	Args:  cobra.NoArgs,
+	Run:   runBlurCheck,
+}
+
+func init() {
+	blurCmd.AddCommand(blurCheckCmd)
+}
+
+func runBlurCheck(cmd *cobra.Command, args []string) {
+	supported, err := blur.ProbeSupport()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
+
+	switch supported {
+	case true:
+		fmt.Println("supported")
+	default:
+		fmt.Println("unsupported")
+	}
+}

core/cmd/dms/commands_brightness.go

@@ -236,6 +236,7 @@ func runBrightnessSet(cmd *cobra.Command, args []string) {
 			defer ddc.Close()
 			time.Sleep(100 * time.Millisecond)
 			if err := ddc.SetBrightnessWithExponent(deviceID, percent, exponential, exponent, nil); err == nil {
+				ddc.WaitPending()
 				fmt.Printf("Set %s to %d%%\n", deviceID, percent)
 				return
 			}

core/cmd/dms/commands_common.go

@@ -64,9 +64,8 @@ var killCmd = &cobra.Command{
 }
 
 var ipcCmd = &cobra.Command{
-	Use:     "ipc [target] [function] [args...]",
-	Short:   "Send IPC commands to running DMS shell",
-	PreRunE: findConfig,
+	Use:   "ipc [target] [function] [args...]",
+	Short: "Send IPC commands to running DMS shell",
 	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		_ = findConfig(cmd, args)
 		return getShellIPCCompletions(args, toComplete), cobra.ShellCompDirectiveNoFileComp
@@ -526,5 +525,6 @@ func getCommonCommands() []*cobra.Command {
 		configCmd,
 		dlCmd,
 		randrCmd,
+		blurCmd,
 	}
 }

core/cmd/dms/commands_doctor.go

@@ -11,6 +11,7 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/blur"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
@@ -82,7 +83,7 @@ func (ds *DoctorStatus) OKCount() int {
 }
 
 var (
-	quickshellVersionRegex = regexp.MustCompile(`quickshell (\d+\.\d+\.\d+)`)
+	quickshellVersionRegex = regexp.MustCompile(`(?i)quickshell (\d+\.\d+\.\d+)`)
 	hyprlandVersionRegex   = regexp.MustCompile(`v?(\d+\.\d+\.\d+)`)
 	niriVersionRegex       = regexp.MustCompile(`niri (\d+\.\d+)`)
 	swayVersionRegex       = regexp.MustCompile(`sway version (\d+\.\d+)`)
@@ -90,6 +91,7 @@ var (
 	wayfireVersionRegex    = regexp.MustCompile(`wayfire (\d+\.\d+)`)
 	labwcVersionRegex      = regexp.MustCompile(`labwc (\d+\.\d+\.\d+)`)
 	mangowcVersionRegex    = regexp.MustCompile(`mango (\d+\.\d+\.\d+)`)
+	miracleVersionRegex    = regexp.MustCompile(`miracle-wm v?(\d+\.\d+\.\d+)`)
 )
 
 var doctorCmd = &cobra.Command{
@@ -468,6 +470,7 @@ func checkWindowManagers() []checkResult {
 		{"Wayfire", "wayfire", "--version", wayfireVersionRegex, []string{"wayfire"}},
 		{"labwc", "labwc", "--version", labwcVersionRegex, []string{"labwc"}},
 		{"mangowc", "mango", "-v", mangowcVersionRegex, []string{"mango"}},
+		{"Miracle WM", "miracle-wm", "--version", miracleVersionRegex, []string{"miracle-wm"}},
 	}
 
 	var results []checkResult
@@ -500,7 +503,7 @@ func checkWindowManagers() []checkResult {
 		results = append(results, checkResult{
 			catCompositor, "Compositor", statusError,
 			"No supported Wayland compositor found",
-			"Install Hyprland, niri, Sway, River, or Wayfire",
+			"Install Hyprland, niri, Sway, River, Wayfire, or miracle-wm",
 			doctorDocsURL + "#compositor-checks",
 		})
 	}
@@ -509,9 +512,24 @@ func checkWindowManagers() []checkResult {
 		results = append(results, checkResult{catCompositor, "Active", statusInfo, wm, "", doctorDocsURL + "#compositor"})
 	}
 
+	results = append(results, checkCompositorBlurSupport())
+
 	return results
 }
 
+func checkCompositorBlurSupport() checkResult {
+	supported, err := blur.ProbeSupport()
+	if err != nil {
+		return checkResult{catCompositor, "Background Blur", statusInfo, "Unable to verify", err.Error(), doctorDocsURL + "#compositor-checks"}
+	}
+
+	if supported {
+		return checkResult{catCompositor, "Background Blur", statusOK, "Supported", "Compositor supports ext-background-effect-v1", doctorDocsURL + "#compositor-checks"}
+	}
+
+	return checkResult{catCompositor, "Background Blur", statusWarn, "Unsupported", "Compositor does not support ext-background-effect-v1", doctorDocsURL + "#compositor-checks"}
+}
+
 func getVersionFromCommand(cmd, arg string, regex *regexp.Regexp) string {
 	output, err := exec.Command(cmd, arg).CombinedOutput()
 	if err != nil && len(output) == 0 {
@@ -535,6 +553,8 @@ func detectRunningWM() string {
 		return "Hyprland"
 	case os.Getenv("NIRI_SOCKET") != "":
 		return "niri"
+	case os.Getenv("MIRACLESOCK") != "":
+		return "Miracle WM"
 	case os.Getenv("XDG_CURRENT_DESKTOP") != "":
 		return os.Getenv("XDG_CURRENT_DESKTOP")
 	}
@@ -553,6 +573,7 @@ func checkQuickshellFeatures() ([]checkResult, bool) {
 	qmlContent := `
 import QtQuick
 import Quickshell
+import Quickshell.Wayland
 
 ShellRoot {
 	id: root
@@ -561,6 +582,7 @@ ShellRoot {
 	property bool idleMonitorAvailable: false
 	property bool idleInhibitorAvailable: false
 	property bool shortcutInhibitorAvailable: false
+	property bool backgroundBlurAvailable: false
 
 	Timer {
 		interval: 50
@@ -578,16 +600,18 @@ ShellRoot {
 
 			try {
 				var testItem = Qt.createQmlObject(
-					'import Quickshell.Wayland; import QtQuick; QtObject { ' +
+					'import Quickshell; import Quickshell.Wayland; import QtQuick; QtObject { ' +
 					'readonly property bool hasIdleMonitor: typeof IdleMonitor !== "undefined"; ' +
 					'readonly property bool hasIdleInhibitor: typeof IdleInhibitor !== "undefined"; ' +
-					'readonly property bool hasShortcutInhibitor: typeof ShortcutInhibitor !== "undefined" ' +
+					'readonly property bool hasShortcutInhibitor: typeof ShortcutInhibitor !== "undefined"; ' +
+					'readonly property bool hasBackgroundBlur: typeof BackgroundEffect !== "undefined" ' +
 					'}',
 					root
 				)
 				root.idleMonitorAvailable = testItem.hasIdleMonitor
 				root.idleInhibitorAvailable = testItem.hasIdleInhibitor
 				root.shortcutInhibitorAvailable = testItem.hasShortcutInhibitor
+				root.backgroundBlurAvailable = testItem.hasBackgroundBlur
 				testItem.destroy()
 			} catch (e) {}
 
@@ -596,6 +620,8 @@ ShellRoot {
 			console.warn(root.idleInhibitorAvailable ? "FEATURE:IdleInhibitor:OK" : "FEATURE:IdleInhibitor:UNAVAILABLE")
 			console.warn(root.shortcutInhibitorAvailable ? "FEATURE:ShortcutInhibitor:OK" : "FEATURE:ShortcutInhibitor:UNAVAILABLE")
 
+			console.warn(root.backgroundBlurAvailable ? "FEATURE:BackgroundBlur:OK" : "FEATURE:BackgroundBlur:UNAVAILABLE")
+
 			Quickshell.execDetached(["kill", "-TERM", String(Quickshell.processId)])
 		}
 	}
@@ -616,6 +642,7 @@ ShellRoot {
 		{"IdleMonitor", "Idle detection"},
 		{"IdleInhibitor", "Prevent idle/sleep"},
 		{"ShortcutInhibitor", "Allow shortcut management (niri)"},
+		{"BackgroundBlur", "Background blur API support in Quickshell"},
 	}
 
 	var results []checkResult
@@ -820,10 +847,14 @@ func checkOptionalDependencies() []checkResult {
 	results = append(results, checkImageFormatPlugins()...)
 
 	terminals := []string{"ghostty", "kitty", "alacritty", "foot", "wezterm"}
-	if idx := slices.IndexFunc(terminals, utils.CommandExists); idx >= 0 {
-		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusOK, terminals[idx], "", optionalFeaturesURL})
+	terminals = slices.DeleteFunc(terminals, func(t string) bool {
+		return !utils.CommandExists(t)
+	})
+
+	if len(terminals) > 0 {
+		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusOK, strings.Join(terminals, ", "), "", optionalFeaturesURL})
 	} else {
-		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusWarn, "None found", "Install ghostty, kitty, or alacritty", optionalFeaturesURL})
+		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusWarn, "None found", "Install ghostty, kitty, foot or alacritty", optionalFeaturesURL})
 	}
 
 	networkResult, err := network.DetectNetworkStack()

core/cmd/dms/commands_features.go

@@ -4,6 +4,7 @@ package main
 
 import (
 	"bufio"
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -15,6 +16,7 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/errdefs"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/version"
 	"github.com/spf13/cobra"
@@ -109,16 +111,37 @@ func updateArchLinux() error {
 	}
 
 	var packageName string
-	if isArchPackageInstalled("dms-shell-bin") {
-		packageName = "dms-shell-bin"
+	var isAUR bool
+	if isArchPackageInstalled("dms-shell") {
+		packageName = "dms-shell"
 	} else if isArchPackageInstalled("dms-shell-git") {
 		packageName = "dms-shell-git"
+		isAUR = true
+	} else if isArchPackageInstalled("dms-shell-bin") {
+		packageName = "dms-shell-bin"
+		isAUR = true
 	} else {
-		fmt.Println("Info: Neither dms-shell-bin nor dms-shell-git package found.")
+		fmt.Println("Info: No dms-shell package found.")
 		fmt.Println("Info: Falling back to git-based update method...")
 		return updateOtherDistros()
 	}
 
+	if !isAUR {
+		fmt.Printf("This will update %s using pacman.\n", packageName)
+		if !confirmUpdate() {
+			return errdefs.ErrUpdateCancelled
+		}
+
+		fmt.Printf("\nRunning: pacman -S %s\n", packageName)
+		if err := privesc.Run(context.Background(), "", "pacman", "-S", "--noconfirm", packageName); err != nil {
+			fmt.Printf("Error: Failed to update using pacman: %v\n", err)
+			return err
+		}
+
+		fmt.Println("dms successfully updated")
+		return nil
+	}
+
 	var helper string
 	var updateCmd *exec.Cmd
 
@@ -454,11 +477,7 @@ func updateDMSBinary() error {
 
 	fmt.Printf("Installing to %s...\n", currentPath)
 
-	replaceCmd := exec.Command("sudo", "install", "-m", "0755", decompressedPath, currentPath)
-	replaceCmd.Stdin = os.Stdin
-	replaceCmd.Stdout = os.Stdout
-	replaceCmd.Stderr = os.Stderr
-	if err := replaceCmd.Run(); err != nil {
+	if err := privesc.Run(context.Background(), "", "install", "-m", "0755", decompressedPath, currentPath); err != nil {
 		return fmt.Errorf("failed to replace binary: %w", err)
 	}
 

core/cmd/dms/commands_setup.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 
@@ -11,14 +12,16 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/greeter"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
 	"github.com/spf13/cobra"
 )
 
 var setupCmd = &cobra.Command{
-	Use:   "setup",
-	Short: "Deploy DMS configurations",
-	Long:  "Deploy compositor and terminal configurations with interactive prompts",
+	Use:               "setup",
+	Short:             "Deploy DMS configurations",
+	Long:              "Deploy compositor and terminal configurations with interactive prompts",
+	PersistentPreRunE: preRunPrivileged,
 	Run: func(cmd *cobra.Command, args []string) {
 		if err := runSetup(); err != nil {
 			log.Fatalf("Error during setup: %v", err)
@@ -266,6 +269,8 @@ func runSetupDmsConfig(name string) error {
 func runSetup() error {
 	fmt.Println("=== DMS Configuration Setup ===")
 
+	ensureInputGroup()
+
 	wm, wmSelected := promptCompositor()
 	terminal, terminalSelected := promptTerminal()
 	useSystemd := promptSystemd()
@@ -339,6 +344,37 @@ func runSetup() error {
 	return nil
 }
 
+// Add user to the input group for the evdev manager for inut state tracking.
+// Caps Lock OSD and the Caps Lock bar indicator.
+func ensureInputGroup() {
+	if !utils.HasGroup("input") {
+		return
+	}
+	currentUser := os.Getenv("USER")
+	if currentUser == "" {
+		currentUser = os.Getenv("LOGNAME")
+	}
+	if currentUser == "" {
+		return
+	}
+	out, err := execGroups(currentUser)
+	if err == nil && strings.Contains(out, "input") {
+		fmt.Printf("✓ %s is already in the input group (Caps Lock OSD enabled)\n", currentUser)
+		return
+	}
+	fmt.Println("Adding user to input group for Caps Lock OSD support...")
+	if err := privesc.Run(context.Background(), "", "usermod", "-aG", "input", currentUser); err != nil {
+		fmt.Printf("⚠ Could not add %s to input group (Caps Lock OSD will be unavailable): %v\n", currentUser, err)
+	} else {
+		fmt.Printf("✓ Added %s to input group (logout/login required to take effect)\n", currentUser)
+	}
+}
+
+func execGroups(user string) (string, error) {
+	out, err := exec.Command("groups", user).Output()
+	return string(out), err
+}
+
 func promptCompositor() (deps.WindowManager, bool) {
 	fmt.Println("Select compositor:")
 	fmt.Println("1) Niri")

core/cmd/dms/immutable_policy.go

@@ -0,0 +1,285 @@
+package main
+
+import (
+	"bufio"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
+	"github.com/spf13/cobra"
+)
+
+const (
+	cliPolicyPackagedPath = "/usr/share/dms/cli-policy.json"
+	cliPolicyAdminPath    = "/etc/dms/cli-policy.json"
+)
+
+var (
+	immutablePolicyOnce sync.Once
+	immutablePolicy     immutableCommandPolicy
+	immutablePolicyErr  error
+)
+
+//go:embed assets/cli-policy.default.json
+var defaultCLIPolicyJSON []byte
+
+type immutableCommandPolicy struct {
+	ImmutableSystem bool
+	ImmutableReason string
+	BlockedCommands []string
+	Message         string
+}
+
+type cliPolicyFile struct {
+	PolicyVersion   int       `json:"policy_version"`
+	ImmutableSystem *bool     `json:"immutable_system"`
+	BlockedCommands *[]string `json:"blocked_commands"`
+	Message         *string   `json:"message"`
+}
+
+func normalizeCommandSpec(raw string) string {
+	normalized := strings.ToLower(strings.TrimSpace(raw))
+	normalized = strings.TrimPrefix(normalized, "dms ")
+	return strings.Join(strings.Fields(normalized), " ")
+}
+
+func normalizeBlockedCommands(raw []string) []string {
+	normalized := make([]string, 0, len(raw))
+	seen := make(map[string]bool)
+
+	for _, cmd := range raw {
+		spec := normalizeCommandSpec(cmd)
+		if spec == "" || seen[spec] {
+			continue
+		}
+		seen[spec] = true
+		normalized = append(normalized, spec)
+	}
+
+	return normalized
+}
+
+func commandBlockedByPolicy(commandPath string, blocked []string) bool {
+	normalizedPath := normalizeCommandSpec(commandPath)
+	if normalizedPath == "" {
+		return false
+	}
+
+	for _, entry := range blocked {
+		spec := normalizeCommandSpec(entry)
+		if spec == "" {
+			continue
+		}
+		if normalizedPath == spec || strings.HasPrefix(normalizedPath, spec+" ") {
+			return true
+		}
+	}
+
+	return false
+}
+
+func loadPolicyFile(path string) (*cliPolicyFile, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("failed to read %s: %w", path, err)
+	}
+
+	var policy cliPolicyFile
+	if err := json.Unmarshal(data, &policy); err != nil {
+		return nil, fmt.Errorf("failed to parse %s: %w", path, err)
+	}
+
+	return &policy, nil
+}
+
+func mergePolicyFile(base *immutableCommandPolicy, path string) error {
+	policyFile, err := loadPolicyFile(path)
+	if err != nil {
+		return err
+	}
+	if policyFile == nil {
+		return nil
+	}
+
+	if policyFile.ImmutableSystem != nil {
+		base.ImmutableSystem = *policyFile.ImmutableSystem
+	}
+	if policyFile.BlockedCommands != nil {
+		base.BlockedCommands = normalizeBlockedCommands(*policyFile.BlockedCommands)
+	}
+	if policyFile.Message != nil {
+		msg := strings.TrimSpace(*policyFile.Message)
+		if msg != "" {
+			base.Message = msg
+		}
+	}
+
+	return nil
+}
+
+func readOSReleaseMap(path string) map[string]string {
+	values := make(map[string]string)
+
+	file, err := os.Open(path)
+	if err != nil {
+		return values
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		parts := strings.SplitN(line, "=", 2)
+		if len(parts) != 2 {
+			continue
+		}
+		key := strings.ToUpper(strings.TrimSpace(parts[0]))
+		value := strings.Trim(strings.TrimSpace(parts[1]), "\"")
+		values[key] = strings.ToLower(value)
+	}
+
+	return values
+}
+
+func hasAnyToken(text string, tokens ...string) bool {
+	if text == "" {
+		return false
+	}
+	for _, token := range tokens {
+		if strings.Contains(text, token) {
+			return true
+		}
+	}
+	return false
+}
+
+func detectImmutableSystem() (bool, string) {
+	if _, err := os.Stat("/run/ostree-booted"); err == nil {
+		return true, "/run/ostree-booted is present"
+	}
+
+	osRelease := readOSReleaseMap("/etc/os-release")
+	if len(osRelease) == 0 {
+		return false, ""
+	}
+
+	id := osRelease["ID"]
+	idLike := osRelease["ID_LIKE"]
+	variantID := osRelease["VARIANT_ID"]
+	name := osRelease["NAME"]
+	prettyName := osRelease["PRETTY_NAME"]
+
+	immutableIDs := map[string]bool{
+		"bluefin":       true,
+		"bazzite":       true,
+		"silverblue":    true,
+		"kinoite":       true,
+		"sericea":       true,
+		"onyx":          true,
+		"aurora":        true,
+		"fedora-iot":    true,
+		"fedora-coreos": true,
+	}
+	if immutableIDs[id] {
+		return true, "os-release ID=" + id
+	}
+
+	markers := []string{"silverblue", "kinoite", "sericea", "onyx", "bazzite", "bluefin", "aurora", "ostree", "atomic"}
+	if hasAnyToken(variantID, markers...) {
+		return true, "os-release VARIANT_ID=" + variantID
+	}
+	if hasAnyToken(idLike, "ostree", "rpm-ostree") {
+		return true, "os-release ID_LIKE=" + idLike
+	}
+	if hasAnyToken(name, markers...) || hasAnyToken(prettyName, markers...) {
+		return true, "os-release identifies an atomic/ostree variant"
+	}
+
+	return false, ""
+}
+
+func getImmutablePolicy() (*immutableCommandPolicy, error) {
+	immutablePolicyOnce.Do(func() {
+		detectedImmutable, reason := detectImmutableSystem()
+		immutablePolicy = immutableCommandPolicy{
+			ImmutableSystem: detectedImmutable,
+			ImmutableReason: reason,
+			BlockedCommands: []string{"greeter install", "greeter enable", "setup"},
+			Message:         "This command is disabled on immutable/image-based systems. Use your distro-native workflow for system-level changes.",
+		}
+
+		var defaultPolicy cliPolicyFile
+		if err := json.Unmarshal(defaultCLIPolicyJSON, &defaultPolicy); err != nil {
+			immutablePolicyErr = fmt.Errorf("failed to parse embedded default CLI policy: %w", err)
+			return
+		}
+		if defaultPolicy.BlockedCommands != nil {
+			immutablePolicy.BlockedCommands = normalizeBlockedCommands(*defaultPolicy.BlockedCommands)
+		}
+		if defaultPolicy.Message != nil {
+			msg := strings.TrimSpace(*defaultPolicy.Message)
+			if msg != "" {
+				immutablePolicy.Message = msg
+			}
+		}
+
+		if err := mergePolicyFile(&immutablePolicy, cliPolicyPackagedPath); err != nil {
+			immutablePolicyErr = err
+			return
+		}
+		if err := mergePolicyFile(&immutablePolicy, cliPolicyAdminPath); err != nil {
+			immutablePolicyErr = err
+			return
+		}
+	})
+
+	if immutablePolicyErr != nil {
+		return nil, immutablePolicyErr
+	}
+	return &immutablePolicy, nil
+}
+
+func requireMutableSystemCommand(cmd *cobra.Command, _ []string) error {
+	policy, err := getImmutablePolicy()
+	if err != nil {
+		return err
+	}
+	if !policy.ImmutableSystem {
+		return nil
+	}
+
+	commandPath := normalizeCommandSpec(cmd.CommandPath())
+	if !commandBlockedByPolicy(commandPath, policy.BlockedCommands) {
+		return nil
+	}
+
+	reason := ""
+	if policy.ImmutableReason != "" {
+		reason = "Detected immutable system: " + policy.ImmutableReason + "\n"
+	}
+
+	return fmt.Errorf("%s%s\nCommand: dms %s\nPolicy files:\n  %s\n  %s", reason, policy.Message, commandPath, cliPolicyPackagedPath, cliPolicyAdminPath)
+}
+
+// preRunPrivileged combines the immutable-system check with a privesc tool
+// selection prompt (shown only when multiple tools are available and the
+// $DMS_PRIVESC env var isn't set).
+func preRunPrivileged(cmd *cobra.Command, args []string) error {
+	if err := requireMutableSystemCommand(cmd, args); err != nil {
+		return err
+	}
+	if _, err := privesc.PromptCLI(os.Stdout, os.Stdin); err != nil {
+		return err
+	}
+	return nil
+}

core/cmd/dms/main.go

@@ -5,6 +5,7 @@ package main
 import (
 	"os"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 )
 
@@ -16,19 +17,10 @@ func init() {
 	runCmd.Flags().Bool("session", false, "Session managed (like as a systemd unit)")
 	runCmd.Flags().MarkHidden("daemon-child")
 
-	// Add subcommands to greeter
-	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd)
-
-	// Add subcommands to setup
+	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
-
-	// Add subcommands to update
 	updateCmd.AddCommand(updateCheckCmd)
-
-	// Add subcommands to plugins
 	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
-
-	// Add common commands to root
 	rootCmd.AddCommand(getCommonCommands()...)
 
 	rootCmd.AddCommand(updateCmd)
@@ -37,7 +29,9 @@ func init() {
 }
 
 func main() {
-	if os.Geteuid() == 0 {
+	clipboard.MaybeServeAndExit()
+
+	if os.Geteuid() == 0 && !isReadOnlyCommand(os.Args) {
 		log.Fatal("This program should not be run as root. Exiting.")
 	}
 

core/cmd/dms/main_distro.go

@@ -5,36 +5,30 @@ package main
 import (
 	"os"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 )
 
 var Version = "dev"
 
 func init() {
-	// Add flags
 	runCmd.Flags().BoolP("daemon", "d", false, "Run in daemon mode")
 	runCmd.Flags().Bool("daemon-child", false, "Internal flag for daemon child process")
 	runCmd.Flags().Bool("session", false, "Session managed (like as a systemd unit)")
 	runCmd.Flags().MarkHidden("daemon-child")
 
-	// Add subcommands to greeter
-	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd)
-
-	// Add subcommands to setup
+	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
-
-	// Add subcommands to plugins
 	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
-
-	// Add common commands to root
 	rootCmd.AddCommand(getCommonCommands()...)
 
 	rootCmd.SetHelpTemplate(getHelpTemplate())
 }
 
 func main() {
-	// Block root
-	if os.Geteuid() == 0 {
+	clipboard.MaybeServeAndExit()
+
+	if os.Geteuid() == 0 && !isReadOnlyCommand(os.Args) {
 		log.Fatal("This program should not be run as root. Exiting.")
 	}
 

core/cmd/dms/shell.go

@@ -616,6 +616,43 @@ func getShellIPCCompletions(args []string, _ string) []string {
 	return nil
 }
 
+func getFirstDMSPID() (int, bool) {
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return 0, false
+	}
+
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), "danklinux-") || !strings.HasSuffix(entry.Name(), ".pid") {
+			continue
+		}
+
+		data, err := os.ReadFile(filepath.Join(dir, entry.Name()))
+		if err != nil {
+			continue
+		}
+
+		pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+		if err != nil {
+			continue
+		}
+
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			continue
+		}
+
+		if proc.Signal(syscall.Signal(0)) != nil {
+			continue
+		}
+
+		return pid, true
+	}
+
+	return 0, false
+}
+
 func runShellIPCCommand(args []string) {
 	if len(args) == 0 {
 		printIPCHelp()
@@ -627,10 +664,21 @@ func runShellIPCCommand(args []string) {
 	}
 
 	cmdArgs := []string{"ipc"}
-	if qsHasAnyDisplay() {
-		cmdArgs = append(cmdArgs, "--any-display")
+
+	switch pid, ok := getFirstDMSPID(); {
+	case ok:
+		cmdArgs = append(cmdArgs, "--pid", strconv.Itoa(pid))
+	default:
+		if err := findConfig(nil, nil); err != nil {
+			log.Fatalf("Error finding config: %v", err)
+		}
+		// ! TODO - remove check when QS 0.3 is released
+		if qsHasAnyDisplay() {
+			cmdArgs = append(cmdArgs, "--any-display")
+		}
+		cmdArgs = append(cmdArgs, "-p", configPath)
 	}
-	cmdArgs = append(cmdArgs, "-p", configPath)
+
 	cmdArgs = append(cmdArgs, args...)
 	cmd := exec.Command("qs", cmdArgs...)
 	cmd.Stdin = os.Stdin

core/cmd/dms/utils.go

@@ -7,12 +7,20 @@ import (
 	"strings"
 )
 
-func findCommandPath(cmd string) (string, error) {
-	path, err := exec.LookPath(cmd)
-	if err != nil {
-		return "", fmt.Errorf("command '%s' not found in PATH", cmd)
+// isReadOnlyCommand returns true if the CLI args indicate a command that is
+// safe to run as root (e.g. shell completion, help).
+func isReadOnlyCommand(args []string) bool {
+	for _, arg := range args[1:] {
+		if strings.HasPrefix(arg, "-") {
+			continue
+		}
+		switch arg {
+		case "completion", "help", "__complete":
+			return true
+		}
+		return false
 	}
-	return path, nil
+	return false
 }
 
 func isArchPackageInstalled(packageName string) bool {

core/internal/blur/probe.go

@@ -0,0 +1,35 @@
+package blur
+
+import (
+	wlhelpers "github.com/AvengeMedia/DankMaterialShell/core/internal/wayland/client"
+	client "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
+)
+
+const extBackgroundEffectInterface = "ext_background_effect_manager_v1"
+
+func ProbeSupport() (bool, error) {
+	display, err := client.Connect("")
+	if err != nil {
+		return false, err
+	}
+	defer display.Context().Close()
+
+	registry, err := display.GetRegistry()
+	if err != nil {
+		return false, err
+	}
+
+	found := false
+	registry.SetGlobalHandler(func(e client.RegistryGlobalEvent) {
+		switch e.Interface {
+		case extBackgroundEffectInterface:
+			found = true
+		}
+	})
+
+	if err := wlhelpers.Roundtrip(display, display.Context()); err != nil {
+		return false, err
+	}
+
+	return found, nil
+}

core/internal/clipboard/clipboard.go

@@ -1,7 +1,6 @@
 package clipboard
 
 import (
-	"bytes"
 	"fmt"
 	"io"
 	"os"
@@ -13,100 +12,166 @@ import (
 	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
 
+const envServe = "_DMS_CLIPBOARD_SERVE"
+const envMime = "_DMS_CLIPBOARD_MIME"
+const envPasteOnce = "_DMS_CLIPBOARD_PASTE_ONCE"
+const envCacheFile = "_DMS_CLIPBOARD_CACHE"
+
+// MaybeServeAndExit intercepts before cobra when re-exec'd as a clipboard
+// child. Reads source data into memory, deletes any cache file, then serves.
+func MaybeServeAndExit() {
+	if os.Getenv(envServe) == "" {
+		return
+	}
+
+	mimeType := os.Getenv(envMime)
+	pasteOnce := os.Getenv(envPasteOnce) == "1"
+	cachePath := os.Getenv(envCacheFile)
+
+	var data []byte
+	var err error
+
+	switch {
+	case cachePath != "":
+		data, err = os.ReadFile(cachePath)
+		os.Remove(cachePath)
+	default:
+		data, err = io.ReadAll(os.Stdin)
+	}
+
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "clipboard: read source: %v\n", err)
+		os.Exit(1)
+	}
+
+	if err := serveClipboard(data, mimeType, pasteOnce); err != nil {
+		fmt.Fprintf(os.Stderr, "clipboard: serve: %v\n", err)
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+
 func Copy(data []byte, mimeType string) error {
-	return CopyReader(bytes.NewReader(data), mimeType, false, false)
+	return copyForkCached(data, mimeType, false)
 }
 
 func CopyOpts(data []byte, mimeType string, foreground, pasteOnce bool) error {
 	if foreground {
-		return copyServeWithWriter(func(writer io.Writer) error {
-			total := 0
-			for total < len(data) {
-				n, err := writer.Write(data[total:])
-				total += n
-				if err != nil {
-					return err
-				}
-			}
-			if total != len(data) {
-				return io.ErrShortWrite
-			}
-			return nil
-		}, mimeType, pasteOnce)
+		return serveClipboard(data, mimeType, pasteOnce)
 	}
-	return CopyReader(bytes.NewReader(data), mimeType, foreground, pasteOnce)
+	return copyForkCached(data, mimeType, pasteOnce)
 }
 
 func CopyReader(data io.Reader, mimeType string, foreground, pasteOnce bool) error {
-	if !foreground {
-		return copyFork(data, mimeType, pasteOnce)
+	if foreground {
+		buf, err := io.ReadAll(data)
+		if err != nil {
+			return fmt.Errorf("read source: %w", err)
+		}
+		return serveClipboard(buf, mimeType, pasteOnce)
 	}
-	return copyServeReader(data, mimeType, pasteOnce)
+	return copyFork(data, mimeType, pasteOnce)
 }
 
-func copyFork(data io.Reader, mimeType string, pasteOnce bool) error {
-	args := []string{os.Args[0], "cl", "copy", "--foreground"}
-	if pasteOnce {
-		args = append(args, "--paste-once")
-	}
-	args = append(args, "--type", mimeType)
-
-	cmd := exec.Command(args[0], args[1:]...)
-	cmd.Stdout = nil
+func newForkCmd(mimeType string, pasteOnce bool, extra ...string) *exec.Cmd {
+	cmd := exec.Command(os.Args[0])
 	cmd.Stderr = nil
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
-
-	if stdinSource, ok := data.(*os.File); ok {
-		cmd.Stdin = stdinSource
-		return cmd.Start()
+	cmd.Env = append(os.Environ(),
+		envServe+"=1",
+		envMime+"="+mimeType,
+	)
+	if pasteOnce {
+		cmd.Env = append(cmd.Env, envPasteOnce+"=1")
 	}
+	cmd.Env = append(cmd.Env, extra...)
+	return cmd
+}
 
-	stdin, err := cmd.StdinPipe()
+func waitReady(cmd *exec.Cmd) error {
+	stdout, err := cmd.StdoutPipe()
 	if err != nil {
-		return fmt.Errorf("stdin pipe: %w", err)
+		return fmt.Errorf("stdout pipe: %w", err)
 	}
-
 	if err := cmd.Start(); err != nil {
 		return fmt.Errorf("start: %w", err)
 	}
-
-	if _, err := io.Copy(stdin, data); err != nil {
-		stdin.Close()
-		return fmt.Errorf("write stdin: %w", err)
+	var buf [1]byte
+	if _, err := stdout.Read(buf[:]); err != nil {
+		return fmt.Errorf("waiting for clipboard ready: %w", err)
 	}
-	if err := stdin.Close(); err != nil {
-		return fmt.Errorf("close stdin: %w", err)
-	}
-
 	return nil
 }
 
-func copyServeReader(data io.Reader, mimeType string, pasteOnce bool) error {
-	cachedData, err := createClipboardCacheFile()
+func copyForkCached(data []byte, mimeType string, pasteOnce bool) error {
+	cacheFile, err := createClipboardCacheFile()
 	if err != nil {
-		return fmt.Errorf("create clipboard cache file: %w", err)
+		return fmt.Errorf("create cache file: %w", err)
 	}
-	defer os.Remove(cachedData.Name())
+	cachePath := cacheFile.Name()
 
-	if _, err := io.Copy(cachedData, data); err != nil {
-		return fmt.Errorf("cache clipboard data: %w", err)
+	if _, err := cacheFile.Write(data); err != nil {
+		cacheFile.Close()
+		os.Remove(cachePath)
+		return fmt.Errorf("write cache file: %w", err)
 	}
-	if err := cachedData.Close(); err != nil {
-		return fmt.Errorf("close temp cache file: %w", err)
+	if err := cacheFile.Close(); err != nil {
+		os.Remove(cachePath)
+		return fmt.Errorf("close cache file: %w", err)
 	}
 
-	return copyServeWithWriter(func(writer io.Writer) error {
-		cachedFile, err := os.Open(cachedData.Name())
+	cmd := newForkCmd(mimeType, pasteOnce, envCacheFile+"="+cachePath)
+	cmd.Stdin = nil
+	if err := waitReady(cmd); err != nil {
+		os.Remove(cachePath)
+		return err
+	}
+	return nil
+}
+
+func copyFork(data io.Reader, mimeType string, pasteOnce bool) error {
+	cmd := newForkCmd(mimeType, pasteOnce)
+
+	switch src := data.(type) {
+	case *os.File:
+		cmd.Stdin = src
+		return waitReady(cmd)
+
+	default:
+		stdin, err := cmd.StdinPipe()
 		if err != nil {
-			return fmt.Errorf("open temp cache file: %w", err)
+			return fmt.Errorf("stdin pipe: %w", err)
 		}
-		defer cachedFile.Close()
 
-		if _, err := io.Copy(writer, cachedFile); err != nil {
-			return fmt.Errorf("write clipboard data: %w", err)
+		stdout, err := cmd.StdoutPipe()
+		if err != nil {
+			return fmt.Errorf("stdout pipe: %w", err)
+		}
+
+		if err := cmd.Start(); err != nil {
+			return fmt.Errorf("start: %w", err)
+		}
+		if _, err := io.Copy(stdin, data); err != nil {
+			stdin.Close()
+			return fmt.Errorf("write stdin: %w", err)
+		}
+		if err := stdin.Close(); err != nil {
+			return fmt.Errorf("close stdin: %w", err)
+		}
+
+		var buf [1]byte
+		if _, err := stdout.Read(buf[:]); err != nil {
+			return fmt.Errorf("waiting for clipboard ready: %w", err)
 		}
 		return nil
-	}, mimeType, pasteOnce)
+	}
+}
+
+func signalReady() {
+	if os.Getenv(envServe) == "" {
+		return
+	}
+	os.Stdout.Write([]byte{1})
 }
 
 func createClipboardCacheFile() (*os.File, error) {
@@ -129,7 +194,7 @@ func createClipboardCacheFile() (*os.File, error) {
 	return os.CreateTemp("", "dms-clipboard-*")
 }
 
-func copyServeWithWriter(writeTo func(io.Writer) error, mimeType string, pasteOnce bool) error {
+func serveClipboard(data []byte, mimeType string, pasteOnce bool) error {
 	display, err := wlclient.Connect("")
 	if err != nil {
 		return fmt.Errorf("wayland connect: %w", err)
@@ -171,12 +236,10 @@ func copyServeWithWriter(writeTo func(io.Writer) error, mimeType string, pasteOn
 	if bindErr != nil {
 		return fmt.Errorf("registry bind: %w", bindErr)
 	}
-
 	if dataControlMgr == nil {
 		return fmt.Errorf("compositor does not support ext_data_control_manager_v1")
 	}
 	defer dataControlMgr.Destroy()
-
 	if seat == nil {
 		return fmt.Errorf("no seat available")
 	}
@@ -215,18 +278,12 @@ func copyServeWithWriter(writeTo func(io.Writer) error, mimeType string, pasteOn
 
 	cancelled := make(chan struct{})
 	pasted := make(chan struct{}, 1)
-	sendErr := make(chan error, 1)
 
 	source.SetSendHandler(func(e ext_data_control.ExtDataControlSourceV1SendEvent) {
-		defer syscall.Close(e.Fd)
+		_ = syscall.SetNonblock(e.Fd, false)
 		file := os.NewFile(uintptr(e.Fd), "pipe")
 		defer file.Close()
-		if err := writeTo(file); err != nil {
-			select {
-			case sendErr <- err:
-			default:
-			}
-		}
+		_, _ = file.Write(data)
 		select {
 		case pasted <- struct{}{}:
 		default:
@@ -242,13 +299,12 @@ func copyServeWithWriter(writeTo func(io.Writer) error, mimeType string, pasteOn
 	}
 
 	display.Roundtrip()
+	signalReady()
 
 	for {
 		select {
 		case <-cancelled:
 			return nil
-		case err := <-sendErr:
-			return err
 		case <-pasted:
 			if pasteOnce {
 				return nil
@@ -502,12 +558,10 @@ func copyMultiServe(offers []Offer, pasteOnce bool) error {
 	if bindErr != nil {
 		return fmt.Errorf("registry bind: %w", bindErr)
 	}
-
 	if dataControlMgr == nil {
 		return fmt.Errorf("compositor does not support ext_data_control_manager_v1")
 	}
 	defer dataControlMgr.Destroy()
-
 	if seat == nil {
 		return fmt.Errorf("no seat available")
 	}
@@ -535,12 +589,12 @@ func copyMultiServe(offers []Offer, pasteOnce bool) error {
 	pasted := make(chan struct{}, 1)
 
 	source.SetSendHandler(func(e ext_data_control.ExtDataControlSourceV1SendEvent) {
-		defer syscall.Close(e.Fd)
+		_ = syscall.SetNonblock(e.Fd, false)
 		file := os.NewFile(uintptr(e.Fd), "pipe")
 		defer file.Close()
 
 		if data, ok := offerMap[e.MimeType]; ok {
-			file.Write(data)
+			_, _ = file.Write(data)
 		}
 
 		select {

core/internal/config/embedded/hypr-binds.conf

@@ -137,7 +137,7 @@ bind = SUPER, bracketright, layoutmsg, preselect r
 
 # === Sizing & Layout ===
 bind = SUPER, R, layoutmsg, togglesplit
-bind = SUPER CTRL, F, resizeactive, exact 100%
+bind = SUPER CTRL, F, resizeactive, exact 100% 100%
 
 # === Move/resize windows with mainMod + LMB/RMB and dragging ===
 bindmd = SUPER, mouse:272, Move window, movewindow

core/internal/config/embedded/hyprland.conf

@@ -94,6 +94,7 @@ windowrule = tile on, match:class ^(gnome-control-center)$
 windowrule = tile on, match:class ^(pavucontrol)$
 windowrule = tile on, match:class ^(nm-connection-editor)$
 
+windowrule = float on, match:class ^(org\.gnome\.Calculator)$
 windowrule = float on, match:class ^(gnome-calculator)$
 windowrule = float on, match:class ^(galculator)$
 windowrule = float on, match:class ^(blueman-manager)$

core/internal/config/embedded/niri.kdl

@@ -224,6 +224,7 @@ window-rule {
     open-floating false
 }
 window-rule {
+    match app-id=r#"^org\.gnome\.Calculator$"#
     match app-id=r#"^gnome-calculator$"#
     match app-id=r#"^galculator$"#
     match app-id=r#"^blueman-manager$"#
@@ -252,6 +253,7 @@ window-rule {
 // Open dms windows as floating by default
 window-rule {
     match app-id=r#"org.quickshell$"#
+    match app-id=r#"com.danklinux.dms$"#
     open-floating true
 }
 debug {

core/internal/distros/arch.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 func init() {
@@ -135,6 +136,42 @@ func (a *ArchDistribution) packageInstalled(pkg string) bool {
 	return err == nil
 }
 
+// parseSRCINFODeps reads a .SRCINFO file and returns runtime dep and makedep package
+func parseSRCINFODeps(srcinfoPath string) (deps []string, makedeps []string, err error) {
+	data, err := os.ReadFile(srcinfoPath)
+	if err != nil {
+		return nil, nil, err
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		line = strings.TrimSpace(line)
+		var pkg string
+		var target *[]string
+		switch {
+		case strings.HasPrefix(line, "makedepends = "):
+			pkg = strings.TrimPrefix(line, "makedepends = ")
+			target = &makedeps
+		case strings.HasPrefix(line, "depends = "):
+			pkg = strings.TrimPrefix(line, "depends = ")
+			target = &deps
+		default:
+			continue
+		}
+		// Strip version constraint (>=, <=, >, <, =) and colon-descriptions
+		if idx := strings.IndexAny(pkg, "><:="); idx >= 0 {
+			pkg = pkg[:idx]
+		}
+		pkg = strings.TrimSpace(pkg)
+		if pkg != "" {
+			*target = append(*target, pkg)
+		}
+	}
+	return deps, makedeps, nil
+}
+
+func (a *ArchDistribution) isInSystemRepo(pkg string) bool {
+	return exec.Command("pacman", "-Si", pkg).Run() == nil
+}
+
 func (a *ArchDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
 	return a.GetPackageMappingWithVariants(wm, make(map[string]deps.PackageVariant))
 }
@@ -206,11 +243,7 @@ func (a *ArchDistribution) getDMSMapping(variant deps.PackageVariant) PackageMap
 		return PackageMapping{Name: "dms-shell-git", Repository: RepoTypeAUR}
 	}
 
-	if a.packageInstalled("dms-shell-bin") {
-		return PackageMapping{Name: "dms-shell-bin", Repository: RepoTypeAUR}
-	}
-
-	return PackageMapping{Name: "dms-shell-bin", Repository: RepoTypeAUR}
+	return PackageMapping{Name: "dms-shell", Repository: RepoTypeSystem}
 }
 
 func (a *ArchDistribution) detectXwaylandSatellite() deps.Dependency {
@@ -260,7 +293,7 @@ func (a *ArchDistribution) InstallPrerequisites(ctx context.Context, sudoPasswor
 		LogOutput:   "Installing base-devel development tools",
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, "pacman -S --needed --noconfirm base-devel")
+	cmd := privesc.ExecCommand(ctx, sudoPassword, "pacman -S --needed --noconfirm base-devel")
 	if err := a.runWithProgress(cmd, progressChan, PhasePrerequisites, 0.08, 0.10); err != nil {
 		return fmt.Errorf("failed to install base-devel: %w", err)
 	}
@@ -292,6 +325,13 @@ func (a *ArchDistribution) InstallPackages(ctx context.Context, dependencies []d
 
 	systemPkgs, aurPkgs, manualPkgs, variantMap := a.categorizePackages(dependencies, wm, reinstallFlags, disabledFlags)
 
+	if slices.Contains(aurPkgs, "quickshell-git") && slices.Contains(systemPkgs, "dms-shell") {
+		if err := a.preinstallQuickshellGit(ctx, sudoPassword, progressChan); err != nil {
+			return fmt.Errorf("failed to preinstall quickshell-git: %w", err)
+		}
+		aurPkgs = slices.DeleteFunc(aurPkgs, func(p string) bool { return p == "quickshell-git" })
+	}
+
 	// Phase 3: System Packages
 	if len(systemPkgs) > 0 {
 		progressChan <- InstallProgressMsg{
@@ -409,6 +449,37 @@ func (a *ArchDistribution) categorizePackages(dependencies []deps.Dependency, wm
 	return systemPkgs, aurPkgs, manualPkgs, variantMap
 }
 
+func (a *ArchDistribution) preinstallQuickshellGit(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+	if a.packageInstalled("quickshell-git") {
+		return nil
+	}
+
+	if a.packageInstalled("quickshell") {
+		progressChan <- InstallProgressMsg{
+			Phase:       PhaseAURPackages,
+			Progress:    0.15,
+			Step:        "Removing stable quickshell...",
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: "sudo pacman -Rdd --noconfirm quickshell",
+			LogOutput:   "Removing stable quickshell so quickshell-git can be installed",
+		}
+		cmd := privesc.ExecCommand(ctx, sudoPassword, "pacman -Rdd --noconfirm quickshell")
+		if err := a.runWithProgress(cmd, progressChan, PhaseAURPackages, 0.15, 0.18); err != nil {
+			return fmt.Errorf("failed to remove stable quickshell: %w", err)
+		}
+	}
+
+	progressChan <- InstallProgressMsg{
+		Phase:       PhaseAURPackages,
+		Progress:    0.18,
+		Step:        "Building quickshell-git before system packages...",
+		IsComplete:  false,
+		CommandInfo: "Installing quickshell-git ahead of dms-shell to avoid conflict",
+	}
+	return a.installSingleAURPackage(ctx, "quickshell-git", sudoPassword, progressChan, 0.18, 0.32)
+}
+
 func (a *ArchDistribution) installSystemPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	if len(packages) == 0 {
 		return nil
@@ -417,6 +488,9 @@ func (a *ArchDistribution) installSystemPackages(ctx context.Context, packages [
 	a.log(fmt.Sprintf("Installing system packages: %s", strings.Join(packages, ", ")))
 
 	args := []string{"pacman", "-S", "--needed", "--noconfirm"}
+	if slices.Contains(packages, "dms-shell") {
+		args = append(args, "--assume-installed", "dms-shell-compositor=1")
+	}
 	args = append(args, packages...)
 
 	progressChan <- InstallProgressMsg{
@@ -428,7 +502,7 @@ func (a *ArchDistribution) installSystemPackages(ctx context.Context, packages [
 		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	return a.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
 }
 
@@ -504,7 +578,7 @@ func (a *ArchDistribution) reorderAURPackages(packages []string) []string {
 	var dmsShell []string
 
 	for _, pkg := range packages {
-		if pkg == "dms-shell-git" || pkg == "dms-shell-bin" {
+		if pkg == "dms-shell-git" {
 			dmsShell = append(dmsShell, pkg)
 		} else {
 			isDep := false
@@ -524,6 +598,16 @@ func (a *ArchDistribution) reorderAURPackages(packages []string) []string {
 }
 
 func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sudoPassword string, progressChan chan<- InstallProgressMsg, startProgress, endProgress float64) error {
+	return a.installSingleAURPackageInternal(ctx, pkg, sudoPassword, progressChan, startProgress, endProgress, make(map[string]bool))
+}
+
+func (a *ArchDistribution) installSingleAURPackageInternal(ctx context.Context, pkg, sudoPassword string, progressChan chan<- InstallProgressMsg, startProgress, endProgress float64, visited map[string]bool) error {
+	if visited[pkg] {
+		a.log(fmt.Sprintf("Skipping %s (already being installed, cycle detected)", pkg))
+		return nil
+	}
+	visited[pkg] = true
+
 	homeDir, err := os.UserHomeDir()
 	if err != nil {
 		return fmt.Errorf("failed to get user home directory: %w", err)
@@ -575,7 +659,7 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 		}
 	}
 
-	if pkg == "dms-shell-git" || pkg == "dms-shell-bin" {
+	if pkg == "dms-shell-git" {
 		srcinfoPath := filepath.Join(packageDir, ".SRCINFO")
 		depsToRemove := []string{
 			"depends = quickshell",
@@ -598,51 +682,65 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 	}
 
 	srcinfoPath = filepath.Join(packageDir, ".SRCINFO")
-	if pkg == "dms-shell-bin" {
-		progressChan <- InstallProgressMsg{
-			Phase:      PhaseAURPackages,
-			Progress:   startProgress + 0.35*(endProgress-startProgress),
-			Step:       fmt.Sprintf("Skipping dependency installation for %s (manually managed)...", pkg),
-			IsComplete: false,
-			LogOutput:  fmt.Sprintf("Dependencies for %s are installed separately", pkg),
-		}
-	} else {
+	{
 		progressChan <- InstallProgressMsg{
 			Phase:       PhaseAURPackages,
 			Progress:    startProgress + 0.3*(endProgress-startProgress),
-			Step:        fmt.Sprintf("Installing dependencies for %s...", pkg),
+			Step:        fmt.Sprintf("Resolving dependencies for %s...", pkg),
 			IsComplete:  false,
-			CommandInfo: "Installing package dependencies and makedepends",
+			CommandInfo: "Classifying dependencies as system or AUR",
 		}
 
-		// Install dependencies from .SRCINFO
-		depFilter := ""
-		if pkg == "dms-shell-git" {
-			depFilter = ` | sed -E 's/[[:space:]]*(quickshell|dgop)[[:space:]]*/ /g' | tr -s ' '`
+		runtimeDeps, makeDeps, err := parseSRCINFODeps(srcinfoPath)
+		if err != nil {
+			return fmt.Errorf("failed to parse .SRCINFO for %s: %w", pkg, err)
 		}
 
-		depsCmd := exec.CommandContext(ctx, "bash", "-c",
-			fmt.Sprintf(`
-				deps=$(grep "depends = " "%s" | grep -v "makedepends" | sed 's/.*depends = //' | tr '\n' ' ' %s | sed 's/[[:space:]]*$//')
-				if [ ! -z "$deps" ] && [ "$deps" != " " ]; then
-					echo '%s' | sudo -S pacman -S --needed --noconfirm $deps
-				fi
-				`, srcinfoPath, depFilter, sudoPassword))
+		seen := make(map[string]bool)
+		var systemPkgs []string
+		var aurPkgs []string
 
-		if err := a.runWithProgress(depsCmd, progressChan, PhaseAURPackages, startProgress+0.3*(endProgress-startProgress), startProgress+0.35*(endProgress-startProgress)); err != nil {
-			return fmt.Errorf("FAILED to install runtime dependencies for %s: %w", pkg, err)
+		for _, dep := range append(runtimeDeps, makeDeps...) {
+			if seen[dep] || a.packageInstalled(dep) {
+				continue
+			}
+			seen[dep] = true
+			if a.isInSystemRepo(dep) {
+				systemPkgs = append(systemPkgs, dep)
+			} else {
+				aurPkgs = append(aurPkgs, dep)
+			}
 		}
 
-		makedepsCmd := exec.CommandContext(ctx, "bash", "-c",
-			fmt.Sprintf(`
-				makedeps=$(grep -E "^[[:space:]]*makedepends = " "%s" | sed 's/^[[:space:]]*makedepends = //' | tr '\n' ' ')
-				if [ ! -z "$makedeps" ]; then
-					echo '%s' | sudo -S pacman -S --needed --noconfirm $makedeps
-				fi
-			`, srcinfoPath, sudoPassword))
+		if len(systemPkgs) > 0 {
+			progressChan <- InstallProgressMsg{
+				Phase:       PhaseAURPackages,
+				Progress:    startProgress + 0.32*(endProgress-startProgress),
+				Step:        fmt.Sprintf("Installing %d system dependencies for %s...", len(systemPkgs), pkg),
+				IsComplete:  false,
+				CommandInfo: fmt.Sprintf("sudo pacman -S --needed --noconfirm %s", strings.Join(systemPkgs, " ")),
+			}
+			if err := a.installSystemPackages(ctx, systemPkgs, sudoPassword, progressChan); err != nil {
+				return fmt.Errorf("failed to install system dependencies for %s: %w", pkg, err)
+			}
+		}
 
-		if err := a.runWithProgress(makedepsCmd, progressChan, PhaseAURPackages, startProgress+0.35*(endProgress-startProgress), startProgress+0.4*(endProgress-startProgress)); err != nil {
-			return fmt.Errorf("FAILED to install make dependencies for %s: %w", pkg, err)
+		for _, aurDep := range aurPkgs {
+			a.log(fmt.Sprintf("Dependency %s is AUR-only, building from source...", aurDep))
+			progressChan <- InstallProgressMsg{
+				Phase:       PhaseAURPackages,
+				Progress:    startProgress + 0.35*(endProgress-startProgress),
+				Step:        fmt.Sprintf("Installing AUR dependency %s for %s...", aurDep, pkg),
+				IsComplete:  false,
+				CommandInfo: fmt.Sprintf("Building AUR dependency: %s", aurDep),
+			}
+			if err := a.installSingleAURPackageInternal(ctx, aurDep, sudoPassword, progressChan,
+				startProgress+0.35*(endProgress-startProgress),
+				startProgress+0.39*(endProgress-startProgress),
+				visited,
+			); err != nil {
+				return fmt.Errorf("failed to install AUR dependency %s for %s: %w", aurDep, pkg, err)
+			}
 		}
 	}
 
@@ -671,42 +769,9 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 		CommandInfo: "sudo pacman -U built-package",
 	}
 
-	// Find .pkg.tar* files - for split packages, install the base and any installed compositor variants
 	var files []string
-	if pkg == "dms-shell-git" || pkg == "dms-shell-bin" {
-		// For DMS split packages, install base package
-		pattern := filepath.Join(packageDir, fmt.Sprintf("%s-%s*.pkg.tar*", pkg, "*"))
-		matches, err := filepath.Glob(pattern)
-		if err == nil {
-			for _, match := range matches {
-				basename := filepath.Base(match)
-				// Always include base package
-				if !strings.Contains(basename, "hyprland") && !strings.Contains(basename, "niri") {
-					files = append(files, match)
-				}
-			}
-		}
-
-		// Also update compositor-specific packages if they're installed
-		if strings.HasSuffix(pkg, "-git") {
-			if a.packageInstalled("dms-shell-hyprland-git") {
-				hyprlandPattern := filepath.Join(packageDir, "dms-shell-hyprland-git-*.pkg.tar*")
-				if hyprlandMatches, err := filepath.Glob(hyprlandPattern); err == nil && len(hyprlandMatches) > 0 {
-					files = append(files, hyprlandMatches[0])
-				}
-			}
-			if a.packageInstalled("dms-shell-niri-git") {
-				niriPattern := filepath.Join(packageDir, "dms-shell-niri-git-*.pkg.tar*")
-				if niriMatches, err := filepath.Glob(niriPattern); err == nil && len(niriMatches) > 0 {
-					files = append(files, niriMatches[0])
-				}
-			}
-		}
-	} else {
-		// For other packages, install all built packages
-		matches, _ := filepath.Glob(filepath.Join(packageDir, "*.pkg.tar*"))
-		files = matches
-	}
+	matches, _ := filepath.Glob(filepath.Join(packageDir, "*.pkg.tar*"))
+	files = matches
 
 	if len(files) == 0 {
 		return fmt.Errorf("no package files found after building %s", pkg)
@@ -715,7 +780,7 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 	installArgs := []string{"pacman", "-U", "--noconfirm"}
 	installArgs = append(installArgs, files...)
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(installArgs, " "))
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(installArgs, " "))
 
 	fileNames := make([]string, len(files))
 	for i, f := range files {

core/internal/distros/base.go

@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/version"
 )
 
@@ -55,27 +56,6 @@ func (b *BaseDistribution) logError(message string, err error) {
 	b.log(errorMsg)
 }
 
-// escapeSingleQuotes escapes single quotes in a string for safe use in bash single-quoted strings.
-// It replaces each ' with '\” which closes the quote, adds an escaped quote, and reopens the quote.
-// This prevents shell injection and syntax errors when passwords contain single quotes or apostrophes.
-func escapeSingleQuotes(s string) string {
-	return strings.ReplaceAll(s, "'", "'\\''")
-}
-
-// MakeSudoCommand creates a command string that safely passes password to sudo.
-// This helper escapes special characters in the password to prevent shell injection
-// and syntax errors when passwords contain single quotes, apostrophes, or other special chars.
-func MakeSudoCommand(sudoPassword string, command string) string {
-	return fmt.Sprintf("echo '%s' | sudo -S %s", escapeSingleQuotes(sudoPassword), command)
-}
-
-// ExecSudoCommand creates an exec.Cmd that runs a command with sudo using the provided password.
-// The password is properly escaped to prevent shell injection and syntax errors.
-func ExecSudoCommand(ctx context.Context, sudoPassword string, command string) *exec.Cmd {
-	cmdStr := MakeSudoCommand(sudoPassword, command)
-	return exec.CommandContext(ctx, "bash", "-c", cmdStr)
-}
-
 func (b *BaseDistribution) detectCommand(name, description string) deps.Dependency {
 	status := deps.StatusMissing
 	if b.commandExists(name) {
@@ -710,7 +690,7 @@ func (b *BaseDistribution) installDMSBinary(ctx context.Context, sudoPassword st
 	}
 
 	// Install to /usr/local/bin
-	installCmd := ExecSudoCommand(ctx, sudoPassword,
+	installCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("cp %s /usr/local/bin/dms", binaryPath))
 	if err := installCmd.Run(); err != nil {
 		return fmt.Errorf("failed to install DMS binary: %w", err)

core/internal/distros/debian.go

@@ -4,10 +4,10 @@ import (
 	"context"
 	"fmt"
 	"os/exec"
-	"runtime"
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 func init() {
@@ -92,9 +92,36 @@ func (d *DebianDistribution) detectDMSGreeter() deps.Dependency {
 }
 
 func (d *DebianDistribution) packageInstalled(pkg string) bool {
-	cmd := exec.Command("dpkg", "-l", pkg)
-	err := cmd.Run()
-	return err == nil
+	return debianPackageInstalledPrecisely(pkg)
+}
+
+func debianPackageInstalledPrecisely(pkg string) bool {
+	cmd := exec.Command("dpkg-query", "-W", "-f=${db:Status-Status}", pkg)
+	output, err := cmd.Output()
+	if err != nil {
+		return false
+	}
+	return strings.TrimSpace(string(output)) == "installed"
+}
+
+func containsString(values []string, target string) bool {
+	for _, value := range values {
+		if value == target {
+			return true
+		}
+	}
+	return false
+}
+
+func debianRepoArchitecture(arch string) string {
+	switch arch {
+	case "amd64", "x86_64":
+		return "amd64"
+	case "arm64", "aarch64":
+		return "arm64"
+	default:
+		return arch
+	}
 }
 
 func (d *DebianDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
@@ -165,7 +192,7 @@ func (d *DebianDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		LogOutput:  "Updating APT package lists",
 	}
 
-	updateCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get update")
+	updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
 	if err := d.runWithProgress(updateCmd, progressChan, PhasePrerequisites, 0.06, 0.07); err != nil {
 		return fmt.Errorf("failed to update package lists: %w", err)
 	}
@@ -182,7 +209,7 @@ func (d *DebianDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 
 	checkCmd := exec.CommandContext(ctx, "dpkg", "-l", "build-essential")
 	if err := checkCmd.Run(); err != nil {
-		cmd := ExecSudoCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y build-essential")
+		cmd := privesc.ExecCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y build-essential")
 		if err := d.runWithProgress(cmd, progressChan, PhasePrerequisites, 0.08, 0.09); err != nil {
 			return fmt.Errorf("failed to install build-essential: %w", err)
 		}
@@ -194,12 +221,12 @@ func (d *DebianDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		Step:        "Installing development dependencies...",
 		IsComplete:  false,
 		NeedsSudo:   true,
-		CommandInfo: "sudo apt-get install -y curl wget git cmake ninja-build pkg-config libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev",
+		CommandInfo: "sudo apt-get install -y curl wget git cmake ninja-build pkg-config gnupg libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev",
 		LogOutput:   "Installing additional development tools",
 	}
 
-	devToolsCmd := ExecSudoCommand(ctx, sudoPassword,
-		"DEBIAN_FRONTEND=noninteractive apt-get install -y curl wget git cmake ninja-build pkg-config libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev libjpeg-dev libpugixml-dev")
+	devToolsCmd := privesc.ExecCommand(ctx, sudoPassword,
+		"DEBIAN_FRONTEND=noninteractive apt-get install -y curl wget git cmake ninja-build pkg-config gnupg libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev libjpeg-dev libpugixml-dev")
 	if err := d.runWithProgress(devToolsCmd, progressChan, PhasePrerequisites, 0.10, 0.12); err != nil {
 		return fmt.Errorf("failed to install development tools: %w", err)
 	}
@@ -379,6 +406,14 @@ func (d *DebianDistribution) extractPackageNames(packages []PackageMapping) []st
 	return names
 }
 
+func (d *DebianDistribution) aptInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"DEBIAN_FRONTEND=noninteractive", "apt-get", "install", "-y"}
+	if minimal {
+		args = append(args, "--no-install-recommends")
+	}
+	return append(args, packages...)
+}
+
 func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []PackageMapping, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	enabledRepos := make(map[string]bool)
 
@@ -416,7 +451,7 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 			keyringPath := fmt.Sprintf("/etc/apt/keyrings/%s.gpg", repoName)
 
 			// Create keyrings directory if it doesn't exist
-			mkdirCmd := ExecSudoCommand(ctx, sudoPassword, "mkdir -p /etc/apt/keyrings")
+			mkdirCmd := privesc.ExecCommand(ctx, sudoPassword, "mkdir -p /etc/apt/keyrings")
 			if err := mkdirCmd.Run(); err != nil {
 				d.log(fmt.Sprintf("Warning: failed to create keyrings directory: %v", err))
 			}
@@ -430,13 +465,13 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 			}
 
 			keyCmd := fmt.Sprintf("bash -c 'rm -f %s && curl -fsSL %s/Release.key | gpg --batch --dearmor -o %s'", keyringPath, baseURL, keyringPath)
-			cmd := ExecSudoCommand(ctx, sudoPassword, keyCmd)
+			cmd := privesc.ExecCommand(ctx, sudoPassword, keyCmd)
 			if err := d.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.18, 0.20); err != nil {
 				return fmt.Errorf("failed to add OBS GPG key for %s: %w", pkg.RepoURL, err)
 			}
 
 			// Add repository
-			repoLine := fmt.Sprintf("deb [signed-by=%s arch=%s] %s/ /", keyringPath, runtime.GOARCH, baseURL)
+			repoLine := fmt.Sprintf("deb [signed-by=%s arch=%s] %s/ /", keyringPath, debianRepoArchitecture(osInfo.Architecture), baseURL)
 
 			progressChan <- InstallProgressMsg{
 				Phase:       PhaseSystemPackages,
@@ -446,7 +481,7 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 				CommandInfo: fmt.Sprintf("echo '%s' | sudo tee %s", repoLine, listFile),
 			}
 
-			addRepoCmd := ExecSudoCommand(ctx, sudoPassword,
+			addRepoCmd := privesc.ExecCommand(ctx, sudoPassword,
 				fmt.Sprintf("bash -c \"echo '%s' | tee %s\"", repoLine, listFile))
 			if err := d.runWithProgress(addRepoCmd, progressChan, PhaseSystemPackages, 0.20, 0.22); err != nil {
 				return fmt.Errorf("failed to add OBS repo %s: %w", pkg.RepoURL, err)
@@ -466,7 +501,7 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 			CommandInfo: "sudo apt-get update",
 		}
 
-		updateCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get update")
+		updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
 		if err := d.runWithProgress(updateCmd, progressChan, PhaseSystemPackages, 0.25, 0.27); err != nil {
 			return fmt.Errorf("failed to update package lists after adding OBS repos: %w", err)
 		}
@@ -482,20 +517,46 @@ func (d *DebianDistribution) installAPTPackages(ctx context.Context, packages []
 
 	d.log(fmt.Sprintf("Installing APT packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"DEBIAN_FRONTEND=noninteractive", "apt-get", "install", "-y"}
-	args = append(args, packages...)
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
 
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		startProgress := 0.40
+		endProgress := 0.60
+		if totalGroups > 1 {
+			if groupIndex == 1 {
+				endProgress = 0.50
+			} else {
+				startProgress = 0.50
+			}
+		}
+
+		args := d.aptInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       PhaseSystemPackages,
+			Progress:    startProgress,
+			Step:        "Installing system packages...",
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return d.runWithProgress(cmd, progressChan, PhaseSystemPackages, startProgress, endProgress)
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return d.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func (d *DebianDistribution) installBuildDependencies(ctx context.Context, manualPkgs []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -574,7 +635,7 @@ func (d *DebianDistribution) installBuildDependencies(ctx context.Context, manua
 	args := []string{"apt-get", "install", "-y"}
 	args = append(args, depList...)
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	return d.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.80, 0.82)
 }
 
@@ -592,7 +653,7 @@ func (d *DebianDistribution) installRust(ctx context.Context, sudoPassword strin
 		CommandInfo: "sudo apt-get install rustup",
 	}
 
-	rustupInstallCmd := ExecSudoCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y rustup")
+	rustupInstallCmd := privesc.ExecCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y rustup")
 	if err := d.runWithProgress(rustupInstallCmd, progressChan, PhaseSystemPackages, 0.82, 0.83); err != nil {
 		return fmt.Errorf("failed to install rustup: %w", err)
 	}
@@ -631,7 +692,7 @@ func (d *DebianDistribution) installGo(ctx context.Context, sudoPassword string,
 		CommandInfo: "sudo apt-get install golang-go",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y golang-go")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y golang-go")
 	return d.runWithProgress(installCmd, progressChan, PhaseSystemPackages, 0.87, 0.90)
 }
 

core/internal/distros/fedora.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 func init() {
@@ -254,7 +255,7 @@ func (f *FedoraDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 
 	args := []string{"dnf", "install", "-y"}
 	args = append(args, missingPkgs...)
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		f.logError("failed to install prerequisites", err)
@@ -437,7 +438,7 @@ func (f *FedoraDistribution) enableCOPRRepos(ctx context.Context, coprPkgs []Pac
 				CommandInfo: fmt.Sprintf("sudo dnf copr enable -y %s", pkg.RepoURL),
 			}
 
-			cmd := ExecSudoCommand(ctx, sudoPassword,
+			cmd := privesc.ExecCommand(ctx, sudoPassword,
 				fmt.Sprintf("dnf copr enable -y %s 2>&1", pkg.RepoURL))
 			output, err := cmd.CombinedOutput()
 			if err != nil {
@@ -461,7 +462,7 @@ func (f *FedoraDistribution) enableCOPRRepos(ctx context.Context, coprPkgs []Pac
 					CommandInfo: fmt.Sprintf("echo \"priority=1\" | sudo tee -a %s", repoFile),
 				}
 
-				priorityCmd := ExecSudoCommand(ctx, sudoPassword,
+				priorityCmd := privesc.ExecCommand(ctx, sudoPassword,
 					fmt.Sprintf("bash -c 'echo \"priority=1\" | tee -a %s'", repoFile))
 				priorityOutput, err := priorityCmd.CombinedOutput()
 				if err != nil {
@@ -484,28 +485,7 @@ func (f *FedoraDistribution) installDNFPackages(ctx context.Context, packages []
 
 	f.log(fmt.Sprintf("Installing DNF packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"dnf", "install", "-y"}
-
-	for _, pkg := range packages {
-		if pkg == "niri" || pkg == "niri-git" {
-			args = append(args, "--setopt=install_weak_deps=False")
-			break
-		}
-	}
-
-	args = append(args, packages...)
-
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
-	}
-
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return f.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	return f.installDNFGroups(ctx, packages, sudoPassword, progressChan, PhaseSystemPackages, "Installing system packages...", 0.40, 0.60)
 }
 
 func (f *FedoraDistribution) installCOPRPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -515,26 +495,57 @@ func (f *FedoraDistribution) installCOPRPackages(ctx context.Context, packages [
 
 	f.log(fmt.Sprintf("Installing COPR packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"dnf", "install", "-y"}
+	return f.installDNFGroups(ctx, packages, sudoPassword, progressChan, PhaseAURPackages, "Installing COPR packages...", 0.70, 0.85)
+}
 
-	for _, pkg := range packages {
-		if pkg == "niri" || pkg == "niri-git" {
-			args = append(args, "--setopt=install_weak_deps=False")
-			break
+func (f *FedoraDistribution) dnfInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"dnf", "install", "-y"}
+	if minimal {
+		args = append(args, "--setopt=install_weak_deps=False")
+	}
+	return append(args, packages...)
+}
+
+func (f *FedoraDistribution) installDNFGroups(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg, phase InstallPhase, step string, startProgress float64, endProgress float64) error {
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
+
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		groupStart := startProgress
+		groupEnd := endProgress
+		if totalGroups > 1 {
+			midpoint := startProgress + ((endProgress - startProgress) / 2)
+			if groupIndex == 1 {
+				groupEnd = midpoint
+			} else {
+				groupStart = midpoint
+			}
+		}
+
+		args := f.dnfInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       phase,
+			Progress:    groupStart,
+			Step:        step,
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return f.runWithProgress(cmd, progressChan, phase, groupStart, groupEnd)
+	}
+
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
 		}
 	}
-
-	args = append(args, packages...)
-
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseAURPackages,
-		Progress:    0.70,
-		Step:        "Installing COPR packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
-	}
-
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return f.runWithProgress(cmd, progressChan, PhaseAURPackages, 0.70, 0.85)
+	return nil
 }

core/internal/distros/gentoo.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 var GentooGlobalUseFlags = []string{
@@ -201,9 +202,9 @@ func (g *GentooDistribution) setGlobalUseFlags(ctx context.Context, sudoPassword
 
 	var cmd *exec.Cmd
 	if hasUse {
-		cmd = ExecSudoCommand(ctx, sudoPassword, fmt.Sprintf("sed -i 's/^USE=\"\\(.*\\)\"/USE=\"\\1 %s\"/' /etc/portage/make.conf", useFlags))
+		cmd = privesc.ExecCommand(ctx, sudoPassword, fmt.Sprintf("sed -i 's/^USE=\"\\(.*\\)\"/USE=\"\\1 %s\"/' /etc/portage/make.conf", useFlags))
 	} else {
-		cmd = ExecSudoCommand(ctx, sudoPassword, fmt.Sprintf("bash -c \"echo 'USE=\\\"%s\\\"' >> /etc/portage/make.conf\"", useFlags))
+		cmd = privesc.ExecCommand(ctx, sudoPassword, fmt.Sprintf("bash -c \"echo 'USE=\\\"%s\\\"' >> /etc/portage/make.conf\"", useFlags))
 	}
 
 	output, err := cmd.CombinedOutput()
@@ -281,7 +282,7 @@ func (g *GentooDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		LogOutput:   "Syncing Portage tree with emerge --sync",
 	}
 
-	syncCmd := ExecSudoCommand(ctx, sudoPassword, "emerge --sync --quiet")
+	syncCmd := privesc.ExecCommand(ctx, sudoPassword, "emerge --sync --quiet")
 	syncOutput, syncErr := syncCmd.CombinedOutput()
 	if syncErr != nil {
 		g.log(fmt.Sprintf("emerge --sync output: %s", string(syncOutput)))
@@ -302,7 +303,7 @@ func (g *GentooDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 
 	args := []string{"emerge", "--ask=n", "--quiet"}
 	args = append(args, missingPkgs...)
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		g.logError("failed to install prerequisites", err)
@@ -503,14 +504,14 @@ func (g *GentooDistribution) installPortagePackages(ctx context.Context, package
 		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	return g.runWithProgressTimeout(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60, 0)
 }
 
 func (g *GentooDistribution) setPackageUseFlags(ctx context.Context, packageName, useFlags, sudoPassword string) error {
 	packageUseDir := "/etc/portage/package.use"
 
-	mkdirCmd := ExecSudoCommand(ctx, sudoPassword,
+	mkdirCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("mkdir -p %s", packageUseDir))
 	if output, err := mkdirCmd.CombinedOutput(); err != nil {
 		g.log(fmt.Sprintf("mkdir output: %s", string(output)))
@@ -524,7 +525,7 @@ func (g *GentooDistribution) setPackageUseFlags(ctx context.Context, packageName
 	if checkExistingCmd.Run() == nil {
 		g.log(fmt.Sprintf("Updating USE flags for %s from existing entry", packageName))
 		escapedPkg := strings.ReplaceAll(packageName, "/", "\\/")
-		replaceCmd := ExecSudoCommand(ctx, sudoPassword,
+		replaceCmd := privesc.ExecCommand(ctx, sudoPassword,
 			fmt.Sprintf("sed -i '/^%s /d' %s/danklinux; exit_code=$?; exit $exit_code", escapedPkg, packageUseDir))
 		if output, err := replaceCmd.CombinedOutput(); err != nil {
 			g.log(fmt.Sprintf("sed delete output: %s", string(output)))
@@ -532,7 +533,7 @@ func (g *GentooDistribution) setPackageUseFlags(ctx context.Context, packageName
 		}
 	}
 
-	appendCmd := ExecSudoCommand(ctx, sudoPassword,
+	appendCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("bash -c \"echo '%s' >> %s/danklinux\"", useFlagLine, packageUseDir))
 
 	output, err := appendCmd.CombinedOutput()
@@ -557,7 +558,7 @@ func (g *GentooDistribution) syncGURURepo(ctx context.Context, sudoPassword stri
 	}
 
 	// Enable GURU repository
-	enableCmd := ExecSudoCommand(ctx, sudoPassword,
+	enableCmd := privesc.ExecCommand(ctx, sudoPassword,
 		"eselect repository enable guru 2>&1; exit_code=$?; exit $exit_code")
 	output, err := enableCmd.CombinedOutput()
 
@@ -589,7 +590,7 @@ func (g *GentooDistribution) syncGURURepo(ctx context.Context, sudoPassword stri
 		LogOutput:   "Syncing GURU repository",
 	}
 
-	syncCmd := ExecSudoCommand(ctx, sudoPassword,
+	syncCmd := privesc.ExecCommand(ctx, sudoPassword,
 		"emaint sync --repo guru 2>&1; exit_code=$?; exit $exit_code")
 	syncOutput, syncErr := syncCmd.CombinedOutput()
 
@@ -622,7 +623,7 @@ func (g *GentooDistribution) setPackageAcceptKeywords(ctx context.Context, packa
 
 	acceptKeywordsDir := "/etc/portage/package.accept_keywords"
 
-	mkdirCmd := ExecSudoCommand(ctx, sudoPassword,
+	mkdirCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("mkdir -p %s", acceptKeywordsDir))
 	if output, err := mkdirCmd.CombinedOutput(); err != nil {
 		g.log(fmt.Sprintf("mkdir output: %s", string(output)))
@@ -636,7 +637,7 @@ func (g *GentooDistribution) setPackageAcceptKeywords(ctx context.Context, packa
 	if checkExistingCmd.Run() == nil {
 		g.log(fmt.Sprintf("Updating accept keywords for %s from existing entry", packageName))
 		escapedPkg := strings.ReplaceAll(packageName, "/", "\\/")
-		replaceCmd := ExecSudoCommand(ctx, sudoPassword,
+		replaceCmd := privesc.ExecCommand(ctx, sudoPassword,
 			fmt.Sprintf("sed -i '/^%s /d' %s/danklinux; exit_code=$?; exit $exit_code", escapedPkg, acceptKeywordsDir))
 		if output, err := replaceCmd.CombinedOutput(); err != nil {
 			g.log(fmt.Sprintf("sed delete output: %s", string(output)))
@@ -644,7 +645,7 @@ func (g *GentooDistribution) setPackageAcceptKeywords(ctx context.Context, packa
 		}
 	}
 
-	appendCmd := ExecSudoCommand(ctx, sudoPassword,
+	appendCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("bash -c \"echo '%s' >> %s/danklinux\"", keywordLine, acceptKeywordsDir))
 
 	output, err := appendCmd.CombinedOutput()
@@ -695,6 +696,6 @@ func (g *GentooDistribution) installGURUPackages(ctx context.Context, packages [
 		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	return g.runWithProgressTimeout(cmd, progressChan, PhaseAURPackages, 0.70, 0.85, 0)
 }

core/internal/distros/manual_packages.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 // ManualPackageInstaller provides methods for installing packages from source
@@ -143,7 +144,7 @@ func (m *ManualPackageInstaller) installDgop(ctx context.Context, sudoPassword s
 		CommandInfo: "sudo make install",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "make install")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "make install")
 	installCmd.Dir = tmpDir
 	if err := installCmd.Run(); err != nil {
 		m.logError("failed to install dgop", err)
@@ -213,7 +214,7 @@ func (m *ManualPackageInstaller) installNiri(ctx context.Context, sudoPassword s
 		CommandInfo: "dpkg -i niri.deb",
 	}
 
-	installDebCmd := ExecSudoCommand(ctx, sudoPassword,
+	installDebCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("dpkg -i %s/target/debian/niri_*.deb", buildDir))
 
 	output, err := installDebCmd.CombinedOutput()
@@ -324,7 +325,7 @@ func (m *ManualPackageInstaller) installQuickshell(ctx context.Context, variant
 		CommandInfo: "sudo cmake --install build",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "cmake --install build")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "cmake --install build")
 	installCmd.Dir = tmpDir
 	if err := installCmd.Run(); err != nil {
 		return fmt.Errorf("failed to install quickshell: %w", err)
@@ -387,7 +388,7 @@ func (m *ManualPackageInstaller) installHyprland(ctx context.Context, sudoPasswo
 		CommandInfo: "sudo make install",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "make install")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "make install")
 	installCmd.Dir = tmpDir
 	if err := installCmd.Run(); err != nil {
 		return fmt.Errorf("failed to install Hyprland: %w", err)
@@ -453,7 +454,7 @@ func (m *ManualPackageInstaller) installGhostty(ctx context.Context, sudoPasswor
 		CommandInfo: "sudo cp zig-out/bin/ghostty /usr/local/bin/",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword,
+	installCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("cp %s/zig-out/bin/ghostty /usr/local/bin/", tmpDir))
 	if err := installCmd.Run(); err != nil {
 		return fmt.Errorf("failed to install Ghostty: %w", err)
@@ -492,16 +493,11 @@ func (m *ManualPackageInstaller) installMatugen(ctx context.Context, sudoPasswor
 		CommandInfo: fmt.Sprintf("sudo cp %s %s", sourcePath, targetPath),
 	}
 
-	copyCmd := exec.CommandContext(ctx, "sudo", "-S", "cp", sourcePath, targetPath)
-	copyCmd.Stdin = strings.NewReader(sudoPassword + "\n")
-	if err := copyCmd.Run(); err != nil {
+	if err := privesc.Run(ctx, sudoPassword, "cp", sourcePath, targetPath); err != nil {
 		return fmt.Errorf("failed to copy matugen to /usr/local/bin: %w", err)
 	}
 
-	// Make it executable
-	chmodCmd := exec.CommandContext(ctx, "sudo", "-S", "chmod", "+x", targetPath)
-	chmodCmd.Stdin = strings.NewReader(sudoPassword + "\n")
-	if err := chmodCmd.Run(); err != nil {
+	if err := privesc.Run(ctx, sudoPassword, "chmod", "+x", targetPath); err != nil {
 		return fmt.Errorf("failed to make matugen executable: %w", err)
 	}
 
@@ -646,15 +642,11 @@ func (m *ManualPackageInstaller) installXwaylandSatellite(ctx context.Context, s
 		CommandInfo: fmt.Sprintf("sudo cp %s %s", sourcePath, targetPath),
 	}
 
-	copyCmd := exec.CommandContext(ctx, "sudo", "-S", "cp", sourcePath, targetPath)
-	copyCmd.Stdin = strings.NewReader(sudoPassword + "\n")
-	if err := copyCmd.Run(); err != nil {
+	if err := privesc.Run(ctx, sudoPassword, "cp", sourcePath, targetPath); err != nil {
 		return fmt.Errorf("failed to copy xwayland-satellite to /usr/local/bin: %w", err)
 	}
 
-	chmodCmd := exec.CommandContext(ctx, "sudo", "-S", "chmod", "+x", targetPath)
-	chmodCmd.Stdin = strings.NewReader(sudoPassword + "\n")
-	if err := chmodCmd.Run(); err != nil {
+	if err := privesc.Run(ctx, sudoPassword, "chmod", "+x", targetPath); err != nil {
 		return fmt.Errorf("failed to make xwayland-satellite executable: %w", err)
 	}
 

core/internal/distros/minimal_install.go

@@ -0,0 +1,44 @@
+package distros
+
+type minimalInstallGroup struct {
+	packages []string
+	minimal  bool
+}
+
+func shouldPreferMinimalInstall(pkg string) bool {
+	switch pkg {
+	case "niri", "niri-git":
+		return true
+	default:
+		return false
+	}
+}
+
+func splitMinimalInstallPackages(packages []string) (normal []string, minimal []string) {
+	for _, pkg := range packages {
+		if shouldPreferMinimalInstall(pkg) {
+			minimal = append(minimal, pkg)
+			continue
+		}
+		normal = append(normal, pkg)
+	}
+	return normal, minimal
+}
+
+func orderedMinimalInstallGroups(packages []string) []minimalInstallGroup {
+	normal, minimal := splitMinimalInstallPackages(packages)
+	groups := make([]minimalInstallGroup, 0, 2)
+	if len(minimal) > 0 {
+		groups = append(groups, minimalInstallGroup{
+			packages: minimal,
+			minimal:  true,
+		})
+	}
+	if len(normal) > 0 {
+		groups = append(groups, minimalInstallGroup{
+			packages: normal,
+			minimal:  false,
+		})
+	}
+	return groups
+}

core/internal/distros/opensuse.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 func init() {
@@ -29,6 +30,8 @@ type OpenSUSEDistribution struct {
 	config DistroConfig
 }
 
+const openSUSENiriWaylandServerPackage = "libwayland-server0"
+
 func NewOpenSUSEDistribution(config DistroConfig, logChan chan<- string) *OpenSUSEDistribution {
 	base := NewBaseDistribution(logChan)
 	return &OpenSUSEDistribution{
@@ -199,35 +202,7 @@ func (o *OpenSUSEDistribution) detectAccountsService() deps.Dependency {
 }
 
 func (o *OpenSUSEDistribution) getPrerequisites() []string {
-	return []string{
-		"make",
-		"unzip",
-		"gcc",
-		"gcc-c++",
-		"cmake",
-		"ninja",
-		"pkgconf-pkg-config",
-		"git",
-		"qt6-base-devel",
-		"qt6-declarative-devel",
-		"qt6-declarative-private-devel",
-		"qt6-shadertools",
-		"qt6-shadertools-devel",
-		"qt6-wayland-devel",
-		"qt6-waylandclient-private-devel",
-		"spirv-tools-devel",
-		"cli11-devel",
-		"wayland-protocols-devel",
-		"libgbm-devel",
-		"libdrm-devel",
-		"pipewire-devel",
-		"jemalloc-devel",
-		"wayland-utils",
-		"Mesa-libGLESv3-devel",
-		"pam-devel",
-		"glib2-devel",
-		"polkit-devel",
-	}
+	return []string{}
 }
 
 func (o *OpenSUSEDistribution) InstallPrerequisites(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -275,7 +250,7 @@ func (o *OpenSUSEDistribution) InstallPrerequisites(ctx context.Context, sudoPas
 
 	args := []string{"zypper", "install", "-y"}
 	args = append(args, missingPkgs...)
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		o.logError("failed to install prerequisites", err)
@@ -297,6 +272,10 @@ func (o *OpenSUSEDistribution) InstallPackages(ctx context.Context, dependencies
 		LogOutput:  "Starting prerequisite check...",
 	}
 
+	if err := o.disableInstallMediaRepos(ctx, sudoPassword, progressChan); err != nil {
+		return fmt.Errorf("failed to disable install media repositories: %w", err)
+	}
+
 	if err := o.InstallPrerequisites(ctx, sudoPassword, progressChan); err != nil {
 		return fmt.Errorf("failed to install prerequisites: %w", err)
 	}
@@ -327,7 +306,7 @@ func (o *OpenSUSEDistribution) InstallPackages(ctx context.Context, dependencies
 			NeedsSudo:  true,
 			LogOutput:  fmt.Sprintf("Installing system packages: %s", strings.Join(systemPkgs, ", ")),
 		}
-		if err := o.installZypperPackages(ctx, systemPkgs, sudoPassword, progressChan); err != nil {
+		if err := o.installZypperPackages(ctx, systemPkgs, sudoPassword, progressChan, PhaseSystemPackages, "Installing system packages...", 0.40, 0.60); err != nil {
 			return fmt.Errorf("failed to install zypper packages: %w", err)
 		}
 	}
@@ -342,7 +321,7 @@ func (o *OpenSUSEDistribution) InstallPackages(ctx context.Context, dependencies
 			IsComplete: false,
 			LogOutput:  fmt.Sprintf("Installing OBS packages: %s", strings.Join(obsPkgNames, ", ")),
 		}
-		if err := o.installZypperPackages(ctx, obsPkgNames, sudoPassword, progressChan); err != nil {
+		if err := o.installZypperPackages(ctx, obsPkgNames, sudoPassword, progressChan, PhaseAURPackages, "Installing OBS packages...", 0.70, 0.85); err != nil {
 			return fmt.Errorf("failed to install OBS packages: %w", err)
 		}
 	}
@@ -432,9 +411,32 @@ func (o *OpenSUSEDistribution) categorizePackages(dependencies []deps.Dependency
 		}
 	}
 
+	systemPkgs = o.appendMissingSystemPackages(systemPkgs, openSUSENiriRuntimePackages(wm, disabledFlags))
+
 	return systemPkgs, obsPkgs, manualPkgs, variantMap
 }
 
+func openSUSENiriRuntimePackages(wm deps.WindowManager, disabledFlags map[string]bool) []string {
+	if wm != deps.WindowManagerNiri || disabledFlags["niri"] {
+		return nil
+	}
+
+	return []string{openSUSENiriWaylandServerPackage}
+}
+
+func (o *OpenSUSEDistribution) appendMissingSystemPackages(systemPkgs []string, extraPkgs []string) []string {
+	for _, pkg := range extraPkgs {
+		if containsString(systemPkgs, pkg) || o.packageInstalled(pkg) {
+			continue
+		}
+
+		o.log(fmt.Sprintf("Adding openSUSE runtime package: %s", pkg))
+		systemPkgs = append(systemPkgs, pkg)
+	}
+
+	return systemPkgs
+}
+
 func (o *OpenSUSEDistribution) extractPackageNames(packages []PackageMapping) []string {
 	names := make([]string, len(packages))
 	for i, pkg := range packages {
@@ -484,7 +486,7 @@ func (o *OpenSUSEDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Pac
 				CommandInfo: fmt.Sprintf("sudo zypper addrepo %s", repoURL),
 			}
 
-			cmd := ExecSudoCommand(ctx, sudoPassword,
+			cmd := privesc.ExecCommand(ctx, sudoPassword,
 				fmt.Sprintf("zypper addrepo -f %s", repoURL))
 			if err := o.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.20, 0.22); err != nil {
 				o.log(fmt.Sprintf("OBS repo %s add failed (may already exist): %v", pkg.RepoURL, err))
@@ -505,7 +507,7 @@ func (o *OpenSUSEDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Pac
 			CommandInfo: "sudo zypper --gpg-auto-import-keys refresh",
 		}
 
-		refreshCmd := ExecSudoCommand(ctx, sudoPassword, "zypper --gpg-auto-import-keys refresh")
+		refreshCmd := privesc.ExecCommand(ctx, sudoPassword, "zypper --gpg-auto-import-keys refresh")
 		if err := o.runWithProgress(refreshCmd, progressChan, PhaseSystemPackages, 0.25, 0.27); err != nil {
 			return fmt.Errorf("failed to refresh repositories: %w", err)
 		}
@@ -514,27 +516,146 @@ func (o *OpenSUSEDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Pac
 	return nil
 }
 
-func (o *OpenSUSEDistribution) installZypperPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+func isOpenSUSEInstallMediaURI(uri string) bool {
+	normalizedURI := strings.ToLower(strings.TrimSpace(uri))
+
+	return strings.HasPrefix(normalizedURI, "cd:/") ||
+		strings.HasPrefix(normalizedURI, "dvd:/") ||
+		strings.HasPrefix(normalizedURI, "hd:/") ||
+		strings.HasPrefix(normalizedURI, "iso:/")
+}
+
+func parseZypperInstallMediaAliases(output string) []string {
+	var aliases []string
+
+	for _, line := range strings.Split(output, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || !strings.Contains(line, "|") {
+			continue
+		}
+
+		parts := strings.Split(line, "|")
+		if len(parts) < 7 {
+			continue
+		}
+
+		for i := range parts {
+			parts[i] = strings.TrimSpace(parts[i])
+		}
+
+		alias := parts[1]
+		enabled := strings.ToLower(parts[3])
+		uri := parts[len(parts)-1]
+
+		if alias == "" || strings.EqualFold(alias, "alias") {
+			continue
+		}
+		if enabled != "" && enabled != "yes" {
+			continue
+		}
+		if !isOpenSUSEInstallMediaURI(uri) {
+			continue
+		}
+
+		aliases = append(aliases, alias)
+	}
+
+	return aliases
+}
+
+func (o *OpenSUSEDistribution) disableInstallMediaRepos(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+	listCmd := exec.CommandContext(ctx, "zypper", "repos", "-u")
+	output, err := listCmd.CombinedOutput()
+	if err != nil {
+		o.log(fmt.Sprintf("Warning: failed to list zypper repositories: %s", strings.TrimSpace(string(output))))
+		return fmt.Errorf("failed to list zypper repositories: %w", err)
+	}
+
+	aliases := parseZypperInstallMediaAliases(string(output))
+	if len(aliases) == 0 {
+		return nil
+	}
+
+	o.log(fmt.Sprintf("Disabling install media repositories: %s", strings.Join(aliases, ", ")))
+	progressChan <- InstallProgressMsg{
+		Phase:       PhasePrerequisites,
+		Progress:    0.055,
+		Step:        "Disabling install media repositories...",
+		IsComplete:  false,
+		NeedsSudo:   true,
+		CommandInfo: fmt.Sprintf("sudo zypper modifyrepo -d %s", strings.Join(aliases, " ")),
+		LogOutput:   fmt.Sprintf("Disabling install media repositories: %s", strings.Join(aliases, ", ")),
+	}
+
+	for _, alias := range aliases {
+		cmd := privesc.ExecCommand(ctx, sudoPassword, fmt.Sprintf("zypper modifyrepo -d '%s'", privesc.EscapeSingleQuotes(alias)))
+		repoOutput, err := cmd.CombinedOutput()
+		if err != nil {
+			o.log(fmt.Sprintf("Failed to disable install media repo %s: %s", alias, strings.TrimSpace(string(repoOutput))))
+			return fmt.Errorf("failed to disable install media repo %s: %w", alias, err)
+		}
+		o.log(fmt.Sprintf("Disabled install media repo %s: %s", alias, strings.TrimSpace(string(repoOutput))))
+	}
+
+	return nil
+}
+
+func (o *OpenSUSEDistribution) zypperInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"zypper", "install", "-y"}
+	if minimal {
+		args = append(args, "--no-recommends")
+	}
+	return append(args, packages...)
+}
+
+func (o *OpenSUSEDistribution) installZypperPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg, phase InstallPhase, step string, startProgress float64, endProgress float64) error {
 	if len(packages) == 0 {
 		return nil
 	}
 
 	o.log(fmt.Sprintf("Installing zypper packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"zypper", "install", "-y"}
-	args = append(args, packages...)
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
 
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		groupStart := startProgress
+		groupEnd := endProgress
+		if totalGroups > 1 {
+			midpoint := startProgress + ((endProgress - startProgress) / 2)
+			if groupIndex == 1 {
+				groupEnd = midpoint
+			} else {
+				groupStart = midpoint
+			}
+		}
+
+		args := o.zypperInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       phase,
+			Progress:    groupStart,
+			Step:        step,
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return o.runWithProgress(cmd, progressChan, phase, groupStart, groupEnd)
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return o.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func (o *OpenSUSEDistribution) installQuickshell(ctx context.Context, variant deps.PackageVariant, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -653,7 +774,7 @@ func (o *OpenSUSEDistribution) installQuickshell(ctx context.Context, variant de
 		CommandInfo: "sudo cmake --install build",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "cmake --install build")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "cmake --install build")
 	installCmd.Dir = tmpDir
 	if err := installCmd.Run(); err != nil {
 		return fmt.Errorf("failed to install quickshell: %w", err)
@@ -677,7 +798,7 @@ func (o *OpenSUSEDistribution) installRust(ctx context.Context, sudoPassword str
 		CommandInfo: "sudo zypper install rustup",
 	}
 
-	rustupInstallCmd := ExecSudoCommand(ctx, sudoPassword, "zypper install -y rustup")
+	rustupInstallCmd := privesc.ExecCommand(ctx, sudoPassword, "zypper install -y rustup")
 	if err := o.runWithProgress(rustupInstallCmd, progressChan, PhaseSystemPackages, 0.82, 0.83); err != nil {
 		return fmt.Errorf("failed to install rustup: %w", err)
 	}

core/internal/distros/ubuntu.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 func init() {
@@ -100,9 +101,7 @@ func (u *UbuntuDistribution) detectDMSGreeter() deps.Dependency {
 }
 
 func (u *UbuntuDistribution) packageInstalled(pkg string) bool {
-	cmd := exec.Command("dpkg", "-l", pkg)
-	err := cmd.Run()
-	return err == nil
+	return debianPackageInstalledPrecisely(pkg)
 }
 
 func (u *UbuntuDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
@@ -179,7 +178,7 @@ func (u *UbuntuDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		LogOutput:  "Updating APT package lists",
 	}
 
-	updateCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get update")
+	updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
 	if err := u.runWithProgress(updateCmd, progressChan, PhasePrerequisites, 0.06, 0.07); err != nil {
 		return fmt.Errorf("failed to update package lists: %w", err)
 	}
@@ -197,7 +196,7 @@ func (u *UbuntuDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 	checkCmd := exec.CommandContext(ctx, "dpkg", "-l", "build-essential")
 	if err := checkCmd.Run(); err != nil {
 		// Not installed, install it
-		cmd := ExecSudoCommand(ctx, sudoPassword, "apt-get install -y build-essential")
+		cmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get install -y build-essential")
 		if err := u.runWithProgress(cmd, progressChan, PhasePrerequisites, 0.08, 0.09); err != nil {
 			return fmt.Errorf("failed to install build-essential: %w", err)
 		}
@@ -213,7 +212,7 @@ func (u *UbuntuDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		LogOutput:   "Installing additional development tools",
 	}
 
-	devToolsCmd := ExecSudoCommand(ctx, sudoPassword,
+	devToolsCmd := privesc.ExecCommand(ctx, sudoPassword,
 		"apt-get install -y curl wget git cmake ninja-build pkg-config libglib2.0-dev libpolkit-agent-1-dev")
 	if err := u.runWithProgress(devToolsCmd, progressChan, PhasePrerequisites, 0.10, 0.12); err != nil {
 		return fmt.Errorf("failed to install development tools: %w", err)
@@ -400,7 +399,7 @@ func (u *UbuntuDistribution) extractPackageNames(packages []PackageMapping) []st
 func (u *UbuntuDistribution) enablePPARepos(ctx context.Context, ppaPkgs []PackageMapping, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	enabledRepos := make(map[string]bool)
 
-	installPPACmd := ExecSudoCommand(ctx, sudoPassword,
+	installPPACmd := privesc.ExecCommand(ctx, sudoPassword,
 		"apt-get install -y software-properties-common")
 	if err := u.runWithProgress(installPPACmd, progressChan, PhaseSystemPackages, 0.15, 0.17); err != nil {
 		return fmt.Errorf("failed to install software-properties-common: %w", err)
@@ -418,7 +417,7 @@ func (u *UbuntuDistribution) enablePPARepos(ctx context.Context, ppaPkgs []Packa
 				CommandInfo: fmt.Sprintf("sudo add-apt-repository -y %s", pkg.RepoURL),
 			}
 
-			cmd := ExecSudoCommand(ctx, sudoPassword,
+			cmd := privesc.ExecCommand(ctx, sudoPassword,
 				fmt.Sprintf("add-apt-repository -y %s", pkg.RepoURL))
 			if err := u.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.20, 0.22); err != nil {
 				u.logError(fmt.Sprintf("failed to enable PPA repo %s", pkg.RepoURL), err)
@@ -439,7 +438,7 @@ func (u *UbuntuDistribution) enablePPARepos(ctx context.Context, ppaPkgs []Packa
 			CommandInfo: "sudo apt-get update",
 		}
 
-		updateCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get update")
+		updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
 		if err := u.runWithProgress(updateCmd, progressChan, PhaseSystemPackages, 0.25, 0.27); err != nil {
 			return fmt.Errorf("failed to update package lists after adding PPAs: %w", err)
 		}
@@ -454,21 +453,7 @@ func (u *UbuntuDistribution) installAPTPackages(ctx context.Context, packages []
 	}
 
 	u.log(fmt.Sprintf("Installing APT packages: %s", strings.Join(packages, ", ")))
-
-	args := []string{"apt-get", "install", "-y"}
-	args = append(args, packages...)
-
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
-	}
-
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return u.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	return u.installAPTGroups(ctx, packages, sudoPassword, progressChan, PhaseSystemPackages, "Installing system packages...", 0.40, 0.60)
 }
 
 func (u *UbuntuDistribution) installPPAPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -477,21 +462,59 @@ func (u *UbuntuDistribution) installPPAPackages(ctx context.Context, packages []
 	}
 
 	u.log(fmt.Sprintf("Installing PPA packages: %s", strings.Join(packages, ", ")))
+	return u.installAPTGroups(ctx, packages, sudoPassword, progressChan, PhaseAURPackages, "Installing PPA packages...", 0.70, 0.85)
+}
 
-	args := []string{"apt-get", "install", "-y"}
-	args = append(args, packages...)
+func (u *UbuntuDistribution) aptInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"DEBIAN_FRONTEND=noninteractive", "apt-get", "install", "-y"}
+	if minimal {
+		args = append(args, "--no-install-recommends")
+	}
+	return append(args, packages...)
+}
 
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseAURPackages,
-		Progress:    0.70,
-		Step:        "Installing PPA packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+func (u *UbuntuDistribution) installAPTGroups(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg, phase InstallPhase, step string, startProgress float64, endProgress float64) error {
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
+
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		groupStart := startProgress
+		groupEnd := endProgress
+		if totalGroups > 1 {
+			midpoint := startProgress + ((endProgress - startProgress) / 2)
+			if groupIndex == 1 {
+				groupEnd = midpoint
+			} else {
+				groupStart = midpoint
+			}
+		}
+
+		args := u.aptInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       phase,
+			Progress:    groupStart,
+			Step:        step,
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return u.runWithProgress(cmd, progressChan, phase, groupStart, groupEnd)
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return u.runWithProgress(cmd, progressChan, PhaseAURPackages, 0.70, 0.85)
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func (u *UbuntuDistribution) installBuildDependencies(ctx context.Context, manualPkgs []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -569,7 +592,7 @@ func (u *UbuntuDistribution) installBuildDependencies(ctx context.Context, manua
 	args := []string{"apt-get", "install", "-y"}
 	args = append(args, depList...)
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	return u.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.80, 0.82)
 }
 
@@ -587,7 +610,7 @@ func (u *UbuntuDistribution) installRust(ctx context.Context, sudoPassword strin
 		CommandInfo: "sudo apt-get install rustup",
 	}
 
-	rustupInstallCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get install -y rustup")
+	rustupInstallCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get install -y rustup")
 	if err := u.runWithProgress(rustupInstallCmd, progressChan, PhaseSystemPackages, 0.82, 0.83); err != nil {
 		return fmt.Errorf("failed to install rustup: %w", err)
 	}
@@ -627,7 +650,7 @@ func (u *UbuntuDistribution) installGo(ctx context.Context, sudoPassword string,
 		CommandInfo: "sudo add-apt-repository ppa:longsleep/golang-backports",
 	}
 
-	addPPACmd := ExecSudoCommand(ctx, sudoPassword,
+	addPPACmd := privesc.ExecCommand(ctx, sudoPassword,
 		"add-apt-repository -y ppa:longsleep/golang-backports")
 	if err := u.runWithProgress(addPPACmd, progressChan, PhaseSystemPackages, 0.87, 0.88); err != nil {
 		return fmt.Errorf("failed to add Go PPA: %w", err)
@@ -642,7 +665,7 @@ func (u *UbuntuDistribution) installGo(ctx context.Context, sudoPassword string,
 		CommandInfo: "sudo apt-get update",
 	}
 
-	updateCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get update")
+	updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
 	if err := u.runWithProgress(updateCmd, progressChan, PhaseSystemPackages, 0.88, 0.89); err != nil {
 		return fmt.Errorf("failed to update package lists after adding Go PPA: %w", err)
 	}
@@ -656,7 +679,7 @@ func (u *UbuntuDistribution) installGo(ctx context.Context, sudoPassword string,
 		CommandInfo: "sudo apt-get install golang-go",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get install -y golang-go")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get install -y golang-go")
 	return u.runWithProgress(installCmd, progressChan, PhaseSystemPackages, 0.89, 0.90)
 }
 

core/internal/greeter/assets/apparmor/usr.bin.dms-greeter

@@ -0,0 +1,91 @@
+# AppArmor profile for dms-greeter
+#
+# Managed by DMS — regenerated on every `dms greeter install` / `dms greeter sync`.
+# Manual edits will be overwritten on next sync.
+#
+# Mode: complain  (denials are logged, nothing is blocked)
+# To switch to enforce after validating with `aa-logprof`:
+#   sudo aa-enforce /etc/apparmor.d/usr.bin.dms-greeter
+#
+#include <tunables/global>
+
+profile dms-greeter /usr/bin/dms-greeter flags=(complain) {
+  #include <abstractions/base>
+  #include <abstractions/bash>
+
+  # The launcher script itself
+  /usr/bin/dms-greeter r,
+
+  # Cache directory — created by dms greeter sync/enable with greeter:greeter ownership
+  /var/cache/dms-greeter/     rw,
+  /var/cache/dms-greeter/**   rwlk,
+
+  # DMS config — packaged path
+  /usr/share/quickshell/dms-greeter/    r,
+  /usr/share/quickshell/dms-greeter/**  r,
+  /usr/share/quickshell/               r,
+  /usr/share/quickshell/**             r,
+
+  # DMS config — system and user overrides
+  /etc/dms/    r,
+  /etc/dms/**  r,
+  /usr/share/dms/    r,
+  /usr/share/dms/**  r,
+  /home/*/.config/quickshell/    r,
+  /home/*/.config/quickshell/**  r,
+  /root/.config/quickshell/     r,
+  /root/.config/quickshell/**   r,
+
+  # greetd / PAM — read-only for session setup
+  /etc/greetd/    r,
+  /etc/greetd/**  r,
+  /etc/pam.d/     r,
+  /etc/pam.d/**   r,
+  /usr/lib/pam.d/ r,
+  /usr/lib/pam.d/** r,
+
+  # Compositor binaries — run unconfined so each compositor uses its own profile
+  /usr/bin/niri        Ux,
+  /usr/bin/hyprland    Ux,
+  /usr/bin/Hyprland    Ux,
+  /usr/bin/sway        Ux,
+  /usr/bin/labwc       Ux,
+  /usr/bin/scroll      Ux,
+  /usr/bin/miracle-wm  Ux,
+  /usr/bin/mango       Ux,
+
+  # Quickshell — run unconfined (has its own compositor profile on some distros)
+  /usr/bin/qs          Ux,
+  /usr/bin/quickshell  Ux,
+
+  # Wayland / XDG runtime (pipewire, wireplumber, wayland socket)
+  /run/user/[0-9]*/               rw,
+  /run/user/[0-9]*/**             rw,
+
+  # DRM / GPU devices (required for Wayland compositor startup)
+  /dev/dri/      r,
+  /dev/dri/*     rw,
+  /dev/udmabuf   rw,
+
+  # Input devices
+  /dev/input/    r,
+  /dev/input/*   r,
+
+  # Systemd journal / logging
+  /run/systemd/journal/socket  rw,
+  /dev/log                     rw,
+
+  # Shell helper binaries invoked by the launcher script
+  /usr/bin/env      ix,
+  /usr/bin/mkdir    ix,
+  /usr/bin/cat      ix,
+  /usr/bin/grep     ix,
+  /usr/bin/dirname  ix,
+  /usr/bin/basename ix,
+  /usr/bin/command  ix,
+  /bin/env          ix,
+  /bin/mkdir        ix,
+
+  # Signal management (compositor lifecycle)
+  signal (send, receive) set=("term", "int", "hup", "kill"),
+}

core/internal/greeter/installer_test.go

@@ -0,0 +1,98 @@
+package greeter
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeTestJSON(t *testing.T, path string, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("failed to create parent dir for %s: %v", path, err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("failed to write %s: %v", path, err)
+	}
+}
+
+func TestResolveGreeterThemeSyncState(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		settingsJSON            string
+		sessionJSON             string
+		wantSourcePath          string
+		wantResolvedWallpaper   string
+		wantDynamicOverrideUsed bool
+	}{
+		{
+			name: "dynamic theme with greeter wallpaper override uses generated greeter colors",
+			settingsJSON: `{
+  "currentThemeName": "dynamic",
+  "greeterWallpaperPath": "Pictures/blue.jpg",
+  "matugenScheme": "scheme-tonal-spot",
+  "iconTheme": "Papirus"
+}`,
+			sessionJSON:             `{"isLightMode":true}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "greeter-colors", "dms-colors.json"),
+			wantResolvedWallpaper:   filepath.Join("Pictures", "blue.jpg"),
+			wantDynamicOverrideUsed: true,
+		},
+		{
+			name: "dynamic theme without override uses desktop colors",
+			settingsJSON: `{
+  "currentThemeName": "dynamic",
+  "greeterWallpaperPath": ""
+}`,
+			sessionJSON:             `{"isLightMode":false}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "dms-colors.json"),
+			wantResolvedWallpaper:   "",
+			wantDynamicOverrideUsed: false,
+		},
+		{
+			name: "non-dynamic theme keeps desktop colors even with override wallpaper",
+			settingsJSON: `{
+  "currentThemeName": "purple",
+  "greeterWallpaperPath": "/tmp/blue.jpg"
+}`,
+			sessionJSON:             `{"isLightMode":false}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "dms-colors.json"),
+			wantResolvedWallpaper:   "/tmp/blue.jpg",
+			wantDynamicOverrideUsed: false,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			homeDir := t.TempDir()
+			writeTestJSON(t, filepath.Join(homeDir, ".config", "DankMaterialShell", "settings.json"), tt.settingsJSON)
+			writeTestJSON(t, filepath.Join(homeDir, ".local", "state", "DankMaterialShell", "session.json"), tt.sessionJSON)
+
+			state, err := resolveGreeterThemeSyncState(homeDir)
+			if err != nil {
+				t.Fatalf("resolveGreeterThemeSyncState returned error: %v", err)
+			}
+
+			if got := state.effectiveColorsSource(homeDir); got != filepath.Join(homeDir, tt.wantSourcePath) {
+				t.Fatalf("effectiveColorsSource = %q, want %q", got, filepath.Join(homeDir, tt.wantSourcePath))
+			}
+
+			wantResolvedWallpaper := tt.wantResolvedWallpaper
+			if wantResolvedWallpaper != "" && !filepath.IsAbs(wantResolvedWallpaper) {
+				wantResolvedWallpaper = filepath.Join(homeDir, wantResolvedWallpaper)
+			}
+			if state.ResolvedGreeterWallpaperPath != wantResolvedWallpaper {
+				t.Fatalf("ResolvedGreeterWallpaperPath = %q, want %q", state.ResolvedGreeterWallpaperPath, wantResolvedWallpaper)
+			}
+
+			if state.UsesDynamicWallpaperOverride != tt.wantDynamicOverrideUsed {
+				t.Fatalf("UsesDynamicWallpaperOverride = %v, want %v", state.UsesDynamicWallpaperOverride, tt.wantDynamicOverrideUsed)
+			}
+		})
+	}
+}

core/internal/keybinds/providers/niri.go

@@ -10,7 +10,6 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/keybinds"
-	"github.com/sblinch/kdl-go"
 	"github.com/sblinch/kdl-go/document"
 )
 
@@ -292,7 +291,7 @@ func (n *NiriProvider) loadOverrideBinds() (map[string]*overrideBind, error) {
 	parser := NewNiriParser(filepath.Dir(overridePath))
 	parser.currentSource = overridePath
 
-	doc, err := kdl.Parse(strings.NewReader(string(data)))
+	doc, err := parseKDL(data)
 	if err != nil {
 		return nil, err
 	}

core/internal/keybinds/providers/niri_parser.go

@@ -50,6 +50,103 @@ type NiriParser struct {
 	conflictingConfigs map[string]*NiriKeyBinding
 }
 
+func parseKDL(data []byte) (*document.Document, error) {
+	return kdl.Parse(strings.NewReader(normalizeKDLBraces(string(data))))
+}
+
+func normalizeKDLBraces(input string) string {
+	var sb strings.Builder
+	sb.Grow(len(input))
+
+	var prev byte
+	n := len(input)
+	for i := 0; i < n; {
+		c := input[i]
+
+		switch {
+		case c == '"':
+			end := findStringEnd(input, i)
+			sb.WriteString(input[i:end])
+			prev = '"'
+			i = end
+		case c == '/' && i+1 < n && input[i+1] == '/':
+			end := findLineCommentEnd(input, i)
+			sb.WriteString(input[i:end])
+			prev = '\n'
+			i = end
+		case c == '/' && i+1 < n && input[i+1] == '*':
+			end := findBlockCommentEnd(input, i)
+			sb.WriteString(input[i:end])
+			prev = '/'
+			i = end
+		case c == '{' && prev != 0 && !isBraceAdjacentSpace(prev):
+			sb.WriteByte(' ')
+			sb.WriteByte(c)
+			prev = c
+			i++
+		default:
+			sb.WriteByte(c)
+			prev = c
+			i++
+		}
+	}
+
+	return sb.String()
+}
+
+func findStringEnd(s string, start int) int {
+	n := len(s)
+	for i := start + 1; i < n; {
+		switch s[i] {
+		case '\\':
+			i += 2
+		case '"':
+			return i + 1
+		default:
+			i++
+		}
+	}
+	return n
+}
+
+func findLineCommentEnd(s string, start int) int {
+	for i := start + 2; i < len(s); i++ {
+		if s[i] == '\n' {
+			return i
+		}
+	}
+	return len(s)
+}
+
+func findBlockCommentEnd(s string, start int) int {
+	n := len(s)
+	depth := 1
+	for i := start + 2; i < n && depth > 0; {
+		switch {
+		case i+1 < n && s[i] == '/' && s[i+1] == '*':
+			depth++
+			i += 2
+		case i+1 < n && s[i] == '*' && s[i+1] == '/':
+			depth--
+			i += 2
+			if depth == 0 {
+				return i
+			}
+		default:
+			i++
+		}
+	}
+	return n
+}
+
+func isBraceAdjacentSpace(b byte) bool {
+	switch b {
+	case ' ', '\t', '\n', '\r', '{':
+		return true
+	}
+	return false
+}
+
 func NewNiriParser(configDir string) *NiriParser {
 	return &NiriParser{
 		configDir:          configDir,
@@ -91,7 +188,7 @@ func (p *NiriParser) parseDMSBindsDirectly(dmsBindsPath string, section *NiriSec
 		return
 	}
 
-	doc, err := kdl.Parse(strings.NewReader(string(data)))
+	doc, err := parseKDL(data)
 	if err != nil {
 		return
 	}
@@ -159,7 +256,7 @@ func (p *NiriParser) parseFile(filePath, sectionName string) (*NiriSection, erro
 		return nil, fmt.Errorf("failed to read %s: %w", absPath, err)
 	}
 
-	doc, err := kdl.Parse(strings.NewReader(string(data)))
+	doc, err := parseKDL(data)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse KDL in %s: %w", absPath, err)
 	}

core/internal/keybinds/providers/niri_parser_test.go

@@ -3,9 +3,74 @@ package providers
 import (
 	"os"
 	"path/filepath"
+	"slices"
 	"testing"
 )
 
+func TestNiriParse_NoSpaceBeforeBrace(t *testing.T) {
+	config := `recent-windows {
+    binds {
+        Alt+Tab         { next-window scope="output"; }
+        Alt+Shift+Tab   { previous-window scope="output"; }
+        Alt+grave       { next-window filter="app-id"; }
+        Alt+Shift+grave { previous-window filter="app-id"; }
+        Alt+Escape      { next-window scope="all"; }
+        Alt+Shift+Escape{ previous-window scope="all"; }
+    }
+}
+`
+	tmpDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(tmpDir, "config.kdl"), []byte(config), 0o644); err != nil {
+		t.Fatalf("Failed to write test config: %v", err)
+	}
+
+	result, err := ParseNiriKeys(tmpDir)
+	if err != nil {
+		t.Fatalf("ParseNiriKeys failed on valid niri config: %v", err)
+	}
+
+	var found *NiriKeyBinding
+	for i := range result.Section.Keybinds {
+		kb := &result.Section.Keybinds[i]
+		if kb.Key == "Escape" && slices.Contains(kb.Mods, "Alt") && slices.Contains(kb.Mods, "Shift") {
+			found = kb
+			break
+		}
+	}
+	if found == nil {
+		t.Fatal("Alt+Shift+Escape bind missing — '{' without preceding space was not handled")
+	}
+	if found.Action != "previous-window" {
+		t.Errorf("Action = %q, want %q", found.Action, "previous-window")
+	}
+}
+
+func TestNormalizeKDLBraces(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		out  string
+	}{
+		{"already spaced", "node { child }\n", "node { child }\n"},
+		{"missing space", "node{ child }\n", "node { child }\n"},
+		{"niri keybind", "Alt+Shift+Escape{ previous-window; }", "Alt+Shift+Escape { previous-window; }"},
+		{"brace inside string", `node "a{b" { child }`, `node "a{b" { child }`},
+		{"brace in line comment", "// foo{bar\nnode { }", "// foo{bar\nnode { }"},
+		{"brace in block comment", "/* foo{bar */ node{ }", "/* foo{bar */ node { }"},
+		{"escaped quote in string", `node "a\"b{c" { }`, `node "a\"b{c" { }`},
+		{"leading brace", "{ child }", "{ child }"},
+		{"nested missing space", "a{b{ c }}", "a {b { c }}"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := normalizeKDLBraces(tc.in)
+			if got != tc.out {
+				t.Errorf("normalizeKDLBraces(%q) = %q, want %q", tc.in, got, tc.out)
+			}
+		})
+	}
+}
+
 func TestNiriParseKeyCombo(t *testing.T) {
 	tests := []struct {
 		combo        string

core/internal/matugen/matugen.go

@@ -100,6 +100,7 @@ type Options struct {
 	IconTheme           string
 	MatugenType         string
 	RunUserTemplates    bool
+	ColorsOnly          bool
 	StockColors         string
 	SyncModeWithPortal  bool
 	TerminalsAlwaysDark bool
@@ -274,6 +275,10 @@ func buildOnce(opts *Options) (bool, error) {
 		return false, nil
 	}
 
+	if opts.ColorsOnly {
+		return true, nil
+	}
+
 	if isDMSGTKActive(opts.ConfigDir) {
 		switch opts.Mode {
 		case ColorModeLight:
@@ -331,6 +336,10 @@ output_path = '%s'
 
 `, opts.ShellDir, opts.ColorsOutput())
 
+	if opts.ColorsOnly {
+		return nil
+	}
+
 	homeDir, _ := os.UserHomeDir()
 	for _, tmpl := range templateRegistry {
 		if opts.ShouldSkipTemplate(tmpl.ID) {
@@ -597,10 +606,10 @@ func detectMatugenVersionLocked() (matugenFlags, error) {
 	matugenVersionOK = true
 
 	if matugenSupportsCOE {
-		log.Infof("Matugen %s supports --continue-on-error", versionStr)
+		log.Debugf("Matugen %s detected: continue-on-error support enabled", versionStr)
 	}
 	if matugenIsV4 {
-		log.Infof("Matugen %s: using v4 flags", versionStr)
+		log.Debugf("Matugen %s detected: using v4 compatibility flags", versionStr)
 	}
 	return matugenFlags{matugenSupportsCOE, matugenIsV4}, nil
 }

core/internal/matugen/matugen_test.go

@@ -3,6 +3,7 @@ package matugen
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	mocks_utils "github.com/AvengeMedia/DankMaterialShell/core/internal/mocks/utils"
@@ -392,3 +393,51 @@ func TestSubstituteVars(t *testing.T) {
 		})
 	}
 }
+
+func TestBuildMergedConfigColorsOnly(t *testing.T) {
+	tempDir := t.TempDir()
+
+	shellDir := filepath.Join(tempDir, "shell")
+	configsDir := filepath.Join(shellDir, "matugen", "configs")
+	if err := os.MkdirAll(configsDir, 0o755); err != nil {
+		t.Fatalf("failed to create configs dir: %v", err)
+	}
+
+	baseConfig := "[config]\ncustom_keywords = []\n"
+	if err := os.WriteFile(filepath.Join(configsDir, "base.toml"), []byte(baseConfig), 0o644); err != nil {
+		t.Fatalf("failed to write base config: %v", err)
+	}
+
+	cfgFile, err := os.CreateTemp(tempDir, "merged-*.toml")
+	if err != nil {
+		t.Fatalf("failed to create temp config: %v", err)
+	}
+	defer os.Remove(cfgFile.Name())
+	defer cfgFile.Close()
+
+	opts := &Options{
+		ShellDir:   shellDir,
+		ConfigDir:  filepath.Join(tempDir, "config"),
+		StateDir:   filepath.Join(tempDir, "state"),
+		ColorsOnly: true,
+	}
+
+	if err := buildMergedConfig(opts, cfgFile, filepath.Join(tempDir, "templates")); err != nil {
+		t.Fatalf("buildMergedConfig failed: %v", err)
+	}
+
+	if err := cfgFile.Close(); err != nil {
+		t.Fatalf("failed to close merged config: %v", err)
+	}
+
+	output, err := os.ReadFile(cfgFile.Name())
+	if err != nil {
+		t.Fatalf("failed to read merged config: %v", err)
+	}
+
+	content := string(output)
+	assert.Contains(t, content, "[templates.dank]")
+	assert.Contains(t, content, "output_path = '"+filepath.Join(opts.StateDir, "dms-colors.json")+"'")
+	assert.NotContains(t, content, "[templates.gtk]")
+	assert.False(t, strings.Contains(content, "output_path = 'CONFIG_DIR/"), "colors-only config should not emit app template outputs")
+}

core/internal/notify/notify.go

@@ -6,6 +6,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"syscall"
 
 	"github.com/godbus/dbus/v5"
@@ -59,7 +60,11 @@ func Send(n Notification) error {
 
 	hints := map[string]dbus.Variant{}
 	if n.FilePath != "" {
-		hints["image_path"] = dbus.MakeVariant(n.FilePath)
+		imgPath := n.FilePath
+		if !strings.HasPrefix(imgPath, "file://") {
+			imgPath = "file://" + imgPath
+		}
+		hints["image_path"] = dbus.MakeVariant(imgPath)
 	}
 
 	obj := conn.Object(notifyDest, notifyPath)

core/internal/privesc/privesc.go

@@ -0,0 +1,385 @@
+package privesc
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+// Tool identifies a privilege-escalation binary.
+type Tool string
+
+const (
+	ToolSudo Tool = "sudo"
+	ToolDoas Tool = "doas"
+	ToolRun0 Tool = "run0"
+)
+
+// EnvVar selects a specific tool when set to one of: sudo, doas, run0.
+const EnvVar = "DMS_PRIVESC"
+
+var detectionOrder = []Tool{ToolSudo, ToolDoas, ToolRun0}
+
+var (
+	detectOnce   sync.Once
+	detected     Tool
+	detectErr    error
+	userSelected bool
+)
+
+// Detect returns the tool that should be used for privilege escalation.
+// The result is cached after the first call.
+func Detect() (Tool, error) {
+	detectOnce.Do(func() {
+		detected, detectErr = detectTool()
+	})
+	return detected, detectErr
+}
+
+// ResetForTesting clears cached detection state.
+func ResetForTesting() {
+	detectOnce = sync.Once{}
+	detected = ""
+	detectErr = nil
+	userSelected = false
+}
+
+// AvailableTools returns the set of supported tools that are installed on
+// PATH, in detection-precedence order.
+func AvailableTools() []Tool {
+	var out []Tool
+	for _, t := range detectionOrder {
+		if t.Available() {
+			out = append(out, t)
+		}
+	}
+	return out
+}
+
+// EnvOverride returns the tool selected by the $DMS_PRIVESC env var (if any)
+// along with ok=true when the variable is set. An empty or unset variable
+// returns ok=false.
+func EnvOverride() (Tool, bool) {
+	v := strings.ToLower(strings.TrimSpace(os.Getenv(EnvVar)))
+	if v == "" {
+		return "", false
+	}
+	return Tool(v), true
+}
+
+// SetTool forces the detected tool to t, bypassing autodetection. Intended
+// for use after the caller has prompted the user for a selection.
+func SetTool(t Tool) error {
+	if !t.Available() {
+		return fmt.Errorf("%q is not installed", t.Name())
+	}
+	detectOnce = sync.Once{}
+	detectOnce.Do(func() {
+		detected = t
+		detectErr = nil
+	})
+	userSelected = true
+	return nil
+}
+
+func detectTool() (Tool, error) {
+	switch override := strings.ToLower(strings.TrimSpace(os.Getenv(EnvVar))); override {
+	case "":
+		// fall through to autodetect
+	case string(ToolSudo), string(ToolDoas), string(ToolRun0):
+		t := Tool(override)
+		if !t.Available() {
+			return "", fmt.Errorf("%s=%s but %q is not installed", EnvVar, override, t.Name())
+		}
+		return t, nil
+	default:
+		return "", fmt.Errorf("invalid %s=%q: must be one of sudo, doas, run0", EnvVar, override)
+	}
+
+	for _, t := range detectionOrder {
+		if t.Available() {
+			return t, nil
+		}
+	}
+	return "", fmt.Errorf("no supported privilege escalation tool found (tried: sudo, doas, run0)")
+}
+
+// Name returns the binary name.
+func (t Tool) Name() string { return string(t) }
+
+// Available reports whether this tool's binary is on PATH.
+func (t Tool) Available() bool {
+	if t == "" {
+		return false
+	}
+	_, err := exec.LookPath(string(t))
+	return err == nil
+}
+
+// SupportsStdinPassword reports whether the tool can accept a password via
+// stdin. Only sudo (-S) supports this.
+func (t Tool) SupportsStdinPassword() bool {
+	return t == ToolSudo
+}
+
+// EscapeSingleQuotes escapes single quotes for safe inclusion inside a
+// bash single-quoted string.
+func EscapeSingleQuotes(s string) string {
+	return strings.ReplaceAll(s, "'", "'\\''")
+}
+
+// MakeCommand returns a bash command string that runs `command` with the
+// detected tool. When the tool supports stdin passwords and password is
+// non-empty, the password is piped in. Otherwise the tool is invoked with
+// no non-interactive flag so that an interactive TTY prompt is still
+// possible for CLI callers.
+//
+// If detection fails, the returned shell string exits 1 with an error
+// message so callers that treat the *exec.Cmd as infallible still fail
+// deterministically.
+func MakeCommand(password, command string) string {
+	t, err := Detect()
+	if err != nil {
+		return failingShell(err)
+	}
+
+	switch t {
+	case ToolSudo:
+		if password != "" {
+			return fmt.Sprintf("echo '%s' | sudo -S %s", EscapeSingleQuotes(password), command)
+		}
+		return fmt.Sprintf("sudo %s", command)
+	case ToolDoas:
+		return fmt.Sprintf("doas sh -c '%s'", EscapeSingleQuotes(command))
+	case ToolRun0:
+		return fmt.Sprintf("run0 sh -c '%s'", EscapeSingleQuotes(command))
+	default:
+		return failingShell(fmt.Errorf("unsupported privilege tool: %q", t))
+	}
+}
+
+// ExecCommand builds an exec.Cmd that runs `command` as root via the
+// detected tool. Detection errors surface at Run() time as a failing
+// command writing a clear error to stderr.
+func ExecCommand(ctx context.Context, password, command string) *exec.Cmd {
+	return exec.CommandContext(ctx, "bash", "-c", MakeCommand(password, command))
+}
+
+// ExecArgv builds an exec.Cmd that runs argv as root via the detected tool.
+// No stdin password is supplied; callers relying on non-interactive success
+// should ensure cached credentials are present (see CheckCached).
+func ExecArgv(ctx context.Context, argv ...string) *exec.Cmd {
+	if len(argv) == 0 {
+		return exec.CommandContext(ctx, "bash", "-c", failingShell(fmt.Errorf("privesc.ExecArgv: argv must not be empty")))
+	}
+	t, err := Detect()
+	if err != nil {
+		return exec.CommandContext(ctx, "bash", "-c", failingShell(err))
+	}
+
+	switch t {
+	case ToolSudo, ToolDoas:
+		return exec.CommandContext(ctx, string(t), argv...)
+	case ToolRun0:
+		return exec.CommandContext(ctx, "run0", argv...)
+	default:
+		return exec.CommandContext(ctx, "bash", "-c", failingShell(fmt.Errorf("unsupported privilege tool: %q", t)))
+	}
+}
+
+func failingShell(err error) string {
+	return fmt.Sprintf("printf 'privesc: %%s\\n' '%s' >&2; exit 1", EscapeSingleQuotes(err.Error()))
+}
+
+// CheckCached runs a non-interactive credential probe. Returns nil if the
+// tool will run commands without prompting (cached credentials, nopass, or
+// polkit rule).
+func CheckCached(ctx context.Context) error {
+	t, err := Detect()
+	if err != nil {
+		return err
+	}
+
+	var cmd *exec.Cmd
+	switch t {
+	case ToolSudo:
+		cmd = exec.CommandContext(ctx, "sudo", "-n", "true")
+	case ToolDoas:
+		cmd = exec.CommandContext(ctx, "doas", "-n", "true")
+	case ToolRun0:
+		cmd = exec.CommandContext(ctx, "run0", "--no-ask-password", "true")
+	default:
+		return fmt.Errorf("unsupported privilege tool: %q", t)
+	}
+	return cmd.Run()
+}
+
+// ClearCache invalidates any cached credentials. No-op for tools that do
+// not expose a cache-clear operation.
+func ClearCache(ctx context.Context) error {
+	t, err := Detect()
+	if err != nil {
+		return err
+	}
+	switch t {
+	case ToolSudo:
+		return exec.CommandContext(ctx, "sudo", "-k").Run()
+	default:
+		return nil
+	}
+}
+
+// ValidateWithAskpass validates cached credentials using an askpass helper
+// script. Only sudo supports this mechanism; the TUI uses it to trigger
+// fingerprint authentication via PAM.
+func ValidateWithAskpass(ctx context.Context, askpassScript string) error {
+	t, err := Detect()
+	if err != nil {
+		return err
+	}
+	if t != ToolSudo {
+		return fmt.Errorf("askpass validation requires sudo (detected: %s)", t)
+	}
+	cmd := exec.CommandContext(ctx, "sudo", "-A", "-v")
+	cmd.Env = append(os.Environ(), fmt.Sprintf("SUDO_ASKPASS=%s", askpassScript))
+	return cmd.Run()
+}
+
+// ValidatePassword validates the given password. Only sudo supports this
+// (via `sudo -S -v`); for other tools the caller should fall back to
+// CheckCached.
+func ValidatePassword(ctx context.Context, password string) error {
+	t, err := Detect()
+	if err != nil {
+		return err
+	}
+	if t != ToolSudo {
+		return fmt.Errorf("password validation requires sudo (detected: %s)", t)
+	}
+
+	cmd := exec.CommandContext(ctx, "sudo", "-S", "-v")
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return err
+	}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	if _, err := fmt.Fprintf(stdin, "%s\n", password); err != nil {
+		stdin.Close()
+		_ = cmd.Wait()
+		return err
+	}
+	stdin.Close()
+	return cmd.Wait()
+}
+
+// QuoteArgsForShell wraps each argv element in single quotes so the result
+// can be safely passed to bash -c.
+func QuoteArgsForShell(argv []string) string {
+	parts := make([]string, len(argv))
+	for i, a := range argv {
+		parts[i] = "'" + EscapeSingleQuotes(a) + "'"
+	}
+	return strings.Join(parts, " ")
+}
+
+// Run invokes argv with privilege escalation. When the tool supports stdin
+// passwords and password is non-empty, the password is piped in. Otherwise
+// argv is invoked directly, which may prompt on a TTY.
+// Stdout and Stderr are inherited from the current process.
+func Run(ctx context.Context, password string, argv ...string) error {
+	if len(argv) == 0 {
+		return fmt.Errorf("privesc.Run: argv must not be empty")
+	}
+	t, err := Detect()
+	if err != nil {
+		return err
+	}
+
+	var cmd *exec.Cmd
+	switch {
+	case t == ToolSudo && password != "":
+		cmd = ExecCommand(ctx, password, QuoteArgsForShell(argv))
+	default:
+		cmd = ExecArgv(ctx, argv...)
+	}
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+
+// stdinIsTTY reports whether stdin is a character device (interactive
+// terminal) rather than a pipe or file.
+func stdinIsTTY() bool {
+	fi, err := os.Stdin.Stat()
+	if err != nil {
+		return false
+	}
+	return (fi.Mode() & os.ModeCharDevice) != 0
+}
+
+// PromptCLI interactively prompts the user to pick a privilege tool when more
+// than one is installed and $DMS_PRIVESC is not set. If stdin is not a TTY,
+// or only one tool is available, or the env var is set, the detected tool is
+// returned without any prompt.
+//
+// The prompt is written to out (typically os.Stdout/os.Stderr) and input is
+// read from in. EOF or empty input selects the first option.
+func PromptCLI(out io.Writer, in io.Reader) (Tool, error) {
+	if userSelected {
+		return Detect()
+	}
+	if _, envSet := EnvOverride(); envSet {
+		return Detect()
+	}
+
+	tools := AvailableTools()
+	switch len(tools) {
+	case 0:
+		return "", fmt.Errorf("no supported privilege tool (sudo/doas/run0) found on PATH")
+	case 1:
+		if err := SetTool(tools[0]); err != nil {
+			return "", err
+		}
+		return tools[0], nil
+	}
+
+	if !stdinIsTTY() {
+		return Detect()
+	}
+
+	fmt.Fprintln(out, "Multiple privilege escalation tools detected:")
+	for i, t := range tools {
+		fmt.Fprintf(out, "  [%d] %s\n", i+1, t.Name())
+	}
+	fmt.Fprintf(out, "Choose one [1-%d] (default 1, or set %s=<tool> to skip): ", len(tools), EnvVar)
+
+	reader := bufio.NewReader(in)
+	line, err := reader.ReadString('\n')
+	if err != nil && err != io.EOF {
+		return "", fmt.Errorf("failed to read selection: %w", err)
+	}
+	line = strings.TrimSpace(line)
+
+	idx := 1
+	if line != "" {
+		n, convErr := strconv.Atoi(line)
+		if convErr != nil || n < 1 || n > len(tools) {
+			return "", fmt.Errorf("invalid selection %q", line)
+		}
+		idx = n
+	}
+
+	chosen := tools[idx-1]
+	if err := SetTool(chosen); err != nil {
+		return "", err
+	}
+	return chosen, nil
+}

core/internal/screenshot/compositor.go

@@ -444,20 +444,21 @@ func GetFocusedMonitor() string {
 
 type outputInfo struct {
 	x, y      int32
+	scale     float64
 	transform int32
 }
 
-func getOutputInfo(outputName string) (*outputInfo, bool) {
+func getAllOutputInfos() map[string]*outputInfo {
 	display, err := client.Connect("")
 	if err != nil {
-		return nil, false
+		return nil
 	}
 	ctx := display.Context()
 	defer ctx.Close()
 
 	registry, err := display.GetRegistry()
 	if err != nil {
-		return nil, false
+		return nil
 	}
 
 	var outputManager *wlr_output_management.ZwlrOutputManagerV1
@@ -476,16 +477,17 @@ func getOutputInfo(outputName string) (*outputInfo, bool) {
 	})
 
 	if err := wlhelpers.Roundtrip(display, ctx); err != nil {
-		return nil, false
+		return nil
 	}
 
 	if outputManager == nil {
-		return nil, false
+		return nil
 	}
 
 	type headState struct {
 		name      string
 		x, y      int32
+		scale     float64
 		transform int32
 	}
 	heads := make(map[*wlr_output_management.ZwlrOutputHeadV1]*headState)
@@ -501,6 +503,9 @@ func getOutputInfo(outputName string) (*outputInfo, bool) {
 			state.x = pe.X
 			state.y = pe.Y
 		})
+		e.Head.SetScaleHandler(func(se wlr_output_management.ZwlrOutputHeadV1ScaleEvent) {
+			state.scale = se.Scale
+		})
 		e.Head.SetTransformHandler(func(te wlr_output_management.ZwlrOutputHeadV1TransformEvent) {
 			state.transform = te.Transform
 		})
@@ -511,21 +516,32 @@ func getOutputInfo(outputName string) (*outputInfo, bool) {
 
 	for !done {
 		if err := ctx.Dispatch(); err != nil {
-			return nil, false
+			return nil
 		}
 	}
 
+	result := make(map[string]*outputInfo, len(heads))
 	for _, state := range heads {
-		if state.name == outputName {
-			return &outputInfo{
-				x:         state.x,
-				y:         state.y,
-				transform: state.transform,
-			}, true
+		if state.name == "" {
+			continue
+		}
+		result[state.name] = &outputInfo{
+			x:         state.x,
+			y:         state.y,
+			scale:     state.scale,
+			transform: state.transform,
 		}
 	}
+	return result
+}
 
-	return nil, false
+func getOutputInfo(outputName string) (*outputInfo, bool) {
+	infos := getAllOutputInfos()
+	if infos == nil {
+		return nil, false
+	}
+	info, ok := infos[outputName]
+	return info, ok
 }
 
 func getDWLActiveWindow() (*WindowGeometry, error) {

core/internal/screenshot/screenshot.go

@@ -2,6 +2,7 @@ package screenshot
 
 import (
 	"fmt"
+	"math"
 	"sync"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
@@ -298,22 +299,20 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 	if len(outputs) == 0 {
 		return nil, fmt.Errorf("no outputs available")
 	}
-
 	if len(outputs) == 1 {
 		return s.captureWholeOutput(outputs[0])
 	}
 
-	// Capture all outputs first to get actual buffer sizes
-	type capturedOutput struct {
-		output *WaylandOutput
-		result *CaptureResult
-		physX  int
-		physY  int
-	}
-	captured := make([]capturedOutput, 0, len(outputs))
+	wlrInfos := getAllOutputInfos()
 
-	var minX, minY, maxX, maxY int
-	first := true
+	type pendingOutput struct {
+		result *CaptureResult
+		logX   float64
+		logY   float64
+		scale  float64
+	}
+	var pending []pendingOutput
+	maxScale := 1.0
 
 	for _, output := range outputs {
 		result, err := s.captureWholeOutput(output)
@@ -322,50 +321,74 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 			continue
 		}
 
-		outX, outY := output.x, output.y
+		logX, logY := float64(output.x), float64(output.y)
 		scale := float64(output.scale)
+
 		switch DetectCompositor() {
 		case CompositorHyprland:
 			if hx, hy, _, _, ok := GetHyprlandMonitorGeometry(output.name); ok {
-				outX, outY = hx, hy
+				logX, logY = float64(hx), float64(hy)
 			}
-			if s := GetHyprlandMonitorScale(output.name); s > 0 {
-				scale = s
+			if hs := GetHyprlandMonitorScale(output.name); hs > 0 {
+				scale = hs
 			}
-		case CompositorDWL:
-			if info, ok := getOutputInfo(output.name); ok {
-				outX, outY = info.x, info.y
+		default:
+			if wlrInfos != nil {
+				if info, ok := wlrInfos[output.name]; ok {
+					logX, logY = float64(info.x), float64(info.y)
+					if info.scale > 0 {
+						scale = info.scale
+					}
+				}
 			}
 		}
+
 		if scale <= 0 {
 			scale = 1.0
 		}
 
-		physX := int(float64(outX) * scale)
-		physY := int(float64(outY) * scale)
+		pending = append(pending, pendingOutput{result: result, logX: logX, logY: logY, scale: scale})
+		if scale > maxScale {
+			maxScale = scale
+		}
+	}
 
-		captured = append(captured, capturedOutput{
-			output: output,
-			result: result,
-			physX:  physX,
-			physY:  physY,
-		})
+	if len(pending) == 0 {
+		return nil, fmt.Errorf("failed to capture any outputs")
+	}
+	if len(pending) == 1 {
+		return pending[0].result, nil
+	}
 
-		right := physX + result.Buffer.Width
-		bottom := physY + result.Buffer.Height
+	type layoutEntry struct {
+		result  *CaptureResult
+		canvasX int
+		canvasY int
+		canvasW int
+		canvasH int
+	}
+	entries := make([]layoutEntry, len(pending))
+	var minX, minY, maxX, maxY int
 
-		if first {
-			minX, minY = physX, physY
-			maxX, maxY = right, bottom
-			first = false
+	for i, p := range pending {
+		cx := int(math.Round(p.logX * maxScale))
+		cy := int(math.Round(p.logY * maxScale))
+		cw := int(math.Round(float64(p.result.Buffer.Width) * maxScale / p.scale))
+		ch := int(math.Round(float64(p.result.Buffer.Height) * maxScale / p.scale))
+
+		entries[i] = layoutEntry{result: p.result, canvasX: cx, canvasY: cy, canvasW: cw, canvasH: ch}
+
+		right := cx + cw
+		bottom := cy + ch
+		if i == 0 {
+			minX, minY, maxX, maxY = cx, cy, right, bottom
 			continue
 		}
-
-		if physX < minX {
-			minX = physX
+		if cx < minX {
+			minX = cx
 		}
-		if physY < minY {
-			minY = physY
+		if cy < minY {
+			minY = cy
 		}
 		if right > maxX {
 			maxX = right
@@ -375,35 +398,26 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 		}
 	}
 
-	if len(captured) == 0 {
-		return nil, fmt.Errorf("failed to capture any outputs")
-	}
-
-	if len(captured) == 1 {
-		return captured[0].result, nil
-	}
-
 	totalW := maxX - minX
 	totalH := maxY - minY
-
-	compositeStride := totalW * 4
-	composite, err := CreateShmBuffer(totalW, totalH, compositeStride)
+	composite, err := CreateShmBuffer(totalW, totalH, totalW*4)
 	if err != nil {
-		for _, c := range captured {
-			c.result.Buffer.Close()
+		for _, e := range entries {
+			e.result.Buffer.Close()
 		}
 		return nil, fmt.Errorf("create composite buffer: %w", err)
 	}
-
 	composite.Clear()
 
 	var format uint32
-	for _, c := range captured {
+	for _, e := range entries {
 		if format == 0 {
-			format = c.result.Format
+			format = e.result.Format
 		}
-		s.blitBuffer(composite, c.result.Buffer, c.physX-minX, c.physY-minY, c.result.YInverted)
-		c.result.Buffer.Close()
+		s.blitBufferScaled(composite, e.result.Buffer,
+			e.canvasX-minX, e.canvasY-minY, e.canvasW, e.canvasH,
+			e.result.YInverted)
+		e.result.Buffer.Close()
 	}
 
 	return &CaptureResult{
@@ -413,32 +427,44 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 	}, nil
 }
 
-func (s *Screenshoter) blitBuffer(dst, src *ShmBuffer, dstX, dstY int, yInverted bool) {
+func (s *Screenshoter) blitBufferScaled(dst, src *ShmBuffer, dstX, dstY, dstW, dstH int, yInverted bool) {
+	if dstW <= 0 || dstH <= 0 {
+		return
+	}
+
 	srcData := src.Data()
 	dstData := dst.Data()
 
-	for srcY := 0; srcY < src.Height; srcY++ {
-		actualSrcY := srcY
-		if yInverted {
-			actualSrcY = src.Height - 1 - srcY
-		}
-
-		dy := dstY + srcY
-		if dy < 0 || dy >= dst.Height {
+	for dy := 0; dy < dstH; dy++ {
+		canvasY := dstY + dy
+		if canvasY < 0 || canvasY >= dst.Height {
 			continue
 		}
 
-		srcRowOff := actualSrcY * src.Stride
-		dstRowOff := dy * dst.Stride
+		srcY := dy * src.Height / dstH
+		if yInverted {
+			srcY = src.Height - 1 - srcY
+		}
+		if srcY < 0 || srcY >= src.Height {
+			continue
+		}
 
-		for srcX := 0; srcX < src.Width; srcX++ {
-			dx := dstX + srcX
-			if dx < 0 || dx >= dst.Width {
+		srcRowOff := srcY * src.Stride
+		dstRowOff := canvasY * dst.Stride
+
+		for dx := 0; dx < dstW; dx++ {
+			canvasX := dstX + dx
+			if canvasX < 0 || canvasX >= dst.Width {
+				continue
+			}
+
+			srcX := dx * src.Width / dstW
+			if srcX >= src.Width {
 				continue
 			}
 
 			si := srcRowOff + srcX*4
-			di := dstRowOff + dx*4
+			di := dstRowOff + canvasX*4
 
 			if si+3 >= len(srcData) || di+3 >= len(dstData) {
 				continue

core/internal/server/brightness/ddc.go

@@ -215,31 +215,34 @@ func (b *DDCBackend) SetBrightnessWithExponent(id string, value int, exponential
 		callback: callback,
 	}
 
-	if timer, exists := b.debounceTimers[id]; exists {
-		timer.Reset(200 * time.Millisecond)
-	} else {
-		b.debounceTimers[id] = time.AfterFunc(200*time.Millisecond, func() {
-			b.debounceMutex.Lock()
-			pending, exists := b.debouncePending[id]
-			if exists {
-				delete(b.debouncePending, id)
-			}
-			b.debounceMutex.Unlock()
-
-			if !exists {
-				return
-			}
-
-			err := b.setBrightnessImmediateWithExponent(id, pending.percent)
-			if err != nil {
-				log.Debugf("Failed to set brightness for %s: %v", id, err)
-			}
-
-			if pending.callback != nil {
-				pending.callback()
-			}
-		})
+	if existing, exists := b.debounceTimers[id]; exists {
+		if existing.Stop() {
+			b.debounceWg.Done()
+		}
 	}
+
+	b.debounceWg.Add(1)
+	b.debounceTimers[id] = time.AfterFunc(200*time.Millisecond, func() {
+		defer b.debounceWg.Done()
+
+		b.debounceMutex.Lock()
+		pending, hasPending := b.debouncePending[id]
+		delete(b.debouncePending, id)
+		delete(b.debounceTimers, id)
+		b.debounceMutex.Unlock()
+
+		if !hasPending {
+			return
+		}
+
+		if err := b.setBrightnessImmediateWithExponent(id, pending.percent); err != nil {
+			log.Debugf("Failed to set brightness for %s: %v", id, err)
+		}
+
+		if pending.callback != nil {
+			pending.callback()
+		}
+	})
 	b.debounceMutex.Unlock()
 
 	return nil
@@ -490,5 +493,19 @@ func (b *DDCBackend) valueToPercent(value int, max int, exponential bool) int {
 	return percent
 }
 
+func (b *DDCBackend) WaitPending() {
+	done := make(chan struct{})
+	go func() {
+		b.debounceWg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		log.Debug("WaitPending timed out waiting for DDC writes")
+	}
+}
+
 func (b *DDCBackend) Close() {
 }

core/internal/server/brightness/types.go

@@ -84,6 +84,7 @@ type DDCBackend struct {
 	debounceMutex   sync.Mutex
 	debounceTimers  map[string]*time.Timer
 	debouncePending map[string]ddcPendingSet
+	debounceWg      sync.WaitGroup
 }
 
 type ddcPendingSet struct {

core/internal/server/clipboard/manager.go

@@ -212,9 +212,10 @@ func (m *Manager) setupDataDeviceSync() {
 		}
 
 		var offer any
-		if e.Id != nil {
+		switch {
+		case e.Id != nil:
 			offer = e.Id
-		} else if e.OfferId != 0 {
+		case e.OfferId != 0:
 			m.offerMutex.RLock()
 			offer = m.offerRegistry[e.OfferId]
 			m.offerMutex.RUnlock()
@@ -224,10 +225,6 @@ func (m *Manager) setupDataDeviceSync() {
 		wasOwner := m.isOwner
 		m.ownerLock.Unlock()
 
-		if offer == nil {
-			return
-		}
-
 		if wasOwner {
 			return
 		}
@@ -236,9 +233,11 @@ func (m *Manager) setupDataDeviceSync() {
 		m.currentOffer = offer
 
 		if prevOffer != nil && prevOffer != offer {
-			m.offerMutex.Lock()
-			delete(m.offerMimeTypes, prevOffer)
-			m.offerMutex.Unlock()
+			m.releaseOffer(prevOffer)
+		}
+
+		if offer == nil {
+			return
 		}
 
 		m.offerMutex.RLock()
@@ -292,6 +291,33 @@ func (m *Manager) setupDataDeviceSync() {
 	log.Info("Data device setup complete")
 }
 
+func (m *Manager) releaseOffer(offer any) {
+	if offer == nil {
+		return
+	}
+	typedOffer, ok := offer.(*ext_data_control.ExtDataControlOfferV1)
+	if !ok {
+		return
+	}
+	m.offerMutex.Lock()
+	delete(m.offerMimeTypes, offer)
+	delete(m.offerRegistry, typedOffer.ID())
+	m.offerMutex.Unlock()
+	typedOffer.Destroy()
+}
+
+func (m *Manager) releaseCurrentSource() {
+	if m.currentSource == nil {
+		return
+	}
+	source, ok := m.currentSource.(*ext_data_control.ExtDataControlSourceV1)
+	m.currentSource = nil
+	if !ok {
+		return
+	}
+	source.Destroy()
+}
+
 func (m *Manager) readAndStore(r *os.File, mimeType string) {
 	defer r.Close()
 
@@ -395,7 +421,7 @@ func (m *Manager) deduplicateInTx(b *bolt.Bucket, hash uint64) error {
 		if extractHash(v) != hash {
 			continue
 		}
-		entry, err := decodeEntry(v)
+		entry, err := decodeEntryMeta(v)
 		if err == nil && entry.Pinned {
 			continue
 		}
@@ -413,7 +439,7 @@ func (m *Manager) trimLengthInTx(b *bolt.Bucket) error {
 	c := b.Cursor()
 	var count int
 	for k, v := c.Last(); k != nil; k, v = c.Prev() {
-		entry, err := decodeEntry(v)
+		entry, err := decodeEntryMeta(v)
 		if err == nil && entry.Pinned {
 			continue
 		}
@@ -456,6 +482,14 @@ func encodeEntry(e Entry) ([]byte, error) {
 }
 
 func decodeEntry(data []byte) (Entry, error) {
+	return decodeEntryFields(data, true)
+}
+
+func decodeEntryMeta(data []byte) (Entry, error) {
+	return decodeEntryFields(data, false)
+}
+
+func decodeEntryFields(data []byte, withData bool) (Entry, error) {
 	buf := bytes.NewReader(data)
 	var e Entry
 
@@ -463,8 +497,15 @@ func decodeEntry(data []byte) (Entry, error) {
 
 	var dataLen uint32
 	binary.Read(buf, binary.BigEndian, &dataLen)
-	e.Data = make([]byte, dataLen)
-	buf.Read(e.Data)
+	switch {
+	case withData:
+		e.Data = make([]byte, dataLen)
+		buf.Read(e.Data)
+	default:
+		if _, err := buf.Seek(int64(dataLen), io.SeekCurrent); err != nil {
+			return e, err
+		}
+	}
 
 	var mimeLen uint32
 	binary.Read(buf, binary.BigEndian, &mimeLen)
@@ -668,14 +709,9 @@ func sizeStr(size int) string {
 func (m *Manager) updateState() {
 	history := m.GetHistory()
 
-	for i := range history {
-		history[i].Data = nil
-	}
-
 	var current *Entry
 	if len(history) > 0 {
 		c := history[0]
-		c.Data = nil
 		current = &c
 	}
 
@@ -750,7 +786,7 @@ func (m *Manager) GetHistory() []Entry {
 		c := b.Cursor()
 
 		for k, v := c.Last(); k != nil; k, v = c.Prev() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil {
 				continue
 			}
@@ -935,7 +971,7 @@ func (m *Manager) ClearHistory() {
 		var toDelete [][]byte
 		c := b.Cursor()
 		for k, v := c.First(); k != nil; k, v = c.Next() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil || !entry.Pinned {
 				toDelete = append(toDelete, k)
 			}
@@ -958,7 +994,7 @@ func (m *Manager) ClearHistory() {
 		if b != nil {
 			c := b.Cursor()
 			for k, v := c.First(); k != nil; k, v = c.Next() {
-				entry, _ := decodeEntry(v)
+				entry, _ := decodeEntryMeta(v)
 				if entry.Pinned {
 					pinnedCount++
 				}
@@ -1066,6 +1102,7 @@ func (m *Manager) SetClipboard(data []byte, mimeType string) error {
 			m.ownerLock.Unlock()
 		})
 
+		m.releaseCurrentSource()
 		m.currentSource = source
 		m.sourceMutex.Lock()
 		m.sourceMimeTypes = []string{mimeType}
@@ -1145,9 +1182,11 @@ func (m *Manager) Close() {
 	m.subscribers = make(map[string]chan State)
 	m.subMutex.Unlock()
 
-	if m.currentSource != nil {
-		source := m.currentSource.(*ext_data_control.ExtDataControlSourceV1)
-		source.Destroy()
+	m.releaseCurrentSource()
+
+	if m.currentOffer != nil {
+		m.releaseOffer(m.currentOffer)
+		m.currentOffer = nil
 	}
 
 	if m.dataDevice != nil {
@@ -1191,11 +1230,10 @@ func (m *Manager) clearOldEntries(days int) error {
 		var toDelete [][]byte
 		c := b.Cursor()
 		for k, v := c.First(); k != nil; k, v = c.Next() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil {
 				continue
 			}
-			// Skip pinned entries
 			if entry.Pinned {
 				continue
 			}
@@ -1310,7 +1348,7 @@ func (m *Manager) Search(params SearchParams) SearchResult {
 
 		c := b.Cursor()
 		for k, v := c.Last(); k != nil; k, v = c.Prev() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil {
 				continue
 			}
@@ -1335,7 +1373,6 @@ func (m *Manager) Search(params SearchParams) SearchResult {
 				continue
 			}
 
-			entry.Data = nil
 			all = append(all, entry)
 		}
 		return nil
@@ -1510,7 +1547,7 @@ func (m *Manager) PinEntry(id uint64) error {
 		}
 		c := b.Cursor()
 		for k, v := c.First(); k != nil; k, v = c.Next() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil || !entry.Pinned {
 				continue
 			}
@@ -1528,7 +1565,6 @@ func (m *Manager) PinEntry(id uint64) error {
 		return nil
 	}
 
-	// Check pinned count
 	cfg := m.getConfig()
 	pinnedCount := 0
 	if err := m.db.View(func(tx *bolt.Tx) error {
@@ -1538,7 +1574,7 @@ func (m *Manager) PinEntry(id uint64) error {
 		}
 		c := b.Cursor()
 		for k, v := c.First(); k != nil; k, v = c.Next() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err == nil && entry.Pinned {
 				pinnedCount++
 			}
@@ -1629,12 +1665,11 @@ func (m *Manager) GetPinnedEntries() []Entry {
 
 		c := b.Cursor()
 		for k, v := c.Last(); k != nil; k, v = c.Prev() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err != nil {
 				continue
 			}
 			if entry.Pinned {
-				entry.Data = nil
 				pinned = append(pinned, entry)
 			}
 		}
@@ -1660,7 +1695,7 @@ func (m *Manager) GetPinnedCount() int {
 
 		c := b.Cursor()
 		for k, v := c.First(); k != nil; k, v = c.Next() {
-			entry, err := decodeEntry(v)
+			entry, err := decodeEntryMeta(v)
 			if err == nil && entry.Pinned {
 				count++
 			}
@@ -1779,6 +1814,7 @@ func (m *Manager) CopyFile(filePath string) error {
 			m.ownerLock.Unlock()
 		})
 
+		m.releaseCurrentSource()
 		m.currentSource = source
 
 		m.ownerLock.Lock()

core/internal/server/evdev/manager.go

@@ -391,7 +391,7 @@ func (m *Manager) Close() {
 
 func InitializeManager() (*Manager, error) {
 	if os.Getuid() != 0 && !hasInputGroupAccess() {
-		return nil, fmt.Errorf("insufficient permissions to access input devices")
+		return nil, fmt.Errorf("insufficient permissions to access input devices. Add your user to the 'input' group: `sudo usermod -a -G input $USER` or run `dms setup`")
 	}
 
 	return NewManager()

core/internal/server/freedesktop/screensaver.go

@@ -104,7 +104,7 @@ func (m *Manager) claimScreensaverName(handler *screensaverHandler, name, iface
 		return false
 	}
 	if reply != dbus.RequestNameReplyPrimaryOwner {
-		log.Warnf("Screensaver name %s already owned by another process", name)
+		log.Infof("Screensaver name %s already owned by another process (e.g. hypridle/swayidle)", name)
 		return false
 	}
 	if err := m.exportScreensaverOnPaths(handler, iface, paths...); err != nil {

core/internal/server/network/backend_networkmanager_wifi.go

@@ -158,18 +158,26 @@ func (b *NetworkManagerBackend) GetWiFiNetworkDetails(ssid string) (*NetworkInfo
 
 		channel := frequencyToChannel(freq)
 
+		isConnected := ssid == currentSSID && bssid == currentBSSID
+		rate := maxBitrate / 1000
+		if isConnected {
+			if devBitrate, err := w.GetPropertyBitrate(); err == nil && devBitrate > 0 {
+				rate = devBitrate / 1000
+			}
+		}
+
 		network := WiFiNetwork{
 			SSID:        ssid,
 			BSSID:       bssid,
 			Signal:      strength,
 			Secured:     secured,
 			Enterprise:  enterprise,
-			Connected:   ssid == currentSSID && bssid == currentBSSID,
+			Connected:   isConnected,
 			Saved:       savedSSIDs[ssid],
 			Autoconnect: autoconnectMap[ssid],
 			Frequency:   freq,
 			Mode:        modeStr,
-			Rate:        maxBitrate / 1000,
+			Rate:        rate,
 			Channel:     channel,
 		}
 
@@ -455,19 +463,27 @@ func (b *NetworkManagerBackend) updateWiFiNetworks() ([]WiFiNetwork, error) {
 
 		channel := frequencyToChannel(freq)
 
+		isConnected := ssid == currentSSID
+		rate := maxBitrate / 1000
+		if isConnected {
+			if devBitrate, err := w.GetPropertyBitrate(); err == nil && devBitrate > 0 {
+				rate = devBitrate / 1000
+			}
+		}
+
 		network := WiFiNetwork{
 			SSID:        ssid,
 			BSSID:       bssid,
 			Signal:      strength,
 			Secured:     secured,
 			Enterprise:  enterprise,
-			Connected:   ssid == currentSSID,
+			Connected:   isConnected,
 			Saved:       savedSSIDs[ssid],
 			Autoconnect: autoconnectMap[ssid],
 			Hidden:      hiddenSSIDs[ssid],
 			Frequency:   freq,
 			Mode:        modeStr,
-			Rate:        maxBitrate / 1000,
+			Rate:        rate,
 			Channel:     channel,
 		}
 
@@ -1003,19 +1019,27 @@ func (b *NetworkManagerBackend) updateAllWiFiDevices() {
 
 				channel := frequencyToChannel(freq)
 
+				isConnected := connected && apSSID == ssid
+				rate := maxBitrate / 1000
+				if isConnected {
+					if devBitrate, err := devInfo.wireless.GetPropertyBitrate(); err == nil && devBitrate > 0 {
+						rate = devBitrate / 1000
+					}
+				}
+
 				network := WiFiNetwork{
 					SSID:        apSSID,
 					BSSID:       apBSSID,
 					Signal:      strength,
 					Secured:     secured,
 					Enterprise:  enterprise,
-					Connected:   connected && apSSID == ssid,
+					Connected:   isConnected,
 					Saved:       savedSSIDs[apSSID],
 					Autoconnect: autoconnectMap[apSSID],
 					Hidden:      hiddenSSIDs[apSSID],
 					Frequency:   freq,
 					Mode:        modeStr,
-					Rate:        maxBitrate / 1000,
+					Rate:        rate,
 					Channel:     channel,
 					Device:      name,
 				}

core/internal/server/network/detect_test.go

@@ -1,6 +1,7 @@
 package network
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -28,7 +29,13 @@ func TestDetectResult_HasNetworkdField(t *testing.T) {
 
 func TestDetectNetworkStack_Integration(t *testing.T) {
 	result, err := DetectNetworkStack()
+
+	if err != nil && strings.Contains(err.Error(), "connect system bus") {
+		t.Skipf("system D-Bus unavailable: %v", err)
+	}
+
 	assert.NoError(t, err)
-	assert.NotNil(t, result)
-	assert.NotEmpty(t, result.ChosenReason)
+	if assert.NotNil(t, result) {
+		assert.NotEmpty(t, result.ChosenReason)
+	}
 }

core/internal/server/wlroutput/manager.go

@@ -13,7 +13,7 @@ func NewManager(display wlclient.WaylandDisplay) (*Manager, error) {
 	m := &Manager{
 		display:    display,
 		ctx:        display.Context(),
-		cmdq:       make(chan cmd, 128),
+		cmdq:       make(chan cmd, 512),
 		stopChan:   make(chan struct{}),
 		dirty:      make(chan struct{}, 1),
 		fatalError: make(chan error, 1),

core/internal/tui/app.go

@@ -3,6 +3,7 @@ package tui
 import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	"github.com/charmbracelet/bubbles/spinner"
 	"github.com/charmbracelet/bubbles/textinput"
 	tea "github.com/charmbracelet/bubbletea"
@@ -42,6 +43,9 @@ type Model struct {
 	sudoPassword       string
 	existingConfigs    []ExistingConfigInfo
 	fingerprintFailed  bool
+
+	availablePrivesc []privesc.Tool
+	selectedPrivesc  int
 }
 
 func NewModel(version string, logFilePath string) Model {
@@ -147,6 +151,8 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		return m.updateGentooUseFlagsState(msg)
 	case StateGentooGCCCheck:
 		return m.updateGentooGCCCheckState(msg)
+	case StateSelectPrivesc:
+		return m.updateSelectPrivescState(msg)
 	case StateAuthMethodChoice:
 		return m.updateAuthMethodChoiceState(msg)
 	case StateFingerprintAuth:
@@ -189,6 +195,8 @@ func (m Model) View() string {
 		return m.viewGentooUseFlags()
 	case StateGentooGCCCheck:
 		return m.viewGentooGCCCheck()
+	case StateSelectPrivesc:
+		return m.viewSelectPrivesc()
 	case StateAuthMethodChoice:
 		return m.viewAuthMethodChoice()
 	case StateFingerprintAuth:

core/internal/tui/states.go

@@ -10,6 +10,7 @@ const (
 	StateDependencyReview
 	StateGentooUseFlags
 	StateGentooGCCCheck
+	StateSelectPrivesc
 	StateAuthMethodChoice
 	StateFingerprintAuth
 	StatePasswordPrompt

core/internal/tui/views_dependencies.go

@@ -180,16 +180,7 @@ func (m Model) updateDependencyReviewState(msg tea.Msg) (tea.Model, tea.Cmd) {
 					return m, nil
 				}
 			}
-			// Check if fingerprint is enabled
-			if checkFingerprintEnabled() {
-				m.state = StateAuthMethodChoice
-				m.selectedConfig = 0 // Default to fingerprint
-				return m, nil
-			} else {
-				m.state = StatePasswordPrompt
-				m.passwordInput.Focus()
-				return m, nil
-			}
+			return m.enterAuthPhase()
 		case "esc":
 			m.state = StateSelectWindowManager
 			return m, nil

core/internal/tui/views_gentoo_use_flags.go

@@ -56,14 +56,7 @@ func (m Model) updateGentooUseFlagsState(msg tea.Msg) (tea.Model, tea.Cmd) {
 			m.state = StateGentooGCCCheck
 			return m, nil
 		}
-		if checkFingerprintEnabled() {
-			m.state = StateAuthMethodChoice
-			m.selectedConfig = 0
-		} else {
-			m.state = StatePasswordPrompt
-			m.passwordInput.Focus()
-		}
-		return m, nil
+		return m.enterAuthPhase()
 	}
 
 	if keyMsg, ok := msg.(tea.KeyMsg); ok {
@@ -75,14 +68,7 @@ func (m Model) updateGentooUseFlagsState(msg tea.Msg) (tea.Model, tea.Cmd) {
 			if m.selectedWM == 1 {
 				return m, m.checkGCCVersion()
 			}
-			if checkFingerprintEnabled() {
-				m.state = StateAuthMethodChoice
-				m.selectedConfig = 0
-			} else {
-				m.state = StatePasswordPrompt
-				m.passwordInput.Focus()
-			}
-			return m, nil
+			return m.enterAuthPhase()
 		case "esc":
 			m.state = StateDependencyReview
 			return m, nil

core/internal/tui/views_install.go

@@ -139,7 +139,7 @@ func dmsPackageName(distroID string, dependencies []deps.Dependency) string {
 		if isGit {
 			return "dms-shell-git"
 		}
-		return "dms-shell-bin"
+		return "dms-shell"
 	case distros.FamilyFedora, distros.FamilyUbuntu, distros.FamilyDebian, distros.FamilySUSE:
 		if isGit {
 			return "dms-git"

core/internal/tui/views_password.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	tea "github.com/charmbracelet/bubbletea"
 )
 
@@ -274,8 +275,7 @@ func (m Model) delayThenReturn() tea.Cmd {
 
 func (m Model) tryFingerprint() tea.Cmd {
 	return func() tea.Msg {
-		clearCmd := exec.Command("sudo", "-k")
-		clearCmd.Run()
+		_ = privesc.ClearCache(context.Background())
 
 		tmpDir := os.TempDir()
 		askpassScript := filepath.Join(tmpDir, fmt.Sprintf("danklinux-fp-%d.sh", time.Now().UnixNano()))
@@ -289,15 +289,9 @@ func (m Model) tryFingerprint() tea.Cmd {
 		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 		defer cancel()
 
-		cmd := exec.CommandContext(ctx, "sudo", "-A", "-v")
-		cmd.Env = append(os.Environ(), fmt.Sprintf("SUDO_ASKPASS=%s", askpassScript))
-
-		err := cmd.Run()
-
-		if err != nil {
+		if err := privesc.ValidateWithAskpass(ctx, askpassScript); err != nil {
 			return passwordValidMsg{password: "", valid: false}
 		}
-
 		return passwordValidMsg{password: "", valid: true}
 	}
 }
@@ -307,32 +301,9 @@ func (m Model) validatePassword(password string) tea.Cmd {
 		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 		defer cancel()
 
-		cmd := exec.CommandContext(ctx, "sudo", "-S", "-v")
-
-		stdin, err := cmd.StdinPipe()
-		if err != nil {
+		if err := privesc.ValidatePassword(ctx, password); err != nil {
 			return passwordValidMsg{password: "", valid: false}
 		}
-
-		if err := cmd.Start(); err != nil {
-			return passwordValidMsg{password: "", valid: false}
-		}
-
-		_, err = fmt.Fprintf(stdin, "%s\n", password)
-		stdin.Close()
-		if err != nil {
-			return passwordValidMsg{password: "", valid: false}
-		}
-
-		err = cmd.Wait()
-
-		if err != nil {
-			if ctx.Err() == context.DeadlineExceeded {
-				return passwordValidMsg{password: "", valid: false}
-			}
-			return passwordValidMsg{password: "", valid: false}
-		}
-
 		return passwordValidMsg{password: password, valid: true}
 	}
 }

core/internal/tui/views_privesc.go

@@ -0,0 +1,133 @@
+package tui
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func (m Model) viewSelectPrivesc() string {
+	var b strings.Builder
+
+	b.WriteString(m.renderBanner())
+	b.WriteString("\n")
+	b.WriteString(m.styles.Title.Render("Privilege Escalation Tool"))
+	b.WriteString("\n\n")
+	b.WriteString(m.styles.Normal.Render("Multiple privilege tools are available. Choose one for installation:"))
+	b.WriteString("\n\n")
+
+	for i, t := range m.availablePrivesc {
+		label := fmt.Sprintf("%s  —  %s", t.Name(), privescToolDescription(t))
+		switch i {
+		case m.selectedPrivesc:
+			b.WriteString(m.styles.SelectedOption.Render("▶ " + label))
+		default:
+			b.WriteString(m.styles.Normal.Render("  " + label))
+		}
+		b.WriteString("\n")
+	}
+
+	b.WriteString("\n")
+	b.WriteString(m.styles.Subtle.Render(fmt.Sprintf("Set %s=<tool> to skip this prompt in future runs.", privesc.EnvVar)))
+	b.WriteString("\n\n")
+	b.WriteString(m.styles.Subtle.Render("↑/↓: Navigate, Enter: Select, Esc: Back"))
+	return b.String()
+}
+
+func (m Model) updateSelectPrivescState(msg tea.Msg) (tea.Model, tea.Cmd) {
+	keyMsg, ok := msg.(tea.KeyMsg)
+	if !ok {
+		return m, m.listenForLogs()
+	}
+
+	switch keyMsg.String() {
+	case "up":
+		if m.selectedPrivesc > 0 {
+			m.selectedPrivesc--
+		}
+	case "down":
+		if m.selectedPrivesc < len(m.availablePrivesc)-1 {
+			m.selectedPrivesc++
+		}
+	case "enter":
+		chosen := m.availablePrivesc[m.selectedPrivesc]
+		if err := privesc.SetTool(chosen); err != nil {
+			m.err = fmt.Errorf("failed to select %s: %w", chosen.Name(), err)
+			m.state = StateError
+			return m, nil
+		}
+		return m.routeToAuthAfterPrivesc()
+	case "esc":
+		m.state = StateDependencyReview
+		return m, nil
+	}
+	return m, nil
+}
+
+func privescToolDescription(t privesc.Tool) string {
+	switch t {
+	case privesc.ToolSudo:
+		return "classic sudo (supports password prompt in this installer)"
+	case privesc.ToolDoas:
+		return "OpenBSD-style doas (requires persist or nopass in /etc/doas.conf)"
+	case privesc.ToolRun0:
+		return "systemd run0 (authenticated via polkit)"
+	default:
+		return string(t)
+	}
+}
+
+// routeToAuthAfterPrivesc advances from the privesc-selection screen to the
+// right auth flow. Sudo goes through the fingerprint/password path; doas and
+// run0 skip password entry and proceed to install.
+func (m Model) routeToAuthAfterPrivesc() (tea.Model, tea.Cmd) {
+	tool, err := privesc.Detect()
+	if err != nil {
+		m.err = err
+		m.state = StateError
+		return m, nil
+	}
+
+	if tool == privesc.ToolSudo {
+		if checkFingerprintEnabled() {
+			m.state = StateAuthMethodChoice
+			m.selectedConfig = 0
+			return m, nil
+		}
+		m.state = StatePasswordPrompt
+		m.passwordInput.Focus()
+		return m, nil
+	}
+
+	m.sudoPassword = ""
+	m.packageProgress = packageInstallProgressMsg{}
+	m.state = StateInstallingPackages
+	m.isLoading = true
+	return m, tea.Batch(m.spinner.Tick, m.installPackages())
+}
+
+// enterAuthPhase is called when dependency review (or the Gentoo screens)
+// finish. It either routes directly to the sudo/fingerprint flow or shows
+// the privesc-tool selection screen when multiple tools are available and
+// no $DMS_PRIVESC override is set.
+func (m Model) enterAuthPhase() (tea.Model, tea.Cmd) {
+	tools := privesc.AvailableTools()
+	_, envSet := privesc.EnvOverride()
+
+	if len(tools) == 0 {
+		m.err = fmt.Errorf("no supported privilege tool (sudo/doas/run0) found on PATH")
+		m.state = StateError
+		return m, nil
+	}
+
+	if envSet || len(tools) == 1 {
+		return m.routeToAuthAfterPrivesc()
+	}
+
+	m.availablePrivesc = tools
+	m.selectedPrivesc = 0
+	m.state = StateSelectPrivesc
+	return m, nil
+}

distro/debian/dms-greeter/debian/control

@@ -13,7 +13,7 @@ Architecture: any
 Depends: ${misc:Depends},
   greetd,
   quickshell-git | quickshell
-Recommends: niri | hyprland | sway
+Suggests: niri | hyprland | sway
 Description: DankMaterialShell greeter for greetd
   DankMaterialShell greeter for greetd login manager. A modern, Material Design 3
   inspired greeter interface built with Quickshell for Wayland compositors.

distro/debian/dms/debian/control

@@ -9,7 +9,7 @@ Vcs-Browser: https://github.com/AvengeMedia/DankMaterialShell
 Vcs-Git: https://github.com/AvengeMedia/DankMaterialShell.git
 
 Package: dms
-Architecture: amd64
+Architecture: amd64 arm64
 Depends: ${misc:Depends},
          quickshell | quickshell-git,
          accountsservice,

distro/debian/dms/debian/source/include-binaries

@@ -1,2 +1,3 @@
 dms-distropkg-amd64.gz
+dms-distropkg-arm64.gz
 dms-source.tar.gz

distro/debian/dms/debian/source/options

@@ -1,4 +1,5 @@
 # Include files that are normally excluded by .gitignore
 # These are needed for the build process on Launchpad
 tar-ignore = !dms-distropkg-amd64.gz
+tar-ignore = !dms-distropkg-arm64.gz
 tar-ignore = !dms-source.tar.gz

distro/nix/common.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  dmsPkgs,
   ...
 }:
 let
@@ -10,7 +9,7 @@ let
 in
 {
   packages = [
-    dmsPkgs.dms-shell
+    cfg.package
   ]
   ++ lib.optional cfg.enableSystemMonitoring cfg.dgop.package
   ++ lib.optionals cfg.enableVPN [

distro/nix/greeter.nix

@@ -8,6 +8,7 @@
 let
   inherit (lib) types;
   cfg = config.programs.dank-material-shell.greeter;
+  cfgDms = config.programs.dank-material-shell;
 
   inherit (config.services.greetd.settings.default_session) user;
 
@@ -23,19 +24,20 @@ let
       lib.makeBinPath [
         cfg.quickshell.package
         compositorPackage
+        pkgs.glib  # provides gdbus, used by the fprintd hardware probe in GreeterContent.qml
       ]
     }
     ${
       lib.escapeShellArgs (
         [
           "sh"
-          "${../../quickshell/Modules/Greetd/assets/dms-greeter}"
+          "${cfg.package}/share/quickshell/dms/Modules/Greetd/assets/dms-greeter"
           "--cache-dir"
           cacheDir
           "--command"
           cfg.compositor.name
           "-p"
-          "${dmsPkgs.dms-shell}/share/quickshell/dms"
+          "${cfg.package}/share/quickshell/dms"
         ]
         ++ lib.optionals (cfg.compositor.customConfig != "") [
           "-C"
@@ -65,6 +67,21 @@ in
 
   options.programs.dank-material-shell.greeter = {
     enable = lib.mkEnableOption "DankMaterialShell greeter";
+    package = lib.mkOption {
+      type = types.package;
+      default = if cfgDms.enable or false then cfgDms.package else dmsPkgs.dms-shell;
+      defaultText = lib.literalExpression ''
+        if config.programs.dank-material-shell.enable
+        then config.programs.dank-material-shell.package
+        else built from source;
+      '';
+      description = ''
+        The DankMaterialShell package to use for the greeter.
+
+        Defaults to the package from `programs.dank-material-shell` if it is enabled,
+        otherwise defaults to building from source.
+      '';
+    };
     compositor.name = lib.mkOption {
       type = types.enum [
         "niri"
@@ -179,7 +196,9 @@ in
       fi
 
       if [ -f settings.json ]; then
-          if cp "$(${jq} -r '.customThemeFile' settings.json)" custom-theme.json; then
+          theme_file="$(${jq} -r '.customThemeFile // empty' settings.json)"
+          if [ -f "$theme_file" ] && [ -r "$theme_file" ]; then
+              cp "$theme_file" custom-theme.json
               mv settings.json settings.orig.json
               ${jq} '.customThemeFile = "${cacheDir}/custom-theme.json"' settings.orig.json > settings.json
           fi

distro/nix/home.nix

@@ -2,7 +2,6 @@
   config,
   pkgs,
   lib,
-  dmsPkgs,
   ...
 }@args:
 let
@@ -13,7 +12,6 @@ let
       config
       pkgs
       lib
-      dmsPkgs
       ;
   };
   hasPluginSettings = lib.any (plugin: plugin.settings != { }) (
@@ -96,7 +94,7 @@ in
       };
 
       Service = {
-        ExecStart = lib.getExe dmsPkgs.dms-shell + " run --session";
+        ExecStart = lib.getExe cfg.package + " run --session";
         Restart = "on-failure";
       };
 

distro/nix/nixos.nix

@@ -2,7 +2,6 @@
   config,
   pkgs,
   lib,
-  dmsPkgs,
   ...
 }@args:
 let
@@ -12,7 +11,6 @@ let
       config
       pkgs
       lib
-      dmsPkgs
       ;
   };
 in
@@ -36,7 +34,7 @@ in
       restartIfChanged = cfg.systemd.restartIfChanged;
 
       serviceConfig = {
-        ExecStart = lib.getExe dmsPkgs.dms-shell + " run --session";
+        ExecStart = lib.getExe cfg.package + " run --session";
         Restart = "on-failure";
       };
     };

distro/nix/options.nix

@@ -26,6 +26,9 @@ in
 
   options.programs.dank-material-shell = {
     enable = lib.mkEnableOption "DankMaterialShell";
+    package = lib.mkPackageOption dmsPkgs "dms-shell" {
+      extraDescription = "The DankMaterialShell package to use (defaults to be built from source)";
+    };
 
     systemd = {
       enable = lib.mkEnableOption "DankMaterialShell systemd startup";

distro/ubuntu/dms-greeter/debian/control

@@ -13,7 +13,7 @@ Architecture: any
 Depends: ${misc:Depends},
   greetd,
   quickshell-git | quickshell
-Recommends: niri | hyprland | sway
+Suggests: niri | hyprland | sway
 Description: DankMaterialShell greeter for greetd
   DankMaterialShell greeter for greetd login manager. A modern, Material Design 3
   inspired greeter interface built with Quickshell for Wayland compositors.

flake.lock

@@ -23,16 +23,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1766725085,
-        "narHash": "sha256-O2aMFdDUYJazFrlwL7aSIHbUSEm3ADVZjmf41uBJfHs=",
+        "lastModified": 1776854048,
+        "narHash": "sha256-lLbV66V3RMNp1l8/UelmR4YzoJ5ONtgvEtiUMJATH/o=",
         "ref": "refs/heads/master",
-        "rev": "41828c4180fb921df7992a5405f5ff05d2ac2fff",
-        "revCount": 715,
+        "rev": "783c953987dc56ff0601abe6845ed96f1d00495a",
+        "revCount": 806,
         "type": "git",
         "url": "https://git.outfoxxed.me/quickshell/quickshell"
       },
       "original": {
-        "rev": "41828c4180fb921df7992a5405f5ff05d2ac2fff",
+        "rev": "783c953987dc56ff0601abe6845ed96f1d00495a",
         "type": "git",
         "url": "https://git.outfoxxed.me/quickshell/quickshell"
       }

flake.nix

@@ -4,7 +4,7 @@
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     quickshell = {
-      url = "git+https://git.outfoxxed.me/quickshell/quickshell?rev=41828c4180fb921df7992a5405f5ff05d2ac2fff";
+      url = "git+https://git.outfoxxed.me/quickshell/quickshell?rev=783c953987dc56ff0601abe6845ed96f1d00495a";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
@@ -41,10 +41,11 @@
         nixpkgs.lib.genAttrs [ "aarch64-darwin" "aarch64-linux" "x86_64-darwin" "x86_64-linux" ] (
           system: fn system nixpkgs.legacyPackages.${system}
         );
-      buildDmsPkgs = pkgs: {
-        dms-shell = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
-        quickshell = quickshell.packages.${pkgs.stdenv.hostPlatform.system}.default;
-      };
+      forEachLinuxSystem =
+        fn:
+        nixpkgs.lib.genAttrs [ "aarch64-linux" "x86_64-linux" ] (
+          system: fn system nixpkgs.legacyPackages.${system}
+        );
       mkModuleWithDmsPkgs =
         modulePath:
         args@{ pkgs, ... }:
@@ -53,6 +54,7 @@
             (import modulePath (args // { dmsPkgs = buildDmsPkgs pkgs; }))
           ];
         };
+
       mkQmlImportPath =
         pkgs: qmlPkgs:
         pkgs.lib.concatStringsSep ":" (map (o: "${o}/${pkgs.qt6.qtbase.qtQmlPrefix}") qmlPkgs);
@@ -69,10 +71,11 @@
           qtimageformats
           kimageformats
         ];
-    in
-    {
-      packages = forEachSystem (
-        system: pkgs:
+
+      # Allows downstream modules to provide their own 'pkgs' (with overlays)
+      # instead of being forced to use the flake's locked nixpkgs.
+      mkDmsShell =
+        pkgs:
         let
           mkDate =
             longDate:
@@ -90,86 +93,96 @@
             in
             "${cleanVersion}${dateSuffix}${revSuffix}";
         in
-        {
-          dms-shell = pkgs.lib.makeOverridable (
+        pkgs.lib.makeOverridable (
+          {
+            extraQtPackages ? [ ],
+          }:
+          (pkgs.buildGoModule.override { go = goForPkgs pkgs; }) (
+            let
+              rootSrc = ./.;
+              qtPackages = (qmlPkgs pkgs) ++ extraQtPackages;
+            in
             {
-              extraQtPackages ? [ ],
-            }:
-            (pkgs.buildGoModule.override { go = goForPkgs pkgs; }) (
-              let
-                rootSrc = ./.;
-                qtPackages = (qmlPkgs pkgs) ++ extraQtPackages;
-              in
-              {
-                inherit version;
-                pname = "dms-shell";
-                src = ./core;
-                vendorHash = "sha256-cVUJXgzYMRSM0od1xzDVkMTdxHu3OIQX2bQ8AJbGQ1Q=";
+              inherit version;
+              pname = "dms-shell";
+              src = ./core;
+              vendorHash = "sha256-cVUJXgzYMRSM0od1xzDVkMTdxHu3OIQX2bQ8AJbGQ1Q=";
 
-                subPackages = [ "cmd/dms" ];
+              subPackages = [ "cmd/dms" ];
 
-                ldflags = [
-                  "-s"
-                  "-w"
-                  "-X 'main.Version=${version}'"
-                ];
+              ldflags = [
+                "-s"
+                "-w"
+                "-X 'main.Version=${version}'"
+              ];
 
-                nativeBuildInputs = with pkgs; [
-                  installShellFiles
-                  makeWrapper
-                ];
+              nativeBuildInputs = with pkgs; [
+                installShellFiles
+                makeWrapper
+              ];
 
-                postInstall = ''
-                  mkdir -p $out/share/quickshell/dms
-                  cp -r ${rootSrc}/quickshell/. $out/share/quickshell/dms/
+              postInstall = ''
+                mkdir -p $out/share/quickshell/dms
+                cp -r ${rootSrc}/quickshell/. $out/share/quickshell/dms/
 
-                  chmod u+w $out/share/quickshell/dms/VERSION
-                  echo "${version}" > $out/share/quickshell/dms/VERSION
+                chmod u+w $out/share/quickshell/dms/VERSION
+                echo "${version}" > $out/share/quickshell/dms/VERSION
 
-                  # Install desktop file and icon
-                  install -D ${rootSrc}/assets/dms-open.desktop \
-                    $out/share/applications/dms-open.desktop
-                  install -D ${rootSrc}/core/assets/danklogo.svg \
-                    $out/share/hicolor/scalable/apps/danklogo.svg
+                # Install desktop file and icon
+                install -D ${rootSrc}/assets/dms-open.desktop \
+                  $out/share/applications/dms-open.desktop
+                install -D ${rootSrc}/core/assets/danklogo.svg \
+                  $out/share/hicolor/scalable/apps/danklogo.svg
 
-                  wrapProgram $out/bin/dms \
-                    --add-flags "-c $out/share/quickshell/dms" \
-                    --prefix "NIXPKGS_QT6_QML_IMPORT_PATH" ":" "${mkQmlImportPath pkgs qtPackages}" \
-                    --prefix "QT_PLUGIN_PATH" ":" "${mkQtPluginPath pkgs qtPackages}"
+                wrapProgram $out/bin/dms \
+                  --add-flags "-c $out/share/quickshell/dms" \
+                  --prefix "NIXPKGS_QT6_QML_IMPORT_PATH" ":" "${mkQmlImportPath pkgs qtPackages}" \
+                  --prefix "QT_PLUGIN_PATH" ":" "${mkQtPluginPath pkgs qtPackages}"
 
-                  install -Dm644 ${rootSrc}/assets/systemd/dms.service \
-                    $out/lib/systemd/user/dms.service
+                install -Dm644 ${rootSrc}/assets/systemd/dms.service \
+                  $out/lib/systemd/user/dms.service
 
-                  substituteInPlace $out/lib/systemd/user/dms.service \
-                    --replace-fail /usr/bin/dms $out/bin/dms \
-                    --replace-fail /usr/bin/pkill ${pkgs.procps}/bin/pkill
+                substituteInPlace $out/lib/systemd/user/dms.service \
+                  --replace-fail /usr/bin/dms $out/bin/dms \
+                  --replace-fail /usr/bin/pkill ${pkgs.procps}/bin/pkill
 
-                  substituteInPlace $out/share/quickshell/dms/Modules/Greetd/assets/dms-greeter \
-                    --replace-fail /bin/bash ${pkgs.bashInteractive}/bin/bash
+                substituteInPlace $out/share/quickshell/dms/Modules/Greetd/assets/dms-greeter \
+                  --replace-fail /bin/bash ${pkgs.bashInteractive}/bin/bash
 
-                  substituteInPlace $out/share/quickshell/dms/assets/pam/fprint \
-                    --replace-fail pam_fprintd.so ${pkgs.fprintd}/lib/security/pam_fprintd.so
+                substituteInPlace $out/share/quickshell/dms/assets/pam/fprint \
+                  --replace-fail pam_fprintd.so ${pkgs.fprintd}/lib/security/pam_fprintd.so
 
-                  installShellCompletion --cmd dms \
-                    --bash <($out/bin/dms completion bash) \
-                    --fish <($out/bin/dms completion fish) \
-                    --zsh <($out/bin/dms completion zsh)
-                '';
+                substituteInPlace $out/share/quickshell/dms/assets/pam/u2f \
+                  --replace-fail pam_u2f.so ${pkgs.pam_u2f}/lib/security/pam_u2f.so
 
-                meta = {
-                  description = "Desktop shell for wayland compositors built with Quickshell & GO";
-                  homepage = "https://danklinux.com";
-                  changelog = "https://github.com/AvengeMedia/DankMaterialShell/releases/tag/v${version}";
-                  license = pkgs.lib.licenses.mit;
-                  mainProgram = "dms";
-                  platforms = pkgs.lib.platforms.linux;
-                };
-              }
-            )
-          ) { };
+                installShellCompletion --cmd dms \
+                  --bash <($out/bin/dms completion bash) \
+                  --fish <($out/bin/dms completion fish) \
+                  --zsh <($out/bin/dms completion zsh)
+              '';
 
+              meta = {
+                description = "Desktop shell for wayland compositors built with Quickshell & GO";
+                homepage = "https://danklinux.com";
+                changelog = "https://github.com/AvengeMedia/DankMaterialShell/releases/tag/v${version}";
+                license = pkgs.lib.licenses.mit;
+                mainProgram = "dms";
+                platforms = pkgs.lib.platforms.linux;
+              };
+            }
+          )
+        ) { };
+
+      buildDmsPkgs = pkgs: {
+        dms-shell = mkDmsShell pkgs;
+        quickshell = quickshell.packages.${pkgs.stdenv.hostPlatform.system}.default;
+      };
+    in
+    {
+      packages = forEachSystem (
+        system: pkgs: {
+          dms-shell = mkDmsShell pkgs;
           quickshell = quickshell.packages.${system}.default;
-
           default = self.packages.${system}.dms-shell;
         }
       );

quickshell/Common/I18n.qml

@@ -115,4 +115,8 @@ Singleton {
             return translations[context][term];
         return term;
     }
+
+    function locale() {
+        return Qt.locale();
+    }
 }

quickshell/Common/KeybindActions.js

@@ -158,10 +158,16 @@ const NIRI_ACTIONS = {
         { id: "focus-monitor-right", label: "Focus Monitor Right" },
         { id: "focus-monitor-down", label: "Focus Monitor Down" },
         { id: "focus-monitor-up", label: "Focus Monitor Up" },
-        { id: "move-column-to-monitor-left", label: "Move to Monitor Left" },
-        { id: "move-column-to-monitor-right", label: "Move to Monitor Right" },
-        { id: "move-column-to-monitor-down", label: "Move to Monitor Down" },
-        { id: "move-column-to-monitor-up", label: "Move to Monitor Up" }
+        { id: "move-column-to-monitor-left", label: "Move Column to Monitor Left" },
+        { id: "move-column-to-monitor-right", label: "Move Column to Monitor Right" },
+        { id: "move-column-to-monitor-down", label: "Move Column to Monitor Down" },
+        { id: "move-column-to-monitor-up", label: "Move Column to Monitor Up" },
+        { id: "move-workspace-to-monitor-left", label: "Move Workspace to Monitor Left" },
+        { id: "move-workspace-to-monitor-right", label: "Move Workspace to Monitor Right" },
+        { id: "move-workspace-to-monitor-down", label: "Move Workspace to Monitor Down" },
+        { id: "move-workspace-to-monitor-up", label: "Move Workspace to Monitor Up" },
+        { id: "move-workspace-to-monitor-next", label: "Move Workspace to Next Monitor" },
+        { id: "move-workspace-to-monitor-previous", label: "Move Workspace to Previous Monitor" }
     ],
     "Screenshot": [
         { id: "screenshot", label: "Screenshot (Interactive)" },

quickshell/Common/Paths.qml

@@ -23,7 +23,9 @@ Singleton {
     }
 
     function expandTilde(path: string): string {
-        return strip(path.replace("~", stringify(root.home)));
+        if (!path.startsWith("~"))
+            return path;
+        return strip(root.home) + path.substring(1);
     }
 
     function shortenHome(path: string): string {

quickshell/Common/PopoutManager.qml

@@ -1,4 +1,5 @@
 pragma Singleton
+pragma ComponentBehavior: Bound
 
 import Quickshell
 import QtQuick
@@ -12,6 +13,37 @@ Singleton {
     signal popoutOpening
     signal popoutChanged
 
+    function _closePopout(popout) {
+        try {
+            switch (true) {
+            case popout.dashVisible !== undefined:
+                popout.dashVisible = false;
+                return;
+            case popout.notificationHistoryVisible !== undefined:
+                popout.notificationHistoryVisible = false;
+                return;
+            default:
+                if (typeof popout.close !== "function")
+                    return;
+                popout.close();
+            }
+        } catch (e) {
+            return;
+        }
+    }
+
+    function _isStale(popout) {
+        try {
+            if (!popout || !("shouldBeVisible" in popout))
+                return true;
+            if (!popout.screen)
+                return true;
+            return false;
+        } catch (e) {
+            return true;
+        }
+    }
+
     function showPopout(popout) {
         if (!popout || !popout.screen)
             return;
@@ -23,13 +55,11 @@ Singleton {
             const otherPopout = currentPopoutsByScreen[otherScreenName];
             if (!otherPopout || otherPopout === popout)
                 continue;
-            if (otherPopout.dashVisible !== undefined) {
-                otherPopout.dashVisible = false;
-            } else if (otherPopout.notificationHistoryVisible !== undefined) {
-                otherPopout.notificationHistoryVisible = false;
-            } else {
-                otherPopout.close();
+            if (_isStale(otherPopout)) {
+                currentPopoutsByScreen[otherScreenName] = null;
+                continue;
             }
+            _closePopout(otherPopout);
         }
 
         currentPopoutsByScreen[screenName] = popout;
@@ -51,15 +81,9 @@ Singleton {
     function closeAllPopouts() {
         for (const screenName in currentPopoutsByScreen) {
             const popout = currentPopoutsByScreen[screenName];
-            if (!popout)
+            if (!popout || _isStale(popout))
                 continue;
-            if (popout.dashVisible !== undefined) {
-                popout.dashVisible = false;
-            } else if (popout.notificationHistoryVisible !== undefined) {
-                popout.notificationHistoryVisible = false;
-            } else {
-                popout.close();
-            }
+            _closePopout(popout);
         }
         currentPopoutsByScreen = {};
     }
@@ -90,6 +114,12 @@ Singleton {
             if (!otherPopout)
                 continue;
 
+            if (_isStale(otherPopout)) {
+                currentPopoutsByScreen[otherScreenName] = null;
+                currentPopoutTriggers[otherScreenName] = null;
+                continue;
+            }
+
             if (otherPopout === popout) {
                 movedFromOtherScreen = true;
                 currentPopoutsByScreen[otherScreenName] = null;
@@ -97,45 +127,26 @@ Singleton {
                 continue;
             }
 
-            if (otherPopout.dashVisible !== undefined) {
-                otherPopout.dashVisible = false;
-            } else if (otherPopout.notificationHistoryVisible !== undefined) {
-                otherPopout.notificationHistoryVisible = false;
-            } else {
-                otherPopout.close();
-            }
+            _closePopout(otherPopout);
         }
 
         if (currentPopout && currentPopout !== popout) {
-            if (currentPopout.dashVisible !== undefined) {
-                currentPopout.dashVisible = false;
-            } else if (currentPopout.notificationHistoryVisible !== undefined) {
-                currentPopout.notificationHistoryVisible = false;
+            if (_isStale(currentPopout)) {
+                currentPopoutsByScreen[screenName] = null;
+                currentPopoutTriggers[screenName] = null;
             } else {
-                currentPopout.close();
+                _closePopout(currentPopout);
             }
         }
 
         if (currentPopout === popout && popout.shouldBeVisible && !movedFromOtherScreen) {
             if (triggerId !== undefined && currentPopoutTriggers[screenName] === triggerId) {
-                if (popout.dashVisible !== undefined) {
-                    popout.dashVisible = false;
-                } else if (popout.notificationHistoryVisible !== undefined) {
-                    popout.notificationHistoryVisible = false;
-                } else {
-                    popout.close();
-                }
+                _closePopout(popout);
                 return;
             }
 
             if (triggerId === undefined) {
-                if (popout.dashVisible !== undefined) {
-                    popout.dashVisible = false;
-                } else if (popout.notificationHistoryVisible !== undefined) {
-                    popout.notificationHistoryVisible = false;
-                } else {
-                    popout.close();
-                }
+                _closePopout(popout);
                 return;
             }
 

quickshell/Common/SessionData.qml

@@ -338,8 +338,8 @@ Singleton {
 
     function setLightMode(lightMode) {
         isSwitchingMode = true;
+        syncWallpaperForCurrentMode(lightMode);
         isLightMode = lightMode;
-        syncWallpaperForCurrentMode();
         saveSettings();
         Qt.callLater(() => {
             isSwitchingMode = false;
@@ -1091,15 +1091,16 @@ Singleton {
         saveSettings();
     }
 
-    function syncWallpaperForCurrentMode() {
+    function syncWallpaperForCurrentMode(mode) {
         if (!perModeWallpaper)
             return;
+        var light = (mode !== undefined) ? mode : isLightMode;
         if (perMonitorWallpaper) {
-            monitorWallpapers = isLightMode ? Object.assign({}, monitorWallpapersLight) : Object.assign({}, monitorWallpapersDark);
+            monitorWallpapers = light ? Object.assign({}, monitorWallpapersLight) : Object.assign({}, monitorWallpapersDark);
             return;
         }
 
-        wallpaperPath = isLightMode ? wallpaperPathLight : wallpaperPathDark;
+        wallpaperPath = light ? wallpaperPathLight : wallpaperPathDark;
     }
 
     function _findMonitorValue(map, screenName) {
@@ -1204,7 +1205,7 @@ Singleton {
         id: greeterSessionFile
 
         path: {
-            const greetCfgDir = Quickshell.env("DMS_GREET_CFG_DIR") || "/etc/greetd/.dms";
+            const greetCfgDir = Quickshell.env("DMS_GREET_CFG_DIR") || "/var/cache/dms-greeter";
             return greetCfgDir + "/session.json";
         }
         preload: isGreeterMode

quickshell/Common/SettingsData.qml

@@ -165,6 +165,18 @@ Singleton {
     property int modalCustomAnimationDuration: 150
     property bool enableRippleEffects: true
     onEnableRippleEffectsChanged: saveSettings()
+    property bool blurEnabled: false
+    onBlurEnabledChanged: saveSettings()
+    property bool blurForegroundLayers: true
+    onBlurForegroundLayersChanged: saveSettings()
+    property real blurLayerOutlineOpacity: 0.12
+    onBlurLayerOutlineOpacityChanged: saveSettings()
+    property string blurBorderColor: "outline"
+    onBlurBorderColorChanged: saveSettings()
+    property string blurBorderCustomColor: "#ffffff"
+    onBlurBorderCustomColorChanged: saveSettings()
+    property real blurBorderOpacity: 0.35
+    onBlurBorderOpacityChanged: saveSettings()
     property string wallpaperFillMode: "Fill"
     property bool blurredWallpaperLayer: false
     property bool blurWallpaperOnOverview: false
@@ -182,6 +194,9 @@ Singleton {
     property int selectedGpuIndex: 0
     property var enabledGpuPciIds: []
     property bool showSystemTray: true
+    property string systemTrayIconTintMode: "none"
+    property int systemTrayIconTintSaturation: 50
+    property int systemTrayIconTintStrength: 135
     property bool showClock: true
     property bool showNotificationButton: true
     property bool showBattery: true
@@ -294,6 +309,11 @@ Singleton {
     property string centeringMode: "index"
     property string clockDateFormat: ""
     property string lockDateFormat: ""
+    property bool greeterRememberLastSession: true
+    property bool greeterRememberLastUser: true
+    property bool greeterEnableFprint: false
+    property bool greeterEnableU2f: false
+    property string greeterWallpaperPath: ""
     property int mediaSize: 1
 
     property string appLauncherViewMode: "list"
@@ -422,6 +442,11 @@ Singleton {
     property bool syncModeWithPortal: true
     property bool terminalsAlwaysDark: false
 
+    property string muxType: "tmux"
+    property bool muxUseCustomCommand: false
+    property string muxCustomCommand: ""
+    property string muxSessionFilter: ""
+
     property bool runDmsMatugenTemplates: true
     property bool matugenTemplateGtk: true
     property bool matugenTemplateNiri: true
@@ -495,6 +520,23 @@ Singleton {
     property bool enableFprint: false
     property int maxFprintTries: 15
     property bool fprintdAvailable: false
+    property bool lockFingerprintCanEnable: false
+    property bool lockFingerprintReady: false
+    property string lockFingerprintReason: "probe_failed"
+    property bool greeterFingerprintCanEnable: false
+    property bool greeterFingerprintReady: false
+    property string greeterFingerprintReason: "probe_failed"
+    property string greeterFingerprintSource: "none"
+    property bool enableU2f: false
+    property string u2fMode: "or"
+    property bool u2fAvailable: false
+    property bool lockU2fCanEnable: false
+    property bool lockU2fReady: false
+    property string lockU2fReason: "probe_failed"
+    property bool greeterU2fCanEnable: false
+    property bool greeterU2fReady: false
+    property string greeterU2fReason: "probe_failed"
+    property string greeterU2fSource: "none"
     property string lockScreenActiveMonitor: "all"
     property string lockScreenInactiveColor: "#000000"
     property int lockScreenNotificationMode: 0
@@ -977,12 +1019,19 @@ Singleton {
     signal widgetDataChanged
     signal workspaceIconsUpdated
 
+    function refreshAuthAvailability() {
+        if (isGreeterMode)
+            return;
+        Processes.settingsRoot = root;
+        Processes.detectAuthCapabilities();
+    }
+
     Component.onCompleted: {
         if (!isGreeterMode) {
             Processes.settingsRoot = root;
             loadSettings();
             initializeListModels();
-            Processes.detectFprintd();
+            refreshAuthAvailability();
             Processes.checkPluginSettings();
         }
     }
@@ -1249,9 +1298,7 @@ Singleton {
             return true;
 
         const msg = String(error || "").toLowerCase();
-        return msg.indexOf("file does not exist") !== -1
-                || msg.indexOf("no such file") !== -1
-                || msg.indexOf("enoent") !== -1;
+        return msg.indexOf("file does not exist") !== -1 || msg.indexOf("no such file") !== -1 || msg.indexOf("enoent") !== -1;
     }
 
     function loadPluginSettings() {

quickshell/Common/Theme.qml

@@ -346,12 +346,11 @@ Singleton {
         function onLoginctlEvent(event) {
             if (!SessionData.themeModeAutoEnabled)
                 return;
-            if (event.event === "unlock" || event.event === "resume") {
-                if (!themeAutoBackendAvailable()) {
-                    root.evaluateThemeMode();
-                    return;
-                }
-                DMSService.sendRequest("theme.auto.trigger", {});
+            if (typeof SettingsData !== "undefined" && SettingsData.loginctlLockIntegration)
+                return;
+            const eventType = String(event?.type || event?.event || "").toLowerCase();
+            if (eventType === "unlock") {
+                root.triggerThemeAutomationRefresh();
             }
         }
 
@@ -414,6 +413,27 @@ Singleton {
         }
     }
 
+    Connections {
+        target: SessionService
+        enabled: typeof SessionService !== "undefined" && typeof SessionData !== "undefined" && SessionData.themeModeAutoEnabled
+
+        function onSessionUnlocked() {
+            root.triggerThemeAutomationRefresh();
+        }
+
+        function onSessionResumed() {
+            root.triggerThemeAutomationRefresh();
+        }
+    }
+
+    function triggerThemeAutomationRefresh() {
+        if (!themeAutoBackendAvailable()) {
+            root.evaluateThemeMode();
+            return;
+        }
+        DMSService.sendRequest("theme.auto.trigger", {});
+    }
+
     function applyGreeterTheme(themeName) {
         switchTheme(themeName, false, false);
         if (themeName === dynamic && dynamicColorsFileView.path) {
@@ -541,8 +561,8 @@ Singleton {
     property color success: currentThemeData.success || "#4CAF50"
 
     property color primaryHover: Qt.rgba(primary.r, primary.g, primary.b, 0.12)
-    property color primaryHoverLight: Qt.rgba(primary.r, primary.g, primary.b, 0.08)
-    property color primaryPressed: Qt.rgba(primary.r, primary.g, primary.b, 0.16)
+    property color primaryHoverLight: Qt.rgba(primary.r, primary.g, primary.b, transparentBlurLayers ? 0.12 : 0.08)
+    property color primaryPressed: Qt.rgba(primary.r, primary.g, primary.b, transparentBlurLayers ? 0.24 : 0.16)
     property color primarySelected: Qt.rgba(primary.r, primary.g, primary.b, 0.3)
     property color primaryBackground: Qt.rgba(primary.r, primary.g, primary.b, 0.04)
 
@@ -551,17 +571,28 @@ Singleton {
     property color surfaceHover: Qt.rgba(surfaceVariant.r, surfaceVariant.g, surfaceVariant.b, 0.08)
     property color surfacePressed: Qt.rgba(surfaceVariant.r, surfaceVariant.g, surfaceVariant.b, 0.12)
     property color surfaceSelected: Qt.rgba(surfaceVariant.r, surfaceVariant.g, surfaceVariant.b, 0.15)
-    property color surfaceLight: Qt.rgba(surfaceVariant.r, surfaceVariant.g, surfaceVariant.b, 0.1)
+    property color surfaceLight: Qt.rgba(surfaceVariant.r, surfaceVariant.g, surfaceVariant.b, transparentBlurLayers ? 0.3 : 0.1)
     property color surfaceVariantAlpha: Qt.rgba(surfaceVariant.r, surfaceVariant.g, surfaceVariant.b, 0.2)
+
+    readonly property bool blurForegroundLayers: BlurService.enabled && (typeof SettingsData === "undefined" || (SettingsData.blurForegroundLayers ?? true))
+    readonly property bool transparentBlurLayers: BlurService.enabled && !blurForegroundLayers
+    readonly property color readableSurface: withAlpha(surfaceContainer, popupTransparency)
+    readonly property color readableSurfaceHigh: withAlpha(surfaceContainerHigh, popupTransparency)
+    readonly property color floatingSurface: transparentBlurLayers ? "transparent" : readableSurface
+    readonly property color floatingSurfaceHigh: transparentBlurLayers ? "transparent" : readableSurfaceHigh
+    readonly property color nestedSurface: floatingSurfaceHigh
+    readonly property real blurLayerOutlineOpacity: Math.max(0, Math.min(1, typeof SettingsData === "undefined" ? 0.12 : (SettingsData.blurLayerOutlineOpacity ?? 0.12)))
+    readonly property real layerOutlineOpacity: BlurService.enabled ? blurLayerOutlineOpacity : 0.08
+    readonly property int layerOutlineWidth: BlurService.enabled && layerOutlineOpacity > 0 ? 1 : 0
     property color surfaceTextHover: Qt.rgba(surfaceText.r, surfaceText.g, surfaceText.b, 0.08)
     property color surfaceTextAlpha: Qt.rgba(surfaceText.r, surfaceText.g, surfaceText.b, 0.3)
     property color surfaceTextLight: Qt.rgba(surfaceText.r, surfaceText.g, surfaceText.b, 0.06)
     property color surfaceTextMedium: Qt.rgba(surfaceText.r, surfaceText.g, surfaceText.b, 0.7)
 
     property color outlineButton: Qt.rgba(outline.r, outline.g, outline.b, 0.5)
-    property color outlineLight: Qt.rgba(outline.r, outline.g, outline.b, 0.05)
-    property color outlineMedium: Qt.rgba(outline.r, outline.g, outline.b, 0.08)
-    property color outlineStrong: Qt.rgba(outline.r, outline.g, outline.b, 0.12)
+    property color outlineLight: Qt.rgba(outline.r, outline.g, outline.b, BlurService.enabled ? Math.min(1, layerOutlineOpacity * 0.625) : 0.05)
+    property color outlineMedium: Qt.rgba(outline.r, outline.g, outline.b, layerOutlineOpacity)
+    property color outlineStrong: Qt.rgba(outline.r, outline.g, outline.b, BlurService.enabled ? Math.min(1, layerOutlineOpacity * 1.5) : 0.12)
 
     property color errorHover: Qt.rgba(error.r, error.g, error.b, 0.12)
     property color errorPressed: Qt.rgba(error.r, error.g, error.b, 0.16)
@@ -579,6 +610,12 @@ Singleton {
         }
     }
 
+    readonly property color ccTileInactiveBg: transparentBlurLayers ? withAlpha(surfaceContainerHigh, 0.16) : (blurForegroundLayers ? withAlpha(surfaceContainerHigh, Math.min(popupTransparency, 0.24)) : withAlpha(surfaceContainer, popupTransparency))
+    readonly property color ccPillInactiveBg: transparentBlurLayers ? withAlpha(surfaceContainerHigh, 0.08) : nestedSurface
+    readonly property color ccPillInactiveHoverBg: transparentBlurLayers ? withAlpha(primary, 0.10) : primaryPressed
+    readonly property color ccSliderTrackColor: transparentBlurLayers ? surfaceText : surfaceContainerHigh
+    readonly property real ccSliderTrackOpacity: transparentBlurLayers ? 0.18 : popupTransparency
+
     readonly property color ccTileActiveText: {
         switch (SettingsData.controlCenterTileColorMode) {
         case "primaryContainer":
@@ -858,7 +895,7 @@ Singleton {
 
     property string fontFamily: {
         if (typeof SessionData !== "undefined" && SessionData.isGreeterMode && typeof GreetdSettings !== "undefined") {
-            return GreetdSettings.fontFamily;
+            return GreetdSettings.getEffectiveFontFamily();
         }
         return typeof SettingsData !== "undefined" ? SettingsData.fontFamily : "Inter Variable";
     }
@@ -1022,7 +1059,11 @@ Singleton {
             if (themeData.variants.type === "multi" && themeData.variants.flavors && themeData.variants.accents) {
                 const defaults = themeData.variants.defaults || {};
                 const modeDefaults = defaults[colorMode] || defaults.dark || {};
-                const stored = typeof SettingsData !== "undefined" ? SettingsData.getRegistryThemeMultiVariant(themeId, modeDefaults, colorMode) : modeDefaults;
+                const isGreeterMode = typeof SessionData !== "undefined" && SessionData.isGreeterMode;
+		const stored = isGreeterMode ?
+		      (GreetdSettings.registryThemeVariants[themeId]?.[colorMode] || modeDefaults) :
+		      (typeof SettingsData !== "undefined" ?
+		       SettingsData.getRegistryThemeMultiVariant(themeId, modeDefaults, colorMode) : modeDefaults);
                 var flavorId = stored.flavor || modeDefaults.flavor || "";
                 const accentId = stored.accent || modeDefaults.accent || "";
                 var flavor = findVariant(themeData.variants.flavors, flavorId);
@@ -1048,7 +1089,10 @@ Singleton {
             }
 
             if (themeData.variants.options && themeData.variants.options.length > 0) {
-                const selectedVariantId = typeof SettingsData !== "undefined" ? SettingsData.getRegistryThemeVariant(themeId, themeData.variants.default) : themeData.variants.default;
+                const isGreeterMode = typeof SessionData !== "undefined" && SessionData.isGreeterMode;
+                const selectedVariantId = isGreeterMode
+                    ? (typeof GreetdSettings.registryThemeVariants[themeId] === "string" ? GreetdSettings.registryThemeVariants[themeId] : themeData.variants.default)
+                    : (typeof SettingsData !== "undefined" ? SettingsData.getRegistryThemeVariant(themeId, themeData.variants.default) : themeData.variants.default);
                 const variant = findVariant(themeData.variants.options, selectedVariantId);
                 if (variant) {
                     const variantColors = variant[colorMode] || variant.dark || variant.light || {};
@@ -1093,7 +1137,7 @@ Singleton {
     }
 
     function loadCustomThemeFromFile(filePath) {
-        customThemeFileView.path = filePath;
+        customThemeFileView.path = Paths.expandTilde(filePath);
     }
 
     function reloadCustomThemeVariant() {
@@ -1420,8 +1464,13 @@ Singleton {
                         const defaults = customThemeRawData.variants.defaults || {};
                         const darkDefaults = defaults.dark || {};
                         const lightDefaults = defaults.light || defaults.dark || {};
-                        const storedDark = typeof SettingsData !== "undefined" ? SettingsData.getRegistryThemeMultiVariant(themeId, darkDefaults, "dark") : darkDefaults;
-                        const storedLight = typeof SettingsData !== "undefined" ? SettingsData.getRegistryThemeMultiVariant(themeId, lightDefaults, "light") : lightDefaults;
+                        const isGreeterMode = typeof SessionData !== "undefined" && SessionData.isGreeterMode;
+                        const storedDark = isGreeterMode
+                            ? (GreetdSettings.registryThemeVariants[themeId]?.dark || darkDefaults)
+                            : (typeof SettingsData !== "undefined" ? SettingsData.getRegistryThemeMultiVariant(themeId, darkDefaults, "dark") : darkDefaults);
+                        const storedLight = isGreeterMode
+                            ? (GreetdSettings.registryThemeVariants[themeId]?.light || lightDefaults)
+                            : (typeof SettingsData !== "undefined" ? SettingsData.getRegistryThemeMultiVariant(themeId, lightDefaults, "light") : lightDefaults);
                         const darkFlavorId = storedDark.flavor || darkDefaults.flavor || "";
                         const lightFlavorId = storedLight.flavor || lightDefaults.flavor || "";
                         const accentId = storedDark.accent || darkDefaults.accent || "";
@@ -1439,7 +1488,10 @@ Singleton {
                                 lightTheme = mergeColors(lightTheme, accent[lightFlavor.id] || {});
                         }
                     } else if (customThemeRawData.variants.options) {
-                        const selectedVariantId = typeof SettingsData !== "undefined" ? SettingsData.getRegistryThemeVariant(themeId, customThemeRawData.variants.default) : customThemeRawData.variants.default;
+                        const isGreeterMode = typeof SessionData !== "undefined" && SessionData.isGreeterMode;
+                        const selectedVariantId = isGreeterMode
+                            ? (typeof GreetdSettings.registryThemeVariants[themeId] === "string" ? GreetdSettings.registryThemeVariants[themeId] : customThemeRawData.variants.default)
+                            : (typeof SettingsData !== "undefined" ? SettingsData.getRegistryThemeVariant(themeId, customThemeRawData.variants.default) : customThemeRawData.variants.default);
                         const variant = findVariant(customThemeRawData.variants.options, selectedVariantId);
                         if (variant) {
                             darkTheme = mergeColors(darkTheme, variant.dark || {});
@@ -1734,6 +1786,7 @@ Singleton {
 
     FileView {
         id: customThemeFileView
+        blockLoading: false
         watchChanges: currentTheme === "custom"
 
         function parseAndLoadTheme() {
@@ -1763,10 +1816,11 @@ Singleton {
     FileView {
         id: dynamicColorsFileView
         path: {
-            const greetCfgDir = Quickshell.env("DMS_GREET_CFG_DIR") || "/etc/greetd/.dms";
+            const greetCfgDir = Quickshell.env("DMS_GREET_CFG_DIR") || "/var/cache/dms-greeter";
             const colorsPath = SessionData.isGreeterMode ? greetCfgDir + "/colors.json" : stateDir + "/dms-colors.json";
             return colorsPath;
         }
+        blockLoading: false
         watchChanges: !SessionData.isGreeterMode
 
         function parseAndLoadColors() {

quickshell/Common/settings/Processes.qml

@@ -10,18 +10,350 @@ Singleton {
 
     property var settingsRoot: null
 
+    property string greetdPamText: ""
+    property string systemAuthPamText: ""
+    property string commonAuthPamText: ""
+    property string passwordAuthPamText: ""
+    property string systemLoginPamText: ""
+    property string systemLocalLoginPamText: ""
+    property string commonAuthPcPamText: ""
+    property string loginPamText: ""
+    property string dankshellU2fPamText: ""
+    property string u2fKeysText: ""
+
+    property string fingerprintProbeOutput: ""
+    property int fingerprintProbeExitCode: 0
+    property bool fingerprintProbeStreamFinished: false
+    property bool fingerprintProbeExited: false
+    property string fingerprintProbeState: "probe_failed"
+
+    property string pamSupportProbeOutput: ""
+    property bool pamSupportProbeStreamFinished: false
+    property bool pamSupportProbeExited: false
+    property int pamSupportProbeExitCode: 0
+    property bool pamFprintSupportDetected: false
+    property bool pamU2fSupportDetected: false
+
+    readonly property string homeDir: Quickshell.env("HOME") || ""
+    readonly property string u2fKeysPath: homeDir ? homeDir + "/.config/Yubico/u2f_keys" : ""
+    readonly property bool homeU2fKeysDetected: u2fKeysPath !== "" && u2fKeysWatcher.loaded && u2fKeysText.trim() !== ""
+    readonly property bool lockU2fCustomConfigDetected: pamModuleEnabled(dankshellU2fPamText, "pam_u2f")
+    readonly property bool greeterPamHasFprint: greeterPamStackHasModule("pam_fprintd")
+    readonly property bool greeterPamHasU2f: greeterPamStackHasModule("pam_u2f")
+
+    function envFlag(name) {
+        const value = (Quickshell.env(name) || "").trim().toLowerCase();
+        if (value === "1" || value === "true" || value === "yes" || value === "on")
+            return true;
+        if (value === "0" || value === "false" || value === "no" || value === "off")
+            return false;
+        return null;
+    }
+
+    readonly property var forcedFprintAvailable: envFlag("DMS_FORCE_FPRINT_AVAILABLE")
+    readonly property var forcedU2fAvailable: envFlag("DMS_FORCE_U2F_AVAILABLE")
+
     function detectQtTools() {
         qtToolsDetectionProcess.running = true;
     }
 
+    function detectAuthCapabilities() {
+        if (!settingsRoot)
+            return;
+
+        if (forcedFprintAvailable === null) {
+            fingerprintProbeOutput = "";
+            fingerprintProbeStreamFinished = false;
+            fingerprintProbeExited = false;
+            fingerprintProbeProcess.running = true;
+        } else {
+            fingerprintProbeState = forcedFprintAvailable ? "ready" : "probe_failed";
+        }
+
+        pamFprintSupportDetected = false;
+        pamU2fSupportDetected = false;
+        pamSupportProbeOutput = "";
+        pamSupportProbeStreamFinished = false;
+        pamSupportProbeExited = false;
+        pamSupportDetectionProcess.running = true;
+
+        recomputeAuthCapabilities();
+    }
+
     function detectFprintd() {
-        fprintdDetectionProcess.running = true;
+        detectAuthCapabilities();
+    }
+
+    function detectU2f() {
+        detectAuthCapabilities();
     }
 
     function checkPluginSettings() {
         pluginSettingsCheckProcess.running = true;
     }
 
+    function stripPamComment(line) {
+        if (!line)
+            return "";
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            return "";
+        const hashIdx = trimmed.indexOf("#");
+        if (hashIdx >= 0)
+            return trimmed.substring(0, hashIdx).trim();
+        return trimmed;
+    }
+
+    function pamModuleEnabled(pamText, moduleName) {
+        if (!pamText || !moduleName)
+            return false;
+        const lines = pamText.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const line = stripPamComment(lines[i]);
+            if (!line)
+                continue;
+            if (line.includes(moduleName))
+                return true;
+        }
+        return false;
+    }
+
+    function pamTextIncludesFile(pamText, filename) {
+        if (!pamText || !filename)
+            return false;
+        const lines = pamText.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const line = stripPamComment(lines[i]);
+            if (!line)
+                continue;
+            if (line.includes(filename) && (line.includes("include") || line.includes("substack") || line.startsWith("@include")))
+                return true;
+        }
+        return false;
+    }
+
+    function greeterPamStackHasModule(moduleName) {
+        if (pamModuleEnabled(greetdPamText, moduleName))
+            return true;
+        const includedPamStacks = [
+            ["system-auth", systemAuthPamText],
+            ["common-auth", commonAuthPamText],
+            ["password-auth", passwordAuthPamText],
+            ["system-login", systemLoginPamText],
+            ["system-local-login", systemLocalLoginPamText],
+            ["common-auth-pc", commonAuthPcPamText],
+            ["login", loginPamText]
+        ];
+        for (let i = 0; i < includedPamStacks.length; i++) {
+            const stack = includedPamStacks[i];
+            if (pamTextIncludesFile(greetdPamText, stack[0]) && pamModuleEnabled(stack[1], moduleName))
+                return true;
+        }
+        return false;
+    }
+
+    function hasEnrolledFingerprintOutput(output) {
+        const lower = (output || "").toLowerCase();
+        if (lower.includes("has fingers enrolled") || lower.includes("has fingerprints enrolled"))
+            return true;
+        const lines = lower.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const trimmed = lines[i].trim();
+            if (trimmed.startsWith("finger:"))
+                return true;
+            if (trimmed.startsWith("- ") && trimmed.includes("finger"))
+                return true;
+        }
+        return false;
+    }
+
+    function hasMissingFingerprintEnrollmentOutput(output) {
+        const lower = (output || "").toLowerCase();
+        return lower.includes("no fingers enrolled")
+            || lower.includes("no fingerprints enrolled")
+            || lower.includes("no prints enrolled");
+    }
+
+    function hasMissingFingerprintReaderOutput(output) {
+        const lower = (output || "").toLowerCase();
+        return lower.includes("no devices available")
+            || lower.includes("no device available")
+            || lower.includes("no devices found")
+            || lower.includes("list_devices failed")
+            || lower.includes("no device");
+    }
+
+    function parseFingerprintProbe(exitCode, output) {
+        if (hasEnrolledFingerprintOutput(output))
+            return "ready";
+        if (hasMissingFingerprintEnrollmentOutput(output))
+            return "missing_enrollment";
+        if (hasMissingFingerprintReaderOutput(output))
+            return "missing_reader";
+        if (exitCode === 0)
+            return "missing_enrollment";
+        if (exitCode === 127 || (output || "").includes("__missing_command__"))
+            return "probe_failed";
+        return pamFprintSupportDetected ? "probe_failed" : "missing_pam_support";
+    }
+
+    function setLockFingerprintCapability(canEnable, ready, reason) {
+        settingsRoot.lockFingerprintCanEnable = canEnable;
+        settingsRoot.lockFingerprintReady = ready;
+        settingsRoot.lockFingerprintReason = reason;
+    }
+
+    function setLockU2fCapability(canEnable, ready, reason) {
+        settingsRoot.lockU2fCanEnable = canEnable;
+        settingsRoot.lockU2fReady = ready;
+        settingsRoot.lockU2fReason = reason;
+    }
+
+    function setGreeterFingerprintCapability(canEnable, ready, reason, source) {
+        settingsRoot.greeterFingerprintCanEnable = canEnable;
+        settingsRoot.greeterFingerprintReady = ready;
+        settingsRoot.greeterFingerprintReason = reason;
+        settingsRoot.greeterFingerprintSource = source;
+    }
+
+    function setGreeterU2fCapability(canEnable, ready, reason, source) {
+        settingsRoot.greeterU2fCanEnable = canEnable;
+        settingsRoot.greeterU2fReady = ready;
+        settingsRoot.greeterU2fReason = reason;
+        settingsRoot.greeterU2fSource = source;
+    }
+
+    function recomputeFingerprintCapabilities() {
+        if (forcedFprintAvailable !== null) {
+            const reason = forcedFprintAvailable ? "ready" : "probe_failed";
+            const source = forcedFprintAvailable ? "dms" : "none";
+            setLockFingerprintCapability(forcedFprintAvailable, forcedFprintAvailable, reason);
+            setGreeterFingerprintCapability(forcedFprintAvailable, forcedFprintAvailable, reason, source);
+            return;
+        }
+
+        const state = fingerprintProbeState;
+
+        switch (state) {
+        case "ready":
+            setLockFingerprintCapability(true, true, "ready");
+            break;
+        case "missing_enrollment":
+            setLockFingerprintCapability(true, false, "missing_enrollment");
+            break;
+        case "missing_reader":
+            setLockFingerprintCapability(false, false, "missing_reader");
+            break;
+        case "missing_pam_support":
+            setLockFingerprintCapability(false, false, "missing_pam_support");
+            break;
+        default:
+            setLockFingerprintCapability(false, false, "probe_failed");
+            break;
+        }
+
+        if (greeterPamHasFprint) {
+            switch (state) {
+            case "ready":
+                setGreeterFingerprintCapability(true, true, "configured_externally", "pam");
+                break;
+            case "missing_enrollment":
+                setGreeterFingerprintCapability(true, false, "missing_enrollment", "pam");
+                break;
+            case "missing_reader":
+                setGreeterFingerprintCapability(false, false, "missing_reader", "pam");
+                break;
+            default:
+                setGreeterFingerprintCapability(true, false, "probe_failed", "pam");
+                break;
+            }
+            return;
+        }
+
+        switch (state) {
+        case "ready":
+            setGreeterFingerprintCapability(true, true, "ready", "dms");
+            break;
+        case "missing_enrollment":
+            setGreeterFingerprintCapability(true, false, "missing_enrollment", "dms");
+            break;
+        case "missing_reader":
+            setGreeterFingerprintCapability(false, false, "missing_reader", "none");
+            break;
+        case "missing_pam_support":
+            setGreeterFingerprintCapability(false, false, "missing_pam_support", "none");
+            break;
+        default:
+            setGreeterFingerprintCapability(false, false, "probe_failed", "none");
+            break;
+        }
+    }
+
+    function recomputeU2fCapabilities() {
+        if (forcedU2fAvailable !== null) {
+            const reason = forcedU2fAvailable ? "ready" : "probe_failed";
+            const source = forcedU2fAvailable ? "dms" : "none";
+            setLockU2fCapability(forcedU2fAvailable, forcedU2fAvailable, reason);
+            setGreeterU2fCapability(forcedU2fAvailable, forcedU2fAvailable, reason, source);
+            return;
+        }
+
+        const lockReady = lockU2fCustomConfigDetected || homeU2fKeysDetected;
+        const lockCanEnable = lockReady || pamU2fSupportDetected;
+        const lockReason = lockReady ? "ready" : (lockCanEnable ? "missing_key_registration" : "missing_pam_support");
+        setLockU2fCapability(lockCanEnable, lockReady, lockReason);
+
+        if (greeterPamHasU2f) {
+            setGreeterU2fCapability(true, true, "configured_externally", "pam");
+            return;
+        }
+
+        const greeterReady = homeU2fKeysDetected;
+        const greeterCanEnable = greeterReady || pamU2fSupportDetected;
+        const greeterReason = greeterReady ? "ready" : (greeterCanEnable ? "missing_key_registration" : "missing_pam_support");
+        setGreeterU2fCapability(greeterCanEnable, greeterReady, greeterReason, greeterCanEnable ? "dms" : "none");
+    }
+
+    function recomputeAuthCapabilities() {
+        if (!settingsRoot)
+            return;
+        recomputeFingerprintCapabilities();
+        recomputeU2fCapabilities();
+        settingsRoot.fprintdAvailable = settingsRoot.lockFingerprintReady || settingsRoot.greeterFingerprintReady;
+        settingsRoot.u2fAvailable = settingsRoot.lockU2fReady || settingsRoot.greeterU2fReady;
+    }
+
+    function finalizeFingerprintProbe() {
+        if (!fingerprintProbeStreamFinished || !fingerprintProbeExited)
+            return;
+        fingerprintProbeState = parseFingerprintProbe(fingerprintProbeExitCode, fingerprintProbeOutput);
+        recomputeAuthCapabilities();
+    }
+
+    function finalizePamSupportProbe() {
+        if (!pamSupportProbeStreamFinished || !pamSupportProbeExited)
+            return;
+
+        pamFprintSupportDetected = false;
+        pamU2fSupportDetected = false;
+
+        const lines = (pamSupportProbeOutput || "").trim().split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const parts = lines[i].split(":");
+            if (parts.length !== 2)
+                continue;
+            if (parts[0] === "pam_fprintd.so")
+                pamFprintSupportDetected = parts[1] === "true";
+            else if (parts[0] === "pam_u2f.so")
+                pamU2fSupportDetected = parts[1] === "true";
+        }
+
+        if (forcedFprintAvailable === null && fingerprintProbeState === "missing_pam_support")
+            fingerprintProbeState = parseFingerprintProbe(fingerprintProbeExitCode, fingerprintProbeOutput);
+
+        recomputeAuthCapabilities();
+    }
+
     property var qtToolsDetectionProcess: Process {
         command: ["sh", "-c", "echo -n 'qt5ct:'; command -v qt5ct >/dev/null && echo 'true' || echo 'false'; echo -n 'qt6ct:'; command -v qt6ct >/dev/null && echo 'true' || echo 'false'; echo -n 'gtk:'; (command -v gsettings >/dev/null || command -v dconf >/dev/null) && echo 'true' || echo 'false'"]
         running: false
@@ -31,15 +363,15 @@ Singleton {
                 if (!settingsRoot)
                     return;
                 if (text && text.trim()) {
-                    var lines = text.trim().split('\n');
-                    for (var i = 0; i < lines.length; i++) {
-                        var line = lines[i];
-                        if (line.startsWith('qt5ct:')) {
-                            settingsRoot.qt5ctAvailable = line.split(':')[1] === 'true';
-                        } else if (line.startsWith('qt6ct:')) {
-                            settingsRoot.qt6ctAvailable = line.split(':')[1] === 'true';
-                        } else if (line.startsWith('gtk:')) {
-                            settingsRoot.gtkAvailable = line.split(':')[1] === 'true';
+                    const lines = text.trim().split("\n");
+                    for (let i = 0; i < lines.length; i++) {
+                        const line = lines[i];
+                        if (line.startsWith("qt5ct:")) {
+                            settingsRoot.qt5ctAvailable = line.split(":")[1] === "true";
+                        } else if (line.startsWith("qt6ct:")) {
+                            settingsRoot.qt6ctAvailable = line.split(":")[1] === "true";
+                        } else if (line.startsWith("gtk:")) {
+                            settingsRoot.gtkAvailable = line.split(":")[1] === "true";
                         }
                     }
                 }
@@ -47,13 +379,181 @@ Singleton {
         }
     }
 
-    property var fprintdDetectionProcess: Process {
-        command: ["sh", "-c", "command -v fprintd-list >/dev/null 2>&1"]
+    property var fingerprintProbeProcess: Process {
+        command: ["sh", "-c", "if command -v fprintd-list >/dev/null 2>&1; then fprintd-list \"${USER:-$(id -un)}\" 2>&1; else printf '__missing_command__\\n'; exit 127; fi"]
         running: false
+
+        stdout: StdioCollector {
+            onStreamFinished: {
+                root.fingerprintProbeOutput = text || "";
+                root.fingerprintProbeStreamFinished = true;
+                root.finalizeFingerprintProbe();
+            }
+        }
+
         onExited: function (exitCode) {
-            if (!settingsRoot)
-                return;
-            settingsRoot.fprintdAvailable = (exitCode === 0);
+            root.fingerprintProbeExitCode = exitCode;
+            root.fingerprintProbeExited = true;
+            root.finalizeFingerprintProbe();
+        }
+    }
+
+    property var pamSupportDetectionProcess: Process {
+        command: ["sh", "-c", "for module in pam_fprintd.so pam_u2f.so; do found=false; for dir in /usr/lib64/security /usr/lib/security /lib/security /lib/x86_64-linux-gnu/security /usr/lib/x86_64-linux-gnu/security /usr/lib/aarch64-linux-gnu/security /run/current-system/sw/lib/security; do if [ -f \"$dir/$module\" ]; then found=true; break; fi; done; printf '%s:%s\\n' \"$module\" \"$found\"; done"]
+        running: false
+
+        stdout: StdioCollector {
+            onStreamFinished: {
+                root.pamSupportProbeOutput = text || "";
+                root.pamSupportProbeStreamFinished = true;
+                root.finalizePamSupportProbe();
+            }
+        }
+
+        onExited: function (exitCode) {
+            root.pamSupportProbeExitCode = exitCode;
+            root.pamSupportProbeExited = true;
+            root.finalizePamSupportProbe();
+        }
+    }
+
+    FileView {
+        id: greetdPamWatcher
+        path: "/etc/pam.d/greetd"
+        printErrors: false
+        onLoaded: {
+            root.greetdPamText = text();
+            root.recomputeAuthCapabilities();
+        }
+        onLoadFailed: {
+            root.greetdPamText = "";
+            root.recomputeAuthCapabilities();
+        }
+    }
+
+    FileView {
+        id: systemAuthPamWatcher
+        path: "/etc/pam.d/system-auth"
+        printErrors: false
+        onLoaded: {
+            root.systemAuthPamText = text();
+            root.recomputeAuthCapabilities();
+        }
+        onLoadFailed: {
+            root.systemAuthPamText = "";
+            root.recomputeAuthCapabilities();
+        }
+    }
+
+    FileView {
+        id: commonAuthPamWatcher
+        path: "/etc/pam.d/common-auth"
+        printErrors: false
+        onLoaded: {
+            root.commonAuthPamText = text();
+            root.recomputeAuthCapabilities();
+        }
+        onLoadFailed: {
+            root.commonAuthPamText = "";
+            root.recomputeAuthCapabilities();
+        }
+    }
+
+    FileView {
+        id: passwordAuthPamWatcher
+        path: "/etc/pam.d/password-auth"
+        printErrors: false
+        onLoaded: {
+            root.passwordAuthPamText = text();
+            root.recomputeAuthCapabilities();
+        }
+        onLoadFailed: {
+            root.passwordAuthPamText = "";
+            root.recomputeAuthCapabilities();
+        }
+    }
+
+    FileView {
+        id: systemLoginPamWatcher
+        path: "/etc/pam.d/system-login"
+        printErrors: false
+        onLoaded: {
+            root.systemLoginPamText = text();
+            root.recomputeAuthCapabilities();
+        }
+        onLoadFailed: {
+            root.systemLoginPamText = "";
+            root.recomputeAuthCapabilities();
+        }
+    }
+
+    FileView {
+        id: systemLocalLoginPamWatcher
+        path: "/etc/pam.d/system-local-login"
+        printErrors: false
+        onLoaded: {
+            root.systemLocalLoginPamText = text();
+            root.recomputeAuthCapabilities();
+        }
+        onLoadFailed: {
+            root.systemLocalLoginPamText = "";
+            root.recomputeAuthCapabilities();
+        }
+    }
+
+    FileView {
+        id: commonAuthPcPamWatcher
+        path: "/etc/pam.d/common-auth-pc"
+        printErrors: false
+        onLoaded: {
+            root.commonAuthPcPamText = text();
+            root.recomputeAuthCapabilities();
+        }
+        onLoadFailed: {
+            root.commonAuthPcPamText = "";
+            root.recomputeAuthCapabilities();
+        }
+    }
+
+    FileView {
+        id: loginPamWatcher
+        path: "/etc/pam.d/login"
+        printErrors: false
+        onLoaded: {
+            root.loginPamText = text();
+            root.recomputeAuthCapabilities();
+        }
+        onLoadFailed: {
+            root.loginPamText = "";
+            root.recomputeAuthCapabilities();
+        }
+    }
+
+    FileView {
+        id: dankshellU2fPamWatcher
+        path: "/etc/pam.d/dankshell-u2f"
+        printErrors: false
+        onLoaded: {
+            root.dankshellU2fPamText = text();
+            root.recomputeAuthCapabilities();
+        }
+        onLoadFailed: {
+            root.dankshellU2fPamText = "";
+            root.recomputeAuthCapabilities();
+        }
+    }
+
+    FileView {
+        id: u2fKeysWatcher
+        path: root.u2fKeysPath
+        printErrors: false
+        onLoaded: {
+            root.u2fKeysText = text();
+            root.recomputeAuthCapabilities();
+        }
+        onLoadFailed: {
+            root.u2fKeysText = "";
+            root.recomputeAuthCapabilities();
         }
     }
 

quickshell/Common/settings/SettingsSpec.js

@@ -46,6 +46,12 @@ var SPEC = {
     modalAnimationSpeed: { def: 1 },
     modalCustomAnimationDuration: { def: 150 },
     enableRippleEffects: { def: true },
+    blurEnabled: { def: false },
+    blurForegroundLayers: { def: true },
+    blurLayerOutlineOpacity: { def: 0.12, coerce: percentToUnit },
+    blurBorderColor: { def: "outline" },
+    blurBorderCustomColor: { def: "#ffffff" },
+    blurBorderOpacity: { def: 0.35, coerce: percentToUnit },
     wallpaperFillMode: { def: "Fill" },
     blurredWallpaperLayer: { def: false },
     blurWallpaperOnOverview: { def: false },
@@ -63,6 +69,9 @@ var SPEC = {
     selectedGpuIndex: { def: 0 },
     enabledGpuPciIds: { def: [] },
     showSystemTray: { def: true },
+    systemTrayIconTintMode: { def: "none" },
+    systemTrayIconTintSaturation: { def: 50 },
+    systemTrayIconTintStrength: { def: 135 },
     showClock: { def: true },
     showNotificationButton: { def: true },
     showBattery: { def: true },
@@ -154,6 +163,11 @@ var SPEC = {
     centeringMode: { def: "index" },
     clockDateFormat: { def: "" },
     lockDateFormat: { def: "" },
+    greeterRememberLastSession: { def: true },
+    greeterRememberLastUser: { def: true },
+    greeterEnableFprint: { def: false },
+    greeterEnableU2f: { def: false },
+    greeterWallpaperPath: { def: "" },
     mediaSize: { def: 1 },
 
     appLauncherViewMode: { def: "list" },
@@ -246,6 +260,11 @@ var SPEC = {
     syncModeWithPortal: { def: true },
     terminalsAlwaysDark: { def: false, onChange: "regenSystemThemes" },
 
+    muxType: { def: "tmux" },
+    muxUseCustomCommand: { def: false },
+    muxCustomCommand: { def: "" },
+    muxSessionFilter: { def: "" },
+
     runDmsMatugenTemplates: { def: true },
     matugenTemplateGtk: { def: true },
     matugenTemplateNiri: { def: true },
@@ -318,6 +337,23 @@ var SPEC = {
     enableFprint: { def: false },
     maxFprintTries: { def: 15 },
     fprintdAvailable: { def: false, persist: false },
+    lockFingerprintCanEnable: { def: false, persist: false },
+    lockFingerprintReady: { def: false, persist: false },
+    lockFingerprintReason: { def: "probe_failed", persist: false },
+    greeterFingerprintCanEnable: { def: false, persist: false },
+    greeterFingerprintReady: { def: false, persist: false },
+    greeterFingerprintReason: { def: "probe_failed", persist: false },
+    greeterFingerprintSource: { def: "none", persist: false },
+    enableU2f: { def: false },
+    u2fMode: { def: "or" },
+    u2fAvailable: { def: false, persist: false },
+    lockU2fCanEnable: { def: false, persist: false },
+    lockU2fReady: { def: false, persist: false },
+    lockU2fReason: { def: "probe_failed", persist: false },
+    greeterU2fCanEnable: { def: false, persist: false },
+    greeterU2fReady: { def: false, persist: false },
+    greeterU2fReason: { def: "probe_failed", persist: false },
+    greeterU2fSource: { def: "none", persist: false },
     lockScreenActiveMonitor: { def: "all" },
     lockScreenInactiveColor: { def: "#000000" },
     lockScreenNotificationMode: { def: 0 },

quickshell/DMSGreeter.qml

@@ -1,7 +1,5 @@
 import QtQuick
 import Quickshell
-import Quickshell.Services.Greetd
-import qs.Common
 import qs.Modules.Greetd
 
 Scope {

quickshell/DMSShell.qml

@@ -7,6 +7,7 @@ import qs.Modals.Clipboard
 import qs.Modals.Greeter
 import qs.Modals.Settings
 import qs.Modals.DankLauncherV2
+import qs.Modals
 import qs.Modules
 import qs.Modules.AppDrawer
 import qs.Modules.DankDash
@@ -27,6 +28,15 @@ import qs.Services
 Item {
     id: root
 
+    property bool osdSurfacesLoaded: true
+    property int pendingOsdResumeReloads: 0
+
+    function recreateOsdSurfaces() {
+        OSDManager.currentOSDsByScreen = ({});
+        osdSurfacesLoaded = false;
+        osdSurfaceReloadTimer.restart();
+    }
+
     Instantiator {
         id: daemonPluginInstantiator
         asynchronous: true
@@ -221,6 +231,33 @@ Item {
         }
     }
 
+    Timer {
+        id: osdResumeRecreateTimer
+        interval: 400
+        repeat: false
+        onTriggered: {
+            root.recreateOsdSurfaces();
+
+            if (root.pendingOsdResumeReloads > 1) {
+                root.pendingOsdResumeReloads--;
+                interval = 1400;
+                restart();
+                return;
+            }
+
+            root.pendingOsdResumeReloads = 0;
+            interval = 400;
+        }
+    }
+
+    Timer {
+        id: osdSurfaceReloadTimer
+        interval: 120
+        repeat: false
+        onTriggered: root.osdSurfacesLoaded = true
+    }
+
+
     Component.onCompleted: {
         dockRecreateDebounce.start();
         // Force PolkitService singleton to initialize
@@ -602,6 +639,10 @@ Item {
         }
     }
 
+    MuxModal {
+        id: muxModal
+    }
+
     ClipboardHistoryModal {
         id: clipboardHistoryModalPopup
 
@@ -716,6 +757,16 @@ Item {
         }
     }
 
+    Connections {
+        target: SessionService
+
+        function onSessionResumed() {
+            root.pendingOsdResumeReloads = 2;
+            osdResumeRecreateTimer.interval = 400;
+            osdResumeRecreateTimer.restart();
+        }
+    }
+
     DankColorPickerModal {
         id: colorPickerModal
 
@@ -798,9 +849,8 @@ Item {
 
             content: Component {
                 Notepad {
-                    onHideRequested: {
-                        notepadSlideout.hide();
-                    }
+                    slideout: notepadSlideout
+                    onHideRequested: notepadSlideout.hide()
                 }
             }
 
@@ -891,81 +941,85 @@ Item {
         }
     }
 
-    Variants {
-        model: SettingsData.getFilteredScreens("osd")
-
-        delegate: VolumeOSD {
-            modelData: item
-        }
-    }
-
-    Variants {
-        model: SettingsData.getFilteredScreens("osd")
-
-        delegate: MediaVolumeOSD {
-            modelData: item
-        }
-    }
-
-    Variants {
-        model: SettingsData.getFilteredScreens("osd")
-
-        delegate: MediaPlaybackOSD {
-            modelData: item
-        }
-    }
-
-    Variants {
-        model: SettingsData.getFilteredScreens("osd")
-
-        delegate: MicMuteOSD {
-            modelData: item
-        }
-    }
-
-    Variants {
-        model: SettingsData.getFilteredScreens("osd")
-
-        delegate: BrightnessOSD {
-            modelData: item
-        }
-    }
-
-    Variants {
-        model: SettingsData.getFilteredScreens("osd")
-
-        delegate: IdleInhibitorOSD {
-            modelData: item
-        }
-    }
-
     Loader {
-        id: powerProfileWatcherLoader
-        active: SettingsData.osdPowerProfileEnabled
-        source: "Services/PowerProfileWatcher.qml"
-    }
+        id: osdSurfacesLoader
+        active: root.osdSurfacesLoaded
+        asynchronous: false
 
-    Variants {
-        model: SettingsData.osdPowerProfileEnabled ? SettingsData.getFilteredScreens("osd") : []
+        sourceComponent: Component {
+            Item {
+                Variants {
+                    model: SettingsData.getFilteredScreens("osd")
 
-        delegate: PowerProfileOSD {
-            modelData: item
-        }
-    }
+                    delegate: VolumeOSD {
+                        modelData: item
+                    }
+                }
 
-    Variants {
-        model: SettingsData.getFilteredScreens("osd")
+                Variants {
+                    model: SettingsData.getFilteredScreens("osd")
 
-        delegate: CapsLockOSD {
-            modelData: item
-        }
-    }
+                    delegate: MediaVolumeOSD {
+                        modelData: item
+                    }
+                }
 
-    Variants {
-        model: SettingsData.getFilteredScreens("osd")
+                Variants {
+                    model: SettingsData.getFilteredScreens("osd")
 
-        delegate: AudioOutputOSD {
-            modelData: item
+                    delegate: MediaPlaybackOSD {
+                        modelData: item
+                    }
+                }
+
+                Variants {
+                    model: SettingsData.getFilteredScreens("osd")
+
+                    delegate: MicMuteOSD {
+                        modelData: item
+                    }
+                }
+
+                Variants {
+                    model: SettingsData.getFilteredScreens("osd")
+
+                    delegate: BrightnessOSD {
+                        modelData: item
+                    }
+                }
+
+                Variants {
+                    model: SettingsData.getFilteredScreens("osd")
+
+                    delegate: IdleInhibitorOSD {
+                        modelData: item
+                    }
+                }
+
+                Variants {
+                    model: SettingsData.osdPowerProfileEnabled ? SettingsData.getFilteredScreens("osd") : []
+
+                    delegate: PowerProfileOSD {
+                        modelData: item
+                    }
+                }
+
+                Variants {
+                    model: SettingsData.getFilteredScreens("osd")
+
+                    delegate: CapsLockOSD {
+                        modelData: item
+                    }
+                }
+
+                Variants {
+                    model: SettingsData.getFilteredScreens("osd")
+
+                    delegate: AudioOutputOSD {
+                        modelData: item
+                    }
+                }
+            }
         }
     }
 

quickshell/Modals/Clipboard/ClipboardContent.qml

@@ -129,7 +129,7 @@ Item {
             }
 
             StyledText {
-                text: I18n.tr("No recent clipboard entries found")
+                text: clipboardContent.modal.clipboardAvailable ? I18n.tr("No recent clipboard entries found") : I18n.tr("Connecting to clipboard service…")
                 anchors.centerIn: parent
                 font.pixelSize: Theme.fontSizeMedium
                 color: Theme.surfaceVariantText
@@ -195,7 +195,7 @@ Item {
             }
 
             StyledText {
-                text: I18n.tr("No saved clipboard entries")
+                text: clipboardContent.modal.clipboardAvailable ? I18n.tr("No saved clipboard entries") : I18n.tr("Connecting to clipboard service…")
                 anchors.centerIn: parent
                 font.pixelSize: Theme.fontSizeMedium
                 color: Theme.surfaceVariantText

quickshell/Modals/Clipboard/ClipboardHistoryModal.qml

@@ -60,15 +60,12 @@ DankModal {
     }
 
     function show() {
-        if (!clipboardAvailable) {
-            ToastService.showError(I18n.tr("Clipboard service not available"));
-            return;
-        }
         open();
         activeImageLoads = 0;
         shouldHaveFocus = true;
         ClipboardService.reset();
-        ClipboardService.refresh();
+        if (clipboardAvailable)
+            ClipboardService.refresh();
         keyboardController.reset();
 
         Qt.callLater(function () {

quickshell/Modals/Clipboard/ClipboardHistoryPopout.qml

@@ -50,14 +50,11 @@ DankPopout {
     }
 
     function show() {
-        if (!clipboardAvailable) {
-            ToastService.showError(I18n.tr("Clipboard service not available"));
-            return;
-        }
         open();
         activeImageLoads = 0;
         ClipboardService.reset();
-        ClipboardService.refresh();
+        if (clipboardAvailable)
+            ClipboardService.refresh();
         keyboardController.reset();
 
         Qt.callLater(function () {
@@ -122,10 +119,10 @@ DankPopout {
     onBackgroundClicked: hide()
 
     onShouldBeVisibleChanged: {
-        if (!shouldBeVisible) {
+        if (!shouldBeVisible)
             return;
-        }
-        ClipboardService.refresh();
+        if (clipboardAvailable)
+            ClipboardService.refresh();
         keyboardController.reset();
         Qt.callLater(function () {
             if (contentLoader.item?.searchField) {

quickshell/Modals/Common/DankModal.qml

@@ -3,6 +3,7 @@ import Quickshell
 import Quickshell.Wayland
 import qs.Common
 import qs.Services
+import qs.Widgets
 
 Item {
     id: root
@@ -59,11 +60,25 @@ Item {
     function open() {
         closeTimer.stop();
         const focusedScreen = CompositorService.getFocusedScreen();
+        const screenChanged = focusedScreen && contentWindow.screen !== focusedScreen;
         if (focusedScreen) {
+            if (screenChanged)
+                contentWindow.visible = false;
             contentWindow.screen = focusedScreen;
-            if (!useSingleWindow)
+            if (!useSingleWindow) {
+                if (screenChanged)
+                    clickCatcher.visible = false;
                 clickCatcher.screen = focusedScreen;
+            }
         }
+        if (screenChanged) {
+            Qt.callLater(() => root._finishOpen());
+        } else {
+            _finishOpen();
+        }
+    }
+
+    function _finishOpen() {
         ModalManager.openModal(root);
         shouldBeVisible = true;
         if (!useSingleWindow)
@@ -211,6 +226,16 @@ Item {
         visible: false
         color: "transparent"
 
+        WindowBlur {
+            targetWindow: contentWindow
+            readonly property real s: Math.min(1, modalContainer.scaleValue)
+            blurX: modalContainer.x + modalContainer.width * (1 - s) * 0.5 + Theme.snap(modalContainer.animX, root.dpr)
+            blurY: modalContainer.y + modalContainer.height * (1 - s) * 0.5 + Theme.snap(modalContainer.animY, root.dpr)
+            blurWidth: (shouldBeVisible && animatedContent.opacity > 0) ? modalContainer.width * s : 0
+            blurHeight: (shouldBeVisible && animatedContent.opacity > 0) ? modalContainer.height * s : 0
+            blurRadius: root.cornerRadius
+        }
+
         WlrLayershell.namespace: root.layerNamespace
         WlrLayershell.layer: {
             if (root.useOverlayLayer)
@@ -385,6 +410,15 @@ Item {
                         radius: root.cornerRadius
                     }
 
+                    Rectangle {
+                        anchors.fill: parent
+                        radius: root.cornerRadius
+                        color: "transparent"
+                        border.color: BlurService.borderColor
+                        border.width: BlurService.borderWidth
+                        z: 100
+                    }
+
                     FocusScope {
                         anchors.fill: parent
                         focus: root.shouldBeVisible

quickshell/Modals/Common/InputModal.qml

@@ -0,0 +1,312 @@
+import QtQuick
+import qs.Common
+import qs.Modals.Common
+import qs.Widgets
+
+DankModal {
+    id: root
+
+    layerNamespace: "dms:input-modal"
+    keepPopoutsOpen: true
+
+    property string inputTitle: ""
+    property string inputMessage: ""
+    property string inputPlaceholder: ""
+    property string inputText: ""
+    property string confirmButtonText: "Confirm"
+    property string cancelButtonText: "Cancel"
+    property color confirmButtonColor: Theme.primary
+    property var onConfirm: function (text) {}
+    property var onCancel: function () {}
+    property int selectedButton: -1
+    property bool keyboardNavigation: false
+
+    function show(title, message, onConfirmCallback, onCancelCallback) {
+        inputTitle = title || "";
+        inputMessage = message || "";
+        inputPlaceholder = "";
+        inputText = "";
+        confirmButtonText = "Confirm";
+        cancelButtonText = "Cancel";
+        confirmButtonColor = Theme.primary;
+        onConfirm = onConfirmCallback || ((text) => {});
+        onCancel = onCancelCallback || (() => {});
+        selectedButton = -1;
+        keyboardNavigation = false;
+        open();
+    }
+
+    function showWithOptions(options) {
+        inputTitle = options.title || "";
+        inputMessage = options.message || "";
+        inputPlaceholder = options.placeholder || "";
+        inputText = options.initialText || "";
+        confirmButtonText = options.confirmText || "Confirm";
+        cancelButtonText = options.cancelText || "Cancel";
+        confirmButtonColor = options.confirmColor || Theme.primary;
+        onConfirm = options.onConfirm || ((text) => {});
+        onCancel = options.onCancel || (() => {});
+        selectedButton = -1;
+        keyboardNavigation = false;
+        open();
+    }
+
+    function confirmAndClose() {
+        const text = inputText;
+        close();
+        if (onConfirm) {
+            onConfirm(text);
+        }
+    }
+
+    function cancelAndClose() {
+        close();
+        if (onCancel) {
+            onCancel();
+        }
+    }
+
+    function selectButton() {
+        if (selectedButton === 0) {
+            cancelAndClose();
+        } else {
+            confirmAndClose();
+        }
+    }
+
+    shouldBeVisible: false
+    allowStacking: true
+    modalWidth: 350
+    modalHeight: contentLoader.item ? contentLoader.item.implicitHeight + Theme.spacingM * 2 : 200
+    enableShadow: true
+    shouldHaveFocus: true
+    onBackgroundClicked: cancelAndClose()
+    onOpened: {
+        Qt.callLater(function () {
+            if (contentLoader.item && contentLoader.item.textInputRef) {
+                contentLoader.item.textInputRef.forceActiveFocus();
+            }
+        });
+    }
+
+    content: Component {
+        FocusScope {
+            anchors.fill: parent
+            implicitHeight: mainColumn.implicitHeight
+            focus: true
+
+            property alias textInputRef: textInput
+
+            Keys.onPressed: function (event) {
+                const textFieldFocused = textInput.activeFocus;
+
+                switch (event.key) {
+                case Qt.Key_Escape:
+                    root.cancelAndClose();
+                    event.accepted = true;
+                    break;
+                case Qt.Key_Tab:
+                    if (textFieldFocused) {
+                        root.keyboardNavigation = true;
+                        root.selectedButton = 0;
+                        textInput.focus = false;
+                    } else {
+                        root.keyboardNavigation = true;
+                        if (root.selectedButton === -1) {
+                            root.selectedButton = 0;
+                        } else if (root.selectedButton === 0) {
+                            root.selectedButton = 1;
+                        } else {
+                            root.selectedButton = -1;
+                            textInput.forceActiveFocus();
+                        }
+                    }
+                    event.accepted = true;
+                    break;
+                case Qt.Key_Left:
+                    if (!textFieldFocused) {
+                        root.keyboardNavigation = true;
+                        root.selectedButton = 0;
+                        event.accepted = true;
+                    }
+                    break;
+                case Qt.Key_Right:
+                    if (!textFieldFocused) {
+                        root.keyboardNavigation = true;
+                        root.selectedButton = 1;
+                        event.accepted = true;
+                    }
+                    break;
+                case Qt.Key_Return:
+                case Qt.Key_Enter:
+                    if (root.selectedButton !== -1) {
+                        root.selectButton();
+                    } else {
+                        root.confirmAndClose();
+                    }
+                    event.accepted = true;
+                    break;
+                }
+            }
+
+            Column {
+                id: mainColumn
+                anchors.left: parent.left
+                anchors.right: parent.right
+                anchors.top: parent.top
+                anchors.leftMargin: Theme.spacingL
+                anchors.rightMargin: Theme.spacingL
+                anchors.topMargin: Theme.spacingL
+                spacing: 0
+
+                StyledText {
+                    text: root.inputTitle
+                    font.pixelSize: Theme.fontSizeLarge
+                    color: Theme.surfaceText
+                    font.weight: Font.Medium
+                    width: parent.width
+                    horizontalAlignment: Text.AlignHCenter
+                }
+
+                Item {
+                    width: 1
+                    height: Theme.spacingL
+                }
+
+                StyledText {
+                    text: root.inputMessage
+                    font.pixelSize: Theme.fontSizeMedium
+                    color: Theme.surfaceText
+                    width: parent.width
+                    horizontalAlignment: Text.AlignHCenter
+                    wrapMode: Text.WordWrap
+                    visible: root.inputMessage !== ""
+                }
+
+                Item {
+                    width: 1
+                    height: root.inputMessage !== "" ? Theme.spacingL : 0
+                    visible: root.inputMessage !== ""
+                }
+
+                Rectangle {
+                    width: parent.width
+                    height: 40
+                    radius: Theme.cornerRadius
+                    color: Theme.surfaceVariantAlpha
+                    border.color: textInput.activeFocus ? Theme.primary : "transparent"
+                    border.width: textInput.activeFocus ? 1 : 0
+
+                    TextInput {
+                        id: textInput
+
+                        anchors.fill: parent
+                        anchors.leftMargin: Theme.spacingM
+                        anchors.rightMargin: Theme.spacingM
+                        verticalAlignment: TextInput.AlignVCenter
+                        font.pixelSize: Theme.fontSizeMedium
+                        color: Theme.surfaceText
+                        selectionColor: Theme.primary
+                        selectedTextColor: Theme.primaryText
+                        clip: true
+                        text: root.inputText
+                        onTextChanged: root.inputText = text
+
+                        StyledText {
+                            anchors.fill: parent
+                            verticalAlignment: Text.AlignVCenter
+                            font.pixelSize: Theme.fontSizeMedium
+                            color: Qt.rgba(Theme.surfaceText.r, Theme.surfaceText.g, Theme.surfaceText.b, 0.4)
+                            text: root.inputPlaceholder
+                            visible: textInput.text === "" && !textInput.activeFocus
+                        }
+                    }
+                }
+
+                Item {
+                    width: 1
+                    height: Theme.spacingL * 1.5
+                }
+
+                Row {
+                    anchors.horizontalCenter: parent.horizontalCenter
+                    spacing: Theme.spacingM
+
+                    Rectangle {
+                        width: 120
+                        height: 40
+                        radius: Theme.cornerRadius
+                        color: {
+                            if (root.keyboardNavigation && root.selectedButton === 0) {
+                                return Qt.rgba(Theme.primary.r, Theme.primary.g, Theme.primary.b, 0.12);
+                            } else if (cancelButton.containsMouse) {
+                                return Theme.surfacePressed;
+                            } else {
+                                return Theme.surfaceVariantAlpha;
+                            }
+                        }
+                        border.color: (root.keyboardNavigation && root.selectedButton === 0) ? Theme.primary : "transparent"
+                        border.width: (root.keyboardNavigation && root.selectedButton === 0) ? 1 : 0
+
+                        StyledText {
+                            text: root.cancelButtonText
+                            font.pixelSize: Theme.fontSizeMedium
+                            color: Theme.surfaceText
+                            font.weight: Font.Medium
+                            anchors.centerIn: parent
+                        }
+
+                        MouseArea {
+                            id: cancelButton
+
+                            anchors.fill: parent
+                            hoverEnabled: true
+                            cursorShape: Qt.PointingHandCursor
+                            onClicked: root.cancelAndClose()
+                        }
+                    }
+
+                    Rectangle {
+                        width: 120
+                        height: 40
+                        radius: Theme.cornerRadius
+                        color: {
+                            const baseColor = root.confirmButtonColor;
+                            if (root.keyboardNavigation && root.selectedButton === 1) {
+                                return Qt.rgba(baseColor.r, baseColor.g, baseColor.b, 1);
+                            } else if (confirmButton.containsMouse) {
+                                return Qt.rgba(baseColor.r, baseColor.g, baseColor.b, 0.9);
+                            } else {
+                                return baseColor;
+                            }
+                        }
+                        border.color: (root.keyboardNavigation && root.selectedButton === 1) ? "white" : "transparent"
+                        border.width: (root.keyboardNavigation && root.selectedButton === 1) ? 1 : 0
+
+                        StyledText {
+                            text: root.confirmButtonText
+                            font.pixelSize: Theme.fontSizeMedium
+                            color: Theme.primaryText
+                            font.weight: Font.Medium
+                            anchors.centerIn: parent
+                        }
+
+                        MouseArea {
+                            id: confirmButton
+
+                            anchors.fill: parent
+                            hoverEnabled: true
+                            cursorShape: Qt.PointingHandCursor
+                            onClicked: root.confirmAndClose()
+                        }
+                    }
+                }
+
+                Item {
+                    width: 1
+                    height: Theme.spacingL
+                }
+            }
+        }
+    }
+}

quickshell/Modals/DankLauncherV2/DankLauncherV2Modal.qml

@@ -4,6 +4,7 @@ import Quickshell.Wayland
 import Quickshell.Hyprland
 import qs.Common
 import qs.Services
+import qs.Widgets
 
 Item {
     id: root
@@ -16,7 +17,6 @@ Item {
     property var spotlightContent: launcherContentLoader.item
     property bool openedFromOverview: false
     property bool isClosing: false
-    property bool _windowEnabled: true
     property bool _pendingInitialize: false
     property string _pendingQuery: ""
     property string _pendingMode: ""
@@ -125,40 +125,47 @@ Item {
         }
     }
 
-    function show() {
-        closeCleanupTimer.stop();
+    function _finishShow(query, mode) {
+        spotlightOpen = true;
         isClosing = false;
         openedFromOverview = false;
 
-        var focusedScreen = CompositorService.getFocusedScreen();
-        if (focusedScreen)
-            launcherWindow.screen = focusedScreen;
-
-        spotlightOpen = true;
         keyboardActive = true;
         ModalManager.openModal(root);
         if (useHyprlandFocusGrab)
             focusGrab.active = true;
 
-        _ensureContentLoadedAndInitialize("", "");
+        _ensureContentLoadedAndInitialize(query || "", mode || "");
+    }
+
+    function show() {
+        closeCleanupTimer.stop();
+
+        var focusedScreen = CompositorService.getFocusedScreen();
+        if (focusedScreen && launcherWindow.screen !== focusedScreen) {
+            spotlightOpen = false;
+            isClosing = false;
+            launcherWindow.screen = focusedScreen;
+            Qt.callLater(() => root._finishShow("", ""));
+            return;
+        }
+
+        _finishShow("", "");
     }
 
     function showWithQuery(query) {
         closeCleanupTimer.stop();
-        isClosing = false;
-        openedFromOverview = false;
 
         var focusedScreen = CompositorService.getFocusedScreen();
-        if (focusedScreen)
+        if (focusedScreen && launcherWindow.screen !== focusedScreen) {
+            spotlightOpen = false;
+            isClosing = false;
             launcherWindow.screen = focusedScreen;
+            Qt.callLater(() => root._finishShow(query, ""));
+            return;
+        }
 
-        spotlightOpen = true;
-        keyboardActive = true;
-        ModalManager.openModal(root);
-        if (useHyprlandFocusGrab)
-            focusGrab.active = true;
-
-        _ensureContentLoadedAndInitialize(query, "");
+        _finishShow(query, "");
     }
 
     function hide() {
@@ -182,14 +189,20 @@ Item {
 
     function showWithMode(mode) {
         closeCleanupTimer.stop();
+
+        var focusedScreen = CompositorService.getFocusedScreen();
+        if (focusedScreen && launcherWindow.screen !== focusedScreen) {
+            spotlightOpen = false;
+            isClosing = false;
+            launcherWindow.screen = focusedScreen;
+            Qt.callLater(() => root._finishShow("", mode));
+            return;
+        }
+
+        spotlightOpen = true;
         isClosing = false;
         openedFromOverview = false;
 
-        var focusedScreen = CompositorService.getFocusedScreen();
-        if (focusedScreen)
-            launcherWindow.screen = focusedScreen;
-
-        spotlightOpen = true;
         keyboardActive = true;
         ModalManager.openModal(root);
         if (useHyprlandFocusGrab)
@@ -262,41 +275,39 @@ Item {
             if (Quickshell.screens.length === 0)
                 return;
 
-            const screen = launcherWindow.screen;
-            const screenName = screen?.name;
-
-            let needsReset = !screen || !screenName;
-            if (!needsReset) {
-                needsReset = true;
+            const screenName = launcherWindow.screen?.name;
+            if (screenName) {
                 for (let i = 0; i < Quickshell.screens.length; i++) {
-                    if (Quickshell.screens[i].name === screenName) {
-                        needsReset = false;
-                        break;
-                    }
+                    if (Quickshell.screens[i].name === screenName)
+                        return;
                 }
             }
 
-            if (!needsReset)
-                return;
+            if (spotlightOpen)
+                hide();
 
             const newScreen = CompositorService.getFocusedScreen() ?? Quickshell.screens[0];
-            if (!newScreen)
-                return;
-
-            root._windowEnabled = false;
-            launcherWindow.screen = newScreen;
-            Qt.callLater(() => {
-                root._windowEnabled = true;
-            });
+            if (newScreen)
+                launcherWindow.screen = newScreen;
         }
     }
 
     PanelWindow {
         id: launcherWindow
-        visible: root._windowEnabled && (spotlightOpen || isClosing)
+        visible: spotlightOpen || isClosing
         color: "transparent"
         exclusionMode: ExclusionMode.Ignore
 
+        WindowBlur {
+            targetWindow: launcherWindow
+            readonly property real s: Math.min(1, modalContainer.scale)
+            blurX: root.modalX + root.modalWidth * (1 - s) * 0.5
+            blurY: root.modalY + root.modalHeight * (1 - s) * 0.5
+            blurWidth: (contentVisible && modalContainer.opacity > 0) ? root.modalWidth * s : 0
+            blurHeight: (contentVisible && modalContainer.opacity > 0) ? root.modalHeight * s : 0
+            blurRadius: root.cornerRadius
+        }
+
         WlrLayershell.namespace: "dms:spotlight"
         WlrLayershell.layer: {
             switch (Quickshell.env("DMS_MODAL_LAYER")) {
@@ -426,6 +437,14 @@ Item {
                     event.accepted = true;
                 }
             }
+
+            Rectangle {
+                anchors.fill: parent
+                radius: root.cornerRadius
+                color: "transparent"
+                border.color: BlurService.borderColor
+                border.width: BlurService.borderWidth
+            }
         }
     }
 }

quickshell/Modals/DankLauncherV2/LauncherContent.qml

@@ -270,7 +270,7 @@ FocusScope {
 
     Item {
         anchors.fill: parent
-        visible: !editMode
+        visible: !editMode && !(root.parentModal?.isClosing ?? false)
 
         Item {
             id: footerBar
@@ -551,7 +551,6 @@ FocusScope {
             Item {
                 width: parent.width
                 height: parent.height - searchField.height - categoryRow.height - actionPanel.height - Theme.spacingXS * (categoryRow.visible ? 3 : 2)
-                opacity: root.parentModal?.isClosing ? 0 : 1
 
                 ResultsList {
                     id: resultsList

quickshell/Modals/DankLauncherV2/LauncherContextMenu.qml

@@ -372,7 +372,7 @@ Popup {
             anchors.fill: parent
             implicitWidth: Math.max(180, menuColumn.implicitWidth + Theme.spacingS * 2)
             implicitHeight: menuColumn.implicitHeight + Theme.spacingS * 2
-            color: Theme.withAlpha(Theme.surfaceContainer, Theme.popupTransparency)
+            color: Theme.floatingSurface
             radius: Theme.cornerRadius
             border.color: Qt.rgba(Theme.outline.r, Theme.outline.g, Theme.outline.b, 0.08)
             border.width: 1

quickshell/Modals/DankLauncherV2/ResultsList.qml

@@ -58,9 +58,9 @@ Item {
                         item: items[i],
                         flatIndex: flatIdx,
                         sectionId: sectionId,
-                        height: 52
+                        height: 56
                     });
-                    cumY += 52;
+                    cumY += 56;
                 }
             } else {
                 var cols = root.controller?.getGridColumns(sectionId) ?? root.gridColumns;
@@ -190,124 +190,135 @@ Item {
         }
     }
 
-    DankListView {
-        id: mainListView
+    Item {
+        id: listClip
         anchors.fill: parent
+        anchors.topMargin: BlurService.enabled && stickyHeader.visible ? 32 : 0
         clip: true
-        scrollBarTopMargin: (root.controller?.sections?.length > 0) ? 32 : 0
 
-        model: ScriptModel {
-            values: root._visualRows
-            objectProp: "_rowId"
-        }
+        DankListView {
+            id: mainListView
+            y: -listClip.anchors.topMargin
+            width: parent.width
+            height: parent.height + listClip.anchors.topMargin
+            clip: true
+            scrollBarTopMargin: (root.controller?.sections?.length > 0) ? 32 : 0
 
-        add: null
-        remove: null
-        displaced: null
-        move: null
-
-        delegate: Item {
-            id: delegateRoot
-            required property var modelData
-            required property int index
-
-            width: mainListView.width
-            height: modelData?.height ?? 52
-
-            SectionHeader {
-                anchors.fill: parent
-                visible: delegateRoot.modelData?.type === "header"
-                section: delegateRoot.modelData?.section ?? null
-                controller: root.controller
-                viewMode: {
-                    var vt = root.controller?.viewModeVersion ?? 0;
-                    void (vt);
-                    return root.controller?.getSectionViewMode(delegateRoot.modelData?.sectionId ?? "") ?? "list";
-                }
-                canChangeViewMode: {
-                    var vt = root.controller?.viewModeVersion ?? 0;
-                    void (vt);
-                    return root.controller?.canChangeSectionViewMode(delegateRoot.modelData?.sectionId ?? "") ?? false;
-                }
-                canCollapse: root.controller?.canCollapseSection(delegateRoot.modelData?.sectionId ?? "") ?? false
+            model: ScriptModel {
+                values: root._visualRows
+                objectProp: "_rowId"
             }
 
-            ResultItem {
-                anchors.fill: parent
-                visible: delegateRoot.modelData?.type === "list_item"
-                item: delegateRoot.modelData?.type === "list_item" ? (delegateRoot.modelData?.item ?? null) : null
-                isSelected: delegateRoot.modelData?.type === "list_item" && (delegateRoot.modelData?.flatIndex ?? -1) === root.controller?.selectedFlatIndex
-                controller: root.controller
-                flatIndex: delegateRoot.modelData?.type === "list_item" ? (delegateRoot.modelData?.flatIndex ?? -1) : -1
+            add: null
+            remove: null
+            displaced: null
+            move: null
 
-                onClicked: {
-                    if (root.controller && delegateRoot.modelData?.item) {
-                        root.controller.executeItem(delegateRoot.modelData.item);
+            delegate: Item {
+                id: delegateRoot
+                required property var modelData
+                required property int index
+
+                width: mainListView.width
+                height: modelData?.height ?? 52
+
+                SectionHeader {
+                    anchors.fill: parent
+                    visible: delegateRoot.modelData?.type === "header"
+                    section: delegateRoot.modelData?.section ?? null
+                    controller: root.controller
+                    viewMode: {
+                        var vt = root.controller?.viewModeVersion ?? 0;
+                        void (vt);
+                        return root.controller?.getSectionViewMode(delegateRoot.modelData?.sectionId ?? "") ?? "list";
+                    }
+                    canChangeViewMode: {
+                        var vt = root.controller?.viewModeVersion ?? 0;
+                        void (vt);
+                        return root.controller?.canChangeSectionViewMode(delegateRoot.modelData?.sectionId ?? "") ?? false;
+                    }
+                    canCollapse: root.controller?.canCollapseSection(delegateRoot.modelData?.sectionId ?? "") ?? false
+                }
+
+                ResultItem {
+                    anchors.fill: parent
+                    anchors.topMargin: 2
+                    anchors.bottomMargin: 2
+                    visible: delegateRoot.modelData?.type === "list_item"
+                    item: delegateRoot.modelData?.type === "list_item" ? (delegateRoot.modelData?.item ?? null) : null
+                    isSelected: delegateRoot.modelData?.type === "list_item" && (delegateRoot.modelData?.flatIndex ?? -1) === root.controller?.selectedFlatIndex
+                    controller: root.controller
+                    flatIndex: delegateRoot.modelData?.type === "list_item" ? (delegateRoot.modelData?.flatIndex ?? -1) : -1
+
+                    onClicked: {
+                        if (root.controller && delegateRoot.modelData?.item) {
+                            root.controller.executeItem(delegateRoot.modelData.item);
+                        }
+                    }
+
+                    onRightClicked: (mouseX, mouseY) => {
+                        root.itemRightClicked(delegateRoot.modelData?.flatIndex ?? -1, delegateRoot.modelData?.item ?? null, mouseX, mouseY);
                     }
                 }
 
-                onRightClicked: (mouseX, mouseY) => {
-                    root.itemRightClicked(delegateRoot.modelData?.flatIndex ?? -1, delegateRoot.modelData?.item ?? null, mouseX, mouseY);
-                }
-            }
+                Row {
+                    id: gridRowContent
+                    anchors.fill: parent
+                    visible: delegateRoot.modelData?.type === "grid_row"
 
-            Row {
-                id: gridRowContent
-                anchors.fill: parent
-                visible: delegateRoot.modelData?.type === "grid_row"
+                    Repeater {
+                        model: delegateRoot.modelData?.type === "grid_row" ? (delegateRoot.modelData?.items ?? []) : []
 
-                Repeater {
-                    model: delegateRoot.modelData?.type === "grid_row" ? (delegateRoot.modelData?.items ?? []) : []
+                        Item {
+                            id: gridCellDelegate
+                            required property var modelData
+                            required property int index
 
-                    Item {
-                        id: gridCellDelegate
-                        required property var modelData
-                        required property int index
+                            readonly property real cellWidth: delegateRoot.modelData?.viewMode === "tile" ? Math.floor(delegateRoot.width / 3) : Math.floor(delegateRoot.width / (delegateRoot.modelData?.cols ?? root.gridColumns))
 
-                        readonly property real cellWidth: delegateRoot.modelData?.viewMode === "tile" ? Math.floor(delegateRoot.width / 3) : Math.floor(delegateRoot.width / (delegateRoot.modelData?.cols ?? root.gridColumns))
+                            width: cellWidth
+                            height: delegateRoot.height
 
-                        width: cellWidth
-                        height: delegateRoot.height
+                            GridItem {
+                                width: parent.width - 4
+                                height: parent.height - 4
+                                anchors.centerIn: parent
+                                visible: delegateRoot.modelData?.viewMode === "grid"
+                                item: gridCellDelegate.modelData?.item ?? null
+                                isSelected: (gridCellDelegate.modelData?.flatIndex ?? -1) === root.controller?.selectedFlatIndex
+                                controller: root.controller
+                                flatIndex: gridCellDelegate.modelData?.flatIndex ?? -1
 
-                        GridItem {
-                            width: parent.width - 4
-                            height: parent.height - 4
-                            anchors.centerIn: parent
-                            visible: delegateRoot.modelData?.viewMode === "grid"
-                            item: gridCellDelegate.modelData?.item ?? null
-                            isSelected: (gridCellDelegate.modelData?.flatIndex ?? -1) === root.controller?.selectedFlatIndex
-                            controller: root.controller
-                            flatIndex: gridCellDelegate.modelData?.flatIndex ?? -1
+                                onClicked: {
+                                    if (root.controller && gridCellDelegate.modelData?.item) {
+                                        root.controller.executeItem(gridCellDelegate.modelData.item);
+                                    }
+                                }
 
-                            onClicked: {
-                                if (root.controller && gridCellDelegate.modelData?.item) {
-                                    root.controller.executeItem(gridCellDelegate.modelData.item);
+                                onRightClicked: (mouseX, mouseY) => {
+                                    root.itemRightClicked(gridCellDelegate.modelData?.flatIndex ?? -1, gridCellDelegate.modelData?.item ?? null, mouseX, mouseY);
                                 }
                             }
 
-                            onRightClicked: (mouseX, mouseY) => {
-                                root.itemRightClicked(gridCellDelegate.modelData?.flatIndex ?? -1, gridCellDelegate.modelData?.item ?? null, mouseX, mouseY);
-                            }
-                        }
+                            TileItem {
+                                width: parent.width - 4
+                                height: parent.height - 4
+                                anchors.centerIn: parent
+                                visible: delegateRoot.modelData?.viewMode === "tile"
+                                item: gridCellDelegate.modelData?.item ?? null
+                                isSelected: (gridCellDelegate.modelData?.flatIndex ?? -1) === root.controller?.selectedFlatIndex
+                                controller: root.controller
+                                flatIndex: gridCellDelegate.modelData?.flatIndex ?? -1
 
-                        TileItem {
-                            width: parent.width - 4
-                            height: parent.height - 4
-                            anchors.centerIn: parent
-                            visible: delegateRoot.modelData?.viewMode === "tile"
-                            item: gridCellDelegate.modelData?.item ?? null
-                            isSelected: (gridCellDelegate.modelData?.flatIndex ?? -1) === root.controller?.selectedFlatIndex
-                            controller: root.controller
-                            flatIndex: gridCellDelegate.modelData?.flatIndex ?? -1
-
-                            onClicked: {
-                                if (root.controller && gridCellDelegate.modelData?.item) {
-                                    root.controller.executeItem(gridCellDelegate.modelData.item);
+                                onClicked: {
+                                    if (root.controller && gridCellDelegate.modelData?.item) {
+                                        root.controller.executeItem(gridCellDelegate.modelData.item);
+                                    }
                                 }
-                            }
 
-                            onRightClicked: (mouseX, mouseY) => {
-                                root.itemRightClicked(gridCellDelegate.modelData?.flatIndex ?? -1, gridCellDelegate.modelData?.item ?? null, mouseX, mouseY);
+                                onRightClicked: (mouseX, mouseY) => {
+                                    root.itemRightClicked(gridCellDelegate.modelData?.flatIndex ?? -1, gridCellDelegate.modelData?.item ?? null, mouseX, mouseY);
+                                }
                             }
                         }
                     }
@@ -324,6 +335,8 @@ Item {
         height: 24
         z: 100
         visible: {
+            if (BlurService.enabled)
+                return false;
             if (mainListView.contentHeight <= mainListView.height)
                 return false;
             var atBottom = mainListView.contentY >= mainListView.contentHeight - mainListView.height + mainListView.originY - 5;
@@ -363,7 +376,7 @@ Item {
         anchors.top: parent.top
         height: 32
         z: 101
-        color: Theme.withAlpha(Theme.surfaceContainer, Theme.popupTransparency)
+        color: Theme.floatingSurface
         visible: stickyHeaderSection !== null
 
         readonly property int versionTrigger: root.controller?.viewModeVersion ?? 0
@@ -441,7 +454,7 @@ Item {
                     case "apps":
                         return "apps";
                     default:
-                        return root.controller?.searchQuery?.length > 0 ? "search_off" : "search";
+                        return "search_off";
                     }
                 }
             }
@@ -469,9 +482,9 @@ Item {
                     case "plugins":
                         return hasQuery ? I18n.tr("No plugin results") : I18n.tr("Browse or search plugins");
                     case "apps":
-                        return hasQuery ? I18n.tr("No apps found") : I18n.tr("Type to search apps");
+                        return I18n.tr("No apps found");
                     default:
-                        return hasQuery ? I18n.tr("No results found") : I18n.tr("Type to search");
+                        return I18n.tr("No results found");
                     }
                 }
             }

quickshell/Modals/DankLauncherV2/Section.qml

@@ -50,7 +50,7 @@ Item {
             id: listComponent
 
             Column {
-                spacing: 2
+                spacing: 4
                 width: contentLoader.width
 
                 Repeater {

quickshell/Modals/Greeter/GreeterDoctorPage.qml

@@ -225,7 +225,13 @@ Item {
                     }
 
                     StyledText {
-                        text: root.errorCount > 0 ? I18n.tr("%1 issue(s) found", "greeter doctor page error count").arg(root.errorCount) : I18n.tr("All checks passed", "greeter doctor page success")
+                        text: {
+                            if (root.errorCount === 0)
+                                return I18n.tr("All checks passed", "greeter doctor page success");
+                            return root.errorCount === 1
+                                ? I18n.tr("%1 issue found", "greeter doctor page error count").arg(root.errorCount)
+                                : I18n.tr("%1 issues found", "greeter doctor page error count").arg(root.errorCount);
+                        }
                         font.pixelSize: Theme.fontSizeMedium
                         color: root.errorCount > 0 ? Theme.error : Theme.surfaceVariantText
                     }

quickshell/Modals/KeybindsModal.qml

@@ -81,7 +81,7 @@ DankModal {
 
                     StyledText {
                         Layout.alignment: Qt.AlignLeft
-                        text: KeybindsService.cheatsheet.title || "Keybinds"
+                        text: KeybindsService.cheatsheet.title || i18n("Keybinds")
                         font.pixelSize: Theme.fontSizeLarge
                         font.weight: Font.Bold
                         color: Theme.primary
@@ -309,10 +309,12 @@ DankModal {
                                                                         id: keyText
                                                                         anchors.centerIn: parent
                                                                         color: Theme.secondary
-                                                                        text: modelData.key || ""
+                                                                        text: (modelData.key || "").replace(/\+/g, " + ")
                                                                         font.pixelSize: Theme.fontSizeSmall
                                                                         font.weight: Font.Medium
                                                                         isMonospace: true
+                                                                        elide: Text.ElideRight
+                                                                        width: Math.min(implicitWidth, 148)
                                                                     }
                                                                 }
 
@@ -325,6 +327,7 @@ DankModal {
                                                                     font.pixelSize: Theme.fontSizeSmall
                                                                     opacity: 0.9
                                                                     elide: Text.ElideRight
+                                                                    wrapMode: Text.NoWrap
                                                                 }
                                                             }
                                                         }

quickshell/Modals/MuxModal.qml

@@ -0,0 +1,621 @@
+pragma ComponentBehavior: Bound
+
+import QtQuick
+import QtQuick.Controls
+import QtQuick.Layouts
+import Quickshell.Hyprland
+import Quickshell.Io
+import Quickshell
+import qs.Common
+import qs.Modals.Common
+import qs.Services
+import qs.Widgets
+
+DankModal {
+    id: muxModal
+
+    layerNamespace: "dms:mux"
+
+    property int selectedIndex: -1
+    property string searchText: ""
+    property var filteredSessions: []
+
+    function updateFilteredSessions() {
+        var filtered = []
+        var lowerSearch = searchText.trim().toLowerCase()
+        for (var i = 0; i < MuxService.sessions.length; i++) {
+            var session = MuxService.sessions[i]
+            if (lowerSearch.length > 0 && !session.name.toLowerCase().includes(lowerSearch))
+                continue
+            filtered.push(session)
+        }
+        filteredSessions = filtered
+
+        if (selectedIndex >= filteredSessions.length) {
+            selectedIndex = Math.max(0, filteredSessions.length - 1)
+        }
+    }
+
+    onSearchTextChanged: updateFilteredSessions()
+
+    Connections {
+        target: MuxService
+        function onSessionsChanged() {
+            updateFilteredSessions()
+        }
+    }
+
+    HyprlandFocusGrab {
+        id: grab
+        windows: [muxModal.contentWindow]
+        active: CompositorService.isHyprland && muxModal.shouldHaveFocus
+    }
+
+    function toggle() {
+        if (shouldBeVisible) {
+            hide()
+        } else {
+            show()
+        }
+    }
+
+    function show() {
+        open()
+        selectedIndex = -1
+        searchText = ""
+        MuxService.refreshSessions()
+        shouldHaveFocus = true
+
+        Qt.callLater(() => {
+            if (muxPanel && muxPanel.searchField) {
+                muxPanel.searchField.forceActiveFocus();
+            }
+        })
+    }
+
+    function hide() {
+        close()
+        selectedIndex = -1
+        searchText = ""
+    }
+
+    function attachToSession(name) {
+        MuxService.attachToSession(name)
+        hide()
+    }
+
+    function renameSession(name) {
+        inputModal.showWithOptions({
+            title: I18n.tr("Rename Session"),
+            message: I18n.tr("Enter a new name for session \"%1\"").arg(name),
+            initialText: name,
+            onConfirm: function (newName) {
+                MuxService.renameSession(name, newName)
+            }
+        })
+    }
+
+    function killSession(name) {
+        confirmModal.showWithOptions({
+            title: I18n.tr("Kill Session"),
+            message: I18n.tr("Are you sure you want to kill session \"%1\"?").arg(name),
+            confirmText: I18n.tr("Kill"),
+            confirmColor: Theme.primary,
+            onConfirm: function () {
+                MuxService.killSession(name)
+            }
+        })
+    }
+
+    function createNewSession() {
+        inputModal.showWithOptions({
+            title: I18n.tr("New Session"),
+            message: I18n.tr("Please write a name for your new %1 session").arg(MuxService.displayName),
+            onConfirm: function (name) {
+                MuxService.createSession(name)
+                hide()
+            }
+        })
+    }
+
+    function selectNext() {
+        selectedIndex = Math.min(selectedIndex + 1, filteredSessions.length - 1)
+    }
+
+    function selectPrevious() {
+        selectedIndex = Math.max(selectedIndex - 1, -1)
+    }
+
+    function activateSelected() {
+        if (selectedIndex === -1) {
+            createNewSession()
+        } else if (selectedIndex >= 0 && selectedIndex < filteredSessions.length) {
+            attachToSession(filteredSessions[selectedIndex].name)
+        }
+    }
+
+    visible: false
+    modalWidth: 600
+    modalHeight: 600
+    backgroundColor: Theme.withAlpha(Theme.surfaceContainer, Theme.popupTransparency)
+    cornerRadius: Theme.cornerRadius
+    borderColor: Theme.outlineMedium
+    borderWidth: 1
+    enableShadow: true
+    keepContentLoaded: true
+
+    onBackgroundClicked: hide()
+
+    Timer {
+        interval: 3000
+        running: muxModal.shouldBeVisible
+        repeat: true
+        onTriggered: MuxService.refreshSessions()
+    }
+
+    IpcHandler {
+        function open(): string {
+            muxModal.show()
+            return "MUX_OPEN_SUCCESS"
+        }
+
+        function close(): string {
+            muxModal.hide()
+            return "MUX_CLOSE_SUCCESS"
+        }
+
+        function toggle(): string {
+            muxModal.toggle()
+            return "MUX_TOGGLE_SUCCESS"
+        }
+
+        target: "mux"
+    }
+
+    // Backwards compatibility
+    IpcHandler {
+        function open(): string {
+            muxModal.show()
+            return "TMUX_OPEN_SUCCESS"
+        }
+
+        function close(): string {
+            muxModal.hide()
+            return "TMUX_CLOSE_SUCCESS"
+        }
+
+        function toggle(): string {
+            muxModal.toggle()
+            return "TMUX_TOGGLE_SUCCESS"
+        }
+
+        target: "tmux"
+    }
+
+    InputModal {
+        id: inputModal
+        onShouldBeVisibleChanged: {
+            if (shouldBeVisible) {
+                muxModal.shouldHaveFocus = false;
+                muxModal.contentWindow.visible = false;
+                return;
+            }
+            if (muxModal.shouldBeVisible) {
+                muxModal.contentWindow.visible = true;
+            }
+            Qt.callLater(function () {
+                if (!muxModal.shouldBeVisible) {
+                    return;
+                }
+                muxModal.shouldHaveFocus = true;
+                muxModal.modalFocusScope.forceActiveFocus();
+                if (muxPanel.searchField) {
+                    muxPanel.searchField.forceActiveFocus();
+                }
+            });
+        }
+    }
+
+    ConfirmModal {
+        id: confirmModal
+        onShouldBeVisibleChanged: {
+            if (shouldBeVisible) {
+                muxModal.shouldHaveFocus = false;
+                muxModal.contentWindow.visible = false;
+                return;
+            }
+            if (muxModal.shouldBeVisible) {
+                muxModal.contentWindow.visible = true;
+            }
+            Qt.callLater(function () {
+                if (!muxModal.shouldBeVisible) {
+                    return;
+                }
+                muxModal.shouldHaveFocus = true;
+                muxModal.modalFocusScope.forceActiveFocus();
+                if (muxPanel.searchField) {
+                    muxPanel.searchField.forceActiveFocus();
+                }
+            });
+        }
+    }
+
+    directContent: Item {
+        id: muxPanel
+
+        clip: false
+
+        property alias searchField: searchField
+
+        Keys.onPressed: event => {
+            if ((event.key === Qt.Key_J && (event.modifiers & Qt.ControlModifier)) ||
+                (event.key === Qt.Key_Down)) {
+                selectNext()
+                event.accepted = true
+            } else if ((event.key === Qt.Key_K && (event.modifiers & Qt.ControlModifier)) ||
+                    (event.key === Qt.Key_Up)) {
+                selectPrevious()
+                event.accepted = true
+            } else if (event.key === Qt.Key_N && (event.modifiers & Qt.ControlModifier)) {
+                createNewSession()
+                event.accepted = true
+            } else if (event.key === Qt.Key_R && (event.modifiers & Qt.ControlModifier)) {
+                if (MuxService.supportsRename && selectedIndex >= 0 && selectedIndex < filteredSessions.length) {
+                    renameSession(filteredSessions[selectedIndex].name)
+                }
+                event.accepted = true
+            } else if (event.key === Qt.Key_D && (event.modifiers & Qt.ControlModifier)) {
+                if (selectedIndex >= 0 && selectedIndex < filteredSessions.length) {
+                    killSession(filteredSessions[selectedIndex].name)
+                }
+                event.accepted = true
+            } else if (event.key === Qt.Key_Escape) {
+                hide()
+                event.accepted = true
+            } else if (event.key === Qt.Key_Return || event.key === Qt.Key_Enter) {
+                activateSelected()
+                event.accepted = true
+            }
+        }
+
+        Column {
+            width: parent.width - Theme.spacingM * 2
+            height: parent.height - Theme.spacingM * 2
+            x: Theme.spacingM
+            y: Theme.spacingM
+            spacing: Theme.spacingS
+
+            // Header
+            Item {
+                width: parent.width
+                height: 40
+
+                StyledText {
+                    anchors.left: parent.left
+                    anchors.leftMargin: Theme.spacingS
+                    anchors.verticalCenter: parent.verticalCenter
+                    text: I18n.tr("%1 Sessions").arg(MuxService.displayName)
+                    font.pixelSize: Theme.fontSizeLarge + 4
+                    font.weight: Font.Bold
+                    color: Theme.surfaceText
+                }
+
+                StyledText {
+                    anchors.right: parent.right
+                    anchors.rightMargin: Theme.spacingS
+                    anchors.verticalCenter: parent.verticalCenter
+                    text: I18n.tr("%1 active, %2 filtered").arg(MuxService.sessions.length).arg(muxModal.filteredSessions.length)
+                    font.pixelSize: Theme.fontSizeMedium
+                    color: Theme.surfaceVariantText
+                }
+            }
+
+            // Search field
+            DankTextField {
+                id: searchField
+
+                width: parent.width
+                height: 48
+                cornerRadius: Theme.cornerRadius
+                backgroundColor: Theme.surfaceContainerHigh
+                normalBorderColor: Theme.outlineMedium
+                focusedBorderColor: Theme.primary
+                leftIconName: "search"
+                leftIconSize: Theme.iconSize
+                leftIconColor: Theme.surfaceVariantText
+                leftIconFocusedColor: Theme.primary
+                showClearButton: true
+                font.pixelSize: Theme.fontSizeMedium
+                placeholderText: I18n.tr("Search sessions...")
+                keyForwardTargets: [muxPanel]
+
+                onTextEdited: {
+                    muxModal.searchText = text
+                    muxModal.selectedIndex = 0
+                }
+            }
+
+            // New Session Button
+            Rectangle {
+                width: parent.width
+                height: 56
+                radius: Theme.cornerRadius
+                color: muxModal.selectedIndex === -1 ? Theme.primaryContainer :
+                        (newMouse.containsMouse ? Theme.surfaceContainerHigh : Theme.surfaceContainer)
+
+                RowLayout {
+                    anchors.fill: parent
+                    anchors.leftMargin: Theme.spacingM
+                    anchors.rightMargin: Theme.spacingM
+                    spacing: Theme.spacingM
+
+                    Rectangle {
+                        Layout.preferredWidth: 40
+                        Layout.preferredHeight: 40
+                        radius: 20
+                        color: Theme.primaryContainer
+
+                        DankIcon {
+                            anchors.centerIn: parent
+                            name: "add"
+                            size: Theme.iconSize
+                            color: Theme.primary
+                        }
+                    }
+
+                    Column {
+                        Layout.fillWidth: true
+                        spacing: 2
+
+                        StyledText {
+                            text: I18n.tr("New Session")
+                            font.pixelSize: Theme.fontSizeMedium
+                            font.weight: Font.Medium
+                            color: Theme.surfaceText
+                        }
+
+                        StyledText {
+                            text: I18n.tr("Create a new %1 session (n)").arg(MuxService.displayName)
+                            font.pixelSize: Theme.fontSizeSmall
+                            color: Theme.surfaceVariantText
+                        }
+                    }
+                }
+
+                MouseArea {
+                    id: newMouse
+                    anchors.fill: parent
+                    hoverEnabled: true
+                    cursorShape: Qt.PointingHandCursor
+                    onClicked: muxModal.createNewSession()
+                }
+            }
+
+            // Sessions List
+            Rectangle {
+                width: parent.width
+                height: parent.height - 88 - 48 - shortcutsBar.height - Theme.spacingS * 3
+                radius: Theme.cornerRadius
+                color: "transparent"
+
+                ScrollView {
+                    anchors.fill: parent
+                    clip: true
+
+                    Column {
+                        width: parent.width
+                        spacing: Theme.spacingXS
+
+                        Repeater {
+                            model: ScriptModel {
+                                values: muxModal.filteredSessions
+                            }
+
+                            delegate: Rectangle {
+                                required property var modelData
+                                required property int index
+
+                                width: parent.width
+                                height: 64
+                                radius: Theme.cornerRadius
+                                color: muxModal.selectedIndex === index ? Theme.primaryContainer :
+                                        (sessionMouse.containsMouse ? Theme.surfaceContainerHigh : "transparent")
+
+                                MouseArea {
+                                    id: sessionMouse
+                                    anchors.fill: parent
+                                    hoverEnabled: true
+                                    cursorShape: Qt.PointingHandCursor
+                                    onClicked: muxModal.attachToSession(modelData.name)
+                                }
+
+                                RowLayout {
+                                    anchors.fill: parent
+                                    anchors.leftMargin: Theme.spacingM
+                                    anchors.rightMargin: Theme.spacingM
+                                    spacing: Theme.spacingM
+
+                                    // Avatar
+                                    Rectangle {
+                                        Layout.preferredWidth: 40
+                                        Layout.preferredHeight: 40
+                                        radius: 20
+                                        color: modelData.attached ? Theme.primaryContainer : Theme.surfaceContainerHigh
+
+                                        StyledText {
+                                            anchors.centerIn: parent
+                                            text: modelData.name.charAt(0).toUpperCase()
+                                            font.pixelSize: Theme.fontSizeLarge
+                                            font.weight: Font.Bold
+                                            color: modelData.attached ? Theme.primary : Theme.surfaceText
+                                        }
+                                    }
+
+                                    // Info
+                                    Column {
+                                        Layout.fillWidth: true
+                                        spacing: 2
+
+                                        StyledText {
+                                            text: modelData.name
+                                            font.pixelSize: Theme.fontSizeMedium
+                                            font.weight: Font.Medium
+                                            color: Theme.surfaceText
+                                            elide: Text.ElideRight
+                                        }
+
+                                        StyledText {
+                                            text: {
+                                                var parts = []
+                                                if (modelData.windows !== "N/A")
+                                                    parts.push(I18n.tr("%1 windows").arg(modelData.windows))
+                                                parts.push(modelData.attached ? I18n.tr("attached") : I18n.tr("detached"))
+                                                return parts.join(" \u2022 ")
+                                            }
+                                            font.pixelSize: Theme.fontSizeSmall
+                                            color: Theme.surfaceVariantText
+                                        }
+                                    }
+
+                                    // Rename button (tmux only)
+                                    Rectangle {
+                                        Layout.preferredWidth: 36
+                                        Layout.preferredHeight: 36
+                                        radius: 18
+                                        visible: MuxService.supportsRename
+                                        color: renameMouse.containsMouse ? Theme.surfaceContainerHighest : "transparent"
+
+                                        DankIcon {
+                                            anchors.centerIn: parent
+                                            name: "edit"
+                                            size: Theme.iconSizeSmall
+                                            color: renameMouse.containsMouse ? Theme.primary : Theme.surfaceVariantText
+                                        }
+
+                                        MouseArea {
+                                            id: renameMouse
+                                            anchors.fill: parent
+                                            hoverEnabled: true
+                                            cursorShape: Qt.PointingHandCursor
+                                            onClicked: muxModal.renameSession(modelData.name)
+                                        }
+                                    }
+
+                                    // Delete button
+                                    Rectangle {
+                                        Layout.preferredWidth: 36
+                                        Layout.preferredHeight: 36
+                                        radius: 18
+                                        color: deleteMouse.containsMouse ? Theme.errorContainer : "transparent"
+
+                                        DankIcon {
+                                            anchors.centerIn: parent
+                                            name: "delete"
+                                            size: Theme.iconSizeSmall
+                                            color: deleteMouse.containsMouse ? Theme.error : Theme.surfaceVariantText
+                                        }
+
+                                        MouseArea {
+                                            id: deleteMouse
+                                            anchors.fill: parent
+                                            hoverEnabled: true
+                                            cursorShape: Qt.PointingHandCursor
+                                            onClicked: {
+                                                muxModal.killSession(modelData.name)
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+
+                        // Empty state
+                        Item {
+                            width: parent.width
+                            height: muxModal.filteredSessions.length === 0 ? 200 : 0
+                            visible: muxModal.filteredSessions.length === 0
+
+                            Column {
+                                anchors.centerIn: parent
+                                spacing: Theme.spacingM
+
+                                DankIcon {
+                                    name: muxModal.searchText.length > 0 ? "search_off" : "terminal"
+                                    size: 48
+                                    color: Theme.surfaceVariantText
+                                    anchors.horizontalCenter: parent.horizontalCenter
+                                }
+
+                                StyledText {
+                                    text: muxModal.searchText.length > 0 ? I18n.tr("No sessions found") : I18n.tr("No active %1 sessions").arg(MuxService.displayName)
+                                    font.pixelSize: Theme.fontSizeMedium
+                                    color: Theme.surfaceVariantText
+                                    anchors.horizontalCenter: parent.horizontalCenter
+                                }
+
+                                StyledText {
+                                    text: muxModal.searchText.length > 0 ? I18n.tr("Try a different search") : I18n.tr("Press 'n' or click 'New Session' to create one")
+                                    font.pixelSize: Theme.fontSizeSmall
+                                    color: Theme.surfaceVariantText
+                                    anchors.horizontalCenter: parent.horizontalCenter
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+
+            // Shortcuts bar
+            Row {
+                id: shortcutsBar
+                width: parent.width
+                spacing: Theme.spacingM
+                bottomPadding: Theme.spacingS
+
+                Repeater {
+                    model: {
+                        var shortcuts = [
+                            { key: "↑↓", label: I18n.tr("Navigate") },
+                            { key: "↵", label: I18n.tr("Attach") },
+                            { key: "^N", label: I18n.tr("New") },
+                            { key: "^D", label: I18n.tr("Kill") },
+                            { key: "Esc", label: I18n.tr("Close") }
+                        ]
+                        if (MuxService.supportsRename)
+                            shortcuts.splice(3, 0, { key: "^R", label: I18n.tr("Rename") })
+                        return shortcuts
+                    }
+
+                    delegate: Row {
+                        required property var modelData
+                        spacing: 4
+
+                        Rectangle {
+                            width: keyText.width + Theme.spacingS
+                            height: keyText.height + 4
+                            radius: 4
+                            color: Theme.surfaceContainerHighest
+                            anchors.verticalCenter: parent.verticalCenter
+
+                            StyledText {
+                                id: keyText
+                                anchors.centerIn: parent
+                                text: modelData.key
+                                font.pixelSize: Theme.fontSizeSmall - 1
+                                font.weight: Font.Medium
+                                color: Theme.surfaceVariantText
+                            }
+                        }
+
+                        StyledText {
+                            text: modelData.label
+                            font.pixelSize: Theme.fontSizeSmall
+                            color: Theme.surfaceVariantText
+                            anchors.verticalCenter: parent.verticalCenter
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

quickshell/Modals/PolkitAuthModal.qml

@@ -1,5 +1,6 @@
 import QtQuick
 import Quickshell
+import Quickshell.Io
 import qs.Common
 import qs.Services
 import qs.Widgets
@@ -11,8 +12,45 @@ FloatingWindow {
     property string passwordInput: ""
     property var currentFlow: PolkitService.agent?.flow
     property bool isLoading: false
+    property bool awaitingFprintForPassword: false
     readonly property int inputFieldHeight: Theme.fontSizeMedium + Theme.spacingL * 2
 
+    property string polkitEtcPamText: ""
+    property string polkitLibPamText: ""
+    property string systemAuthPamText: ""
+    property string commonAuthPamText: ""
+    property string passwordAuthPamText: ""
+    readonly property bool polkitPamHasFprint: {
+        const polkitText = polkitEtcPamText !== "" ? polkitEtcPamText : polkitLibPamText;
+        if (!polkitText)
+            return false;
+        return pamModuleEnabled(polkitText, "pam_fprintd") || (polkitText.includes("system-auth") && pamModuleEnabled(systemAuthPamText, "pam_fprintd")) || (polkitText.includes("common-auth") && pamModuleEnabled(commonAuthPamText, "pam_fprintd")) || (polkitText.includes("password-auth") && pamModuleEnabled(passwordAuthPamText, "pam_fprintd"));
+    }
+
+    function stripPamComment(line) {
+        if (!line)
+            return "";
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            return "";
+        const hashIdx = trimmed.indexOf("#");
+        if (hashIdx >= 0)
+            return trimmed.substring(0, hashIdx).trim();
+        return trimmed;
+    }
+
+    function pamModuleEnabled(pamText, moduleName) {
+        if (!pamText || !moduleName)
+            return false;
+        const lines = pamText.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const line = stripPamComment(lines[i]);
+            if (line && line.includes(moduleName))
+                return true;
+        }
+        return false;
+    }
+
     function focusPasswordField() {
         passwordField.forceActiveFocus();
     }
@@ -20,6 +58,7 @@ FloatingWindow {
     function show() {
         passwordInput = "";
         isLoading = false;
+        awaitingFprintForPassword = false;
         visible = true;
         Qt.callLater(focusPasswordField);
     }
@@ -28,17 +67,27 @@ FloatingWindow {
         visible = false;
     }
 
+    function _commitSubmit() {
+        isLoading = true;
+        awaitingFprintForPassword = false;
+        currentFlow.submit(passwordInput);
+        passwordInput = "";
+    }
+
     function submitAuth() {
         if (!currentFlow || isLoading)
             return;
-        isLoading = true;
-        currentFlow.submit(passwordInput);
-        passwordInput = "";
+        if (!currentFlow.isResponseRequired) {
+            awaitingFprintForPassword = true;
+            return;
+        }
+        _commitSubmit();
     }
 
     function cancelAuth() {
         if (isLoading)
             return;
+        awaitingFprintForPassword = false;
         if (currentFlow) {
             currentFlow.cancelAuthenticationRequest();
             return;
@@ -60,6 +109,7 @@ FloatingWindow {
         }
         passwordInput = "";
         isLoading = false;
+        awaitingFprintForPassword = false;
     }
 
     Connections {
@@ -83,6 +133,11 @@ FloatingWindow {
         function onIsResponseRequiredChanged() {
             if (!currentFlow.isResponseRequired)
                 return;
+            if (awaitingFprintForPassword && passwordInput !== "") {
+                _commitSubmit();
+                return;
+            }
+            awaitingFprintForPassword = false;
             isLoading = false;
             passwordInput = "";
             passwordField.forceActiveFocus();
@@ -101,6 +156,41 @@ FloatingWindow {
         }
     }
 
+    FileView {
+        path: "/etc/pam.d/polkit-1"
+        printErrors: false
+        onLoaded: root.polkitEtcPamText = text()
+        onLoadFailed: root.polkitEtcPamText = ""
+    }
+
+    FileView {
+        path: "/usr/lib/pam.d/polkit-1"
+        printErrors: false
+        onLoaded: root.polkitLibPamText = text()
+        onLoadFailed: root.polkitLibPamText = ""
+    }
+
+    FileView {
+        path: "/etc/pam.d/system-auth"
+        printErrors: false
+        onLoaded: root.systemAuthPamText = text()
+        onLoadFailed: root.systemAuthPamText = ""
+    }
+
+    FileView {
+        path: "/etc/pam.d/common-auth"
+        printErrors: false
+        onLoaded: root.commonAuthPamText = text()
+        onLoadFailed: root.commonAuthPamText = ""
+    }
+
+    FileView {
+        path: "/etc/pam.d/password-auth"
+        printErrors: false
+        onLoaded: root.passwordAuthPamText = text()
+        onLoadFailed: root.passwordAuthPamText = ""
+    }
+
     FocusScope {
         id: contentFocusScope
 
@@ -205,36 +295,30 @@ FloatingWindow {
                 visible: text !== ""
             }
 
-            Rectangle {
+            DankTextField {
+                id: passwordField
+
                 width: parent.width
                 height: inputFieldHeight
-                radius: Theme.cornerRadius
-                color: Theme.surfaceHover
-                border.color: passwordField.activeFocus ? Theme.primary : Theme.outlineStrong
-                border.width: passwordField.activeFocus ? 2 : 1
+                backgroundColor: Theme.surfaceHover
+                normalBorderColor: Theme.outlineStrong
+                focusedBorderColor: Theme.primary
+                borderWidth: 1
+                focusedBorderWidth: 2
+                leftIconName: polkitPamHasFprint ? "fingerprint" : ""
+                leftIconSize: 20
+                leftIconColor: Theme.primary
+                leftIconFocusedColor: Theme.primary
                 opacity: isLoading ? 0.5 : 1
-
-                MouseArea {
-                    anchors.fill: parent
-                    enabled: !isLoading
-                    onClicked: passwordField.forceActiveFocus()
-                }
-
-                DankTextField {
-                    id: passwordField
-
-                    anchors.fill: parent
-                    font.pixelSize: Theme.fontSizeMedium
-                    textColor: Theme.surfaceText
-                    text: passwordInput
-                    showPasswordToggle: !(currentFlow?.responseVisible ?? false)
-                    echoMode: (currentFlow?.responseVisible ?? false) || passwordVisible ? TextInput.Normal : TextInput.Password
-                    placeholderText: ""
-                    backgroundColor: "transparent"
-                    enabled: !isLoading
-                    onTextEdited: passwordInput = text
-                    onAccepted: submitAuth()
-                }
+                font.pixelSize: Theme.fontSizeMedium
+                textColor: Theme.surfaceText
+                text: passwordInput
+                showPasswordToggle: !(currentFlow?.responseVisible ?? false)
+                echoMode: (currentFlow?.responseVisible ?? false) || passwordVisible ? TextInput.Normal : TextInput.Password
+                placeholderText: ""
+                enabled: !isLoading
+                onTextEdited: passwordInput = text
+                onAccepted: submitAuth()
             }
 
             StyledText {

quickshell/Modals/Settings/SettingsContent.qml

@@ -473,5 +473,20 @@ FocusScope {
                     Qt.callLater(() => item.forceActiveFocus());
             }
         }
+
+        Loader {
+            id: muxLoader
+            anchors.fill: parent
+            active: root.currentIndex === 32
+            visible: active
+            focus: active
+
+            sourceComponent: MuxTab {}
+
+            onActiveChanged: {
+                if (active && item)
+                    Qt.callLater(() => item.forceActiveFocus());
+            }
+        }
     }
 }

quickshell/Modals/Settings/SettingsSidebar.qml

@@ -156,7 +156,7 @@ Rectangle {
                 {
                     "id": "running_apps",
                     "text": I18n.tr("Running Apps"),
-                    "icon": "apps",
+                    "icon": "app_registration",
                     "tabIndex": 19,
                     "hyprlandNiriOnly": true
                 },
@@ -237,7 +237,7 @@ Rectangle {
         {
             "id": "system",
             "text": I18n.tr("System"),
-            "icon": "computer",
+            "icon": "memory",
             "collapsedByDefault": true,
             "children": [
                 {
@@ -260,6 +260,12 @@ Rectangle {
                     "tabIndex": 8,
                     "cupsOnly": true
                 },
+                {
+                    "id": "multiplexers",
+                    "text": I18n.tr("Multiplexers"),
+                    "icon": "terminal",
+                    "tabIndex": 32
+                },
                 {
                     "id": "window_rules",
                     "text": I18n.tr("Window Rules"),

quickshell/Modules/AppDrawer/AppDrawerPopout.qml

@@ -136,7 +136,7 @@ DankPopout {
             QtObject {
                 id: modalAdapter
                 property bool spotlightOpen: appDrawerPopout.shouldBeVisible
-                property bool isClosing: false
+                readonly property bool isClosing: !appDrawerPopout.shouldBeVisible
 
                 function hide() {
                     appDrawerPopout.close();

quickshell/Modules/BlurredWallpaperBackground.qml

@@ -86,7 +86,7 @@ Variants {
 
             Component.onCompleted: {
                 if (typeof blurWallpaperWindow.updatesEnabled !== "undefined")
-                    blurWallpaperWindow.updatesEnabled = Qt.binding(() => root.effectActive || root._renderSettling || currentWallpaper.status === Image.Loading || nextWallpaper.status === Image.Loading);
+                    blurWallpaperWindow.updatesEnabled = Qt.binding(() => !root.source || root.effectActive || root._renderSettling || currentWallpaper.status === Image.Loading || nextWallpaper.status === Image.Loading);
                 isInitialized = true;
             }
 
@@ -100,10 +100,30 @@ Variants {
             Connections {
                 target: currentWallpaper
                 function onStatusChanged() {
-                    if (currentWallpaper.status === Image.Ready) {
-                        root._renderSettling = true;
-                        renderSettleTimer.restart();
-                    }
+                    if (currentWallpaper.status !== Image.Ready && currentWallpaper.status !== Image.Error)
+                        return;
+                    root._renderSettling = true;
+                    renderSettleTimer.restart();
+                }
+            }
+
+            Connections {
+                target: blurWallpaperWindow
+                function onWidthChanged() {
+                    root._renderSettling = true;
+                    renderSettleTimer.restart();
+                }
+                function onHeightChanged() {
+                    root._renderSettling = true;
+                    renderSettleTimer.restart();
+                }
+            }
+
+            Connections {
+                target: Quickshell
+                function onScreensChanged() {
+                    root._renderSettling = true;
+                    renderSettleTimer.restart();
                 }
             }
 
@@ -167,6 +187,8 @@ Variants {
                     transitionAnimation.stop();
                     root.transitionProgress = 0;
                     root.effectActive = false;
+                    root._renderSettling = true;
+                    renderSettleTimer.restart();
                     currentWallpaper.source = nextWallpaper.source;
                     nextWallpaper.source = "";
                 }
@@ -175,6 +197,9 @@ Variants {
                     return;
                 }
 
+                root._renderSettling = true;
+                renderSettleTimer.restart();
+
                 nextWallpaper.source = newPath;
 
                 if (nextWallpaper.status === Image.Ready)
@@ -201,6 +226,7 @@ Variants {
                 visible: false
                 opacity: 1
                 asynchronous: true
+                retainWhileLoading: true
                 smooth: true
                 cache: true
                 sourceSize: Qt.size(root.textureWidth, root.textureHeight)
@@ -213,6 +239,7 @@ Variants {
                 visible: false
                 opacity: 0
                 asynchronous: true
+                retainWhileLoading: true
                 smooth: true
                 cache: true
                 sourceSize: Qt.size(root.textureWidth, root.textureHeight)
@@ -295,6 +322,8 @@ Variants {
                     root.useNextForEffect = false;
                     nextWallpaper.source = "";
                     root.transitionProgress = 0.0;
+                    root._renderSettling = true;
+                    renderSettleTimer.restart();
                     root.effectActive = false;
                 }
             }

quickshell/Modules/BuiltinDesktopPlugins/DesktopClockWidget.qml

@@ -58,7 +58,7 @@ Item {
         }
     }
 
-    property bool enabled: isInstance ? (instanceData?.enabled ?? true) : SettingsData.desktopClockEnabled
+    enabled: isInstance ? (instanceData?.enabled ?? true) : SettingsData.desktopClockEnabled
     property real transparency: isInstance ? (cfg.transparency ?? 0.8) : SettingsData.desktopClockTransparency
     property string colorMode: isInstance ? (cfg.colorMode ?? "primary") : SettingsData.desktopClockColorMode
     property color customColor: isInstance ? (cfg.customColor ?? "#ffffff") : SettingsData.desktopClockCustomColor

quickshell/Modules/BuiltinDesktopPlugins/SystemMonitorWidget.qml

@@ -37,7 +37,7 @@ Item {
     readonly property var cfg: instanceData?.config ?? null
     readonly property bool isInstance: instanceId !== "" && cfg !== null
 
-    property bool enabled: isInstance ? (instanceData?.enabled ?? true) : SettingsData.systemMonitorEnabled
+    enabled: isInstance ? (instanceData?.enabled ?? true) : SettingsData.systemMonitorEnabled
     property bool showHeader: isInstance ? (cfg.showHeader ?? true) : SettingsData.systemMonitorShowHeader
     property real transparency: isInstance ? (cfg.transparency ?? 0.8) : SettingsData.systemMonitorTransparency
     property string colorMode: isInstance ? (cfg.colorMode ?? "primary") : SettingsData.systemMonitorColorMode

quickshell/Modules/ControlCenter/BuiltinPlugins/CupsWidget.qml

@@ -34,7 +34,9 @@ PluginComponent {
             id: detailRoot
             implicitHeight: detailColumn.implicitHeight + Theme.spacingM * 2
             radius: Theme.cornerRadius
-            color: Theme.surfaceContainerHigh
+            color: Theme.nestedSurface
+            border.color: Theme.outlineMedium
+            border.width: Theme.layerOutlineWidth
 
             DankActionButton {
                 anchors.top: parent.top
@@ -252,7 +254,7 @@ PluginComponent {
                                 width: parent ? parent.width : 300
                                 height: 50
                                 radius: Theme.cornerRadius
-                                color: Theme.surfaceContainerHighest
+                                color: Theme.surfaceLight
                                 border.width: 1
                                 border.color: Theme.outlineLight
                                 opacity: 1.0

quickshell/Modules/ControlCenter/Components/ActionTile.qml

@@ -12,7 +12,6 @@ Rectangle {
     property string text: ""
     property string secondaryText: ""
     property bool isActive: false
-    property bool enabled: true
     property int widgetIndex: 0
     property var widgetData: null
     property bool editMode: false
@@ -28,12 +27,12 @@ Rectangle {
     }
 
     readonly property color _tileBgActive: Theme.ccTileActiveBg
-    readonly property color _tileBgInactive: Theme.withAlpha(Theme.surfaceContainerHigh, Theme.popupTransparency)
+    readonly property color _tileBgInactive: Theme.ccPillInactiveBg
     readonly property color _tileRingActive: Theme.ccTileRing
 
     color: isActive ? _tileBgActive : _tileBgInactive
-    border.color: isActive ? _tileRingActive : Qt.rgba(Theme.outline.r, Theme.outline.g, Theme.outline.b, 0.08)
-    border.width: isActive ? 1 : 1
+    border.color: isActive ? _tileRingActive : Theme.outlineMedium
+    border.width: isActive ? 1 : Theme.layerOutlineWidth
     opacity: enabled ? 1.0 : 0.6
 
     function hoverTint(base) {

quickshell/Modules/ControlCenter/Components/DragDropGrid.qml

@@ -260,7 +260,7 @@ Column {
                     }
                 case "audioOutput":
                     {
-                        if (!AudioService.sink)
+                        if (!AudioService.sink?.audio)
                             return "volume_off";
                         let volume = AudioService.sink.audio.volume;
                         let muted = AudioService.sink.audio.muted;
@@ -276,7 +276,7 @@ Column {
                     }
                 case "audioInput":
                     {
-                        if (!AudioService.source)
+                        if (!AudioService.source?.audio)
                             return "mic_off";
                         let muted = AudioService.source.audio.muted;
                         return muted ? "mic_off" : "mic";
@@ -369,7 +369,7 @@ Column {
                     }
                 case "audioOutput":
                     {
-                        if (!AudioService.sink)
+                        if (!AudioService.sink?.audio)
                             return I18n.tr("Select device", "audio status");
                         if (AudioService.sink.audio.muted)
                             return I18n.tr("Muted", "audio status");
@@ -380,7 +380,7 @@ Column {
                     }
                 case "audioInput":
                     {
-                        if (!AudioService.source)
+                        if (!AudioService.source?.audio)
                             return I18n.tr("Select device", "audio status");
                         if (AudioService.source.audio.muted)
                             return I18n.tr("Muted", "audio status");
@@ -412,9 +412,9 @@ Column {
                 case "bluetooth":
                     return !!(BluetoothService.available && BluetoothService.adapter && BluetoothService.adapter.enabled);
                 case "audioOutput":
-                    return !!(AudioService.sink && !AudioService.sink.audio.muted);
+                    return !!(AudioService.sink?.audio && !AudioService.sink.audio.muted);
                 case "audioInput":
-                    return !!(AudioService.source && !AudioService.source.audio.muted);
+                    return !!(AudioService.source?.audio && !AudioService.source.audio.muted);
                 default:
                     return false;
                 }
@@ -507,7 +507,8 @@ Column {
                 anchors.centerIn: parent
                 width: parent.width
                 height: 14
-                property color sliderTrackColor: Theme.withAlpha(Theme.surfaceContainerHigh, Theme.popupTransparency)
+                sliderTrackColor: Theme.ccSliderTrackColor
+                sliderTrackOpacity: Theme.ccSliderTrackOpacity
             }
         }
     }
@@ -529,7 +530,8 @@ Column {
                 instanceId: widgetData.instanceId || ""
                 screenName: root.screenName
                 parentScreen: root.parentScreen
-                property color sliderTrackColor: Theme.withAlpha(Theme.surfaceContainerHigh, Theme.popupTransparency)
+                sliderTrackColor: Theme.ccSliderTrackColor
+                sliderTrackOpacity: Theme.ccSliderTrackOpacity
 
                 onIconClicked: {
                     if (!root.editMode && DisplayService.devices && DisplayService.devices.length > 1) {
@@ -552,7 +554,8 @@ Column {
                 anchors.centerIn: parent
                 width: parent.width
                 height: 14
-                property color sliderTrackColor: Theme.withAlpha(Theme.surfaceContainerHigh, Theme.popupTransparency)
+                sliderTrackColor: Theme.ccSliderTrackColor
+                sliderTrackOpacity: Theme.ccSliderTrackOpacity
             }
         }
     }