feat(settings): add location search to theme & gamma coordinates (#3010)

* feat(settings): add location search to theme & gamma coordinates

* fix(settings): refresh coordinate fields after manual edits

README.md

@@ -101,7 +101,9 @@ MPRIS player controls, calendar sync, weather widgets, and clipboard history wit
 Lock screen, idle detection, auto-lock/suspend with separate AC/battery settings, and a settings front-end for [dank-greeter](https://github.com/AvengeMedia/dank-greeter).
 
 **Plugin System**
-Extend functionality with the [plugin registry](https://plugins.danklinux.com).
+Extend functionality with the [plugin registry](https://plugins.danklinux.com). DMS keeps
+`~/.config/DankMaterialShell/plugins.lock.json` synchronized with managed plugin installs and
+their exact Git commits, so the same plugins can be reproduced on another machine.
 
 ## Supported Compositors
 
@@ -120,6 +122,8 @@ dms ipc call audio setvolume 50
 dms ipc call wallpaper set /path/to/image.jpg
 dms brightness list  # List available displays
 dms plugins search   # Browse plugin registry
+dms plugins lock     # Refresh the portable plugin lockfile
+dms plugins restore ~/plugins.lock.json
 ```
 
 [Full CLI and IPC documentation](https://danklinux.com/docs/dankmaterialshell/keybinds-ipc)

core/README.md

@@ -74,7 +74,7 @@ Custom IPC via unix socket (JSON API) for shell communication.
 - `dms run [-d]` - Start shell (optionally as daemon)
 - `dms restart` / `dms kill` - Manage running processes
 - `dms ipc <command>` - Send IPC commands (toggle launcher, notifications, etc.)
-- `dms plugins [install|browse|search]` - Plugin management
+- `dms plugins [install|browse|search|lock|restore]` - Plugin management and portable exact-revision lockfiles
 - `dms brightness [list|set]` - Control display/monitor brightness
 - `dms color pick` - Native color picker (see below)
 - `dms update` - Update DMS and dependencies (disabled in distro packages)

core/cmd/dms/commands_common.go

@@ -51,6 +51,8 @@ func init() {
 	})
 	pluginsUpdateCmd.Flags().BoolP("all", "a", false, "Update all installed plugins")
 	pluginsUpdateCmd.Flags().Bool("check", false, "Check for available updates without applying them")
+	pluginsLockCmd.Flags().StringP("output", "o", "", "Also write the lockfile to this path")
+	pluginsRestoreCmd.Flags().Bool("prune", false, "Remove managed plugins that are not in the lockfile")
 }
 
 var debugSrvCmd = &cobra.Command{
@@ -178,6 +180,36 @@ var pluginsUpdateCmd = &cobra.Command{
 	},
 }
 
+var pluginsLockCmd = &cobra.Command{
+	Use:   "lock",
+	Short: "Record installed plugins and their exact revisions",
+	Long:  "Write a portable plugins.lock.json containing every managed user plugin and its current Git commit.",
+	Args:  cobra.NoArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		output, _ := cmd.Flags().GetString("output")
+		if err := lockPluginsCLI(output); err != nil {
+			log.Fatalf("Error writing plugin lockfile: %v", err)
+		}
+	},
+}
+
+var pluginsRestoreCmd = &cobra.Command{
+	Use:   "restore [lockfile]",
+	Short: "Restore plugins from exact revisions in a lockfile",
+	Long:  "Install or reset all plugins in a portable plugins.lock.json. Existing managed plugins are retained unless --prune is specified.",
+	Args:  cobra.MaximumNArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		path := ""
+		if len(args) == 1 {
+			path = args[0]
+		}
+		prune, _ := cmd.Flags().GetBool("prune")
+		if err := restorePluginsCLI(path, prune); err != nil {
+			log.Fatalf("Error restoring plugins: %v", err)
+		}
+	},
+}
+
 func runVersion(cmd *cobra.Command, args []string) {
 	fmt.Printf("%s\n", formatVersion(Version))
 }
@@ -433,6 +465,40 @@ func installPluginCLI(idOrName string) error {
 	return nil
 }
 
+func lockPluginsCLI(outputPath string) error {
+	manager, err := plugins.NewManager()
+	if err != nil {
+		return fmt.Errorf("failed to create manager: %w", err)
+	}
+	warnings, err := manager.WriteCurrentLockfile(outputPath)
+	if err != nil {
+		return err
+	}
+	for _, warning := range warnings {
+		fmt.Fprintf(os.Stderr, "Warning: %s\n", warning)
+	}
+	fmt.Printf("Plugin lockfile written: %s\n", manager.GetLockfilePath())
+	if outputPath != "" && outputPath != manager.GetLockfilePath() {
+		fmt.Printf("Plugin lockfile exported: %s\n", outputPath)
+	}
+	return nil
+}
+
+func restorePluginsCLI(path string, prune bool) error {
+	manager, err := plugins.NewManager()
+	if err != nil {
+		return fmt.Errorf("failed to create manager: %w", err)
+	}
+	if err := manager.RestoreFromLockfile(path, prune); err != nil {
+		return err
+	}
+	if path == "" {
+		path = manager.GetLockfilePath()
+	}
+	fmt.Printf("Plugins restored from lockfile: %s\n", path)
+	return nil
+}
+
 func getAvailablePluginIDs() []string {
 	registry, err := plugins.NewRegistry()
 	if err != nil {
@@ -704,6 +770,7 @@ func getCommonCommands() []*cobra.Command {
 		ipcCmd,
 		debugSrvCmd,
 		pluginsCmd,
+		registryCmd,
 		dank16Cmd,
 		brightnessCmd,
 		dpmsCmd,

core/cmd/dms/commands_registry.go

@@ -0,0 +1,67 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/registries"
+	"github.com/spf13/afero"
+	"github.com/spf13/cobra"
+)
+
+var registryCmd = &cobra.Command{
+	Use:   "registry",
+	Short: "Manage plugin and theme registries",
+	Long:  "Manage the registries DMS fetches plugins and themes from. The official registry is always active; additional registries can be added by name and git URL.",
+}
+
+var registryListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List configured registries",
+	Run: func(cmd *cobra.Command, args []string) {
+		for _, s := range registries.Load(afero.NewOsFs()) {
+			suffix := ""
+			if s.Official() {
+				suffix = " (official)"
+			}
+			fmt.Printf("%s%s\n    %s\n", s.Name, suffix, s.URL)
+		}
+	},
+}
+
+var registryAddCmd = &cobra.Command{
+	Use:   "add <name> <url>",
+	Short: "Add a registry",
+	Long:  "Add a registry by name and git URL. The repository must contain a plugins/ or themes/ directory in the registry format.",
+	Args:  cobra.ExactArgs(2),
+	Run: func(cmd *cobra.Command, args []string) {
+		if err := registries.Add(afero.NewOsFs(), args[0], args[1]); err != nil {
+			log.Fatalf("Error adding registry: %v", err)
+		}
+		fmt.Printf("Registry added: %s\n", args[0])
+	},
+}
+
+var registryRemoveCmd = &cobra.Command{
+	Use:   "remove <name>",
+	Short: "Remove a registry",
+	Args:  cobra.ExactArgs(1),
+	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		if len(args) != 0 {
+			return nil, cobra.ShellCompDirectiveNoFileComp
+		}
+		var names []string
+		for _, s := range registries.Load(afero.NewOsFs()) {
+			if !s.Official() {
+				names = append(names, s.Name)
+			}
+		}
+		return names, cobra.ShellCompDirectiveNoFileComp
+	},
+	Run: func(cmd *cobra.Command, args []string) {
+		if err := registries.Remove(afero.NewOsFs(), args[0]); err != nil {
+			log.Fatalf("Error removing registry: %v", err)
+		}
+		fmt.Printf("Registry removed: %s\n", args[0])
+	},
+}

core/cmd/dms/main.go

@@ -15,7 +15,8 @@ func init() {
 	authCmd.AddCommand(authSyncCmd, authResolveLockCmd, authListServicesCmd, authValidateCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
 	updateCmd.AddCommand(updateCheckCmd)
-	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
+	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd, pluginsLockCmd, pluginsRestoreCmd)
+	registryCmd.AddCommand(registryListCmd, registryAddCmd, registryRemoveCmd)
 	rootCmd.AddCommand(getCommonCommands()...)
 
 	rootCmd.AddCommand(authCmd)

core/cmd/dms/main_distro.go

@@ -14,7 +14,7 @@ var Version = "dev"
 func init() {
 	authCmd.AddCommand(authSyncCmd, authResolveLockCmd, authListServicesCmd, authValidateCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
-	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
+	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd, pluginsLockCmd, pluginsRestoreCmd)
 	rootCmd.AddCommand(getCommonCommands()...)
 	rootCmd.AddCommand(authCmd)
 

core/go.mod

@@ -69,7 +69,7 @@ require (
 )
 
 require (
-	github.com/AvengeMedia/dankgo v0.0.0-20260724133713-a4ef23371e05
+	github.com/AvengeMedia/dankgo v0.0.0-20260730184236-239485829b0b
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect

core/go.sum

@@ -1,7 +1,7 @@
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-github.com/AvengeMedia/dankgo v0.0.0-20260724133713-a4ef23371e05 h1:Ij/yzOT8y2HL7V5Rkec1GxJV0rUvhKqfAzyGxVRTk1o=
+github.com/AvengeMedia/dankgo v0.0.0-20260730184236-239485829b0b h1:UwX1H4BkzazL7ips9ljnHzBXGttYARcIi5Njj9aqIt4=
-github.com/AvengeMedia/dankgo v0.0.0-20260724133713-a4ef23371e05/go.mod h1:xt8RldAfti0QCWidwYIzsSSoJWsE61WgEhTu2H9UpD4=
+github.com/AvengeMedia/dankgo v0.0.0-20260730184236-239485829b0b/go.mod h1:xt8RldAfti0QCWidwYIzsSSoJWsE61WgEhTu2H9UpD4=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=

core/internal/dank16/dank16.go

@@ -313,6 +313,7 @@ func EnsureContrastDPSLstar(hexColor, hexBg string, minLc float64, isLightMode b
 	fg := HexToRGB(hexColor)
 	cf := colorful.Color{R: fg.R, G: fg.G, B: fg.B}
 	Lf, af, bf := cf.Lab()
+	Lf *= 100.0
 
 	dir := 1.0
 	if isLightMode {
@@ -341,6 +342,7 @@ func EnsureContrastDPSBidirectional(hexColor, hexBg string, minLc float64, isLig
 	fg := HexToRGB(hexColor)
 	cf := colorful.Color{R: fg.R, G: fg.G, B: fg.B}
 	origL, af, bf := cf.Lab()
+	origL *= 100.0
 
 	var darkerResult, lighterResult string
 	darkerL, lighterL := origL, origL
@@ -420,6 +422,24 @@ func blendHue(base, target, factor float64) float64 {
 	return result
 }
 
+// color8 sits a fixed L* offset from the background so it keeps its dim role
+// regardless of primary brightness (conventional palettes put ANSI bright
+// black ~2-2.5:1 from the background, e.g. catppuccin-mocha #585b70 on #1e1e2e)
+func DeriveDim(bgHex string, hue, sat float64, isLight bool) string {
+	offset := 22.0
+	if isLight {
+		offset = -offset
+	}
+
+	bgL := getLstar(bgHex)
+	targetL := math.Max(0, math.Min(100, bgL+offset))
+
+	tint := HSVToRGB(HSV{H: hue, S: sat, V: 0.5})
+	c := colorful.Color{R: tint.R, G: tint.G, B: tint.B}
+	_, af, bf := c.Lab()
+	return labToHex(targetL, af, bf)
+}
+
 func DeriveContainer(primary string, isLight bool) string {
 	rgb := HexToRGB(primary)
 	hsv := RGBToHSV(rgb)
@@ -500,10 +520,7 @@ func GeneratePalette(primaryColor string, opts PaletteOptions) Palette {
 		gray7V := baseVal * 0.28
 		palette.Color7 = NewColorInfo(ensureContrastAuto(RGBToHex(HSVToRGB(HSV{H: hsv.H, S: gray7S, V: gray7V})), bgColor, normalTextTarget, opts))
 
-		gray8S := baseSat * 0.05
+		palette.Color8 = NewColorInfo(DeriveDim(bgColor, hsv.H, baseSat*0.05, true))
-		gray8V := baseVal * 0.85
-		dimTarget := secondaryTarget * 0.5
-		palette.Color8 = NewColorInfo(ensureContrastBidirectional(RGBToHex(HSVToRGB(HSV{H: hsv.H, S: gray8S, V: gray8V})), bgColor, dimTarget, opts))
 
 		brightRedS := math.Min(baseSat*1.0, 1.0)
 		brightRedV := math.Min(baseVal*1.2, 1.0)
@@ -559,9 +576,7 @@ func GeneratePalette(primaryColor string, opts PaletteOptions) Palette {
 		gray7V := math.Min(baseVal*1.05, 1.0)
 		palette.Color7 = NewColorInfo(ensureContrastAuto(RGBToHex(HSVToRGB(HSV{H: hsv.H, S: gray7S, V: gray7V})), bgColor, normalTextTarget, opts))
 
-		gray8S := baseSat * 0.15
+		palette.Color8 = NewColorInfo(DeriveDim(bgColor, hsv.H, baseSat*0.15, false))
-		gray8V := baseVal * 0.65
-		palette.Color8 = NewColorInfo(ensureContrastAuto(RGBToHex(HSVToRGB(HSV{H: hsv.H, S: gray8S, V: gray8V})), bgColor, secondaryTarget, opts))
 
 		brightRedS := math.Min(baseSat*0.75, 1.0)
 		brightRedV := math.Min(baseVal*1.35, 1.0)

core/internal/dank16/dank16_test.go

@@ -679,3 +679,73 @@ func TestContrastAlgorithmComparison(t *testing.T) {
 
 	t.Logf("WCAG and DPS palettes differ in %d/16 colors", differentCount)
 }
+
+func TestEnsureContrastDPSLightModeStaysLight(t *testing.T) {
+	tests := []struct {
+		name     string
+		result   string
+		bg       string
+		minLstar float64
+	}{
+		{
+			name:     "bidirectional adjustment",
+			result:   EnsureContrastDPSBidirectional("#d0ccc6", "#f8f8f8", 17.5, true),
+			bg:       "#f8f8f8",
+			minLstar: 20.0,
+		},
+		{
+			name:     "lstar adjustment",
+			result:   EnsureContrastDPSLstar("#c0c0c0", "#f8f8f8", 30.0, true),
+			bg:       "#f8f8f8",
+			minLstar: 20.0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			lstar := getLstar(tt.result)
+			if lstar < tt.minLstar {
+				t.Errorf("result %s has L* %.2f on light bg %s, expected >= %.2f (collapsed to near-black)",
+					tt.result, lstar, tt.bg, tt.minLstar)
+			}
+		})
+	}
+}
+
+func TestGeneratePaletteColor8Dim(t *testing.T) {
+	hues := []string{"#e91e63", "#f59e0b", "#22c55e", "#06b6d4", "#8b5cf6", "#ef4444"}
+
+	for _, base := range hues {
+		t.Run(base, func(t *testing.T) {
+			palette := GeneratePalette(base, PaletteOptions{IsLight: false, UseDPS: true})
+
+			bgRatio := ContrastRatio(palette.Color8.Hex, palette.Color0.Hex)
+			if bgRatio < 1.5 || bgRatio > 3.0 {
+				t.Errorf("Color8 %s vs bg %s ratio %.2f, expected 1.5-3.0 (bright black stays near bg)",
+					palette.Color8.Hex, palette.Color0.Hex, bgRatio)
+			}
+
+			sepRatio := ContrastRatio(palette.Color4.Hex, palette.Color8.Hex)
+			if sepRatio < 2.0 {
+				t.Errorf("Color4 %s vs Color8 %s ratio %.2f, expected >= 2.0 (blue must not collide with bright black)",
+					palette.Color4.Hex, palette.Color8.Hex, sepRatio)
+			}
+		})
+	}
+}
+
+func TestGeneratePaletteLightColor8StaysLight(t *testing.T) {
+	palette := GeneratePalette("#f59e0b", PaletteOptions{IsLight: true, UseDPS: true})
+
+	lstar := getLstar(palette.Color8.Hex)
+	if lstar < 60.0 {
+		t.Errorf("light mode Color8 %s has L* %.2f, expected >= 60 (dim grey, not near-black)",
+			palette.Color8.Hex, lstar)
+	}
+
+	bgRatio := ContrastRatio(palette.Color8.Hex, palette.Color0.Hex)
+	if bgRatio > 3.0 {
+		t.Errorf("light mode Color8 %s vs bg %s ratio %.2f, expected <= 3.0",
+			palette.Color8.Hex, palette.Color0.Hex, bgRatio)
+	}
+}

core/internal/distros/gentoo.go

@@ -53,6 +53,11 @@ func NewGentooDistribution(config DistroConfig, logChan chan<- string) *GentooDi
 	}
 }
 
+func emergeInstallArgs(packages []string) []string {
+	args := []string{"emerge", "--ask=n", "--quiet", "--autounmask-continue=y", "--autounmask-keep-keywords=y", "--autounmask-keep-masks=y"}
+	return append(args, packages...)
+}
+
 func (g *GentooDistribution) getArchKeyword() string {
 	arch := runtime.GOARCH
 	switch arch {
@@ -319,6 +324,7 @@ func (g *GentooDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 	}
 	g.log("Portage tree synced successfully")
 
+	args := emergeInstallArgs(missingPkgs)
 	g.log(fmt.Sprintf("Installing prerequisites: %s", strings.Join(missingPkgs, ", ")))
 	progressChan <- InstallProgressMsg{
 		Phase:       PhasePrerequisites,
@@ -326,12 +332,10 @@ func (g *GentooDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		Step:        fmt.Sprintf("Installing %d prerequisites...", len(missingPkgs)),
 		IsComplete:  false,
 		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo emerge --ask=n %s", strings.Join(missingPkgs, " ")),
+		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
 		LogOutput:   fmt.Sprintf("Installing prerequisites: %s", strings.Join(missingPkgs, ", ")),
 	}
 
-	args := []string{"emerge", "--ask=n", "--quiet"}
-	args = append(args, missingPkgs...)
 	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	output, err := cmd.CombinedOutput()
 	if err != nil {
@@ -521,8 +525,7 @@ func (g *GentooDistribution) installPortagePackages(ctx context.Context, package
 		}
 	}
 
-	args := []string{"emerge", "--ask=n", "--quiet"}
+	args := emergeInstallArgs(packageNames)
-	args = append(args, packageNames...)
 
 	progressChan <- InstallProgressMsg{
 		Phase:       PhaseSystemPackages,
@@ -713,8 +716,7 @@ func (g *GentooDistribution) installGURUPackages(ctx context.Context, packages [
 		guruPackages[i] = pkg + "::guru"
 	}
 
-	args := []string{"emerge", "--ask=n", "--quiet"}
+	args := emergeInstallArgs(guruPackages)
-	args = append(args, guruPackages...)
 
 	progressChan <- InstallProgressMsg{
 		Phase:       PhaseAURPackages,

core/internal/keybinds/providers/hyprland.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"regexp"
 	"sort"
 	"strconv"
 	"strings"
@@ -224,6 +225,44 @@ func (h *HyprlandProvider) validateAction(action string) error {
 	return nil
 }
 
+var luaExprActionPattern = regexp.MustCompile(`^(function\s*\(|hl\.)`)
+
+// isRawLuaActionText reports that action is a Lua expression to re-emit
+// verbatim rather than freeform dispatcher text to wrap for hyprctl. The
+// balance check keeps malformed input from corrupting the generated file.
+func isRawLuaActionText(action string) bool {
+	if !luaExprActionPattern.MatchString(action) {
+		return false
+	}
+	depth := 0
+	var quote byte
+	escaped := false
+	for i := 0; i < len(action); i++ {
+		c := action[i]
+		switch {
+		case escaped:
+			escaped = false
+		case quote != 0:
+			switch c {
+			case '\\':
+				escaped = true
+			case quote:
+				quote = 0
+			}
+		case c == '"' || c == '\'':
+			quote = c
+		case c == '(':
+			depth++
+		case c == ')':
+			depth--
+			if depth < 0 {
+				return false
+			}
+		}
+	}
+	return depth == 0 && quote == 0 && !escaped
+}
+
 func (h *HyprlandProvider) SetBind(key, action, description string, options map[string]any) error {
 	if err := h.ensureWritableConfig(); err != nil {
 		return err
@@ -259,6 +298,7 @@ func (h *HyprlandProvider) SetBind(key, action, description string, options map[
 		Description:  description,
 		Flags:        flags,
 		Options:      options,
+		RawLuaAction: isRawLuaActionText(action),
 	}
 
 	return h.writeOverrideBinds(existingBinds)

core/internal/keybinds/providers/hyprland_parser_test.go

@@ -463,6 +463,56 @@ func TestHyprlandSetBindLeavesConfOnlyInstallReadOnly(t *testing.T) {
 	}
 }
 
+func TestIsRawLuaActionText(t *testing.T) {
+	cases := []struct {
+		action string
+		want   bool
+	}{
+		{`function() hl.plugin.scrolloverview.overview("toggle") end`, true},
+		{`hl.dsp.exec_cmd("foo")`, true},
+		{`hl.dsp.no_op()`, true},
+		{"workspace 3", false},
+		{"exec zeditor", false},
+		{`function() hl.foo( end`, false},
+		{`function() hl.foo("a) end`, false},
+		{`hl.foo()) hl.bar((`, false},
+	}
+	for _, tc := range cases {
+		if got := isRawLuaActionText(tc.action); got != tc.want {
+			t.Errorf("isRawLuaActionText(%q) = %v, want %v", tc.action, got, tc.want)
+		}
+	}
+}
+
+func TestHyprlandSetBindPreservesRawLuaAction(t *testing.T) {
+	tmpDir := t.TempDir()
+	dmsDir := filepath.Join(tmpDir, "dms")
+	if err := os.MkdirAll(dmsDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dmsDir, "binds-user.lua"), []byte("-- DMS user keybind overrides\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	provider := NewHyprlandProvider(tmpDir)
+	rawAction := `function() hl.plugin.scrolloverview.overview("toggle") end`
+	if err := provider.SetBind("SUPER + G", rawAction, "Toggle overview", nil); err != nil {
+		t.Fatal(err)
+	}
+
+	data, err := os.ReadFile(filepath.Join(dmsDir, "binds-user.lua"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := string(data)
+	if !strings.Contains(got, `hl.bind("SUPER + G", `+rawAction) {
+		t.Fatalf("expected raw Lua action to be written verbatim, got:\n%s", got)
+	}
+	if strings.Contains(got, "hyprctl dispatch function") {
+		t.Fatalf("expected raw Lua action to not be wrapped in hyprctl dispatch, got:\n%s", got)
+	}
+}
+
 func TestHyprlandSetBindUpdatesSpacedLuaOverrideWithoutDuplicates(t *testing.T) {
 	tmpDir := t.TempDir()
 	dmsDir := filepath.Join(tmpDir, "dms")

core/internal/matugen/matugen.go

@@ -471,12 +471,9 @@ output_path = '%s'
 		case TemplateKindTerminal:
 			appendTerminalConfig(opts, cfgFile, tmpDir, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
 		case TemplateKindVSCode:
-			appendVSCodeConfig(cfgFile, "vscode", filepath.Join(homeDir, ".vscode/extensions"), opts.ShellDir)
+			for _, editor := range vscodeEditors {
-			appendVSCodeConfig(cfgFile, "codium", filepath.Join(homeDir, ".vscode-oss/extensions"), opts.ShellDir)
+				appendVSCodeConfig(cfgFile, editor.name, editor.extensionsDir(homeDir), opts.ShellDir)
-			appendVSCodeConfig(cfgFile, "codeoss", filepath.Join(homeDir, ".config/Code - OSS/extensions"), opts.ShellDir)
+			}
-			appendVSCodeConfig(cfgFile, "cursor", filepath.Join(homeDir, ".cursor/extensions"), opts.ShellDir)
-			appendVSCodeConfig(cfgFile, "windsurf", filepath.Join(homeDir, ".windsurf/extensions"), opts.ShellDir)
-			appendVSCodeConfig(cfgFile, "vscode-insiders", filepath.Join(homeDir, ".vscode-insiders/extensions"), opts.ShellDir)
 		case TemplateKindEmacs:
 			if utils.EmacsConfigDir() != "" {
 				appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigDirs, tmpl.ConfigFile)
@@ -633,6 +630,23 @@ func appExists(checker utils.AppChecker, checkCmd []string, checkFlatpaks []stri
 	return false
 }
 
+type vscodeEditor struct {
+	name    string
+	dataDir string
+}
+
+var vscodeEditors = []vscodeEditor{
+	{"vscode", ".vscode"},
+	{"codium", ".vscode-oss"},
+	{"cursor", ".cursor"},
+	{"windsurf", ".windsurf"},
+	{"vscode-insiders", ".vscode-insiders"},
+}
+
+func (e vscodeEditor) extensionsDir(homeDir string) string {
+	return filepath.Join(homeDir, e.dataDir, "extensions")
+}
+
 func appendVSCodeConfig(cfgFile *os.File, name, extBaseDir, shellDir string) {
 	pattern := filepath.Join(extBaseDir, "danklinux.dms-theme-*")
 	matches, err := filepath.Glob(pattern)
@@ -968,11 +982,32 @@ func applyKDEColorScheme(mode ColorMode) {
 	}
 }
 
+func gtkThemeInstalled(theme string) bool {
+	home, _ := os.UserHomeDir()
+	candidates := []string{
+		filepath.Join(home, ".local/share/themes", theme),
+		filepath.Join(home, ".themes", theme),
+		filepath.Join("/usr/share/themes", theme),
+		filepath.Join("/usr/local/share/themes", theme),
+	}
+	for _, dir := range candidates {
+		if info, err := os.Stat(dir); err == nil && info.IsDir() {
+			return true
+		}
+	}
+	return false
+}
+
 func refreshGTKTheme(mode ColorMode) {
+	theme := mode.GTKTheme()
+	if !gtkThemeInstalled(theme) {
+		log.Infof("Skipping gtk-theme refresh: %s is not installed", theme)
+		return
+	}
 	if err := utils.GsettingsSet("org.gnome.desktop.interface", "gtk-theme", ""); err != nil {
 		log.Warnf("Failed to reset gtk-theme: %v", err)
 	}
-	if err := utils.GsettingsSet("org.gnome.desktop.interface", "gtk-theme", mode.GTKTheme()); err != nil {
+	if err := utils.GsettingsSet("org.gnome.desktop.interface", "gtk-theme", theme); err != nil {
 		log.Warnf("Failed to set gtk-theme: %v", err)
 	}
 }
@@ -1147,16 +1182,8 @@ func CheckTemplates(checker utils.AppChecker) []TemplateCheck {
 }
 
 func checkVSCodeExtension(homeDir string) bool {
-	extDirs := []string{
+	for _, editor := range vscodeEditors {
-		filepath.Join(homeDir, ".vscode/extensions"),
+		pattern := filepath.Join(editor.extensionsDir(homeDir), "danklinux.dms-theme-*")
-		filepath.Join(homeDir, ".vscode-oss/extensions"),
-		filepath.Join(homeDir, ".config/Code - OSS/extensions"),
-		filepath.Join(homeDir, ".cursor/extensions"),
-		filepath.Join(homeDir, ".windsurf/extensions"),
-	}
-
-	for _, extDir := range extDirs {
-		pattern := filepath.Join(extDir, "danklinux.dms-theme-*")
 		if matches, err := filepath.Glob(pattern); err == nil && len(matches) > 0 {
 			return true
 		}

core/internal/plugins/lockfile.go

@@ -0,0 +1,197 @@
+package plugins
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/spf13/afero"
+)
+
+const pluginLockfileVersion = 1
+
+var gitCommitPattern = regexp.MustCompile(`^[0-9a-fA-F]{40}$`)
+
+var scpLikeRepoPattern = regexp.MustCompile(`^[^@:/\s]+@[^@:/\s]+:\S+$`)
+
+type PluginLockfile struct {
+	LockfileVersion int                     `json:"lockfileVersion"`
+	Plugins         map[string]LockedPlugin `json:"plugins"`
+}
+
+type LockedPlugin struct {
+	Repo   string `json:"repo"`
+	Path   string `json:"path,omitempty"`
+	Commit string `json:"commit"`
+}
+
+type LockStore struct {
+	fs   afero.Fs
+	path string
+}
+
+func NewLockStore(fs afero.Fs, path string) *LockStore {
+	return &LockStore{fs: fs, path: path}
+}
+
+func NewPluginLockfile() PluginLockfile {
+	return PluginLockfile{
+		LockfileVersion: pluginLockfileVersion,
+		Plugins:         make(map[string]LockedPlugin),
+	}
+}
+
+func (s *LockStore) Path() string {
+	return s.path
+}
+
+func (s *LockStore) Exists() (bool, error) {
+	return afero.Exists(s.fs, s.path)
+}
+
+func (s *LockStore) Load() (PluginLockfile, error) {
+	data, err := afero.ReadFile(s.fs, s.path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return NewPluginLockfile(), nil
+		}
+		return PluginLockfile{}, fmt.Errorf("failed to read plugin lockfile: %w", err)
+	}
+
+	return ParsePluginLockfile(data)
+}
+
+func ParsePluginLockfile(data []byte) (PluginLockfile, error) {
+	var lock PluginLockfile
+	if err := json.Unmarshal(data, &lock); err != nil {
+		return PluginLockfile{}, fmt.Errorf("failed to parse plugin lockfile: %w", err)
+	}
+	if lock.Plugins == nil {
+		lock.Plugins = make(map[string]LockedPlugin)
+	}
+	if err := lock.Validate(); err != nil {
+		return PluginLockfile{}, err
+	}
+	return lock, nil
+}
+
+func (s *LockStore) Write(lock PluginLockfile) error {
+	if err := lock.Validate(); err != nil {
+		return err
+	}
+
+	data, err := json.MarshalIndent(lock, "", "  ")
+	if err != nil {
+		return fmt.Errorf("failed to encode plugin lockfile: %w", err)
+	}
+	data = append(data, '\n')
+
+	if err := s.fs.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {
+		return fmt.Errorf("failed to create plugin lockfile directory: %w", err)
+	}
+
+	tmpPath := s.path + ".tmp"
+	if err := afero.WriteFile(s.fs, tmpPath, data, 0o644); err != nil {
+		return fmt.Errorf("failed to write temporary plugin lockfile: %w", err)
+	}
+	defer s.fs.Remove(tmpPath) //nolint:errcheck
+
+	if err := s.fs.Rename(tmpPath, s.path); err != nil {
+		return fmt.Errorf("failed to replace plugin lockfile: %w", err)
+	}
+	return nil
+}
+
+func (lock PluginLockfile) Validate() error {
+	if lock.LockfileVersion != pluginLockfileVersion {
+		return fmt.Errorf("unsupported plugin lockfile version %d (expected %d)", lock.LockfileVersion, pluginLockfileVersion)
+	}
+
+	repoCommits := make(map[string]string)
+	for id, plugin := range lock.Plugins {
+		if !isSafePluginPathComponent(id) {
+			return fmt.Errorf("invalid locked plugin id: %q", id)
+		}
+		if strings.TrimSpace(plugin.Repo) == "" {
+			return fmt.Errorf("locked plugin %q has no repository", id)
+		}
+		if err := validatePluginRepo(plugin.Repo); err != nil {
+			return fmt.Errorf("locked plugin %q: %w", id, err)
+		}
+		if !gitCommitPattern.MatchString(plugin.Commit) {
+			return fmt.Errorf("locked plugin %q has invalid commit %q", id, plugin.Commit)
+		}
+		if err := validatePluginRepoPath(plugin.Path); err != nil {
+			return fmt.Errorf("locked plugin %q: %w", id, err)
+		}
+		if commit, ok := repoCommits[plugin.Repo]; ok && !strings.EqualFold(commit, plugin.Commit) {
+			return fmt.Errorf("plugins from repository %q must use the same commit", plugin.Repo)
+		}
+		repoCommits[plugin.Repo] = plugin.Commit
+	}
+	return nil
+}
+
+func validatePluginRepo(repo string) error {
+	parsed, err := url.Parse(repo)
+	if err != nil {
+		if scpLikeRepoPattern.MatchString(repo) {
+			return nil
+		}
+		return fmt.Errorf("invalid repository URL %q", repo)
+	}
+	if parsed.User == nil {
+		return nil
+	}
+	if _, hasPassword := parsed.User.Password(); hasPassword {
+		return fmt.Errorf("repository URL must not contain credentials")
+	}
+	switch parsed.Scheme {
+	case "http", "https":
+		return fmt.Errorf("repository URL must not contain credentials")
+	}
+	return nil
+}
+
+func validatePluginRepoPath(path string) error {
+	if path == "" {
+		return nil
+	}
+	clean := filepath.Clean(path)
+	if filepath.IsAbs(clean) || clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
+		return fmt.Errorf("invalid repository path %q", path)
+	}
+	return nil
+}
+
+func (lock PluginLockfile) IDs() []string {
+	ids := make([]string, 0, len(lock.Plugins))
+	for id := range lock.Plugins {
+		ids = append(ids, id)
+	}
+	sort.Strings(ids)
+	return ids
+}
+
+func (lock *PluginLockfile) SetRepositoryCommit(repo, commit string) {
+	for id, plugin := range lock.Plugins {
+		if plugin.Repo != repo {
+			continue
+		}
+		plugin.Commit = commit
+		lock.Plugins[id] = plugin
+	}
+}
+
+func (lock PluginLockfile) Clone() PluginLockfile {
+	cloned := NewPluginLockfile()
+	for id, plugin := range lock.Plugins {
+		cloned.Plugins[id] = plugin
+	}
+	return cloned
+}

core/internal/plugins/lockfile_test.go

@@ -0,0 +1,111 @@
+package plugins
+
+import (
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const testCommit = "0123456789abcdef0123456789abcdef01234567"
+
+func TestPluginLockfileRoundTrip(t *testing.T) {
+	fs := afero.NewMemMapFs()
+	store := NewLockStore(fs, "/config/plugins.lock.json")
+	lock := NewPluginLockfile()
+	lock.Plugins["weather"] = LockedPlugin{
+		Repo:   "https://github.com/example/plugins.git",
+		Path:   "plugins/weather",
+		Commit: testCommit,
+	}
+
+	require.NoError(t, store.Write(lock))
+	loaded, err := store.Load()
+	require.NoError(t, err)
+	assert.Equal(t, lock, loaded)
+
+	data, err := afero.ReadFile(fs, store.Path())
+	require.NoError(t, err)
+	assert.Equal(t, "{\n  \"lockfileVersion\": 1,\n  \"plugins\": {\n    \"weather\": {\n      \"repo\": \"https://github.com/example/plugins.git\",\n      \"path\": \"plugins/weather\",\n      \"commit\": \"0123456789abcdef0123456789abcdef01234567\"\n    }\n  }\n}\n", string(data))
+}
+
+func TestPluginLockfileValidation(t *testing.T) {
+	tests := []struct {
+		name string
+		lock PluginLockfile
+		want string
+	}{
+		{
+			name: "rejects unsupported version",
+			lock: PluginLockfile{LockfileVersion: 2, Plugins: map[string]LockedPlugin{}},
+			want: "unsupported plugin lockfile version",
+		},
+		{
+			name: "rejects unsafe id",
+			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{"../bad": {Repo: "repo", Commit: testCommit}}},
+			want: "invalid locked plugin id",
+		},
+		{
+			name: "rejects unsafe repository path",
+			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{"bad": {Repo: "repo", Path: "../bad", Commit: testCommit}}},
+			want: "invalid repository path",
+		},
+		{
+			name: "rejects abbreviated commit",
+			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{"bad": {Repo: "repo", Commit: "abc123"}}},
+			want: "invalid commit",
+		},
+		{
+			name: "rejects repository credentials",
+			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{"bad": {Repo: "https://token@example.com/plugin.git", Commit: testCommit}}},
+			want: "must not contain credentials",
+		},
+		{
+			name: "rejects ssh password",
+			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{"bad": {Repo: "ssh://git:secret@example.com/plugin.git", Commit: testCommit}}},
+			want: "must not contain credentials",
+		},
+		{
+			name: "rejects conflicting monorepo commits",
+			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{
+				"one": {Repo: "repo", Commit: testCommit},
+				"two": {Repo: "repo", Commit: "1123456789abcdef0123456789abcdef01234567"},
+			}},
+			want: "must use the same commit",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.lock.Validate()
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), tt.want)
+		})
+	}
+}
+
+func TestPluginLockfileAcceptsSSHRemotes(t *testing.T) {
+	repos := []string{
+		"https://github.com/user/plugin.git",
+		"ssh://git@github.com/user/plugin.git",
+		"git@github.com:user/plugin.git",
+	}
+
+	for _, repo := range repos {
+		t.Run(repo, func(t *testing.T) {
+			lock := PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{
+				"plugin": {Repo: repo, Commit: testCommit},
+			}}
+			assert.NoError(t, lock.Validate())
+		})
+	}
+}
+
+func TestMissingPluginLockfileIsEmpty(t *testing.T) {
+	store := NewLockStore(afero.NewMemMapFs(), "/config/plugins.lock.json")
+	lock, err := store.Load()
+	require.NoError(t, err)
+	assert.Equal(t, pluginLockfileVersion, lock.LockfileVersion)
+	assert.Empty(t, lock.Plugins)
+}

core/internal/plugins/manager.go

@@ -16,6 +16,7 @@ import (
 type Manager struct {
 	fs         afero.Fs
 	pluginsDir string
+	lockPath   string
 	gitClient  GitClient
 }
 
@@ -28,6 +29,7 @@ func NewManagerWithFs(fs afero.Fs) (*Manager, error) {
 	return &Manager{
 		fs:         fs,
 		pluginsDir: pluginsDir,
+		lockPath:   getPluginLockPath(),
 		gitClient:  &realGitClient{},
 	}, nil
 }
@@ -41,6 +43,15 @@ func getPluginsDir() string {
 	return filepath.Join(configDir, "DankMaterialShell", "plugins")
 }
 
+func getPluginLockPath() string {
+	configDir, err := os.UserConfigDir()
+	if err != nil {
+		log.Error("failed to get user config dir", "err", err)
+		return ""
+	}
+	return filepath.Join(configDir, "DankMaterialShell", "plugins.lock.json")
+}
+
 func (m *Manager) IsInstalled(plugin Plugin) (bool, error) {
 	path, err := m.findInstalledPath(plugin.ID)
 	if err != nil {
@@ -118,7 +129,12 @@ func (m *Manager) findInDir(dir, pluginID string) (string, error) {
 }
 
 func (m *Manager) Install(plugin Plugin) error {
+	if !isSafePluginPathComponent(plugin.ID) {
+		return fmt.Errorf("invalid plugin id: %q", plugin.ID)
+	}
+
 	pluginPath := filepath.Join(m.pluginsDir, plugin.ID)
+	repoPath := pluginPath
 
 	exists, err := afero.DirExists(m.fs, pluginPath)
 	if err != nil {
@@ -128,6 +144,18 @@ func (m *Manager) Install(plugin Plugin) error {
 	if exists {
 		return fmt.Errorf("plugin already installed: %s", plugin.Name)
 	}
+	if strings.TrimSpace(plugin.Repo) == "" {
+		return fmt.Errorf("plugin repository is required")
+	}
+	if err := validatePluginRepo(plugin.Repo); err != nil {
+		return err
+	}
+	if err := validatePluginRepoPath(plugin.Path); err != nil {
+		return err
+	}
+	if _, err := m.ensureLockfile(); err != nil {
+		return err
+	}
 
 	if err := m.fs.MkdirAll(m.pluginsDir, 0o755); err != nil {
 		return fmt.Errorf("failed to create plugins directory: %w", err)
@@ -140,7 +168,7 @@ func (m *Manager) Install(plugin Plugin) error {
 
 	if plugin.Path != "" {
 		repoName := m.getRepoName(plugin.Repo)
-		repoPath := filepath.Join(reposDir, repoName)
+		repoPath = filepath.Join(reposDir, repoName)
 
 		repoExists, err := afero.DirExists(m.fs, repoPath)
 		if err != nil {
@@ -178,12 +206,13 @@ func (m *Manager) Install(plugin Plugin) error {
 		if err := m.createSymlink(sourcePath, pluginPath); err != nil {
 			return fmt.Errorf("failed to create symlink: %w", err)
 		}
-
 		metaPath := pluginPath + ".meta"
 		metaContent := fmt.Sprintf("repo=%s\npath=%s\nrepodir=%s", plugin.Repo, plugin.Path, repoName)
 		if err := afero.WriteFile(m.fs, metaPath, []byte(metaContent), 0o644); err != nil {
-			return fmt.Errorf("failed to write metadata: %w", err)
+			m.fs.Remove(pluginPath) //nolint:errcheck
+			return fmt.Errorf("failed to write plugin repository metadata: %w", err)
 		}
+
 	} else {
 		if err := m.gitClient.PlainClone(pluginPath, plugin.Repo); err != nil {
 			m.fs.RemoveAll(pluginPath) //nolint:errcheck
@@ -191,6 +220,16 @@ func (m *Manager) Install(plugin Plugin) error {
 		}
 	}
 
+	if err := m.recordInstalledPlugin(plugin, repoPath); err != nil {
+		if plugin.Path != "" {
+			m.fs.Remove(pluginPath)           //nolint:errcheck
+			m.fs.Remove(pluginPath + ".meta") //nolint:errcheck
+		} else {
+			m.fs.RemoveAll(pluginPath) //nolint:errcheck
+		}
+		return fmt.Errorf("failed to update plugin lockfile: %w", err)
+	}
+
 	return nil
 }
 
@@ -207,6 +246,15 @@ func (m *Manager) createSymlink(source, dest string) error {
 }
 
 func (m *Manager) Update(plugin Plugin) error {
+	lock, err := m.ensureLockfile()
+	if err != nil {
+		return err
+	}
+	if locked, ok := lock.Plugins[plugin.ID]; ok {
+		plugin.Repo = locked.Repo
+		plugin.Path = locked.Path
+	}
+
 	pluginPath, err := m.findInstalledPath(plugin.ID)
 	if err != nil {
 		return fmt.Errorf("failed to find plugin: %w", err)
@@ -219,46 +267,42 @@ func (m *Manager) Update(plugin Plugin) error {
 	if strings.HasPrefix(pluginPath, "/etc/xdg/quickshell/dms-plugins") {
 		return fmt.Errorf("cannot update system plugin: %s", plugin.Name)
 	}
-
+	if plugin.Repo == "" {
-	metaPath := pluginPath + ".meta"
+		plugin.Repo, err = m.gitClient.OriginURL(pluginPath)
-	metaExists, err := afero.Exists(m.fs, metaPath)
 		if err != nil {
-		return fmt.Errorf("failed to check metadata: %w", err)
+			return fmt.Errorf("failed to read plugin origin: %w", err)
+		}
 	}
 
-	if metaExists {
+	repoPath := m.repositoryPath(plugin.ID, LockedPlugin{Repo: plugin.Repo, Path: plugin.Path})
-		reposDir := filepath.Join(m.pluginsDir, ".repos")
-		repoName := m.getRepoName(plugin.Repo)
-		repoPath := filepath.Join(reposDir, repoName)
-
-		// Try to pull, if it fails (e.g., shallow clone corruption), delete and re-clone
 	if err := m.gitClient.Pull(repoPath); err != nil {
-			// Repository is likely corrupted or has issues, delete and re-clone
 		if err := m.fs.RemoveAll(repoPath); err != nil {
-				return fmt.Errorf("failed to remove corrupted repository: %w", err)
+			return fmt.Errorf("failed to remove corrupted plugin repository: %w", err)
 		}
-
 		if err := m.gitClient.PlainClone(repoPath, plugin.Repo); err != nil {
-				return fmt.Errorf("failed to re-clone repository: %w", err)
+			return fmt.Errorf("failed to re-clone plugin repository: %w", err)
-			}
-		}
-	} else {
-		// Try to pull, if it fails, delete and re-clone
-		if err := m.gitClient.Pull(pluginPath); err != nil {
-			if err := m.fs.RemoveAll(pluginPath); err != nil {
-				return fmt.Errorf("failed to remove corrupted plugin: %w", err)
-			}
-
-			if err := m.gitClient.PlainClone(pluginPath, plugin.Repo); err != nil {
-				return fmt.Errorf("failed to re-clone plugin: %w", err)
-			}
 		}
 	}
 
+	if err := m.recordInstalledPlugin(plugin, repoPath); err != nil {
+		if locked, ok := lock.Plugins[plugin.ID]; ok {
+			m.gitClient.CheckoutRevision(repoPath, locked.Commit) //nolint:errcheck
+		}
+		return err
+	}
 	return nil
 }
 
 func (m *Manager) Uninstall(plugin Plugin) error {
+	lock, err := m.ensureLockfile()
+	if err != nil {
+		return err
+	}
+	if locked, ok := lock.Plugins[plugin.ID]; ok {
+		plugin.Repo = locked.Repo
+		plugin.Path = locked.Path
+	}
+
 	pluginPath, err := m.findInstalledPath(plugin.ID)
 	if err != nil {
 		return fmt.Errorf("failed to find plugin: %w", err)
@@ -271,72 +315,66 @@ func (m *Manager) Uninstall(plugin Plugin) error {
 	if strings.HasPrefix(pluginPath, "/etc/xdg/quickshell/dms-plugins") {
 		return fmt.Errorf("cannot uninstall system plugin: %s", plugin.Name)
 	}
-
+	updatedLock := lock.Clone()
-	metaPath := pluginPath + ".meta"
+	delete(updatedLock.Plugins, plugin.ID)
-	metaExists, err := afero.Exists(m.fs, metaPath)
+	if err := m.lockStore().Write(updatedLock); err != nil {
-	if err != nil {
+		return err
-		return fmt.Errorf("failed to check metadata: %w", err)
+	}
+	rollbackLock := func(err error) error {
+		if rollbackErr := m.lockStore().Write(lock); rollbackErr != nil {
+			return fmt.Errorf("%w (also failed to restore plugin lockfile: %v)", err, rollbackErr)
+		}
+		return err
 	}
 
-	if metaExists {
+	metaPath := pluginPath + ".meta"
+	if plugin.Path != "" {
 		reposDir := filepath.Join(m.pluginsDir, ".repos")
 		repoName := m.getRepoName(plugin.Repo)
 		repoPath := filepath.Join(reposDir, repoName)
 
-		shouldCleanup, err := m.shouldCleanupRepo(repoPath, plugin.Repo, plugin.ID)
+		shouldCleanup, err := m.shouldCleanupRepo(plugin.Repo, plugin.ID)
 		if err != nil {
-			return fmt.Errorf("failed to check repo cleanup: %w", err)
+			return rollbackLock(fmt.Errorf("failed to check repo cleanup: %w", err))
 		}
 
 		if err := m.fs.Remove(pluginPath); err != nil {
-			return fmt.Errorf("failed to remove symlink: %w", err)
+			return rollbackLock(fmt.Errorf("failed to remove symlink: %w", err))
 		}
 
+		if metaExists, _ := afero.Exists(m.fs, metaPath); metaExists {
 			if err := m.fs.Remove(metaPath); err != nil {
-			return fmt.Errorf("failed to remove metadata: %w", err)
+				return rollbackLock(fmt.Errorf("failed to remove metadata: %w", err))
+			}
 		}
 
 		if shouldCleanup {
 			if err := m.fs.RemoveAll(repoPath); err != nil {
-				return fmt.Errorf("failed to cleanup repository: %w", err)
+				return rollbackLock(fmt.Errorf("failed to cleanup repository: %w", err))
 			}
 		}
 	} else {
 		if err := m.fs.RemoveAll(pluginPath); err != nil {
-			return fmt.Errorf("failed to remove plugin: %w", err)
+			return rollbackLock(fmt.Errorf("failed to remove plugin: %w", err))
 		}
 	}
 
 	return nil
 }
 
-func (m *Manager) shouldCleanupRepo(repoPath, repoURL, excludePlugin string) (bool, error) {
+func (m *Manager) shouldCleanupRepo(repoURL, excludePlugin string) (bool, error) {
-	installed, err := m.ListInstalled()
+	lock, err := m.ensureLockfile()
 	if err != nil {
 		return false, err
 	}
-
+	for id, plugin := range lock.Plugins {
-	registry, err := NewRegistry()
-	if err != nil {
-		return false, err
-	}
-
-	allPlugins, err := registry.List()
-	if err != nil {
-		return false, err
-	}
-
-	for _, id := range installed {
 		if id == excludePlugin {
 			continue
 		}
-
+		if plugin.Repo == repoURL && plugin.Path != "" {
-		for _, p := range allPlugins {
-			if p.ID == id && p.Repo == repoURL && p.Path != "" {
 			return false, nil
 		}
 	}
-	}
 
 	return true, nil
 }
@@ -456,6 +494,16 @@ func (m *Manager) UninstallByIDOrName(idOrName string) error {
 	if strings.HasPrefix(pluginPath, "/etc/xdg/quickshell/dms-plugins") {
 		return fmt.Errorf("cannot uninstall system plugin: %s", idOrName)
 	}
+	manifest := m.getPluginManifest(pluginPath)
+	if manifest != nil {
+		lock, err := m.ensureLockfile()
+		if err != nil {
+			return err
+		}
+		if locked, ok := lock.Plugins[manifest.ID]; ok {
+			return m.Uninstall(Plugin{ID: manifest.ID, Name: manifest.Name, Repo: locked.Repo, Path: locked.Path})
+		}
+	}
 
 	metaPath := pluginPath + ".meta"
 	metaExists, _ := afero.Exists(m.fs, metaPath)
@@ -488,6 +536,16 @@ func (m *Manager) UpdateByIDOrName(idOrName string) error {
 	if strings.HasPrefix(pluginPath, "/etc/xdg/quickshell/dms-plugins") {
 		return fmt.Errorf("cannot update system plugin: %s", idOrName)
 	}
+	manifest := m.getPluginManifest(pluginPath)
+	if manifest != nil {
+		lock, err := m.ensureLockfile()
+		if err != nil {
+			return err
+		}
+		if locked, ok := lock.Plugins[manifest.ID]; ok {
+			return m.Update(Plugin{ID: manifest.ID, Name: manifest.Name, Repo: locked.Repo, Path: locked.Path})
+		}
+	}
 
 	metaPath := pluginPath + ".meta"
 	metaExists, _ := afero.Exists(m.fs, metaPath)
@@ -502,9 +560,15 @@ func (m *Manager) UpdateByIDOrName(idOrName string) error {
 	if err := m.gitClient.Pull(pluginPath); err != nil {
 		return fmt.Errorf("failed to update plugin: %w", err)
 	}
-
+	if manifest == nil {
 		return nil
 	}
+	repo, err := m.gitClient.OriginURL(pluginPath)
+	if err != nil {
+		return fmt.Errorf("failed to read plugin origin: %w", err)
+	}
+	return m.recordInstalledPlugin(Plugin{ID: manifest.ID, Name: manifest.Name, Repo: repo}, pluginPath)
+}
 
 func (m *Manager) findInstalledPathByIDOrName(idOrName string) (string, error) {
 	path, err := m.findInDirByIDOrName(m.pluginsDir, idOrName)
@@ -572,6 +636,15 @@ func (m *Manager) findInDirByIDOrName(dir, idOrName string) (string, error) {
 }
 
 func (m *Manager) HasUpdates(pluginID string, plugin Plugin) (hasUpdates bool, diffURL string, err error) {
+	lock, err := m.ensureLockfile()
+	if err != nil {
+		return false, "", err
+	}
+	if locked, ok := lock.Plugins[pluginID]; ok {
+		plugin.Repo = locked.Repo
+		plugin.Path = locked.Path
+	}
+
 	pluginPath, err := m.findInstalledPath(pluginID)
 	if err != nil {
 		return false, "", fmt.Errorf("failed to find plugin: %w", err)
@@ -585,25 +658,11 @@ func (m *Manager) HasUpdates(pluginID string, plugin Plugin) (hasUpdates bool, d
 		return false, "", nil
 	}
 
-	metaPath := pluginPath + ".meta"
+	repoPath := pluginPath
-	metaExists, err := afero.Exists(m.fs, metaPath)
+	if plugin.Path != "" {
-	if err != nil {
+		repoPath = m.repositoryPath(pluginID, LockedPlugin{Repo: plugin.Repo, Path: plugin.Path})
-		return false, "", fmt.Errorf("failed to check metadata: %w", err)
-	}
-
-	var hasUp bool
-	var localHash, remoteHash string
-	if metaExists {
-		// Plugin is from a monorepo, check the repo directory
-		reposDir := filepath.Join(m.pluginsDir, ".repos")
-		repoName := m.getRepoName(plugin.Repo)
-		repoPath := filepath.Join(reposDir, repoName)
-
-		hasUp, localHash, remoteHash, err = m.gitClient.HasUpdates(repoPath)
-	} else {
-		// Plugin is a standalone repo
-		hasUp, localHash, remoteHash, err = m.gitClient.HasUpdates(pluginPath)
 	}
+	hasUp, localHash, remoteHash, err := m.gitClient.HasUpdates(repoPath)
 
 	if err != nil {
 		return false, "", err

core/internal/plugins/manager_lockfile.go

@@ -0,0 +1,299 @@
+package plugins
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"github.com/spf13/afero"
+)
+
+func (m *Manager) lockStore() *LockStore {
+	lockPath := m.lockPath
+	if lockPath == "" {
+		lockPath = filepath.Join(filepath.Dir(m.pluginsDir), "plugins.lock.json")
+	}
+	return NewLockStore(m.fs, lockPath)
+}
+
+func (m *Manager) GetLockfilePath() string {
+	return m.lockStore().Path()
+}
+
+func (m *Manager) ensureLockfile() (PluginLockfile, error) {
+	store := m.lockStore()
+	exists, err := store.Exists()
+	if err != nil {
+		return PluginLockfile{}, fmt.Errorf("failed to check plugin lockfile: %w", err)
+	}
+	if exists {
+		return store.Load()
+	}
+
+	lock, _, err := m.SnapshotLockfile()
+	if err != nil {
+		return PluginLockfile{}, err
+	}
+	if err := store.Write(lock); err != nil {
+		return PluginLockfile{}, err
+	}
+	return lock, nil
+}
+
+func (m *Manager) SnapshotLockfile() (PluginLockfile, []string, error) {
+	lock := NewPluginLockfile()
+	warnings := []string{}
+
+	exists, err := afero.DirExists(m.fs, m.pluginsDir)
+	if err != nil {
+		return PluginLockfile{}, nil, fmt.Errorf("failed to check plugins directory: %w", err)
+	}
+	if !exists {
+		return lock, warnings, nil
+	}
+
+	entries, err := afero.ReadDir(m.fs, m.pluginsDir)
+	if err != nil {
+		return PluginLockfile{}, nil, fmt.Errorf("failed to read plugins directory: %w", err)
+	}
+
+	for _, entry := range entries {
+		name := entry.Name()
+		if name == ".repos" || strings.HasSuffix(name, ".meta") {
+			continue
+		}
+
+		pluginPath := filepath.Join(m.pluginsDir, name)
+		manifest := m.getPluginManifest(pluginPath)
+		if manifest == nil || manifest.ID == "" {
+			continue
+		}
+
+		locked, repoPath, err := m.lockedPluginFromInstall(pluginPath)
+		if err != nil {
+			warnings = append(warnings, fmt.Sprintf("%s: %v", manifest.ID, err))
+			continue
+		}
+		commit, err := m.gitClient.CurrentRevision(repoPath)
+		if err != nil {
+			warnings = append(warnings, fmt.Sprintf("%s: cannot read git revision: %v", manifest.ID, err))
+			continue
+		}
+		locked.Commit = commit
+		lock.SetRepositoryCommit(locked.Repo, commit)
+		lock.Plugins[manifest.ID] = locked
+	}
+
+	if err := lock.Validate(); err != nil {
+		return PluginLockfile{}, warnings, err
+	}
+	return lock, warnings, nil
+}
+
+func (m *Manager) lockedPluginFromInstall(pluginPath string) (LockedPlugin, string, error) {
+	metaPath := pluginPath + ".meta"
+	if metaExists, _ := afero.Exists(m.fs, metaPath); metaExists {
+		data, err := afero.ReadFile(m.fs, metaPath)
+		if err != nil {
+			return LockedPlugin{}, "", fmt.Errorf("failed to read legacy metadata: %w", err)
+		}
+		metadata := parseLegacyPluginMetadata(string(data))
+		repo := metadata["repo"]
+		path := metadata["path"]
+		repoDir := metadata["repodir"]
+		if repo == "" || repoDir == "" {
+			return LockedPlugin{}, "", fmt.Errorf("legacy metadata is incomplete")
+		}
+		if err := validatePluginRepo(repo); err != nil {
+			return LockedPlugin{}, "", err
+		}
+		if !isSafePluginPathComponent(repoDir) {
+			return LockedPlugin{}, "", fmt.Errorf("legacy repository directory is invalid")
+		}
+		if err := validatePluginRepoPath(path); err != nil {
+			return LockedPlugin{}, "", err
+		}
+		return LockedPlugin{Repo: repo, Path: path}, filepath.Join(m.pluginsDir, ".repos", repoDir), nil
+	}
+
+	repo, err := m.gitClient.OriginURL(pluginPath)
+	if err != nil {
+		return LockedPlugin{}, "", fmt.Errorf("plugin is not a managed git checkout")
+	}
+	if err := validatePluginRepo(repo); err != nil {
+		return LockedPlugin{}, "", err
+	}
+	return LockedPlugin{Repo: repo}, pluginPath, nil
+}
+
+func parseLegacyPluginMetadata(data string) map[string]string {
+	metadata := make(map[string]string)
+	for _, line := range strings.Split(data, "\n") {
+		key, value, ok := strings.Cut(line, "=")
+		if ok {
+			metadata[strings.TrimSpace(key)] = strings.TrimSpace(value)
+		}
+	}
+	return metadata
+}
+
+func (m *Manager) recordInstalledPlugin(plugin Plugin, repoPath string) error {
+	lock, err := m.ensureLockfile()
+	if err != nil {
+		return err
+	}
+	commit, err := m.gitClient.CurrentRevision(repoPath)
+	if err != nil {
+		return fmt.Errorf("failed to read installed plugin revision: %w", err)
+	}
+
+	lock.SetRepositoryCommit(plugin.Repo, commit)
+	lock.Plugins[plugin.ID] = LockedPlugin{
+		Repo:   plugin.Repo,
+		Path:   plugin.Path,
+		Commit: commit,
+	}
+	return m.lockStore().Write(lock)
+}
+
+func (m *Manager) WriteCurrentLockfile(outputPath string) ([]string, error) {
+	lock, warnings, err := m.SnapshotLockfile()
+	if err != nil {
+		return warnings, err
+	}
+	if err := m.lockStore().Write(lock); err != nil {
+		return warnings, err
+	}
+	if outputPath != "" && outputPath != m.GetLockfilePath() {
+		if err := NewLockStore(m.fs, outputPath).Write(lock); err != nil {
+			return warnings, err
+		}
+	}
+	return warnings, nil
+}
+
+func (m *Manager) RestoreFromLockfile(sourcePath string, prune bool) error {
+	if sourcePath == "" {
+		sourcePath = m.GetLockfilePath()
+	}
+	sourceStore := NewLockStore(m.fs, sourcePath)
+	exists, err := sourceStore.Exists()
+	if err != nil {
+		return fmt.Errorf("failed to check plugin lockfile: %w", err)
+	}
+	if !exists {
+		return fmt.Errorf("plugin lockfile not found: %s", sourcePath)
+	}
+	target, err := sourceStore.Load()
+	if err != nil {
+		return err
+	}
+	current, err := m.ensureLockfile()
+	if err != nil {
+		return err
+	}
+
+	for _, id := range target.IDs() {
+		wanted := target.Plugins[id]
+		installedPath, err := m.findInstalledPath(id)
+		if err != nil {
+			return err
+		}
+
+		if installedPath != "" {
+			existing, managed := current.Plugins[id]
+			if !managed {
+				return fmt.Errorf("plugin %q is already installed but is not managed by the lockfile", id)
+			}
+			if existing.Repo != wanted.Repo || existing.Path != wanted.Path {
+				if err := m.UninstallByIDOrName(id); err != nil {
+					return err
+				}
+				installedPath = ""
+			}
+		}
+
+		plugin := Plugin{ID: id, Name: id, Repo: wanted.Repo, Path: wanted.Path}
+		newlyInstalled := installedPath == ""
+		if installedPath == "" {
+			if err := m.Install(plugin); err != nil {
+				return fmt.Errorf("failed to restore plugin %q: %w", id, err)
+			}
+		}
+
+		repoPath := m.repositoryPath(id, wanted)
+		previousCommit, err := m.gitClient.CurrentRevision(repoPath)
+		if err != nil {
+			if newlyInstalled {
+				m.UninstallByIDOrName(id) //nolint:errcheck
+			}
+			return fmt.Errorf("failed to read current revision for plugin %q: %w", id, err)
+		}
+		if err := m.gitClient.CheckoutRevision(repoPath, wanted.Commit); err != nil {
+			if newlyInstalled {
+				if rollbackErr := m.UninstallByIDOrName(id); rollbackErr != nil {
+					return fmt.Errorf("failed to restore plugin %q at %s: %w (also failed to remove the partial install: %v)", id, wanted.Commit, err, rollbackErr)
+				}
+			}
+			return fmt.Errorf("failed to restore plugin %q at %s: %w", id, wanted.Commit, err)
+		}
+		rollback := func(restoreErr error) error {
+			if newlyInstalled {
+				if rollbackErr := m.UninstallByIDOrName(id); rollbackErr != nil {
+					return fmt.Errorf("%w (also failed to remove the partial install: %v)", restoreErr, rollbackErr)
+				}
+				return restoreErr
+			}
+			if rollbackErr := m.gitClient.CheckoutRevision(repoPath, previousCommit); rollbackErr != nil {
+				return fmt.Errorf("%w (also failed to restore revision %s: %v)", restoreErr, previousCommit, rollbackErr)
+			}
+			return restoreErr
+		}
+		pluginPath := installedPath
+		if pluginPath == "" {
+			pluginPath = filepath.Join(m.pluginsDir, id)
+		}
+		if actualID := m.getPluginID(pluginPath); actualID != id {
+			return rollback(fmt.Errorf("restored plugin %q has manifest id %q", id, actualID))
+		}
+		if err := m.recordInstalledPlugin(plugin, repoPath); err != nil {
+			return rollback(err)
+		}
+		current, err = m.lockStore().Load()
+		if err != nil {
+			return err
+		}
+	}
+
+	if prune {
+		for _, id := range current.IDs() {
+			if _, wanted := target.Plugins[id]; wanted {
+				continue
+			}
+			if err := m.UninstallByIDOrName(id); err != nil {
+				return fmt.Errorf("failed to prune plugin %q: %w", id, err)
+			}
+		}
+		return m.lockStore().Write(target)
+	}
+
+	merged, err := m.lockStore().Load()
+	if err != nil {
+		return err
+	}
+	for id, plugin := range target.Plugins {
+		merged.SetRepositoryCommit(plugin.Repo, plugin.Commit)
+		merged.Plugins[id] = plugin
+	}
+	return m.lockStore().Write(merged)
+}
+
+func (m *Manager) repositoryPath(pluginID string, plugin LockedPlugin) string {
+	if plugin.Path != "" {
+		return filepath.Join(m.pluginsDir, ".repos", m.getRepoName(plugin.Repo))
+	}
+	if installedPath, err := m.findInDir(m.pluginsDir, pluginID); err == nil && installedPath != "" {
+		return installedPath
+	}
+	return filepath.Join(m.pluginsDir, pluginID)
+}

core/internal/plugins/manager_test.go

@@ -1,6 +1,7 @@
 package plugins
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"testing"
@@ -16,6 +17,7 @@ func setupTestManager(t *testing.T) (*Manager, afero.Fs, string) {
 	manager := &Manager{
 		fs:         fs,
 		pluginsDir: pluginsDir,
+		lockPath:   "/config/plugins.lock.json",
 		gitClient:  &mockGitClient{},
 	}
 	return manager, fs, pluginsDir
@@ -245,3 +247,244 @@ func TestManagerGetPluginsDir(t *testing.T) {
 	manager, _, pluginsDir := setupTestManager(t)
 	assert.Equal(t, pluginsDir, manager.GetPluginsDir())
 }
+
+func TestInstallUpdatesLockfile(t *testing.T) {
+	manager, fs, pluginsDir := setupTestManager(t)
+	plugin := Plugin{ID: "test-plugin", Name: "Test Plugin", Repo: "https://github.com/test/plugin.git"}
+	manager.gitClient = &mockGitClient{
+		cloneFunc: func(path, _ string) error {
+			require.NoError(t, fs.MkdirAll(path, 0o755))
+			return afero.WriteFile(fs, filepath.Join(path, "plugin.json"), []byte(`{"id":"test-plugin"}`), 0o644)
+		},
+		revisionFunc: func(string) (string, error) { return testCommit, nil },
+	}
+
+	require.NoError(t, manager.Install(plugin))
+	lock, err := manager.lockStore().Load()
+	require.NoError(t, err)
+	assert.Equal(t, LockedPlugin{Repo: plugin.Repo, Commit: testCommit}, lock.Plugins[plugin.ID])
+	exists, err := afero.Exists(fs, filepath.Join(pluginsDir, plugin.ID))
+	require.NoError(t, err)
+	assert.True(t, exists)
+}
+
+func TestUpdateRefreshesLockedCommit(t *testing.T) {
+	manager, fs, pluginsDir := setupTestManager(t)
+	plugin := Plugin{ID: "test-plugin", Name: "Test Plugin", Repo: "https://github.com/test/plugin.git"}
+	pluginPath := filepath.Join(pluginsDir, plugin.ID)
+	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
+	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"test-plugin"}`), 0o644))
+	require.NoError(t, manager.lockStore().Write(PluginLockfile{
+		LockfileVersion: 1,
+		Plugins: map[string]LockedPlugin{
+			plugin.ID: {Repo: plugin.Repo, Commit: testCommit},
+		},
+	}))
+	newCommit := "1123456789abcdef0123456789abcdef01234567"
+	manager.gitClient = &mockGitClient{
+		pullFunc:     func(string) error { return nil },
+		revisionFunc: func(string) (string, error) { return newCommit, nil },
+	}
+
+	require.NoError(t, manager.Update(plugin))
+	lock, err := manager.lockStore().Load()
+	require.NoError(t, err)
+	assert.Equal(t, newCommit, lock.Plugins[plugin.ID].Commit)
+}
+
+func TestUpdateResolvesRenamedPluginDirectory(t *testing.T) {
+	manager, fs, pluginsDir := setupTestManager(t)
+	plugin := Plugin{ID: "test-plugin", Name: "Test Plugin", Repo: "https://github.com/test/plugin.git"}
+	pluginPath := filepath.Join(pluginsDir, "renamed-dir")
+	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
+	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"test-plugin"}`), 0o644))
+	require.NoError(t, manager.lockStore().Write(PluginLockfile{
+		LockfileVersion: 1,
+		Plugins: map[string]LockedPlugin{
+			plugin.ID: {Repo: plugin.Repo, Commit: testCommit},
+		},
+	}))
+	var pulledPath string
+	manager.gitClient = &mockGitClient{
+		pullFunc: func(path string) error {
+			pulledPath = path
+			return nil
+		},
+		cloneFunc: func(path, _ string) error {
+			t.Fatalf("unexpected clone to %s", path)
+			return nil
+		},
+		revisionFunc: func(string) (string, error) { return testCommit, nil },
+	}
+
+	require.NoError(t, manager.Update(plugin))
+	assert.Equal(t, pluginPath, pulledPath)
+}
+
+func TestUninstallRemovesLockedPlugin(t *testing.T) {
+	manager, fs, pluginsDir := setupTestManager(t)
+	plugin := Plugin{ID: "test-plugin", Name: "Test Plugin", Repo: "https://github.com/test/plugin.git"}
+	pluginPath := filepath.Join(pluginsDir, plugin.ID)
+	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
+	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"test-plugin"}`), 0o644))
+	require.NoError(t, manager.lockStore().Write(PluginLockfile{
+		LockfileVersion: 1,
+		Plugins: map[string]LockedPlugin{
+			plugin.ID: {Repo: plugin.Repo, Commit: testCommit},
+		},
+	}))
+
+	require.NoError(t, manager.Uninstall(plugin))
+	lock, err := manager.lockStore().Load()
+	require.NoError(t, err)
+	assert.NotContains(t, lock.Plugins, plugin.ID)
+}
+
+func TestRestoreFromLockfileInstallsExactCommit(t *testing.T) {
+	manager, fs, _ := setupTestManager(t)
+	wantedCommit := "2123456789abcdef0123456789abcdef01234567"
+	incoming := PluginLockfile{
+		LockfileVersion: 1,
+		Plugins: map[string]LockedPlugin{
+			"restored": {Repo: "https://github.com/test/restored.git", Commit: wantedCommit},
+		},
+	}
+	require.NoError(t, NewLockStore(fs, "/incoming.lock.json").Write(incoming))
+	currentCommit := testCommit
+	manager.gitClient = &mockGitClient{
+		cloneFunc: func(path, _ string) error {
+			require.NoError(t, fs.MkdirAll(path, 0o755))
+			return afero.WriteFile(fs, filepath.Join(path, "plugin.json"), []byte(`{"id":"restored"}`), 0o644)
+		},
+		revisionFunc: func(string) (string, error) { return currentCommit, nil },
+		checkoutFunc: func(_ string, revision string) error {
+			currentCommit = revision
+			return nil
+		},
+	}
+
+	require.NoError(t, manager.RestoreFromLockfile("/incoming.lock.json", false))
+	lock, err := manager.lockStore().Load()
+	require.NoError(t, err)
+	assert.Equal(t, wantedCommit, lock.Plugins["restored"].Commit)
+}
+
+func TestSnapshotLockfileMigratesLegacyMonorepoMetadata(t *testing.T) {
+	manager, fs, pluginsDir := setupTestManager(t)
+	pluginPath := filepath.Join(pluginsDir, "legacy")
+	repoPath := filepath.Join(pluginsDir, ".repos", "legacy-repo")
+	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
+	require.NoError(t, fs.MkdirAll(repoPath, 0o755))
+	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"legacy"}`), 0o644))
+	require.NoError(t, afero.WriteFile(fs, pluginPath+".meta", []byte("repo=https://github.com/test/suite.git\npath=plugins/legacy\nrepodir=legacy-repo"), 0o644))
+	manager.gitClient = &mockGitClient{
+		revisionFunc: func(path string) (string, error) {
+			assert.Equal(t, repoPath, path)
+			return testCommit, nil
+		},
+	}
+
+	lock, warnings, err := manager.SnapshotLockfile()
+	require.NoError(t, err)
+	assert.Empty(t, warnings)
+	assert.Equal(t, LockedPlugin{
+		Repo:   "https://github.com/test/suite.git",
+		Path:   "plugins/legacy",
+		Commit: testCommit,
+	}, lock.Plugins["legacy"])
+}
+
+func TestRecordInstalledPluginUpdatesSharedRepositoryCommit(t *testing.T) {
+	manager, _, _ := setupTestManager(t)
+	repo := "https://github.com/test/suite.git"
+	require.NoError(t, manager.lockStore().Write(PluginLockfile{
+		LockfileVersion: 1,
+		Plugins: map[string]LockedPlugin{
+			"one": {Repo: repo, Path: "plugins/one", Commit: testCommit},
+			"two": {Repo: repo, Path: "plugins/two", Commit: testCommit},
+		},
+	}))
+	newCommit := "3123456789abcdef0123456789abcdef01234567"
+	manager.gitClient = &mockGitClient{
+		revisionFunc: func(string) (string, error) { return newCommit, nil },
+	}
+
+	require.NoError(t, manager.recordInstalledPlugin(Plugin{ID: "one", Repo: repo, Path: "plugins/one"}, "/repo"))
+	lock, err := manager.lockStore().Load()
+	require.NoError(t, err)
+	assert.Equal(t, newCommit, lock.Plugins["one"].Commit)
+	assert.Equal(t, newCommit, lock.Plugins["two"].Commit)
+}
+
+func TestRestoreFromLockfilePrunesManagedPlugins(t *testing.T) {
+	manager, fs, pluginsDir := setupTestManager(t)
+	pluginPath := filepath.Join(pluginsDir, "old")
+	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
+	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"old","name":"Old"}`), 0o644))
+	require.NoError(t, manager.lockStore().Write(PluginLockfile{
+		LockfileVersion: 1,
+		Plugins: map[string]LockedPlugin{
+			"old": {Repo: "https://github.com/test/old.git", Commit: testCommit},
+		},
+	}))
+	require.NoError(t, NewLockStore(fs, "/empty.lock.json").Write(NewPluginLockfile()))
+
+	require.NoError(t, manager.RestoreFromLockfile("/empty.lock.json", true))
+	exists, err := afero.Exists(fs, pluginPath)
+	require.NoError(t, err)
+	assert.False(t, exists)
+	lock, err := manager.lockStore().Load()
+	require.NoError(t, err)
+	assert.Empty(t, lock.Plugins)
+}
+
+func TestRestoreMissingLockfileDoesNotPrune(t *testing.T) {
+	manager, fs, pluginsDir := setupTestManager(t)
+	pluginPath := filepath.Join(pluginsDir, "kept")
+	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
+	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"kept"}`), 0o644))
+	require.NoError(t, manager.lockStore().Write(PluginLockfile{
+		LockfileVersion: 1,
+		Plugins: map[string]LockedPlugin{
+			"kept": {Repo: "https://github.com/test/kept.git", Commit: testCommit},
+		},
+	}))
+
+	err := manager.RestoreFromLockfile("/missing.lock.json", true)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not found")
+	exists, statErr := afero.Exists(fs, pluginPath)
+	require.NoError(t, statErr)
+	assert.True(t, exists)
+}
+
+func TestRestoreFailedRevisionRemovesPartialInstall(t *testing.T) {
+	manager, fs, pluginsDir := setupTestManager(t)
+	incoming := PluginLockfile{
+		LockfileVersion: 1,
+		Plugins: map[string]LockedPlugin{
+			"broken": {Repo: "https://github.com/test/broken.git", Commit: testCommit},
+		},
+	}
+	require.NoError(t, NewLockStore(fs, "/incoming.lock.json").Write(incoming))
+	manager.gitClient = &mockGitClient{
+		cloneFunc: func(path, _ string) error {
+			require.NoError(t, fs.MkdirAll(path, 0o755))
+			return afero.WriteFile(fs, filepath.Join(path, "plugin.json"), []byte(`{"id":"broken"}`), 0o644)
+		},
+		revisionFunc: func(string) (string, error) { return testCommit, nil },
+		checkoutFunc: func(string, string) error {
+			return errors.New("revision unavailable")
+		},
+	}
+
+	err := manager.RestoreFromLockfile("/incoming.lock.json", false)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "revision unavailable")
+	exists, statErr := afero.Exists(fs, filepath.Join(pluginsDir, "broken"))
+	require.NoError(t, statErr)
+	assert.False(t, exists)
+	lock, loadErr := manager.lockStore().Load()
+	require.NoError(t, loadErr)
+	assert.NotContains(t, lock.Plugins, "broken")
+}

core/internal/plugins/registry.go

@@ -2,17 +2,18 @@ package plugins
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/registries"
 	"github.com/go-git/go-git/v6"
+	"github.com/go-git/go-git/v6/plumbing"
 	"github.com/spf13/afero"
 )
 
-const registryRepo = "https://github.com/AvengeMedia/dms-plugin-registry.git"
-
 type Plugin struct {
 	ID           string   `json:"id"`
 	Name         string   `json:"name"`
@@ -33,7 +34,10 @@ type Plugin struct {
 type GitClient interface {
 	PlainClone(path string, url string) error
 	Pull(path string) error
+	OriginURL(path string) (string, error)
 	HasUpdates(path string) (hasUpdates bool, localHash string, remoteHash string, err error)
+	CurrentRevision(path string) (string, error)
+	CheckoutRevision(path string, revision string) error
 }
 
 type realGitClient struct{}
@@ -65,6 +69,22 @@ func (g *realGitClient) Pull(path string) error {
 	return nil
 }
 
+func (g *realGitClient) OriginURL(path string) (string, error) {
+	repo, err := git.PlainOpen(path)
+	if err != nil {
+		return "", err
+	}
+	remote, err := repo.Remote("origin")
+	if err != nil {
+		return "", err
+	}
+	urls := remote.Config().URLs
+	if len(urls) == 0 {
+		return "", errors.New("origin remote has no URL")
+	}
+	return urls[0], nil
+}
+
 func (g *realGitClient) HasUpdates(path string) (bool, string, string, error) {
 	repo, err := git.PlainOpen(path)
 	if err != nil {
@@ -118,9 +138,51 @@ func (g *realGitClient) HasUpdates(path string) (bool, string, string, error) {
 	return localHash != remoteHead, localHash, remoteHead, nil
 }
 
+func (g *realGitClient) CurrentRevision(path string) (string, error) {
+	repo, err := git.PlainOpen(path)
+	if err != nil {
+		return "", err
+	}
+	head, err := repo.Head()
+	if err != nil {
+		return "", err
+	}
+	return head.Hash().String(), nil
+}
+
+func (g *realGitClient) CheckoutRevision(path string, revision string) error {
+	if !gitCommitPattern.MatchString(revision) {
+		return fmt.Errorf("invalid git revision %q", revision)
+	}
+
+	repo, err := git.PlainOpen(path)
+	if err != nil {
+		return err
+	}
+	hash := plumbing.NewHash(revision)
+	if _, objectErr := repo.CommitObject(hash); objectErr != nil {
+		if _, remoteErr := repo.Remote("origin"); remoteErr != nil {
+			return fmt.Errorf("revision %s is not available in repository: %w", revision, objectErr)
+		}
+		fetchErr := repo.Fetch(&git.FetchOptions{})
+		if fetchErr != nil && fetchErr != git.NoErrAlreadyUpToDate {
+			return fmt.Errorf("failed to fetch locked revision: %w", fetchErr)
+		}
+	}
+	if _, err := repo.CommitObject(hash); err != nil {
+		return fmt.Errorf("revision %s is not available in repository: %w", revision, err)
+	}
+	worktree, err := repo.Worktree()
+	if err != nil {
+		return err
+	}
+	return worktree.Reset(&git.ResetOptions{Commit: hash, Mode: git.HardReset})
+}
+
 type Registry struct {
 	fs         afero.Fs
 	cacheDir   string
+	registries []registries.Source
 	plugins    []Plugin
 	git        GitClient
 }
@@ -130,63 +192,63 @@ func NewRegistry() (*Registry, error) {
 }
 
 func NewRegistryWithFs(fs afero.Fs) (*Registry, error) {
-	cacheDir := getCacheDir()
 	return &Registry{
 		fs:         fs,
-		cacheDir: cacheDir,
+		cacheDir:   getCacheDir(),
+		registries: registries.Load(fs),
 		git:        &realGitClient{},
 	}, nil
 }
 
+func (r *Registry) cacheDirFor(src registries.Source) string {
+	return filepath.Join(r.cacheDir, src.Name)
+}
+
 func getCacheDir() string {
 	return filepath.Join(os.TempDir(), "dankdots-plugin-registry")
 }
 
-func (r *Registry) Update() error {
+// A cached clone is reused only when its origin still matches the configured
-	exists, err := afero.DirExists(r.fs, r.cacheDir)
+// URL; renamed or re-pointed registries re-clone instead of pulling from the
+// stale remote.
+func (r *Registry) updateOne(src registries.Source) error {
+	dir := r.cacheDirFor(src)
+	exists, err := afero.DirExists(r.fs, dir)
 	if err != nil {
 		return fmt.Errorf("failed to check cache directory: %w", err)
 	}
 
-	if !exists {
+	if exists {
-		if err := r.fs.MkdirAll(filepath.Dir(r.cacheDir), 0o755); err != nil {
+		origin, originErr := r.git.OriginURL(dir)
+		if originErr == nil && origin == src.URL && r.git.Pull(dir) == nil {
+			return nil
+		}
+		if err := r.fs.RemoveAll(dir); err != nil {
+			return fmt.Errorf("failed to remove stale registry cache: %w", err)
+		}
+	}
+
+	if err := r.fs.MkdirAll(filepath.Dir(dir), 0o755); err != nil {
 		return fmt.Errorf("failed to create cache directory: %w", err)
 	}
-
+	if err := r.git.PlainClone(dir, src.URL); err != nil {
-		if err := r.git.PlainClone(r.cacheDir, registryRepo); err != nil {
+		return fmt.Errorf("failed to clone: %w", err)
-			return fmt.Errorf("failed to clone registry: %w", err)
 	}
-	} else {
+	return nil
-		// Try to pull, if it fails (e.g., shallow clone corruption), delete and re-clone
-		if err := r.git.Pull(r.cacheDir); err != nil {
-			// Repository is likely corrupted or has issues, delete and re-clone
-			if err := r.fs.RemoveAll(r.cacheDir); err != nil {
-				return fmt.Errorf("failed to remove corrupted registry: %w", err)
 }
 
-			if err := r.fs.MkdirAll(filepath.Dir(r.cacheDir), 0o755); err != nil {
+// A registry without a plugins/ directory is a valid themes-only registry.
-				return fmt.Errorf("failed to create cache directory: %w", err)
+func (r *Registry) loadPluginsFrom(dir string) ([]Plugin, error) {
-			}
+	pluginsDir := filepath.Join(dir, "plugins")
-
-			if err := r.git.PlainClone(r.cacheDir, registryRepo); err != nil {
-				return fmt.Errorf("failed to re-clone registry: %w", err)
-			}
-		}
-	}
-
-	return r.loadPlugins()
-}
-
-func (r *Registry) loadPlugins() error {
-	pluginsDir := filepath.Join(r.cacheDir, "plugins")
-
 	entries, err := afero.ReadDir(r.fs, pluginsDir)
 	if err != nil {
-		return fmt.Errorf("failed to read plugins directory: %w", err)
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("failed to read plugins directory: %w", err)
 	}
 
-	r.plugins = []Plugin{}
+	var plugins []Plugin
-
 	for _, entry := range entries {
 		if entry.IsDir() || filepath.Ext(entry.Name()) != ".json" {
 			continue
@@ -206,15 +268,51 @@ func (r *Registry) loadPlugins() error {
 			plugin.ID = strings.TrimSuffix(entry.Name(), ".json")
 		}
 
-		r.plugins = append(r.plugins, plugin)
+		plugins = append(plugins, plugin)
+	}
+	return plugins, nil
 }
 
-	return nil
+// Pre-multi-registry caches were a single clone at the base dir; the per-name
+// layout nests under it, so a leftover clone is deleted wholesale first.
+func (r *Registry) resetLegacyCache() {
+	if exists, _ := afero.DirExists(r.fs, filepath.Join(r.cacheDir, ".git")); exists {
+		_ = r.fs.RemoveAll(r.cacheDir)
+	}
+}
+
+// Update refreshes every configured registry, aggregating plugins in
+// declaration order (first occurrence of an ID wins). A failing registry is
+// reported in the joined error but does not block the others.
+func (r *Registry) Update() error {
+	r.resetLegacyCache()
+	r.plugins = []Plugin{}
+	seen := make(map[string]struct{})
+	var errs []error
+	for _, src := range r.registries {
+		if err := r.updateOne(src); err != nil {
+			errs = append(errs, fmt.Errorf("registry %s: %w", src.Name, err))
+			continue
+		}
+		plugins, err := r.loadPluginsFrom(r.cacheDirFor(src))
+		if err != nil {
+			errs = append(errs, fmt.Errorf("registry %s: %w", src.Name, err))
+			continue
+		}
+		for _, p := range plugins {
+			if _, dup := seen[p.ID]; dup {
+				continue
+			}
+			seen[p.ID] = struct{}{}
+			r.plugins = append(r.plugins, p)
+		}
+	}
+	return errors.Join(errs...)
 }
 
 func (r *Registry) List() ([]Plugin, error) {
 	if len(r.plugins) == 0 {
-		if err := r.Update(); err != nil {
+		if err := r.Update(); err != nil && len(r.plugins) == 0 {
 			return nil, err
 		}
 	}

core/internal/plugins/registry_test.go

@@ -2,18 +2,29 @@ package plugins
 
 import (
 	"encoding/json"
+	"errors"
+	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/registries"
+	"github.com/go-git/go-git/v6"
+	"github.com/go-git/go-git/v6/plumbing/object"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+const testRegistryURL = "https://example.com/test-registry.git"
+
 type mockGitClient struct {
 	cloneFunc      func(path string, url string) error
 	pullFunc       func(path string) error
+	originFunc     func(path string) (string, error)
 	hasUpdatesFunc func(path string) (bool, string, string, error)
+	revisionFunc   func(path string) (string, error)
+	checkoutFunc   func(path string, revision string) error
 }
 
 func (m *mockGitClient) PlainClone(path string, url string) error {
@@ -30,6 +41,13 @@ func (m *mockGitClient) Pull(path string) error {
 	return nil
 }
 
+func (m *mockGitClient) OriginURL(path string) (string, error) {
+	if m.originFunc != nil {
+		return m.originFunc(path)
+	}
+	return "https://github.com/test/plugin.git", nil
+}
+
 func (m *mockGitClient) HasUpdates(path string) (bool, string, string, error) {
 	if m.hasUpdatesFunc != nil {
 		return m.hasUpdatesFunc(path)
@@ -37,11 +55,27 @@ func (m *mockGitClient) HasUpdates(path string) (bool, string, string, error) {
 	return false, "", "", nil
 }
 
+func (m *mockGitClient) CurrentRevision(path string) (string, error) {
+	if m.revisionFunc != nil {
+		return m.revisionFunc(path)
+	}
+	return "0123456789abcdef0123456789abcdef01234567", nil
+}
+
+func (m *mockGitClient) CheckoutRevision(path string, revision string) error {
+	if m.checkoutFunc != nil {
+		return m.checkoutFunc(path, revision)
+	}
+	return nil
+}
+
 func TestNewRegistry(t *testing.T) {
 	registry, err := NewRegistry()
 	assert.NoError(t, err)
 	assert.NotNil(t, registry)
 	assert.NotEmpty(t, registry.cacheDir)
+	require.NotEmpty(t, registry.registries)
+	assert.Equal(t, registries.OfficialName, registry.registries[0].Name)
 }
 
 func TestGetCacheDir(t *testing.T) {
@@ -49,12 +83,48 @@ func TestGetCacheDir(t *testing.T) {
 	assert.Contains(t, cacheDir, "/tmp/dankdots-plugin-registry")
 }
 
+func TestRealGitClientRevisionCheckout(t *testing.T) {
+	repoPath := t.TempDir()
+	repo, err := git.PlainInit(repoPath, false)
+	require.NoError(t, err)
+	worktree, err := repo.Worktree()
+	require.NoError(t, err)
+	filePath := filepath.Join(repoPath, "value.txt")
+	signature := &object.Signature{Name: "DMS Test", Email: "test@example.com", When: time.Unix(1, 0)}
+
+	require.NoError(t, os.WriteFile(filePath, []byte("one"), 0o644))
+	_, err = worktree.Add("value.txt")
+	require.NoError(t, err)
+	first, err := worktree.Commit("first", &git.CommitOptions{Author: signature})
+	require.NoError(t, err)
+
+	require.NoError(t, os.WriteFile(filePath, []byte("two"), 0o644))
+	_, err = worktree.Add("value.txt")
+	require.NoError(t, err)
+	second, err := worktree.Commit("second", &git.CommitOptions{Author: signature})
+	require.NoError(t, err)
+
+	client := &realGitClient{}
+	revision, err := client.CurrentRevision(repoPath)
+	require.NoError(t, err)
+	assert.Equal(t, second.String(), revision)
+	require.NoError(t, client.CheckoutRevision(repoPath, first.String()))
+
+	revision, err = client.CurrentRevision(repoPath)
+	require.NoError(t, err)
+	assert.Equal(t, first.String(), revision)
+	data, err := os.ReadFile(filePath)
+	require.NoError(t, err)
+	assert.Equal(t, "one", string(data))
+}
+
 func setupTestRegistry(t *testing.T) (*Registry, afero.Fs, string) {
 	fs := afero.NewMemMapFs()
 	tmpDir := "/test-cache"
 	registry := &Registry{
 		fs:         fs,
 		cacheDir:   tmpDir,
+		registries: []registries.Source{{Name: "test", URL: testRegistryURL}},
 		plugins:    []Plugin{},
 		git:        &mockGitClient{},
 	}
@@ -104,14 +174,14 @@ func TestLoadPlugins(t *testing.T) {
 		createTestPlugin(t, fs, tmpDir, "plugin1.json", plugin1)
 		createTestPlugin(t, fs, tmpDir, "plugin2.json", plugin2)
 
-		err := registry.loadPlugins()
+		plugins, err := registry.loadPluginsFrom(tmpDir)
 		assert.NoError(t, err)
-		assert.Len(t, registry.plugins, 2)
+		assert.Len(t, plugins, 2)
 
-		assert.Equal(t, "TestPlugin1", registry.plugins[0].Name)
+		assert.Equal(t, "TestPlugin1", plugins[0].Name)
-		assert.Equal(t, "TestPlugin2", registry.plugins[1].Name)
+		assert.Equal(t, "TestPlugin2", plugins[1].Name)
-		assert.Equal(t, []string{"dankbar-widget"}, registry.plugins[0].Capabilities)
+		assert.Equal(t, []string{"dankbar-widget"}, plugins[0].Capabilities)
-		assert.Equal(t, []string{"dep1", "dep2"}, registry.plugins[1].Dependencies)
+		assert.Equal(t, []string{"dep1", "dep2"}, plugins[1].Dependencies)
 	})
 
 	t.Run("skips non-json files", func(t *testing.T) {
@@ -136,34 +206,10 @@ func TestLoadPlugins(t *testing.T) {
 		}
 		createTestPlugin(t, fs, tmpDir, "valid.json", plugin)
 
-		err = registry.loadPlugins()
+		plugins, err := registry.loadPluginsFrom(tmpDir)
 		assert.NoError(t, err)
-		assert.Len(t, registry.plugins, 1)
+		assert.Len(t, plugins, 1)
-		assert.Equal(t, "ValidPlugin", registry.plugins[0].Name)
+		assert.Equal(t, "ValidPlugin", plugins[0].Name)
-	})
-
-	t.Run("skips directories", func(t *testing.T) {
-		registry, fs, tmpDir := setupTestRegistry(t)
-
-		pluginsDir := filepath.Join(tmpDir, "plugins")
-		err := fs.MkdirAll(filepath.Join(pluginsDir, "subdir"), 0o755)
-		require.NoError(t, err)
-
-		plugin := Plugin{
-			Name:         "ValidPlugin",
-			Capabilities: []string{"test"},
-			Category:     "test",
-			Repo:         "https://github.com/test/test",
-			Author:       "Test",
-			Description:  "Test",
-			Compositors:  []string{"niri"},
-			Distro:       []string{"any"},
-		}
-		createTestPlugin(t, fs, tmpDir, "valid.json", plugin)
-
-		err = registry.loadPlugins()
-		assert.NoError(t, err)
-		assert.Len(t, registry.plugins, 1)
 	})
 
 	t.Run("skips invalid json files", func(t *testing.T) {
@@ -188,18 +234,18 @@ func TestLoadPlugins(t *testing.T) {
 		}
 		createTestPlugin(t, fs, tmpDir, "valid.json", plugin)
 
-		err = registry.loadPlugins()
+		plugins, err := registry.loadPluginsFrom(tmpDir)
 		assert.NoError(t, err)
-		assert.Len(t, registry.plugins, 1)
+		assert.Len(t, plugins, 1)
-		assert.Equal(t, "ValidPlugin", registry.plugins[0].Name)
+		assert.Equal(t, "ValidPlugin", plugins[0].Name)
 	})
 
-	t.Run("returns error when plugins directory missing", func(t *testing.T) {
+	t.Run("missing plugins directory is a themes-only registry", func(t *testing.T) {
 		registry, _, _ := setupTestRegistry(t)
 
-		err := registry.loadPlugins()
+		plugins, err := registry.loadPluginsFrom(registry.cacheDir)
-		assert.Error(t, err)
+		assert.NoError(t, err)
-		assert.Contains(t, err.Error(), "failed to read plugins directory")
+		assert.Empty(t, plugins)
 	})
 }
 
@@ -240,19 +286,40 @@ func TestList(t *testing.T) {
 			Distro:       []string{"any"},
 		}
 
-		mockGit := &mockGitClient{
+		registry.git = &mockGitClient{
 			cloneFunc: func(path string, url string) error {
 				createTestPlugin(t, fs, path, "plugin.json", plugin)
 				return nil
 			},
 		}
-		registry.git = mockGit
 
 		plugins, err := registry.List()
 		assert.NoError(t, err)
 		assert.Len(t, plugins, 1)
 		assert.Equal(t, "NewPlugin", plugins[0].Name)
 	})
+
+	t.Run("partial registry failure still returns loaded plugins", func(t *testing.T) {
+		registry, fs, _ := setupTestRegistry(t)
+
+		registry.registries = []registries.Source{
+			{Name: "test", URL: testRegistryURL},
+			{Name: "broken", URL: "https://example.com/broken.git"},
+		}
+		registry.git = &mockGitClient{
+			cloneFunc: func(path string, url string) error {
+				if url != testRegistryURL {
+					return errors.New("clone failed")
+				}
+				createTestPlugin(t, fs, path, "x.json", Plugin{ID: "x", Name: "X"})
+				return nil
+			},
+		}
+
+		plugins, err := registry.List()
+		assert.NoError(t, err)
+		assert.Len(t, plugins, 1)
+	})
 }
 
 func TestUpdate(t *testing.T) {
@@ -271,16 +338,15 @@ func TestUpdate(t *testing.T) {
 		}
 
 		cloneCalled := false
-		mockGit := &mockGitClient{
+		registry.git = &mockGitClient{
 			cloneFunc: func(path string, url string) error {
 				cloneCalled = true
-				assert.Equal(t, registryRepo, url)
+				assert.Equal(t, testRegistryURL, url)
-				assert.Equal(t, tmpDir, path)
+				assert.Equal(t, filepath.Join(tmpDir, "test"), path)
 				createTestPlugin(t, fs, path, "plugin.json", plugin)
 				return nil
 			},
 		}
-		registry.git = mockGit
 
 		err := registry.Update()
 		assert.NoError(t, err)
@@ -289,7 +355,7 @@ func TestUpdate(t *testing.T) {
 		assert.Equal(t, "RepoPlugin", registry.plugins[0].Name)
 	})
 
-	t.Run("pulls updates when cache exists", func(t *testing.T) {
+	t.Run("pulls when cache exists with matching origin", func(t *testing.T) {
 		registry, fs, tmpDir := setupTestRegistry(t)
 
 		plugin := Plugin{
@@ -303,24 +369,188 @@ func TestUpdate(t *testing.T) {
 			Distro:       []string{"any"},
 		}
 
-		err := fs.MkdirAll(tmpDir, 0o755)
+		subdir := filepath.Join(tmpDir, "test")
-		require.NoError(t, err)
+		require.NoError(t, fs.MkdirAll(subdir, 0o755))
 
 		pullCalled := false
-		mockGit := &mockGitClient{
+		registry.git = &mockGitClient{
+			originFunc: func(path string) (string, error) {
+				return testRegistryURL, nil
+			},
 			pullFunc: func(path string) error {
 				pullCalled = true
-				assert.Equal(t, tmpDir, path)
+				assert.Equal(t, subdir, path)
 				createTestPlugin(t, fs, path, "plugin.json", plugin)
 				return nil
 			},
 		}
-		registry.git = mockGit
 
-		err = registry.Update()
+		err := registry.Update()
 		assert.NoError(t, err)
 		assert.True(t, pullCalled)
 		assert.Len(t, registry.plugins, 1)
 		assert.Equal(t, "UpdatedPlugin", registry.plugins[0].Name)
 	})
+
+	t.Run("re-clones when cached origin does not match configured URL", func(t *testing.T) {
+		registry, fs, tmpDir := setupTestRegistry(t)
+
+		subdir := filepath.Join(tmpDir, "test")
+		require.NoError(t, fs.MkdirAll(subdir, 0o755))
+		require.NoError(t, afero.WriteFile(fs, filepath.Join(subdir, "stale"), []byte("x"), 0o644))
+
+		pullCalled := false
+		cloneCalled := false
+		registry.git = &mockGitClient{
+			originFunc: func(path string) (string, error) {
+				return "https://example.com/old-origin.git", nil
+			},
+			pullFunc: func(path string) error {
+				pullCalled = true
+				return nil
+			},
+			cloneFunc: func(path string, url string) error {
+				cloneCalled = true
+				assert.Equal(t, testRegistryURL, url)
+				createTestPlugin(t, fs, path, "x.json", Plugin{ID: "x", Name: "X"})
+				return nil
+			},
+		}
+
+		err := registry.Update()
+		assert.NoError(t, err)
+		assert.False(t, pullCalled, "stale origin must not be pulled")
+		assert.True(t, cloneCalled)
+		exists, _ := afero.Exists(fs, filepath.Join(subdir, "stale"))
+		assert.False(t, exists, "stale cache contents removed before re-clone")
+	})
+
+	t.Run("re-clones when pull fails", func(t *testing.T) {
+		registry, fs, tmpDir := setupTestRegistry(t)
+
+		subdir := filepath.Join(tmpDir, "test")
+		require.NoError(t, fs.MkdirAll(subdir, 0o755))
+
+		cloneCalled := false
+		registry.git = &mockGitClient{
+			originFunc: func(path string) (string, error) {
+				return testRegistryURL, nil
+			},
+			pullFunc: func(path string) error {
+				return errors.New("shallow clone corruption")
+			},
+			cloneFunc: func(path string, url string) error {
+				cloneCalled = true
+				createTestPlugin(t, fs, path, "x.json", Plugin{ID: "x", Name: "X"})
+				return nil
+			},
+		}
+
+		err := registry.Update()
+		assert.NoError(t, err)
+		assert.True(t, cloneCalled)
+	})
+
+	t.Run("aggregates from multiple registries", func(t *testing.T) {
+		registry, fs, _ := setupTestRegistry(t)
+
+		pluginA := Plugin{ID: "a", Name: "PluginA", Compositors: []string{"niri"}, Distro: []string{"any"}}
+		pluginB := Plugin{ID: "b", Name: "PluginB", Compositors: []string{"niri"}, Distro: []string{"any"}}
+
+		registry.registries = []registries.Source{
+			{Name: "official", URL: testRegistryURL},
+			{Name: "louzt", URL: "https://example.com/louzt.git"},
+		}
+
+		registry.git = &mockGitClient{
+			cloneFunc: func(path string, url string) error {
+				switch filepath.Base(path) {
+				case "official":
+					createTestPlugin(t, fs, path, "x.json", pluginA)
+				case "louzt":
+					createTestPlugin(t, fs, path, "x.json", pluginB)
+				}
+				return nil
+			},
+		}
+
+		err := registry.Update()
+		assert.NoError(t, err)
+		assert.Len(t, registry.plugins, 2)
+		assert.Equal(t, "a", registry.plugins[0].ID)
+		assert.Equal(t, "b", registry.plugins[1].ID)
+	})
+
+	t.Run("dedupes by ID with declaration order priority", func(t *testing.T) {
+		registry, fs, _ := setupTestRegistry(t)
+
+		pluginOfficial := Plugin{ID: "weather", Name: "OfficialWeather", Compositors: []string{"niri"}, Distro: []string{"any"}}
+		pluginLouzt := Plugin{ID: "weather", Name: "LouztWeather", Compositors: []string{"niri"}, Distro: []string{"any"}}
+
+		registry.registries = []registries.Source{
+			{Name: "official", URL: testRegistryURL},
+			{Name: "louzt", URL: "https://example.com/louzt.git"},
+		}
+
+		registry.git = &mockGitClient{
+			cloneFunc: func(path string, url string) error {
+				switch filepath.Base(path) {
+				case "official":
+					createTestPlugin(t, fs, path, "x.json", pluginOfficial)
+				case "louzt":
+					createTestPlugin(t, fs, path, "x.json", pluginLouzt)
+				}
+				return nil
+			},
+		}
+
+		err := registry.Update()
+		assert.NoError(t, err)
+		assert.Len(t, registry.plugins, 1)
+		assert.Equal(t, "OfficialWeather", registry.plugins[0].Name)
+	})
+
+	t.Run("continues past failing registry and reports it", func(t *testing.T) {
+		registry, fs, _ := setupTestRegistry(t)
+
+		registry.registries = []registries.Source{
+			{Name: "broken", URL: "https://example.com/broken.git"},
+			{Name: "test", URL: testRegistryURL},
+		}
+		registry.git = &mockGitClient{
+			cloneFunc: func(path string, url string) error {
+				if url != testRegistryURL {
+					return errors.New("network unreachable")
+				}
+				createTestPlugin(t, fs, path, "x.json", Plugin{ID: "x", Name: "X"})
+				return nil
+			},
+		}
+
+		err := registry.Update()
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "registry broken")
+		assert.Len(t, registry.plugins, 1, "healthy registry still loads")
+	})
+
+	t.Run("removes legacy single-clone cache at base", func(t *testing.T) {
+		registry, fs, tmpDir := setupTestRegistry(t)
+
+		require.NoError(t, fs.MkdirAll(filepath.Join(tmpDir, ".git"), 0o755))
+		createTestPlugin(t, fs, tmpDir, "legacy.json", Plugin{ID: "legacy", Name: "Legacy"})
+
+		registry.git = &mockGitClient{
+			cloneFunc: func(path string, url string) error {
+				createTestPlugin(t, fs, path, "x.json", Plugin{ID: "x", Name: "X"})
+				return nil
+			},
+		}
+
+		err := registry.Update()
+		assert.NoError(t, err)
+		exists, _ := afero.DirExists(fs, filepath.Join(tmpDir, ".git"))
+		assert.False(t, exists, "legacy clone removed")
+		assert.Len(t, registry.plugins, 1)
+		assert.Equal(t, "x", registry.plugins[0].ID)
+	})
 }

core/internal/qmlchecks/lockscreen_input_test.go

@@ -22,6 +22,16 @@ func TestLockScreenPasswordFieldBypassesTextInputIME(t *testing.T) {
 	if !strings.Contains(content, "Keys.onPressed") || !strings.Contains(content, "event.text") {
 		t.Fatalf("passwordField should handle physical key text manually instead of relying on a text input control")
 	}
+
+	// Wayland IMEs commit unconsumed printable keys as text-input text rather
+	// than forwarding raw keys, so the lock screen needs an IME commit sink
+	// alongside raw key handling.
+	if !strings.Contains(content, "id: imeCommitSink") {
+		t.Fatalf("passwordField must keep the imeCommitSink TextInput so IME-routed keyboards can type (#2950)")
+	}
+	if !strings.Contains(content, "Qt.ImhSensitiveData") {
+		t.Fatalf("imeCommitSink must advertise hidden-text hints so IMEs treat it as a password field")
+	}
 }
 
 func TestLockScreenPamSupportsManagedAndSystemPolicies(t *testing.T) {

core/internal/registries/registries.go

@@ -0,0 +1,130 @@
+package registries
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/spf13/afero"
+)
+
+const (
+	OfficialName = "official"
+	officialURL  = "https://github.com/AvengeMedia/dms-plugin-registry.git"
+)
+
+// Source identifies a registry repository. Name doubles as the per-registry
+// cache subdirectory, so it is restricted to a filesystem-safe slug.
+type Source struct {
+	Name string `json:"name"`
+	URL  string `json:"url"`
+}
+
+func (s Source) Official() bool {
+	return s.Name == OfficialName
+}
+
+var nameRe = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{0,31}$`)
+
+func configPath() (string, error) {
+	configDir, err := os.UserConfigDir()
+	if err != nil {
+		return "", fmt.Errorf("failed to get user config dir: %w", err)
+	}
+	return filepath.Join(configDir, "DankMaterialShell", "registries.json"), nil
+}
+
+// Load returns the official registry followed by any user-configured extras.
+// A missing or unreadable config yields just the official registry.
+func Load(fs afero.Fs) []Source {
+	sources := []Source{{Name: OfficialName, URL: officialURL}}
+
+	path, err := configPath()
+	if err != nil {
+		return sources
+	}
+	data, err := afero.ReadFile(fs, path)
+	if err != nil {
+		return sources
+	}
+	var extras []Source
+	if err := json.Unmarshal(data, &extras); err != nil {
+		return sources
+	}
+	for _, s := range extras {
+		if !nameRe.MatchString(s.Name) || s.Name == OfficialName || s.URL == "" {
+			continue
+		}
+		sources = append(sources, s)
+	}
+	return sources
+}
+
+func saveExtras(fs afero.Fs, extras []Source) error {
+	path, err := configPath()
+	if err != nil {
+		return err
+	}
+	if err := fs.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		return fmt.Errorf("failed to create config dir: %w", err)
+	}
+	data, err := json.MarshalIndent(extras, "", "  ")
+	if err != nil {
+		return err
+	}
+	return afero.WriteFile(fs, path, append(data, '\n'), 0o644)
+}
+
+func loadExtras(fs afero.Fs) []Source {
+	sources := Load(fs)
+	return sources[1:]
+}
+
+func Add(fs afero.Fs, name, url string) error {
+	name = strings.TrimSpace(name)
+	url = strings.TrimSpace(url)
+
+	if !nameRe.MatchString(name) {
+		return fmt.Errorf("invalid registry name %q: use 1-32 lowercase letters, digits or hyphens", name)
+	}
+	if name == OfficialName {
+		return fmt.Errorf("registry name %q is reserved", OfficialName)
+	}
+	if url == "" {
+		return fmt.Errorf("registry URL is required")
+	}
+
+	extras := loadExtras(fs)
+	for _, s := range extras {
+		if s.Name == name {
+			return fmt.Errorf("registry %q already exists", name)
+		}
+		if s.URL == url {
+			return fmt.Errorf("registry %q already uses this URL", s.Name)
+		}
+	}
+
+	return saveExtras(fs, append(extras, Source{Name: name, URL: url}))
+}
+
+func Remove(fs afero.Fs, name string) error {
+	if name == OfficialName {
+		return fmt.Errorf("the official registry cannot be removed")
+	}
+
+	extras := loadExtras(fs)
+	kept := make([]Source, 0, len(extras))
+	for _, s := range extras {
+		if s.Name != name {
+			kept = append(kept, s)
+		}
+	}
+	if len(kept) == len(extras) {
+		return fmt.Errorf("registry %q not found", name)
+	}
+
+	return saveExtras(fs, kept)
+}

core/internal/registries/registries_test.go

@@ -0,0 +1,79 @@
+package registries
+
+import (
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setupFs(t *testing.T) afero.Fs {
+	t.Setenv("XDG_CONFIG_HOME", "/xdg")
+	return afero.NewMemMapFs()
+}
+
+func TestLoadDefaults(t *testing.T) {
+	fs := setupFs(t)
+
+	sources := Load(fs)
+	require.Len(t, sources, 1)
+	assert.Equal(t, OfficialName, sources[0].Name)
+	assert.Equal(t, officialURL, sources[0].URL)
+	assert.True(t, sources[0].Official())
+}
+
+func TestAddAndLoad(t *testing.T) {
+	fs := setupFs(t)
+
+	require.NoError(t, Add(fs, "extra", "https://example.com/extra.git"))
+	require.NoError(t, Add(fs, "another", "https://example.com/another.git"))
+
+	sources := Load(fs)
+	require.Len(t, sources, 3)
+	assert.Equal(t, OfficialName, sources[0].Name)
+	assert.Equal(t, "extra", sources[1].Name)
+	assert.Equal(t, "another", sources[2].Name)
+	assert.False(t, sources[1].Official())
+}
+
+func TestAddValidation(t *testing.T) {
+	fs := setupFs(t)
+
+	assert.Error(t, Add(fs, "", "https://example.com/x.git"))
+	assert.Error(t, Add(fs, "Has Spaces", "https://example.com/x.git"))
+	assert.Error(t, Add(fs, "UPPER", "https://example.com/x.git"))
+	assert.Error(t, Add(fs, "../escape", "https://example.com/x.git"))
+	assert.Error(t, Add(fs, OfficialName, "https://example.com/x.git"))
+	assert.Error(t, Add(fs, "noname", ""))
+
+	require.NoError(t, Add(fs, "extra", "https://example.com/x.git"))
+	assert.Error(t, Add(fs, "extra", "https://example.com/other.git"), "duplicate name rejected")
+	assert.Error(t, Add(fs, "extra2", "https://example.com/x.git"), "duplicate URL rejected")
+}
+
+func TestRemove(t *testing.T) {
+	fs := setupFs(t)
+
+	require.NoError(t, Add(fs, "extra", "https://example.com/x.git"))
+	require.NoError(t, Remove(fs, "extra"))
+	assert.Len(t, Load(fs), 1)
+
+	assert.Error(t, Remove(fs, "extra"), "already removed")
+	assert.Error(t, Remove(fs, OfficialName), "official is not removable")
+}
+
+func TestLoadIgnoresInvalidConfig(t *testing.T) {
+	fs := setupFs(t)
+
+	require.NoError(t, fs.MkdirAll("/xdg/DankMaterialShell", 0o755))
+	require.NoError(t, afero.WriteFile(fs, "/xdg/DankMaterialShell/registries.json", []byte("{not json"), 0o644))
+	assert.Len(t, Load(fs), 1)
+
+	entries := `[{"name":"ok","url":"https://example.com/ok.git"},{"name":"Bad Name","url":"https://example.com/bad.git"},{"name":"official","url":"https://example.com/spoof.git"},{"name":"nourl","url":""}]`
+	require.NoError(t, afero.WriteFile(fs, "/xdg/DankMaterialShell/registries.json", []byte(entries), 0o644))
+	sources := Load(fs)
+	require.Len(t, sources, 2, "invalid entries dropped")
+	assert.Equal(t, "ok", sources[1].Name)
+	assert.Equal(t, officialURL, sources[0].URL, "official cannot be spoofed from config")
+}

core/internal/server/cups/manager.go

@@ -229,6 +229,9 @@ func (m *Manager) snapshotState() CUPSState {
 func (m *Manager) Subscribe(id string) chan CUPSState {
 	ch := make(chan CUPSState, 64)
 
+	m.subLifecycleMu.Lock()
+	defer m.subLifecycleMu.Unlock()
+
 	wasEmpty := true
 	m.subscribers.Range(func(key string, ch chan CUPSState) bool {
 		wasEmpty = false
@@ -237,19 +240,25 @@ func (m *Manager) Subscribe(id string) chan CUPSState {
 
 	m.subscribers.Store(id, ch)
 
-	if wasEmpty && m.subscription != nil {
+	if !wasEmpty || m.subscription == nil {
+		return ch
+	}
+
 	if err := m.subscription.Start(); err != nil {
 		log.Warnf("[CUPS] Failed to start subscription manager: %v", err)
-		} else {
+		return ch
+	}
+
 	m.eventWG.Add(1)
 	go m.eventHandler()
-		}
-	}
 
 	return ch
 }
 
 func (m *Manager) Unsubscribe(id string) {
+	m.subLifecycleMu.Lock()
+	defer m.subLifecycleMu.Unlock()
+
 	if val, ok := m.subscribers.LoadAndDelete(id); ok {
 		close(val)
 	}
@@ -260,18 +269,22 @@ func (m *Manager) Unsubscribe(id string) {
 		return false
 	})
 
-	if isEmpty && m.subscription != nil {
+	if !isEmpty || m.subscription == nil {
+		return
+	}
+
 	m.subscription.Stop()
 	m.eventWG.Wait()
 }
-}
 
 func (m *Manager) Close() {
 	close(m.stopChan)
 
+	m.subLifecycleMu.Lock()
 	if m.subscription != nil {
 		m.subscription.Stop()
 	}
+	m.subLifecycleMu.Unlock()
 
 	m.eventWG.Wait()
 	m.notifierWg.Wait()

core/internal/server/cups/manager_test.go

@@ -1,6 +1,9 @@
 package cups
 
 import (
+	"errors"
+	"fmt"
+	"sync"
 	"testing"
 
 	mocks_cups "github.com/AvengeMedia/DankMaterialShell/core/internal/mocks/cups"
@@ -75,6 +78,67 @@ func TestManager_Subscribe(t *testing.T) {
 	assert.Equal(t, 0, count)
 }
 
+// mirrors the real managers: eventChan guarded by mu, conn/running deliberately
+// unsynchronized so overlapping Start/Stop trips the race detector
+type stubSubscription struct {
+	mu      sync.Mutex
+	events  chan SubscriptionEvent
+	conn    *int
+	running bool
+}
+
+func (s *stubSubscription) Start() error {
+	if s.running {
+		return errors.New("already running")
+	}
+	s.running = true
+
+	s.mu.Lock()
+	s.events = make(chan SubscriptionEvent)
+	s.mu.Unlock()
+
+	v := 0
+	s.conn = &v
+	*s.conn++
+
+	return nil
+}
+
+func (s *stubSubscription) Stop() {
+	if !s.running {
+		return
+	}
+	s.running = false
+	s.conn = nil
+
+	s.mu.Lock()
+	close(s.events)
+	s.mu.Unlock()
+}
+
+func (s *stubSubscription) Events() <-chan SubscriptionEvent {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.events
+}
+
+func TestManager_SubscribeUnsubscribeRace(t *testing.T) {
+	m := NewTestManager(mocks_cups.NewMockCUPSClientInterface(t), nil)
+	m.subscription = &stubSubscription{}
+
+	var wg sync.WaitGroup
+	for i := range 8 {
+		wg.Go(func() {
+			id := fmt.Sprintf("client-%d", i)
+			for range 50 {
+				m.Subscribe(id)
+				m.Unsubscribe(id)
+			}
+		})
+	}
+	wg.Wait()
+}
+
 func TestManager_Close(t *testing.T) {
 	mockClient := mocks_cups.NewMockCUPSClientInterface(t)
 

core/internal/server/cups/types.go

@@ -79,6 +79,7 @@ type Manager struct {
 	client            CUPSClientInterface
 	pkHelper          PkHelper
 	subscription      SubscriptionManagerInterface
+	subLifecycleMu    sync.Mutex
 	stateMutex        sync.RWMutex
 	subscribers       syncmap.Map[string, chan CUPSState]
 	stopChan          chan struct{}

core/internal/server/evdev/manager.go

@@ -48,7 +48,7 @@ func NewManager() (*Manager, error) {
 		return nil, fmt.Errorf("failed to find keyboards: %w", err)
 	}
 
-	initialCapsLock := readInitialCapsLockState(devices[0])
+	initialCapsLock, _ := capsLockFromDevices(devices)
 
 	watcher, err := fsnotify.NewWatcher()
 	if err != nil {
@@ -85,14 +85,21 @@ func NewManager() (*Manager, error) {
 	return m, nil
 }
 
-func readInitialCapsLockState(device EvdevDevice) bool {
+func capsLockFromDevices(devices []EvdevDevice) (bool, bool) {
-	ledStates, err := device.State(evLedType)
+	for _, device := range devices {
-	if err != nil {
+		if device == nil {
-		log.Debugf("Could not read LED state: %v", err)
+			continue
-		return false
 		}
 
-	return ledStates[ledCapslockKey]
+		ledStates, err := device.State(evLedType)
+		if err != nil || len(ledStates) == 0 {
+			continue
+		}
+
+		return ledStates[ledCapslockKey], true
+	}
+
+	return false, false
 }
 
 func findKeyboards() ([]EvdevDevice, error) {
@@ -297,25 +304,22 @@ func (m *Manager) readAndUpdateCapsLockState(deviceIndex int) {
 		m.devicesMutex.RUnlock()
 		return
 	}
-	device := m.devices[deviceIndex]
+	ordered := make([]EvdevDevice, 0, len(m.devices))
+	ordered = append(ordered, m.devices[deviceIndex])
+	for i, device := range m.devices {
+		if i == deviceIndex {
+			continue
+		}
+		ordered = append(ordered, device)
+	}
 	m.devicesMutex.RUnlock()
 
-	ledStates, err := device.State(evLedType)
+	capsLockState, ok := capsLockFromDevices(ordered)
-	if err != nil {
+	if !ok {
-		log.Warnf("Failed to read LED state: %v", err)
+		log.Debug("No LED-capable device available for caps lock state")
 		return
 	}
 
-	if len(ledStates) == 0 {
-		log.Debug("No LED state available (empty map)")
-
-		// This means the device either:
-		// - doesn't support LED reporting at all, or
-		// - the kernel returned an empty state
-		return
-	}
-
-	capsLockState := ledStates[ledCapslockKey]
 	m.updateCapsLockStateDirect(capsLockState)
 }
 

core/internal/server/evdev/manager_test.go

@@ -306,7 +306,7 @@ func TestNotifySubscribers(t *testing.T) {
 	m.Close()
 }
 
-func TestReadInitialCapsLockState(t *testing.T) {
+func TestCapsLockFromDevices(t *testing.T) {
 	t.Run("caps lock is on", func(t *testing.T) {
 		mockDevice := mocks.NewMockEvdevDevice(t)
 		ledState := evdev.StateMap{
@@ -314,7 +314,8 @@ func TestReadInitialCapsLockState(t *testing.T) {
 		}
 		mockDevice.EXPECT().State(evdev.EvType(evLedType)).Return(ledState, nil).Once()
 
-		result := readInitialCapsLockState(mockDevice)
+		result, ok := capsLockFromDevices([]EvdevDevice{mockDevice})
+		assert.True(t, ok)
 		assert.True(t, result)
 	})
 
@@ -325,7 +326,8 @@ func TestReadInitialCapsLockState(t *testing.T) {
 		}
 		mockDevice.EXPECT().State(evdev.EvType(evLedType)).Return(ledState, nil).Once()
 
-		result := readInitialCapsLockState(mockDevice)
+		result, ok := capsLockFromDevices([]EvdevDevice{mockDevice})
+		assert.True(t, ok)
 		assert.False(t, result)
 	})
 
@@ -333,9 +335,25 @@ func TestReadInitialCapsLockState(t *testing.T) {
 		mockDevice := mocks.NewMockEvdevDevice(t)
 		mockDevice.EXPECT().State(evdev.EvType(evLedType)).Return(nil, errors.New("read error")).Once()
 
-		result := readInitialCapsLockState(mockDevice)
+		result, ok := capsLockFromDevices([]EvdevDevice{mockDevice})
+		assert.False(t, ok)
 		assert.False(t, result)
 	})
+
+	t.Run("falls back past device without LED state", func(t *testing.T) {
+		noLedDevice := mocks.NewMockEvdevDevice(t)
+		noLedDevice.EXPECT().State(evdev.EvType(evLedType)).Return(evdev.StateMap{}, nil).Once()
+
+		ledDevice := mocks.NewMockEvdevDevice(t)
+		ledState := evdev.StateMap{
+			ledCapslockKey: true,
+		}
+		ledDevice.EXPECT().State(evdev.EvType(evLedType)).Return(ledState, nil).Once()
+
+		result, ok := capsLockFromDevices([]EvdevDevice{noLedDevice, nil, ledDevice})
+		assert.True(t, ok)
+		assert.True(t, result)
+	})
 }
 
 func TestHasInputGroupAccess(t *testing.T) {

core/internal/server/network/agent_networkmanager.go

@@ -302,17 +302,17 @@ func (a *SecretAgent) GetSecrets(
 		}
 		a.backend.cachedVPNCredsMu.Unlock()
 
-		a.backend.cachedGPSamlMu.Lock()
+		a.backend.cachedOpenConnectMu.Lock()
-		cachedGPSaml := a.backend.cachedGPSamlCookie
+		cachedOpenConnect := a.backend.cachedOpenConnectAuth
-		if cachedGPSaml != nil && cachedGPSaml.ConnectionUUID == connUuid {
+		if cachedOpenConnect != nil && cachedOpenConnect.ConnectionUUID == connUuid {
-			a.backend.cachedGPSamlCookie = nil
+			a.backend.cachedOpenConnectAuth = nil
-			a.backend.cachedGPSamlMu.Unlock()
+			a.backend.cachedOpenConnectMu.Unlock()
 
-			log.Infof("[SecretAgent] Using cached GlobalProtect SAML cookie for %s", connUuid)
+			log.Infof("[SecretAgent] Using cached OpenConnect authentication for %s", connUuid)
 
-			return buildGPSamlSecretsResponse(settingName, cachedGPSaml.Cookie, cachedGPSaml.Host, cachedGPSaml.Fingerprint), nil
+			return buildOpenConnectSecretsResponse(settingName, cachedOpenConnect.Cookie, cachedOpenConnect.Host, cachedOpenConnect.Fingerprint), nil
 		}
-		a.backend.cachedGPSamlMu.Unlock()
+		a.backend.cachedOpenConnectMu.Unlock()
 
 		if len(fields) == 1 && fields[0] == "gp-saml" {
 			gateway := ""
@@ -347,17 +347,17 @@ func (a *SecretAgent) GetSecrets(
 
 			log.Infof("[SecretAgent] GlobalProtect SAML authentication successful, returning cookie to NetworkManager")
 
-			a.backend.cachedGPSamlMu.Lock()
+			a.backend.cachedOpenConnectMu.Lock()
-			a.backend.cachedGPSamlCookie = &cachedGPSamlCookie{
+			a.backend.cachedOpenConnectAuth = &cachedOpenConnectAuth{
 				ConnectionUUID: connUuid,
 				Cookie:         authResult.Cookie,
 				Host:           authResult.Host,
 				User:           authResult.User,
 				Fingerprint:    authResult.Fingerprint,
 			}
-			a.backend.cachedGPSamlMu.Unlock()
+			a.backend.cachedOpenConnectMu.Unlock()
 
-			return buildGPSamlSecretsResponse(settingName, authResult.Cookie, authResult.Host, authResult.Fingerprint), nil
+			return buildOpenConnectSecretsResponse(settingName, authResult.Cookie, authResult.Host, authResult.Fingerprint), nil
 		}
 	}
 
@@ -987,7 +987,7 @@ func buildWiFiSecretsResponse(settingName string, secrets map[string]string) nmS
 	return out
 }
 
-func buildGPSamlSecretsResponse(settingName, cookie, host, fingerprint string) nmSettingMap {
+func buildOpenConnectSecretsResponse(settingName, cookie, host, fingerprint string) nmSettingMap {
 	out := nmSettingMap{}
 	vpnSec := nmVariantMap{}
 

core/internal/server/network/agent_networkmanager_test.go

@@ -122,7 +122,7 @@ func TestNeedsExternalBrowserAuth(t *testing.T) {
 	}
 }
 
-func TestBuildGPSamlSecretsResponse(t *testing.T) {
+func TestBuildOpenConnectSecretsResponse(t *testing.T) {
 	tests := []struct {
 		name        string
 		settingName string
@@ -155,7 +155,7 @@ func TestBuildGPSamlSecretsResponse(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := buildGPSamlSecretsResponse(tt.settingName, tt.cookie, tt.host, tt.fingerprint)
+			result := buildOpenConnectSecretsResponse(tt.settingName, tt.cookie, tt.host, tt.fingerprint)
 
 			assert.NotNil(t, result)
 			assert.Contains(t, result, tt.settingName)

core/internal/server/network/backend_networkmanager.go

@@ -86,8 +86,8 @@ type NetworkManagerBackend struct {
 	cachedVPNCredsMu      sync.Mutex
 	cachedPKCS11PIN       *cachedPKCS11PIN
 	cachedPKCS11Mu        sync.Mutex
-	cachedGPSamlCookie *cachedGPSamlCookie
+	cachedOpenConnectAuth *cachedOpenConnectAuth
-	cachedGPSamlMu     sync.Mutex
+	cachedOpenConnectMu   sync.Mutex
 	cachedWiFiSecret      *cachedWiFiSecret
 	cachedWiFiSecretMu    sync.Mutex
 
@@ -101,6 +101,7 @@ type pendingVPNCredentials struct {
 	// Secrets holds all VPN secret fields keyed by name (e.g. "cert-pass");
 	// falls back to Password under the "password" key when empty.
 	Secrets           map[string]string
+	PersistentSecrets map[string]string
 	SavePassword      bool
 }
 
@@ -124,7 +125,7 @@ type cachedWiFiSecret struct {
 	Secrets        map[string]string
 }
 
-type cachedGPSamlCookie struct {
+type cachedOpenConnectAuth struct {
 	ConnectionUUID string
 	Cookie         string
 	Host           string

core/internal/server/network/backend_networkmanager_gp_saml.go

@@ -3,6 +3,7 @@ package network
 import (
 	"bufio"
 	"context"
+	"errors"
 	"fmt"
 	"os/exec"
 	"strings"
@@ -10,16 +11,29 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 )
 
-type gpSamlAuthResult struct {
+type openConnectAuthResult struct {
 	Cookie      string
 	Host        string
 	User        string
 	Fingerprint string
 }
 
+type openConnectAuthError struct {
+	cause      error
+	serverCert string
+}
+
+func (e *openConnectAuthError) Error() string {
+	return fmt.Sprintf("openconnect --authenticate failed: %v", e.cause)
+}
+
+func (e *openConnectAuthError) Unwrap() error {
+	return e.cause
+}
+
 // runGlobalProtectSAMLAuth handles GlobalProtect SAML/SSO authentication using gp-saml-gui.
 // Only supports protocol=gp. Other protocols need their own implementations.
-func (b *NetworkManagerBackend) runGlobalProtectSAMLAuth(ctx context.Context, gateway, protocol string) (*gpSamlAuthResult, error) {
+func (b *NetworkManagerBackend) runGlobalProtectSAMLAuth(ctx context.Context, gateway, protocol string) (*openConnectAuthResult, error) {
 	if gateway == "" {
 		return nil, fmt.Errorf("GP SAML auth: gateway is empty")
 	}
@@ -63,7 +77,7 @@ func (b *NetworkManagerBackend) runGlobalProtectSAMLAuth(ctx context.Context, ga
 		}
 	}()
 
-	result := &gpSamlAuthResult{Host: gateway}
+	result := &openConnectAuthResult{Host: gateway}
 	var allOutput []string
 
 	scanner := bufio.NewScanner(stdout)
@@ -117,13 +131,8 @@ func (b *NetworkManagerBackend) runGlobalProtectSAMLAuth(ctx context.Context, ga
 	return result, nil
 }
 
-func convertGPPreloginCookie(ctx context.Context, gateway, preloginCookie, user string) (*gpSamlAuthResult, error) {
+func convertGPPreloginCookie(ctx context.Context, gateway, preloginCookie, user string) (*openConnectAuthResult, error) {
-	ocPath, err := exec.LookPath("openconnect")
+	return runOpenConnectAuthenticate(ctx, []string{
-	if err != nil {
-		return nil, fmt.Errorf("openconnect not found: %w", err)
-	}
-
-	args := []string{
 		"--protocol=gp",
 		"--usergroup=gateway:prelogin-cookie",
 		"--user=" + user,
@@ -131,18 +140,83 @@ func convertGPPreloginCookie(ctx context.Context, gateway, preloginCookie, user
 		"--allow-insecure-crypto",
 		"--authenticate",
 		gateway,
+	}, preloginCookie)
+}
+
+func runOpenConnectPasswordAuth(
+	ctx context.Context,
+	data map[string]string,
+	username, password, serverCert string,
+) (*openConnectAuthResult, error) {
+	if data["protocol"] != "fortinet" {
+		return nil, fmt.Errorf("only Fortinet password authentication is supported")
+	}
+	gateway := data["gateway"]
+	if gateway == "" {
+		return nil, fmt.Errorf("OpenConnect gateway is empty")
+	}
+	if username == "" || password == "" {
+		return nil, fmt.Errorf("OpenConnect username and password are required")
+	}
+
+	args := []string{
+		"--protocol=fortinet",
+		"--user=" + username,
+		"--passwd-on-stdin",
+		"--non-inter",
+	}
+	if usergroup := data["usergroup"]; usergroup != "" {
+		args = append(args, "--usergroup="+usergroup)
+	}
+	if serverCert != "" {
+		args = append(args, "--servercert="+serverCert)
+	}
+	args = append(args, "--authenticate", gateway)
+
+	result, err := runOpenConnectAuthenticate(ctx, args, password)
+	if err == nil {
+		result.Host = gateway
+		if result.Fingerprint == "" {
+			result.Fingerprint = serverCert
+		}
+	}
+	return result, err
+}
+
+func runOpenConnectAuthenticate(ctx context.Context, args []string, secret string) (*openConnectAuthResult, error) {
+	ocPath, err := exec.LookPath("openconnect")
+	if err != nil {
+		return nil, fmt.Errorf("openconnect not found: %w", err)
 	}
 
 	cmd := exec.CommandContext(ctx, ocPath, args...)
-	cmd.Stdin = strings.NewReader(preloginCookie)
+	cmd.Stdin = strings.NewReader(secret + "\n")
 
 	output, err := cmd.CombinedOutput()
+	result := parseOpenConnectAuthenticateOutput(string(output))
+	serverCert := suggestedOpenConnectServerCert(string(output))
 	if err != nil {
-		return nil, fmt.Errorf("openconnect --authenticate failed: %w\noutput: %s", err, string(output))
+		if ctx.Err() != nil {
+			return nil, fmt.Errorf("openconnect authentication timed out or was cancelled: %w", ctx.Err())
+		}
+		return nil, &openConnectAuthError{cause: err, serverCert: serverCert}
+	}
+	if result.Cookie == "" {
+		return nil, &openConnectAuthError{
+			cause:      errors.New("no COOKIE in command output"),
+			serverCert: serverCert,
+		}
 	}
 
-	result := &gpSamlAuthResult{}
+	log.Infof("[OpenConnect] Authentication successful: cookie_len=%d, host=%s, has_fingerprint=%v",
-	for _, line := range strings.Split(string(output), "\n") {
+		len(result.Cookie), result.Host, result.Fingerprint != "")
+
+	return result, nil
+}
+
+func parseOpenConnectAuthenticateOutput(output string) *openConnectAuthResult {
+	result := &openConnectAuthResult{}
+	for _, line := range strings.Split(output, "\n") {
 		line = strings.TrimSpace(line)
 		switch {
 		case strings.HasPrefix(line, "COOKIE="):
@@ -158,15 +232,7 @@ func convertGPPreloginCookie(ctx context.Context, gateway, preloginCookie, user
 			}
 		}
 	}
-
+	return result
-	if result.Cookie == "" {
-		return nil, fmt.Errorf("no COOKIE in openconnect --authenticate output: %s", string(output))
-	}
-
-	log.Infof("[GP-SAML] openconnect --authenticate: cookie_len=%d, host=%s, fingerprint=%s",
-		len(result.Cookie), result.Host, result.Fingerprint)
-
-	return result, nil
 }
 
 func unshellQuote(s string) string {
@@ -179,7 +245,7 @@ func unshellQuote(s string) string {
 	return s
 }
 
-func parseGPSamlFromCommandLine(line string, result *gpSamlAuthResult) {
+func parseGPSamlFromCommandLine(line string, result *openConnectAuthResult) {
 	if !strings.Contains(line, "openconnect") {
 		return
 	}

core/internal/server/network/backend_networkmanager_gp_saml_test.go

@@ -1,6 +1,10 @@
 package network
 
 import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -71,7 +75,7 @@ func TestParseGPSamlFromCommandLine(t *testing.T) {
 	tests := []struct {
 		name           string
 		line           string
-		initialResult  *gpSamlAuthResult
+		initialResult  *openConnectAuthResult
 		expectedCookie string
 		expectedUser   string
 		expectedFP     string
@@ -79,7 +83,7 @@ func TestParseGPSamlFromCommandLine(t *testing.T) {
 		{
 			name:           "full openconnect command",
 			line:           "openconnect --protocol=gp --cookie=AUTH123 --servercert=pin-sha256:ABC --user=john",
-			initialResult:  &gpSamlAuthResult{},
+			initialResult:  &openConnectAuthResult{},
 			expectedCookie: "AUTH123",
 			expectedUser:   "john",
 			expectedFP:     "pin-sha256:ABC",
@@ -87,7 +91,7 @@ func TestParseGPSamlFromCommandLine(t *testing.T) {
 		{
 			name:           "with equals signs in cookie",
 			line:           "openconnect --cookie=authcookie=xyz123&portal=GATE --user=jane",
-			initialResult:  &gpSamlAuthResult{},
+			initialResult:  &openConnectAuthResult{},
 			expectedCookie: "authcookie=xyz123&portal=GATE",
 			expectedUser:   "jane",
 			expectedFP:     "",
@@ -95,7 +99,7 @@ func TestParseGPSamlFromCommandLine(t *testing.T) {
 		{
 			name:           "non-openconnect line",
 			line:           "some other output",
-			initialResult:  &gpSamlAuthResult{},
+			initialResult:  &openConnectAuthResult{},
 			expectedCookie: "",
 			expectedUser:   "",
 			expectedFP:     "",
@@ -103,7 +107,7 @@ func TestParseGPSamlFromCommandLine(t *testing.T) {
 		{
 			name:           "preserves existing values",
 			line:           "openconnect --user=newuser",
-			initialResult:  &gpSamlAuthResult{Cookie: "existing", Fingerprint: "existing-fp"},
+			initialResult:  &openConnectAuthResult{Cookie: "existing", Fingerprint: "existing-fp"},
 			expectedCookie: "existing",
 			expectedUser:   "newuser",
 			expectedFP:     "existing-fp",
@@ -111,7 +115,7 @@ func TestParseGPSamlFromCommandLine(t *testing.T) {
 		{
 			name:           "only updates empty fields",
 			line:           "openconnect --cookie=NEW --user=NEW",
-			initialResult:  &gpSamlAuthResult{Cookie: "OLD"},
+			initialResult:  &openConnectAuthResult{Cookie: "OLD"},
 			expectedCookie: "OLD",
 			expectedUser:   "NEW",
 			expectedFP:     "",
@@ -119,7 +123,7 @@ func TestParseGPSamlFromCommandLine(t *testing.T) {
 		{
 			name:           "real gp-saml-gui output",
 			line:           "openconnect --protocol=gp --user=john.doe@example.com --os=linux-64 --usergroup=gateway:prelogin-cookie --passwd-on-stdin",
-			initialResult:  &gpSamlAuthResult{},
+			initialResult:  &openConnectAuthResult{},
 			expectedCookie: "",
 			expectedUser:   "john.doe@example.com",
 			expectedFP:     "",
@@ -127,7 +131,7 @@ func TestParseGPSamlFromCommandLine(t *testing.T) {
 		{
 			name:           "with server cert flag",
 			line:           "openconnect --servercert=pin-sha256:xp3scfzy3rOgQEXnfPiYKrUk7D66a8b8O+gEXaMPleE= vpn.example.com",
-			initialResult:  &gpSamlAuthResult{},
+			initialResult:  &openConnectAuthResult{},
 			expectedCookie: "",
 			expectedUser:   "",
 			expectedFP:     "pin-sha256:xp3scfzy3rOgQEXnfPiYKrUk7D66a8b8O+gEXaMPleE=",
@@ -158,7 +162,7 @@ func TestParseGPSamlFromCommandLine_MultipleLines(t *testing.T) {
 		"",
 	}
 
-	result := &gpSamlAuthResult{}
+	result := &openConnectAuthResult{}
 	for _, line := range lines {
 		parseGPSamlFromCommandLine(line, result)
 	}
@@ -167,3 +171,19 @@ func TestParseGPSamlFromCommandLine_MultipleLines(t *testing.T) {
 	assert.Empty(t, result.Cookie, "cookie should not be parsed from command line")
 	assert.Empty(t, result.Fingerprint)
 }
+
+func TestRunOpenConnectAuthenticateSanitizesFailure(t *testing.T) {
+	binDir := t.TempDir()
+	openConnectPath := filepath.Join(binDir, "openconnect")
+	script := "#!/bin/sh\nprintf '%s\\n' 'Cookie: should-not-leak' 'Add --servercert pin-sha256:TEST-FINGERPRINT' >&2\nexit 1\n"
+	assert.NoError(t, os.WriteFile(openConnectPath, []byte(script), 0o755))
+	t.Setenv("PATH", binDir)
+
+	_, err := runOpenConnectAuthenticate(context.Background(), []string{"--authenticate", "vpn.example.test"}, "password")
+	assert.Error(t, err)
+	assert.NotContains(t, err.Error(), "should-not-leak")
+
+	var authErr *openConnectAuthError
+	assert.True(t, errors.As(err, &authErr))
+	assert.Equal(t, "pin-sha256:TEST-FINGERPRINT", authErr.serverCert)
+}

core/internal/server/network/backend_networkmanager_vpn.go

@@ -326,6 +326,7 @@ func (b *NetworkManagerBackend) ConnectVPN(uuidOrName string, singleActive bool)
 	}
 
 	authAction := detectVPNAuthAction(vpnServiceType, vpnData)
+	var openConnectAuth *openConnectAuthResult
 
 	switch authAction {
 	case "openvpn_username":
@@ -335,6 +336,19 @@ func (b *NetworkManagerBackend) ConnectVPN(uuidOrName string, singleActive bool)
 		if err := b.handleOpenVPNUsernameAuth(targetConn, connName, targetUUID, vpnServiceType); err != nil {
 			return err
 		}
+	case "openconnect_password":
+		if err := b.ensureOpenConnectAgentFlags(targetConn, vpnData); err != nil {
+			return fmt.Errorf("failed to prepare OpenConnect connection: %w", err)
+		}
+
+		authCtx, authCancel := context.WithTimeout(context.Background(), 5*time.Minute)
+		openConnectAuth, err = b.handleOpenConnectPasswordAuth(
+			authCtx, targetConn, connName, targetUUID, vpnServiceType, vpnData,
+		)
+		authCancel()
+		if err != nil {
+			return fmt.Errorf("OpenConnect authentication failed: %w", err)
+		}
 	case "gp_saml":
 		gateway := vpnData["gateway"]
 		protocol := vpnData["protocol"]
@@ -345,7 +359,7 @@ func (b *NetworkManagerBackend) ConnectVPN(uuidOrName string, singleActive bool)
 		log.Infof("[ConnectVPN] GlobalProtect SAML/SSO authentication required for %s (gateway=%s)", connName, gateway)
 
 		samlCtx, samlCancel := context.WithTimeout(context.Background(), 5*time.Minute)
-		authResult, err := b.runGlobalProtectSAMLAuth(samlCtx, gateway, protocol)
+		openConnectAuth, err = b.runGlobalProtectSAMLAuth(samlCtx, gateway, protocol)
 		samlCancel()
 		if err != nil {
 			errMsg := err.Error()
@@ -363,16 +377,6 @@ func (b *NetworkManagerBackend) ConnectVPN(uuidOrName string, singleActive bool)
 			}
 		}
 
-		b.cachedGPSamlMu.Lock()
-		b.cachedGPSamlCookie = &cachedGPSamlCookie{
-			ConnectionUUID: targetUUID,
-			Cookie:         authResult.Cookie,
-			Host:           authResult.Host,
-			User:           authResult.User,
-			Fingerprint:    authResult.Fingerprint,
-		}
-		b.cachedGPSamlMu.Unlock()
-
 		if err := targetConn.ClearSecrets(); err != nil {
 			log.Warnf("[ConnectVPN] ClearSecrets failed (non-fatal): %v", err)
 		} else {
@@ -382,6 +386,19 @@ func (b *NetworkManagerBackend) ConnectVPN(uuidOrName string, singleActive bool)
 		log.Infof("[ConnectVPN] GlobalProtect SAML cookie cached for %s, proceeding with activation", connName)
 	}
 
+	if openConnectAuth != nil {
+		b.cachedOpenConnectMu.Lock()
+		b.cachedOpenConnectAuth = &cachedOpenConnectAuth{
+			ConnectionUUID: targetUUID,
+			Cookie:         openConnectAuth.Cookie,
+			Host:           openConnectAuth.Host,
+			User:           openConnectAuth.User,
+			Fingerprint:    openConnectAuth.Fingerprint,
+		}
+		b.cachedOpenConnectMu.Unlock()
+		log.Infof("[ConnectVPN] OpenConnect authentication cached for %s, proceeding with activation", connName)
+	}
+
 	b.stateMutex.Lock()
 	b.state.IsConnectingVPN = true
 	b.state.ConnectingVPNUUID = targetUUID
@@ -394,6 +411,13 @@ func (b *NetworkManagerBackend) ConnectVPN(uuidOrName string, singleActive bool)
 	nm := b.nmConn.(gonetworkmanager.NetworkManager)
 	_, err = nm.ActivateConnection(targetConn, nil, nil)
 	if err != nil {
+		b.cachedOpenConnectMu.Lock()
+		b.cachedOpenConnectAuth = nil
+		b.cachedOpenConnectMu.Unlock()
+		b.pendingVPNSaveMu.Lock()
+		b.pendingVPNSave = nil
+		b.pendingVPNSaveMu.Unlock()
+
 		b.stateMutex.Lock()
 		b.state.IsConnectingVPN = false
 		b.state.ConnectingVPNUUID = ""
@@ -425,6 +449,9 @@ func detectVPNAuthAction(serviceType string, data map[string]string) string {
 				log.Infof("[VPN] External browser auth detected for protocol '%s' but only GlobalProtect (gp) is currently supported", protocol)
 			}
 		}
+		if protocol == "fortinet" && data["authtype"] == "password" {
+			return "openconnect_password"
+		}
 	case strings.Contains(serviceType, "openvpn"):
 		connType := data["connection-type"]
 		username := data["username"]
@@ -435,6 +462,200 @@ func detectVPNAuthAction(serviceType string, data map[string]string) string {
 	return ""
 }
 
+func setOpenConnectAgentFlags(data map[string]string) bool {
+	changed := false
+	for _, field := range []string{"cookie", "gateway", "gwcert"} {
+		key := field + "-flags"
+		if data[key] != "2" {
+			data[key] = "2"
+			changed = true
+		}
+	}
+	return changed
+}
+
+func (b *NetworkManagerBackend) ensureOpenConnectAgentFlags(conn gonetworkmanager.Connection, data map[string]string) error {
+	if !setOpenConnectAgentFlags(data) {
+		return nil
+	}
+	if b.dbusConn == nil {
+		return fmt.Errorf("NetworkManager D-Bus connection is unavailable")
+	}
+
+	connObj := b.dbusConn.Object("org.freedesktop.NetworkManager", conn.GetPath())
+	var existingSettings map[string]map[string]dbus.Variant
+	if err := connObj.Call("org.freedesktop.NetworkManager.Settings.Connection.GetSettings", 0).Store(&existingSettings); err != nil {
+		return fmt.Errorf("failed to get connection settings: %w", err)
+	}
+
+	vpn, ok := existingSettings["vpn"]
+	if !ok {
+		return fmt.Errorf("VPN settings are missing")
+	}
+	vpn["data"] = dbus.MakeVariant(data)
+
+	var stored map[string]map[string]dbus.Variant
+	if err := connObj.Call("org.freedesktop.NetworkManager.Settings.Connection.GetSecrets", 0, "vpn").Store(&stored); err != nil {
+		return fmt.Errorf("failed to preserve VPN secrets: %w", err)
+	}
+	if storedVPN, ok := stored["vpn"]; ok {
+		if secrets, ok := storedVPN["secrets"]; ok {
+			vpn["secrets"] = secrets
+		}
+	}
+
+	settings := map[string]map[string]dbus.Variant{"vpn": vpn}
+	if connection, ok := existingSettings["connection"]; ok {
+		settings["connection"] = connection
+	}
+
+	var result map[string]dbus.Variant
+	if err := connObj.Call("org.freedesktop.NetworkManager.Settings.Connection.Update2", 0,
+		settings, uint32(0x1), map[string]dbus.Variant{}).Store(&result); err != nil {
+		return fmt.Errorf("failed to set NetworkManager secret-agent flags: %w", err)
+	}
+	return nil
+}
+
+func (b *NetworkManagerBackend) handleOpenConnectPasswordAuth(
+	ctx context.Context,
+	targetConn gonetworkmanager.Connection,
+	connName, targetUUID, vpnServiceType string,
+	data map[string]string,
+) (*openConnectAuthResult, error) {
+	username := data["username"]
+	secrets := map[string]string{}
+	if stored, err := targetConn.GetSecrets("vpn"); err == nil {
+		if vpn, ok := stored["vpn"]; ok {
+			if saved, ok := vpn["secrets"].(map[string]string); ok {
+				secrets = saved
+			}
+		}
+	}
+
+	password := secrets["password"]
+	serverCert := secrets["certificate:"+data["gateway"]]
+	if serverCert == "" {
+		serverCert = secrets["gwcert"]
+	}
+
+	var reply PromptReply
+	if username == "" || password == "" {
+		if b.promptBroker == nil {
+			return nil, fmt.Errorf("password authentication requires an interactive prompt")
+		}
+
+		fields := []string{}
+		fieldsInfo := []FieldInfo{}
+		if username == "" {
+			fields = append(fields, "username")
+			fieldsInfo = append(fieldsInfo, FieldInfo{Name: "username", Label: "Username", IsSecret: false})
+		}
+		if password == "" {
+			fields = append(fields, "password")
+			fieldsInfo = append(fieldsInfo, FieldInfo{Name: "password", Label: "Password", IsSecret: true})
+		}
+
+		token, err := b.promptBroker.Ask(ctx, PromptRequest{
+			Name:           connName,
+			ConnType:       "vpn",
+			VpnService:     vpnServiceType,
+			SettingName:    "vpn",
+			Fields:         fields,
+			FieldsInfo:     fieldsInfo,
+			Reason:         "required",
+			ConnectionId:   connName,
+			ConnectionUuid: targetUUID,
+			ConnectionPath: string(targetConn.GetPath()),
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to request credentials: %w", err)
+		}
+
+		reply, err = b.promptBroker.Wait(ctx, token)
+		if err != nil {
+			return nil, fmt.Errorf("credentials prompt failed: %w", err)
+		}
+		if username == "" {
+			username = reply.Secrets["username"]
+		}
+		if password == "" {
+			password = reply.Secrets["password"]
+		}
+	}
+
+	auth, err := runOpenConnectPasswordAuth(ctx, data, username, password, serverCert)
+	persistentSecrets := map[string]string{}
+	var authErr *openConnectAuthError
+	if err != nil && errors.As(err, &authErr) && authErr.serverCert != "" && authErr.serverCert != serverCert {
+		if b.promptBroker == nil {
+			return nil, fmt.Errorf("VPN server certificate is untrusted: %s", authErr.serverCert)
+		}
+
+		reason := "server-certificate"
+		if serverCert != "" {
+			reason = "server-certificate-changed"
+		}
+
+		token, promptErr := b.promptBroker.Ask(ctx, PromptRequest{
+			Name:           connName,
+			ConnType:       "vpn",
+			VpnService:     vpnServiceType,
+			SettingName:    "vpn",
+			Hints:          []string{authErr.serverCert},
+			Reason:         reason,
+			ConnectionId:   connName,
+			ConnectionUuid: targetUUID,
+			ConnectionPath: string(targetConn.GetPath()),
+		})
+		if promptErr != nil {
+			return nil, fmt.Errorf("failed to request certificate confirmation: %w", promptErr)
+		}
+		if _, promptErr = b.promptBroker.Wait(ctx, token); promptErr != nil {
+			return nil, fmt.Errorf("certificate confirmation failed: %w", promptErr)
+		}
+
+		auth, err = runOpenConnectPasswordAuth(ctx, data, username, password, authErr.serverCert)
+		if err == nil {
+			persistentSecrets["certificate:"+data["gateway"]] = authErr.serverCert
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	if len(reply.Secrets) > 0 || len(persistentSecrets) > 0 {
+		creds := &pendingVPNCredentials{
+			ConnectionPath:    string(targetConn.GetPath()),
+			PersistentSecrets: persistentSecrets,
+		}
+		if _, ok := reply.Secrets["username"]; ok {
+			creds.Username = username
+		}
+		if reply.Save {
+			creds.Username = username
+			creds.Password = password
+			creds.Secrets = map[string]string{"password": password}
+			creds.SavePassword = true
+		}
+		b.pendingVPNSaveMu.Lock()
+		b.pendingVPNSave = creds
+		b.pendingVPNSaveMu.Unlock()
+	}
+
+	return auth, nil
+}
+
+func suggestedOpenConnectServerCert(output string) string {
+	for _, field := range strings.Fields(output) {
+		field = strings.Trim(field, "'\".,")
+		if strings.HasPrefix(field, "pin-sha256:") {
+			return field
+		}
+	}
+	return ""
+}
+
 func (b *NetworkManagerBackend) handleOpenVPNUsernameAuth(targetConn gonetworkmanager.Connection, connName, targetUUID, vpnServiceType string) error {
 	log.Infof("[ConnectVPN] OpenVPN requires username in vpn.data - prompting before activation")
 
@@ -758,13 +979,13 @@ func (b *NetworkManagerBackend) updateVPNConnectionState() {
 				b.state.VPNErrorUuid = ""
 				b.stateMutex.Unlock()
 
-				// Clear cached PKCS11 PIN and SAML cookie on success
+				// Clear cached one-shot authentication values on success.
 				b.cachedPKCS11Mu.Lock()
 				b.cachedPKCS11PIN = nil
 				b.cachedPKCS11Mu.Unlock()
-				b.cachedGPSamlMu.Lock()
+				b.cachedOpenConnectMu.Lock()
-				b.cachedGPSamlCookie = nil
+				b.cachedOpenConnectAuth = nil
-				b.cachedGPSamlMu.Unlock()
+				b.cachedOpenConnectMu.Unlock()
 
 				b.pendingVPNSaveMu.Lock()
 				pending := b.pendingVPNSave
@@ -787,13 +1008,16 @@ func (b *NetworkManagerBackend) updateVPNConnectionState() {
 				b.state.VPNErrorUuid = connectingVPNUUID
 				b.stateMutex.Unlock()
 
-				// Clear cached PKCS11 PIN and SAML cookie on failure
+				// Clear cached one-shot authentication values on failure.
 				b.cachedPKCS11Mu.Lock()
 				b.cachedPKCS11PIN = nil
 				b.cachedPKCS11Mu.Unlock()
-				b.cachedGPSamlMu.Lock()
+				b.cachedOpenConnectMu.Lock()
-				b.cachedGPSamlCookie = nil
+				b.cachedOpenConnectAuth = nil
-				b.cachedGPSamlMu.Unlock()
+				b.cachedOpenConnectMu.Unlock()
+				b.pendingVPNSaveMu.Lock()
+				b.pendingVPNSave = nil
+				b.pendingVPNSaveMu.Unlock()
 				return
 			}
 		}
@@ -811,13 +1035,16 @@ func (b *NetworkManagerBackend) updateVPNConnectionState() {
 		b.state.VPNErrorUuid = connectingVPNUUID
 		b.stateMutex.Unlock()
 
-		// Clear cached PKCS11 PIN and SAML cookie
+		// Clear cached one-shot authentication values.
 		b.cachedPKCS11Mu.Lock()
 		b.cachedPKCS11PIN = nil
 		b.cachedPKCS11Mu.Unlock()
-		b.cachedGPSamlMu.Lock()
+		b.cachedOpenConnectMu.Lock()
-		b.cachedGPSamlCookie = nil
+		b.cachedOpenConnectAuth = nil
-		b.cachedGPSamlMu.Unlock()
+		b.cachedOpenConnectMu.Unlock()
+		b.pendingVPNSaveMu.Lock()
+		b.pendingVPNSave = nil
+		b.pendingVPNSaveMu.Unlock()
 	}
 }
 
@@ -863,17 +1090,40 @@ func (b *NetworkManagerBackend) saveVPNCredentials(creds *pendingVPNCredentials)
 		log.Infof("[saveVPNCredentials] Saving username")
 	}
 
-	// Save secrets if requested
+	secs := map[string]string{}
-	if creds.SavePassword {
+	if len(creds.PersistentSecrets) > 0 {
-		secs := creds.Secrets
+		var stored map[string]map[string]dbus.Variant
-		if len(secs) == 0 {
+		if err := connObj.Call("org.freedesktop.NetworkManager.Settings.Connection.GetSecrets", 0, "vpn").Store(&stored); err != nil {
-			secs = map[string]string{"password": creds.Password}
+			log.Warnf("[saveVPNCredentials] GetSecrets failed: %v", err)
+			return
 		}
-		for field := range secs {
+		if storedVPN, ok := stored["vpn"]; ok {
+			if storedSecrets, ok := storedVPN["secrets"]; ok {
+				saved, _ := storedSecrets.Value().(map[string]string)
+				for field, value := range saved {
+					secs[field] = value
+				}
+			}
+		}
+		for field, value := range creds.PersistentSecrets {
+			secs[field] = value
 			data[field+"-flags"] = "0"
 		}
+	}
+
+	if creds.SavePassword {
+		toSave := creds.Secrets
+		if len(toSave) == 0 {
+			toSave = map[string]string{"password": creds.Password}
+		}
+		for field, value := range toSave {
+			secs[field] = value
+			data[field+"-flags"] = "0"
+		}
+	}
+	if len(secs) > 0 {
 		vpn["secrets"] = dbus.MakeVariant(secs)
-		log.Infof("[saveVPNCredentials] Saving %d secret field(s) with flags=0", len(secs))
+		log.Infof("[saveVPNCredentials] Saving %d secret field(s)", len(secs))
 	}
 
 	vpn["data"] = dbus.MakeVariant(data)

core/internal/server/network/backend_networkmanager_vpn_test.go

@@ -1,10 +1,14 @@
 package network
 
 import (
+	"context"
+	"os"
+	"path/filepath"
 	"testing"
 
 	mock_gonetworkmanager "github.com/AvengeMedia/DankMaterialShell/core/internal/mocks/github.com/Wifx/gonetworkmanager/v2"
 	"github.com/Wifx/gonetworkmanager/v2"
+	"github.com/godbus/dbus/v5"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -136,3 +140,137 @@ func TestNetworkManagerBackend_UpdateVPNConnectionState_EmptyUUID(t *testing.T)
 		backend.updateVPNConnectionState()
 	})
 }
+
+func TestDetectVPNAuthAction_FortinetPasswordOnly(t *testing.T) {
+	service := "org.freedesktop.NetworkManager.openconnect"
+
+	assert.Equal(t, "openconnect_password", detectVPNAuthAction(service, map[string]string{
+		"protocol": "fortinet",
+		"authtype": "password",
+	}))
+	assert.Empty(t, detectVPNAuthAction(service, map[string]string{
+		"protocol": "anyconnect",
+		"authtype": "password",
+	}))
+	assert.Empty(t, detectVPNAuthAction(service, map[string]string{
+		"protocol": "fortinet",
+		"authtype": "saml",
+	}))
+}
+
+func TestEnsureOpenConnectAgentFlags(t *testing.T) {
+	data := map[string]string{"protocol": "fortinet"}
+	assert.True(t, setOpenConnectAgentFlags(data))
+	assert.Equal(t, "2", data["cookie-flags"])
+	assert.Equal(t, "2", data["gateway-flags"])
+	assert.Equal(t, "2", data["gwcert-flags"])
+	assert.False(t, setOpenConnectAgentFlags(data))
+}
+
+func TestOpenConnectCertificateConfirmation(t *testing.T) {
+	binDir := t.TempDir()
+	openConnectPath := filepath.Join(binDir, "openconnect")
+	script := `#!/bin/sh
+case "$*" in
+  *--servercert=pin-sha256:TEST-FINGERPRINT*)
+    printf '%s\n' "COOKIE='SVPNCOOKIE=test'" "HOST='vpn.example.test'" "FINGERPRINT='pin-sha256:TEST-FINGERPRINT'"
+    exit 0
+    ;;
+esac
+printf '%s\n' 'Add --servercert pin-sha256:TEST-FINGERPRINT' >&2
+exit 1
+`
+	assert.NoError(t, os.WriteFile(openConnectPath, []byte(script), 0o755))
+	t.Setenv("PATH", binDir)
+
+	conn := mock_gonetworkmanager.NewMockConnection(t)
+	connPath := dbus.ObjectPath("/org/freedesktop/NetworkManager/Settings/999")
+	conn.EXPECT().GetSecrets("vpn").Return(gonetworkmanager.ConnectionSettings{
+		"vpn": {"secrets": map[string]string{"password": "test-password"}},
+	}, nil)
+	conn.EXPECT().GetPath().Return(connPath).Twice()
+
+	broker := &fakePromptBroker{
+		asked: make(chan PromptRequest, 1),
+		reply: PromptReply{},
+	}
+	backend := &NetworkManagerBackend{promptBroker: broker}
+	data := map[string]string{
+		"gateway":  "vpn.example.test:443",
+		"protocol": "fortinet",
+		"authtype": "password",
+		"username": "test-user",
+	}
+
+	result, err := backend.handleOpenConnectPasswordAuth(
+		context.Background(), conn, "Test VPN", "test-uuid",
+		"org.freedesktop.NetworkManager.openconnect", data,
+	)
+	assert.NoError(t, err)
+	assert.Equal(t, "SVPNCOOKIE=test", result.Cookie)
+	assert.Equal(t, "vpn.example.test:443", result.Host)
+
+	prompt := <-broker.asked
+	assert.Equal(t, "server-certificate", prompt.Reason)
+	assert.Equal(t, []string{"pin-sha256:TEST-FINGERPRINT"}, prompt.Hints)
+
+	assert.Equal(t, map[string]string{
+		"certificate:vpn.example.test:443": "pin-sha256:TEST-FINGERPRINT",
+	}, backend.pendingVPNSave.PersistentSecrets)
+}
+
+func TestOpenConnectCertificateRotationReprompts(t *testing.T) {
+	binDir := t.TempDir()
+	openConnectPath := filepath.Join(binDir, "openconnect")
+	script := `#!/bin/sh
+case "$*" in
+  *--servercert=pin-sha256:NEW-FINGERPRINT*)
+    printf '%s\n' "COOKIE='SVPNCOOKIE=test'" "HOST='vpn.example.test'" "FINGERPRINT='pin-sha256:NEW-FINGERPRINT'"
+    exit 0
+    ;;
+esac
+printf '%s\n' 'Add --servercert pin-sha256:NEW-FINGERPRINT' >&2
+exit 1
+`
+	assert.NoError(t, os.WriteFile(openConnectPath, []byte(script), 0o755))
+	t.Setenv("PATH", binDir)
+
+	conn := mock_gonetworkmanager.NewMockConnection(t)
+	connPath := dbus.ObjectPath("/org/freedesktop/NetworkManager/Settings/999")
+	conn.EXPECT().GetSecrets("vpn").Return(gonetworkmanager.ConnectionSettings{
+		"vpn": {"secrets": map[string]string{
+			"password":                         "test-password",
+			"certificate:vpn.example.test:443": "pin-sha256:OLD-FINGERPRINT",
+		}},
+	}, nil)
+	conn.EXPECT().GetPath().Return(connPath).Twice()
+
+	broker := &fakePromptBroker{
+		asked: make(chan PromptRequest, 1),
+		reply: PromptReply{},
+	}
+	backend := &NetworkManagerBackend{promptBroker: broker}
+	data := map[string]string{
+		"gateway":  "vpn.example.test:443",
+		"protocol": "fortinet",
+		"authtype": "password",
+		"username": "test-user",
+	}
+
+	result, err := backend.handleOpenConnectPasswordAuth(
+		context.Background(), conn, "Test VPN", "test-uuid",
+		"org.freedesktop.NetworkManager.openconnect", data,
+	)
+	assert.NoError(t, err)
+	assert.Equal(t, "SVPNCOOKIE=test", result.Cookie)
+
+	prompt := <-broker.asked
+	assert.Equal(t, "server-certificate-changed", prompt.Reason)
+	assert.Equal(t, []string{"pin-sha256:NEW-FINGERPRINT"}, prompt.Hints)
+
+	assert.Equal(t, map[string]string{
+		"certificate:vpn.example.test:443": "pin-sha256:NEW-FINGERPRINT",
+	}, backend.pendingVPNSave.PersistentSecrets)
+	assert.False(t, backend.pendingVPNSave.SavePassword)
+	assert.Empty(t, backend.pendingVPNSave.Secrets)
+}

core/internal/server/network/handlers.go

@@ -43,6 +43,8 @@ func HandleRequest(conn *models.Conn, req models.Request, manager *Manager) {
 		handleGetNetworkQRCode(conn, req, manager)
 	case "network.qrcode-content":
 		handleGetNetworkQRCodeContent(conn, req, manager)
+	case "network.generate-qrcode":
+		handleGenerateQRCode(conn, req)
 	case "network.delete-qrcode":
 		handleDeleteQRCode(conn, req, manager)
 	case "network.ethernet.info":
@@ -365,6 +367,22 @@ func handleGetNetworkQRCodeContent(conn *models.Conn, req models.Request, manage
 	models.Respond(conn, req.ID, content)
 }
 
+func handleGenerateQRCode(conn *models.Conn, req models.Request) {
+	text, err := params.String(req.Params, "text")
+	if err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+
+	paths, err := generateTextQRCode(text)
+	if err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+
+	models.Respond(conn, req.ID, paths)
+}
+
 func handleDeleteQRCode(conn *models.Conn, req models.Request, _ *Manager) {
 	path, err := params.String(req.Params, "path")
 	if err != nil {

core/internal/server/network/qr_generator.go

@@ -0,0 +1,64 @@
+package network
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/yeqown/go-qrcode/v2"
+	"github.com/yeqown/go-qrcode/writer/standard"
+)
+
+const textQRCodeTmpPrefix = "/tmp/dank-text-qrcode-"
+
+func generateTextQRCode(text string) ([2]string, error) {
+	qrc, err := qrcode.New(text)
+	if err != nil {
+		return [2]string{}, fmt.Errorf("failed to create QR code for text: %w", err)
+	}
+
+	pathThemed, pathNormal := textQRCodePaths(text)
+
+	if err := saveQRCodePNG(qrc, pathThemed, standard.WithBgTransparent(), standard.WithFgColorRGBHex("#ffffff")); err != nil {
+		return [2]string{}, err
+	}
+	if err := saveQRCodePNG(qrc, pathNormal); err != nil {
+		return [2]string{}, err
+	}
+
+	return [2]string{pathThemed, pathNormal}, nil
+}
+
+// Write to a temp file and rename into place so the shell's Image never
+// observes a partially written PNG.
+func saveQRCodePNG(qrc *qrcode.QRCode, path string, opts ...standard.ImageOption) error {
+	tmpPath := path + ".tmp"
+	opts = append(opts, standard.WithBuiltinImageEncoder(standard.PNG_FORMAT))
+
+	w, err := standard.New(tmpPath, opts...)
+	if err != nil {
+		return fmt.Errorf("failed to create QR code writer: %w", err)
+	}
+	if err := qrc.Save(w); err != nil {
+		os.Remove(tmpPath)
+		return fmt.Errorf("failed to save QR code: %w", err)
+	}
+	if err := os.Rename(tmpPath, path); err != nil {
+		os.Remove(tmpPath)
+		return fmt.Errorf("failed to move QR code into place: %w", err)
+	}
+	return nil
+}
+
+// Paths are unique per generation, not per text: the library's mask selection
+// is non-deterministic, so regenerating the same text produces different
+// bytes, and reusing a path lets the shell's URL-keyed pixmap cache serve a
+// stale pattern over the new file.
+func textQRCodePaths(text string) (themed, normal string) {
+	hash := fmt.Sprintf("%x", sha256.Sum256([]byte(text)))[:8]
+	nonce := time.Now().UnixNano()
+	themed = fmt.Sprintf("%s%s-%d-themed.png", textQRCodeTmpPrefix, hash, nonce)
+	normal = fmt.Sprintf("%s%s-%d-normal.png", textQRCodeTmpPrefix, hash, nonce)
+	return
+}

core/internal/server/network/wifi_qrcode.go

@@ -24,7 +24,7 @@ func qrCodePaths(ssid string) (themed, normal string) {
 
 func isValidQRCodePath(path string) bool {
 	clean := filepath.Clean(path)
-	return strings.HasPrefix(clean, qrCodeTmpPrefix) && strings.HasSuffix(clean, ".png")
+	return (strings.HasPrefix(clean, qrCodeTmpPrefix) || strings.HasPrefix(clean, textQRCodeTmpPrefix)) && strings.HasSuffix(clean, ".png")
 }
 
 var safePathChar = regexp.MustCompile(`[^a-zA-Z0-9_-]`)

core/internal/server/registries/handlers.go

@@ -0,0 +1,83 @@
+package registries
+
+import (
+	"fmt"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/registries"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/models"
+	"github.com/spf13/afero"
+)
+
+type RegistryInfo struct {
+	Name     string `json:"name"`
+	URL      string `json:"url"`
+	Official bool   `json:"official"`
+}
+
+type SuccessResult struct {
+	Success bool   `json:"success"`
+	Message string `json:"message"`
+}
+
+func HandleRequest(conn *models.Conn, req models.Request) {
+	switch req.Method {
+	case "registries.list":
+		HandleList(conn, req)
+	case "registries.add":
+		HandleAdd(conn, req)
+	case "registries.remove":
+		HandleRemove(conn, req)
+	default:
+		models.RespondError(conn, req.ID, fmt.Sprintf("unknown method: %s", req.Method))
+	}
+}
+
+func HandleList(conn *models.Conn, req models.Request) {
+	sources := registries.Load(afero.NewOsFs())
+	result := make([]RegistryInfo, len(sources))
+	for i, s := range sources {
+		result[i] = RegistryInfo{Name: s.Name, URL: s.URL, Official: s.Official()}
+	}
+	models.Respond(conn, req.ID, result)
+}
+
+func HandleAdd(conn *models.Conn, req models.Request) {
+	name, ok := models.Get[string](req, "name")
+	if !ok {
+		models.RespondError(conn, req.ID, "missing or invalid 'name' parameter")
+		return
+	}
+	url, ok := models.Get[string](req, "url")
+	if !ok {
+		models.RespondError(conn, req.ID, "missing or invalid 'url' parameter")
+		return
+	}
+
+	if err := registries.Add(afero.NewOsFs(), name, url); err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+
+	models.Respond(conn, req.ID, SuccessResult{
+		Success: true,
+		Message: fmt.Sprintf("registry added: %s", name),
+	})
+}
+
+func HandleRemove(conn *models.Conn, req models.Request) {
+	name, ok := models.Get[string](req, "name")
+	if !ok {
+		models.RespondError(conn, req.ID, "missing or invalid 'name' parameter")
+		return
+	}
+
+	if err := registries.Remove(afero.NewOsFs(), name); err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+
+	models.Respond(conn, req.ID, SuccessResult{
+		Success: true,
+		Message: fmt.Sprintf("registry removed: %s", name),
+	})
+}

core/internal/server/router.go

@@ -18,6 +18,7 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/models"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/network"
 	serverPlugins "github.com/AvengeMedia/DankMaterialShell/core/internal/server/plugins"
+	serverRegistries "github.com/AvengeMedia/DankMaterialShell/core/internal/server/registries"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/sysupdate"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/tailscale"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/thememode"
@@ -47,6 +48,11 @@ func RouteRequest(conn *models.Conn, req models.Request) {
 		return
 	}
 
+	if strings.HasPrefix(req.Method, "registries.") {
+		serverRegistries.HandleRequest(conn, req)
+		return
+	}
+
 	if strings.HasPrefix(req.Method, "theme.auto.") {
 		if themeModeManager == nil {
 			models.RespondError(conn, req.ID, "theme mode manager not initialized")

core/internal/server/server.go

@@ -36,7 +36,7 @@ import (
 	"github.com/AvengeMedia/dankgo/syncmap"
 )
 
-const APIVersion = 28
+const APIVersion = 29
 
 var CLIVersion = "dev"
 
@@ -1183,6 +1183,38 @@ func handleSubscribe(conn *models.Conn, req models.Request) {
 		}()
 	}
 
+	if shouldSubscribe("location") && locationManager != nil {
+		wg.Add(1)
+		locationChan := locationManager.Subscribe(clientID + "-location")
+		go func() {
+			defer wg.Done()
+			defer locationManager.Unsubscribe(clientID + "-location")
+
+			initialState := locationManager.GetState()
+			select {
+			case eventChan <- ServiceEvent{Service: "location", Data: initialState}:
+			case <-stopChan:
+				return
+			}
+
+			for {
+				select {
+				case state, ok := <-locationChan:
+					if !ok {
+						return
+					}
+					select {
+					case eventChan <- ServiceEvent{Service: "location", Data: state}:
+					case <-stopChan:
+						return
+					}
+				case <-stopChan:
+					return
+				}
+			}
+		}()
+	}
+
 	if shouldSubscribe("sysupdate") && sysUpdateManager != nil {
 		wg.Add(1)
 		sysupdateChan := sysUpdateManager.Subscribe(clientID + "-sysupdate")

core/internal/server/sysupdate/executor.go

@@ -143,7 +143,8 @@ func wrapInTerminal(term, title, shellCmd string, extraArgs []string) []string {
 	case "konsole":
 		argv = []string{term, "-p", "tabtitle=" + title}
 	case "gnome-terminal":
-		argv = []string{term, "--title=" + title}
+		// --wait: the factory process otherwise returns immediately
+		argv = []string{term, "--wait", "--title=" + title}
 		execFlag = "--"
 	default:
 		argv = []string{term}

core/internal/server/sysupdate/manager.go

@@ -412,23 +412,28 @@ func (m *Manager) runCustomUpgrade(ctx context.Context, opts UpgradeOptions) {
 	onLine := func(line string) { m.appendLog(line) }
 	argv := wrapInTerminal(term, "DMS — System Update (custom)", opts.CustomCommand, opts.TerminalArgs)
 	if err := Run(ctx, argv, RunOptions{OnLine: onLine}); err != nil {
-		code := ErrCodeBackendFailed
 		switch {
 		case errors.Is(ctx.Err(), context.DeadlineExceeded):
-			code = ErrCodeTimeout
+			m.failCustomUpgrade(ErrCodeTimeout, err)
+			return
 		case errors.Is(ctx.Err(), context.Canceled):
-			code = ErrCodeCancelled
+			m.failCustomUpgrade(ErrCodeCancelled, err)
+			return
 		}
+		// exit status reflects the trailing `read`, not the update command
+		m.appendLog(fmt.Sprintf("Terminal exited early: %v", err))
+	}
+
+	m.finishSuccessfulUpgrade(false)
+	m.runRefresh(context.Background(), false)
+}
+
+func (m *Manager) failCustomUpgrade(code ErrorCode, err error) {
 	m.mu.Lock()
 	m.state.Phase = PhaseError
 	m.state.Error = &ErrorInfo{Code: code, Message: err.Error()}
 	m.mu.Unlock()
 	m.markDirty()
-		return
-	}
-
-	m.finishSuccessfulUpgrade(false)
-	m.runRefresh(context.Background(), false)
 }
 
 func (m *Manager) finishSuccessfulUpgrade(clearPackages bool) {

core/internal/server/sysupdate/upgrade_commands_test.go

@@ -233,3 +233,27 @@ func TestUpgradeBackendsFiltersFlatpakOnly(t *testing.T) {
 		t.Fatalf("upgradeBackends(mixed) = %#v, want dnf5 then flatpak", got)
 	}
 }
+
+func TestWrapInTerminal(t *testing.T) {
+	tests := []struct {
+		term       string
+		wantPrefix []string
+	}{
+		{"kitty", []string{"kitty", "--class", "com.danklinux.dms", "-T", "Title"}},
+		{"gnome-terminal", []string{"gnome-terminal", "--wait", "--title=Title"}},
+		{"foot", []string{"foot", "--app-id=com.danklinux.dms", "--title=Title"}},
+	}
+	for _, tt := range tests {
+		got := wrapInTerminal(tt.term, "Title", "echo hi", nil)
+		if len(got) < len(tt.wantPrefix) || !reflect.DeepEqual(got[:len(tt.wantPrefix)], tt.wantPrefix) {
+			t.Errorf("wrapInTerminal(%q) = %#v, want prefix %#v", tt.term, got, tt.wantPrefix)
+		}
+		tail := got[len(got)-3:]
+		if tail[0] != "sh" || tail[1] != "-c" {
+			t.Errorf("wrapInTerminal(%q) tail = %#v, want [sh -c <cmd>]", tt.term, tail)
+		}
+		if !strings.Contains(tail[2], "echo hi") {
+			t.Errorf("wrapInTerminal(%q) command %q does not contain shell command", tt.term, tail[2])
+		}
+	}
+}

core/internal/server/wayland/manager.go

@@ -759,6 +759,9 @@ func (m *Manager) schedulerLoop() {
 
 		now := time.Now()
 		m.recalcSchedule(now)
+		// publish independent of output readiness so night status never
+		// presents a stale schedule while applies are blocked (#2967)
+		m.updateStateFromSchedule()
 
 		waitDur := 24 * time.Hour
 		if enabled {
@@ -1104,13 +1107,15 @@ func (m *Manager) SetTemperature(low, high int) error {
 		m.configMutex.Unlock()
 		return nil
 	}
-	m.config.LowTemp = low
+	updated := m.config
-	m.config.HighTemp = high
+	updated.LowTemp = low
-	err := m.config.Validate()
+	updated.HighTemp = high
+	if err := updated.Validate(); err != nil {
 		m.configMutex.Unlock()
-	if err != nil {
 		return err
 	}
+	m.config = updated
+	m.configMutex.Unlock()
 	m.triggerUpdate()
 	return nil
 }
@@ -1122,14 +1127,16 @@ func (m *Manager) SetLocation(lat, lon float64) error {
 		m.configMutex.Unlock()
 		return nil
 	}
-	m.config.Latitude = &lat
+	updated := m.config
-	m.config.Longitude = &lon
+	updated.Latitude = &lat
-	m.config.UseIPLocation = false
+	updated.Longitude = &lon
-	err := m.config.Validate()
+	updated.UseIPLocation = false
+	if err := updated.Validate(); err != nil {
 		m.configMutex.Unlock()
-	if err != nil {
 		return err
 	}
+	m.config = updated
+	m.configMutex.Unlock()
 	m.triggerUpdate()
 	return nil
 }
@@ -1164,13 +1171,15 @@ func (m *Manager) SetManualTimes(sunrise, sunset time.Time) error {
 		m.configMutex.Unlock()
 		return nil
 	}
-	m.config.ManualSunrise = &sunrise
+	updated := m.config
-	m.config.ManualSunset = &sunset
+	updated.ManualSunrise = &sunrise
-	err := m.config.Validate()
+	updated.ManualSunset = &sunset
+	if err := updated.Validate(); err != nil {
 		m.configMutex.Unlock()
-	if err != nil {
 		return err
 	}
+	m.config = updated
+	m.configMutex.Unlock()
 	m.triggerUpdate()
 	return nil
 }
@@ -1193,12 +1202,14 @@ func (m *Manager) SetGamma(gamma float64) error {
 		m.configMutex.Unlock()
 		return nil
 	}
-	m.config.Gamma = gamma
+	updated := m.config
-	err := m.config.Validate()
+	updated.Gamma = gamma
+	if err := updated.Validate(); err != nil {
 		m.configMutex.Unlock()
-	if err != nil {
 		return err
 	}
+	m.config = updated
+	m.configMutex.Unlock()
 	m.triggerUpdate()
 	return nil
 }

core/internal/server/wayland/manager_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/stretchr/testify/assert"
 
 	mocks_wlclient "github.com/AvengeMedia/DankMaterialShell/core/internal/mocks/wlclient"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/wlr_gamma_control"
 )
 
 func TestManager_ActorSerializesOutputStateAccess(t *testing.T) {
@@ -412,3 +413,75 @@ func TestNewManager_InvalidConfig(t *testing.T) {
 	_, err := NewManager(mockDisplay, config)
 	assert.Error(t, err)
 }
+
+func TestSetters_RejectedValuesLeaveConfigUntouched(t *testing.T) {
+	newManager := func() *Manager {
+		return &Manager{
+			config:        DefaultConfig(),
+			updateTrigger: make(chan struct{}, 1),
+		}
+	}
+
+	t.Run("SetTemperature", func(t *testing.T) {
+		m := newManager()
+		before := m.config
+
+		err := m.SetTemperature(3200, 2500)
+		assert.Error(t, err)
+		assert.Equal(t, before, m.config)
+		assert.Empty(t, m.updateTrigger)
+	})
+
+	t.Run("SetLocation", func(t *testing.T) {
+		m := newManager()
+		before := m.config
+
+		err := m.SetLocation(120.0, 10.0)
+		assert.Error(t, err)
+		assert.Equal(t, before, m.config)
+		assert.Empty(t, m.updateTrigger)
+	})
+
+	t.Run("SetGamma", func(t *testing.T) {
+		m := newManager()
+		before := m.config
+
+		err := m.SetGamma(-1.0)
+		assert.Error(t, err)
+		assert.Equal(t, before, m.config)
+		assert.Empty(t, m.updateTrigger)
+	})
+}
+
+func TestSetters_ValidValuesCommitAndTrigger(t *testing.T) {
+	m := &Manager{
+		config:        DefaultConfig(),
+		updateTrigger: make(chan struct{}, 1),
+	}
+
+	err := m.SetTemperature(3000, 6000)
+	assert.NoError(t, err)
+	assert.Equal(t, 3000, m.config.LowTemp)
+	assert.Equal(t, 6000, m.config.HighTemp)
+	assert.Len(t, m.updateTrigger, 1)
+}
+
+func TestApplyGamma_SkipsUnchangedTempAndGamma(t *testing.T) {
+	m := &Manager{config: DefaultConfig()}
+	m.controlsInitialized = true
+
+	out := &outputState{
+		id:           1,
+		rampSize:     256,
+		gammaControl: &wlr_gamma_control.ZwlrGammaControlV1{},
+		lastTemp:     5000,
+		lastGamma:    m.config.Gamma,
+	}
+	m.outputs.Store(out.id, out)
+
+	m.applyGamma(5000)
+
+	assert.False(t, out.failed, "unchanged temp must not reach the compositor write path")
+	assert.Equal(t, 5000, out.lastTemp)
+	assert.Equal(t, uint32(256), out.rampSize)
+}

core/internal/themes/registry.go

@@ -7,12 +7,11 @@ import (
 	"os"
 	"path/filepath"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/registries"
 	"github.com/go-git/go-git/v6"
 	"github.com/spf13/afero"
 )
 
-const registryRepo = "https://github.com/AvengeMedia/dms-plugin-registry.git"
-
 type ColorScheme struct {
 	Primary                 string `json:"primary,omitempty"`
 	PrimaryText             string `json:"primaryText,omitempty"`
@@ -151,6 +150,7 @@ type Theme struct {
 type GitClient interface {
 	PlainClone(path string, url string) error
 	Pull(path string) error
+	OriginURL(path string) (string, error)
 }
 
 type realGitClient struct{}
@@ -182,9 +182,26 @@ func (g *realGitClient) Pull(path string) error {
 	return nil
 }
 
+func (g *realGitClient) OriginURL(path string) (string, error) {
+	repo, err := git.PlainOpen(path)
+	if err != nil {
+		return "", err
+	}
+	remote, err := repo.Remote("origin")
+	if err != nil {
+		return "", err
+	}
+	urls := remote.Config().URLs
+	if len(urls) == 0 {
+		return "", errors.New("origin remote has no URL")
+	}
+	return urls[0], nil
+}
+
 type Registry struct {
 	fs         afero.Fs
 	cacheDir   string
+	registries []registries.Source
 	themes     []Theme
 	git        GitClient
 }
@@ -194,61 +211,63 @@ func NewRegistry() (*Registry, error) {
 }
 
 func NewRegistryWithFs(fs afero.Fs) (*Registry, error) {
-	cacheDir := getCacheDir()
 	return &Registry{
 		fs:         fs,
-		cacheDir: cacheDir,
+		cacheDir:   getCacheDir(),
+		registries: registries.Load(fs),
 		git:        &realGitClient{},
 	}, nil
 }
 
+func (r *Registry) cacheDirFor(src registries.Source) string {
+	return filepath.Join(r.cacheDir, src.Name)
+}
+
 func getCacheDir() string {
 	return filepath.Join(os.TempDir(), "dankdots-plugin-registry")
 }
 
-func (r *Registry) Update() error {
+// A cached clone is reused only when its origin still matches the configured
-	exists, err := afero.DirExists(r.fs, r.cacheDir)
+// URL; renamed or re-pointed registries re-clone instead of pulling from the
+// stale remote.
+func (r *Registry) updateOne(src registries.Source) error {
+	dir := r.cacheDirFor(src)
+	exists, err := afero.DirExists(r.fs, dir)
 	if err != nil {
 		return fmt.Errorf("failed to check cache directory: %w", err)
 	}
 
-	if !exists {
+	if exists {
-		if err := r.fs.MkdirAll(filepath.Dir(r.cacheDir), 0o755); err != nil {
+		origin, originErr := r.git.OriginURL(dir)
+		if originErr == nil && origin == src.URL && r.git.Pull(dir) == nil {
+			return nil
+		}
+		if err := r.fs.RemoveAll(dir); err != nil {
+			return fmt.Errorf("failed to remove stale registry cache: %w", err)
+		}
+	}
+
+	if err := r.fs.MkdirAll(filepath.Dir(dir), 0o755); err != nil {
 		return fmt.Errorf("failed to create cache directory: %w", err)
 	}
-
+	if err := r.git.PlainClone(dir, src.URL); err != nil {
-		if err := r.git.PlainClone(r.cacheDir, registryRepo); err != nil {
+		return fmt.Errorf("failed to clone: %w", err)
-			return fmt.Errorf("failed to clone registry: %w", err)
 	}
-	} else {
+	return nil
-		if err := r.git.Pull(r.cacheDir); err != nil {
-			if err := r.fs.RemoveAll(r.cacheDir); err != nil {
-				return fmt.Errorf("failed to remove corrupted registry: %w", err)
 }
 
-			if err := r.fs.MkdirAll(filepath.Dir(r.cacheDir), 0o755); err != nil {
+// A registry without a themes/ directory is a valid plugins-only registry.
-				return fmt.Errorf("failed to create cache directory: %w", err)
+func (r *Registry) loadThemesFrom(dir string) ([]Theme, error) {
-			}
+	themesDir := filepath.Join(dir, "themes")
-
-			if err := r.git.PlainClone(r.cacheDir, registryRepo); err != nil {
-				return fmt.Errorf("failed to re-clone registry: %w", err)
-			}
-		}
-	}
-
-	return r.loadThemes()
-}
-
-func (r *Registry) loadThemes() error {
-	themesDir := filepath.Join(r.cacheDir, "themes")
-
 	entries, err := afero.ReadDir(r.fs, themesDir)
 	if err != nil {
-		return fmt.Errorf("failed to read themes directory: %w", err)
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("failed to read themes directory: %w", err)
 	}
 
-	r.themes = []Theme{}
+	var themes []Theme
-
 	for _, entry := range entries {
 		if !entry.IsDir() {
 			continue
@@ -278,10 +297,46 @@ func (r *Registry) loadThemes() error {
 			theme.PreviewPath = previewPath
 		}
 
-		r.themes = append(r.themes, theme)
+		themes = append(themes, theme)
+	}
+	return themes, nil
 }
 
-	return nil
+// Pre-multi-registry caches were a single clone at the base dir; the per-name
+// layout nests under it, so a leftover clone is deleted wholesale first.
+func (r *Registry) resetLegacyCache() {
+	if exists, _ := afero.DirExists(r.fs, filepath.Join(r.cacheDir, ".git")); exists {
+		_ = r.fs.RemoveAll(r.cacheDir)
+	}
+}
+
+// Update refreshes every configured registry, aggregating themes in
+// declaration order (first occurrence of an ID wins). A failing registry is
+// reported in the joined error but does not block the others.
+func (r *Registry) Update() error {
+	r.resetLegacyCache()
+	r.themes = []Theme{}
+	seen := make(map[string]struct{})
+	var errs []error
+	for _, src := range r.registries {
+		if err := r.updateOne(src); err != nil {
+			errs = append(errs, fmt.Errorf("registry %s: %w", src.Name, err))
+			continue
+		}
+		themes, err := r.loadThemesFrom(r.cacheDirFor(src))
+		if err != nil {
+			errs = append(errs, fmt.Errorf("registry %s: %w", src.Name, err))
+			continue
+		}
+		for _, t := range themes {
+			if _, dup := seen[t.ID]; dup {
+				continue
+			}
+			seen[t.ID] = struct{}{}
+			r.themes = append(r.themes, t)
+		}
+	}
+	return errors.Join(errs...)
 }
 
 func loadThemeWCAG(fs afero.Fs, themeDir string) *ThemeWCAG {
@@ -300,7 +355,7 @@ func loadThemeWCAG(fs afero.Fs, themeDir string) *ThemeWCAG {
 
 func (r *Registry) List() ([]Theme, error) {
 	if len(r.themes) == 0 {
-		if err := r.Update(); err != nil {
+		if err := r.Update(); err != nil && len(r.themes) == 0 {
 			return nil, err
 		}
 	}
@@ -343,11 +398,25 @@ func (r *Registry) Get(idOrName string) (*Theme, error) {
 }
 
 func (r *Registry) GetThemeSourcePath(themeID string) string {
-	return filepath.Join(r.cacheDir, "themes", themeID, "theme.json")
+	// Themes may live under any registry's subdir. Search them all; first hit wins.
+	for _, cfg := range r.registries {
+		candidate := filepath.Join(r.cacheDirFor(cfg), "themes", themeID, "theme.json")
+		if exists, _ := afero.Exists(r.fs, candidate); exists {
+			return candidate
+		}
+	}
+	// Fallback to first registry (legacy path semantics).
+	return filepath.Join(r.cacheDirFor(r.registries[0]), "themes", themeID, "theme.json")
 }
 
 func (r *Registry) GetThemeDir(themeID string) string {
-	return filepath.Join(r.cacheDir, "themes", themeID)
+	for _, cfg := range r.registries {
+		candidate := filepath.Join(r.cacheDirFor(cfg), "themes", themeID)
+		if exists, _ := afero.DirExists(r.fs, candidate); exists {
+			return candidate
+		}
+	}
+	return filepath.Join(r.cacheDirFor(r.registries[0]), "themes", themeID)
 }
 
 func SortByFirstParty(themes []Theme) []Theme {

core/internal/themes/registry_test.go

@@ -1,8 +1,10 @@
 package themes
 
 import (
+	"os"
 	"testing"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/registries"
 	"github.com/spf13/afero"
 )
 
@@ -64,3 +66,73 @@ func TestLoadThemeWCAGInvalidJSON(t *testing.T) {
 		t.Fatalf("expected nil for invalid wcag.json, got %+v", wcag)
 	}
 }
+
+type stubGitClient struct {
+	cloneFunc func(path string, url string) error
+}
+
+func (s *stubGitClient) PlainClone(path string, url string) error {
+	if s.cloneFunc != nil {
+		return s.cloneFunc(path, url)
+	}
+	return nil
+}
+func (s *stubGitClient) Pull(path string) error                { return nil }
+func (s *stubGitClient) OriginURL(path string) (string, error) { return "", os.ErrNotExist }
+
+func writeTestTheme(t *testing.T, fs afero.Fs, registryDir, themeID, name string) {
+	dir := registryDir + "/themes/" + themeID
+	if err := fs.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	themeJSON := `{"id":"` + themeID + `","name":"` + name + `","version":"1.0","author":"a","description":"d"}`
+	if err := afero.WriteFile(fs, dir+"/theme.json", []byte(themeJSON), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestUpdateMultiRegistry(t *testing.T) {
+	fs := afero.NewMemMapFs()
+	base := "/test-cache"
+	r := &Registry{
+		fs:       fs,
+		cacheDir: base,
+		registries: []registries.Source{
+			{Name: "official", URL: "https://example.com/official.git"},
+			{Name: "extra", URL: "https://example.com/extra.git"},
+		},
+		themes: []Theme{},
+	}
+	r.git = &stubGitClient{
+		cloneFunc: func(path string, url string) error {
+			switch path {
+			case base + "/official":
+				writeTestTheme(t, fs, path, "shared", "OfficialShared")
+				writeTestTheme(t, fs, path, "one", "One")
+			case base + "/extra":
+				writeTestTheme(t, fs, path, "shared", "ExtraShared")
+				writeTestTheme(t, fs, path, "two", "Two")
+			}
+			return nil
+		},
+	}
+
+	if err := r.Update(); err != nil {
+		t.Fatalf("Update: %v", err)
+	}
+	if len(r.themes) != 3 {
+		t.Fatalf("expected 3 themes after dedupe, got %d", len(r.themes))
+	}
+	for _, theme := range r.themes {
+		if theme.ID == "shared" && theme.Name != "OfficialShared" {
+			t.Fatalf("first registry should win for duplicate ID, got %q", theme.Name)
+		}
+	}
+
+	if dir := r.GetThemeDir("two"); dir != base+"/extra/themes/two" {
+		t.Fatalf("expected theme dir under extra registry, got %q", dir)
+	}
+	if path := r.GetThemeSourcePath("one"); path != base+"/official/themes/one/theme.json" {
+		t.Fatalf("expected theme source under official registry, got %q", path)
+	}
+}

flake.lock

@@ -3,11 +3,11 @@
     "dank-qml-common": {
       "flake": false,
       "locked": {
-        "lastModified": 1784935106,
+        "lastModified": 1786121412,
-        "narHash": "sha256-aVgOBRynme6XNKYCZlf/oCjPDZFwddyUQPRRkEupC3c=",
+        "narHash": "sha256-XHNpDNfQfjP6nIscd26GK6ydgBdVN5gknYGOVxXBWLw=",
         "owner": "AvengeMedia",
         "repo": "dank-qml-common",
-        "rev": "a172b39841d8f42bac46ac133b76cade1fae91b4",
+        "rev": "28fde7311296cbd041e5b704e54a481082b92b18",
         "type": "github"
       },
       "original": {

flake.nix

@@ -111,7 +111,7 @@
               inherit version;
               pname = "dms-shell";
               src = ./core;
-              vendorHash = "sha256-ZvaOPC92ZFRPqSyLJa2TA9OUKQ3QnWCIMxrnYLGnC58=";
+              vendorHash = "sha256-pjaRyB6E2TZvVd5a4xcdGSRVr9Dg9wEG/5e+HdtZJCg=";
 
               subPackages = [ "cmd/dms" ];
 

quickshell/Common/CacheData.qml

@@ -11,16 +11,27 @@ Singleton {
     id: root
     readonly property var log: Log.scoped("CacheData")
 
-    readonly property int cacheConfigVersion: 1
+    readonly property int cacheConfigVersion: 2
 
     readonly property string _stateUrl: StandardPaths.writableLocation(StandardPaths.GenericCacheLocation)
     readonly property string _stateDir: Paths.strip(_stateUrl)
 
     property bool _loading: false
+    property bool _hasLoaded: false
+    property int _loadedCacheVersion: 0
+
+    readonly property var _pinKeys: ["brightnessDevicePins", "wifiNetworkPins", "bluetoothDevicePins", "audioInputDevicePins", "audioOutputDevicePins"]
+    readonly property var _dataKeys: ["wallpaperLastPath", "profileLastPath", "fileBrowserSettings"].concat(_pinKeys)
 
     property string wallpaperLastPath: ""
     property string profileLastPath: ""
 
+    property var brightnessDevicePins: ({})
+    property var wifiNetworkPins: ({})
+    property var bluetoothDevicePins: ({})
+    property var audioInputDevicePins: ({})
+    property var audioOutputDevicePins: ({})
+
     property var fileBrowserSettings: ({
             "wallpaper": {
                 "lastPath": "",
@@ -78,8 +89,46 @@ Singleton {
 
     function loadCache() {
         _loading = true;
+        try {
             parseCache(cacheFile.text());
+        } finally {
             _loading = false;
+            _hasLoaded = true;
+        }
+    }
+
+    function set(key, value) {
+        if (_dataKeys.indexOf(key) < 0) {
+            log.warn("Unknown cache key:", key);
+            return;
+        }
+        root[key] = value;
+        saveCache();
+    }
+
+    function migratePins(pins) {
+        if (!pins)
+            return;
+        if (!_hasLoaded)
+            loadCache();
+        if (_loadedCacheVersion >= cacheConfigVersion)
+            return;
+
+        let migrated = false;
+        for (const key of _pinKeys) {
+            const legacy = pins[key];
+            if (!legacy || Object.keys(legacy).length === 0)
+                continue;
+            if (Object.keys(root[key] || {}).length > 0)
+                continue;
+            root[key] = legacy;
+            migrated = true;
+        }
+
+        if (!migrated)
+            return;
+        log.info("Migrated device pins from settings.json");
+        saveCache();
     }
 
     function parseCache(content) {
@@ -87,6 +136,7 @@ Singleton {
         try {
             if (content && content.trim()) {
                 const cache = JSON.parse(content);
+                _loadedCacheVersion = cache.configVersion || 0;
 
                 wallpaperLastPath = cache.wallpaperLastPath !== undefined ? cache.wallpaperLastPath : "";
                 profileLastPath = cache.profileLastPath !== undefined ? cache.profileLastPath : "";
@@ -122,6 +172,10 @@ Singleton {
                     };
                 }
 
+                for (const key of _pinKeys) {
+                    root[key] = cache[key] !== undefined ? cache[key] : {};
+                }
+
                 if (cache.configVersion === undefined) {
                     migrateFromUndefinedToV1(cache);
                     cleanupUnusedKeys();
@@ -138,12 +192,16 @@ Singleton {
     function saveCache() {
         if (_loading)
             return;
-        cacheFile.setText(JSON.stringify({
+        const data = {
             "wallpaperLastPath": wallpaperLastPath,
             "profileLastPath": profileLastPath,
             "fileBrowserSettings": fileBrowserSettings,
             "configVersion": cacheConfigVersion
-        }, null, 2));
+        };
+        for (const key of _pinKeys) {
+            data[key] = root[key];
+        }
+        cacheFile.setText(JSON.stringify(data, null, 2));
     }
 
     function migrateFromUndefinedToV1(cache) {
@@ -151,7 +209,7 @@ Singleton {
     }
 
     function cleanupUnusedKeys() {
-        const validKeys = ["wallpaperLastPath", "profileLastPath", "fileBrowserSettings", "configVersion"];
+        const validKeys = _dataKeys.concat(["configVersion"]);
 
         try {
             const content = cacheFile.text();

quickshell/Common/CacheUtils.qml

@@ -1,29 +0,0 @@
-pragma Singleton
-pragma ComponentBehavior: Bound
-import QtQuick
-import Quickshell
-import qs.Common
-
-Singleton {
-    id: root
-
-    function clearImageCache() {
-        Quickshell.execDetached(["rm", "-rf", Paths.stringify(Paths.imagecache)]);
-        Paths.mkdir(Paths.imagecache);
-    }
-
-    function clearOldCache(ageInMinutes) {
-        Quickshell.execDetached(["find", Paths.stringify(Paths.imagecache), "-name", "*.png", "-mmin", `+${ageInMinutes}`, "-delete"]);
-    }
-
-    function clearCacheForSize(size) {
-        Quickshell.execDetached(["find", Paths.stringify(Paths.imagecache), "-name", `*@${size}x${size}.png`, "-delete"]);
-    }
-
-    function getCacheSize(callback) {
-        Proc.runCommand("cache_size", ["du", "-sm", Paths.stringify(Paths.imagecache)], function (output, exitCode) {
-            const sizeMB = parseInt(output.split("\t")[0]) || 0;
-            callback(sizeMB);
-        });
-    }
-}

quickshell/Common/ConnectedSurfaceDescriptor.js

@@ -114,26 +114,6 @@ function withRevision(descriptor, revision) {
     return next;
 }
 
-function withAnimationOffset(descriptor, x, y) {
-    var next = normalize(descriptor);
-    next.animationOffset = {
-        "x": x === undefined ? next.animationOffset.x : _number(x, next.animationOffset.x),
-        "y": y === undefined ? next.animationOffset.y : _number(y, next.animationOffset.y)
-    };
-    return next;
-}
-
-function withBodyRect(descriptor, x, y, width, height) {
-    var next = normalize(descriptor);
-    next.bodyRect = {
-        "x": x === undefined ? next.bodyRect.x : _number(x, next.bodyRect.x),
-        "y": y === undefined ? next.bodyRect.y : _number(y, next.bodyRect.y),
-        "width": width === undefined ? next.bodyRect.width : Math.max(0, _number(width, next.bodyRect.width)),
-        "height": height === undefined ? next.bodyRect.height : Math.max(0, _number(height, next.bodyRect.height))
-    };
-    return next;
-}
-
 function same(a, b, threshold) {
     if (!a || !b)
         return false;

quickshell/Common/ConnectedSurfaceGeometry.js

@@ -162,21 +162,6 @@ function fillBounds(rect, side, seamOverlap, dpr) {
     };
 }
 
-function clipEnvelope(rect, side, radii, seamOverlap, dpr) {
-    var fill = fillBounds(rect, side, seamOverlap, dpr);
-    var chrome = chromeBounds(fill, side, radii.start, radii.end, radii.farExtent, dpr);
-    return {
-        "x": chrome.x,
-        "y": chrome.y,
-        "width": chrome.width,
-        "height": chrome.height,
-        "bodyX": snap(fill.x - chrome.x, dpr),
-        "bodyY": snap(fill.y - chrome.y, dpr),
-        "bodyWidth": fill.width,
-        "bodyHeight": fill.height
-    };
-}
-
 function blurRegions(descriptor, rect, radii, dpr) {
     var side = descriptor.barSide;
     var regions = [bodyRect(rect, dpr)];
@@ -219,14 +204,3 @@ function unionBounds(rects, padding, dpr) {
         "height": Math.max(0, snap(maxY - minY + pad * 2, dpr))
     };
 }
-
-function shadowSourceBounds(descriptor, rect, radii, padding, dpr) {
-    return unionBounds(blurRegions(descriptor, rect, radii, dpr), padding, dpr);
-}
-
-function stableEqual(a, b, dpr) {
-    if (!a || !b)
-        return false;
-    var threshold = 0.5 / (dpr || 1);
-    return Math.abs(a.x - b.x) < threshold && Math.abs(a.y - b.y) < threshold && Math.abs(a.width - b.width) < threshold && Math.abs(a.height - b.height) < threshold;
-}

quickshell/Common/ConnectorGeometry.js

@@ -44,16 +44,6 @@ function connectorX(barSide, baseX, bodyWidth, placement, spacing, radius) {
     return barSide === "left" ? s : s - w;
 }
 
-function connectorY(barSide, baseY, bodyHeight, placement, spacing, radius) {
-    var s = seamY(barSide, baseY, bodyHeight, placement);
-    var h = connectorHeight(barSide, spacing, radius);
-    if (barSide === "top")
-        return s;
-    if (barSide === "bottom")
-        return s - h;
-    return placement === "left" ? s - h : s;
-}
-
 // Which corner of the connector's bounding rect hosts the concave arc that
 // carves into the body. Used for arc-sweep orientation.
 function arcCorner(barSide, placement) {

quickshell/Common/Format.js

@@ -0,0 +1,72 @@
+.pragma library
+
+function formatRate(bytesPerSec, gbDecimals) {
+    if (bytesPerSec < 1024)
+        return bytesPerSec.toFixed(0) + " B/s";
+    if (bytesPerSec < 1024 * 1024)
+        return (bytesPerSec / 1024).toFixed(1) + " KB/s";
+    if (bytesPerSec < 1024 * 1024 * 1024)
+        return (bytesPerSec / (1024 * 1024)).toFixed(1) + " MB/s";
+    return (bytesPerSec / (1024 * 1024 * 1024)).toFixed(gbDecimals ?? 2) + " GB/s";
+}
+
+function formatBytes(bytes) {
+    if (bytes < 1024)
+        return bytes.toFixed(0) + "B";
+    if (bytes < 1024 * 1024)
+        return (bytes / 1024).toFixed(0) + "K";
+    if (bytes < 1024 * 1024 * 1024)
+        return (bytes / (1024 * 1024)).toFixed(1) + "M";
+    return (bytes / (1024 * 1024 * 1024)).toFixed(1) + "G";
+}
+
+function formatIsoTime(isoString) {
+    if (!isoString)
+        return "";
+    try {
+        const date = new Date(isoString);
+        if (isNaN(date.getTime()))
+            return "";
+        return date.toLocaleTimeString(Qt.locale(), "HH:mm");
+    } catch (e) {
+        return "";
+    }
+}
+
+function formatRemaining(ms, zeroText, minText, hText, hmText) {
+    if (ms <= 0)
+        return zeroText;
+    const totalMinutes = Math.ceil(ms / 60000);
+    if (totalMinutes < 60)
+        return minText.arg(totalMinutes);
+    const hours = Math.floor(totalMinutes / 60);
+    const mins = totalMinutes - hours * 60;
+    if (mins === 0)
+        return hText.arg(hours);
+    return hmText.arg(hours).arg(mins);
+}
+
+function pad2(n) {
+    return n < 10 ? "0" + n : "" + n;
+}
+
+function formatUntil(ts, use24h) {
+    if (!ts)
+        return "";
+    const d = new Date(ts);
+    const hours = d.getHours();
+    const minutes = d.getMinutes();
+    if (use24h)
+        return pad2(hours) + ":" + pad2(minutes);
+    const suffix = hours >= 12 ? "PM" : "AM";
+    const h12 = ((hours + 11) % 12) + 1;
+    return h12 + ":" + pad2(minutes) + " " + suffix;
+}
+
+function addToHistory(arr, val, max) {
+    const newArr = arr.slice();
+    newArr.push(val);
+    if (newArr.length > max)
+        newArr.shift();
+    return newArr;
+}

quickshell/Common/KeyUtils.js

@@ -271,3 +271,61 @@ function getConflictingBinds(keyCombo, currentAction, allBinds, modKey) {
     }
     return conflicts;
 }
+
+function qtKeyFromName(name) {
+    var n = (name || "").toUpperCase();
+    if (n.length === 1 && n >= "A" && n <= "Z")
+        return Qt.Key_A + (n.charCodeAt(0) - 65);
+    if (n.length === 1 && n >= "0" && n <= "9")
+        return Qt.Key_0 + (n.charCodeAt(0) - 48);
+    if (n.length >= 2 && n[0] === "F") {
+        var f = parseInt(n.slice(1), 10);
+        if (f >= 1 && f <= 12)
+            return Qt.Key_F1 + (f - 1);
+    }
+    var named = {
+        "SPACE": Qt.Key_Space,
+        "TAB": Qt.Key_Tab,
+        "RETURN": Qt.Key_Return,
+        "ENTER": Qt.Key_Enter,
+        "BACKSPACE": Qt.Key_Backspace,
+        "DELETE": Qt.Key_Delete,
+        "HOME": Qt.Key_Home,
+        "END": Qt.Key_End,
+        "UP": Qt.Key_Up,
+        "DOWN": Qt.Key_Down,
+        "LEFT": Qt.Key_Left,
+        "RIGHT": Qt.Key_Right
+    };
+    return named[n] || 0;
+}
+
+function isModifierKey(qk) {
+    return qk === Qt.Key_Control || qk === Qt.Key_Shift || qk === Qt.Key_Alt || qk === Qt.Key_Meta
+        || qk === Qt.Key_NumLock || qk === Qt.Key_CapsLock || qk === Qt.Key_ScrollLock;
+}
+
+function eventMatchesCombo(event, combo) {
+    if (!combo)
+        return false;
+    var parts = combo.split("+");
+    var keyName = parts[parts.length - 1].trim().toUpperCase();
+    var wantsShift = false;
+    var hasCtrl = false;
+    for (var i = 0; i < parts.length - 1; i++) {
+        var mod = parts[i].trim().toLowerCase();
+        if (mod === "shift")
+            wantsShift = true;
+        else if (mod === "ctrl" || mod === "control")
+            hasCtrl = true;
+        else
+            return false;
+    }
+    if (hasCtrl && !(event.modifiers & Qt.ControlModifier))
+        return false;
+    if (event.modifiers & (Qt.AltModifier | Qt.MetaModifier))
+        return false;
+    if (((event.modifiers & Qt.ShiftModifier) !== 0) !== wantsShift)
+        return false;
+    return event.key === qtKeyFromName(keyName);
+}

quickshell/Common/KeybindActions.js

@@ -1370,10 +1370,3 @@ function buildDmsAction(baseKey, args) {
 
     return parts.join(" ");
 }
-
-function getScreenshotOptions() {
-    return [
-        { id: "write-to-disk", label: "Save to disk", type: "bool" },
-        { id: "show-pointer", label: "Show pointer", type: "bool" }
-    ];
-}

quickshell/Common/ModalManager.qml

@@ -15,7 +15,11 @@ Singleton {
     function openModal(modal) {
         PopoutManager.screenshotActive = false;
         const screenName = modal.effectiveScreen?.name ?? "unknown";
-        currentModalsByScreen[screenName] = modal;
+        var next = {};
+        for (var k in currentModalsByScreen)
+            next[k] = currentModalsByScreen[k];
+        next[screenName] = modal;
+        currentModalsByScreen = next;
         modalChanged();
         Qt.callLater(() => {
             if (!modal.allowStacking)
@@ -34,7 +38,12 @@ Singleton {
     function closeModal(modal) {
         const screenName = modal.effectiveScreen?.name ?? "unknown";
         if (currentModalsByScreen[screenName] === modal) {
-            delete currentModalsByScreen[screenName];
+            var next = {};
+            for (var k in currentModalsByScreen) {
+                if (k !== screenName)
+                    next[k] = currentModalsByScreen[k];
+            }
+            currentModalsByScreen = next;
             modalChanged();
         }
     }

quickshell/Common/Paths.qml

@@ -22,6 +22,10 @@ Singleton {
 
     readonly property url imagecache: `${cache}/imagecache`
 
+    property var iconResolver: null
+    property var desktopIconResolver: null
+    property var trashHandler: null
+
     Component.onCompleted: mkdir(imagecache)
 
     function stringify(path: url): string {
@@ -88,7 +92,7 @@ Singleton {
     function themedIconPath(name: string): string {
         if (!name)
             return "";
-        const themed = (typeof IconThemeService !== "undefined") ? IconThemeService.resolve(name) : "";
+        const themed = iconResolver ? iconResolver(name) : "";
         if (themed)
             return themed;
         return Quickshell.iconPath(name, true);
@@ -105,11 +109,15 @@ Singleton {
                 return moddedId;
             return themedIconPath(moddedId);
         }
-        return themedIconPath(iconName) || DesktopService.resolveIconPath(iconName);
+        if (!desktopIconResolver)
+            return themedIconPath(iconName);
+        return themedIconPath(iconName) || desktopIconResolver(iconName);
     }
 
     function trashPath(path: string, callback): void {
-        TrashService.trashPath(path, callback);
+        if (!trashHandler)
+            return;
+        trashHandler(path, callback);
     }
 
     function copyPathToClipboard(path: string): void {
@@ -125,7 +133,7 @@ Singleton {
             return toFileUrl(expandTilde(target));
         if (target.startsWith("file://"))
             return target;
-        const themed = (typeof IconThemeService !== "undefined") ? IconThemeService.resolve(target) : "";
+        const themed = iconResolver ? iconResolver(target) : "";
         if (themed)
             return themed;
         return "image://icon/" + target;
@@ -148,7 +156,9 @@ Singleton {
         if (icon && icon !== "")
             return icon;
 
-        return DesktopService.resolveIconPath(appId);
+        if (!desktopIconResolver)
+            return "";
+        return desktopIconResolver(appId);
     }
 
     function getAppName(appId: string, desktopEntry: var): string {

quickshell/Common/QmlUtils.js

@@ -0,0 +1,27 @@
+.pragma library
+
+function findParentFlickable(item) {
+    while (item) {
+        if (item.hasOwnProperty("contentY") && item.hasOwnProperty("contentItem"))
+            return item;
+        item = item.parent;
+    }
+    return null;
+}
+
+function findSettings(item) {
+    while (item) {
+        if (item.saveValue !== undefined && item.loadValue !== undefined)
+            return item;
+        item = item.parent;
+    }
+    return null;
+}
+
+function normalizePinList(value) {
+    if (Array.isArray(value))
+        return value.filter(v => v);
+    if (typeof value === "string" && value.length > 0)
+        return [value];
+    return [];
+}

quickshell/Common/SessionData.qml

@@ -16,6 +16,10 @@ Singleton {
 
     readonly property int sessionConfigVersion: 3
 
+    signal loaded
+    signal brightnessDisplayHintChanged(string deviceName)
+    signal loadErrorOccurred(string file, string message)
+
     property bool _parseError: false
     property bool _hasLoaded: false
     property bool _isReadOnly: false
@@ -144,6 +148,7 @@ Singleton {
     property var includedTransitions: availableWallpaperTransitions.filter(t => t !== "none")
 
     property bool wallpaperCyclingEnabled: false
+    property bool wallpaperCyclingRandom: false
     property string wallpaperCyclingMode: "interval"
     property int wallpaperCyclingInterval: 300
     property string wallpaperCyclingTime: "06:00"
@@ -276,15 +281,14 @@ Singleton {
             if (typeof Theme !== "undefined")
                 Theme.generateSystemThemesFromCurrentTheme();
 
-            if (typeof WallpaperCyclingService !== "undefined")
+            loaded();
-                WallpaperCyclingService.updateCyclingState();
 
             _checkSessionWritable();
         } catch (e) {
             _parseError = true;
             const msg = e.message;
             log.error("Failed to parse session.json - file will not be overwritten.");
-            Qt.callLater(() => ToastService.showError(I18n.tr("Failed to parse %1").arg("session.json"), msg));
+            Qt.callLater(() => loadErrorOccurred("session.json", msg));
         }
     }
 
@@ -358,13 +362,12 @@ Singleton {
             if (typeof Theme !== "undefined")
                 Theme.generateSystemThemesFromCurrentTheme();
 
-            if (typeof WallpaperCyclingService !== "undefined")
+            loaded();
-                WallpaperCyclingService.updateCyclingState();
         } catch (e) {
             _parseError = true;
             const msg = e.message;
             log.error("Failed to parse session.json - file will not be overwritten.");
-            Qt.callLater(() => ToastService.showError(I18n.tr("Failed to parse %1").arg("session.json"), msg));
+            Qt.callLater(() => loadErrorOccurred("session.json", msg));
         }
     }
 
@@ -465,11 +468,6 @@ Singleton {
         saveSettings();
     }
 
-    function setWallpaperPath(path) {
-        wallpaperPath = path;
-        saveSettings();
-    }
-
     function setWallpaper(imagePath) {
         wallpaperPath = imagePath;
         if (perModeWallpaper) {
@@ -649,6 +647,11 @@ Singleton {
         saveSettings();
     }
 
+    function setWallpaperCyclingRandom(random) {
+        wallpaperCyclingRandom = random;
+        saveSettings();
+    }
+
     function setWallpaperCyclingMode(mode) {
         wallpaperCyclingMode = mode;
         saveSettings();
@@ -695,6 +698,37 @@ Singleton {
         saveSettings();
     }
 
+    function setMonitorCyclingRandom(screenName, random) {
+        var screen = null;
+        var screens = Quickshell.screens;
+        for (var i = 0; i < screens.length; i++) {
+            if (screens[i].name === screenName) {
+                screen = screens[i];
+                break;
+            }
+        }
+
+        if (!screen) {
+            log.warn("Screen not found");
+            return;
+        }
+
+        var identifier = typeof SettingsData !== "undefined" ? SettingsData.getScreenDisplayName(screen) : screen.name;
+
+        var newSettings = {};
+        for (var key in monitorCyclingSettings) {
+            var isThisScreen = key === screen.name || (screen.model && key === screen.model);
+            if (!isThisScreen) {
+                newSettings[key] = monitorCyclingSettings[key];
+            }
+        }
+
+        newSettings[identifier] = getMonitorCyclingSettings(screenName);
+        newSettings[identifier].random = random;
+        monitorCyclingSettings = newSettings;
+        saveSettings();
+    }
+
     function setMonitorCyclingMode(screenName, mode) {
         var screen = null;
         var screens = Quickshell.screens;
@@ -848,11 +882,6 @@ Singleton {
         saveSettings();
     }
 
-    function setNightModeLocationProvider(provider) {
-        nightModeLocationProvider = provider;
-        saveSettings();
-    }
-
     function setThemeModeAutoEnabled(enabled) {
         themeModeAutoEnabled = enabled;
         saveSettings();
@@ -941,10 +970,6 @@ Singleton {
         setBarPinnedApps(currentPinned);
     }
 
-    function isBarPinnedApp(appId) {
-        return appId && barPinnedApps.indexOf(appId) !== -1;
-    }
-
     function hideTrayId(trayId) {
         if (!trayId)
             return;
@@ -1007,11 +1032,6 @@ Singleton {
         saveSettings();
     }
 
-    function setLaunchPrefix(prefix) {
-        launchPrefix = prefix;
-        saveSettings();
-    }
-
     function setLastBrightnessDevice(device) {
         lastBrightnessDevice = device;
         saveSettings();
@@ -1026,10 +1046,7 @@ Singleton {
         }
         brightnessExponentialDevices = newSettings;
         saveSettings();
-
+        brightnessDisplayHintChanged(deviceName);
-        if (typeof DisplayService !== "undefined") {
-            DisplayService.updateDeviceBrightnessDisplay(deviceName);
-        }
     }
 
     function getBrightnessExponential(deviceName) {
@@ -1043,10 +1060,6 @@ Singleton {
         saveSettings();
     }
 
-    function getBrightnessUserSetValue(deviceName) {
-        return brightnessUserSetValues[deviceName];
-    }
-
     function clearBrightnessUserSetValue(deviceName) {
         var newValues = Object.assign({}, brightnessUserSetValues);
         delete newValues[deviceName];
@@ -1070,21 +1083,6 @@ Singleton {
         return value !== undefined ? value : 1.2;
     }
 
-    function setSelectedGpuIndex(index) {
-        selectedGpuIndex = index;
-        saveSettings();
-    }
-
-    function setNvidiaGpuTempEnabled(enabled) {
-        nvidiaGpuTempEnabled = enabled;
-        saveSettings();
-    }
-
-    function setNonNvidiaGpuTempEnabled(enabled) {
-        nonNvidiaGpuTempEnabled = enabled;
-        saveSettings();
-    }
-
     function setEnabledGpuPciIds(pciIds) {
         enabledGpuPciIds = pciIds;
         saveSettings();
@@ -1200,15 +1198,6 @@ Singleton {
         return deviceMaxVolumes[nodeName] ?? 100;
     }
 
-    function removeDeviceMaxVolume(nodeName) {
-        if (!nodeName)
-            return;
-        const updated = Object.assign({}, deviceMaxVolumes);
-        delete updated[nodeName];
-        deviceMaxVolumes = updated;
-        saveSettings();
-    }
-
     function updateLocale() {
         if (!locale) {
             I18n._pickTranslation();
@@ -1272,12 +1261,6 @@ Singleton {
         saveSettings();
     }
 
-    function clearLauncherHistory() {
-        launcherLastQuery = "";
-        launcherSearchHistory = [];
-        saveSettings();
-    }
-
     function setAppDrawerLastMode(mode) {
         appDrawerLastMode = mode;
         saveSettings();
@@ -1376,6 +1359,7 @@ Singleton {
     function getMonitorCyclingSettings(screenName) {
         var defaults = {
             "enabled": false,
+            "random": false,
             "mode": "interval",
             "interval": 300,
             "time": "06:00"
@@ -1417,141 +1401,4 @@ Singleton {
             }
         }
     }
-
-    IpcHandler {
-        target: "wallpaper"
-
-        function get(): string {
-            if (root.perMonitorWallpaper) {
-                return "ERROR: Per-monitor mode enabled. Use getFor(screenName) instead.";
-            }
-            return root.wallpaperPath || "";
-        }
-
-        function set(path: string): string {
-            if (root.perMonitorWallpaper) {
-                return "ERROR: Per-monitor mode enabled. Use setFor(screenName, path) instead.";
-            }
-
-            if (!path) {
-                return "ERROR: No path provided";
-            }
-
-            var absolutePath = path.startsWith("/") ? path : StandardPaths.writableLocation(StandardPaths.HomeLocation) + "/" + path;
-
-            try {
-                root.setWallpaper(absolutePath);
-                return "SUCCESS: Wallpaper set to " + absolutePath;
-            } catch (e) {
-                return "ERROR: Failed to set wallpaper: " + e.toString();
-            }
-        }
-
-        function clear(): string {
-            root.setWallpaper("");
-            root.setPerMonitorWallpaper(false);
-            root.monitorWallpapers = {};
-            root.saveSettings();
-            return "SUCCESS: All wallpapers cleared";
-        }
-
-        function next(): string {
-            if (root.perMonitorWallpaper) {
-                return "ERROR: Per-monitor mode enabled. Use nextFor(screenName) instead.";
-            }
-
-            if (!root.wallpaperPath) {
-                return "ERROR: No wallpaper set";
-            }
-
-            try {
-                WallpaperCyclingService.cycleNextManually();
-                return "SUCCESS: Cycling to next wallpaper";
-            } catch (e) {
-                return "ERROR: Failed to cycle wallpaper: " + e.toString();
-            }
-        }
-
-        function prev(): string {
-            if (root.perMonitorWallpaper) {
-                return "ERROR: Per-monitor mode enabled. Use prevFor(screenName) instead.";
-            }
-
-            if (!root.wallpaperPath) {
-                return "ERROR: No wallpaper set";
-            }
-
-            try {
-                WallpaperCyclingService.cyclePrevManually();
-                return "SUCCESS: Cycling to previous wallpaper";
-            } catch (e) {
-                return "ERROR: Failed to cycle wallpaper: " + e.toString();
-            }
-        }
-
-        function getFor(screenName: string): string {
-            if (!screenName) {
-                return "ERROR: No screen name provided";
-            }
-            return root.getMonitorWallpaper(screenName) || "";
-        }
-
-        function setFor(screenName: string, path: string): string {
-            if (!screenName) {
-                return "ERROR: No screen name provided";
-            }
-
-            if (!path) {
-                return "ERROR: No path provided";
-            }
-
-            var absolutePath = path.startsWith("/") ? path : StandardPaths.writableLocation(StandardPaths.HomeLocation) + "/" + path;
-
-            try {
-                if (!root.perMonitorWallpaper) {
-                    root.setPerMonitorWallpaper(true);
-                }
-                root.setMonitorWallpaper(screenName, absolutePath);
-                return "SUCCESS: Wallpaper set for " + screenName + " to " + absolutePath;
-            } catch (e) {
-                return "ERROR: Failed to set wallpaper for " + screenName + ": " + e.toString();
-            }
-        }
-
-        function nextFor(screenName: string): string {
-            if (!screenName) {
-                return "ERROR: No screen name provided";
-            }
-
-            var currentWallpaper = root.getMonitorWallpaper(screenName);
-            if (!currentWallpaper) {
-                return "ERROR: No wallpaper set for " + screenName;
-            }
-
-            try {
-                WallpaperCyclingService.cycleNextForMonitor(screenName);
-                return "SUCCESS: Cycling to next wallpaper for " + screenName;
-            } catch (e) {
-                return "ERROR: Failed to cycle wallpaper for " + screenName + ": " + e.toString();
-            }
-        }
-
-        function prevFor(screenName: string): string {
-            if (!screenName) {
-                return "ERROR: No screen name provided";
-            }
-
-            var currentWallpaper = root.getMonitorWallpaper(screenName);
-            if (!currentWallpaper) {
-                return "ERROR: No wallpaper set for " + screenName;
-            }
-
-            try {
-                WallpaperCyclingService.cyclePrevForMonitor(screenName);
-                return "SUCCESS: Cycling to previous wallpaper for " + screenName;
-            } catch (e) {
-                return "ERROR: Failed to cycle wallpaper for " + screenName + ": " + e.toString();
-            }
-        }
-    }
 }

quickshell/Common/SettingsData.qml

@@ -15,7 +15,7 @@ Singleton {
     id: root
     readonly property var log: Log.scoped("SettingsData")
 
-    readonly property int settingsConfigVersion: 12
+    readonly property int settingsConfigVersion: 13
 
     enum Position {
         Top,
@@ -164,6 +164,11 @@ Singleton {
     property string matugenTargetMonitor: ""
     property real popupTransparency: 1.0
     property real dockTransparency: 1
+    property bool floatingWindowSyncGlobal: true
+    property real floatingWindowTransparency: 1.0
+    property bool floatingWindowForegroundLayers: true
+    property real floatingWindowForegroundTransparency: 1.0
+    property bool dmsWindowsFloating: true
     property string widgetBackgroundColor: "sch"
     property string widgetBackgroundCustomColor: "#6750A4"
     property real widgetBackgroundCustomStrength: 0.50
@@ -203,6 +208,16 @@ Singleton {
     property bool touchpadTapAndDrag: true
     property bool touchpadTapToClick: true
 
+    property string keyboardLayouts: ""
+    property string keyboardVariants: ""
+    property string keyboardModel: ""
+    property string keyboardOptions: ""
+    property string keyboardKeymapFile: ""
+    property string keyboardTrackLayout: ""
+    property int keyboardRepeatDelay: 0
+    property int keyboardRepeatRate: 0
+    property bool keyboardNumlock: false
+
     property int firstDayOfWeek: -1
     property bool showWeekNumber: false
     property string calendarBackend: "auto"
@@ -254,6 +269,7 @@ Singleton {
     onBlurEnabledChanged: saveSettings()
     property bool blurForegroundLayers: true
     onBlurForegroundLayersChanged: saveSettings()
+    property real foregroundLayerTransparency: 1.0
     property real blurLayerOutlineOpacity: 0.12
     onBlurLayerOutlineOpacityChanged: saveSettings()
     property bool blurBorderEnabled: true
@@ -479,6 +495,7 @@ Singleton {
     property bool mediaAdaptiveWidthEnabled: true
     property bool audioVisualizerEnabled: true
     property bool mediaUseAlbumArtAccent: false
+    property bool appleMusicAnimatedArtEnabled: false
     property string audioScrollMode: "volume"
     property int audioWheelScrollAmount: 5
     property bool audioDeviceScrollVolumeEnabled: false
@@ -659,9 +676,6 @@ Singleton {
     readonly property string iconTheme: resolveIconTheme()
     property var availableIconThemes: ["System Default"]
     property string systemDefaultIconTheme: ""
-    property bool qt5ctAvailable: false
-    property bool qt6ctAvailable: false
-    property bool gtkAvailable: false
 
     property var cursorSettings: ({
             "theme": "System Default",
@@ -712,16 +726,23 @@ Singleton {
     property bool notepadUseCompositorGap: false
     property int notepadEdgeGap: 0
 
+    property string activeCompositor: ""
+
     // Compositor layout gap when enabled and available, else the manual value.
     readonly property int notepadEffectiveEdgeGap: {
         if (notepadUseCompositorGap) {
             var g = -1;
-            if (CompositorService.isNiri)
+            switch (activeCompositor) {
+            case "niri":
                 g = niriLayoutGapsOverride;
-            else if (CompositorService.isHyprland)
+                break;
+            case "hyprland":
                 g = hyprlandLayoutGapsOverride;
-            else if (CompositorService.isMango)
+                break;
+            case "mango":
                 g = mangoLayoutGapsOverride;
+                break;
+            }
             if (g >= 0)
                 return g;
         }
@@ -790,14 +811,7 @@ Singleton {
     property bool fadeToDpmsEnabled: true
     property int fadeToDpmsGracePeriod: 5
     property string launchPrefix: ""
-    property var brightnessDevicePins: ({})
-    property var wifiNetworkPins: ({})
-    property var bluetoothDevicePins: ({})
-    property var audioInputDevicePins: ({})
-    property var audioOutputDevicePins: ({})
 
-    property bool gtkThemingEnabled: false
-    property bool qtThemingEnabled: false
     property bool syncModeWithPortal: true
     property bool terminalsAlwaysDark: false
 
@@ -920,6 +934,8 @@ Singleton {
     property bool lockPamInlineU2f: false
     property bool lockPamExternallyManaged: false
     property string lockU2fPamPath: ""
+    property string lockScreenSecurityKeyShortcut: "Ctrl+Q"
+    property bool lockScreenSecurityKeyShortcutEnabled: false
     property bool greeterPamExternallyManaged: false
     property string lockScreenInactiveColor: "#000000"
     property int lockScreenNotificationMode: 0
@@ -974,6 +990,7 @@ Singleton {
     property string customPowerActionHibernate: ""
     property string customPowerActionReboot: ""
     property string customPowerActionPowerOff: ""
+    property var customPowerButtons: []
 
     property bool updaterHideWidget: false
     property bool updaterCheckOnStart: false
@@ -1131,44 +1148,6 @@ Singleton {
         saveSettings();
     }
 
-    function getSystemMonitorVariants() {
-        return systemMonitorVariants || [];
-    }
-
-    function createSystemMonitorVariant(name, config) {
-        const id = "sysmon_" + Date.now() + "_" + Math.random().toString(36).substr(2, 9);
-        const variant = {
-            id: id,
-            name: name,
-            config: config || getDefaultSystemMonitorConfig()
-        };
-        const variants = JSON.parse(JSON.stringify(systemMonitorVariants || []));
-        variants.push(variant);
-        systemMonitorVariants = variants;
-        saveSettings();
-        return variant;
-    }
-
-    function updateSystemMonitorVariant(variantId, updates) {
-        const variants = JSON.parse(JSON.stringify(systemMonitorVariants || []));
-        const idx = variants.findIndex(v => v.id === variantId);
-        if (idx === -1)
-            return;
-        Object.assign(variants[idx], updates);
-        systemMonitorVariants = variants;
-        saveSettings();
-    }
-
-    function removeSystemMonitorVariant(variantId) {
-        const variants = (systemMonitorVariants || []).filter(v => v.id !== variantId);
-        systemMonitorVariants = variants;
-        saveSettings();
-    }
-
-    function getSystemMonitorVariant(variantId) {
-        return (systemMonitorVariants || []).find(v => v.id === variantId) || null;
-    }
-
     function getDefaultSystemMonitorConfig() {
         return {
             showHeader: true,
@@ -1309,70 +1288,6 @@ Singleton {
         return (desktopWidgetInstances || []).find(inst => inst.id === instanceId) || null;
     }
 
-    function getDesktopWidgetInstancesOfType(widgetType) {
-        return (desktopWidgetInstances || []).filter(inst => inst.widgetType === widgetType);
-    }
-
-    function getEnabledDesktopWidgetInstances() {
-        return (desktopWidgetInstances || []).filter(inst => inst.enabled);
-    }
-
-    function moveDesktopWidgetInstance(instanceId, direction) {
-        const instances = JSON.parse(JSON.stringify(desktopWidgetInstances || []));
-        const idx = instances.findIndex(inst => inst.id === instanceId);
-        if (idx === -1)
-            return false;
-        const targetIdx = direction === "up" ? idx - 1 : idx + 1;
-        if (targetIdx < 0 || targetIdx >= instances.length)
-            return false;
-        const temp = instances[idx];
-        instances[idx] = instances[targetIdx];
-        instances[targetIdx] = temp;
-        desktopWidgetInstances = instances;
-        saveSettings();
-        return true;
-    }
-
-    function reorderDesktopWidgetInstance(instanceId, newIndex) {
-        const instances = JSON.parse(JSON.stringify(desktopWidgetInstances || []));
-        const idx = instances.findIndex(inst => inst.id === instanceId);
-        if (idx === -1 || newIndex < 0 || newIndex >= instances.length)
-            return false;
-        const [item] = instances.splice(idx, 1);
-        instances.splice(newIndex, 0, item);
-        desktopWidgetInstances = instances;
-        saveSettings();
-        return true;
-    }
-
-    function reorderDesktopWidgetInstanceInGroup(instanceId, groupId, newIndexInGroup) {
-        const instances = JSON.parse(JSON.stringify(desktopWidgetInstances || []));
-        const groups = desktopWidgetGroups || [];
-        const groupMatches = inst => {
-            if (groupId === null)
-                return !inst.group || !groups.some(g => g.id === inst.group);
-            return inst.group === groupId;
-        };
-        const groupInstances = instances.filter(groupMatches);
-        const currentGroupIdx = groupInstances.findIndex(inst => inst.id === instanceId);
-        if (currentGroupIdx === -1 || currentGroupIdx === newIndexInGroup)
-            return false;
-        if (newIndexInGroup < 0 || newIndexInGroup >= groupInstances.length)
-            return false;
-        const globalIdx = instances.findIndex(inst => inst.id === instanceId);
-        if (globalIdx === -1)
-            return false;
-        const [item] = instances.splice(globalIdx, 1);
-        const targetInstance = groupInstances[newIndexInGroup];
-        let targetGlobalIdx = instances.findIndex(inst => inst.id === targetInstance.id);
-        if (newIndexInGroup > currentGroupIdx)
-            targetGlobalIdx++;
-        instances.splice(targetGlobalIdx, 0, item);
-        desktopWidgetInstances = instances;
-        saveSettings();
-        return true;
-    }
-
     function moveDesktopWidgetInstanceToGroup(instanceId, groupId, newIndexInGroup) {
         const instances = JSON.parse(JSON.stringify(desktopWidgetInstances || []));
         const groups = desktopWidgetGroups || [];
@@ -1438,22 +1353,14 @@ Singleton {
         saveSettings();
     }
 
-    function getDesktopWidgetGroup(groupId) {
-        return (desktopWidgetGroups || []).find(g => g.id === groupId) || null;
-    }
-
-    function getDesktopWidgetInstancesByGroup(groupId) {
-        return (desktopWidgetInstances || []).filter(inst => inst.group === groupId);
-    }
-
-    function getUngroupedDesktopWidgetInstances() {
-        return (desktopWidgetInstances || []).filter(inst => !inst.group);
-    }
-
     signal forceDankBarLayoutRefresh
     signal forceDockLayoutRefresh
     signal widgetDataChanged
     signal workspaceIconsUpdated
+    signal compositorLayoutRefreshNeeded(bool frame)
+    signal compositorInputRefreshNeeded
+    signal compositorCursorRefreshNeeded
+    signal notificationPopupsInvalidated
 
     function refreshAuthAvailability() {
         Processes.detectAuthCapabilities();
@@ -1488,31 +1395,15 @@ Singleton {
     }
 
     function updateCompositorLayout() {
-        if (typeof CompositorService === "undefined")
+        compositorLayoutRefreshNeeded(false);
-            return;
-        if (CompositorService.isNiri && typeof NiriService !== "undefined")
-            NiriService.generateNiriLayoutConfig();
-        if (CompositorService.isHyprland && typeof HyprlandService !== "undefined")
-            HyprlandService.generateLayoutConfig();
-        if (CompositorService.isMango && typeof MangoService !== "undefined")
-            MangoService.generateLayoutConfig();
     }
 
     function updateCompositorInput() {
-        if (typeof CompositorService === "undefined")
+        compositorInputRefreshNeeded();
-            return;
-        if (CompositorService.isNiri && typeof NiriService !== "undefined")
-            NiriService.generateNiriInputConfig();
     }
 
     function updateFrameCompositorLayout() {
-        // Generate before begin() so compositor readiness is already pending at transitionRequested
+        compositorLayoutRefreshNeeded(true);
-        if (typeof CompositorService !== "undefined") {
-            if (CompositorService.isNiri && typeof NiriService !== "undefined")
-                NiriService.generateNiriLayoutConfig(true);
-            if (CompositorService.isHyprland && typeof HyprlandService !== "undefined")
-                HyprlandService.generateLayoutConfig(true);
-        }
         FrameTransitionState.begin();
     }
 
@@ -1757,6 +1648,7 @@ Singleton {
             let obj = (txt && txt.trim()) ? JSON.parse(txt) : null;
 
             const oldVersion = obj?.configVersion ?? 0;
+            const legacyPins = oldVersion < 13 ? Store.extractPins(obj) : null;
             if (oldVersion < settingsConfigVersion) {
                 const migrated = Store.migrateToVersion(obj, settingsConfigVersion);
                 if (migrated) {
@@ -1764,6 +1656,8 @@ Singleton {
                     obj = migrated;
                 }
             }
+            if (legacyPins)
+                Qt.callLater(() => CacheData.migratePins(legacyPins));
 
             if (obj?.lockScreenActiveMonitor !== undefined) {
                 var oldVal = obj.lockScreenActiveMonitor;
@@ -1804,7 +1698,6 @@ Singleton {
             _hasLoaded = true;
             applyStoredTheme();
             updateCompositorCursor();
-            Processes.detectQtTools();
             Qt.callLater(checkIconThemeDrift);
 
             _checkSettingsWritable();
@@ -2162,14 +2055,6 @@ Singleton {
         return showSeconds ? "h:mm:ss AP" : "h:mm AP";
     }
 
-    function getEffectiveClockDateFormat() {
-        return clockDateFormat && clockDateFormat.length > 0 ? clockDateFormat : "ddd d";
-    }
-
-    function getEffectiveLockDateFormat() {
-        return lockDateFormat && lockDateFormat.length > 0 ? lockDateFormat : Locale.LongFormat;
-    }
-
     function initializeListModels() {
         const defaultBar = barConfigs[0] || getBarConfig("default");
         if (defaultBar) {
@@ -2182,39 +2067,6 @@ Singleton {
         widgetDataChanged();
     }
 
-    function hasNamedWorkspaces() {
-        if (typeof NiriService === "undefined" || !CompositorService.isNiri)
-            return false;
-
-        for (var i = 0; i < NiriService.allWorkspaces.length; i++) {
-            var ws = NiriService.allWorkspaces[i];
-            if (ws.name && ws.name.trim() !== "")
-                return true;
-        }
-        return false;
-    }
-
-    function getNamedWorkspaces() {
-        var namedWorkspaces = [];
-        if (typeof NiriService === "undefined" || !CompositorService.isNiri)
-            return namedWorkspaces;
-
-        for (const ws of NiriService.allWorkspaces) {
-            if (ws.name && ws.name.trim() !== "") {
-                namedWorkspaces.push(ws.name);
-            }
-        }
-        return namedWorkspaces;
-    }
-
-    function getPopupYPosition(barHeight) {
-        const defaultBar = barConfigs[0] || getBarConfig("default");
-        const gothOffset = defaultBar?.gothCornersEnabled ? Theme.cornerRadius : 0;
-        const spacing = defaultBar?.spacing ?? 4;
-        const bottomGap = defaultBar?.bottomGap ?? 0;
-        return barHeight + spacing + bottomGap - gothOffset + Theme.popupDistance;
-    }
-
     function getPopupTriggerPosition(pos, screen, barThickness, widgetWidth, barSpacing, barPosition, barConfig) {
         const relativeX = pos.x;
         const relativeY = pos.y;
@@ -2508,51 +2360,10 @@ Singleton {
         updateBarConfigs();
 
         if (positionChanged) {
-            NotificationService.dismissAllPopups();
+            notificationPopupsInvalidated();
         }
     }
 
-    function checkBarCollisions(barId) {
-        const bar = getBarConfig(barId);
-        if (!bar || !bar.enabled)
-            return [];
-
-        const conflicts = [];
-        const enabledBars = getEnabledBarConfigs();
-
-        for (var i = 0; i < enabledBars.length; i++) {
-            const other = enabledBars[i];
-            if (other.id === barId)
-                continue;
-            const samePosition = bar.position === other.position;
-            if (!samePosition)
-                continue;
-            const barScreens = bar.screenPreferences || ["all"];
-            const otherScreens = other.screenPreferences || ["all"];
-
-            const hasAll = barScreens.includes("all") || otherScreens.includes("all");
-            if (hasAll) {
-                conflicts.push({
-                    "barId": other.id,
-                    "barName": other.name,
-                    "reason": "Same position on all screens"
-                });
-                continue;
-            }
-
-            const overlapping = barScreens.some(screen => otherScreens.includes(screen));
-            if (overlapping) {
-                conflicts.push({
-                    "barId": other.id,
-                    "barName": other.name,
-                    "reason": "Same position on overlapping screens"
-                });
-            }
-        }
-
-        return conflicts;
-    }
-
     function deleteBarConfig(barId) {
         if (barId === "default")
             return;
@@ -2701,38 +2512,6 @@ Singleton {
         return filtered;
     }
 
-    function getFrameFilteredScreens() {
-        var prefs = frameScreenPreferences || ["all"];
-        if (!prefs || prefs.length === 0 || prefs.includes("all")) {
-            return Quickshell.screens;
-        }
-        return Quickshell.screens.filter(screen => isScreenInPreferences(screen, prefs));
-    }
-
-    function getActiveBarEdgeForScreen(screen) {
-        if (!screen)
-            return "";
-        for (var i = 0; i < barConfigs.length; i++) {
-            var bc = barConfigs[i];
-            if (!bc.enabled)
-                continue;
-            var prefs = bc.screenPreferences || ["all"];
-            if (!prefs.includes("all") && !isScreenInPreferences(screen, prefs))
-                continue;
-            switch (bc.position ?? 0) {
-            case SettingsData.Position.Top:
-                return "top";
-            case SettingsData.Position.Bottom:
-                return "bottom";
-            case SettingsData.Position.Left:
-                return "left";
-            case SettingsData.Position.Right:
-                return "right";
-            }
-        }
-        return "";
-    }
-
     function getActiveBarEdgesForScreen(screen) {
         if (!screen)
             return [];
@@ -2791,51 +2570,19 @@ Singleton {
         return edges;
     }
 
-    function frameEdgeInsetForSide(screen, side) {
+    readonly property real frameBarContentGap: frameBarInsetPadding < 0 ? frameThickness : frameBarInsetPadding
-        if (!frameEnabled || !screen)
+    readonly property real frameBarContentGapExtra: Math.max(0, frameBarContentGap - frameThickness)
-            return 0;
-        const edges = getActiveBarEdgesForScreen(screen);
-        return edges.includes(side) ? frameBarSize : frameThickness;
-    }
 
-    function getActiveBarThicknessForScreen(screen) {
+    function frameEdgeReservation(screen, edge) {
-        if (frameEnabled)
-            return frameBarSize;
         if (!screen)
-            return frameThickness;
+            return 0;
-        for (var i = 0; i < barConfigs.length; i++) {
+        return getActiveBarEdgesForScreen(screen).includes(edge) ? frameBarSize : frameThickness;
-            var bc = barConfigs[i];
-            if (!bc.enabled)
-                continue;
-            var prefs = bc.screenPreferences || ["all"];
-            if (!prefs.includes("all") && !isScreenInPreferences(screen, prefs))
-                continue;
-            const innerPadding = bc.innerPadding ?? 4;
-            const barT = Math.max(26 + innerPadding * 0.6, Theme.barHeight - 4 - (8 - innerPadding));
-            const spacing = bc.spacing ?? 4;
-            const bottomGap = bc.bottomGap ?? 0;
-            return barT + spacing + bottomGap;
-        }
-        return frameThickness;
     }
 
-    function sendTestNotifications() {
+    function frameEdgeInsetForSide(screen, side) {
-        NotificationService.dismissAllPopups();
+        if (!frameEnabled)
-        sendTestNotification(0);
+            return 0;
-        testNotifTimer1.start();
+        return frameEdgeReservation(screen, side);
-        testNotifTimer2.start();
-    }
-
-    function sendTestNotification(index) {
-        const notifications = [["Notification Position Test", "DMS test notification 1 of 3 ~ Hi there!", "preferences-system"], ["Second Test", "DMS Notification 2 of 3 ~ Check it out!", "applications-graphics"], ["Third Test", "DMS notification 3 of 3 ~ Enjoy!", "face-smile"]];
-
-        if (index < 0 || index >= notifications.length) {
-            return;
-        }
-
-        const notif = notifications[index];
-        testNotificationProcess.command = ["notify-send", "-h", "int:transient:1", "-a", "DMS", "-i", notif[2], notif[0], notif[1]];
-        testNotificationProcess.running = true;
     }
 
     function setMatugenScheme(scheme) {
@@ -2854,15 +2601,6 @@ Singleton {
         set("matugenContrast", value);
     }
 
-    function setRunUserMatugenTemplates(enabled) {
-        if (runUserMatugenTemplates === enabled)
-            return;
-        set("runUserMatugenTemplates", enabled);
-        if (typeof Theme !== "undefined") {
-            Theme.generateSystemThemesFromCurrentTheme();
-        }
-    }
-
     function setMatugenTargetMonitor(monitorName) {
         if (matugenTargetMonitor === monitorName)
             return;
@@ -2881,11 +2619,6 @@ Singleton {
         SessionData.setWeatherLocation(displayName, coordinates);
     }
 
-    function setIconTheme(themeName) {
-        const light = iconThemePerMode && typeof SessionData !== "undefined" && SessionData.isLightMode;
-        setIconThemeForMode(themeName, light);
-    }
-
     function setIconThemeForMode(themeName, light) {
         if (light)
             iconThemeLight = themeName;
@@ -2931,20 +2664,7 @@ Singleton {
     // https://github.com/Supreeeme/xwayland-satellite/issues/104
     // no idea if this matters on other compositors but we also set XCURSOR stuff in the launcher
     function updateCompositorCursor() {
-        if (typeof CompositorService === "undefined")
+        compositorCursorRefreshNeeded();
-            return;
-        if (CompositorService.isNiri && typeof NiriService !== "undefined") {
-            NiriService.generateNiriCursorConfig();
-            return;
-        }
-        if (CompositorService.isHyprland && typeof HyprlandService !== "undefined") {
-            HyprlandService.generateCursorConfig();
-            return;
-        }
-        if (CompositorService.isMango && typeof MangoService !== "undefined") {
-            MangoService.generateCursorConfig();
-            return;
-        }
     }
 
     function updateXResources() {
@@ -3012,20 +2732,6 @@ Singleton {
         return env;
     }
 
-    function setGtkThemingEnabled(enabled) {
-        set("gtkThemingEnabled", enabled);
-        if (enabled && typeof Theme !== "undefined") {
-            Theme.generateSystemThemesFromCurrentTheme();
-        }
-    }
-
-    function setQtThemingEnabled(enabled) {
-        set("qtThemingEnabled", enabled);
-        if (enabled && typeof Theme !== "undefined") {
-            Theme.generateSystemThemesFromCurrentTheme();
-        }
-    }
-
     function setShowDock(enabled) {
         showDock = enabled;
         const defaultBar = barConfigs[0] || getBarConfig("default");
@@ -3071,16 +2777,6 @@ Singleton {
         Qt.callLater(() => forceDockLayoutRefresh());
     }
 
-    function setDankBarSpacing(spacing) {
-        const defaultBar = barConfigs[0] || getBarConfig("default");
-        if (defaultBar) {
-            updateBarConfig(defaultBar.id, {
-                "spacing": spacing
-            });
-        }
-        updateCompositorLayout();
-    }
-
     function setDankBarPosition(position) {
         const defaultBar = barConfigs[0] || getBarConfig("default");
         if (!defaultBar)
@@ -3136,39 +2832,6 @@ Singleton {
         }
     }
 
-    function resetDankBarWidgetsToDefault() {
-        var defaultLeft = ["launcherButton", "workspaceSwitcher", "focusedWindow"];
-        var defaultCenter = ["music", "clock", "weather"];
-        var defaultRight = ["systemTray", "clipboard", "notificationButton", "battery", "controlCenterButton"];
-        const defaultBar = barConfigs[0] || getBarConfig("default");
-        if (defaultBar) {
-            updateBarConfig(defaultBar.id, {
-                "leftWidgets": defaultLeft,
-                "centerWidgets": defaultCenter,
-                "rightWidgets": defaultRight
-            });
-        }
-        updateListModel(leftWidgetsModel, defaultLeft);
-        updateListModel(centerWidgetsModel, defaultCenter);
-        updateListModel(rightWidgetsModel, defaultRight);
-        showLauncherButton = true;
-        showWorkspaceSwitcher = true;
-        showFocusedWindow = true;
-        showWeather = true;
-        showMusic = true;
-        showClipboard = true;
-        showCpuUsage = true;
-        showMemUsage = true;
-        showCpuTemp = true;
-        showGpuTemp = true;
-        showSystemTray = true;
-        showClock = true;
-        showNotificationButton = true;
-        showBattery = true;
-        showControlCenterButton = true;
-        showCapsLockIndicator = true;
-    }
-
     function setWorkspaceNameIcon(workspaceName, iconData) {
         var iconMap = JSON.parse(JSON.stringify(workspaceNameIcons));
         iconMap[workspaceName] = iconData;
@@ -3450,15 +3113,6 @@ Singleton {
             Theme.reloadCustomThemeVariant();
     }
 
-    function toggleDankBarVisible() {
-        const defaultBar = barConfigs[0] || getBarConfig("default");
-        if (defaultBar) {
-            updateBarConfig(defaultBar.id, {
-                "visible": !defaultBar.visible
-            });
-        }
-    }
-
     function toggleShowDock() {
         setShowDock(!showDock);
     }
@@ -3480,13 +3134,6 @@ Singleton {
         savePluginSettings();
     }
 
-    function removePluginSettings(pluginId) {
-        if (pluginSettings[pluginId]) {
-            delete pluginSettings[pluginId];
-            savePluginSettings();
-        }
-    }
-
     function getPluginSettingsForPlugin(pluginId) {
         const settings = pluginSettings[pluginId];
         return settings ? JSON.parse(JSON.stringify(settings)) : {};
@@ -3512,22 +3159,6 @@ Singleton {
         return settings ? JSON.parse(JSON.stringify(settings)) : {};
     }
 
-    function setNiriOutputSettings(outputId, settings) {
-        const updated = JSON.parse(JSON.stringify(niriOutputSettings));
-        updated[outputId] = settings;
-        niriOutputSettings = updated;
-        saveSettings();
-    }
-
-    function removeNiriOutputSettings(outputId) {
-        if (!niriOutputSettings[outputId])
-            return;
-        const updated = JSON.parse(JSON.stringify(niriOutputSettings));
-        delete updated[outputId];
-        niriOutputSettings = updated;
-        saveSettings();
-    }
-
     function getHyprlandOutputSetting(outputId, key, defaultValue) {
         if (!hyprlandOutputSettings[outputId])
             return defaultValue;
@@ -3552,40 +3183,6 @@ Singleton {
         saveSettings();
     }
 
-    function getHyprlandOutputSettings(outputId) {
-        const settings = hyprlandOutputSettings[outputId];
-        return settings ? JSON.parse(JSON.stringify(settings)) : {};
-    }
-
-    function setHyprlandOutputSettings(outputId, settings) {
-        const updated = JSON.parse(JSON.stringify(hyprlandOutputSettings));
-        updated[outputId] = settings;
-        hyprlandOutputSettings = updated;
-        saveSettings();
-    }
-
-    function removeHyprlandOutputSettings(outputId) {
-        if (!hyprlandOutputSettings[outputId])
-            return;
-        const updated = JSON.parse(JSON.stringify(hyprlandOutputSettings));
-        delete updated[outputId];
-        hyprlandOutputSettings = updated;
-        saveSettings();
-    }
-
-    function getDisplayProfiles(compositor) {
-        return displayProfiles[compositor] || {};
-    }
-
-    function setDisplayProfile(compositor, profileId, data) {
-        const updated = JSON.parse(JSON.stringify(displayProfiles));
-        if (!updated[compositor])
-            updated[compositor] = {};
-        updated[compositor][profileId] = data;
-        displayProfiles = updated;
-        saveSettings();
-    }
-
     function removeDisplayProfile(compositor, profileId) {
         if (!displayProfiles[compositor] || !displayProfiles[compositor][profileId])
             return;
@@ -3639,29 +3236,6 @@ Singleton {
         id: rightWidgetsModel
     }
 
-    property Process testNotificationProcess
-
-    testNotificationProcess: Process {
-        command: []
-        running: false
-    }
-
-    property Timer testNotifTimer1
-
-    testNotifTimer1: Timer {
-        interval: 400
-        repeat: false
-        onTriggered: sendTestNotification(1)
-    }
-
-    property Timer testNotifTimer2
-
-    testNotifTimer2: Timer {
-        interval: 800
-        repeat: false
-        onTriggered: sendTestNotification(2)
-    }
-
     property alias settingsFile: settingsFile
 
     Timer {

quickshell/Common/StockThemes.js

@@ -416,24 +416,6 @@ const StockThemes = {
   },
 };
 
-const ThemeCategories = {
-  GENERIC: {
-    name: "Generic",
-    variants: [
-      "blue",
-      "purple",
-      "green",
-      "orange",
-      "red",
-      "cyan",
-      "pink",
-      "amber",
-      "coral",
-      "monochrome",
-    ],
-  },
-};
-
 const ThemeNames = {
   BLUE: "blue",
   PURPLE: "purple",
@@ -448,10 +430,6 @@ const ThemeNames = {
   DYNAMIC: "dynamic",
 };
 
-function isStockTheme(themeName) {
-  return Object.keys(StockThemes.DARK).includes(themeName);
-}
-
 function getAvailableThemes(isLight = false) {
   return isLight ? StockThemes.LIGHT : StockThemes.DARK;
 }
@@ -464,7 +442,3 @@ function getThemeByName(themeName, isLight = false) {
 function getAllThemeNames() {
   return Object.keys(StockThemes.DARK);
 }
-
-function getThemeCategories() {
-  return ThemeCategories;
-}

quickshell/Common/Theme.qml

@@ -96,8 +96,6 @@ Singleton {
     }
 
     property bool matugenAvailable: false
-    property bool gtkThemingEnabled: typeof SettingsData !== "undefined" ? SettingsData.gtkAvailable : false
-    property bool qtThemingEnabled: typeof SettingsData !== "undefined" ? (SettingsData.qt5ctAvailable || SettingsData.qt6ctAvailable) : false
     property var workerRunning: false
     property var pendingThemeRequest: null
 
@@ -107,8 +105,11 @@ Singleton {
     property int _colorsRetryCount: 0
     property double _lastGenerateMs: 0
 
-    property bool themeModeAutomationActive: false
+    property bool blurLayersActive: false
-    property bool dmsServiceWasDisconnected: true
+    property bool matugenToastSuppressed: false
+
+    signal screenTransitionNeeded
+    signal themeGenerationStarting
 
     readonly property var dank16: {
         const raw = matugenColors?.dank16;
@@ -144,7 +145,7 @@ Singleton {
         Quickshell.execDetached(["mkdir", "-p", stateDir]);
         // shellDir may be an embedded-UI extraction, which is read-only and
         // unexecutable (dankgo shellapp/shellfs makeReadOnly chmods 0444)
-        Quickshell.execDetached(["bash", shellDir + "/scripts/gtk.sh", configDir, "", "", shellDir]);
+        Quickshell.execDetached(["bash", shellDir + "/scripts/gtk.sh", configDir, "assets", "", shellDir]);
         Proc.runCommand("matugenCheck", ["sh", "-c", "command -v matugen"], (output, code) => {
             matugenAvailable = (code === 0) && !envDisableMatugen;
 
@@ -196,235 +197,6 @@ Singleton {
             const currentIsLight = (typeof SessionData !== "undefined") ? SessionData.isLightMode : false;
             SettingsData.updateCosmicThemeMode(currentIsLight);
         }
-
-        if (typeof SessionData !== "undefined" && SessionData.themeModeAutoEnabled) {
-            startThemeModeAutomation();
-        }
-    }
-
-    Connections {
-        target: SessionData
-        enabled: typeof SessionData !== "undefined"
-
-        function onThemeModeAutoEnabledChanged() {
-            if (SessionData.themeModeAutoEnabled) {
-                root.startThemeModeAutomation();
-            } else {
-                root.stopThemeModeAutomation();
-            }
-        }
-
-        function onThemeModeAutoModeChanged() {
-            if (root.themeModeAutomationActive) {
-                root.evaluateThemeMode();
-                root.syncTimeThemeSchedule();
-                root.syncLocationThemeSchedule();
-            }
-        }
-
-        function onThemeModeStartHourChanged() {
-            if (root.themeModeAutomationActive && !SessionData.themeModeShareGammaSettings) {
-                root.evaluateThemeMode();
-                root.syncTimeThemeSchedule();
-            }
-        }
-
-        function onThemeModeStartMinuteChanged() {
-            if (root.themeModeAutomationActive && !SessionData.themeModeShareGammaSettings) {
-                root.evaluateThemeMode();
-                root.syncTimeThemeSchedule();
-            }
-        }
-
-        function onThemeModeEndHourChanged() {
-            if (root.themeModeAutomationActive && !SessionData.themeModeShareGammaSettings) {
-                root.evaluateThemeMode();
-                root.syncTimeThemeSchedule();
-            }
-        }
-
-        function onThemeModeEndMinuteChanged() {
-            if (root.themeModeAutomationActive && !SessionData.themeModeShareGammaSettings) {
-                root.evaluateThemeMode();
-                root.syncTimeThemeSchedule();
-            }
-        }
-
-        function onThemeModeShareGammaSettingsChanged() {
-            if (root.themeModeAutomationActive) {
-                root.evaluateThemeMode();
-                root.syncTimeThemeSchedule();
-                root.syncLocationThemeSchedule();
-            }
-        }
-
-        function onNightModeStartHourChanged() {
-            if (root.themeModeAutomationActive && SessionData.themeModeShareGammaSettings) {
-                root.evaluateThemeMode();
-                root.syncTimeThemeSchedule();
-            }
-        }
-
-        function onNightModeStartMinuteChanged() {
-            if (root.themeModeAutomationActive && SessionData.themeModeShareGammaSettings) {
-                root.evaluateThemeMode();
-                root.syncTimeThemeSchedule();
-            }
-        }
-
-        function onNightModeEndHourChanged() {
-            if (root.themeModeAutomationActive && SessionData.themeModeShareGammaSettings) {
-                root.evaluateThemeMode();
-                root.syncTimeThemeSchedule();
-            }
-        }
-
-        function onNightModeEndMinuteChanged() {
-            if (root.themeModeAutomationActive && SessionData.themeModeShareGammaSettings) {
-                root.evaluateThemeMode();
-                root.syncTimeThemeSchedule();
-            }
-        }
-
-        function onLatitudeChanged() {
-            if (root.themeModeAutomationActive && SessionData.themeModeAutoMode === "location") {
-                if (!SessionData.nightModeUseIPLocation && SessionData.latitude !== 0.0 && SessionData.longitude !== 0.0 && typeof DMSService !== "undefined") {
-                    DMSService.sendRequest("wayland.gamma.setLocation", {
-                        "latitude": SessionData.latitude,
-                        "longitude": SessionData.longitude
-                    });
-                }
-                root.evaluateThemeMode();
-                root.syncLocationThemeSchedule();
-            }
-        }
-
-        function onLongitudeChanged() {
-            if (root.themeModeAutomationActive && SessionData.themeModeAutoMode === "location") {
-                if (!SessionData.nightModeUseIPLocation && SessionData.latitude !== 0.0 && SessionData.longitude !== 0.0 && typeof DMSService !== "undefined") {
-                    DMSService.sendRequest("wayland.gamma.setLocation", {
-                        "latitude": SessionData.latitude,
-                        "longitude": SessionData.longitude
-                    });
-                }
-                root.evaluateThemeMode();
-                root.syncLocationThemeSchedule();
-            }
-        }
-
-        function onNightModeUseIPLocationChanged() {
-            if (root.themeModeAutomationActive && SessionData.themeModeAutoMode === "location") {
-                if (typeof DMSService !== "undefined") {
-                    DMSService.sendRequest("wayland.gamma.setUseIPLocation", {
-                        "use": SessionData.nightModeUseIPLocation
-                    }, response => {
-                        if (!response.error && !SessionData.nightModeUseIPLocation && SessionData.latitude !== 0.0 && SessionData.longitude !== 0.0) {
-                            DMSService.sendRequest("wayland.gamma.setLocation", {
-                                "latitude": SessionData.latitude,
-                                "longitude": SessionData.longitude
-                            });
-                        }
-                    });
-                }
-                root.evaluateThemeMode();
-                root.syncLocationThemeSchedule();
-            }
-        }
-    }
-
-    // React to gamma backend's isDay state changes for location-based mode
-    Connections {
-        target: DisplayService
-        enabled: typeof DisplayService !== "undefined" && typeof SessionData !== "undefined" && SessionData.themeModeAutoEnabled && SessionData.themeModeAutoMode === "location" && !themeAutoBackendAvailable()
-
-        function onGammaIsDayChanged() {
-            if (root.isLightMode !== DisplayService.gammaIsDay) {
-                root.setLightMode(DisplayService.gammaIsDay, true, true);
-            }
-        }
-    }
-
-    Connections {
-        target: DMSService
-
-        function onThemeAutoStateUpdate(data) {
-            if (!SessionData.themeModeAutoEnabled) {
-                return;
-            }
-            applyThemeAutoState(data);
-        }
-
-        function onConnectionStateChanged() {
-            if (DMSService.isConnected && SessionData.themeModeAutoMode === "time") {
-                root.syncTimeThemeSchedule();
-            }
-
-            if (DMSService.isConnected && SessionData.themeModeAutoMode === "location") {
-                root.syncLocationThemeSchedule();
-            }
-
-            if (themeAutoBackendAvailable() && SessionData.themeModeAutoEnabled) {
-                DMSService.sendRequest("theme.auto.getState", null, response => {
-                    if (response && response.result) {
-                        applyThemeAutoState(response.result);
-                    }
-                });
-            }
-
-            if (!SessionData.themeModeAutoEnabled) {
-                return;
-            }
-
-            if (DMSService.isConnected && SessionData.themeModeAutoMode === "location") {
-                if (SessionData.nightModeUseIPLocation) {
-                    DMSService.sendRequest("wayland.gamma.setUseIPLocation", {
-                        "use": true
-                    }, response => {
-                        if (!response.error) {
-                            log.info("Theme automation: IP location enabled after connection");
-                        }
-                    });
-                } else if (SessionData.latitude !== 0.0 && SessionData.longitude !== 0.0) {
-                    DMSService.sendRequest("wayland.gamma.setUseIPLocation", {
-                        "use": false
-                    }, response => {
-                        if (!response.error) {
-                            DMSService.sendRequest("wayland.gamma.setLocation", {
-                                "latitude": SessionData.latitude,
-                                "longitude": SessionData.longitude
-                            }, locationResponse => {
-                                if (locationResponse?.error) {
-                                    log.warn("Theme automation: Failed to set location", locationResponse.error);
-                                }
-                            });
-                        }
-                    });
-                } else {
-                    log.warn("Theme automation: No location configured");
-                }
-            }
-        }
-    }
-
-    Connections {
-        target: SessionService
-        enabled: SessionData.themeModeAutoEnabled
-
-        function onSessionUnlocked() {
-            root.triggerThemeAutomationRefresh();
-        }
-
-        function onSessionResumed() {
-            root.triggerThemeAutomationRefresh();
-        }
-    }
-
-    function triggerThemeAutomationRefresh() {
-        if (!themeAutoBackendAvailable()) {
-            root.evaluateThemeMode();
-            return;
-        }
-        DMSService.sendRequest("theme.auto.trigger", {});
     }
 
     function getMatugenColor(path, fallback) {
@@ -571,13 +343,30 @@ Singleton {
     property color surfaceVariantAlpha: withAlpha(surfaceVariant, 0.2)
 
     readonly property bool foregroundLayers: typeof SettingsData === "undefined" || (SettingsData.blurForegroundLayers ?? true)
-    readonly property bool blurForegroundLayers: BlurService.enabled && foregroundLayers
+    readonly property bool blurForegroundLayers: blurLayersActive && foregroundLayers
-    readonly property bool transparentBlurLayers: BlurService.enabled && !foregroundLayers
+    readonly property bool transparentBlurLayers: blurLayersActive && !foregroundLayers
+    readonly property real foregroundLayerTransparency: typeof SettingsData === "undefined" ? 1.0 : (SettingsData.foregroundLayerTransparency ?? 1.0)
     readonly property bool notificationForegroundLayers: typeof SettingsData === "undefined" || (SettingsData.notificationForegroundLayers ?? true)
     readonly property color readableSurface: withAlpha(surfaceContainer, popupTransparency)
     readonly property color readableSurfaceHigh: withAlpha(surfaceContainerHigh, popupTransparency)
     readonly property color floatingSurface: foregroundLayers ? readableSurface : withAlpha(readableSurface, 0)
-    readonly property color floatingSurfaceHigh: foregroundLayers ? readableSurfaceHigh : withAlpha(readableSurfaceHigh, 0)
+    readonly property color floatingSurfaceHigh: foregroundLayers ? withAlpha(surfaceContainerHigh, foregroundLayerTransparency) : withAlpha(surfaceContainerHigh, 0)
+    readonly property bool floatingWindowSynced: typeof SettingsData === "undefined" || (SettingsData.floatingWindowSyncGlobal ?? true)
+    readonly property real floatingWindowTransparency: {
+        if (typeof SettingsData === "undefined" || floatingWindowSynced)
+            return popupTransparency;
+        return SettingsData.floatingWindowTransparency ?? 1.0;
+    }
+    readonly property bool floatingWindowForegroundLayers: floatingWindowSynced ? foregroundLayers : (SettingsData.floatingWindowForegroundLayers ?? true)
+    readonly property real floatingWindowForegroundTransparency: {
+        if (typeof SettingsData === "undefined" || floatingWindowSynced)
+            return foregroundLayerTransparency;
+        return SettingsData.floatingWindowForegroundTransparency ?? 1.0;
+    }
+    readonly property color floatingWindowSurface: withAlpha(surfaceContainer, floatingWindowTransparency)
+    readonly property color floatingWindowSurfaceHigh: floatingWindowForegroundLayers ? withAlpha(surfaceContainerHigh, floatingWindowForegroundTransparency) : withAlpha(surfaceContainerHigh, 0)
+    readonly property color floatingWindowNestedSurface: floatingWindowSurfaceHigh
+    readonly property color notepadWindowSurface: withAlpha(surfaceContainer, notepadTransparency)
     readonly property color nestedSurface: floatingSurfaceHigh
     readonly property color notificationFloatingSurface: notificationForegroundLayers ? readableSurface : withAlpha(readableSurface, 0)
     readonly property color notificationFloatingSurfaceHigh: notificationForegroundLayers ? readableSurfaceHigh : withAlpha(readableSurfaceHigh, 0)
@@ -585,6 +374,20 @@ Singleton {
     readonly property real blurLayerOutlineOpacity: Math.max(0, Math.min(1, typeof SettingsData === "undefined" ? 0.12 : (SettingsData.blurLayerOutlineOpacity ?? 0.12)))
     readonly property real layerOutlineOpacity: blurLayerOutlineOpacity
     readonly property int layerOutlineWidth: layerOutlineOpacity > 0 ? 1 : 0
+    readonly property real floatingWindowFieldAlpha: floatingWindowTransparency
+    readonly property color floatingWindowFieldColor: withAlpha(surfaceContainerHigh, floatingWindowFieldAlpha)
+    readonly property real popupFieldAlpha: {
+        if (transparentBlurLayers)
+            return 0.28;
+        if (blurForegroundLayers)
+            return Math.max(foregroundLayerTransparency, 0.62);
+        return popupTransparency;
+    }
+    readonly property color popupFieldColor: withAlpha(surfaceContainerHigh, popupFieldAlpha)
+    readonly property color popupFieldBorderColor: withAlpha(outline, blurLayersActive ? 0.16 : layerOutlineOpacity)
+    readonly property color popupFieldFocusedBorderColor: withAlpha(primary, blurLayersActive ? 0.72 : 1.0)
+    readonly property color floatingWindowFieldBorderColor: popupFieldBorderColor
+    readonly property color floatingWindowFieldFocusedBorderColor: popupFieldFocusedBorderColor
     property color surfaceTextHover: withAlpha(surfaceText, 0.08)
     property color surfaceTextAlpha: withAlpha(surfaceText, 0.3)
 
@@ -658,7 +461,7 @@ Singleton {
         }
     }
 
-    readonly property color ccTileInactiveBg: transparentBlurLayers ? withAlpha(surfaceContainerHigh, 0.16) : (foregroundLayers ? withAlpha(surfaceContainerHigh, BlurService.enabled ? Math.min(popupTransparency, 0.24) : popupTransparency) : withAlpha(surfaceContainer, 0))
+    readonly property color ccTileInactiveBg: transparentBlurLayers ? withAlpha(surfaceContainerHigh, 0.16) : (foregroundLayers ? withAlpha(surfaceContainerHigh, blurLayersActive ? Math.min(popupTransparency, 0.24) : popupTransparency) : withAlpha(surfaceContainer, 0))
     readonly property color ccPillInactiveBg: transparentBlurLayers ? withAlpha(surfaceContainerHigh, 0.08) : nestedSurface
     readonly property color ccPillInactiveHoverBg: transparentBlurLayers ? withAlpha(primary, 0.10) : primaryPressed
     readonly property color ccSliderTrackColor: transparentBlurLayers ? surfaceText : surfaceContainerHigh
@@ -978,22 +781,6 @@ Singleton {
         };
     }
 
-    function elevationTintOpacity(level) {
-        if (!level)
-            return 0;
-        if (level === elevationLevel1)
-            return 0.05;
-        if (level === elevationLevel2)
-            return 0.08;
-        if (level === elevationLevel3)
-            return 0.11;
-        if (level === elevationLevel4)
-            return 0.12;
-        if (level === elevationLevel5)
-            return 0.14;
-        return 0.08;
-    }
-
     readonly property var animationDurations: [
         {
             "shorter": 0,
@@ -1261,9 +1048,7 @@ Singleton {
     }
 
     function screenTransition() {
-        if (CompositorService.isNiri) {
+        screenTransitionNeeded();
-            NiriService.doScreenTransition();
-        }
     }
 
     function switchTheme(themeName, savePrefs = true, enableTransition = true) {
@@ -1315,7 +1100,6 @@ Singleton {
             SessionData.setLightMode(light);
         }
 
-        PortalService.setLightMode(light);
         if (typeof SettingsData !== "undefined") {
             SettingsData.updateCosmicThemeMode(light);
         }
@@ -1326,22 +1110,6 @@ Singleton {
         setLightMode(!isLightMode, savePrefs, true);
     }
 
-    function forceGenerateSystemThemes() {
-        if (!matugenAvailable) {
-            return;
-        }
-        generateSystemThemesFromCurrentTheme();
-    }
-
-    function getAvailableThemes() {
-        return StockThemes.getAllThemeNames();
-    }
-
-    function getThemeDisplayName(themeName) {
-        const themeData = StockThemes.getThemeByName(themeName, isLightMode);
-        return themeData.name;
-    }
-
     function getThemeColors(themeName) {
         if (themeName === "custom" && customThemeData) {
             return customThemeData;
@@ -1457,11 +1225,7 @@ Singleton {
     readonly property var _availableThemeNames: StockThemes.getAllThemeNames()
     property string currentThemeName: currentTheme
 
-    function panelBackground() {
+    property real notepadTransparency: SettingsData.notepadTransparencyOverride >= 0 ? SettingsData.notepadTransparencyOverride : floatingWindowTransparency
-        return withAlpha(surfaceContainer, panelTransparency);
-    }
-
-    property real notepadTransparency: SettingsData.notepadTransparencyOverride >= 0 ? SettingsData.notepadTransparencyOverride : popupTransparency
 
     property bool widgetBackgroundHasAlpha: {
         const colorMode = typeof SettingsData !== "undefined" ? SettingsData.widgetBackgroundColor : "sch";
@@ -1537,10 +1301,6 @@ Singleton {
         }
     }
 
-    function isColorDark(c) {
-        return (0.299 * c.r + 0.587 * c.g + 0.114 * c.b) < 0.5;
-    }
-
     function barIconSize(barThickness, offset, maximizeIcon, iconScale) {
         const defaultOffset = offset !== undefined ? offset : -6;
         const size = (maximizeIcon ?? false) ? iconSizeLarge : iconSize;
@@ -1623,19 +1383,6 @@ Singleton {
         }
     }
 
-    function getPowerProfileDescription(profile) {
-        switch (profile) {
-        case 0:
-            return I18n.tr("Extend battery life", "power profile description");
-        case 1:
-            return I18n.tr("Balance power and performance", "power profile description");
-        case 2:
-            return I18n.tr("Prioritize performance", "power profile description");
-        default:
-            return I18n.tr("Custom power profile", "power profile description");
-        }
-    }
-
     function onLightModeChanged() {
         if (currentTheme === "custom" && customThemeFileView.path) {
             customThemeFileView.reload();
@@ -1663,9 +1410,7 @@ Singleton {
 
         log.info("Setting desired theme -", kind, "mode:", isLight ? "light" : "dark", stockColors ? "(stock colors)" : "(dynamic)");
 
-        if (typeof NiriService !== "undefined" && CompositorService.isNiri) {
+        themeGenerationStarting();
-            NiriService.suppressNextToast();
-        }
 
         const desired = {
             "kind": kind,
@@ -1777,8 +1522,7 @@ Singleton {
 
         if (currentTheme === dynamic) {
             if (!rawWallpaperPath) {
-                log.warn("Auto theme has no wallpaper - skipping matugen, syncing portal mode only");
+                log.warn("Auto theme has no wallpaper - skipping matugen");
-                PortalService.setLightMode(isLight);
                 return;
             }
             const selectedMatugenType = (typeof SettingsData !== "undefined" && SettingsData.matugenScheme) ? SettingsData.matugenScheme : "scheme-tonal-spot";
@@ -1955,7 +1699,13 @@ Singleton {
     function patchGtk3colors() {
         const isLight = (typeof SessionData !== "undefined" && SessionData.isLightMode);
         Proc.runCommand("gtk3Patcher", ["bash", shellDir + "/scripts/gtk.sh", configDir, "patch", isLight, shellDir], (output, exitCode) => {
-            if (exitCode !== 0) {
+            switch (exitCode) {
+            case 0:
+                refreshGtkTheme();
+                break;
+            case 2:
+                break;
+            default:
                 log.warn(`Failed to patch GTK3 colors: ${output}`);
             }
         });
@@ -1972,7 +1722,7 @@ Singleton {
         const isLight = (typeof SessionData !== "undefined" && SessionData.isLightMode) ? "true" : "false";
         Proc.runCommand("gtkApplier", ["bash", shellDir + "/scripts/gtk.sh", configDir, "apply", isLight, shellDir], (output, exitCode) => {
             if (exitCode === 0) {
-                if (typeof ToastService !== "undefined" && typeof NiriService !== "undefined" && !NiriService.matugenSuppression) {
+                if (typeof ToastService !== "undefined" && !root.matugenToastSuppressed) {
                     ToastService.showInfo(I18n.tr("GTK colors applied successfully"));
                 }
             } else {
@@ -2010,18 +1760,17 @@ Singleton {
         return Qt.rgba(c.r, c.g, c.b, a);
     }
 
-    function popupLayerColor(baseColor) {
-        if (isConnectedEffect)
-            return connectedSurfaceColor;
-        return withAlpha(baseColor, popupTransparency);
-    }
-
     function blendAlpha(c, a) {
         if (!c || c.r === undefined)
             return Qt.rgba(0, 0, 0, 0);
         return Qt.rgba(c.r, c.g, c.b, c.a * a);
     }
 
+    function hoverTint(base) {
+        const factor = 1.2;
+        return isLightMode ? Qt.darker(base, factor) : Qt.lighter(base, factor);
+    }
+
     function blend(c1, c2, r) {
         return Qt.rgba(c1.r * (1 - r) + c2.r * r, c1.g * (1 - r) + c2.g * r, c1.b * (1 - r) + c2.b * r, c1.a * (1 - r) + c2.a * r);
     }
@@ -2167,10 +1916,8 @@ Singleton {
             }
 
             if (!pendingThemeRequest) {
-                if (SettingsData.matugenTemplateGtk) {
+                if (SettingsData.matugenTemplateGtk)
                     patchGtk3colors();
-                    refreshGtkTheme();
-                }
                 return;
             }
 
@@ -2340,303 +2087,4 @@ Singleton {
             root.switchTheme(defaultTheme, true, false);
         }
     }
-
-    // Theme mode automation functions
-    function themeAutoBackendAvailable() {
-        return typeof DMSService !== "undefined" && DMSService.isConnected && Array.isArray(DMSService.capabilities) && DMSService.capabilities.includes("theme.auto");
-    }
-
-    function applyThemeAutoState(state) {
-        if (!state) {
-            return;
-        }
-        if (state.config && state.config.mode && state.config.mode !== SessionData.themeModeAutoMode) {
-            return;
-        }
-        if (typeof SessionData !== "undefined" && state.nextTransition !== undefined) {
-            SessionData.themeModeNextTransition = state.nextTransition || "";
-        }
-        if (state.isLight !== undefined && root.isLightMode !== state.isLight) {
-            root.setLightMode(state.isLight, true, true);
-        }
-    }
-
-    function syncTimeThemeSchedule() {
-        if (typeof SessionData === "undefined" || typeof DMSService === "undefined") {
-            return;
-        }
-
-        if (!DMSService.isConnected) {
-            return;
-        }
-
-        const timeModeActive = SessionData.themeModeAutoEnabled && SessionData.themeModeAutoMode === "time";
-
-        if (!timeModeActive) {
-            return;
-        }
-
-        DMSService.sendRequest("theme.auto.setMode", {
-            "mode": "time"
-        });
-
-        const shareSettings = SessionData.themeModeShareGammaSettings;
-        const startHour = shareSettings ? SessionData.nightModeStartHour : SessionData.themeModeStartHour;
-        const startMinute = shareSettings ? SessionData.nightModeStartMinute : SessionData.themeModeStartMinute;
-        const endHour = shareSettings ? SessionData.nightModeEndHour : SessionData.themeModeEndHour;
-        const endMinute = shareSettings ? SessionData.nightModeEndMinute : SessionData.themeModeEndMinute;
-
-        DMSService.sendRequest("theme.auto.setSchedule", {
-            "startHour": startHour,
-            "startMinute": startMinute,
-            "endHour": endHour,
-            "endMinute": endMinute
-        }, response => {
-            if (response && response.error) {
-                log.error("Theme automation: Failed to sync time schedule:", response.error);
-            }
-        });
-
-        DMSService.sendRequest("theme.auto.setEnabled", {
-            "enabled": true
-        });
-        DMSService.sendRequest("theme.auto.trigger", {});
-    }
-
-    function syncLocationThemeSchedule() {
-        if (typeof SessionData === "undefined" || typeof DMSService === "undefined") {
-            return;
-        }
-
-        if (!DMSService.isConnected) {
-            return;
-        }
-
-        const locationModeActive = SessionData.themeModeAutoEnabled && SessionData.themeModeAutoMode === "location";
-
-        if (!locationModeActive) {
-            return;
-        }
-
-        DMSService.sendRequest("theme.auto.setMode", {
-            "mode": "location"
-        });
-
-        if (SessionData.nightModeUseIPLocation) {
-            DMSService.sendRequest("theme.auto.setUseIPLocation", {
-                "use": true
-            });
-        } else {
-            DMSService.sendRequest("theme.auto.setUseIPLocation", {
-                "use": false
-            });
-            if (SessionData.latitude !== 0.0 && SessionData.longitude !== 0.0) {
-                DMSService.sendRequest("theme.auto.setLocation", {
-                    "latitude": SessionData.latitude,
-                    "longitude": SessionData.longitude
-                });
-            }
-        }
-
-        DMSService.sendRequest("theme.auto.setEnabled", {
-            "enabled": true
-        });
-        DMSService.sendRequest("theme.auto.trigger", {});
-    }
-
-    function evaluateThemeMode() {
-        if (typeof SessionData === "undefined" || !SessionData.themeModeAutoEnabled) {
-            return;
-        }
-
-        if (themeAutoBackendAvailable()) {
-            DMSService.sendRequest("theme.auto.getState", null, response => {
-                if (response && response.result) {
-                    applyThemeAutoState(response.result);
-                }
-            });
-            return;
-        }
-
-        const mode = SessionData.themeModeAutoMode;
-
-        if (mode === "location") {
-            evaluateLocationBasedThemeMode();
-        } else {
-            evaluateTimeBasedThemeMode();
-        }
-    }
-
-    function evaluateLocationBasedThemeMode() {
-        if (typeof DisplayService !== "undefined") {
-            const shouldBeLight = DisplayService.gammaIsDay;
-            if (root.isLightMode !== shouldBeLight) {
-                root.setLightMode(shouldBeLight, true, true);
-            }
-            return;
-        }
-
-        if (!SessionData.nightModeUseIPLocation && SessionData.latitude !== 0.0 && SessionData.longitude !== 0.0) {
-            const shouldBeLight = calculateIsDaytime(SessionData.latitude, SessionData.longitude);
-            if (root.isLightMode !== shouldBeLight) {
-                root.setLightMode(shouldBeLight, true, true);
-            }
-            return;
-        }
-
-        if (root.themeModeAutomationActive) {
-            if (SessionData.nightModeUseIPLocation) {
-                log.warn("Theme automation: Waiting for IP location from backend");
-            } else {
-                log.warn("Theme automation: Location mode requires coordinates");
-            }
-        }
-    }
-
-    function evaluateTimeBasedThemeMode() {
-        const shareSettings = SessionData.themeModeShareGammaSettings;
-
-        const startHour = shareSettings ? SessionData.nightModeStartHour : SessionData.themeModeStartHour;
-        const startMinute = shareSettings ? SessionData.nightModeStartMinute : SessionData.themeModeStartMinute;
-        const endHour = shareSettings ? SessionData.nightModeEndHour : SessionData.themeModeEndHour;
-        const endMinute = shareSettings ? SessionData.nightModeEndMinute : SessionData.themeModeEndMinute;
-
-        const now = new Date();
-        const currentMinutes = now.getHours() * 60 + now.getMinutes();
-        const startMinutes = startHour * 60 + startMinute;
-        const endMinutes = endHour * 60 + endMinute;
-
-        let shouldBeLight;
-        if (startMinutes < endMinutes) {
-            shouldBeLight = currentMinutes < startMinutes || currentMinutes >= endMinutes;
-        } else {
-            shouldBeLight = currentMinutes >= endMinutes && currentMinutes < startMinutes;
-        }
-
-        if (root.isLightMode !== shouldBeLight) {
-            root.setLightMode(shouldBeLight, true, true);
-        }
-    }
-
-    function calculateIsDaytime(lat, lng) {
-        const now = new Date();
-        const start = new Date(now.getFullYear(), 0, 0);
-        const diff = now - start;
-        const dayOfYear = Math.floor(diff / 86400000);
-        const latRad = lat * Math.PI / 180;
-
-        const declination = 23.45 * Math.sin((360 / 365) * (dayOfYear - 81) * Math.PI / 180);
-        const declinationRad = declination * Math.PI / 180;
-
-        const cosHourAngle = -Math.tan(latRad) * Math.tan(declinationRad);
-
-        if (cosHourAngle > 1) {
-            return false; // Polar night
-        }
-        if (cosHourAngle < -1) {
-            return true; // Midnight sun
-        }
-
-        const hourAngle = Math.acos(cosHourAngle);
-        const hourAngleDeg = hourAngle * 180 / Math.PI;
-
-        const sunriseHour = 12 - hourAngleDeg / 15;
-        const sunsetHour = 12 + hourAngleDeg / 15;
-
-        const timeZoneOffset = now.getTimezoneOffset() / 60;
-        const localSunrise = sunriseHour - lng / 15 - timeZoneOffset;
-        const localSunset = sunsetHour - lng / 15 - timeZoneOffset;
-
-        const currentHour = now.getHours() + now.getMinutes() / 60;
-
-        const normalizeSunrise = ((localSunrise % 24) + 24) % 24;
-        const normalizeSunset = ((localSunset % 24) + 24) % 24;
-
-        return currentHour >= normalizeSunrise && currentHour < normalizeSunset;
-    }
-
-    // Helper function to send location to backend
-    function sendLocationToBackend() {
-        if (typeof SessionData === "undefined" || typeof DMSService === "undefined") {
-            return false;
-        }
-
-        if (!DMSService.isConnected) {
-            return false;
-        }
-
-        if (SessionData.nightModeUseIPLocation) {
-            DMSService.sendRequest("wayland.gamma.setUseIPLocation", {
-                "use": true
-            }, response => {
-                if (response?.error) {
-                    log.warn("Theme automation: Failed to enable IP location", response.error);
-                }
-            });
-            return true;
-        } else if (SessionData.latitude !== 0.0 && SessionData.longitude !== 0.0) {
-            DMSService.sendRequest("wayland.gamma.setUseIPLocation", {
-                "use": false
-            }, response => {
-                if (!response.error) {
-                    DMSService.sendRequest("wayland.gamma.setLocation", {
-                        "latitude": SessionData.latitude,
-                        "longitude": SessionData.longitude
-                    }, locResp => {
-                        if (locResp?.error) {
-                            log.warn("Theme automation: Failed to set location", locResp.error);
-                        }
-                    });
-                }
-            });
-            return true;
-        }
-        return false;
-    }
-
-    Timer {
-        id: locationRetryTimer
-        interval: 1000
-        repeat: true
-        running: false
-        property int retryCount: 0
-
-        onTriggered: {
-            if (root.sendLocationToBackend()) {
-                stop();
-                retryCount = 0;
-                root.evaluateThemeMode();
-            } else {
-                retryCount++;
-                if (retryCount >= 10) {
-                    stop();
-                    retryCount = 0;
-                }
-            }
-        }
-    }
-
-    function startThemeModeAutomation() {
-        root.themeModeAutomationActive = true;
-
-        root.syncTimeThemeSchedule();
-        root.syncLocationThemeSchedule();
-
-        const sent = root.sendLocationToBackend();
-
-        if (!sent && typeof SessionData !== "undefined" && SessionData.themeModeAutoMode === "location") {
-            locationRetryTimer.start();
-        } else {
-            root.evaluateThemeMode();
-        }
-    }
-
-    function stopThemeModeAutomation() {
-        root.themeModeAutomationActive = false;
-        if (typeof DMSService !== "undefined" && DMSService.isConnected) {
-            DMSService.sendRequest("theme.auto.setEnabled", {
-                "enabled": false
-            });
-        }
-    }
 }

quickshell/Common/TrayMenuManager.qml

@@ -1,31 +1,69 @@
 pragma Singleton
 
 import Quickshell
+import Quickshell.Services.SystemTray
 import QtQuick
 
 Singleton {
     id: root
 
     property var activeTrayMenus: ({})
+    property var _pendingMenuRequest: null
+
+    signal openTrayMenuRequested
+
+    function requestOpenMenu(itemId, screenName) {
+        _pendingMenuRequest = {
+            "itemId": itemId,
+            "screenName": screenName
+        };
+        openTrayMenuRequested();
+    }
+
+    // Every SystemTrayBar instance receives the signal; the claim ensures
+    // exactly one opens the menu, preferring the requested screen
+    function claimMenuRequest(instanceScreenName) {
+        if (!_pendingMenuRequest)
+            return null;
+        if (_pendingMenuRequest.screenName && _pendingMenuRequest.screenName !== instanceScreenName)
+            return null;
+        const request = _pendingMenuRequest;
+        _pendingMenuRequest = null;
+        return request;
+    }
+
+    function findTrayItem(itemId: string): var {
+        if (!itemId)
+            return null;
+
+        return SystemTray.items.values.find(item => {
+            const id = item?.id || "";
+            const title = item?.tooltipTitle || "";
+            const fullKey = title ? `${id}::${title}` : id;
+            return fullKey === itemId || id === itemId;
+        });
+    }
 
     function registerMenu(screenName, menu) {
-        if (!screenName || !menu) return
+        if (!screenName || !menu)
-        const newMenus = Object.assign({}, activeTrayMenus)
+            return;
-        newMenus[screenName] = menu
+        const newMenus = Object.assign({}, activeTrayMenus);
-        activeTrayMenus = newMenus
+        newMenus[screenName] = menu;
+        activeTrayMenus = newMenus;
     }
 
     function unregisterMenu(screenName) {
-        if (!screenName) return
+        if (!screenName)
-        const newMenus = Object.assign({}, activeTrayMenus)
+            return;
-        delete newMenus[screenName]
+        const newMenus = Object.assign({}, activeTrayMenus);
-        activeTrayMenus = newMenus
+        delete newMenus[screenName];
+        activeTrayMenus = newMenus;
     }
 
-    function closeAllMenus() {
+    function closeHoverMenus() {
         for (const screenName in activeTrayMenus) {
             const menu = activeTrayMenus[screenName]
-            if (!menu) continue
+            if (!menu || menu.openedByHover !== true) continue
             if (typeof menu.close === "function") {
                 menu.close()
             } else if (menu.showMenu !== undefined) {
@@ -33,4 +71,17 @@ Singleton {
             }
         }
     }
+
+    function closeAllMenus() {
+        for (const screenName in activeTrayMenus) {
+            const menu = activeTrayMenus[screenName];
+            if (!menu)
+                continue;
+            if (typeof menu.close === "function") {
+                menu.close();
+            } else if (menu.showMenu !== undefined) {
+                menu.showMenu = false;
+            }
+        }
+    }
 }

quickshell/Common/markdown2html.js

@@ -4,17 +4,13 @@
 function markdownToHtml(text) {
     if (!text) return "";
 
-    // Store code blocks and inline code to protect them from further processing
     const codeBlocks = [];
     const inlineCode = [];
     let blockIndex = 0;
     let inlineIndex = 0;
 
-    // First, extract and replace code blocks with placeholders
     let html = text.replace(/```([\s\S]*?)```/g, (match, code) => {
-        // Trim leading and trailing blank lines only
         const trimmedCode = code.replace(/^\n+|\n+$/g, '');
-        // Escape HTML entities in code
         const escapedCode = trimmedCode.replace(/&/g, '&')
                                        .replace(/</g, '&lt;')
                                        .replace(/>/g, '&gt;');
@@ -22,9 +18,7 @@ function markdownToHtml(text) {
         return `\x00CODEBLOCK${blockIndex++}\x00`;
     });
 
-    // Extract and replace inline code
     html = html.replace(/`([^`]+)`/g, (match, code) => {
-        // Escape HTML entities in code
         const escapedCode = code.replace(/&/g, '&amp;')
                                .replace(/</g, '&lt;')
                                .replace(/>/g, '&gt;');
@@ -40,12 +34,10 @@ function markdownToHtml(text) {
         return prefix + `\x00URL${urlIndex++}\x00`;
     });
 
-    // Escape HTML entities (but not in code blocks or URLs)
     html = html.replace(/&/g, '&amp;')
                 .replace(/</g, '&lt;')
                 .replace(/>/g, '&gt;');
 
-    // Headers
     html = html.replace(/^### (.*?)$/gm, '<h3>$1</h3>');
     html = html.replace(/^## (.*?)$/gm, '<h2>$1</h2>');
     html = html.replace(/^# (.*?)$/gm, '<h1>$1</h1>');
@@ -58,20 +50,16 @@ function markdownToHtml(text) {
     html = html.replace(/__(.*?)__/g, '<b>$1</b>');
     html = html.replace(/_(.*?)_/g, '<i>$1</i>');
 
-    // Links
     html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2">$1</a>');
 
-    // Lists
     html = html.replace(/^\* (.*?)$/gm, '<li>$1</li>');
     html = html.replace(/^- (.*?)$/gm, '<li>$1</li>');
     html = html.replace(/^\d+\. (.*?)$/gm, '<li>$1</li>');
 
-    // Wrap consecutive list items in ul/ol tags
     html = html.replace(/(<li>[\s\S]*?<\/li>\s*)+/g, function(match) {
         return '<ul>' + match + '</ul>';
     });
 
-    // Restore extracted URLs as anchor tags (preserves raw & in href)
     html = html.replace(/\x00URL(\d+)\x00/g, (_, index) => {
         const url = urls[parseInt(index)];
         const display = url.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
@@ -87,30 +75,23 @@ function markdownToHtml(text) {
         return inlineCode[parseInt(index)];
     });
 
-    // Line breaks (after code blocks are restored)
     html = html.replace(/\n\n/g, '</p><p>');
     html = html.replace(/\n/g, '<br/>');
 
-    // Wrap in paragraph tags if not already wrapped
     if (!html.startsWith('<')) {
         html = '<p>' + html + '</p>';
     }
 
-    // Clean up the final HTML
-    // Remove <br/> tags immediately before block elements
     html = html.replace(/<br\/>\s*<pre>/g, '<pre>');
     html = html.replace(/<br\/>\s*<ul>/g, '<ul>');
     html = html.replace(/<br\/>\s*<h[1-6]>/g, '<h$1>');
 
-    // Remove empty paragraphs
     html = html.replace(/<p>\s*<\/p>/g, '');
     html = html.replace(/<p>\s*<br\/>\s*<\/p>/g, '');
 
-    // Remove excessive line breaks
+    html = html.replace(/(<br\/>){3,}/g, '<br/><br/>');
-    html = html.replace(/(<br\/>){3,}/g, '<br/><br/>'); // Max 2 consecutive line breaks
+    html = html.replace(/(<\/p>)\s*(<p>)/g, '$1$2');
-    html = html.replace(/(<\/p>)\s*(<p>)/g, '$1$2'); // Remove whitespace between paragraphs
 
-    // Remove leading/trailing whitespace
     html = html.trim();
 
     return html;

quickshell/Common/settings/Processes.qml

@@ -5,11 +5,13 @@ import QtQuick
 import Quickshell
 import Quickshell.Io
 import qs.Common
-import qs.Services
 
 Singleton {
     id: root
 
+    signal toastRequested(int severity, string title, string body, string command, string category)
+    signal toastCategoryDismissed(string category)
+
     property var settingsRoot: null
 
     onSettingsRootChanged: {
@@ -317,7 +319,7 @@ Singleton {
     function launchAuthApplyTerminalFallback(fromPrecheck, details) {
         authApplyTerminalFallbackFromPrecheck = fromPrecheck;
         if (details && details !== "")
-            ToastService.showInfo(I18n.tr("Authentication changes need sudo. Opening terminal so you can use password or fingerprint."), details, "", "auth-sync");
+            toastRequested(0, I18n.tr("Authentication changes need sudo. Opening terminal so you can use password or fingerprint."), details, "", "auth-sync");
         authApplyTerminalFallbackStderr = "";
         authApplyTerminalFallbackProcess.running = true;
     }
@@ -364,21 +366,21 @@ Singleton {
     }
 
     function deferGreeterAutoLoginSyncToPill(details) {
-        ToastService.dismissCategory("greeter-autologin-sync");
+        toastCategoryDismissed("greeter-autologin-sync");
         if (settingsRoot)
             settingsRoot.set("greeterSyncPending", true);
-        ToastService.showWarning(I18n.tr("Auto-login change needs a sync"), I18n.tr("Administrator access is required. Use the Sync button in Settings → Greeter to apply.") + (details ? "\n\n" + details : ""), "dms-greeter sync --autologin", "greeter-autologin-sync");
+        toastRequested(1, I18n.tr("Auto-login change needs a sync"), I18n.tr("Administrator access is required. Use the Sync button in Settings → Greeter to apply.") + (details ? "\n\n" + details : ""), "dms-greeter sync --autologin", "greeter-autologin-sync");
         finishGreeterAutoLoginSync();
     }
 
     function greeterAutoLoginSyncSuccessToast(details) {
         const enabling = settingsRoot && settingsRoot.greeterAutoLogin;
         // Clear the sticky in-progress toast, then confirm with an auto-dismissing toast.
-        ToastService.dismissCategory("greeter-autologin-sync");
+        toastCategoryDismissed("greeter-autologin-sync");
         if (enabling) {
-            ToastService.showWarning(I18n.tr("Auto-login enabled"), I18n.tr("You'll skip the greeter password after the next reboot. The lock screen and signing out still require your password.") + (details ? "\n\n" + details : ""));
+            toastRequested(1, I18n.tr("Auto-login enabled"), I18n.tr("You'll skip the greeter password after the next reboot. The lock screen and signing out still require your password.") + (details ? "\n\n" + details : ""), "", "");
         } else {
-            ToastService.showInfo(I18n.tr("Auto-login disabled"), I18n.tr("You'll enter your password at the greeter after the next reboot.") + (details ? "\n\n" + details : ""));
+            toastRequested(0, I18n.tr("Auto-login disabled"), I18n.tr("You'll enter your password at the greeter after the next reboot.") + (details ? "\n\n" + details : ""), "", "");
         }
     }
 
@@ -485,41 +487,10 @@ Singleton {
         return pamFprintDetected ? "probe_failed" : "missing_pam_support";
     }
 
-    // --- Qt tools detection ---
-
-    function detectQtTools() {
-        qtToolsDetectionProcess.running = true;
-    }
-
     function checkPluginSettings() {
         pluginSettingsCheckProcess.running = true;
     }
 
-    property var qtToolsDetectionProcess: Process {
-        command: ["sh", "-c", "echo -n 'qt5ct:'; command -v qt5ct >/dev/null && echo 'true' || echo 'false'; echo -n 'qt6ct:'; command -v qt6ct >/dev/null && echo 'true' || echo 'false'; echo -n 'gtk:'; (command -v gsettings >/dev/null || command -v dconf >/dev/null) && echo 'true' || echo 'false'"]
-        running: false
-
-        stdout: StdioCollector {
-            onStreamFinished: {
-                if (!settingsRoot)
-                    return;
-                if (text && text.trim()) {
-                    const lines = text.trim().split("\n");
-                    for (let i = 0; i < lines.length; i++) {
-                        const line = lines[i];
-                        if (line.startsWith("qt5ct:")) {
-                            settingsRoot.qt5ctAvailable = line.split(":")[1] === "true";
-                        } else if (line.startsWith("qt6ct:")) {
-                            settingsRoot.qt6ctAvailable = line.split(":")[1] === "true";
-                        } else if (line.startsWith("gtk:")) {
-                            settingsRoot.gtkAvailable = line.split(":")[1] === "true";
-                        }
-                    }
-                }
-            }
-        }
-    }
-
     Timer {
         id: authApplyDebounce
         interval: 300
@@ -575,7 +546,7 @@ Singleton {
         onExited: exitCode => {
             const enabling = root.settingsRoot && root.settingsRoot.greeterAutoLogin;
             if (exitCode === 0) {
-                ToastService.showWarning(enabling ? I18n.tr("Applying auto-login on startup...") : I18n.tr("Disabling auto-login on startup..."), "", "dms-greeter sync --autologin", "greeter-autologin-sync");
+                root.toastRequested(1, enabling ? I18n.tr("Applying auto-login on startup...") : I18n.tr("Disabling auto-login on startup..."), "", "dms-greeter sync --autologin", "greeter-autologin-sync");
                 root.greeterAutoLoginSyncProcess.running = true;
                 return;
             }
@@ -604,7 +575,7 @@ Singleton {
                 let details = out;
                 if (err !== "")
                     details = details !== "" ? details + "\n\nstderr:\n" + err : "stderr:\n" + err;
-                ToastService.showInfo(I18n.tr("Authentication changes applied"), details, "", "auth-sync");
+                root.toastRequested(0, I18n.tr("Authentication changes applied"), details, "", "auth-sync");
                 root.detectAuthCapabilities();
                 root.finishAuthApply();
                 return;
@@ -615,7 +586,7 @@ Singleton {
                 details = out;
             if (err !== "")
                 details = details !== "" ? details + "\n\nstderr:\n" + err : "stderr:\n" + err;
-            ToastService.showWarning(I18n.tr("Background authentication sync failed. Trying terminal mode."), details, "", "auth-sync");
+            root.toastRequested(1, I18n.tr("Background authentication sync failed. Trying terminal mode."), details, "", "auth-sync");
             root.launchAuthApplyTerminalFallback(false, "");
         }
     }
@@ -631,7 +602,7 @@ Singleton {
         onExited: exitCode => {
             const err = (root.authApplySudoProbeStderr || "").trim();
             if (exitCode === 0) {
-                ToastService.showInfo(I18n.tr("Applying authentication changes..."), "", "", "auth-sync");
+                root.toastRequested(0, I18n.tr("Applying authentication changes..."), "", "", "auth-sync");
                 root.authApplyProcess.running = true;
                 return;
             }
@@ -651,10 +622,10 @@ Singleton {
         onExited: exitCode => {
             if (exitCode === 0) {
                 const message = root.authApplyTerminalFallbackFromPrecheck ? I18n.tr("Terminal opened. Complete authentication there; it will close automatically when done.") : I18n.tr("Terminal fallback opened. Complete authentication there; it will close automatically when done.");
-                ToastService.showInfo(message, "", "", "auth-sync");
+                root.toastRequested(0, message, "", "", "auth-sync");
             } else {
                 let details = (root.authApplyTerminalFallbackStderr || "").trim();
-                ToastService.showError(I18n.tr("Terminal fallback failed. Install a supported terminal emulator or run 'dms auth sync' manually.") + " (exit " + exitCode + ")", details, "", "auth-sync");
+                root.toastRequested(2, I18n.tr("Terminal fallback failed. Install a supported terminal emulator or run 'dms auth sync' manually.") + " (exit " + exitCode + ")", details, "", "auth-sync");
             }
             root.finishAuthApply();
         }

quickshell/Common/settings/SessionSpec.js

@@ -19,6 +19,7 @@ var SPEC = {
     includedTransitions: { def: ["fade", "wipe", "disc", "stripes", "iris bloom", "pixelate", "portal"] },
 
     wallpaperCyclingEnabled: { def: false },
+    wallpaperCyclingRandom: { def: false },
     wallpaperCyclingMode: { def: "interval" },
     wallpaperCyclingInterval: { def: 300 },
     wallpaperCyclingTime: { def: "06:00" },

quickshell/Common/settings/SessionStore.js

@@ -75,26 +75,3 @@ function migrateToVersion(obj, targetVersion, settingsData) {
 
     return session;
 }
-
-function cleanup(fileText) {
-    var getValidKeys = SpecModule.getValidKeys;
-    if (!fileText || !fileText.trim()) return null;
-
-    try {
-        var session = JSON.parse(fileText);
-        var validKeys = getValidKeys();
-        var needsSave = false;
-
-        for (var key in session) {
-            if (validKeys.indexOf(key) < 0) {
-                delete session[key];
-                needsSave = true;
-            }
-        }
-
-        return needsSave ? JSON.stringify(session, null, 2) : null;
-    } catch (e) {
-        console.warn("SessionData: Failed to cleanup unused keys:", e.message);
-        return null;
-    }
-}

quickshell/Common/settings/SettingsSpec.js

@@ -17,6 +17,11 @@ var SPEC = {
 
     popupTransparency: { def: 1.0, coerce: percentToUnit },
     dockTransparency: { def: 1.0, coerce: percentToUnit },
+    floatingWindowSyncGlobal: { def: true },
+    floatingWindowTransparency: { def: 1.0, coerce: percentToUnit },
+    floatingWindowForegroundLayers: { def: true },
+    floatingWindowForegroundTransparency: { def: 1.0, coerce: percentToUnit },
+    dmsWindowsFloating: { def: true },
 
     widgetBackgroundColor: { def: "sch" },
     widgetBackgroundCustomColor: { def: "#6750A4" },
@@ -57,6 +62,16 @@ var SPEC = {
     touchpadTapAndDrag: { def: true, onChange: "updateCompositorInput" },
     touchpadTapToClick: { def: true, onChange: "updateCompositorInput" },
 
+    keyboardLayouts: { def: "", onChange: "updateCompositorInput" },
+    keyboardVariants: { def: "", onChange: "updateCompositorInput" },
+    keyboardModel: { def: "", onChange: "updateCompositorInput" },
+    keyboardOptions: { def: "", onChange: "updateCompositorInput" },
+    keyboardKeymapFile: { def: "", onChange: "updateCompositorInput" },
+    keyboardTrackLayout: { def: "", onChange: "updateCompositorInput" },
+    keyboardRepeatDelay: { def: 0, onChange: "updateCompositorInput" },
+    keyboardRepeatRate: { def: 0, onChange: "updateCompositorInput" },
+    keyboardNumlock: { def: false, onChange: "updateCompositorInput" },
+
     firstDayOfWeek: { def: -1 },
     showWeekNumber: { def: false },
     calendarBackend: { def: "auto" },
@@ -87,6 +102,7 @@ var SPEC = {
     barElevationEnabled: { def: true },
     blurEnabled: { def: false },
     blurForegroundLayers: { def: true },
+    foregroundLayerTransparency: { def: 1.0, coerce: percentToUnit },
     blurLayerOutlineOpacity: { def: 0.12, coerce: percentToUnit },
     blurBorderEnabled: { def: true },
     blurBorderColor: { def: "outline" },
@@ -205,6 +221,7 @@ var SPEC = {
     mediaAdaptiveWidthEnabled: { def: true },
     audioVisualizerEnabled: { def: true },
     mediaUseAlbumArtAccent: { def: false },
+    appleMusicAnimatedArtEnabled: { def: false },
     audioScrollMode: { def: "volume" },
     audioWheelScrollAmount: { def: 5 },
     audioDeviceScrollVolumeEnabled: { def: false },
@@ -298,9 +315,6 @@ var SPEC = {
     lastAppliedIconTheme: { def: "" },
     availableIconThemes: { def: ["System Default"], persist: false },
     systemDefaultIconTheme: { def: "", persist: false },
-    qt5ctAvailable: { def: false, persist: false },
-    qt6ctAvailable: { def: false, persist: false },
-    gtkAvailable: { def: false, persist: false },
 
     cursorSettings: { def: { theme: "System Default", size: 24, niri: { hideWhenTyping: false, hideAfterInactiveMs: 0 }, hyprland: { hideOnKeyPress: false, hideOnTouch: false, inactiveTimeout: 0 }, dwl: { cursorHideTimeout: 0 }, mango: { cursorHideTimeout: 0 } }, onChange: "updateCompositorCursor" },
     availableCursorThemes: { def: ["System Default"], persist: false },
@@ -373,14 +387,7 @@ var SPEC = {
     fadeToDpmsEnabled: { def: true },
     fadeToDpmsGracePeriod: { def: 5 },
     launchPrefix: { def: "" },
-    brightnessDevicePins: { def: {} },
-    wifiNetworkPins: { def: {} },
-    bluetoothDevicePins: { def: {} },
-    audioInputDevicePins: { def: {} },
-    audioOutputDevicePins: { def: {} },
 
-    gtkThemingEnabled: { def: false, onChange: "regenSystemThemes" },
-    qtThemingEnabled: { def: false, onChange: "regenSystemThemes" },
     syncModeWithPortal: { def: true },
     terminalsAlwaysDark: { def: false, onChange: "regenSystemThemes" },
 
@@ -478,6 +485,8 @@ var SPEC = {
     enableU2f: { def: false, onChange: "scheduleAuthApply" },
     u2fMode: { def: "or" },
     lockPamPath: { def: "" },
+    lockScreenSecurityKeyShortcut: { def: "Ctrl+Q" },
+    lockScreenSecurityKeyShortcutEnabled: { def: false },
     lockPamInlineFprint: { def: false },
     lockPamInlineU2f: { def: false },
     lockPamExternallyManaged: { def: false },
@@ -534,6 +543,7 @@ var SPEC = {
     customPowerActionHibernate: { def: "" },
     customPowerActionReboot: { def: "" },
     customPowerActionPowerOff: { def: "" },
+    customPowerButtons: { def: [] },
 
     updaterHideWidget: { def: false },
     updaterCheckOnStart: { def: false },

quickshell/Common/settings/SettingsStore.js

@@ -2,6 +2,21 @@
 
     .import "./SettingsSpec.js" as SpecModule
 
+var PIN_KEYS = ["brightnessDevicePins", "wifiNetworkPins", "bluetoothDevicePins", "audioInputDevicePins", "audioOutputDevicePins"];
+
+function extractPins(obj) {
+    if (!obj) return null;
+
+    var pins = null;
+    for (var i = 0; i < PIN_KEYS.length; i++) {
+        var value = obj[PIN_KEYS[i]];
+        if (!value || Object.keys(value).length === 0) continue;
+        if (!pins) pins = {};
+        pins[PIN_KEYS[i]] = value;
+    }
+    return pins;
+}
+
 function parse(root, jsonObj) {
     var SPEC = SpecModule.SPEC;
 
@@ -263,28 +278,16 @@ function migrateToVersion(obj, targetVersion) {
         settings.configVersion = 12;
     }
 
+    if (currentVersion < 13) {
+        console.info("Migrating settings from version", currentVersion, "to version 13");
+        console.info("Moving device and network pins to cache.json");
+
+        for (var p = 0; p < PIN_KEYS.length; p++) {
+            delete settings[PIN_KEYS[p]];
+        }
+
+        settings.configVersion = 13;
+    }
+
     return settings;
 }
-
-function cleanup(fileText) {
-    var getValidKeys = SpecModule.getValidKeys;
-    if (!fileText || !fileText.trim()) return;
-
-    try {
-        var settings = JSON.parse(fileText);
-        var validKeys = getValidKeys();
-        var needsSave = false;
-
-        for (var key in settings) {
-            if (validKeys.indexOf(key) < 0) {
-                delete settings[key];
-                needsSave = true;
-            }
-        }
-
-        return needsSave ? JSON.stringify(settings, null, 2) : null;
-    } catch (e) {
-        console.warn("SettingsData: Failed to cleanup unused keys:", e.message);
-        return null;
-    }
-}

quickshell/Common/suncalc.js

@@ -122,11 +122,6 @@ const times = [
 
 // adds a custom time to the times config
 
-function addTime(angle, riseName, setName) {
-    times.push([angle, riseName, setName]);
-};
-
-
 // calculations for sun times
 
 const J0 = 0.0009;
@@ -246,63 +241,3 @@ function getMoonIllumination(date) {
         angle
     };
 };
-
-
-function hoursLater(date, h) {
-    return new Date(date.valueOf() + h * dayMs / 24);
-}
-
-// calculations for moon rise/set times are based on http://www.stargazing.net/kepler/moonrise.html article
-
-function getMoonTimes(date, lat, lng, inUTC) {
-    const t = new Date(date);
-    if (inUTC) t.setUTCHours(0, 0, 0, 0);
-    else t.setHours(0, 0, 0, 0);
-
-    const hc = 0.133 * rad;
-    let h0 = getMoonPosition(t, lat, lng).altitude - hc,
-        rise, set, ye;
-
-    // go in 2-hour chunks, each time seeing if a 3-point quadratic curve crosses zero (which means rise or set)
-    for (let i = 1; i <= 24; i += 2) {
-        const h1 = getMoonPosition(hoursLater(t, i), lat, lng).altitude - hc;
-        const h2 = getMoonPosition(hoursLater(t, i + 1), lat, lng).altitude - hc;
-        const a = (h0 + h2) / 2 - h1;
-        const b = (h2 - h0) / 2;
-        const xe = -b / (2 * a);
-        const d = b * b - 4 * a * h1;
-        let roots = 0, x1 = 0, x2 = 0;
-        ye = (a * xe + b) * xe + h1;
-
-        if (d >= 0) {
-            const dx = Math.sqrt(d) / (Math.abs(a) * 2);
-            x1 = xe - dx;
-            x2 = xe + dx;
-            if (Math.abs(x1) <= 1) roots++;
-            if (Math.abs(x2) <= 1) roots++;
-            if (x1 < -1) x1 = x2;
-        }
-
-        if (roots === 1) {
-            if (h0 < 0) rise = i + x1;
-            else set = i + x1;
-
-        } else if (roots === 2) {
-            rise = i + (ye < 0 ? x2 : x1);
-            set = i + (ye < 0 ? x1 : x2);
-        }
-
-        if (rise && set) break;
-
-        h0 = h2;
-    }
-
-    const result = {};
-
-    if (rise) result.rise = hoursLater(t, rise);
-    if (set) result.set = hoursLater(t, set);
-
-    if (!rise && !set) result[ye > 0 ? 'alwaysUp' : 'alwaysDown'] = true;
-
-    return result;
-};

quickshell/DMSShell.qml

@@ -233,6 +233,11 @@ Item {
         PolkitService.polkitAvailable;
         DisplayConfigState.hasOutputBackend;
         PortalService.systemColorScheme;
+        IconThemeService.revision;
+        DesktopService.isSystemd;
+        TrashService.count;
+        WallpaperCyclingService.cyclingActive;
+        ThemeAutoService.active;
     }
 
     Loader {
@@ -440,6 +445,23 @@ Item {
         }
     }
 
+    LazyLoader {
+        id: qrGeneratorModalLoader
+        active: false
+
+        Component.onCompleted: {
+            PopoutService.qrGeneratorModalLoader = qrGeneratorModalLoader;
+        }
+
+        QRGeneratorModal {
+            id: qrGeneratorModalItem
+
+            Component.onCompleted: {
+                PopoutService.qrGeneratorModal = qrGeneratorModalItem;
+            }
+        }
+    }
+
     LazyLoader {
         id: polkitAuthModalLoader
         active: false
@@ -613,7 +635,7 @@ Item {
                 if (visible) {
                     wasShown = true;
                 } else if (wasShown) {
-                    PopoutService.unloadSettings();
+                    Qt.callLater(() => PopoutService.unloadSettingsNow());
                 }
             }
         }
@@ -918,6 +940,7 @@ Item {
             expandedWidthValue: 960
             edgeGap: SettingsData.notepadEffectiveEdgeGap
             slideEdge: SettingsData.notepadSlideoutSide
+            customTransparency: Theme.notepadTransparency
 
             onIsVisibleChanged: {
                 if (isVisible)
@@ -993,6 +1016,9 @@ Item {
                 case "reboot":
                     SessionService.reboot();
                     break;
+                case "softreboot":
+                    SessionService.softReboot();
+                    break;
                 case "poweroff":
                     SessionService.poweroff();
                     break;

quickshell/DMSShellIPC.qml

@@ -25,20 +25,19 @@ Item {
     required property var windowRuleModalLoader
 
     function getPreferredBar(refPropertyName) {
-        if (!root.dankBarRepeater || root.dankBarRepeater.count === 0)
-            return null;
-
         const focusedScreenName = BarWidgetService.getFocusedScreenName();
 
-        const loaders = Array.from({
+        const bars = [];
-            length: root.dankBarRepeater.count
+        if (root.dankBarRepeater) {
-        }, (_, i) => root.dankBarRepeater.itemAt(i));
+            for (let i = 0; i < root.dankBarRepeater.count; i++)
+                bars.push(...(root.dankBarRepeater.itemAt(i)?.item?.barVariants?.instances || []));
+        }
+        const frameBars = BarWidgetService.frameHostedBars;
+        for (const screenName in frameBars)
+            bars.push(frameBars[screenName]);
 
         let currentBar = null;
-
+        for (const bar of bars) {
-        for (const loader of loaders) {
-            const instances = loader?.item?.barVariants?.instances || [];
-            for (const bar of instances) {
             if (!bar)
                 continue;
 
@@ -52,7 +51,6 @@ Item {
                     break;
             }
         }
-        }
 
         return currentBar;
     }
@@ -285,28 +283,66 @@ Item {
             }
         }
 
+        function _resolvePosition(position) {
+            switch ((position || "").toLowerCase()) {
+            case "left":
+                return "left";
+            case "center":
+                return "center";
+            case "right":
+                return "right";
+            default:
+                return "";
+            }
+        }
+
+        function _dashBar(position) {
+            if (position)
+                return root.getPreferredBar();
+            return root.getPreferredBar("clockButtonRef") || root.getPreferredBar();
+        }
+
+        function _openDash(tab, position) {
+            const bar = _dashBar(position);
+            if (!bar)
+                return false;
+
+            const tabId = _resolveTabId(tab);
+            const dash = root.dankDashPopoutLoader.item;
+            if (dash && dash.shouldBeVisible && dash.triggerScreen?.name === bar.screen?.name) {
+                if (position && bar.positionDash)
+                    bar.positionDash(dash, position);
+                dash.requestTab(tabId);
+                if (dash.updateSurfacePosition)
+                    dash.updateSurfacePosition();
+                return true;
+            }
+
+            return bar.triggerDashTab(tabId, position);
+        }
+
+        function _toggleDash(tab, position) {
+            if (root.dankDashPopoutLoader.item?.dashVisible) {
+                root.dankDashPopoutLoader.item.dashVisible = false;
+                return true;
+            }
+
+            const bar = _dashBar(position);
+            if (!bar)
+                return false;
+            return bar.triggerDashTab(_resolveTabId(tab), position);
+        }
+
         function resolveTabIndex(tab: string): int {
             return SettingsData.dashTabIndexForId(_resolveTabId(tab));
         }
 
         function open(tab: string): string {
-            const bar = root.getPreferredBar("clockButtonRef") || root.getPreferredBar();
+            return _openDash(tab, "") ? "DASH_OPEN_SUCCESS" : "DASH_OPEN_FAILED";
-            if (!bar)
-                return "DASH_OPEN_FAILED";
-
-            const tabId = _resolveTabId(tab);
-            const dash = root.dankDashPopoutLoader.item;
-            if (dash && dash.shouldBeVisible && dash.triggerScreen?.name === bar.screen?.name) {
-                dash.requestTab(tabId);
-                if (dash.updateSurfacePosition)
-                    dash.updateSurfacePosition();
-                return "DASH_OPEN_SUCCESS";
         }
 
-            if (!bar.triggerDashTab(tabId))
+        function openAt(tab: string, position: string): string {
-                return "DASH_OPEN_FAILED";
+            return _openDash(tab, _resolvePosition(position)) ? "DASH_OPEN_SUCCESS" : "DASH_OPEN_FAILED";
-
-            return "DASH_OPEN_SUCCESS";
         }
 
         function close(): string {
@@ -318,18 +354,11 @@ Item {
         }
 
         function toggle(tab: string): string {
-            if (root.dankDashPopoutLoader.item?.dashVisible) {
+            return _toggleDash(tab, "") ? "DASH_TOGGLE_SUCCESS" : "DASH_TOGGLE_FAILED";
-                root.dankDashPopoutLoader.item.dashVisible = false;
-                return "DASH_TOGGLE_SUCCESS";
         }
 
-            const bar = root.getPreferredBar("clockButtonRef") || root.getPreferredBar();
+        function toggleAt(tab: string, position: string): string {
-            if (bar) {
+            return _toggleDash(tab, _resolvePosition(position)) ? "DASH_TOGGLE_SUCCESS" : "DASH_TOGGLE_FAILED";
-                if (!bar.triggerDashTab(_resolveTabId(tab)))
-                    return "DASH_TOGGLE_FAILED";
-                return "DASH_TOGGLE_SUCCESS";
-            }
-            return "DASH_TOGGLE_FAILED";
         }
 
         target: "dash"
@@ -1994,18 +2023,6 @@ Item {
     }
 
     IpcHandler {
-        function findTrayItem(itemId: string): var {
-            if (!itemId)
-                return null;
-
-            return SystemTray.items.values.find(item => {
-                const id = item?.id || "";
-                const title = item?.tooltipTitle || "";
-                const fullKey = title ? `${id}::${title}` : id;
-                return fullKey === itemId || id === itemId;
-            });
-        }
-
         function list(): string {
             const items = SystemTray.items.values;
             if (items.length === 0)
@@ -2021,7 +2038,7 @@ Item {
         }
 
         function activate(itemId: string): string {
-            const item = findTrayItem(itemId);
+            const item = TrayMenuManager.findTrayItem(itemId);
             if (!item)
                 return `ERROR: Tray item not found: ${itemId}`;
 
@@ -2029,8 +2046,20 @@ Item {
             return `SUCCESS: Activated ${itemId}`;
         }
 
+        function menu(itemId: string): string {
+            const item = TrayMenuManager.findTrayItem(itemId);
+            if (!item)
+                return `ERROR: Tray item not found: ${itemId}`;
+
+            if (!item.hasMenu)
+                return `ERROR: Tray item has no menu: ${itemId}`;
+
+            TrayMenuManager.requestOpenMenu(itemId, BarWidgetService.getFocusedScreenName());
+            return `SUCCESS: Requested menu ${itemId}`;
+        }
+
         function status(itemId: string): string {
-            const item = findTrayItem(itemId);
+            const item = TrayMenuManager.findTrayItem(itemId);
             if (!item)
                 return `ERROR: Tray item not found: ${itemId}`;
 

quickshell/Modals/AppPickerModal.qml

@@ -318,10 +318,6 @@ DankModal {
                     width: parent.width - Theme.spacingS * 2
                     anchors.horizontalCenter: parent.horizontalCenter
                     height: 52
-                    cornerRadius: Theme.cornerRadius
-                    backgroundColor: Theme.withAlpha(Theme.surfaceContainerHigh, Theme.popupTransparency)
-                    normalBorderColor: Theme.outlineMedium
-                    focusedBorderColor: Theme.primary
                     leftIconName: "search"
                     leftIconSize: Theme.iconSize
                     leftIconColor: Theme.surfaceVariantText

quickshell/Modals/Changelog/ChangelogFeatureCard.qml

@@ -15,7 +15,7 @@ Rectangle {
 
     height: Math.round(Theme.fontSizeMedium * 4.2)
     radius: Theme.cornerRadius
-    color: Theme.surfaceContainerHigh
+    color: Theme.floatingWindowNestedSurface
 
     Rectangle {
         anchors.fill: parent

quickshell/Modals/Changelog/ChangelogModal.qml

@@ -4,10 +4,9 @@ import qs.Common
 import qs.Services
 import qs.Widgets
 
-FloatingWindow {
+DankFloatingWindow {
     id: root
 
-    property bool disablePopupTransparency: true
     readonly property int modalWidth: 680
     readonly property int modalHeight: screen ? Math.min(720, screen.height - 80) : 720
 
@@ -21,7 +20,6 @@ FloatingWindow {
     title: i18n("What's New")
     minimumSize: Qt.size(modalWidth, modalHeight)
     maximumSize: Qt.size(modalWidth, modalHeight)
-    color: Theme.surfaceContainer
     visible: false
 
     onClosed: visible = false
@@ -112,7 +110,7 @@ FloatingWindow {
             anchors.right: parent.right
             anchors.bottom: parent.bottom
             height: Math.round(Theme.fontSizeMedium * 4.5)
-            color: Theme.surfaceContainerHigh
+            color: Theme.floatingWindowNestedSurface
 
             Rectangle {
                 anchors.top: parent.top

quickshell/Modals/Common/DankModalConnected.qml

@@ -314,26 +314,20 @@ Item {
     readonly property real alignedWidth: Theme.px(modalWidth, dpr)
     readonly property real alignedHeight: Theme.px(modalHeight, dpr)
 
-    function _frameEdgeInset(side) {
-        if (!effectiveScreen)
-            return 0;
-        return SettingsData.frameEdgeInsetForSide(effectiveScreen, side);
-    }
-
     readonly property real _connectedAlignedX: {
         switch (resolvedConnectedBarSide) {
         case "top":
         case "bottom":
             {
-                const insetL = _frameEdgeInset("left");
+                const insetL = SettingsData.frameEdgeInsetForSide(effectiveScreen, "left");
-                const insetR = _frameEdgeInset("right");
+                const insetR = SettingsData.frameEdgeInsetForSide(effectiveScreen, "right");
                 const usable = Math.max(0, screenWidth - insetL - insetR);
                 return insetL + Math.max(0, (usable - alignedWidth) / 2);
             }
         case "left":
-            return _frameEdgeInset("left");
+            return SettingsData.frameEdgeInsetForSide(effectiveScreen, "left");
         case "right":
-            return screenWidth - alignedWidth - _frameEdgeInset("right");
+            return screenWidth - alignedWidth - SettingsData.frameEdgeInsetForSide(effectiveScreen, "right");
         }
         return 0;
     }
@@ -341,14 +335,14 @@ Item {
     readonly property real _connectedAlignedY: {
         switch (resolvedConnectedBarSide) {
         case "top":
-            return _frameEdgeInset("top");
+            return SettingsData.frameEdgeInsetForSide(effectiveScreen, "top");
         case "bottom":
-            return screenHeight - alignedHeight - _frameEdgeInset("bottom");
+            return screenHeight - alignedHeight - SettingsData.frameEdgeInsetForSide(effectiveScreen, "bottom");
         case "left":
         case "right":
             {
-                const insetT = _frameEdgeInset("top");
+                const insetT = SettingsData.frameEdgeInsetForSide(effectiveScreen, "top");
-                const insetB = _frameEdgeInset("bottom");
+                const insetB = SettingsData.frameEdgeInsetForSide(effectiveScreen, "bottom");
                 const usable = Math.max(0, screenHeight - insetT - insetB);
                 return insetT + Math.max(0, (usable - alignedHeight) / 2);
             }

quickshell/Modals/DankLauncherV2/Controller.qml

@@ -819,6 +819,13 @@ Item {
             }
 
             if (isCategoryFiltered) {
+                var categoryPluginId = AppSearchService.getPluginIdForCategory(appCategory);
+                if (categoryPluginId) {
+                    var pluginCategoryItems = getPluginItems(categoryPluginId, "");
+                    for (var i = 0; i < pluginCategoryItems.length; i++) {
+                        allItems.push(pluginCategoryItems[i]);
+                    }
+                } else {
                     var rawApps = AppSearchService.getAppsInCategory(appCategory);
                     for (var i = 0; i < rawApps.length; i++) {
                         allItems.push(getOrTransformApp(rawApps[i]));
@@ -830,6 +837,7 @@ Item {
                         if (coreAppCats.indexOf(appCategory) !== -1)
                             allItems.push(transformCoreApp(allCoreApps[i]));
                     }
+                }
             } else {
                 var apps = searchApps(searchQuery);
                 for (var i = 0; i < apps.length; i++) {
@@ -839,7 +847,7 @@ Item {
 
             var scoredItems = Scorer.scoreItems(allItems, searchQuery, getFrecencyForItem);
             var sortAlpha = !searchQuery && SettingsData.sortAppsAlphabetically;
-            var newSections = Scorer.groupBySection(scoredItems, sectionDefinitions, sortAlpha, searchQuery ? 50 : 500);
+            var newSections = Scorer.groupBySection(scoredItems, buildDynamicSectionDefs(allItems), sortAlpha, searchQuery ? 50 : 500);
 
             for (var sid in collapsedSections) {
                 for (var i = 0; i < newSections.length; i++) {

quickshell/Modals/DankLauncherV2/DankLauncherV2ModalConnected.qml

@@ -105,12 +105,6 @@ Item {
     }
     readonly property bool _dockBlocksEmergence: frameOwnsConnectedChrome && _dockOccupiesSide(resolvedConnectedBarSide)
 
-    function _frameEdgeInset(side) {
-        if (!effectiveScreen)
-            return 0;
-        return SettingsData.frameEdgeInsetForSide(effectiveScreen, side);
-    }
-
     readonly property var _connectedModalPos: {
         const fallback = {
             "x": (screenWidth - modalWidth) / 2,
@@ -120,10 +114,10 @@ Item {
         case "top":
         case "bottom":
             {
-                const insetL = _frameEdgeInset("left");
+                const insetL = SettingsData.frameEdgeInsetForSide(effectiveScreen, "left");
-                const insetR = _frameEdgeInset("right");
+                const insetR = SettingsData.frameEdgeInsetForSide(effectiveScreen, "right");
-                const insetT = _frameEdgeInset("top");
+                const insetT = SettingsData.frameEdgeInsetForSide(effectiveScreen, "top");
-                const insetB = _frameEdgeInset("bottom");
+                const insetB = SettingsData.frameEdgeInsetForSide(effectiveScreen, "bottom");
                 const usable = Math.max(0, screenWidth - insetL - insetR);
                 const usableH = Math.max(0, screenHeight - insetT - insetB);
                 return {
@@ -134,11 +128,11 @@ Item {
         case "left":
         case "right":
             {
-                const insetT = _frameEdgeInset("top");
+                const insetT = SettingsData.frameEdgeInsetForSide(effectiveScreen, "top");
-                const insetB = _frameEdgeInset("bottom");
+                const insetB = SettingsData.frameEdgeInsetForSide(effectiveScreen, "bottom");
                 const usable = Math.max(0, screenHeight - insetT - insetB);
                 return {
-                    "x": resolvedConnectedBarSide === "left" ? _frameEdgeInset("left") : screenWidth - modalWidth - _frameEdgeInset("right"),
+                    "x": resolvedConnectedBarSide === "left" ? SettingsData.frameEdgeInsetForSide(effectiveScreen, "left") : screenWidth - modalWidth - SettingsData.frameEdgeInsetForSide(effectiveScreen, "right"),
                     "y": insetT + Math.max(0, (usable - modalHeight) / 2)
                 };
             }
@@ -188,16 +182,16 @@ Item {
     readonly property real _connectedChromeY: {
         if (!launcherArcExtenderActive)
             return alignedY;
-        return resolvedConnectedBarSide === "top" ? Theme.snap(_frameEdgeInset("top"), dpr) : alignedY;
+        return resolvedConnectedBarSide === "top" ? Theme.snap(SettingsData.frameEdgeInsetForSide(effectiveScreen, "top"), dpr) : alignedY;
     }
     readonly property real _connectedChromeWidth: alignedWidth
     readonly property real _connectedChromeHeight: {
         if (!launcherArcExtenderActive)
             return alignedHeight;
         if (resolvedConnectedBarSide === "top")
-            return Theme.snap(Math.max(alignedHeight, alignedY + alignedHeight - _frameEdgeInset("top")), dpr);
+            return Theme.snap(Math.max(alignedHeight, alignedY + alignedHeight - SettingsData.frameEdgeInsetForSide(effectiveScreen, "top")), dpr);
         if (resolvedConnectedBarSide === "bottom")
-            return Theme.snap(Math.max(alignedHeight, screenHeight - _frameEdgeInset("bottom") - alignedY), dpr);
+            return Theme.snap(Math.max(alignedHeight, screenHeight - SettingsData.frameEdgeInsetForSide(effectiveScreen, "bottom") - alignedY), dpr);
         return alignedHeight;
     }
     readonly property real contentSurfaceHeight: launcherArcExtenderActive ? _connectedChromeHeight : alignedHeight

quickshell/Modals/DankLauncherV2/LauncherContent.qml

@@ -23,17 +23,6 @@ FocusScope {
     property bool editMode: false
     property var editingApp: null
     property string editAppId: ""
-    readonly property bool _blurActive: Theme.blurForegroundLayers || Theme.transparentBlurLayers
-    readonly property real _launcherFieldAlpha: {
-        if (Theme.transparentBlurLayers)
-            return 0.28;
-        if (Theme.blurForegroundLayers)
-            return Math.max(Theme.popupTransparency, 0.62);
-        return Theme.popupTransparency;
-    }
-    readonly property color _launcherSearchFieldColor: Theme.withAlpha(Theme.surfaceContainerHigh, _launcherFieldAlpha)
-    readonly property color _launcherSearchBorderColor: Theme.withAlpha(Theme.outline, _blurActive ? 0.16 : Theme.layerOutlineOpacity)
-    readonly property color _launcherSearchFocusedBorderColor: Theme.withAlpha(Theme.primary, _blurActive ? 0.72 : 1.0)
 
     function resetScroll() {
         resultsList.resetScroll();
@@ -314,7 +303,7 @@ FocusScope {
                 anchors.fill: parent
                 anchors.topMargin: -Theme.cornerRadius
                 // In connected mode the launcher provides the surface so update the toolbar for arcs
-                visible: !(root.parentModal?.frameOwnsConnectedChrome ?? false) && !root._blurActive
+                visible: !(root.parentModal?.frameOwnsConnectedChrome ?? false) && !Theme.blurLayersActive
                 color: Theme.withAlpha(Theme.surfaceContainerHigh, Theme.popupTransparency)
                 radius: Theme.cornerRadius
             }
@@ -472,12 +461,6 @@ FocusScope {
             DankTextField {
                 id: searchField
                 width: parent.width - (pluginBadge.visible ? pluginBadge.width + Theme.spacingS : 0)
-                cornerRadius: Theme.cornerRadius
-                backgroundColor: root._launcherSearchFieldColor
-                normalBorderColor: root._launcherSearchBorderColor
-                focusedBorderColor: root._launcherSearchFocusedBorderColor
-                borderWidth: 1
-                focusedBorderWidth: 2
                 leftIconName: controller.activePluginId ? "extension" : controller.searchQuery.startsWith("/") ? "folder" : "search"
                 leftIconSize: Theme.iconSize
                 leftIconColor: Theme.surfaceVariantText

quickshell/Modals/DankLauncherV2/Scorer.js

@@ -89,15 +89,6 @@ function fuzzyScore(text, query) {
     return bestScore
 }
 
-function getTimeBucketWeight(daysSinceUsed) {
-    for (var i = 0; i < TimeBuckets.length; i++) {
-        if (daysSinceUsed <= TimeBuckets[i].maxDays) {
-            return TimeBuckets[i].weight
-        }
-    }
-    return 10
-}
-
 function calculateTextScore(name, query) {
     if (name === query) return Weights.exactMatch
     if (name.startsWith(query)) return Weights.prefixMatch

quickshell/Modals/DankLauncherV2/SourceBadge.qml

@@ -7,6 +7,7 @@ Item {
 
     property string source: ""
     property int glyphSize: 14
+    property bool badgeVisible: true
 
     readonly property var sourceAsset: ({
             "flatpak": "../../assets/package-sources/flatpak.svg",
@@ -17,7 +18,7 @@ Item {
 
     readonly property string assetPath: sourceAsset[source] || ""
 
-    visible: SettingsData.dankLauncherV2ShowSourceBadges && assetPath.length > 0
+    visible: badgeVisible && SettingsData.dankLauncherV2ShowSourceBadges && assetPath.length > 0
     implicitWidth: glyphSize
     implicitHeight: glyphSize
 

quickshell/Modals/DankLauncherV2/TileItem.qml

@@ -178,7 +178,7 @@ Rectangle {
                 anchors.margins: Theme.spacingXS
                 source: root.item?.type === "app" ? (root.item.source || "") : ""
                 glyphSize: 16
-                visible: !root.isSelected && !!source
+                badgeVisible: !root.isSelected
             }
         }
     }

quickshell/Modals/Greeter/GreeterCompletePage.qml

@@ -146,7 +146,7 @@ Item {
                     width: parent.width
                     height: keybindsGrid.height + Theme.spacingM * 2
                     radius: Theme.cornerRadius
-                    color: Theme.surfaceContainerHigh
+                    color: Theme.floatingWindowNestedSurface
 
                     readonly property bool useTwoColumns: width > 500
                     readonly property int columnCount: useTwoColumns ? 2 : 1
@@ -240,7 +240,7 @@ Item {
                 width: parent.width
                 height: noKeybindsColumn.height + Theme.spacingM * 2
                 radius: Theme.cornerRadius
-                color: Theme.surfaceContainerHigh
+                color: Theme.floatingWindowNestedSurface
                 visible: !root.hasKeybinds
 
                 Column {

quickshell/Modals/Greeter/GreeterDoctorPage.qml

@@ -291,7 +291,7 @@ Item {
             anchors.leftMargin: Theme.spacingXL
             anchors.rightMargin: Theme.spacingXL
             radius: Theme.cornerRadius
-            color: Theme.surfaceContainerHigh
+            color: Theme.floatingWindowNestedSurface
             clip: true
 
             Column {

quickshell/Modals/Greeter/GreeterFeatureCard.qml

@@ -15,7 +15,7 @@ Rectangle {
 
     height: Math.round(Theme.fontSizeMedium * 6.4)
     radius: Theme.cornerRadius
-    color: Theme.surfaceContainerHigh
+    color: Theme.floatingWindowNestedSurface
 
     Rectangle {
         anchors.fill: parent

quickshell/Modals/Greeter/GreeterModal.qml

@@ -5,11 +5,10 @@ import qs.Common
 import qs.Services
 import qs.Widgets
 
-FloatingWindow {
+DankFloatingWindow {
     id: root
     readonly property var log: Log.scoped("GreeterModal")
 
-    property bool disablePopupTransparency: true
     property int currentPage: 0
     readonly property int totalPages: 3
     readonly property var pageComponents: [welcomePage, doctorPage, completePage]
@@ -90,7 +89,6 @@ FloatingWindow {
     title: I18n.tr("Welcome", "greeter modal window title")
     minimumSize: Qt.size(modalWidth, modalHeight)
     maximumSize: Qt.size(modalWidth, modalHeight)
-    color: Theme.surfaceContainer
     visible: false
 
     onClosed: visible = false
@@ -173,7 +171,7 @@ FloatingWindow {
                 width: pageIndicatorRow.width + Theme.spacingM * 2
                 height: indicatorHeight
                 radius: indicatorHeight / 2
-                color: Theme.surfaceContainerHigh
+                color: Theme.floatingWindowNestedSurface
 
                 Row {
                     id: pageIndicatorRow
@@ -259,7 +257,7 @@ FloatingWindow {
             anchors.right: parent.right
             anchors.bottom: parent.bottom
             height: Math.round(Theme.fontSizeMedium * 4.5)
-            color: Theme.surfaceContainerHigh
+            color: Theme.floatingWindowNestedSurface
 
             Rectangle {
                 anchors.top: parent.top

quickshell/Modals/Greeter/GreeterQuickLink.qml

@@ -13,7 +13,7 @@ Rectangle {
 
     height: Math.round(Theme.fontSizeMedium * 3.1)
     radius: Theme.cornerRadius
-    color: Theme.surfaceContainerHigh
+    color: Theme.floatingWindowNestedSurface
 
     Rectangle {
         anchors.fill: parent

quickshell/Modals/Greeter/GreeterSettingsCard.qml

@@ -15,7 +15,7 @@ Rectangle {
 
     height: Math.round(Theme.fontSizeMedium * 4.5)
     radius: Theme.cornerRadius
-    color: Theme.surfaceContainerHigh
+    color: Theme.floatingWindowNestedSurface
 
     Rectangle {
         anchors.fill: parent

quickshell/Modals/Greeter/GreeterStatusCard.qml

@@ -9,7 +9,7 @@ Rectangle {
     property string label: ""
     property string iconName: ""
     property color iconColor: Theme.surfaceText
-    property color bgColor: Theme.surfaceContainerHigh
+    property color bgColor: Theme.floatingWindowNestedSurface
     property bool selected: false
 
     signal clicked

quickshell/Modals/KeybindsModalWindow.qml

@@ -5,10 +5,9 @@ import qs.Modals
 import qs.Services
 import qs.Widgets
 
-FloatingWindow {
+DankFloatingWindow {
     id: win
 
-    property bool disablePopupTransparency: true
     property alias shouldBeVisible: win.visible
 
     signal floatingToggleRequested
@@ -30,7 +29,6 @@ FloatingWindow {
     minimumSize: Qt.size(Math.min(560, Screen.width), Math.min(400, Screen.height))
     implicitWidth: 1000
     implicitHeight: screen ? Math.min(820, screen.height - 100) : 820
-    color: Theme.surfaceContainer
     visible: false
 
     onVisibleChanged: {
@@ -61,12 +59,6 @@ FloatingWindow {
                 onDoubleClicked: windowControls.tryToggleMaximize()
             }
 
-            Rectangle {
-                anchors.fill: parent
-                color: Theme.surfaceContainer
-                opacity: 0.5
-            }
-
             Row {
                 anchors.left: parent.left
                 anchors.leftMargin: Theme.spacingL

quickshell/Modals/MuxModal.qml

@@ -313,10 +313,6 @@ DankModal {
 
                 width: parent.width
                 height: 48
-                cornerRadius: Theme.cornerRadius
-                backgroundColor: Theme.surfaceContainerHigh
-                normalBorderColor: Theme.outlineMedium
-                focusedBorderColor: Theme.primary
                 leftIconName: "search"
                 leftIconSize: Theme.iconSize
                 leftIconColor: Theme.surfaceVariantText

quickshell/Modals/NotificationModal.qml

@@ -64,6 +64,10 @@ DankModal {
         NotificationService.dismissAllPopups();
     }
 
+    function dismissLastNotification() {
+        NotificationService.dismissLastNotification();
+    }
+
     modalWidth: Math.min(500, screenWidth - 48)
     modalHeight: Math.min(700, screenHeight * 0.85)
     backgroundColor: Theme.withAlpha(Theme.surfaceContainer, Theme.popupTransparency)
@@ -190,6 +194,11 @@ DankModal {
             return "NOTIFICATION_MODAL_DISMISS_ALL_POPUPS_SUCCESS";
         }
 
+        function dismiss(): string {
+            notificationModal.dismissLastNotification();
+            return "NOTIFICATION_DISMISS_SUCCESS";
+        }
+
         target: "notifications"
     }
 

quickshell/Modals/PolkitAuthContent.qml

@@ -202,7 +202,7 @@ FocusScope {
             StyledText {
                 text: root.currentFlow?.message ?? ""
                 font.pixelSize: Theme.fontSizeMedium
-                color: Theme.surfaceTextMedium
+                color: Theme.surfaceText
                 width: parent.width
                 wrapMode: Text.Wrap
                 maximumLineCount: 2
@@ -272,11 +272,6 @@ FocusScope {
 
             width: parent.width
             height: root.inputFieldHeight
-            backgroundColor: Theme.surfaceHover
-            normalBorderColor: Theme.outlineStrong
-            focusedBorderColor: Theme.primary
-            borderWidth: 1
-            focusedBorderWidth: 2
             leftIconName: root.polkitPamHasFprint ? "fingerprint" : ""
             leftIconSize: 20
             leftIconColor: Theme.primary
@@ -352,7 +347,7 @@ FocusScope {
                         anchors.centerIn: parent
                         text: I18n.tr("Authenticate")
                         font.pixelSize: Theme.fontSizeMedium
-                        color: Theme.background
+                        color: Theme.primaryText
                         font.weight: Font.Medium
                     }
 

quickshell/Modals/PolkitAuthModal.qml

@@ -4,11 +4,9 @@ import qs.Common
 import qs.Services
 import qs.Widgets
 
-FloatingWindow {
+DankFloatingWindow {
     id: root
 
-    property bool disablePopupTransparency: true
-
     function show() {
         if (contentLoader.item)
             contentLoader.item.reset();
@@ -29,7 +27,6 @@ FloatingWindow {
     title: I18n.tr("Authentication")
     minimumSize: Qt.size(460, 220)
     maximumSize: Qt.size(460, 220)
-    color: Theme.surfaceContainer
     visible: false
 
     onClosed: hide()

quickshell/Modals/PowerMenuModal.qml

@@ -129,6 +129,13 @@ DankModal {
             switchUserRequested();
             return;
         }
+        if (action.startsWith("custom:")) {
+            const button = (SettingsData.customPowerButtons || [])[parseInt(action.slice(7), 10)];
+            close();
+            if (button?.command)
+                Quickshell.execDetached(["sh", "-c", button.command]);
+            return;
+        }
         close();
         root.powerActionRequested(action, "", "");
     }
@@ -172,11 +179,14 @@ DankModal {
 
     function updateVisibleActions() {
         const allActions = SettingsData.powerMenuActions || ["reboot", "logout", "poweroff", "lock", "suspend", "restart"];
+        const customButtons = SettingsData.customPowerButtons || [];
         visibleActions = allActions.filter(action => {
             if (action === "hibernate" && !SessionService.hibernateSupported)
                 return false;
+            if (action === "softreboot" && !SessionService.softRebootSupported)
+                return false;
             return true;
-        });
+        }).concat(customButtons.map((button, i) => "custom:" + i));
 
         if (!SettingsData.powerMenuGridLayout)
             return;
@@ -216,6 +226,14 @@ DankModal {
     }
 
     function getActionData(action) {
+        if (action.startsWith("custom:")) {
+            const button = (SettingsData.customPowerButtons || [])[parseInt(action.slice(7), 10)];
+            return {
+                "icon": button?.icon || "terminal",
+                "label": button?.label || button?.command || "",
+                "key": ""
+            };
+        }
         switch (action) {
         case "reboot":
             return {
@@ -223,6 +241,12 @@ DankModal {
                 "label": I18n.tr("Reboot"),
                 "key": "R"
             };
+        case "softreboot":
+            return {
+                "icon": "autorenew",
+                "label": I18n.tr("Soft Reboot"),
+                "key": "B"
+            };
         case "logout":
             return {
                 "icon": "logout",
@@ -370,7 +394,7 @@ DankModal {
 
     function handleListNavigation(event, isPressed) {
         if (!isPressed) {
-            if (event.key === Qt.Key_Return || event.key === Qt.Key_Enter || event.key === Qt.Key_R || event.key === Qt.Key_X || event.key === Qt.Key_L || event.key === Qt.Key_S || event.key === Qt.Key_H || event.key === Qt.Key_D || (event.key === Qt.Key_P && !(event.modifiers & Qt.ControlModifier))) {
+            if (event.key === Qt.Key_Return || event.key === Qt.Key_Enter || event.key === Qt.Key_R || event.key === Qt.Key_B || event.key === Qt.Key_X || event.key === Qt.Key_L || event.key === Qt.Key_S || event.key === Qt.Key_H || event.key === Qt.Key_D || (event.key === Qt.Key_P && !(event.modifiers & Qt.ControlModifier))) {
                 cancelHold();
                 event.accepted = true;
             }
@@ -429,6 +453,12 @@ DankModal {
                 event.accepted = true;
             }
             break;
+        case Qt.Key_B:
+            if (visibleActions.includes("softreboot")) {
+                startHold("softreboot", visibleActions.indexOf("softreboot"));
+                event.accepted = true;
+            }
+            break;
         case Qt.Key_X:
             if (visibleActions.includes("logout")) {
                 startHold("logout", visibleActions.indexOf("logout"));
@@ -464,7 +494,7 @@ DankModal {
 
     function handleGridNavigation(event, isPressed) {
         if (!isPressed) {
-            if (event.key === Qt.Key_Return || event.key === Qt.Key_Enter || event.key === Qt.Key_R || event.key === Qt.Key_X || event.key === Qt.Key_L || event.key === Qt.Key_S || event.key === Qt.Key_H || event.key === Qt.Key_D || (event.key === Qt.Key_P && !(event.modifiers & Qt.ControlModifier))) {
+            if (event.key === Qt.Key_Return || event.key === Qt.Key_Enter || event.key === Qt.Key_R || event.key === Qt.Key_B || event.key === Qt.Key_X || event.key === Qt.Key_L || event.key === Qt.Key_S || event.key === Qt.Key_H || event.key === Qt.Key_D || (event.key === Qt.Key_P && !(event.modifiers & Qt.ControlModifier))) {
                 cancelHold();
                 event.accepted = true;
             }
@@ -539,6 +569,12 @@ DankModal {
                 event.accepted = true;
             }
             break;
+        case Qt.Key_B:
+            if (visibleActions.includes("softreboot")) {
+                startHold("softreboot", visibleActions.indexOf("softreboot"));
+                event.accepted = true;
+            }
+            break;
         case Qt.Key_X:
             if (visibleActions.includes("logout")) {
                 startHold("logout", visibleActions.indexOf("logout"));
@@ -597,7 +633,7 @@ DankModal {
 
                         readonly property var actionData: root.getActionData(modelData)
                         readonly property bool isSelected: root.selectedIndex === index
-                        readonly property bool showWarning: modelData === "reboot" || modelData === "poweroff"
+                        readonly property bool showWarning: modelData === "reboot" || modelData === "softreboot" || modelData === "poweroff"
                         readonly property bool isHolding: root.holdActionIndex === index && root.holdProgress > 0
 
                         width: (root.modalWidth - Theme.spacingL * 2 - Theme.spacingS * (root.gridColumns - 1)) / root.gridColumns
@@ -627,7 +663,7 @@ DankModal {
                                 color: {
                                     if (gridButtonRect.modelData === "poweroff")
                                         return Theme.errorSelected;
-                                    if (gridButtonRect.modelData === "reboot")
+                                    if (gridButtonRect.modelData === "reboot" || gridButtonRect.modelData === "softreboot")
                                         return Theme.withAlpha(Theme.warning, 0.3);
                                     return Theme.primarySelected;
                                 }
@@ -668,6 +704,7 @@ DankModal {
                                 height: 16
                                 radius: 4
                                 color: Theme.onSurface_12
+                                visible: gridButtonRect.actionData.key !== ""
                                 anchors.horizontalCenter: parent.horizontalCenter
 
                                 StyledText {
@@ -722,7 +759,7 @@ DankModal {
 
                         readonly property var actionData: root.getActionData(modelData)
                         readonly property bool isSelected: root.selectedIndex === index
-                        readonly property bool showWarning: modelData === "reboot" || modelData === "poweroff"
+                        readonly property bool showWarning: modelData === "reboot" || modelData === "softreboot" || modelData === "poweroff"
                         readonly property bool isHolding: root.holdActionIndex === index && root.holdProgress > 0
 
                         width: parent.width
@@ -752,7 +789,7 @@ DankModal {
                                 color: {
                                     if (listButtonRect.modelData === "poweroff")
                                         return Theme.errorSelected;
-                                    if (listButtonRect.modelData === "reboot")
+                                    if (listButtonRect.modelData === "reboot" || listButtonRect.modelData === "softreboot")
                                         return Theme.withAlpha(Theme.warning, 0.3);
                                     return Theme.primarySelected;
                                 }
@@ -800,6 +837,7 @@ DankModal {
                             height: 20
                             radius: 4
                             color: Theme.onSurface_12
+                            visible: listButtonRect.actionData.key !== ""
                             anchors {
                                 right: parent.right
                                 rightMargin: Theme.spacingM