flake: update-common

.github/workflows/go-ci.yml

@@ -50,39 +50,8 @@ jobs:
       - name: Build dms
         run: go build -v ./cmd/dms
 
-      - name: Build dms (embedded shell)
-        run: make build
-
       - name: Build dms (distropkg)
-        run: go build -v -tags 'distro_binary withshell' ./cmd/dms
+        run: go build -v -tags distro_binary ./cmd/dms
 
       - name: Build dankinstall
         run: go build -v ./cmd/dankinstall
-
-  build-freebsd:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: core
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          submodules: recursive
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: ./core/go.mod
-
-      - name: Build all packages
-        env:
-          GOOS: freebsd
-          CGO_ENABLED: 0
-        run: go build -v ./...
-
-      - name: Build dms (distropkg, embedded shell)
-        run: |
-          make sync-shell
-          GOOS=freebsd CGO_ENABLED=0 go build -v -tags 'distro_binary withshell' ./cmd/dms

.github/workflows/nix-pr-check.yml

@@ -33,6 +33,8 @@ jobs:
       - name: Run NixOS service start test
         run: nix build .#nixosTests.x86_64-linux.nixos-service-start-module -L
 
+      - name: Run greeter niri test
+        run: nix build .#nixosTests.x86_64-linux.greeter-niri-module -L
 
       - name: Run home-manager module test
         run: nix build .#nixosTests.x86_64-linux.home-manager-module -L

.github/workflows/release.yml

@@ -27,11 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        include:
-          - { goos: linux, arch: amd64 }
-          - { goos: linux, arch: arm64 }
-          - { goos: freebsd, arch: amd64 }
-          - { goos: freebsd, arch: arm64 }
+        arch: [amd64, arm64]
 
     defaults:
       run:
@@ -39,8 +35,6 @@ jobs:
 
     env:
       TAG: ${{ inputs.tag }}
-      # linux assets keep their historical arch-only names
-      ASSET: ${{ matrix.goos == 'linux' && matrix.arch || format('{0}-{1}', matrix.goos, matrix.arch) }}
 
     steps:
       - name: Checkout
@@ -56,7 +50,6 @@ jobs:
           go-version-file: ./core/go.mod
 
       - name: Format check
-        if: matrix.goos == 'linux'
         run: |
           if [ "$(gofmt -s -l . | wc -l)" -gt 0 ]; then
             echo "The following files are not formatted:"
@@ -65,43 +58,38 @@ jobs:
           fi
 
       - name: Run tests
-        if: matrix.goos == 'linux'
         run: go test -v ./...
 
-      - name: Build dankinstall (${{ env.ASSET }})
-        if: matrix.goos == 'linux'
+      - name: Build dankinstall (${{ matrix.arch }})
         env:
-          GOOS: ${{ matrix.goos }}
+          GOOS: linux
           CGO_ENABLED: 0
           GOARCH: ${{ matrix.arch }}
         run: |
           set -eux
           cd cmd/dankinstall
           go build -trimpath -ldflags "-s -w -X main.Version=${TAG}" \
-            -o ../../dankinstall-${{ env.ASSET }}
+            -o ../../dankinstall-${{ matrix.arch }}
           cd ../..
-          gzip -9 -k dankinstall-${{ env.ASSET }}
-          sha256sum dankinstall-${{ env.ASSET }}.gz > dankinstall-${{ env.ASSET }}.gz.sha256
+          gzip -9 -k dankinstall-${{ matrix.arch }}
+          sha256sum dankinstall-${{ matrix.arch }}.gz > dankinstall-${{ matrix.arch }}.gz.sha256
 
-      - name: Sync embedded shell
-        run: make sync-shell
-
-      - name: Build dms (${{ env.ASSET }})
+      - name: Build dms (${{ matrix.arch }})
         env:
-          GOOS: ${{ matrix.goos }}
+          GOOS: linux
           CGO_ENABLED: 0
           GOARCH: ${{ matrix.arch }}
         run: |
           set -eux
           cd cmd/dms
-          go build -trimpath -tags withshell -ldflags "-s -w -X main.Version=${TAG}" \
-            -o ../../dms-${{ env.ASSET }}
+          go build -trimpath -ldflags "-s -w -X main.Version=${TAG}" \
+            -o ../../dms-${{ matrix.arch }}
           cd ../..
-          gzip -9 -k dms-${{ env.ASSET }}
-          sha256sum dms-${{ env.ASSET }}.gz > dms-${{ env.ASSET }}.gz.sha256
+          gzip -9 -k dms-${{ matrix.arch }}
+          sha256sum dms-${{ matrix.arch }}.gz > dms-${{ matrix.arch }}.gz.sha256
 
       - name: Generate shell completions
-        if: matrix.goos == 'linux' && matrix.arch == 'amd64'
+        if: matrix.arch == 'amd64'
         run: |
           set -eux
           chmod +x dms-amd64
@@ -109,58 +97,46 @@ jobs:
           ./dms-amd64 completion fish > completion.fish
           ./dms-amd64 completion zsh > completion.zsh
 
-      - name: Build dms-distropkg (${{ env.ASSET }})
+      - name: Build dms-distropkg (${{ matrix.arch }})
         env:
-          GOOS: ${{ matrix.goos }}
+          GOOS: linux
           CGO_ENABLED: 0
           GOARCH: ${{ matrix.arch }}
         run: |
           set -eux
           cd cmd/dms
-          go build -trimpath -tags 'distro_binary withshell' -ldflags "-s -w -X main.Version=${TAG}" \
-            -o ../../dms-distropkg-${{ env.ASSET }}
+          go build -trimpath -tags distro_binary -ldflags "-s -w -X main.Version=${TAG}" \
+            -o ../../dms-distropkg-${{ matrix.arch }}
           cd ../..
-          gzip -9 -k dms-distropkg-${{ env.ASSET }}
-          sha256sum dms-distropkg-${{ env.ASSET }}.gz > dms-distropkg-${{ env.ASSET }}.gz.sha256
+          gzip -9 -k dms-distropkg-${{ matrix.arch }}
+          sha256sum dms-distropkg-${{ matrix.arch }}.gz > dms-distropkg-${{ matrix.arch }}.gz.sha256
 
-      - name: Upload artifacts (${{ env.ASSET }})
-        if: matrix.goos == 'linux' && matrix.arch == 'arm64'
+      - name: Upload artifacts (${{ matrix.arch }})
+        if: matrix.arch == 'arm64'
         uses: actions/upload-artifact@v5
         with:
-          name: core-assets-${{ env.ASSET }}
+          name: core-assets-${{ matrix.arch }}
           path: |
-            core/dankinstall-${{ env.ASSET }}.gz
-            core/dankinstall-${{ env.ASSET }}.gz.sha256
-            core/dms-${{ env.ASSET }}.gz
-            core/dms-${{ env.ASSET }}.gz.sha256
-            core/dms-distropkg-${{ env.ASSET }}.gz
-            core/dms-distropkg-${{ env.ASSET }}.gz.sha256
-          if-no-files-found: error
-
-      - name: Upload artifacts (${{ env.ASSET }}, no installer)
-        if: matrix.goos != 'linux'
-        uses: actions/upload-artifact@v5
-        with:
-          name: core-assets-${{ env.ASSET }}
-          path: |
-            core/dms-${{ env.ASSET }}.gz
-            core/dms-${{ env.ASSET }}.gz.sha256
-            core/dms-distropkg-${{ env.ASSET }}.gz
-            core/dms-distropkg-${{ env.ASSET }}.gz.sha256
+            core/dankinstall-${{ matrix.arch }}.gz
+            core/dankinstall-${{ matrix.arch }}.gz.sha256
+            core/dms-${{ matrix.arch }}.gz
+            core/dms-${{ matrix.arch }}.gz.sha256
+            core/dms-distropkg-${{ matrix.arch }}.gz
+            core/dms-distropkg-${{ matrix.arch }}.gz.sha256
           if-no-files-found: error
 
       - name: Upload artifacts with completions
-        if: matrix.goos == 'linux' && matrix.arch == 'amd64'
+        if: matrix.arch == 'amd64'
         uses: actions/upload-artifact@v5
         with:
-          name: core-assets-${{ env.ASSET }}
+          name: core-assets-${{ matrix.arch }}
           path: |
-            core/dankinstall-${{ env.ASSET }}.gz
-            core/dankinstall-${{ env.ASSET }}.gz.sha256
-            core/dms-${{ env.ASSET }}.gz
-            core/dms-${{ env.ASSET }}.gz.sha256
-            core/dms-distropkg-${{ env.ASSET }}.gz
-            core/dms-distropkg-${{ env.ASSET }}.gz.sha256
+            core/dankinstall-${{ matrix.arch }}.gz
+            core/dankinstall-${{ matrix.arch }}.gz.sha256
+            core/dms-${{ matrix.arch }}.gz
+            core/dms-${{ matrix.arch }}.gz.sha256
+            core/dms-distropkg-${{ matrix.arch }}.gz
+            core/dms-distropkg-${{ matrix.arch }}.gz.sha256
             core/completion.bash
             core/completion.fish
             core/completion.zsh
@@ -269,18 +245,12 @@ jobs:
           ### Complete Packages
           - **`dms-full-amd64.tar.gz`** - Complete package for x86_64 systems (CLI binaries + QML source + shell completions + installation guide)
           - **`dms-full-arm64.tar.gz`** - Complete package for ARM64 systems (CLI binaries + QML source + shell completions + installation guide)
-          - **`dms-full-freebsd-amd64.tar.gz`** - Complete package for FreeBSD x86_64 systems
-          - **`dms-full-freebsd-arm64.tar.gz`** - Complete package for FreeBSD ARM64 systems
 
           ### Individual Components
           - **`dms-cli-amd64.gz`** - DMS CLI binary for x86_64 systems
           - **`dms-cli-arm64.gz`** - DMS CLI binary for ARM64 systems
-          - **`dms-cli-freebsd-amd64.gz`** - DMS CLI binary for FreeBSD x86_64 systems
-          - **`dms-cli-freebsd-arm64.gz`** - DMS CLI binary for FreeBSD ARM64 systems
           - **`dms-distropkg-amd64.gz`** - DMS CLI binary built with distro_package tag for AMD64 systems
           - **`dms-distropkg-arm64.gz`** - DMS CLI binary built with distro_package tag for ARM64 systems
-          - **`dms-distropkg-freebsd-amd64.gz`** - DMS CLI binary built with distro_package tag for FreeBSD x86_64 systems
-          - **`dms-distropkg-freebsd-arm64.gz`** - DMS CLI binary built with distro_package tag for FreeBSD ARM64 systems
           - **`dankinstall-amd64.gz`** - Installer binary for x86_64 systems
           - **`dankinstall-arm64.gz`** - Installer binary for ARM64 systems
           - **`dms-cli-<version>.tar.gz`** - Go source code with vendored modules (for distro packaging)
@@ -365,8 +335,8 @@ jobs:
           # Generate checksum for QML package
           (cd _release_assets && sha256sum dms-qml.tar.gz > dms-qml.tar.gz.sha256)
 
-          # Create full packages for each os/architecture
-          for arch in amd64 arm64 freebsd-amd64 freebsd-arm64; do
+          # Create full packages for each architecture
+          for arch in amd64 arm64; do
             mkdir -p _temp_full/dms
             mkdir -p _temp_full/bin
             mkdir -p _temp_full/completions
@@ -409,16 +379,18 @@ jobs:
 
           ## Installation Steps
 
-          The Quickshell UI is embedded in the `dms` binary. The bundled `dms/`
-          tree is optional — pass it with `-c` or `DMS_SHELL_DIR` to run a
-          modified copy instead of the embedded UI.
+          1. **Install quickshell assets:**
+             ```bash
+             mkdir -p ~/.config/quickshell
+             cp -r dms ~/.config/quickshell/
+             ```
 
-          1. **Install the DMS CLI binaries:**
+          2. **Install the DMS CLI binaries:**
              ```bash
              sudo install -m 755 bin/dms /usr/local/bin/dms
              ```
 
-          2. **Install shell completions (optional):**
+          3. **Install shell completions (optional):**
              ```bash
              # Bash
              sudo install -m 644 completions/completion.bash /usr/share/bash-completion/completions/dms
@@ -430,7 +402,7 @@ jobs:
              sudo install -m 644 completions/completion.zsh /usr/share/zsh/site-functions/_dms
              ```
 
-          3. **Start the shell:**
+          4. **Start the shell:**
              ```bash
              dms run
              ```

.github/workflows/run-copr.yml

@@ -4,12 +4,14 @@ on:
   workflow_dispatch:
     inputs:
       package:
-        description: 'Package to build'
+        description: 'Package to build (dms, dms-greeter, or both)'
         required: false
         default: 'dms'
         type: choice
         options:
           - dms
+          - dms-greeter
+          - both
       version:
         description: 'Versioning (e.g., 1.0.3, leave empty for latest release)'
         required: false
@@ -29,7 +31,11 @@ jobs:
         id: set-packages
         run: |
           PACKAGE_INPUT="${{ github.event.inputs.package || 'dms' }}"
-          echo "packages=[\"$PACKAGE_INPUT\"]" >> $GITHUB_OUTPUT
+          if [ "$PACKAGE_INPUT" = "both" ]; then
+            echo 'packages=["dms","dms-greeter"]' >> $GITHUB_OUTPUT
+          else
+            echo "packages=[\"$PACKAGE_INPUT\"]" >> $GITHUB_OUTPUT
+          fi
 
   build-and-upload:
     needs: determine-packages
@@ -157,6 +163,8 @@ jobs:
           PACKAGE="${{ matrix.package }}"
           if [ "$PACKAGE" = "dms" ]; then
             COPR_PROJECT="avengemedia/dms"
+          elif [ "$PACKAGE" = "dms-greeter" ]; then
+            COPR_PROJECT="avengemedia/danklinux"
           else
             echo "❌ Unknown package: $PACKAGE"
             exit 1

.github/workflows/run-obs.yml

@@ -9,6 +9,7 @@ on:
         type: choice
         options:
           - dms
+          - dms-greeter
           - dms-git
           - all
         default: "dms"
@@ -74,12 +75,27 @@ jobs:
             fi
           }
 
+          # Helper function to check dms-greeter stable tag
+          check_dms_greeter_stable() {
+            LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
+            local OBS_SPEC=$(curl -s -u "$OBS_USERNAME:$OBS_PASSWORD" "https://api.opensuse.org/source/home:AvengeMedia:danklinux/dms-greeter/dms-greeter.spec" 2>/dev/null || echo "")
+            local OBS_VERSION=$(echo "$OBS_SPEC" | grep "^Version:" | awk '{print $2}' | xargs | sed 's/^v//')
+
+            if [[ -n "$LATEST_TAG" && "$LATEST_TAG" == "v$OBS_VERSION" ]]; then
+              echo "📋 dms-greeter: Tag $LATEST_TAG already exists, skipping"
+              return 1  # No update needed
+            else
+              echo "📋 dms-greeter: New tag ${LATEST_TAG:-unknown} (OBS has ${OBS_VERSION:-none})"
+              return 0  # Update needed
+            fi
+          }
+
           # Main logic
           REBUILD="${{ github.event.inputs.rebuild_release }}"
 
           if [[ "${{ github.ref }}" =~ ^refs/tags/ ]] && [[ -z "${{ github.event.inputs.package }}" ]]; then
-            # Run from tag with no package specified - update stable package
-            echo "packages=dms" >> $GITHUB_OUTPUT
+            # Run from tag with no package specified - update both stable packages
+            echo "packages=dms dms-greeter" >> $GITHUB_OUTPUT
             VERSION="${GITHUB_REF#refs/tags/}"
             echo "version=$VERSION" >> $GITHUB_OUTPUT
             echo "has_updates=true" >> $GITHUB_OUTPUT
@@ -105,7 +121,7 @@ jobs:
               echo "🔄 Manual rebuild requested: $PKG (db$REBUILD)"
 
             elif [[ "$PKG" == "all" ]]; then
-              # Check the stable package and build list of those needing updates
+              # Check each stable package and build list of those needing updates
               PACKAGES_TO_UPDATE=()
               if check_dms_stable; then
                 PACKAGES_TO_UPDATE+=("dms")
@@ -113,6 +129,10 @@ jobs:
                   echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
                 fi
               fi
+              if check_dms_greeter_stable; then
+                PACKAGES_TO_UPDATE+=("dms-greeter")
+                [[ -n "$LATEST_TAG" ]] && echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+              fi
 
               if [[ ${#PACKAGES_TO_UPDATE[@]} -gt 0 ]]; then
                 echo "packages=${PACKAGES_TO_UPDATE[*]}" >> $GITHUB_OUTPUT
@@ -121,7 +141,7 @@ jobs:
               else
                 echo "packages=" >> $GITHUB_OUTPUT
                 echo "has_updates=false" >> $GITHUB_OUTPUT
-                echo "✓ All packages up to date"
+                echo "✓ Both packages up to date"
               fi
 
             elif [[ "$PKG" == "dms-git" ]]; then
@@ -145,6 +165,18 @@ jobs:
                 echo "has_updates=false" >> $GITHUB_OUTPUT
               fi
 
+            elif [[ "$PKG" == "dms-greeter" ]]; then
+              if check_dms_greeter_stable; then
+                echo "packages=$PKG" >> $GITHUB_OUTPUT
+                echo "has_updates=true" >> $GITHUB_OUTPUT
+                if [[ -n "$LATEST_TAG" ]]; then
+                  echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+                fi
+              else
+                echo "packages=" >> $GITHUB_OUTPUT
+                echo "has_updates=false" >> $GITHUB_OUTPUT
+              fi
+
             else
               # Unknown package - proceed anyway
               echo "packages=$PKG" >> $GITHUB_OUTPUT
@@ -189,9 +221,9 @@ jobs:
           elif [[ -n "${{ github.event.inputs.package }}" ]]; then
             # Manual workflow dispatch
 
-            # Determine version for dms stable using the API
+            # Determine version for dms stable and dms-greeter using the API
             # GITHUB_REF is unreliable when "Use workflow from" a tag; API works from any ref
-            if [[ "${{ github.event.inputs.package }}" == "dms" ]] || [[ "${{ github.event.inputs.package }}" == "all" ]]; then
+            if [[ "${{ github.event.inputs.package }}" == "dms" ]] || [[ "${{ github.event.inputs.package }}" == "dms-greeter" ]] || [[ "${{ github.event.inputs.package }}" == "all" ]]; then
               LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
               if [[ -n "$LATEST_TAG" ]]; then
                 echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
@@ -257,7 +289,7 @@ jobs:
             echo " -- Avenge Media <[email protected]>  $CHANGELOG_DATE"
           } > "distro/debian/dms-git/debian/changelog"
 
-      - name: Update stable version (dms)
+      - name: Update stable version (dms + dms-greeter)
         if: steps.packages.outputs.version != ''
         run: |
           VERSION="${{ steps.packages.outputs.version }}"
@@ -293,12 +325,25 @@ jobs:
             fi
           fi
 
+          # Update dms-greeter changelog when dms-greeter is in the upload list
+          if [[ "$PACKAGES" == *"dms-greeter"* ]] && [[ -f "distro/debian/dms-greeter/debian/changelog" ]]; then
+            CHANGELOG_DATE=$(date -R)
+            {
+              echo "dms-greeter (${VERSION_NO_V}db1) unstable; urgency=medium"
+              echo ""
+              echo "  * Update to $VERSION stable release"
+              echo ""
+              echo " -- Avenge Media <[email protected]>  $CHANGELOG_DATE"
+            } > "distro/debian/dms-greeter/debian/changelog"
+            echo "✓ Updated dms-greeter changelog to ${VERSION_NO_V}db1"
+          fi
+
           # Update Debian _service files for packages in upload list (download_url paths)
           for service in distro/debian/*/_service; do
             if [[ -f "$service" ]]; then
               # Update tar_scm revision parameter (for dms-git)
               sed -i "s|<param name=\"revision\">v[0-9.]*</param>|<param name=\"revision\">$VERSION</param>|" "$service"
-              # Update download_url paths (for dms stable)
+              # Update download_url paths (for dms, dms-greeter stable)
               sed -i "s|/v[0-9.]\+/|/$VERSION/|g" "$service"
               sed -i "s|/tags/v[0-9.]\+\.tar\.gz|/tags/$VERSION.tar.gz|g" "$service"
             fi
@@ -359,7 +404,7 @@ jobs:
           UPLOADED_PACKAGES=()
           SKIPPED_PACKAGES=()
 
-          # PACKAGES can be a space-separated list (from the "all" check)
+          # PACKAGES can be space-separated list (e.g., "dms dms-greeter" from "all" check)
           # Loop through each package and upload
           for PKG in $PACKAGES; do
             echo ""
@@ -462,6 +507,9 @@ jobs:
                 dms-git)
                   echo "- $STATUS_ICON **dms-git** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms-git/dms-git)" >> $GITHUB_STEP_SUMMARY
                   ;;
+                dms-greeter)
+                  echo "- $STATUS_ICON **dms-greeter** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:danklinux/dms-greeter)" >> $GITHUB_STEP_SUMMARY
+                  ;;
               esac
             done
             echo "" >> $GITHUB_STEP_SUMMARY

.github/workflows/run-ppa.yml

@@ -9,6 +9,7 @@ on:
         type: choice
         options:
           - dms
+          - dms-greeter
           - dms-git
           - all
         default: "dms"
@@ -134,6 +135,7 @@ jobs:
           case "$PACKAGE" in
             dms) PPA_NAME="dms" ;;
             dms-git) PPA_NAME="dms-git" ;;
+            dms-greeter) PPA_NAME="danklinux" ;;
             *) echo "::error::Unknown package $PACKAGE"; exit 1 ;;
           esac
 
@@ -148,3 +150,4 @@ jobs:
           echo "- **Target:** ${{ matrix.target }}" >> "$GITHUB_STEP_SUMMARY"
           echo "- **DMS PPA:** https://launchpad.net/~avengemedia/+archive/ubuntu/dms/+packages" >> "$GITHUB_STEP_SUMMARY"
           echo "- **DMS-Git PPA:** https://launchpad.net/~avengemedia/+archive/ubuntu/dms-git/+packages" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **DankLinux PPA:** https://launchpad.net/~avengemedia/+archive/ubuntu/danklinux/+packages" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/run-xbps.yml

@@ -27,6 +27,11 @@ on:
         type: boolean
         required: false
         default: true
+      build_greeter:
+        description: 'Build stable dms-greeter package'
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   contents: read
@@ -101,6 +106,7 @@ jobs:
       - name: Inject templates
         run: |
           cp -R distro/void/srcpkgs/dms void-packages/srcpkgs/
+          cp -R distro/void/srcpkgs/dms-greeter void-packages/srcpkgs/
           cp -R distro/void/srcpkgs/dms-git void-packages/srcpkgs/
 
       - name: Enable unprivileged user namespaces (Ubuntu 24.04)
@@ -174,16 +180,19 @@ jobs:
           mkdir -p r2-repo/current
 
           BUILD_DMS="${{ github.event.inputs.build_dms || 'true' }}"
+          BUILD_GREETER="${{ github.event.inputs.build_greeter || 'true' }}"
           BUILD_GIT="${{ github.event.inputs.build_git || 'true' }}"
           FORCE_REBUILD="${{ github.event.inputs.force_rebuild || 'false' }}"
 
           if [ "${{ github.event_name }}" = "schedule" ]; then
             BUILD_DMS="false"
+            BUILD_GREETER="false"
             BUILD_GIT="true"
           fi
 
           if [ "${{ github.event_name }}" = "release" ]; then
             BUILD_DMS="true"
+            BUILD_GREETER="true"
             BUILD_GIT="false"
           fi
 
@@ -208,20 +217,23 @@ jobs:
 
           echo "=== Starting Builds ==="
           echo "DMS stable build enabled:     $BUILD_DMS"
+          echo "Greeter stable build enabled: $BUILD_GREETER"
           echo "Git build enabled:            $BUILD_GIT"
           echo "Force rebuild:                $FORCE_REBUILD"
 
           cd void-packages
 
-          if [ -n "$RELEASE_VER" ] && [ "$BUILD_DMS" = "true" ]; then
-            echo "🔧 Updating stable template for $ARCHIVE_TAG"
+          if [ -n "$RELEASE_VER" ] && { [ "$BUILD_DMS" = "true" ] || [ "$BUILD_GREETER" = "true" ]; }; then
+            echo "🔧 Updating stable templates for $ARCHIVE_TAG"
             TARBALL="$(mktemp)"
             curl -fsSL -o "$TARBALL" "https://github.com/${{ github.repository }}/releases/download/${ARCHIVE_TAG}/dms-source.tar.gz"
             RELEASE_CHECKSUM="$(sha256sum "$TARBALL" | cut -d' ' -f1)"
             rm -f "$TARBALL"
 
-            sed -i "s/^version=.*/version=${RELEASE_VER}/" srcpkgs/dms/template
-            sed -i "s/^checksum=.*/checksum=${RELEASE_CHECKSUM}/" srcpkgs/dms/template
+            for pkg in dms dms-greeter; do
+              sed -i "s/^version=.*/version=${RELEASE_VER}/" "srcpkgs/${pkg}/template"
+              sed -i "s/^checksum=.*/checksum=${RELEASE_CHECKSUM}/" "srcpkgs/${pkg}/template"
+            done
           fi
 
           # 1. Build dms-git (development package)
@@ -277,6 +289,22 @@ jobs:
             fi
           fi
 
+          # 3. Build stable dms-greeter package
+          if [ "$BUILD_GREETER" = "true" ]; then
+            GREETER_VER=$(grep -E '^version=' srcpkgs/dms-greeter/template | cut -d= -f2 | tr -d '"')
+            GREETER_REV=$(grep -E '^revision=' srcpkgs/dms-greeter/template | cut -d= -f2 | tr -d '"')
+
+            EXPECTED_GREETER_FILE="dms-greeter-${GREETER_VER}_${GREETER_REV}.x86_64.xbps"
+            if [ -f "../r2-repo/current/$EXPECTED_GREETER_FILE" ] && [ "$FORCE_REBUILD" != "true" ]; then
+              echo "✅ $EXPECTED_GREETER_FILE already exists, skipping build."
+            else
+              echo "🔨 Compiling dms-greeter ($GREETER_VER)..."
+              ./xbps-src pkg dms-greeter
+              rm -f "../r2-repo/current/${EXPECTED_GREETER_FILE}"
+              cp -L hostdir/binpkgs/dms-greeter-${GREETER_VER}_${GREETER_REV}.x86_64.xbps ../r2-repo/current/
+            fi
+          fi
+
       - name: Index and sign repository
         run: |
           cd r2-repo/current

.gitignore

@@ -129,5 +129,3 @@ distro/void/masterdir*/
 
 # Often gets built
 core/dms
-
-core/internal/shellembed/dist

.gitmodules

@@ -1,4 +1,3 @@
 [submodule "dank-qml-common"]
 	path = dank-qml-common
 	url = https://github.com/AvengeMedia/dank-qml-common.git
-	branch = master

CHANGELOG.MD

@@ -1,13 +1,5 @@
 This file is more of a quick reference so I know what to account for before next releases.
 
-# Next
-- Go core migrated to dankgo (shared log/paths/errdefs/ipc/shellapp)
-- Quickshell UI embedded in the dms binary, -c / DMS_SHELL_DIR override - breaking for setups relying on ~/.config/quickshell/dms auto-discovery (XDG search removed)
-- release binaries + all -git packages build with withshell; sockets/pidfiles/env names unchanged, IPC APIVersion 28 wire-compatible
-- -git packages (AUR dms-shell-git, fedora, opensuse, void, debian, ubuntu) no longer install /usr/share/quickshell/dms; dms greeter install falls back to the embedded UI when the greeter package is present
-- ping over the socket returns {"pong":true} instead of "pong"
-- startup: embedded UI resolution is keyed by build-time .dankrev (no per-start content hashing)
-
 # 1.5.0
 - Overhauled shadows
 - App ID changed to com.danklinux.dms - breaking for window rules

CONTRIBUTING.md

@@ -14,12 +14,6 @@ git clone --recurse-submodules https://github.com/AvengeMedia/DankMaterialShell.
 git submodule update --init
 ```
 
-To have `git pull` keep the submodule in sync automatically (moving it to the commit this repo points at, no separate `git submodule update` step), set:
-
-```bash
-git config submodule.recurse true
-```
-
 Install [prek](https://prek.j178.dev/) then activate pre-commit hooks:
 
 ```bash
@@ -42,29 +36,6 @@ This will provide:
 
 The dev shell automatically creates the `.qmlls.ini` file in the `quickshell/` directory.
 
-## Building and running
-
-The Quickshell UI is embedded into the `dms` binary at build time. `make build` copies `quickshell/` into `core/internal/shellembed/dist/` (generated, never committed) and compiles with the `withshell` tag. `make dev` builds without the tag — that binary carries no UI and requires an explicit config dir.
-
-```bash
-make build   # embedded binary at core/bin/dms
-make dev     # untagged development build
-make run     # dev build, then launch against the live quickshell/ tree
-```
-
-The UI config dir resolves in order: `-c <dir>`, `DMS_SHELL_DIR`, the dir a running instance is using, then the embedded UI. Each candidate must contain `shell.qml`. `make run` uses `-c $(pwd)/quickshell`, so QML edits hot-reload from the working tree.
-
-The Go core depends on [dankgo](https://github.com/AvengeMedia/dankgo) for logging, XDG paths, the IPC transport, and the quickshell process lifecycle. To develop against a local dankgo checkout, create a gitignored `go.work` at the repo root:
-
-```
-go 1.26.1
-
-use (
-	./core
-	../dankgo
-)
-```
-
 ## Shared widgets (dank-qml-common)
 
 Everything under `quickshell/DankCommon/` (core widgets, the file browser, scroll physics, bundled fonts) is shared across the DMS suite and lives in the `dank-qml-common` submodule. It is a normal git worktree:

Makefile

@@ -18,7 +18,7 @@ SHELL_INSTALL_DIR=$(DATA_DIR)/quickshell/dms
 ASSETS_DIR=assets
 APPLICATIONS_DIR=$(DATA_DIR)/applications
 
-.PHONY: all build dev run clean lint-qml install install-bin install-shell install-completions install-systemd install-icon install-desktop uninstall uninstall-bin uninstall-shell uninstall-completions uninstall-systemd uninstall-icon uninstall-desktop help
+.PHONY: all build clean lint-qml install install-bin install-shell install-completions install-systemd install-icon install-desktop uninstall uninstall-bin uninstall-shell uninstall-completions uninstall-systemd uninstall-icon uninstall-desktop help
 
 all: build
 
@@ -27,12 +27,6 @@ build:
 	@$(MAKE) -C $(CORE_DIR) build
 	@echo "Build complete"
 
-dev:
-	@$(MAKE) -C $(CORE_DIR) dev
-
-run: dev
-	@$(BUILD_DIR)/$(BINARY_NAME) run -c $(CURDIR)/$(SHELL_DIR)
-
 clean:
 	@echo "Cleaning build artifacts..."
 	@$(MAKE) -C $(CORE_DIR) clean
@@ -72,9 +66,6 @@ install-completions:
 	@echo "Shell completions installed"
 
 install-systemd:
-ifneq ($(shell uname),Linux)
-	@echo "Skipping systemd user service (non-Linux); start the shell from your compositor config with 'dms run'"
-else
 	@echo "Installing systemd user service..."
 	@mkdir -p $(SYSTEMD_USER_DIR)
 	@if [ -n "$(SUDO_USER)" ]; then chown -R $(SUDO_USER):"$(id -gn $SUDO_USER)" $(SYSTEMD_USER_DIR); fi
@@ -82,7 +73,6 @@ else
 	@chmod 644 $(SYSTEMD_USER_DIR)/dms.service
 	@if [ -n "$(SUDO_USER)" ]; then chown $(SUDO_USER):"$(id -gn $SUDO_USER)" $(SYSTEMD_USER_DIR)/dms.service; fi
 	@echo "Systemd service installed to $(SYSTEMD_USER_DIR)/dms.service"
-endif
 
 install-icon:
 	@echo "Installing icon..."

README.md

@@ -83,7 +83,7 @@ One command installs DMS and all dependencies on Arch, Fedora, Debian, Ubuntu, o
 Wallpaper-based color schemes that automatically theme GTK, Qt, terminals, editors (vscode, vscodium), and more using [matugen](https://github.com/InioX/matugen) and dank16.
 
 **System Monitoring**
-Real-time CPU, RAM, GPU metrics and temperatures built into the dms daemon (powered by [dgop](https://github.com/AvengeMedia/dgop)). Process list with search and management.
+Real-time CPU, RAM, GPU metrics and temperatures with [dgop](https://github.com/AvengeMedia/dgop). Process list with search and management.
 
 **Powerful Launcher**
 Spotlight-style search for applications, files ([dsearch](https://github.com/AvengeMedia/danksearch)), emojis, running windows, calculator, and commands. Extensible with plugins.
@@ -98,12 +98,10 @@ Notification center with grouping, rich text support, and keyboard navigation.
 MPRIS player controls, calendar sync, weather widgets, and clipboard history with image previews.
 
 **Session Management**
-Lock screen, idle detection, auto-lock/suspend with separate AC/battery settings, and a settings front-end for [dank-greeter](https://github.com/AvengeMedia/dank-greeter).
+Lock screen, idle detection, auto-lock/suspend with separate AC/battery settings, and greeter support.
 
 **Plugin System**
-Extend functionality with the [plugin registry](https://plugins.danklinux.com). DMS keeps
-`~/.config/DankMaterialShell/plugins.lock.json` synchronized with managed plugin installs and
-their exact Git commits, so the same plugins can be reproduced on another machine.
+Extend functionality with the [plugin registry](https://plugins.danklinux.com).
 
 ## Supported Compositors
 
@@ -122,8 +120,6 @@ dms ipc call audio setvolume 50
 dms ipc call wallpaper set /path/to/image.jpg
 dms brightness list  # List available displays
 dms plugins search   # Browse plugin registry
-dms plugins lock     # Refresh the portable plugin lockfile
-dms plugins restore ~/plugins.lock.json
 ```
 
 [Full CLI and IPC documentation](https://danklinux.com/docs/dankmaterialshell/keybinds-ipc)
@@ -136,17 +132,6 @@ dms plugins restore ~/plugins.lock.json
 - **Plugins:** [Development guide](https://danklinux.com/docs/dankmaterialshell/plugins-overview)
 - **Support:** [Ko-fi](https://ko-fi.com/avengemediallc)
 
-## Dank Projects
-
-DMS is one piece of the suite. The rest lives in its own repos:
-
-- [dank-greeter](https://github.com/AvengeMedia/dank-greeter) - greetd login screen with the Dank Material aesthetic. The Greeter tab in DMS settings is the front-end for it.
-- [dankcalendar](https://github.com/AvengeMedia/dankcalendar) - Local, Google, Microsoft, and CalDAV calendars for the dank desktop.
-- [dgop](https://github.com/AvengeMedia/dgop) - System monitoring TUI and Go library; its library powers the process list and dashboard widgets inside the dms daemon.
-- [dsearch](https://github.com/AvengeMedia/danksearch) - Fast file search that powers file results in the launcher.
-- [dank-qml-common](https://github.com/AvengeMedia/dank-qml-common) - Shared QML widgets and components used by DMS, dank-greeter, and dankcalendar.
-- [dankgo](https://github.com/AvengeMedia/dankgo) - Common Go modules behind the single binary apps.
-
 ## Development
 
 See component-specific documentation:

core/.golangci.yml

@@ -93,6 +93,11 @@ linters:
       - linters:
           - errcheck
         text: "Error return value of `.+\\.AddMatchSignal` is not checked"
+      # Exclude wayland pkg from errcheck and ineffassign (generated code patterns)
+      - linters:
+          - errcheck
+          - ineffassign
+        path: pkg/go-wayland/
       # Exclude proto pkg from ineffassign (generated protocol code)
       - linters:
           - ineffassign

core/.mockery.yml

@@ -52,7 +52,7 @@ packages:
       pkgname: mocks_version
     interfaces:
       VersionFetcher: {}
-  github.com/AvengeMedia/dankgo/wayland/client:
+  github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client:
     config:
       dir: internal/mocks/wlclient
       pkgname: mocks_wlclient

core/Makefile

@@ -3,8 +3,6 @@ BINARY_NAME_INSTALL=dankinstall
 SOURCE_DIR=cmd/dms
 SOURCE_DIR_INSTALL=cmd/dankinstall
 BUILD_DIR=bin
-SHELL_SRC=../quickshell
-EMBED_DIR=internal/shellembed/dist
 PREFIX ?= /usr/local
 INSTALL_DIR=$(PREFIX)/bin
 
@@ -23,46 +21,17 @@ BUILD_LDFLAGS=-ldflags='-s -w -X main.Version=$(VERSION) -X main.buildTime=$(BUI
 
 # Architecture to build for dist target (amd64, arm64, or all)
 ARCH ?= all
-# Target OSes for dist builds
-DIST_OSES ?= linux freebsd
 
-ifeq ($(ARCH),all)
-DIST_ARCHS = amd64 arm64
-else
-DIST_ARCHS = $(ARCH)
-endif
-
-.PHONY: all build sync-shell dankinstall dist clean install install-all install-dankinstall uninstall uninstall-all uninstall-dankinstall install-config uninstall-config test fmt vet deps print-version help
+.PHONY: all build dankinstall dist clean install install-all install-dankinstall uninstall uninstall-all uninstall-dankinstall install-config uninstall-config test fmt vet deps print-version help
 
 # Default target
 all: build
 
-# Copy the quickshell UI into the embed dir (gitignored) so tagged builds
-# can bake it into the binary. Dev-only files are stripped; scripts/ is kept
-# minus its dev entries, since Theme.qml and BluetoothService.qml run
-# gtk.sh/qt.sh/bluez-card-profile.lua out of the resolved shell dir.
-# tar -h dereferences the DankCommon submodule symlink; go:embed rejects
-# symlinks. .qmlls.ini is excluded at copy time: it's a symlink into the
-# quickshell runtime VFS and dereferencing it fails whenever the shell isn't
-# running.
-sync-shell:
-	@test -e $(SHELL_SRC)/DankCommon/Widgets/DankIcon.qml || { echo "DankCommon missing: run git submodule update --init"; exit 1; }
-	@rm -rf $(EMBED_DIR)
-	@mkdir -p $(EMBED_DIR)
-	@tar -C $(SHELL_SRC) --exclude=.qmlls.ini -chf - . | tar -C $(EMBED_DIR) -xf -
-	@rm -rf $(EMBED_DIR)/.git* $(EMBED_DIR)/.github
-	@find $(EMBED_DIR) -type d \( -name .claude -o -name .vscode \) -prune -exec rm -rf {} +
-	@rm -f $(EMBED_DIR)/AGENTS.md $(EMBED_DIR)/qmlformat-all.sh
-	@rm -f $(EMBED_DIR)/scripts/i18nsync.py $(EMBED_DIR)/scripts/build-vscode-vsix.sh $(EMBED_DIR)/scripts/qmllint-entrypoints.sh
-	@rm -f $(EMBED_DIR)/scripts/spam-notifications.sh $(EMBED_DIR)/scripts/verify-notifications.sh
-	@rm -f $(EMBED_DIR)/translations/*.py $(EMBED_DIR)/translations/WORKFLOW.md
-	@cd $(EMBED_DIR) && find . -type f -print0 | LC_ALL=C sort -z | xargs -0 sha256sum | sha256sum | cut -c1-16 > .dankrev
-
 # Build the main binary (dms)
-build: sync-shell
+build:
 	@echo "Building $(BINARY_NAME)..."
 	@mkdir -p $(BUILD_DIR)
-	CGO_ENABLED=0 $(GO) build -tags withshell $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME) ./$(SOURCE_DIR)
+	CGO_ENABLED=0 $(GO) build $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME) ./$(SOURCE_DIR)
 	@echo "Build complete: $(BUILD_DIR)/$(BINARY_NAME)"
 
 dankinstall:
@@ -71,18 +40,26 @@ dankinstall:
 	CGO_ENABLED=0 $(GO) build $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME_INSTALL) ./$(SOURCE_DIR_INSTALL)
 	@echo "Build complete: $(BUILD_DIR)/$(BINARY_NAME_INSTALL)"
 
-# Build distro binaries (no update/greeter support) for each DIST_OSES/DIST_ARCHS pair
-dist: sync-shell
-	@echo "Building $(BINARY_NAME) for distribution ($(DIST_OSES) x $(DIST_ARCHS))..."
+# Build distro binaries for amd64 and arm64 (Linux only, no update/greeter support)
+dist:
+ifeq ($(ARCH),all)
+	@echo "Building $(BINARY_NAME) for distribution (amd64 and arm64)..."
 	@mkdir -p $(BUILD_DIR)
-	@for os in $(DIST_OSES); do \
-		for arch in $(DIST_ARCHS); do \
-			echo "Building for $$os/$$arch..."; \
-			CGO_ENABLED=0 GOOS=$$os GOARCH=$$arch $(GO) build -tags 'distro_binary withshell' $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-$$os-$$arch ./$(SOURCE_DIR) || exit 1; \
-			echo "  $(BUILD_DIR)/$(BINARY_NAME)-$$os-$$arch"; \
-		done; \
-	done
-	@echo "Distribution builds complete"
+	@echo "Building for linux/amd64..."
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -tags distro_binary $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64 ./$(SOURCE_DIR)
+	@echo "Building for linux/arm64..."
+	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -tags distro_binary $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64 ./$(SOURCE_DIR)
+	@echo "Distribution builds complete:"
+	@echo "  $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64"
+	@echo "  $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64"
+else
+	@echo "Building $(BINARY_NAME) for distribution ($(ARCH))..."
+	@mkdir -p $(BUILD_DIR)
+	@echo "Building for linux/$(ARCH)..."
+	CGO_ENABLED=0 GOOS=linux GOARCH=$(ARCH) $(GO) build -tags distro_binary $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-$(ARCH) ./$(SOURCE_DIR)
+	@echo "Distribution build complete:"
+	@echo "  $(BUILD_DIR)/$(BINARY_NAME)-linux-$(ARCH)"
+endif
 
 build-all: build dankinstall
 
@@ -122,7 +99,7 @@ uninstall-dankinstall:
 
 clean:
 	@echo "Cleaning build artifacts..."
-	@rm -rf $(BUILD_DIR) $(EMBED_DIR)
+	@rm -rf $(BUILD_DIR)
 	@echo "Clean complete"
 
 test:
@@ -164,11 +141,10 @@ print-version:
 help:
 	@echo "Available targets:"
 	@echo "  all                 - Build the main binary (dms) (default)"
-	@echo "  build               - Build the main binary (dms) with the embedded UI"
-	@echo "  sync-shell          - Copy quickshell/ into the embed dir (runs before tagged builds)"
+	@echo "  build               - Build the main binary (dms)"
 	@echo "  dankinstall         - Build dankinstall binary"
-	@echo "  dist                - Build dms for linux/freebsd amd64/arm64 (no update/greeter)"
-	@echo "                        Use ARCH=amd64 or ARCH=arm64 and/or DIST_OSES=linux to narrow"
+	@echo "  dist                - Build dms for linux amd64/arm64 (no update/greeter)"
+	@echo "                        Use ARCH=amd64 or ARCH=arm64 to build only one"
 	@echo "  build-all           - Build both binaries"
 	@echo "  install             - Install dms to $(INSTALL_DIR)"
 	@echo "  install-all         - Install both dms and dankinstall to $(INSTALL_DIR)"

core/README.md

@@ -74,11 +74,11 @@ Custom IPC via unix socket (JSON API) for shell communication.
 - `dms run [-d]` - Start shell (optionally as daemon)
 - `dms restart` / `dms kill` - Manage running processes
 - `dms ipc <command>` - Send IPC commands (toggle launcher, notifications, etc.)
-- `dms plugins [install|browse|search|lock|restore]` - Plugin management and portable exact-revision lockfiles
+- `dms plugins [install|browse|search]` - Plugin management
 - `dms brightness [list|set]` - Control display/monitor brightness
 - `dms color pick` - Native color picker (see below)
 - `dms update` - Update DMS and dependencies (disabled in distro packages)
-- `dms greeter` - Deprecated; forwards to the standalone [dms-greeter](https://github.com/AvengeMedia/dank-greeter) binary
+- `dms greeter install` - Install greetd greeter (disabled in distro packages)
 
 ### Color Picker
 
@@ -109,7 +109,7 @@ make test         # Run tests
 **Distribution build:**
 
 ```bash
-make dist         # Build without update features
+make dist         # Build without update/greeter features
 ```
 
 Produces `bin/dms-linux-amd64` and `bin/dms-linux-arm64`
@@ -170,7 +170,7 @@ sudo -v && curl -fsSL https://install.danklinux.com | sh -s -- -c hyprland -t ki
 | `--exclude-deps <name,...>` | | Skip specific dependencies |
 | `--replace-configs <name,...>` | | Replace specific configuration files (mutually exclusive with `--replace-configs-all`) |
 | `--replace-configs-all` | | Replace all configuration files (mutually exclusive with `--replace-configs`) |
-| `--yes` | `-y` | Required for headless mode - confirms installation without interactive prompts |
+| `--yes` | `-y` | Required for headless mode — confirms installation without interactive prompts |
 
 Headless mode requires `--yes` to proceed; without it, the installer exits with an error.
 Configuration files are not replaced by default unless `--replace-configs` or `--replace-configs-all` is specified.

core/cmd/dms/commands_auth.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 
@@ -16,7 +15,7 @@ import (
 var authCmd = &cobra.Command{
 	Use:   "auth",
 	Short: "Manage DMS authentication sync",
-	Long:  "Manage PAM/authentication setup for the DMS lock screen",
+	Long:  "Manage shared PAM/authentication setup for DMS greeter and lock screen",
 }
 
 var authSyncCmd = &cobra.Command{
@@ -212,31 +211,3 @@ func syncAuthInTerminal(nonInteractive bool) error {
 	shellCmd := shellSyncCmd + `; echo; echo "Authentication sync finished. Closing in 3 seconds..."; sleep 3`
 	return runCommandInTerminal(shellCmd)
 }
-func runCommandInTerminal(shellCmd string) error {
-	terminals := []struct {
-		name string
-		args []string
-	}{
-		{"gnome-terminal", []string{"--", "bash", "-c", shellCmd}},
-		{"konsole", []string{"-e", "bash", "-c", shellCmd}},
-		{"xfce4-terminal", []string{"-e", "bash -c \"" + strings.ReplaceAll(shellCmd, `"`, `\"`) + "\""}},
-		{"ghostty", []string{"-e", "bash", "-c", shellCmd}},
-		{"wezterm", []string{"start", "--", "bash", "-c", shellCmd}},
-		{"alacritty", []string{"-e", "bash", "-c", shellCmd}},
-		{"kitty", []string{"bash", "-c", shellCmd}},
-		{"xterm", []string{"-e", "bash -c \"" + strings.ReplaceAll(shellCmd, `"`, `\"`) + "\""}},
-	}
-	for _, t := range terminals {
-		if _, err := exec.LookPath(t.name); err != nil {
-			continue
-		}
-		cmd := exec.Command(t.name, t.args...)
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-		if err := cmd.Run(); err != nil {
-			return err
-		}
-		return nil
-	}
-	return fmt.Errorf("no terminal emulator found (tried: gnome-terminal, konsole, xfce4-terminal, ghostty, wezterm, alacritty, kitty, xterm)")
-}

core/cmd/dms/commands_backup.go

@@ -1,62 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/backup"
-	"github.com/spf13/cobra"
-)
-
-var backupOutputPath string
-
-var backupCmd = &cobra.Command{
-	Use:   "backup",
-	Short: "Backup and restore DMS configuration",
-}
-
-var backupCreateCmd = &cobra.Command{
-	Use:   "create",
-	Short: "Create a tar.gz backup of ~/.config/DankMaterialShell (settings, plugins, themes)",
-	Args:  cobra.NoArgs,
-	Run:   runBackupCreate,
-}
-
-var backupRestoreCmd = &cobra.Command{
-	Use:   "restore <archive>",
-	Short: "Restore a DMS configuration backup; the current configuration is moved aside first",
-	Args:  cobra.ExactArgs(1),
-	Run:   runBackupRestore,
-}
-
-func init() {
-	backupCreateCmd.Flags().StringVarP(&backupOutputPath, "output", "o", "", "Output archive path (default dms-backup-<timestamp>.tar.gz)")
-	backupCmd.AddCommand(backupCreateCmd, backupRestoreCmd)
-	rootCmd.AddCommand(backupCmd)
-}
-
-func runBackupCreate(cmd *cobra.Command, args []string) {
-	output := backupOutputPath
-	if output == "" {
-		output = backup.DefaultArchiveName()
-	}
-
-	if err := backup.Create(output); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-	fmt.Println(output)
-}
-
-func runBackupRestore(cmd *cobra.Command, args []string) {
-	previous, err := backup.Restore(args[0])
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-
-	if previous != "" {
-		fmt.Printf("Previous configuration moved to %s\n", previous)
-	}
-	fmt.Println("Restore complete. Restart the shell to apply.")
-}

core/cmd/dms/commands_clipboard.go

@@ -31,7 +31,6 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/models"
-	"github.com/AvengeMedia/dankgo/wlclipboard"
 	"github.com/spf13/cobra"
 )
 
@@ -284,8 +283,8 @@ func runClipCopy(cmd *cobra.Command, args []string) {
 	}
 }
 
-func parseMultiOffers(data []byte) ([]wlclipboard.Offer, error) {
-	var offers []wlclipboard.Offer
+func parseMultiOffers(data []byte) ([]clipboard.Offer, error) {
+	var offers []clipboard.Offer
 	pos := 0
 
 	for pos < len(data) {
@@ -312,14 +311,14 @@ func parseMultiOffers(data []byte) ([]wlclipboard.Offer, error) {
 		offerData := data[pos : pos+dataLen]
 		pos += dataLen
 
-		offers = append(offers, wlclipboard.Offer{MimeType: mimeType, Data: offerData})
+		offers = append(offers, clipboard.Offer{MimeType: mimeType, Data: offerData})
 	}
 
 	return offers, nil
 }
 
 func runClipPaste(cmd *cobra.Command, args []string) {
-	data, _, err := wlclipboard.Paste()
+	data, _, err := clipboard.Paste()
 	if err != nil {
 		log.Fatalf("paste: %v", err)
 	}
@@ -345,13 +344,13 @@ func runClipWatch(cmd *cobra.Command, args []string) {
 
 	switch {
 	case len(args) > 0:
-		if err := wlclipboard.Watch(ctx, func(data []byte, mimeType string) {
+		if err := clipboard.Watch(ctx, func(data []byte, mimeType string) {
 			runCommand(args, data)
 		}); err != nil && err != context.Canceled {
 			log.Fatalf("Watch error: %v", err)
 		}
 	case clipWatchStore:
-		if err := wlclipboard.Watch(ctx, func(data []byte, mimeType string) {
+		if err := clipboard.Watch(ctx, func(data []byte, mimeType string) {
 			if err := clipboard.Store(data, mimeType); err != nil {
 				log.Errorf("store: %v", err)
 			}
@@ -383,7 +382,7 @@ func runClipWatch(cmd *cobra.Command, args []string) {
 			log.Fatalf("Watch error: %v", err)
 		}
 	case clipJSONOutput:
-		if err := wlclipboard.Watch(ctx, func(data []byte, mimeType string) {
+		if err := clipboard.Watch(ctx, func(data []byte, mimeType string) {
 			out := map[string]any{
 				"data":      string(data),
 				"mimeType":  mimeType,
@@ -396,7 +395,7 @@ func runClipWatch(cmd *cobra.Command, args []string) {
 			log.Fatalf("Watch error: %v", err)
 		}
 	default:
-		if err := wlclipboard.Watch(ctx, func(data []byte, mimeType string) {
+		if err := clipboard.Watch(ctx, func(data []byte, mimeType string) {
 			os.Stdout.Write(data)
 			os.Stdout.WriteString("\n")
 		}); err != nil && err != context.Canceled {

core/cmd/dms/commands_common.go

@@ -6,10 +6,10 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/plugins"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/shellembed"
 	"github.com/spf13/cobra"
 )
 
@@ -19,6 +19,63 @@ var versionCmd = &cobra.Command{
 	Run:   runVersion,
 }
 
+var runCmd = &cobra.Command{
+	Use:     "run",
+	Short:   "Launch quickshell with DMS configuration",
+	Long:    "Launch quickshell with DMS configuration (qs -c dms)",
+	PreRunE: findConfig,
+	Run: func(cmd *cobra.Command, args []string) {
+		daemon, _ := cmd.Flags().GetBool("daemon")
+		session, _ := cmd.Flags().GetBool("session")
+		if v, _ := cmd.Flags().GetString("log-level"); v != "" {
+			if err := os.Setenv("DMS_LOG_LEVEL", v); err != nil {
+				log.Fatalf("Failed to set DMS_LOG_LEVEL: %v", err)
+			}
+		}
+		if v, _ := cmd.Flags().GetString("log-file"); v != "" {
+			if err := os.Setenv("DMS_LOG_FILE", v); err != nil {
+				log.Fatalf("Failed to set DMS_LOG_FILE: %v", err)
+			}
+		}
+		log.ApplyEnvOverrides()
+		config.CleanupStrayHyprlandConfFile(log.Infof)
+		if daemon {
+			runShellDaemon(session)
+		} else {
+			runShellInteractive(session)
+		}
+	},
+}
+
+var restartCmd = &cobra.Command{
+	Use:     "restart",
+	Short:   "Restart quickshell with DMS configuration",
+	Long:    "Kill existing DMS shell processes and restart quickshell with DMS configuration",
+	PreRunE: findConfig,
+	Run: func(cmd *cobra.Command, args []string) {
+		restartShell()
+	},
+}
+
+var restartDetachedCmd = &cobra.Command{
+	Use:     "restart-detached <pid>",
+	Hidden:  true,
+	Args:    cobra.ExactArgs(1),
+	PreRunE: findConfig,
+	Run: func(cmd *cobra.Command, args []string) {
+		runDetachedRestart(args[0])
+	},
+}
+
+var killCmd = &cobra.Command{
+	Use:   "kill",
+	Short: "Kill running DMS shell processes",
+	Long:  "Kill all running quickshell processes with DMS configuration",
+	Run: func(cmd *cobra.Command, args []string) {
+		killShell()
+	},
+}
+
 var ipcCmd = &cobra.Command{
 	Use:   "ipc",
 	Short: "Send IPC commands to running DMS shell",
@@ -51,8 +108,6 @@ func init() {
 	})
 	pluginsUpdateCmd.Flags().BoolP("all", "a", false, "Update all installed plugins")
 	pluginsUpdateCmd.Flags().Bool("check", false, "Check for available updates without applying them")
-	pluginsLockCmd.Flags().StringP("output", "o", "", "Also write the lockfile to this path")
-	pluginsRestoreCmd.Flags().Bool("prune", false, "Remove managed plugins that are not in the lockfile")
 }
 
 var debugSrvCmd = &cobra.Command{
@@ -180,36 +235,6 @@ var pluginsUpdateCmd = &cobra.Command{
 	},
 }
 
-var pluginsLockCmd = &cobra.Command{
-	Use:   "lock",
-	Short: "Record installed plugins and their exact revisions",
-	Long:  "Write a portable plugins.lock.json containing every managed user plugin and its current Git commit.",
-	Args:  cobra.NoArgs,
-	Run: func(cmd *cobra.Command, args []string) {
-		output, _ := cmd.Flags().GetString("output")
-		if err := lockPluginsCLI(output); err != nil {
-			log.Fatalf("Error writing plugin lockfile: %v", err)
-		}
-	},
-}
-
-var pluginsRestoreCmd = &cobra.Command{
-	Use:   "restore [lockfile]",
-	Short: "Restore plugins from exact revisions in a lockfile",
-	Long:  "Install or reset all plugins in a portable plugins.lock.json. Existing managed plugins are retained unless --prune is specified.",
-	Args:  cobra.MaximumNArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		path := ""
-		if len(args) == 1 {
-			path = args[0]
-		}
-		prune, _ := cmd.Flags().GetBool("prune")
-		if err := restorePluginsCLI(path, prune); err != nil {
-			log.Fatalf("Error restoring plugins: %v", err)
-		}
-	},
-}
-
 func runVersion(cmd *cobra.Command, args []string) {
 	fmt.Printf("%s\n", formatVersion(Version))
 }
@@ -239,41 +264,29 @@ func formatVersion(version string) string {
 	return fmt.Sprintf("dms %s", version)
 }
 
-var baseVersionRe = regexp.MustCompile(`^([\d.]+)`)
-
-// Installed UI trees, for builds without an embedded UI.
-var shellVersionPaths = []string{
-	"/usr/share/quickshell/dms/VERSION",
-	"/usr/local/share/quickshell/dms/VERSION",
-	"/etc/xdg/quickshell/dms/VERSION",
-}
-
 func getBaseVersion() string {
-	if ver := parseBaseVersion(shellembed.Version()); ver != "" {
-		return ver
+	paths := []string{
+		"/usr/share/quickshell/dms/VERSION",
+		"/usr/local/share/quickshell/dms/VERSION",
+		"/etc/xdg/quickshell/dms/VERSION",
 	}
 
-	for _, path := range shellVersionPaths {
-		content, err := os.ReadFile(path)
-		if err != nil {
-			continue
-		}
-		if ver := parseBaseVersion(string(content)); ver != "" {
-			return ver
+	for _, path := range paths {
+		if content, err := os.ReadFile(path); err == nil {
+			ver := strings.TrimSpace(string(content))
+			ver = strings.TrimPrefix(ver, "v")
+			if re := regexp.MustCompile(`^([\d.]+)`); re.MatchString(ver) {
+				if matches := re.FindStringSubmatch(ver); matches != nil {
+					return matches[1]
+				}
+			}
 		}
 	}
 
+	// Fallback
 	return "1.0.2"
 }
 
-func parseBaseVersion(raw string) string {
-	matches := baseVersionRe.FindStringSubmatch(strings.TrimPrefix(strings.TrimSpace(raw), "v"))
-	if matches == nil {
-		return ""
-	}
-	return matches[1]
-}
-
 func startDebugServer() error {
 	server.CLIVersion = Version
 	return server.Start(true)
@@ -465,40 +478,6 @@ func installPluginCLI(idOrName string) error {
 	return nil
 }
 
-func lockPluginsCLI(outputPath string) error {
-	manager, err := plugins.NewManager()
-	if err != nil {
-		return fmt.Errorf("failed to create manager: %w", err)
-	}
-	warnings, err := manager.WriteCurrentLockfile(outputPath)
-	if err != nil {
-		return err
-	}
-	for _, warning := range warnings {
-		fmt.Fprintf(os.Stderr, "Warning: %s\n", warning)
-	}
-	fmt.Printf("Plugin lockfile written: %s\n", manager.GetLockfilePath())
-	if outputPath != "" && outputPath != manager.GetLockfilePath() {
-		fmt.Printf("Plugin lockfile exported: %s\n", outputPath)
-	}
-	return nil
-}
-
-func restorePluginsCLI(path string, prune bool) error {
-	manager, err := plugins.NewManager()
-	if err != nil {
-		return fmt.Errorf("failed to create manager: %w", err)
-	}
-	if err := manager.RestoreFromLockfile(path, prune); err != nil {
-		return err
-	}
-	if path == "" {
-		path = manager.GetLockfilePath()
-	}
-	fmt.Printf("Plugins restored from lockfile: %s\n", path)
-	return nil
-}
-
 func getAvailablePluginIDs() []string {
 	registry, err := plugins.NewRegistry()
 	if err != nil {
@@ -764,13 +743,15 @@ func checkAllPluginsCLI() error {
 }
 
 func getCommonCommands() []*cobra.Command {
-	commands := shellApp.Commands()
-	return append(commands, []*cobra.Command{
+	return []*cobra.Command{
 		versionCmd,
+		runCmd,
+		restartCmd,
+		restartDetachedCmd,
+		killCmd,
 		ipcCmd,
 		debugSrvCmd,
 		pluginsCmd,
-		registryCmd,
 		dank16Cmd,
 		brightnessCmd,
 		dpmsCmd,
@@ -794,5 +775,5 @@ func getCommonCommands() []*cobra.Command {
 		trashCmd,
 		systemCmd,
 		switchUserCmd,
-	}...)
+	}
 }

core/cmd/dms/commands_config.go

@@ -40,7 +40,6 @@ var resolveIncludeCmd = &cobra.Command{
 				"layout.kdl",
 				"outputs.kdl",
 				"binds.kdl",
-				"input.kdl",
 				"cursor.conf",
 				"layout.conf",
 				"outputs.conf",

core/cmd/dms/commands_doctor.go

@@ -401,12 +401,12 @@ func checkVersions(qsMissingFeatures bool) []checkResult {
 }
 
 func getDMSShellVersion() (version, path string) {
-	if err := shellApp.ResolveConfig(nil, nil); err == nil && shellApp.ConfigPath() != "" {
-		versionFile := filepath.Join(shellApp.ConfigPath(), "VERSION")
+	if err := findConfig(nil, nil); err == nil && configPath != "" {
+		versionFile := filepath.Join(configPath, "VERSION")
 		if data, err := os.ReadFile(versionFile); err == nil {
-			return strings.TrimSpace(string(data)), shellApp.ConfigPath()
+			return strings.TrimSpace(string(data)), configPath
 		}
-		return "installed", shellApp.ConfigPath()
+		return "installed", configPath
 	}
 
 	if dmsPath, err := config.LocateDMSConfig(); err == nil {
@@ -449,7 +449,12 @@ func getQuickshellVersionInfo(missingFeatures bool) (string, status, string) {
 func checkDMSInstallation() []checkResult {
 	var results []checkResult
 
-	dmsPath := resolveDoctorShellPath()
+	dmsPath := ""
+	if err := findConfig(nil, nil); err == nil && configPath != "" {
+		dmsPath = configPath
+	} else if path, err := config.LocateDMSConfig(); err == nil {
+		dmsPath = path
+	}
 
 	if dmsPath == "" {
 		return []checkResult{{catInstallation, "DMS Configuration", statusError, "Not found", "shell.qml not found in any config path", doctorDocsURL + "#dms-configuration"}}
@@ -828,8 +833,6 @@ func detectNetworkBackend(stackResult *network.DetectResult) string {
 		return "systemd-networkd"
 	case network.BackendConnMan:
 		return "ConnMan"
-	case network.BackendWpaSupplicant:
-		return "wpa_supplicant"
 	default:
 		return ""
 	}
@@ -903,6 +906,7 @@ func checkOptionalDependencies() []checkResult {
 		important       bool
 	}{
 		{"matugen", "matugen", "Dynamic theming", true},
+		{"dgop", "dgop", "System monitoring", true},
 		{"cava", "cava", "Audio visualizer", true},
 		{"khal", "khal", "Calendar events", false},
 		{"danksearch", "dsearch", "File search", false},
@@ -1163,182 +1167,99 @@ func formatResultsPlain(results []checkResult) string {
 	return sb.String()
 }
 
-const (
-	defaultDoctorFontFamily     = "Inter Variable"
-	defaultDoctorMonoFontFamily = "Fira Code"
-)
-
-// bundledFontRelPaths maps settings/default family names to font files shipped with
-// the shell and loaded via Qt FontLoader (not registered with fontconfig).
-var bundledFontRelPaths = map[string][]string{
-	"inter variable": {
-		"DankCommon/assets/fonts/inter/InterVariable.ttf",
-		"assets/fonts/inter/InterVariable.ttf",
-	},
-	"fira code": {
-		"DankCommon/assets/fonts/nerd-fonts/FiraCodeNerdFont-Regular.ttf",
-		"assets/fonts/nerd-fonts/FiraCodeNerdFont-Regular.ttf",
-	},
-	"firacode nerd font": {
-		"DankCommon/assets/fonts/nerd-fonts/FiraCodeNerdFont-Regular.ttf",
-		"assets/fonts/nerd-fonts/FiraCodeNerdFont-Regular.ttf",
-	},
-}
-
-func resolveDoctorShellPath() string {
-	if err := shellApp.ResolveConfig(nil, nil); err == nil && shellApp.ConfigPath() != "" {
-		return shellApp.ConfigPath()
-	}
-	if path, err := config.LocateDMSConfig(); err == nil {
-		return path
-	}
-	return ""
-}
-
-func findBundledFontFile(shellPath, family string) string {
-	if shellPath == "" {
-		return ""
-	}
-	relPaths, ok := bundledFontRelPaths[strings.ToLower(strings.TrimSpace(family))]
-	if !ok {
-		return ""
-	}
-	for _, rel := range relPaths {
-		path := filepath.Join(shellPath, rel)
-		if info, err := os.Stat(path); err == nil && !info.IsDir() {
-			return path
-		}
-	}
-	return ""
-}
-
-func isBundledDefaultFont(family string) bool {
-	_, ok := bundledFontRelPaths[strings.ToLower(strings.TrimSpace(family))]
-	return ok
-}
-
-func fontInFcList(name, cacheLower string) bool {
-	target := strings.ToLower(strings.TrimSpace(name))
-	if target == "" {
-		return false
-	}
-	for _, line := range strings.Split(cacheLower, "\n") {
-		for _, fam := range strings.Split(strings.TrimSpace(line), ",") {
-			if strings.TrimSpace(fam) == target {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-func checkConfiguredFont(label, family, shellPath, fcCache string, fcListAvailable bool, url string) checkResult {
-	if bundled := findBundledFontFile(shellPath, family); bundled != "" {
-		details := "Bundled (Qt FontLoader)"
-		if doctorVerbose {
-			details = bundled
-		}
-		return checkResult{catFonts, label, statusOK, family, details, url}
-	}
-
-	if isBundledDefaultFont(family) {
-		if shellPath == "" {
-			return checkResult{
-				catFonts, label, statusWarn,
-				fmt.Sprintf("'%s' not verified", family),
-				"Could not locate shell config to verify bundled font files.",
-				url,
-			}
-		}
-		return checkResult{
-			catFonts, label, statusWarn,
-			fmt.Sprintf("'%s' bundled file missing", family),
-			"Expected font file missing from shell install. Reinstall DMS or check DankCommon assets.",
-			url,
-		}
-	}
-
-	if !fcListAvailable {
-		return checkResult{
-			catFonts, label, statusWarn,
-			fmt.Sprintf("'%s' not verified", family),
-			"fc-list not installed; cannot verify custom fonts in fontconfig.",
-			url,
-		}
-	}
-
-	if fcCache == "" {
-		return checkResult{
-			catFonts, label, statusWarn,
-			fmt.Sprintf("'%s' not found", family),
-			"Fontconfig cache is empty or unreadable. Try running 'fc-cache -fv'.",
-			url,
-		}
-	}
-
-	if fontInFcList(family, fcCache) {
-		return checkResult{catFonts, label, statusOK, family, "Available via fontconfig", url}
-	}
-
-	return checkResult{
-		catFonts, label, statusWarn,
-		fmt.Sprintf("'%s' not found", family),
-		"Font is not registered with fontconfig. Try running 'fc-cache -fv' or install the font.",
-		url,
-	}
-}
-
 func checkFonts() []checkResult {
 	var results []checkResult
 	url := doctorDocsURL + "#fonts"
 
-	fontFamily := defaultDoctorFontFamily
-	monoFontFamily := defaultDoctorMonoFontFamily
+	configDir, err := os.UserConfigDir()
+	if err != nil {
+		return nil
+	}
+	settingsPath := filepath.Join(configDir, "DankMaterialShell", "settings.json")
 
-	if configDir, err := os.UserConfigDir(); err == nil {
-		settingsPath := filepath.Join(configDir, "DankMaterialShell", "settings.json")
-		if data, err := os.ReadFile(settingsPath); err == nil {
-			var settings struct {
-				FontFamily     string `json:"fontFamily"`
-				MonoFontFamily string `json:"monoFontFamily"`
+	fontFamily := "Inter Variable"
+	monoFontFamily := "Fira Code"
+
+	if data, err := os.ReadFile(settingsPath); err == nil {
+		var settings struct {
+			FontFamily     string `json:"fontFamily"`
+			MonoFontFamily string `json:"monoFontFamily"`
+		}
+		if err := json.Unmarshal(data, &settings); err == nil {
+			if settings.FontFamily != "" {
+				fontFamily = settings.FontFamily
 			}
-			if err := json.Unmarshal(data, &settings); err == nil {
-				if settings.FontFamily != "" {
-					fontFamily = settings.FontFamily
-				}
-				if settings.MonoFontFamily != "" {
-					monoFontFamily = settings.MonoFontFamily
-				}
+			if settings.MonoFontFamily != "" {
+				monoFontFamily = settings.MonoFontFamily
 			}
 		}
 	}
 
-	shellPath := resolveDoctorShellPath()
-	needFontconfig := !isBundledDefaultFont(fontFamily) || !isBundledDefaultFont(monoFontFamily)
+	if !utils.CommandExists("fc-list") {
+		results = append(results, checkResult{catFonts, "Fontconfig Tools", statusWarn, "fc-list not installed", "Cannot verify if fonts are cached.", url})
+		return results
+	}
 
-	fcListAvailable := utils.CommandExists("fc-list")
-	fcCache := ""
+	// Retrieve font list
+	output, err := exec.Command("fc-list", ":", "family").Output()
+	if err != nil {
+		results = append(results, checkResult{catFonts, "Fontconfig Cache", statusError, "Failed to query font list", "Fontconfig cache query failed. Try running 'fc-cache -fv'.", url})
+		return results
+	}
 
-	if needFontconfig {
-		if !fcListAvailable {
-			results = append(results, checkResult{catFonts, "Fontconfig Tools", statusWarn, "fc-list not installed", "Cannot verify custom fonts in fontconfig cache.", url})
-		} else {
-			output, err := exec.Command("fc-list", ":", "family").Output()
-			if err != nil {
-				results = append(results, checkResult{catFonts, "Fontconfig Cache", statusError, "Failed to query font list", "Fontconfig cache query failed. Try running 'fc-cache -fv'.", url})
-			} else {
-				fcCache = strings.ToLower(string(output))
-				if len(strings.TrimSpace(fcCache)) == 0 {
-					results = append(results, checkResult{catFonts, "Fontconfig Cache", statusError, "Cache is empty", "No fonts found in fontconfig cache. Try running 'fc-cache -fv'.", url})
+	outStr := string(output)
+	if len(strings.TrimSpace(outStr)) == 0 {
+		results = append(results, checkResult{catFonts, "Fontconfig Cache", statusError, "Cache is empty", "No fonts found in fontconfig cache. Try running 'fc-cache -fv'.", url})
+		return results
+	}
+
+	lowerFonts := strings.ToLower(outStr)
+
+	// Helper to check if a font exists
+	hasFont := func(name string) bool {
+		target := strings.ToLower(strings.TrimSpace(name))
+		if target == "" {
+			return false
+		}
+		for _, line := range strings.Split(lowerFonts, "\n") {
+			line = strings.TrimSpace(line)
+			if line == "" {
+				continue
+			}
+			// Each line can have comma-separated families
+			families := strings.Split(line, ",")
+			for _, fam := range families {
+				if strings.TrimSpace(fam) == target {
+					return true
 				}
 			}
 		}
+		return false
 	}
 
-	results = append(results,
-		checkConfiguredFont("Normal Font", fontFamily, shellPath, fcCache, fcListAvailable, url),
-		checkConfiguredFont("Monospace Font", monoFontFamily, shellPath, fcCache, fcListAvailable, url),
-	)
+	// Normal Font Check
+	if hasFont(fontFamily) {
+		results = append(results, checkResult{catFonts, "Normal Font", statusOK, fontFamily, "Available", url})
+	} else {
+		results = append(results, checkResult{
+			catFonts, "Normal Font", statusWarn,
+			fmt.Sprintf("'%s' not found", fontFamily),
+			"Font is not registered. Try running 'fc-cache -fv' or install the font.",
+			url,
+		})
+	}
+
+	// Monospace Font Check
+	if hasFont(monoFontFamily) {
+		results = append(results, checkResult{catFonts, "Monospace Font", statusOK, monoFontFamily, "Available", url})
+	} else {
+		results = append(results, checkResult{
+			catFonts, "Monospace Font", statusWarn,
+			fmt.Sprintf("'%s' not found", monoFontFamily),
+			"Font is not registered. Try running 'fc-cache -fv' or install the font.",
+			url,
+		})
+	}
 
 	return results
 }

core/cmd/dms/commands_features.go

@@ -26,7 +26,7 @@ var updateCmd = &cobra.Command{
 	Use:     "update",
 	Short:   "Update DankMaterialShell to the latest version",
 	Long:    "Update DankMaterialShell to the latest version using the appropriate package manager for your distribution",
-	PreRunE: shellApp.ResolveConfig,
+	PreRunE: findConfig,
 	Run: func(cmd *cobra.Command, args []string) {
 		runUpdate()
 	},
@@ -98,7 +98,7 @@ func runUpdate() {
 	}
 
 	log.Info("Update complete! Restarting DMS...")
-	shellApp.Restart()
+	restartShell()
 }
 
 func updateArchLinux() error {

core/cmd/dms/commands_greeter_test.go

@@ -0,0 +1,150 @@
+package main
+
+import (
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	sharedpam "github.com/AvengeMedia/DankMaterialShell/core/internal/pam"
+	"github.com/spf13/cobra"
+)
+
+func TestSyncGreeterConfigsAndAuthDelegatesSharedAuth(t *testing.T) {
+	origGreeterConfigSyncFn := greeterConfigSyncFn
+	origSharedAuthSyncFn := sharedAuthSyncFn
+	t.Cleanup(func() {
+		greeterConfigSyncFn = origGreeterConfigSyncFn
+		sharedAuthSyncFn = origSharedAuthSyncFn
+	})
+
+	var calls []string
+	greeterConfigSyncFn = func(dmsPath, compositor string, logFunc func(string), sudoPassword string) error {
+		if dmsPath != "/tmp/dms" {
+			t.Fatalf("unexpected dmsPath %q", dmsPath)
+		}
+		if compositor != "niri" {
+			t.Fatalf("unexpected compositor %q", compositor)
+		}
+		if sudoPassword != "" {
+			t.Fatalf("expected empty sudoPassword, got %q", sudoPassword)
+		}
+		calls = append(calls, "configs")
+		return nil
+	}
+
+	var gotOptions sharedpam.SyncAuthOptions
+	sharedAuthSyncFn = func(logFunc func(string), sudoPassword string, options sharedpam.SyncAuthOptions) error {
+		if sudoPassword != "" {
+			t.Fatalf("expected empty sudoPassword, got %q", sudoPassword)
+		}
+		gotOptions = options
+		calls = append(calls, "auth")
+		return nil
+	}
+
+	err := syncGreeterConfigsAndAuth("/tmp/dms", "niri", func(string) {}, sharedpam.SyncAuthOptions{
+		ForceGreeterAuth: true,
+	}, func() {
+		calls = append(calls, "before-auth")
+	})
+	if err != nil {
+		t.Fatalf("syncGreeterConfigsAndAuth returned error: %v", err)
+	}
+
+	wantCalls := []string{"configs", "before-auth", "auth"}
+	if !reflect.DeepEqual(calls, wantCalls) {
+		t.Fatalf("call order = %v, want %v", calls, wantCalls)
+	}
+	if !gotOptions.ForceGreeterAuth {
+		t.Fatalf("expected ForceGreeterAuth to be true, got %+v", gotOptions)
+	}
+}
+
+func TestSyncGreeterConfigsAndAuthStopsOnConfigError(t *testing.T) {
+	origGreeterConfigSyncFn := greeterConfigSyncFn
+	origSharedAuthSyncFn := sharedAuthSyncFn
+	t.Cleanup(func() {
+		greeterConfigSyncFn = origGreeterConfigSyncFn
+		sharedAuthSyncFn = origSharedAuthSyncFn
+	})
+
+	greeterConfigSyncFn = func(string, string, func(string), string) error {
+		return errors.New("config sync failed")
+	}
+
+	authCalled := false
+	sharedAuthSyncFn = func(func(string), string, sharedpam.SyncAuthOptions) error {
+		authCalled = true
+		return nil
+	}
+
+	err := syncGreeterConfigsAndAuth("/tmp/dms", "niri", func(string) {}, sharedpam.SyncAuthOptions{}, nil)
+	if err == nil || err.Error() != "config sync failed" {
+		t.Fatalf("expected config sync error, got %v", err)
+	}
+	if authCalled {
+		t.Fatal("expected auth sync not to run after config sync failure")
+	}
+}
+
+func TestGreeterStatusStateDirUsesNixOSDefault(t *testing.T) {
+	if got := greeterStatusStateDir("", true); got != nixOSGreeterStateDir {
+		t.Fatalf("greeterStatusStateDir() = %q, want %q", got, nixOSGreeterStateDir)
+	}
+}
+
+func TestGreeterStatusStateDirHonorsExplicitOverrideOnNixOS(t *testing.T) {
+	command := "dms-greeter --cache-dir /srv/dms-greeter --command niri"
+	if got := greeterStatusStateDir(command, true); got != "/srv/dms-greeter" {
+		t.Fatalf("greeterStatusStateDir() = %q, want %q", got, "/srv/dms-greeter")
+	}
+}
+
+func TestExtractGreeterWrapperFromEnvCommand(t *testing.T) {
+	command := "env LIBSEAT_BACKEND=logind DMS_VOID=1 /usr/bin/dms-greeter --command niri"
+	if got := extractGreeterWrapperFromCommand(command); got != "/usr/bin/dms-greeter" {
+		t.Fatalf("extractGreeterWrapperFromCommand() = %q, want %q", got, "/usr/bin/dms-greeter")
+	}
+}
+
+func TestRejectNixOSGreeterMutationBlocksImperativeCommands(t *testing.T) {
+	origGreeterIsNixOSFn := greeterIsNixOSFn
+	greeterIsNixOSFn = func() bool { return true }
+	t.Cleanup(func() {
+		greeterIsNixOSFn = origGreeterIsNixOSFn
+	})
+
+	for _, commandName := range []string{"install", "enable", "sync", "uninstall"} {
+		t.Run(commandName, func(t *testing.T) {
+			root := &cobra.Command{Use: "dms"}
+			greeterCommand := &cobra.Command{Use: "greeter"}
+			mutationCommand := &cobra.Command{Use: commandName}
+			root.AddCommand(greeterCommand)
+			greeterCommand.AddCommand(mutationCommand)
+
+			err := rejectNixOSGreeterMutation(mutationCommand)
+			if err == nil {
+				t.Fatalf("expected NixOS greeter %s to be rejected", commandName)
+			}
+			if !strings.Contains(err.Error(), "dms greeter "+commandName+" is disabled on NixOS") {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if strings.Contains(err.Error(), "/var/cache/dms-greeter") {
+				t.Fatalf("NixOS remediation should not recommend the non-NixOS cache path: %v", err)
+			}
+		})
+	}
+}
+
+func TestRejectNixOSGreeterMutationAllowsOtherDistros(t *testing.T) {
+	origGreeterIsNixOSFn := greeterIsNixOSFn
+	greeterIsNixOSFn = func() bool { return false }
+	t.Cleanup(func() {
+		greeterIsNixOSFn = origGreeterIsNixOSFn
+	})
+
+	if err := rejectNixOSGreeterMutation(&cobra.Command{Use: "sync"}); err != nil {
+		t.Fatalf("expected non-NixOS greeter command to be allowed, got %v", err)
+	}
+}

core/cmd/dms/commands_registry.go

@@ -1,67 +0,0 @@
-package main
-
-import (
-	"fmt"
-
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/registries"
-	"github.com/spf13/afero"
-	"github.com/spf13/cobra"
-)
-
-var registryCmd = &cobra.Command{
-	Use:   "registry",
-	Short: "Manage plugin and theme registries",
-	Long:  "Manage the registries DMS fetches plugins and themes from. The official registry is always active; additional registries can be added by name and git URL.",
-}
-
-var registryListCmd = &cobra.Command{
-	Use:   "list",
-	Short: "List configured registries",
-	Run: func(cmd *cobra.Command, args []string) {
-		for _, s := range registries.Load(afero.NewOsFs()) {
-			suffix := ""
-			if s.Official() {
-				suffix = " (official)"
-			}
-			fmt.Printf("%s%s\n    %s\n", s.Name, suffix, s.URL)
-		}
-	},
-}
-
-var registryAddCmd = &cobra.Command{
-	Use:   "add <name> <url>",
-	Short: "Add a registry",
-	Long:  "Add a registry by name and git URL. The repository must contain a plugins/ or themes/ directory in the registry format.",
-	Args:  cobra.ExactArgs(2),
-	Run: func(cmd *cobra.Command, args []string) {
-		if err := registries.Add(afero.NewOsFs(), args[0], args[1]); err != nil {
-			log.Fatalf("Error adding registry: %v", err)
-		}
-		fmt.Printf("Registry added: %s\n", args[0])
-	},
-}
-
-var registryRemoveCmd = &cobra.Command{
-	Use:   "remove <name>",
-	Short: "Remove a registry",
-	Args:  cobra.ExactArgs(1),
-	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		if len(args) != 0 {
-			return nil, cobra.ShellCompDirectiveNoFileComp
-		}
-		var names []string
-		for _, s := range registries.Load(afero.NewOsFs()) {
-			if !s.Official() {
-				names = append(names, s.Name)
-			}
-		}
-		return names, cobra.ShellCompDirectiveNoFileComp
-	},
-	Run: func(cmd *cobra.Command, args []string) {
-		if err := registries.Remove(afero.NewOsFs(), args[0]); err != nil {
-			log.Fatalf("Error removing registry: %v", err)
-		}
-		fmt.Printf("Registry removed: %s\n", args[0])
-	},
-}

core/cmd/dms/commands_root.go

@@ -1,9 +1,19 @@
 package main
 
 import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/spf13/cobra"
 )
 
+var customConfigPath string
+var configPath string
+
 var rootCmd = &cobra.Command{
 	Use:   "dms",
 	Short: "dms CLI",
@@ -11,5 +21,54 @@ var rootCmd = &cobra.Command{
 }
 
 func init() {
-	rootCmd.PersistentFlags().StringVarP(shellApp.CustomConfigVar(), "config", "c", "", "Path to a UI config dir (containing shell.qml) to use instead of the embedded UI (env: DMS_SHELL_DIR)")
+	rootCmd.PersistentFlags().StringVarP(&customConfigPath, "config", "c", "", "Specify a custom path to the DMS config directory")
+}
+
+func findConfig(cmd *cobra.Command, args []string) error {
+	if customConfigPath != "" {
+		log.Debug("Custom config path provided via -c flag: %s", customConfigPath)
+		shellPath := filepath.Join(customConfigPath, "shell.qml")
+
+		info, statErr := os.Stat(shellPath)
+
+		if statErr == nil && !info.IsDir() {
+			configPath = customConfigPath
+			log.Debug("Using config from: %s", configPath)
+			return nil
+		}
+
+		if statErr != nil {
+			return fmt.Errorf("custom config path error: %w", statErr)
+		}
+
+		return fmt.Errorf("path is a directory, not a file: %s", shellPath)
+	}
+
+	configStateFile := filepath.Join(getRuntimeDir(), "danklinux.path")
+	if data, readErr := os.ReadFile(configStateFile); readErr == nil {
+		if len(getAllDMSPIDs()) == 0 {
+			os.Remove(configStateFile)
+		} else {
+			statePath := strings.TrimSpace(string(data))
+			shellPath := filepath.Join(statePath, "shell.qml")
+
+			if info, statErr := os.Stat(shellPath); statErr == nil && !info.IsDir() {
+				log.Debug("Using config from active session state file: %s", statePath)
+				configPath = statePath
+				log.Debug("Using config from: %s", configPath)
+				return nil
+			}
+			os.Remove(configStateFile)
+		}
+	}
+
+	log.Debug("No custom path or active session, searching default XDG locations...")
+	var err error
+	configPath, err = config.LocateDMSConfig()
+	if err != nil {
+		return err
+	}
+
+	log.Debug("Using config from: %s", configPath)
+	return nil
 }

core/cmd/dms/commands_screenshot.go

@@ -231,16 +231,16 @@ func setPopoutScreenshotMode(begin bool) {
 		fn = "begin"
 	}
 	cmdArgs := []string{"ipc"}
-	if pid, ok := shellApp.SessionPID(); ok {
+	if pid, ok := getFirstDMSPID(); ok {
 		cmdArgs = append(cmdArgs, "--pid", strconv.Itoa(pid))
 	} else {
-		if err := shellApp.ResolveConfig(nil, nil); err != nil {
+		if err := findConfig(nil, nil); err != nil {
 			return
 		}
 		if qsHasAnyDisplay() {
 			cmdArgs = append(cmdArgs, "--any-display")
 		}
-		cmdArgs = append(cmdArgs, "-p", shellApp.ConfigPath())
+		cmdArgs = append(cmdArgs, "-p", configPath)
 	}
 	cmdArgs = append(cmdArgs, "call", "screenshot", fn)
 	_ = exec.Command("qs", cmdArgs...).Run()

core/cmd/dms/commands_setup.go

@@ -11,6 +11,7 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/greeter"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
@@ -143,10 +144,6 @@ var dmsConfigSpecs = map[string]dmsConfigSpec{
 		niriFile:    "alttab.kdl",
 		niriContent: func(_ string) string { return config.NiriAlttabConfig },
 	},
-	"input": {
-		niriFile:    "input.kdl",
-		niriContent: func(_ string) string { return config.NiriInputConfig },
-	},
 	"outputs": {
 		niriFile:     "outputs.kdl",
 		hyprFile:     "outputs.lua",
@@ -208,12 +205,7 @@ func detectTerminal() (string, error) {
 }
 
 func detectCompositorForSetup() (string, error) {
-	var compositors []string
-	for _, candidate := range []string{"niri", "Hyprland", "mango"} {
-		if utils.CommandExists(candidate) {
-			compositors = append(compositors, candidate)
-		}
-	}
+	compositors := greeter.DetectCompositors()
 
 	switch len(compositors) {
 	case 0:
@@ -222,20 +214,11 @@ func detectCompositorForSetup() (string, error) {
 		return strings.ToLower(compositors[0]), nil
 	}
 
-	fmt.Println("Multiple compositors detected:")
-	for i, compositor := range compositors {
-		fmt.Printf("%d) %s\n", i+1, compositor)
+	selected, err := greeter.PromptCompositorChoice(compositors)
+	if err != nil {
+		return "", err
 	}
-	fmt.Printf("\nChoice (1-%d): ", len(compositors))
-
-	var response string
-	fmt.Scanln(&response)
-	choice := 0
-	fmt.Sscanf(strings.TrimSpace(response), "%d", &choice)
-	if choice < 1 || choice > len(compositors) {
-		return "", fmt.Errorf("invalid choice")
-	}
-	return strings.ToLower(compositors[choice-1]), nil
+	return strings.ToLower(selected), nil
 }
 
 func runSetupDmsConfig(name string) error {

core/cmd/dms/dpms_client.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/wlr_output_power"
-	wlclient "github.com/AvengeMedia/dankgo/wayland/client"
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
 
 type cmd struct {

core/cmd/dms/init_service.go

@@ -0,0 +1,137 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/greeter"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
+)
+
+// runit (Void Linux) service helpers. Services live in /etc/sv and are "enabled"
+// by symlinking them into the /var/service supervision dir, so the greeter
+// commands branch on isRunit() instead of shelling systemctl.
+
+const (
+	runitSvDir      = "/etc/sv"
+	runitServiceDir = "/var/service"
+)
+
+// isRunit reports whether this system is supervised by runit (Void Linux).
+func isRunit() bool {
+	if fi, err := os.Stat("/run/runit"); err == nil && fi.IsDir() {
+		return true
+	}
+	if _, err := os.Stat("/run/systemd/system"); err == nil {
+		return false
+	}
+	if fi, err := os.Stat(runitServiceDir); err == nil && fi.IsDir() {
+		return true
+	}
+	return false
+}
+
+func runitServiceInstalled(name string) bool {
+	fi, err := os.Stat(runitSvDir + "/" + name)
+	return err == nil && fi.IsDir()
+}
+
+func runitServiceEnabled(name string) bool {
+	_, err := os.Lstat(runitServiceDir + "/" + name)
+	return err == nil
+}
+
+// enableRunitService links a service into /var/service (idempotent).
+func enableRunitService(name string) error {
+	if !runitServiceInstalled(name) {
+		return fmt.Errorf("runit service %q not found in %s", name, runitSvDir)
+	}
+	if runitServiceEnabled(name) {
+		return nil
+	}
+	return privesc.Run(context.Background(), "", "ln", "-sf",
+		runitSvDir+"/"+name, runitServiceDir+"/"+name)
+}
+
+// disableRunitService removes a service's supervision symlink.
+func disableRunitService(name string) error {
+	if !runitServiceEnabled(name) {
+		return nil
+	}
+	return privesc.Run(context.Background(), "", "rm", "-f",
+		runitServiceDir+"/"+name)
+}
+
+// ensureRunitSeat sets up the seat access a Wayland greeter needs on runit (the
+// equivalent of logind on systemd): enables seatd and adds the greeter user to
+// the seat/video/input groups. Failures are reported but non-fatal.
+func ensureRunitSeat(greeterUser string) {
+	if runitServiceInstalled("seatd") {
+		if err := enableRunitService("seatd"); err != nil {
+			fmt.Printf("  ⚠ could not enable seatd: %v\n", err)
+		} else {
+			fmt.Println("  ✓ seatd enabled")
+		}
+	} else {
+		fmt.Println("  ⚠ seatd not installed — the greeter compositor needs it for GPU/seat access")
+	}
+	if err := privesc.Run(context.Background(), "", "usermod", "-aG", "_seatd,video,input", greeterUser); err != nil {
+		fmt.Printf("  ⚠ could not add %s to seat groups: %v\n", greeterUser, err)
+	} else {
+		fmt.Printf("  ✓ %s added to seat groups (_seatd, video, input)\n", greeterUser)
+	}
+}
+
+// ensureVoidLogindGreeter configures the elogind-backed greeter on Void.
+func ensureVoidLogindGreeter(greeterUser string) {
+	for _, service := range []string{"dbus", "elogind"} {
+		if err := enableRunitService(service); err != nil {
+			fmt.Printf("  ⚠ could not enable %s: %v\n", service, err)
+		} else {
+			fmt.Printf("  ✓ %s enabled\n", service)
+		}
+	}
+	greeter.EnsureVoidGreetdRunScript(func(msg string) { fmt.Println("  " + msg) }, "")
+	if runitServiceEnabled("seatd") {
+		if err := disableRunitService("seatd"); err != nil {
+			fmt.Printf("  ⚠ could not disable seatd: %v\n", err)
+		} else {
+			fmt.Println("  ✓ seatd disabled (elogind manages the seat)")
+		}
+	}
+	if err := privesc.Run(context.Background(), "", "usermod", "-aG", "video,input", greeterUser); err != nil {
+		fmt.Printf("  ⚠ could not add %s to video/input groups: %v\n", greeterUser, err)
+	} else {
+		fmt.Printf("  ✓ %s added to video/input groups (elogind manages the seat)\n", greeterUser)
+	}
+}
+
+// ensureGreetdPamRundir provides XDG_RUNTIME_DIR to runit greeter sessions.
+func ensureGreetdPamRundir() {
+	const pamPath = "/etc/pam.d/greetd"
+	data, err := os.ReadFile(pamPath)
+	if err != nil {
+		fmt.Printf("  ⚠ could not read %s: %v\n", pamPath, err)
+		return
+	}
+	if strings.Contains(string(data), "pam_rundir") {
+		return
+	}
+	line := "session    optional    pam_rundir.so"
+	if err := privesc.Run(context.Background(), "", "sh", "-c",
+		fmt.Sprintf("printf '%%s\\n' %q >> %s", line, pamPath)); err != nil {
+		fmt.Printf("  ⚠ could not add pam_rundir to %s: %v\n", pamPath, err)
+		return
+	}
+	fmt.Println("  ✓ pam_rundir added to greetd PAM (provides XDG_RUNTIME_DIR for the session)")
+}
+
+// startGreeterHint returns the init-appropriate "start greetd now" command.
+func startGreeterHint() string {
+	if isRunit() {
+		return "  sudo sv up greetd"
+	}
+	return "  sudo systemctl start greetd"
+}

core/cmd/dms/main.go

@@ -12,11 +12,18 @@ import (
 var Version = "dev"
 
 func init() {
+	runCmd.Flags().BoolP("daemon", "d", false, "Run in daemon mode")
+	runCmd.Flags().Bool("daemon-child", false, "Internal flag for daemon child process")
+	runCmd.Flags().Bool("session", false, "Session managed (like as a systemd unit)")
+	runCmd.Flags().String("log-level", "", "Log level: debug, info, warn, error, fatal (overrides DMS_LOG_LEVEL)")
+	runCmd.Flags().String("log-file", "", "Append logs to this file in addition to stderr (overrides DMS_LOG_FILE)")
+	runCmd.Flags().MarkHidden("daemon-child")
+
+	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd, greeterLaunchSessionCmd)
 	authCmd.AddCommand(authSyncCmd, authResolveLockCmd, authListServicesCmd, authValidateCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
 	updateCmd.AddCommand(updateCheckCmd)
-	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd, pluginsLockCmd, pluginsRestoreCmd)
-	registryCmd.AddCommand(registryListCmd, registryAddCmd, registryRemoveCmd)
+	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
 	rootCmd.AddCommand(getCommonCommands()...)
 
 	rootCmd.AddCommand(authCmd)

core/cmd/dms/main_distro.go

@@ -12,9 +12,17 @@ import (
 var Version = "dev"
 
 func init() {
+	runCmd.Flags().BoolP("daemon", "d", false, "Run in daemon mode")
+	runCmd.Flags().Bool("daemon-child", false, "Internal flag for daemon child process")
+	runCmd.Flags().Bool("session", false, "Session managed (like as a systemd unit)")
+	runCmd.Flags().String("log-level", "", "Log level: debug, info, warn, error, fatal (overrides DMS_LOG_LEVEL)")
+	runCmd.Flags().String("log-file", "", "Append logs to this file in addition to stderr (overrides DMS_LOG_FILE)")
+	runCmd.Flags().MarkHidden("daemon-child")
+
+	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd, greeterLaunchSessionCmd)
 	authCmd.AddCommand(authSyncCmd, authResolveLockCmd, authListServicesCmd, authValidateCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
-	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd, pluginsLockCmd, pluginsRestoreCmd)
+	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
 	rootCmd.AddCommand(getCommonCommands()...)
 	rootCmd.AddCommand(authCmd)
 

core/cmd/dms/randr_client.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/wlr_output_management"
-	wlclient "github.com/AvengeMedia/dankgo/wayland/client"
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
 
 type randrOutput struct {

core/cmd/dms/server_client.go

@@ -101,8 +101,11 @@ func getServerSocketPath() string {
 		runtimeDir = os.TempDir()
 	}
 
-	if sessionSock, ok := shellApp.SessionSocketPath(); ok {
-		return sessionSock
+	if parentPID, ok := sessionParentPID(os.Getenv("WAYLAND_DISPLAY")); ok {
+		sessionSock := filepath.Join(runtimeDir, fmt.Sprintf("danklinux-%d.sock", parentPID))
+		if _, err := os.Stat(sessionSock); err == nil {
+			return sessionSock
+		}
 	}
 
 	entries, err := os.ReadDir(runtimeDir)

core/cmd/dms/shell.go

@@ -4,20 +4,591 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
+	"os/signal"
 	"path/filepath"
 	"slices"
 	"strconv"
 	"strings"
 	"sync"
+	"syscall"
 	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/server"
 )
 
 type ipcTargets map[string]map[string][]string
 
+// getProcessExitCode returns the exit code from a ProcessState.
+// For normal exits, returns the exit code directly.
+// For signal termination, returns 128 + signal number (Unix convention).
+func getProcessExitCode(state *os.ProcessState) int {
+	if state == nil {
+		return 1
+	}
+	if code := state.ExitCode(); code != -1 {
+		return code
+	}
+	// Process was killed by signal - extract signal number
+	if status, ok := state.Sys().(syscall.WaitStatus); ok {
+		if status.Signaled() {
+			return 128 + int(status.Signal())
+		}
+	}
+	return 1
+}
+
+var isSessionManaged bool
+
+func execDetachedRestart(targetPID int) {
+	selfPath, err := os.Executable()
+	if err != nil {
+		return
+	}
+
+	cmd := exec.Command(selfPath, "restart-detached", strconv.Itoa(targetPID))
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Setsid: true,
+	}
+	cmd.Start()
+}
+
+func runDetachedRestart(targetPIDStr string) {
+	targetPID, err := strconv.Atoi(targetPIDStr)
+	if err != nil {
+		return
+	}
+
+	time.Sleep(200 * time.Millisecond)
+
+	proc, err := os.FindProcess(targetPID)
+	if err == nil {
+		proc.Signal(syscall.SIGTERM)
+	}
+
+	time.Sleep(500 * time.Millisecond)
+
+	killShell()
+	runShellDaemon(false)
+}
+
+func getRuntimeDir() string {
+	if runtime := os.Getenv("XDG_RUNTIME_DIR"); runtime != "" {
+		return runtime
+	}
+	return os.TempDir()
+}
+
+func appendLogEnv(env []string) []string {
+	if v := os.Getenv("DMS_LOG_LEVEL"); v != "" {
+		env = append(env, "DMS_LOG_LEVEL="+v)
+	}
+	if v := os.Getenv("DMS_LOG_FILE"); v != "" {
+		env = append(env, "DMS_LOG_FILE="+v)
+	}
+	return env
+}
+
+func withDMSExecutable(env []string) []string {
+	selfPath, err := os.Executable()
+	if err != nil {
+		return env
+	}
+	return append(env, "DMS_EXECUTABLE="+selfPath)
+}
+
+func hasSystemdRun() bool {
+	_, err := exec.LookPath("systemd-run")
+	return err == nil
+}
+
+func getPIDFilePath() string {
+	return filepath.Join(getRuntimeDir(), fmt.Sprintf("danklinux-%d.pid", os.Getpid()))
+}
+
+func getSessionFilePath() string {
+	return filepath.Join(getRuntimeDir(), fmt.Sprintf("danklinux-%d.session", os.Getpid()))
+}
+
+func writePIDFile(childPID int) error {
+	pidFile := getPIDFilePath()
+	if display := os.Getenv("WAYLAND_DISPLAY"); display != "" {
+		if err := os.WriteFile(getSessionFilePath(), []byte(display), 0o644); err != nil {
+			log.Warnf("Failed to write session file: %v", err)
+		}
+	}
+	return os.WriteFile(pidFile, []byte(strconv.Itoa(childPID)), 0o644)
+}
+
+func removePIDFile() {
+	os.Remove(getPIDFilePath())
+	os.Remove(getSessionFilePath())
+}
+
+func getAllDMSPIDs() []int {
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return nil
+	}
+
+	var pids []int
+
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), "danklinux-") || !strings.HasSuffix(entry.Name(), ".pid") {
+			continue
+		}
+
+		pidFile := filepath.Join(dir, entry.Name())
+		data, err := os.ReadFile(pidFile)
+		if err != nil {
+			continue
+		}
+
+		childPID, err := strconv.Atoi(strings.TrimSpace(string(data)))
+		if err != nil {
+			os.Remove(pidFile)
+			continue
+		}
+
+		proc, err := os.FindProcess(childPID)
+		if err != nil {
+			os.Remove(pidFile)
+			continue
+		}
+
+		if err := proc.Signal(syscall.Signal(0)); err != nil {
+			os.Remove(pidFile)
+			continue
+		}
+
+		pids = append(pids, childPID)
+
+		parentPIDStr := strings.TrimPrefix(entry.Name(), "danklinux-")
+		parentPIDStr = strings.TrimSuffix(parentPIDStr, ".pid")
+		if parentPID, err := strconv.Atoi(parentPIDStr); err == nil {
+			if parentProc, err := os.FindProcess(parentPID); err == nil {
+				if err := parentProc.Signal(syscall.Signal(0)); err == nil {
+					pids = append(pids, parentPID)
+				}
+			}
+		}
+	}
+
+	return pids
+}
+
+func runShellInteractive(session bool) {
+	isSessionManaged = session
+	go printASCII()
+	fmt.Fprintf(os.Stderr, "dms %s\n", Version)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	socketPath := server.GetSocketPath()
+
+	configStateFile := filepath.Join(getRuntimeDir(), "danklinux.path")
+	if err := os.WriteFile(configStateFile, []byte(configPath), 0o644); err != nil {
+		log.Warnf("Failed to write config state file: %v", err)
+	}
+	defer os.Remove(configStateFile)
+
+	errChan := make(chan error, 2)
+
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				errChan <- fmt.Errorf("server panic: %v", r)
+			}
+		}()
+		server.CLIVersion = Version
+		if err := server.Start(false); err != nil {
+			errChan <- fmt.Errorf("server error: %w", err)
+		}
+	}()
+
+	ensureFontCache()
+	log.Infof("Spawning quickshell with -p %s", configPath)
+
+	cmd := exec.CommandContext(ctx, "qs", "-p", configPath)
+	cmd.Env = withDMSExecutable(append(os.Environ(), "DMS_SOCKET="+socketPath))
+	if os.Getenv("QT_LOGGING_RULES") == "" {
+		if qtRules := log.GetQtLoggingRules(); qtRules != "" {
+			cmd.Env = append(cmd.Env, "QT_LOGGING_RULES="+qtRules)
+		}
+	}
+
+	if isSessionManaged && hasSystemdRun() {
+		cmd.Env = append(cmd.Env, "DMS_DEFAULT_LAUNCH_PREFIX=systemd-run --user --scope")
+	}
+
+	homeDir, err := os.UserHomeDir()
+	if err == nil && os.Getenv("DMS_DISABLE_HOT_RELOAD") == "" {
+		if !strings.HasPrefix(configPath, homeDir) {
+			cmd.Env = append(cmd.Env, "DMS_DISABLE_HOT_RELOAD=1")
+		}
+	}
+
+	if os.Getenv("QT_QPA_PLATFORMTHEME") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORMTHEME=gtk3")
+	}
+	if os.Getenv("QT_QPA_PLATFORMTHEME_QT6") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORMTHEME_QT6=gtk3")
+	}
+	if os.Getenv("QT_QPA_PLATFORM") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORM=wayland;xcb")
+	}
+	if os.Getenv("QSG_USE_SIMPLE_ANIMATION_DRIVER") == "" {
+		cmd.Env = append(cmd.Env, "QSG_USE_SIMPLE_ANIMATION_DRIVER=1")
+	}
+
+	cmd.Env = appendLogEnv(cmd.Env)
+
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	tracker := &stderrTracker{parent: os.Stderr}
+	cmd.Stderr = tracker
+
+	startTime := time.Now()
+	if err := cmd.Start(); err != nil {
+		log.Fatalf("Error starting quickshell: %v", err)
+	}
+
+	// Write PID file for the quickshell child process
+	if err := writePIDFile(cmd.Process.Pid); err != nil {
+		log.Warnf("Failed to write PID file: %v", err)
+	}
+	defer removePIDFile()
+
+	defer func() {
+		if cmd.Process != nil {
+			cmd.Process.Signal(syscall.SIGTERM)
+		}
+	}()
+
+	sigChan := make(chan os.Signal, 1)
+	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM, syscall.SIGUSR1)
+
+	go func() {
+		if err := cmd.Wait(); err != nil {
+			errChan <- fmt.Errorf("quickshell exited: %w", err)
+		} else {
+			errChan <- fmt.Errorf("quickshell exited")
+		}
+	}()
+
+	for {
+		select {
+		case sig := <-sigChan:
+			if sig == syscall.SIGUSR1 {
+				if isSessionManaged {
+					log.Infof("Received SIGUSR1, exiting for systemd restart...")
+					cancel()
+					cmd.Process.Signal(syscall.SIGTERM)
+					os.Remove(socketPath)
+					os.Exit(1)
+				}
+				log.Infof("Received SIGUSR1, spawning detached restart process...")
+				execDetachedRestart(os.Getpid())
+				return
+			}
+
+			// Check if qs already crashed before we got SIGTERM (systemd sends SIGTERM when D-Bus name is released)
+			select {
+			case <-errChan:
+				cancel()
+				os.Remove(socketPath)
+				exitCode := getProcessExitCode(cmd.ProcessState)
+				logStartupFailure(startTime, exitCode, tracker)
+				os.Exit(exitCode)
+			case <-time.After(500 * time.Millisecond):
+			}
+
+			log.Infof("\nReceived signal %v, shutting down...", sig)
+			cancel()
+			cmd.Process.Signal(syscall.SIGTERM)
+			os.Remove(socketPath)
+			return
+
+		case err := <-errChan:
+			log.Error(err)
+			cancel()
+			if cmd.Process != nil {
+				cmd.Process.Signal(syscall.SIGTERM)
+			}
+			os.Remove(socketPath)
+			exitCode := getProcessExitCode(cmd.ProcessState)
+			logStartupFailure(startTime, exitCode, tracker)
+			os.Exit(exitCode)
+		}
+	}
+}
+
+func restartShell() {
+	pids := getAllDMSPIDs()
+
+	if len(pids) == 0 {
+		log.Info("No running DMS shell instances found. Starting daemon...")
+		runShellDaemon(false)
+		return
+	}
+
+	currentPid := os.Getpid()
+	uniquePids := make(map[int]bool)
+
+	for _, pid := range pids {
+		if pid != currentPid {
+			uniquePids[pid] = true
+		}
+	}
+
+	for pid := range uniquePids {
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			log.Errorf("Error finding process %d: %v", pid, err)
+			continue
+		}
+
+		if err := proc.Signal(syscall.Signal(0)); err != nil {
+			continue
+		}
+
+		if err := proc.Signal(syscall.SIGUSR1); err != nil {
+			log.Errorf("Error sending SIGUSR1 to process %d: %v", pid, err)
+		} else {
+			log.Infof("Sent SIGUSR1 to DMS process with PID %d", pid)
+		}
+	}
+}
+
+func killShell() {
+	pids := getAllDMSPIDs()
+
+	if len(pids) == 0 {
+		log.Info("No running DMS shell instances found.")
+		return
+	}
+
+	currentPid := os.Getpid()
+	uniquePids := make(map[int]bool)
+
+	for _, pid := range pids {
+		if pid != currentPid {
+			uniquePids[pid] = true
+		}
+	}
+
+	for pid := range uniquePids {
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			log.Errorf("Error finding process %d: %v", pid, err)
+			continue
+		}
+
+		if err := proc.Signal(syscall.Signal(0)); err != nil {
+			continue
+		}
+
+		if err := proc.Kill(); err != nil {
+			log.Errorf("Error killing process %d: %v", pid, err)
+		} else {
+			log.Infof("Killed DMS process with PID %d", pid)
+		}
+	}
+
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return
+	}
+
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), "danklinux-") {
+			continue
+		}
+		if strings.HasSuffix(entry.Name(), ".pid") || strings.HasSuffix(entry.Name(), ".session") {
+			os.Remove(filepath.Join(dir, entry.Name()))
+		}
+	}
+}
+
+func runShellDaemon(session bool) {
+	isSessionManaged = session
+	isDaemonChild := slices.Contains(os.Args, "--daemon-child")
+
+	if !isDaemonChild {
+		fmt.Fprintf(os.Stderr, "dms %s\n", Version)
+
+		cmd := exec.Command(os.Args[0], "run", "-d", "--daemon-child")
+		cmd.Env = os.Environ()
+
+		cmd.SysProcAttr = &syscall.SysProcAttr{
+			Setsid: true,
+		}
+
+		if err := cmd.Start(); err != nil {
+			log.Fatalf("Error starting daemon: %v", err)
+		}
+
+		log.Infof("DMS shell daemon started (PID: %d)", cmd.Process.Pid)
+		return
+	}
+
+	fmt.Fprintf(os.Stderr, "dms %s\n", Version)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	socketPath := server.GetSocketPath()
+
+	configStateFile := filepath.Join(getRuntimeDir(), "danklinux.path")
+	if err := os.WriteFile(configStateFile, []byte(configPath), 0o644); err != nil {
+		log.Warnf("Failed to write config state file: %v", err)
+	}
+	defer os.Remove(configStateFile)
+
+	errChan := make(chan error, 2)
+
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				errChan <- fmt.Errorf("server panic: %v", r)
+			}
+		}()
+		server.CLIVersion = Version
+		if err := server.Start(false); err != nil {
+			errChan <- fmt.Errorf("server error: %w", err)
+		}
+	}()
+
+	ensureFontCache()
+	log.Infof("Spawning quickshell with -p %s", configPath)
+
+	cmd := exec.CommandContext(ctx, "qs", "-p", configPath)
+	cmd.Env = withDMSExecutable(append(os.Environ(), "DMS_SOCKET="+socketPath))
+	if os.Getenv("QT_LOGGING_RULES") == "" {
+		if qtRules := log.GetQtLoggingRules(); qtRules != "" {
+			cmd.Env = append(cmd.Env, "QT_LOGGING_RULES="+qtRules)
+		}
+	}
+
+	// ! TODO - remove when QS 0.3 is up and we can use the pragma
+	cmd.Env = append(cmd.Env, "QS_APP_ID=com.danklinux.dms")
+
+	if isSessionManaged && hasSystemdRun() {
+		cmd.Env = append(cmd.Env, "DMS_DEFAULT_LAUNCH_PREFIX=systemd-run --user --scope")
+	}
+
+	homeDir, err := os.UserHomeDir()
+	if err == nil && os.Getenv("DMS_DISABLE_HOT_RELOAD") == "" {
+		if !strings.HasPrefix(configPath, homeDir) {
+			cmd.Env = append(cmd.Env, "DMS_DISABLE_HOT_RELOAD=1")
+		}
+	}
+
+	if os.Getenv("QT_QPA_PLATFORMTHEME") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORMTHEME=gtk3")
+	}
+	if os.Getenv("QT_QPA_PLATFORMTHEME_QT6") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORMTHEME_QT6=gtk3")
+	}
+	if os.Getenv("QT_QPA_PLATFORM") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORM=wayland;xcb")
+	}
+	if os.Getenv("QSG_USE_SIMPLE_ANIMATION_DRIVER") == "" {
+		cmd.Env = append(cmd.Env, "QSG_USE_SIMPLE_ANIMATION_DRIVER=1")
+	}
+
+	cmd.Env = appendLogEnv(cmd.Env)
+
+	devNull, err := os.OpenFile("/dev/null", os.O_RDWR, 0)
+	if err != nil {
+		log.Fatalf("Error opening /dev/null: %v", err)
+	}
+	defer devNull.Close()
+
+	cmd.Stdin = devNull
+	cmd.Stdout = devNull
+	tracker := &stderrTracker{parent: devNull}
+	cmd.Stderr = tracker
+
+	startTime := time.Now()
+	if err := cmd.Start(); err != nil {
+		log.Fatalf("Error starting daemon: %v", err)
+	}
+
+	// Write PID file for the quickshell child process
+	if err := writePIDFile(cmd.Process.Pid); err != nil {
+		log.Warnf("Failed to write PID file: %v", err)
+	}
+	defer removePIDFile()
+
+	defer func() {
+		if cmd.Process != nil {
+			cmd.Process.Signal(syscall.SIGTERM)
+		}
+	}()
+
+	sigChan := make(chan os.Signal, 1)
+	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM, syscall.SIGUSR1)
+
+	go func() {
+		if err := cmd.Wait(); err != nil {
+			errChan <- fmt.Errorf("quickshell exited: %w", err)
+		} else {
+			errChan <- fmt.Errorf("quickshell exited")
+		}
+	}()
+
+	for {
+		select {
+		case sig := <-sigChan:
+			if sig == syscall.SIGUSR1 {
+				if isSessionManaged {
+					log.Infof("Received SIGUSR1, exiting for systemd restart...")
+					cancel()
+					cmd.Process.Signal(syscall.SIGTERM)
+					os.Remove(socketPath)
+					os.Exit(1)
+				}
+				log.Infof("Received SIGUSR1, spawning detached restart process...")
+				execDetachedRestart(os.Getpid())
+				return
+			}
+
+			// Check if qs already crashed before we got SIGTERM (systemd sends SIGTERM when D-Bus name is released)
+			select {
+			case <-errChan:
+				cancel()
+				os.Remove(socketPath)
+				exitCode := getProcessExitCode(cmd.ProcessState)
+				logStartupFailure(startTime, exitCode, tracker)
+				os.Exit(exitCode)
+			case <-time.After(500 * time.Millisecond):
+			}
+
+			cancel()
+			cmd.Process.Signal(syscall.SIGTERM)
+			os.Remove(socketPath)
+			return
+
+		case <-errChan:
+			cancel()
+			if cmd.Process != nil {
+				cmd.Process.Signal(syscall.SIGTERM)
+			}
+			os.Remove(socketPath)
+			exitCode := getProcessExitCode(cmd.ProcessState)
+			logStartupFailure(startTime, exitCode, tracker)
+			os.Exit(exitCode)
+		}
+	}
+}
+
 var qsHasAnyDisplay = sync.OnceValue(func() bool {
 	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
 	defer cancel()
@@ -61,17 +632,17 @@ func parseTargetsFromIPCShowOutput(output string) ipcTargets {
 
 func buildQsIPCBaseArgs() ([]string, error) {
 	cmdArgs := []string{"ipc"}
-	switch pid, ok := shellApp.SessionPID(); {
+	switch pid, ok := getSessionDMSPID(); {
 	case ok:
 		cmdArgs = append(cmdArgs, "--pid", strconv.Itoa(pid))
 	default:
-		if err := shellApp.ResolveConfig(nil, nil); err != nil {
+		if err := findConfig(nil, nil); err != nil {
 			return nil, err
 		}
 		if qsHasAnyDisplay() {
 			cmdArgs = append(cmdArgs, "--any-display")
 		}
-		cmdArgs = append(cmdArgs, "-p", shellApp.ConfigPath())
+		cmdArgs = append(cmdArgs, "-p", configPath)
 	}
 	return cmdArgs, nil
 }
@@ -128,6 +699,101 @@ func getShellIPCCompletions(args []string, _ string) []string {
 	return nil
 }
 
+func getFirstDMSPID() (int, bool) {
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return 0, false
+	}
+
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), "danklinux-") || !strings.HasSuffix(entry.Name(), ".pid") {
+			continue
+		}
+
+		data, err := os.ReadFile(filepath.Join(dir, entry.Name()))
+		if err != nil {
+			continue
+		}
+
+		pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+		if err != nil {
+			continue
+		}
+
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			continue
+		}
+
+		if proc.Signal(syscall.Signal(0)) != nil {
+			continue
+		}
+
+		return pid, true
+	}
+
+	return 0, false
+}
+
+func sessionParentPID(display string) (int, bool) {
+	if display == "" {
+		return 0, false
+	}
+
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return 0, false
+	}
+
+	for _, entry := range entries {
+		name := entry.Name()
+		if !strings.HasPrefix(name, "danklinux-") || !strings.HasSuffix(name, ".session") {
+			continue
+		}
+
+		data, err := os.ReadFile(filepath.Join(dir, name))
+		if err != nil || strings.TrimSpace(string(data)) != display {
+			continue
+		}
+
+		parentStr := strings.TrimSuffix(strings.TrimPrefix(name, "danklinux-"), ".session")
+		parentPID, err := strconv.Atoi(parentStr)
+		if err != nil {
+			continue
+		}
+
+		return parentPID, true
+	}
+
+	return 0, false
+}
+
+func getSessionDMSPID() (int, bool) {
+	parentPID, ok := sessionParentPID(os.Getenv("WAYLAND_DISPLAY"))
+	if !ok {
+		return getFirstDMSPID()
+	}
+
+	data, err := os.ReadFile(filepath.Join(getRuntimeDir(), fmt.Sprintf("danklinux-%d.pid", parentPID)))
+	if err != nil {
+		return getFirstDMSPID()
+	}
+
+	pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+	if err != nil {
+		return getFirstDMSPID()
+	}
+
+	proc, err := os.FindProcess(pid)
+	if err != nil || proc.Signal(syscall.Signal(0)) != nil {
+		return getFirstDMSPID()
+	}
+
+	return pid, true
+}
+
 func runShellIPCCommand(args []string) {
 	if len(args) == 0 {
 		printIPCHelp()
@@ -280,12 +946,36 @@ func rebuildFontCache() {
 	}
 }
 
+type stderrTracker struct {
+	mu     sync.Mutex
+	buf    strings.Builder
+	parent io.Writer
+}
+
+func (s *stderrTracker) Write(p []byte) (n int, err error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.buf.Len() < 8192 {
+		s.buf.Write(p)
+	}
+	if s.parent != nil {
+		return s.parent.Write(p)
+	}
+	return len(p), nil
+}
+
+func (s *stderrTracker) String() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.buf.String()
+}
+
 // logStartupFailure logs diagnostic advice if qs crashes within 5s of launch.
-func logStartupFailure(exitCode int, uptime time.Duration, stderrTail string) {
-	if uptime >= 5*time.Second || exitCode == 0 || exitCode > 128 {
+func logStartupFailure(startTime time.Time, exitCode int, tracker *stderrTracker) {
+	if time.Since(startTime) >= 5*time.Second || exitCode == 0 || exitCode > 128 {
 		return
 	}
-	if containsFontCrashSignature(stderrTail) {
+	if containsFontCrashSignature(tracker.String()) {
 		log.Errorf("DMS startup failed due to a potential font/rendering crash. Try running 'fc-cache -fv' and restarting DMS.")
 	} else {
 		log.Errorf("DMS startup failed (exit code %d). Run 'dms doctor' for more diagnostics.", exitCode)

core/cmd/dms/shellapp.go

@@ -1,82 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/server"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/shellembed"
-	"github.com/AvengeMedia/dankgo/shellapp"
-)
-
-var shellApp = shellapp.New(shellapp.Config{
-	ID:        "danklinux",
-	EnvPrefix: "DMS",
-	QSAppID:   "com.danklinux.dms",
-	Version:   Version,
-	Embedded:  embeddedShell{},
-	Boot:      bootBackend,
-	PreLaunch: preLaunch,
-	ExtraEnv:  dmsExtraEnv,
-	OnUIExit:  logStartupFailure,
-})
-
-type embeddedShell struct{}
-
-func (embeddedShell) Available() bool { return shellembed.Available() }
-
-func (embeddedShell) Extract(baseDir string) (string, error) { return shellembed.Extract(baseDir) }
-
-func (embeddedShell) Prune(baseDir, keep string) { shellembed.Prune(baseDir, keep) }
-
-type dmsBackend struct {
-	srv  *server.Server
-	done chan error
-}
-
-func (b *dmsBackend) SocketPath() string { return b.srv.SocketPath() }
-
-func (b *dmsBackend) Close() { b.srv.Close() }
-
-func (b *dmsBackend) Done() <-chan error { return b.done }
-
-func bootBackend(ctx context.Context) (shellapp.Backend, error) {
-	config.CleanupStrayHyprlandConfFile(log.Infof)
-	server.CLIVersion = Version
-
-	srv := server.New()
-	if err := srv.Listen(); err != nil {
-		return nil, err
-	}
-
-	backend := &dmsBackend{srv: srv, done: make(chan error, 1)}
-	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				backend.done <- fmt.Errorf("server panic: %v", r)
-			}
-		}()
-		backend.done <- srv.Serve(false)
-	}()
-
-	return backend, nil
-}
-
-func preLaunch() {
-	go printASCII()
-	ensureFontCache()
-}
-
-func dmsExtraEnv(string) []string {
-	var env []string
-	if selfPath, err := os.Executable(); err == nil {
-		env = append(env, "DMS_EXECUTABLE="+selfPath)
-	}
-	if os.Getenv("QSG_USE_SIMPLE_ANIMATION_DRIVER") == "" {
-		env = append(env, "QSG_USE_SIMPLE_ANIMATION_DRIVER=1")
-	}
-	return env
-}

core/cmd/dms/utils.go

@@ -1,7 +1,9 @@
 package main
 
 import (
+	"fmt"
 	"os/exec"
+	"slices"
 	"strings"
 )
 
@@ -26,3 +28,62 @@ func isArchPackageInstalled(packageName string) bool {
 	err := cmd.Run()
 	return err == nil
 }
+
+type systemdServiceState struct {
+	Name         string
+	EnabledState string
+	NeedsDisable bool
+	Exists       bool
+}
+
+// checkSystemdServiceEnabled returns (state, should_disable, error) for a systemd service
+func checkSystemdServiceEnabled(serviceName string) (string, bool, error) {
+	cmd := exec.Command("systemctl", "is-enabled", serviceName)
+	output, err := cmd.Output()
+
+	stateStr := strings.TrimSpace(string(output))
+
+	if err != nil {
+		knownStates := []string{"disabled", "masked", "masked-runtime", "not-found", "enabled", "enabled-runtime", "static", "indirect", "alias"}
+		isKnownState := slices.Contains(knownStates, stateStr)
+
+		if !isKnownState {
+			return stateStr, false, fmt.Errorf("systemctl is-enabled failed: %w (output: %s)", err, stateStr)
+		}
+	}
+
+	shouldDisable := false
+	switch stateStr {
+	case "enabled", "enabled-runtime", "static", "indirect", "alias":
+		shouldDisable = true
+	case "disabled", "masked", "masked-runtime", "not-found":
+		shouldDisable = false
+	default:
+		shouldDisable = true
+	}
+
+	return stateStr, shouldDisable, nil
+}
+
+func getSystemdServiceState(serviceName string) (*systemdServiceState, error) {
+	state := &systemdServiceState{
+		Name:   serviceName,
+		Exists: false,
+	}
+
+	enabledState, needsDisable, err := checkSystemdServiceEnabled(serviceName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to check enabled state: %w", err)
+	}
+
+	state.EnabledState = enabledState
+	state.NeedsDisable = needsDisable
+
+	if enabledState == "not-found" {
+		state.Exists = false
+		return state, nil
+	}
+
+	state.Exists = true
+	return state, nil
+}

core/go.mod

@@ -1,14 +1,14 @@
 module github.com/AvengeMedia/DankMaterialShell/core
 
-go 1.26.4
+go 1.26.1
 
 require (
-	github.com/AvengeMedia/dgop v0.2.4-0.20260808141551-f559f2f31d2a
 	github.com/Wifx/gonetworkmanager/v2 v2.2.0
-	github.com/alecthomas/chroma/v2 v2.27.0
+	github.com/alecthomas/chroma/v2 v2.24.1
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/charmbracelet/log v1.0.0
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/godbus/dbus/v5 v5.2.2
 	github.com/holoplot/go-evdev v0.0.0-20260504100651-66d1748fe847
@@ -18,12 +18,12 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/yeqown/go-qrcode/v2 v2.2.5
 	github.com/yeqown/go-qrcode/writer/standard v1.3.0
-	github.com/yuin/goldmark v1.8.4
+	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	go.etcd.io/bbolt v1.5.0
+	go.etcd.io/bbolt v1.4.3
 	go4.org/mem v0.0.0-20240501181205-ae6ca9944745
-	golang.org/x/image v0.44.0
-	tailscale.com v1.100.0
+	golang.org/x/image v0.39.0
+	tailscale.com v1.96.5
 )
 
 require (
@@ -31,55 +31,45 @@ require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/akutz/memconn v0.1.0 // indirect
-	github.com/charmbracelet/log v1.0.0 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
-	github.com/cloudflare/circl v1.6.4 // indirect
-	github.com/coder/websocket v1.8.15 // indirect
-	github.com/danielgtaylor/huma/v2 v2.39.1 // indirect
-	github.com/dblohm7/wingoes v0.0.0-20260526185140-fb298caac7ca // indirect
-	github.com/dlclark/regexp2/v2 v2.5.1 // indirect
-	github.com/ebitengine/purego v0.10.2 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/coder/websocket v1.8.14 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/dblohm7/wingoes v0.0.0-20250822163801-6d8e6105c62d // indirect
+	github.com/dlclark/regexp2 v1.12.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/fogleman/gg v1.3.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/go-git/gcfg/v2 v2.0.2 // indirect
-	github.com/go-git/go-billy/v6 v6.0.0-alpha.1 // indirect
-	github.com/go-json-experiment/json v0.0.0-20260623181947-01eb4420fa68 // indirect
+	github.com/go-git/go-billy/v6 v6.0.0-20260504142752-cb8e9d337266 // indirect
+	github.com/go-json-experiment/json v0.0.0-20260430182902-b6187a392ed4 // indirect
 	github.com/go-logfmt/logfmt v0.6.1 // indirect
-	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
 	github.com/jsimonetti/rtnetlink v1.4.2 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
-	github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 // indirect
-	github.com/mdlayher/netlink v1.11.2 // indirect
-	github.com/mdlayher/socket v0.6.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/mdlayher/netlink v1.11.1 // indirect
+	github.com/mdlayher/socket v0.6.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
-	github.com/shirou/gopsutil/v4 v4.26.7 // indirect
 	github.com/stretchr/objx v0.5.3 // indirect
 	github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 // indirect
-	github.com/tklauser/go-sysconf v0.4.0 // indirect
-	github.com/tklauser/numcpus v0.12.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yeqown/reedsolomon v1.0.0 // indirect
-	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
-	golang.org/x/crypto v0.54.0 // indirect
-	golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 	golang.zx2c4.com/wireguard/windows v1.0.1 // indirect
 )
 
 require (
-	github.com/AvengeMedia/dankgo v0.0.0-20260812195758-5935f34d40ce
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
@@ -89,22 +79,22 @@ require (
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/go-git/go-git/v6 v6.0.0-alpha.4
+	github.com/go-git/go-git/v6 v6.0.0-alpha.2
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.4.1
-	github.com/mattn/go-isatty v0.0.24
-	github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 // indirect
-	github.com/mattn/go-runewidth v0.0.27 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.0
+	github.com/mattn/go-isatty v0.0.22
+	github.com/mattn/go-localereader v0.0.1 // indirect
+	github.com/mattn/go-runewidth v0.0.23 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/muesli/termenv v0.16.0
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/sys v0.47.0
-	golang.org/x/text v0.40.0
+	golang.org/x/sys v0.43.0
+	golang.org/x/text v0.36.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 

core/go.sum

@@ -1,9 +1,5 @@
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-github.com/AvengeMedia/dankgo v0.0.0-20260812195758-5935f34d40ce h1:vNccNlfXze7Fmg9PXrsyxhfAMaifK04bsQHWUjVfe2w=
-github.com/AvengeMedia/dankgo v0.0.0-20260812195758-5935f34d40ce/go.mod h1:xt8RldAfti0QCWidwYIzsSSoJWsE61WgEhTu2H9UpD4=
-github.com/AvengeMedia/dgop v0.2.4-0.20260808141551-f559f2f31d2a h1:bGwK4G22ixHUs5NBeNy4JYMKUMMFoZtQz180OnbSFKE=
-github.com/AvengeMedia/dgop v0.2.4-0.20260808141551-f559f2f31d2a/go.mod h1:2kt1u9YgHwi2npqB5ago8kwZdFrHlPGXv3PM/vwRHfY=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
@@ -15,8 +11,8 @@ github.com/akutz/memconn v0.1.0/go.mod h1:Jo8rI7m0NieZyLI5e2CDlRdRqRRB4S7Xp77ukD
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.2.0/go.mod h1:vf4zrexSH54oEjJ7EdB65tGNHmH3pGZmVkgTP5RHvAs=
-github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
-github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
+github.com/alecthomas/chroma/v2 v2.24.1 h1:m5ffpfZbIb++k8AqFEKy9uVgY12xIQtBsQlc6DfZJQM=
+github.com/alecthomas/chroma/v2 v2.24.1/go.mod h1:l+ohZ9xRXIbGe7cIW+YZgOGbvuVLjMps/FYN/CwuabI=
 github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
@@ -52,27 +48,25 @@ github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSE
 github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/cloudflare/circl v1.6.4 h1:pOXuDTCEYyzydgUpQ0CQz3LsinKjiSk6nNP5Lt5K64U=
-github.com/cloudflare/circl v1.6.4/go.mod h1:YxarevkLlbaHuWsxG6vmYNWBEsSp4pnp7j+4VljMavY=
-github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA=
-github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=
+github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creachadair/taskgroup v0.13.2 h1:3KyqakBuFsm3KkXi/9XIb0QcA8tEzLHLgaoidf0MdVc=
 github.com/creachadair/taskgroup v0.13.2/go.mod h1:i3V1Zx7H8RjwljUEeUWYT30Lmb9poewSb2XI1yTwD0g=
-github.com/danielgtaylor/huma/v2 v2.39.1 h1:0kwF4ltQoYZ+IU55VPy+BcGekzgF44R64daTGde1H+g=
-github.com/danielgtaylor/huma/v2 v2.39.1/go.mod h1:zcnQ38duIJ3VUHwFaBoZ6x8T+KN/mr33oyqxcj0HTug=
+github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
+github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dblohm7/wingoes v0.0.0-20260526185140-fb298caac7ca h1:h1Awca4lQOspNR/2eeo04Ricn5NixDX9mb17WSAgLhQ=
-github.com/dblohm7/wingoes v0.0.0-20260526185140-fb298caac7ca/go.mod h1:2TGl1jRJrRpbzykmg7asHm3h08TqutUgQqY5v9k/g3c=
+github.com/dblohm7/wingoes v0.0.0-20250822163801-6d8e6105c62d h1:QRKpU+9ZBDs62LyBfwhZkJdB5DJX2Sm3p4kUh7l1aA0=
+github.com/dblohm7/wingoes v0.0.0-20250822163801-6d8e6105c62d/go.mod h1:SUxUaAK/0UG5lYyZR1L1nC4AaYYvSSYTWQSH3FPcxKU=
 github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2/v2 v2.5.1 h1:E5Ug7Dh264W1ymdySmiHNcDG7fmsR307APCE5R07a20=
-github.com/dlclark/regexp2/v2 v2.5.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
-github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE=
-github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
@@ -89,23 +83,18 @@ github.com/gaissmai/bart v0.26.1 h1:+w4rnLGNlA2GDVn382Tfe3jOsK5vOr5n4KmigJ9lbTo=
 github.com/gaissmai/bart v0.26.1/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
-github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
-github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo=
 github.com/go-git/gcfg/v2 v2.0.2/go.mod h1:/lv2NsxvhepuMrldsFilrgct6pxzpGdSRC13ydTLSLs=
-github.com/go-git/go-billy/v6 v6.0.0-alpha.1 h1:xVjAR4oUvrKy7/Xuw/lLlV3gkxR3KO2H8W+MamuVVsQ=
-github.com/go-git/go-billy/v6 v6.0.0-alpha.1/go.mod h1:eaCUpHbedW7//EwcYmUDfJe2N6sJC9O12AT0OTqJR1E=
-github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1 h1:gmqi2jvsreu0s8JMLylYDFq4sbjHwwlhktMw0DUg3mA=
-github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1/go.mod h1:ECf1MqJlBdYpKggBrOXjo/0EnvRZx6D++I86UYjPgAQ=
-github.com/go-git/go-git/v6 v6.0.0-alpha.4 h1:aDTc2UGanmaE7FkGLSlBEB9nohMnQ+RKXcfq/D+esDQ=
-github.com/go-git/go-git/v6 v6.0.0-alpha.4/go.mod h1:4ODa/G7hPWrh4Y+7lmt59Ij3zW38IEfvRoAZxLYYBhc=
-github.com/go-json-experiment/json v0.0.0-20260623181947-01eb4420fa68 h1:KZaTBSyshWX3MP5jukJcNSuXDQTO+rNpt0J564dX/eg=
-github.com/go-json-experiment/json v0.0.0-20260623181947-01eb4420fa68/go.mod h1:tphK2c80bpPhMOI4v6bIc2xWywPfbqi1Z06+RcrMkDg=
+github.com/go-git/go-billy/v6 v6.0.0-20260504142752-cb8e9d337266 h1:wH21vHuv323v9x78JNFNJ6P7HEAsdwr9yq2k9/o4zEE=
+github.com/go-git/go-billy/v6 v6.0.0-20260504142752-cb8e9d337266/go.mod h1:CdBVp7CXl9l3sOyNEog46cP1Pvx/hjCe9AD0mtaIUYU=
+github.com/go-git/go-git-fixtures/v6 v6.0.0-20260405195209-b16dd39735e0 h1:XoTsdvaghuVfIr7HpNTmFDLu2nz3I2iGqyn6Uk6MkJc=
+github.com/go-git/go-git-fixtures/v6 v6.0.0-20260405195209-b16dd39735e0/go.mod h1:1Lr7/vYEYyl6Ir9Ku0tKrCIRreM5zovv0Jdx2MPSM4s=
+github.com/go-git/go-git/v6 v6.0.0-alpha.2 h1:T3loNtDuAixNzXtlQxZhnYiYpaQ3CA4vn9RssAniEeI=
+github.com/go-git/go-git/v6 v6.0.0-alpha.2/go.mod h1:oCD3i19CTz7gBpeb11ZZqL91WzqbMq9avn5KpUYy/Ak=
+github.com/go-json-experiment/json v0.0.0-20260430182902-b6187a392ed4 h1:2WmHkJINIjgXXYDGik8d3oJvFA3DAwPy00csDJ3vo+o=
+github.com/go-json-experiment/json v0.0.0-20260430182902-b6187a392ed4/go.mod h1:tphK2c80bpPhMOI4v6bIc2xWywPfbqi1Z06+RcrMkDg=
 github.com/go-logfmt/logfmt v0.6.1 h1:4hvbpePJKnIzH1B+8OR/JPbTx37NktoI9LE2QZBBkvE=
 github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/z6CO0XAk=
-github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
-github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
@@ -116,8 +105,6 @@ github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUv
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/hdevalence/ed25519consensus v0.2.0 h1:37ICyZqdyj0lAZ8P4D1d1id3HqbbG1N3iBb1Tb4rdcU=
 github.com/hdevalence/ed25519consensus v0.2.0/go.mod h1:w3BHWjwJbFU29IRHL1Iqkw3sus+7FctEyM4RqDxYNzo=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
@@ -130,8 +117,8 @@ github.com/jsimonetti/rtnetlink v1.4.2 h1:Df9w9TZ3npHTyDn0Ev9e1uzmN2odmXd0QX+J5G
 github.com/jsimonetti/rtnetlink v1.4.2/go.mod h1:92s6LJdE+1iOrw+F2/RO7LYI2Qd8pPpFNNUYW06gcoM=
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
-github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
-github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -139,20 +126,18 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
-github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 h1:eveIIGn4BGM3qknO74omf6HYr30/exH+eVUTuAgwjZ0=
-github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
-github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
+github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 h1:P8UmIzZMYDR+NGImiFvErt6VWfIRPuGM+vyjiEdkmIw=
 github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
-github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhVlIR0=
-github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
-github.com/mdlayher/netlink v1.11.2 h1:HKh2jqe+omdSWcQ88nrT7INE61B0NXfiSPFdgL4YbNI=
-github.com/mdlayher/netlink v1.11.2/go.mod h1:uT2Yc/QLaZubzDpZIBi9d4GoeLwtp3x1AMeqSRrK2sA=
-github.com/mdlayher/socket v0.6.1 h1:M7uj2NtuujUY4mYr1C57NmfNiRHbkKpnBxO856lsc3A=
-github.com/mdlayher/socket v0.6.1/go.mod h1:+/SGtqc9V+5dAuRgQsU0fGBI+oRDiW7O2Obx10OIWfg=
+github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
+github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mdlayher/netlink v1.11.1 h1:T136gDS6Gkt+hLncaBwKdW5GpEC8Z0ykqimOebVoal0=
+github.com/mdlayher/netlink v1.11.1/go.mod h1:ao4LjamyK4Uq9L8+fQzqFYpAncbeCdwbvd9Edv/pYnc=
+github.com/mdlayher/socket v0.6.0 h1:ScZPaAGyO1icQnbFrhPM8mnXyMu9qukC1K4ZoM2IQKU=
+github.com/mdlayher/socket v0.6.0/go.mod h1:q7vozUAnxSqnjHc12Fik5yUKIzfZ8ITCfMkhOtE9z18=
 github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
 github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
@@ -170,8 +155,6 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 h1:jL3a8soXdzuTCcRnKhOmtcsVOObdDTFf4O2B403HPRU=
-github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
@@ -181,8 +164,6 @@ github.com/sblinch/kdl-go v0.0.0-20260121213736-8b7053306ca6 h1:JsjzqC6ymELkN4Xl
 github.com/sblinch/kdl-go v0.0.0-20260121213736-8b7053306ca6/go.mod h1:b3oNGuAKOQzhsCKmuLc/urEOPzgHj6fB8vl8bwTBh28=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/shirou/gopsutil/v4 v4.26.7 h1:IXzpHz/dkMRYAhKkOXr1HB6SuzWU3eoyyeWe7g3bNZc=
-github.com/shirou/gopsutil/v4 v4.26.7/go.mod h1:5O9FjBiXoTDFatIWjZZosqj4pV0DRtLx598xGbBehzM=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
@@ -199,12 +180,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 h1:Gzfnfk2TWrk8Jj4P4c1a3CtQyMaTVCznlkLZI++hok4=
 github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55/go.mod h1:4k4QO+dQ3R5FofL+SanAUZe+/QfeK0+OIuwDIRu2vSg=
-github.com/tailscale/wireguard-go v0.0.0-20260527010701-b48af7099cad h1:Ky26FR5yZ5IKEB0xtm5A8xSTb06ImY7kxBFrvgOmJSg=
-github.com/tailscale/wireguard-go v0.0.0-20260527010701-b48af7099cad/go.mod h1:6SerzcvHWQchKO2BfNdmquA77CHSECZuFl+D9fp4RnI=
-github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
-github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
-github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
-github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
+github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da h1:jVRUZPRs9sqyKlYHHzHjAqKN+6e/Vog6NpHYeNPJqOw=
+github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da/go.mod h1:BOm5fXUBFM+m9woLNBoxI9TaBXXhGNP50LX/TGIvGb4=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
@@ -216,41 +193,36 @@ github.com/yeqown/go-qrcode/writer/standard v1.3.0/go.mod h1:O4MbzsotGCvy8upYPCR
 github.com/yeqown/reedsolomon v1.0.0 h1:x1h/Ej/uJnNu8jaX7GLHBWmZKCAWjEJTetkqaabr4B0=
 github.com/yeqown/reedsolomon v1.0.0/go.mod h1:P76zpcn2TCuL0ul1Fso373qHRc69LKwAw/Iy6g1WiiM=
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.8.4 h1:oat/nd3U6NeQqFEL3xpEJq7d7c86NI+DbSNGAs4xnjA=
-github.com/yuin/goldmark v1.8.4/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark v1.8.2 h1:kEGpgqJXdgbkhcOgBxkC0X0PmoPG1ZyoZ117rDVp4zE=
+github.com/yuin/goldmark v1.8.2/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
-github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
-github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
-go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
+go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
+go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go4.org/mem v0.0.0-20240501181205-ae6ca9944745 h1:Tl++JLUCe4sxGu8cTpDzRLd3tN7US4hOxG5YpKCzkek=
 go4.org/mem v0.0.0-20240501181205-ae6ca9944745/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
-golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 h1:ex206bKw+v3K0dm3andkrIF+ijyQKJG1pLgwQ2PYdQM=
-golang.org/x/exp v0.0.0-20260727155853-b88d891fe743/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
-golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
-golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
+golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard/windows v1.0.1 h1:eOxiDVbywPC+ZQqvdCK7x+ZwWXKbYv50TtH8ysFIbw8=
@@ -263,5 +235,5 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-tailscale.com v1.100.0 h1:nm/M/dEaW9RaRsGUjW2HsSDpsZ60Jwd9k4gNW9tTFiE=
-tailscale.com v1.100.0/go.mod h1:DQ9YBy85DpNlSyeU2XRIWzbAu3RsGp/frv+Khg57meE=
+tailscale.com v1.96.5 h1:gNkfA/KSZAl6jCH9cj8urq00HRWItDDTtGsyATI89jA=
+tailscale.com v1.96.5/go.mod h1:/3lnZBYb2UEwnN0MNu2SDXUtT06AGd5k0s+OWx3WmcY=

core/internal/backup/backup.go

@@ -1,198 +0,0 @@
-package backup
-
-import (
-	"archive/tar"
-	"compress/gzip"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-)
-
-const dirName = "DankMaterialShell"
-
-func ConfigDir() (string, error) {
-	configDir, err := os.UserConfigDir()
-	if err != nil {
-		return "", err
-	}
-	return filepath.Join(configDir, dirName), nil
-}
-
-func DefaultArchiveName() string {
-	return fmt.Sprintf("dms-backup-%s.tar.gz", time.Now().Format("20060102-150405"))
-}
-
-func Create(outputPath string) error {
-	srcDir, err := ConfigDir()
-	if err != nil {
-		return err
-	}
-	if _, err := os.Stat(srcDir); err != nil {
-		return fmt.Errorf("no DMS configuration found at %s: %w", srcDir, err)
-	}
-
-	out, err := os.Create(outputPath)
-	if err != nil {
-		return err
-	}
-	defer out.Close()
-
-	gz := gzip.NewWriter(out)
-	defer gz.Close()
-	tw := tar.NewWriter(gz)
-	defer tw.Close()
-
-	return filepath.Walk(srcDir, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-
-		rel, err := filepath.Rel(srcDir, path)
-		if err != nil {
-			return err
-		}
-		if rel == "." {
-			return nil
-		}
-
-		var link string
-		if info.Mode()&os.ModeSymlink != 0 {
-			if link, err = os.Readlink(path); err != nil {
-				return err
-			}
-		}
-
-		header, err := tar.FileInfoHeader(info, link)
-		if err != nil {
-			return err
-		}
-		header.Name = filepath.ToSlash(filepath.Join(dirName, rel))
-
-		if err := tw.WriteHeader(header); err != nil {
-			return err
-		}
-		if !info.Mode().IsRegular() {
-			return nil
-		}
-
-		f, err := os.Open(path)
-		if err != nil {
-			return err
-		}
-		defer f.Close()
-		_, err = io.Copy(tw, f)
-		return err
-	})
-}
-
-func Restore(archivePath string) (string, error) {
-	dstDir, err := ConfigDir()
-	if err != nil {
-		return "", err
-	}
-
-	if err := validateArchive(archivePath); err != nil {
-		return "", err
-	}
-
-	previous := ""
-	if _, err := os.Stat(dstDir); err == nil {
-		previous = dstDir + ".pre-restore-" + time.Now().Format("20060102-150405")
-		if err := os.Rename(dstDir, previous); err != nil {
-			return "", fmt.Errorf("failed to move existing configuration aside: %w", err)
-		}
-	}
-
-	if err := extract(archivePath, filepath.Dir(dstDir)); err != nil {
-		if previous != "" {
-			os.RemoveAll(dstDir)
-			os.Rename(previous, dstDir)
-		}
-		return "", err
-	}
-	return previous, nil
-}
-
-func validateArchive(archivePath string) error {
-	hasSettings := false
-	err := walkArchive(archivePath, func(header *tar.Header, _ *tar.Reader) error {
-		name := filepath.ToSlash(filepath.Clean(header.Name))
-		if strings.HasPrefix(name, "..") || filepath.IsAbs(header.Name) {
-			return fmt.Errorf("unsafe path in archive: %s", header.Name)
-		}
-		if !strings.HasPrefix(name, dirName+"/") && name != dirName {
-			return fmt.Errorf("not a DMS backup: unexpected entry %s", header.Name)
-		}
-		if name == dirName+"/settings.json" {
-			hasSettings = true
-		}
-		return nil
-	})
-	if err != nil {
-		return err
-	}
-	if !hasSettings {
-		return fmt.Errorf("not a DMS backup: settings.json missing from archive")
-	}
-	return nil
-}
-
-func extract(archivePath, destParent string) error {
-	return walkArchive(archivePath, func(header *tar.Header, tr *tar.Reader) error {
-		target := filepath.Join(destParent, filepath.Clean(header.Name))
-
-		switch header.Typeflag {
-		case tar.TypeDir:
-			return os.MkdirAll(target, os.FileMode(header.Mode))
-		case tar.TypeSymlink:
-			if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
-				return err
-			}
-			return os.Symlink(header.Linkname, target)
-		case tar.TypeReg:
-			if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
-				return err
-			}
-			f, err := os.OpenFile(target, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.FileMode(header.Mode))
-			if err != nil {
-				return err
-			}
-			defer f.Close()
-			_, err = io.Copy(f, tr)
-			return err
-		default:
-			return nil
-		}
-	})
-}
-
-func walkArchive(archivePath string, visit func(*tar.Header, *tar.Reader) error) error {
-	f, err := os.Open(archivePath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	gz, err := gzip.NewReader(f)
-	if err != nil {
-		return fmt.Errorf("not a gzip archive: %w", err)
-	}
-	defer gz.Close()
-
-	tr := tar.NewReader(gz)
-	for {
-		header, err := tr.Next()
-		if err == io.EOF {
-			return nil
-		}
-		if err != nil {
-			return err
-		}
-		if err := visit(header, tr); err != nil {
-			return err
-		}
-	}
-}

core/internal/blur/probe.go

@@ -2,7 +2,7 @@ package blur
 
 import (
 	wlhelpers "github.com/AvengeMedia/DankMaterialShell/core/internal/wayland/client"
-	client "github.com/AvengeMedia/dankgo/wayland/client"
+	client "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
 
 const extBackgroundEffectInterface = "ext_background_effect_manager_v1"

core/internal/clipboard/clipboard.go

@@ -8,8 +8,7 @@ import (
 	"path/filepath"
 	"syscall"
 
-	"github.com/AvengeMedia/dankgo/wayland/ext_data_control"
-	"github.com/AvengeMedia/dankgo/wlclipboard"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/ext_data_control"
 )
 
 const envServe = "_DMS_CLIPBOARD_SERVE"
@@ -17,6 +16,37 @@ const envMime = "_DMS_CLIPBOARD_MIME"
 const envPasteOnce = "_DMS_CLIPBOARD_PASTE_ONCE"
 const envCacheFile = "_DMS_CLIPBOARD_CACHE"
 
+type Offer struct {
+	MimeType string
+	Data     []byte
+}
+
+// textMimeAliases are offered alongside plain-text content so legacy X11
+// clients bridged through XWayland find a target they can convert.
+var textMimeAliases = []string{
+	"text/plain",
+	"text/plain;charset=utf-8",
+	"UTF8_STRING",
+	"STRING",
+	"TEXT",
+}
+
+// ExpandOffers turns raw clipboard data into the full offer list to serve,
+// adding the standard alias set for text content.
+func ExpandOffers(data []byte, mimeType string) []Offer {
+	offers := []Offer{{MimeType: mimeType, Data: data}}
+	if mimeType != "text/plain" && mimeType != "text/plain;charset=utf-8" {
+		return offers
+	}
+	for _, alias := range textMimeAliases {
+		if alias == mimeType {
+			continue
+		}
+		offers = append(offers, Offer{MimeType: alias, Data: data})
+	}
+	return offers
+}
+
 // MaybeServeAndExit intercepts before cobra when re-exec'd as a clipboard
 // child. Reads source data into memory, deletes any cache file, then serves.
 func MaybeServeAndExit() {
@@ -44,7 +74,7 @@ func MaybeServeAndExit() {
 		os.Exit(1)
 	}
 
-	if err := serveOffers(wlclipboard.ExpandOffers(data, mimeType), pasteOnce); err != nil {
+	if err := serveOffers(ExpandOffers(data, mimeType), pasteOnce); err != nil {
 		fmt.Fprintf(os.Stderr, "clipboard: serve: %v\n", err)
 		os.Exit(1)
 	}
@@ -61,7 +91,7 @@ func CopyText(text string) error {
 
 func CopyOpts(data []byte, mimeType string, foreground, pasteOnce bool) error {
 	if foreground {
-		return serveOffers(wlclipboard.ExpandOffers(data, mimeType), pasteOnce)
+		return serveOffers(ExpandOffers(data, mimeType), pasteOnce)
 	}
 	return copyForkCached(data, mimeType, pasteOnce)
 }
@@ -74,10 +104,10 @@ func CopyReader(data io.Reader, mimeType string, foreground, pasteOnce bool) err
 	if err != nil {
 		return fmt.Errorf("read source: %w", err)
 	}
-	return serveOffers(wlclipboard.ExpandOffers(buf, mimeType), pasteOnce)
+	return serveOffers(ExpandOffers(buf, mimeType), pasteOnce)
 }
 
-func CopyMulti(offers []wlclipboard.Offer, foreground, pasteOnce bool) error {
+func CopyMulti(offers []Offer, foreground, pasteOnce bool) error {
 	if foreground {
 		return serveOffers(offers, pasteOnce)
 	}
@@ -176,7 +206,7 @@ func copyFork(data io.Reader, mimeType string, pasteOnce bool) error {
 	return nil
 }
 
-func copyMultiFork(offers []wlclipboard.Offer, pasteOnce bool) error {
+func copyMultiFork(offers []Offer, pasteOnce bool) error {
 	args := []string{os.Args[0], "cl", "copy", "--foreground", "--type", "__multi__"}
 	if pasteOnce {
 		args = append(args, "--paste-once")
@@ -238,7 +268,7 @@ func createClipboardCacheFile() (*os.File, error) {
 
 // serveOffers owns the Wayland selection until cancelled (or first paste when
 // pasteOnce is set), answering every offered mime type with its data.
-func serveOffers(offers []wlclipboard.Offer, pasteOnce bool) error {
+func serveOffers(offers []Offer, pasteOnce bool) error {
 	if len(offers) == 0 {
 		return fmt.Errorf("no offers to serve")
 	}
@@ -318,6 +348,111 @@ func serveOffers(offers []wlclipboard.Offer, pasteOnce bool) error {
 	}
 }
 
+func Paste() ([]byte, string, error) {
+	s, err := connectSession()
+	if err != nil {
+		return nil, "", err
+	}
+	defer s.Close()
+
+	dataControlMgr, err := s.requireDataControl()
+	if err != nil {
+		return nil, "", err
+	}
+
+	device, err := dataControlMgr.GetDataDevice(s.seat)
+	if err != nil {
+		return nil, "", fmt.Errorf("get data device: %w", err)
+	}
+	defer device.Destroy()
+
+	offerMimeTypes := make(map[*ext_data_control.ExtDataControlOfferV1][]string)
+
+	device.SetDataOfferHandler(func(e ext_data_control.ExtDataControlDeviceV1DataOfferEvent) {
+		if e.Id == nil {
+			return
+		}
+		offerMimeTypes[e.Id] = nil
+		e.Id.SetOfferHandler(func(me ext_data_control.ExtDataControlOfferV1OfferEvent) {
+			offerMimeTypes[e.Id] = append(offerMimeTypes[e.Id], me.MimeType)
+		})
+	})
+
+	var selectionOffer *ext_data_control.ExtDataControlOfferV1
+	gotSelection := false
+
+	device.SetSelectionHandler(func(e ext_data_control.ExtDataControlDeviceV1SelectionEvent) {
+		selectionOffer = e.Id
+		gotSelection = true
+	})
+
+	s.display.Roundtrip()
+	s.display.Roundtrip()
+
+	if !gotSelection || selectionOffer == nil {
+		return nil, "", fmt.Errorf("no clipboard data")
+	}
+
+	selectedMime := selectPreferredMimeType(offerMimeTypes[selectionOffer])
+	if selectedMime == "" {
+		return nil, "", fmt.Errorf("no supported mime type")
+	}
+
+	r, w, err := os.Pipe()
+	if err != nil {
+		return nil, "", fmt.Errorf("create pipe: %w", err)
+	}
+	defer r.Close()
+
+	if err := selectionOffer.Receive(selectedMime, int(w.Fd())); err != nil {
+		w.Close()
+		return nil, "", fmt.Errorf("receive: %w", err)
+	}
+	w.Close()
+
+	s.display.Roundtrip()
+
+	data, err := io.ReadAll(r)
+	if err != nil {
+		return nil, "", fmt.Errorf("read: %w", err)
+	}
+
+	return data, selectedMime, nil
+}
+
+func PasteText() (string, error) {
+	data, _, err := Paste()
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+func selectPreferredMimeType(mimes []string) string {
+	preferred := []string{
+		"text/plain;charset=utf-8",
+		"text/plain",
+		"UTF8_STRING",
+		"STRING",
+		"TEXT",
+		"image/png",
+		"image/jpeg",
+	}
+
+	for _, pref := range preferred {
+		for _, mime := range mimes {
+			if mime == pref {
+				return mime
+			}
+		}
+	}
+
+	if len(mimes) > 0 {
+		return mimes[0]
+	}
+	return ""
+}
+
 func IsImageMimeType(mime string) bool {
 	return len(mime) > 6 && mime[:6] == "image/"
 }

core/internal/clipboard/pastekey.go

@@ -6,7 +6,7 @@ import (
 	"strconv"
 	"strings"
 
-	wlclient "github.com/AvengeMedia/dankgo/wayland/client"
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 	"golang.org/x/sys/unix"
 )
 

core/internal/clipboard/pastekey_live_test.go

@@ -4,7 +4,7 @@ import (
 	"os"
 	"testing"
 
-	wlclient "github.com/AvengeMedia/dankgo/wayland/client"
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 	"golang.org/x/sys/unix"
 )
 

core/internal/clipboard/pastekey_test.go

@@ -78,3 +78,28 @@ func TestResolveKeycodes(t *testing.T) {
 		})
 	}
 }
+
+func TestExpandOffers(t *testing.T) {
+	text := ExpandOffers([]byte("hi"), "text/plain;charset=utf-8")
+	if len(text) != 5 {
+		t.Fatalf("expected 5 text offers, got %d", len(text))
+	}
+	seen := map[string]bool{}
+	for _, o := range text {
+		if string(o.Data) != "hi" {
+			t.Errorf("offer %s has wrong data", o.MimeType)
+		}
+		if seen[o.MimeType] {
+			t.Errorf("duplicate offer %s", o.MimeType)
+		}
+		seen[o.MimeType] = true
+	}
+	if !seen["UTF8_STRING"] || !seen["STRING"] || !seen["TEXT"] || !seen["text/plain"] {
+		t.Errorf("missing X11 alias offers: %v", seen)
+	}
+
+	img := ExpandOffers([]byte{1}, "image/png")
+	if len(img) != 1 || img[0].MimeType != "image/png" {
+		t.Errorf("non-text mime should not expand, got %+v", img)
+	}
+}

core/internal/clipboard/watch.go

@@ -8,24 +8,191 @@ import (
 	"os"
 	"time"
 
-	"github.com/AvengeMedia/dankgo/wayland/ext_data_control"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/ext_data_control"
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
 
-// WatchAll subscribes to clipboard selection changes like wlclipboard.Watch,
-// additionally reporting every mime type each selection offers.
+type ClipboardChange struct {
+	Data      []byte
+	MimeType  string
+	MimeTypes []string
+}
+
+func Watch(ctx context.Context, callback func(data []byte, mimeType string)) error {
+	display, err := wlclient.Connect("")
+	if err != nil {
+		return fmt.Errorf("wayland connect: %w", err)
+	}
+	defer display.Destroy()
+
+	wlCtx := display.Context()
+	registry, err := display.GetRegistry()
+	if err != nil {
+		return fmt.Errorf("get registry: %w", err)
+	}
+	defer registry.Destroy()
+
+	var dataControlMgr *ext_data_control.ExtDataControlManagerV1
+	var seat *wlclient.Seat
+	var bindErr error
+
+	registry.SetGlobalHandler(func(e wlclient.RegistryGlobalEvent) {
+		switch e.Interface {
+		case "ext_data_control_manager_v1":
+			dataControlMgr = ext_data_control.NewExtDataControlManagerV1(wlCtx)
+			if err := registry.Bind(e.Name, e.Interface, e.Version, dataControlMgr); err != nil {
+				bindErr = err
+			}
+		case "wl_seat":
+			if seat != nil {
+				return
+			}
+			seat = wlclient.NewSeat(wlCtx)
+			if err := registry.Bind(e.Name, e.Interface, e.Version, seat); err != nil {
+				bindErr = err
+			}
+		}
+	})
+
+	display.Roundtrip()
+	display.Roundtrip()
+
+	if bindErr != nil {
+		return fmt.Errorf("registry bind: %w", bindErr)
+	}
+
+	if dataControlMgr == nil {
+		return fmt.Errorf("compositor does not support ext_data_control_manager_v1")
+	}
+	defer dataControlMgr.Destroy()
+
+	if seat == nil {
+		return fmt.Errorf("no seat available")
+	}
+
+	device, err := dataControlMgr.GetDataDevice(seat)
+	if err != nil {
+		return fmt.Errorf("get data device: %w", err)
+	}
+	defer device.Destroy()
+
+	offerMimeTypes := make(map[*ext_data_control.ExtDataControlOfferV1][]string)
+
+	device.SetDataOfferHandler(func(e ext_data_control.ExtDataControlDeviceV1DataOfferEvent) {
+		if e.Id == nil {
+			return
+		}
+		offerMimeTypes[e.Id] = nil
+		e.Id.SetOfferHandler(func(me ext_data_control.ExtDataControlOfferV1OfferEvent) {
+			offerMimeTypes[e.Id] = append(offerMimeTypes[e.Id], me.MimeType)
+		})
+	})
+
+	device.SetSelectionHandler(func(e ext_data_control.ExtDataControlDeviceV1SelectionEvent) {
+		if e.Id == nil {
+			return
+		}
+
+		mimes := offerMimeTypes[e.Id]
+		selectedMime := selectPreferredMimeType(mimes)
+		if selectedMime == "" {
+			return
+		}
+
+		r, w, err := os.Pipe()
+		if err != nil {
+			return
+		}
+
+		if err := e.Id.Receive(selectedMime, int(w.Fd())); err != nil {
+			w.Close()
+			r.Close()
+			return
+		}
+		w.Close()
+
+		go func() {
+			defer r.Close()
+			data, err := io.ReadAll(r)
+			if err != nil || len(data) == 0 {
+				return
+			}
+			callback(data, selectedMime)
+		}()
+	})
+
+	display.Roundtrip()
+	display.Roundtrip()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+			if err := wlCtx.SetReadDeadline(time.Now().Add(100 * time.Millisecond)); err != nil {
+				return fmt.Errorf("set read deadline: %w", err)
+			}
+			if err := wlCtx.Dispatch(); err != nil {
+				if isTimeoutError(err) {
+					continue
+				}
+				return fmt.Errorf("dispatch: %w", err)
+			}
+		}
+	}
+}
+
 func WatchAll(ctx context.Context, callback func(data []byte, mimeType string, allMimeTypes []string)) error {
-	s, err := connectSession()
+	display, err := wlclient.Connect("")
 	if err != nil {
-		return err
+		return fmt.Errorf("wayland connect: %w", err)
 	}
-	defer s.Close()
+	defer display.Destroy()
 
-	dataControlMgr, err := s.requireDataControl()
+	wlCtx := display.Context()
+	registry, err := display.GetRegistry()
 	if err != nil {
-		return err
+		return fmt.Errorf("get registry: %w", err)
+	}
+	defer registry.Destroy()
+
+	var dataControlMgr *ext_data_control.ExtDataControlManagerV1
+	var seat *wlclient.Seat
+	var bindErr error
+
+	registry.SetGlobalHandler(func(e wlclient.RegistryGlobalEvent) {
+		switch e.Interface {
+		case "ext_data_control_manager_v1":
+			dataControlMgr = ext_data_control.NewExtDataControlManagerV1(wlCtx)
+			if err := registry.Bind(e.Name, e.Interface, e.Version, dataControlMgr); err != nil {
+				bindErr = err
+			}
+		case "wl_seat":
+			if seat != nil {
+				return
+			}
+			seat = wlclient.NewSeat(wlCtx)
+			if err := registry.Bind(e.Name, e.Interface, e.Version, seat); err != nil {
+				bindErr = err
+			}
+		}
+	})
+
+	display.Roundtrip()
+	display.Roundtrip()
+
+	if bindErr != nil {
+		return fmt.Errorf("registry bind: %w", bindErr)
+	}
+	if dataControlMgr == nil {
+		return fmt.Errorf("compositor does not support ext_data_control_manager_v1")
+	}
+	defer dataControlMgr.Destroy()
+	if seat == nil {
+		return fmt.Errorf("no seat available")
 	}
 
-	device, err := dataControlMgr.GetDataDevice(s.seat)
+	device, err := dataControlMgr.GetDataDevice(seat)
 	if err != nil {
 		return fmt.Errorf("get data device: %w", err)
 	}
@@ -79,18 +246,18 @@ func WatchAll(ctx context.Context, callback func(data []byte, mimeType string, a
 		}()
 	})
 
-	s.display.Roundtrip()
-	s.display.Roundtrip()
+	display.Roundtrip()
+	display.Roundtrip()
 
 	for {
 		select {
 		case <-ctx.Done():
 			return ctx.Err()
 		default:
-			if err := s.ctx.SetReadDeadline(time.Now().Add(100 * time.Millisecond)); err != nil {
+			if err := wlCtx.SetReadDeadline(time.Now().Add(100 * time.Millisecond)); err != nil {
 				return fmt.Errorf("set read deadline: %w", err)
 			}
-			if err := s.ctx.Dispatch(); err != nil {
+			if err := wlCtx.Dispatch(); err != nil {
 				if isTimeoutError(err) {
 					continue
 				}
@@ -100,31 +267,6 @@ func WatchAll(ctx context.Context, callback func(data []byte, mimeType string, a
 	}
 }
 
-func selectPreferredMimeType(mimes []string) string {
-	preferred := []string{
-		"text/plain;charset=utf-8",
-		"text/plain",
-		"UTF8_STRING",
-		"STRING",
-		"TEXT",
-		"image/png",
-		"image/jpeg",
-	}
-
-	for _, pref := range preferred {
-		for _, mime := range mimes {
-			if mime == pref {
-				return mime
-			}
-		}
-	}
-
-	if len(mimes) > 0 {
-		return mimes[0]
-	}
-	return ""
-}
-
 func isTimeoutError(err error) bool {
 	if err == nil {
 		return false
@@ -137,3 +279,25 @@ func isTimeoutError(err error) bool {
 	}
 	return false
 }
+
+func WatchChan(ctx context.Context) (<-chan ClipboardChange, <-chan error) {
+	ch := make(chan ClipboardChange, 16)
+	errCh := make(chan error, 1)
+
+	go func() {
+		defer close(ch)
+		err := Watch(ctx, func(data []byte, mimeType string) {
+			select {
+			case ch <- ClipboardChange{Data: data, MimeType: mimeType}:
+			default:
+			}
+		})
+		if err != nil && err != context.Canceled {
+			errCh <- err
+		}
+		close(errCh)
+	}()
+
+	time.Sleep(50 * time.Millisecond)
+	return ch, errCh
+}

core/internal/clipboard/wl.go

@@ -3,9 +3,9 @@ package clipboard
 import (
 	"fmt"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/ext_data_control"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/virtual_keyboard"
-	wlclient "github.com/AvengeMedia/dankgo/wayland/client"
-	"github.com/AvengeMedia/dankgo/wayland/ext_data_control"
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
 
 type session struct {

core/internal/colorpicker/picker.go

@@ -10,7 +10,7 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/wlr_screencopy"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/wp_viewporter"
 	wlhelpers "github.com/AvengeMedia/DankMaterialShell/core/internal/wayland/client"
-	"github.com/AvengeMedia/dankgo/wayland/client"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
 
 type Config struct {

core/internal/config/deployer.go

@@ -264,7 +264,6 @@ func (cd *ConfigDeployer) deployNiriDmsConfigs(dmsDir, terminalCommand string) e
 		{"layout.kdl", NiriLayoutConfig},
 		{"alttab.kdl", NiriAlttabConfig},
 		{"binds.kdl", strings.ReplaceAll(NiriBindsConfig, "{{TERMINAL_COMMAND}}", terminalCommand)},
-		{"input.kdl", NiriInputConfig},
 		{"outputs.kdl", ""},
 		{"cursor.kdl", ""},
 		{"windowrules.kdl", ""},

core/internal/config/embedded/niri-greeter.kdl

@@ -0,0 +1,17 @@
+hotkey-overlay {
+    skip-at-startup
+}
+
+environment {
+    DMS_RUN_GREETER "1"
+}
+
+gestures {
+    hot-corners {
+        off
+    }
+}
+
+layout {
+    background-color "#000000"
+}

core/internal/config/embedded/niri-input.kdl

@@ -1,15 +0,0 @@
-// ! DO NOT EDIT !
-// ! AUTO-GENERATED BY DMS !
-// ! CHANGES WILL BE OVERWRITTEN !
-// ! PLACE YOUR CUSTOM CONFIGURATION ELSEWHERE !
-
-input {
-    mouse {
-        accel-speed 0.0
-    }
-    touchpad {
-        tap
-        accel-speed 0.0
-        natural-scroll
-    }
-}

core/internal/config/embedded/niri.kdl

@@ -34,6 +34,31 @@ input {
         numlock
     }
 
+    // Next sections include libinput settings.
+    // Omitting settings disables them, or leaves them at their default values.
+    // All commented-out settings here are examples, not defaults.
+    touchpad {
+        // off
+        tap
+        // dwt
+        // dwtp
+        // drag false
+        // drag-lock
+        natural-scroll
+        // accel-speed 0.2
+        // accel-profile "flat"
+        // scroll-method "two-finger"
+        // disabled-on-external-mouse
+    }
+
+    mouse {
+        // off
+        // natural-scroll
+        // accel-speed 0.2
+        // accel-profile "flat"
+        // scroll-method "no-scroll"
+    }
+
     trackpoint {
         // off
         // natural-scroll
@@ -52,7 +77,6 @@ input {
     // Setting max-scroll-amount="0%" makes it work only on windows already fully on screen.
     // focus-follows-mouse max-scroll-amount="0%"
 }
-
 // You can configure outputs by their name, which you can find
 // by running `niri msg outputs` while inside a niri instance.
 // The built-in laptop monitor is usually called "eDP-1".
@@ -247,4 +271,3 @@ include optional=true "dms/alttab.kdl"
 include optional=true "dms/binds.kdl"
 include optional=true "dms/outputs.kdl"
 include optional=true "dms/cursor.kdl"
-include optional=true "dms/input.kdl"

core/internal/config/niri.go

@@ -17,5 +17,5 @@ var NiriAlttabConfig string
 //go:embed embedded/niri-binds.kdl
 var NiriBindsConfig string
 
-//go:embed embedded/niri-input.kdl
-var NiriInputConfig string
+//go:embed embedded/niri-greeter.kdl
+var NiriGreeterConfig string

core/internal/dank16/dank16.go

@@ -313,7 +313,6 @@ func EnsureContrastDPSLstar(hexColor, hexBg string, minLc float64, isLightMode b
 	fg := HexToRGB(hexColor)
 	cf := colorful.Color{R: fg.R, G: fg.G, B: fg.B}
 	Lf, af, bf := cf.Lab()
-	Lf *= 100.0
 
 	dir := 1.0
 	if isLightMode {
@@ -342,7 +341,6 @@ func EnsureContrastDPSBidirectional(hexColor, hexBg string, minLc float64, isLig
 	fg := HexToRGB(hexColor)
 	cf := colorful.Color{R: fg.R, G: fg.G, B: fg.B}
 	origL, af, bf := cf.Lab()
-	origL *= 100.0
 
 	var darkerResult, lighterResult string
 	darkerL, lighterL := origL, origL
@@ -422,24 +420,6 @@ func blendHue(base, target, factor float64) float64 {
 	return result
 }
 
-// color8 sits a fixed L* offset from the background so it keeps its dim role
-// regardless of primary brightness (conventional palettes put ANSI bright
-// black ~2-2.5:1 from the background, e.g. catppuccin-mocha #585b70 on #1e1e2e)
-func DeriveDim(bgHex string, hue, sat float64, isLight bool) string {
-	offset := 22.0
-	if isLight {
-		offset = -offset
-	}
-
-	bgL := getLstar(bgHex)
-	targetL := math.Max(0, math.Min(100, bgL+offset))
-
-	tint := HSVToRGB(HSV{H: hue, S: sat, V: 0.5})
-	c := colorful.Color{R: tint.R, G: tint.G, B: tint.B}
-	_, af, bf := c.Lab()
-	return labToHex(targetL, af, bf)
-}
-
 func DeriveContainer(primary string, isLight bool) string {
 	rgb := HexToRGB(primary)
 	hsv := RGBToHSV(rgb)
@@ -520,7 +500,10 @@ func GeneratePalette(primaryColor string, opts PaletteOptions) Palette {
 		gray7V := baseVal * 0.28
 		palette.Color7 = NewColorInfo(ensureContrastAuto(RGBToHex(HSVToRGB(HSV{H: hsv.H, S: gray7S, V: gray7V})), bgColor, normalTextTarget, opts))
 
-		palette.Color8 = NewColorInfo(DeriveDim(bgColor, hsv.H, baseSat*0.05, true))
+		gray8S := baseSat * 0.05
+		gray8V := baseVal * 0.85
+		dimTarget := secondaryTarget * 0.5
+		palette.Color8 = NewColorInfo(ensureContrastBidirectional(RGBToHex(HSVToRGB(HSV{H: hsv.H, S: gray8S, V: gray8V})), bgColor, dimTarget, opts))
 
 		brightRedS := math.Min(baseSat*1.0, 1.0)
 		brightRedV := math.Min(baseVal*1.2, 1.0)
@@ -576,7 +559,9 @@ func GeneratePalette(primaryColor string, opts PaletteOptions) Palette {
 		gray7V := math.Min(baseVal*1.05, 1.0)
 		palette.Color7 = NewColorInfo(ensureContrastAuto(RGBToHex(HSVToRGB(HSV{H: hsv.H, S: gray7S, V: gray7V})), bgColor, normalTextTarget, opts))
 
-		palette.Color8 = NewColorInfo(DeriveDim(bgColor, hsv.H, baseSat*0.15, false))
+		gray8S := baseSat * 0.15
+		gray8V := baseVal * 0.65
+		palette.Color8 = NewColorInfo(ensureContrastAuto(RGBToHex(HSVToRGB(HSV{H: hsv.H, S: gray8S, V: gray8V})), bgColor, secondaryTarget, opts))
 
 		brightRedS := math.Min(baseSat*0.75, 1.0)
 		brightRedV := math.Min(baseVal*1.35, 1.0)

core/internal/dank16/dank16_test.go

@@ -679,73 +679,3 @@ func TestContrastAlgorithmComparison(t *testing.T) {
 
 	t.Logf("WCAG and DPS palettes differ in %d/16 colors", differentCount)
 }
-
-func TestEnsureContrastDPSLightModeStaysLight(t *testing.T) {
-	tests := []struct {
-		name     string
-		result   string
-		bg       string
-		minLstar float64
-	}{
-		{
-			name:     "bidirectional adjustment",
-			result:   EnsureContrastDPSBidirectional("#d0ccc6", "#f8f8f8", 17.5, true),
-			bg:       "#f8f8f8",
-			minLstar: 20.0,
-		},
-		{
-			name:     "lstar adjustment",
-			result:   EnsureContrastDPSLstar("#c0c0c0", "#f8f8f8", 30.0, true),
-			bg:       "#f8f8f8",
-			minLstar: 20.0,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			lstar := getLstar(tt.result)
-			if lstar < tt.minLstar {
-				t.Errorf("result %s has L* %.2f on light bg %s, expected >= %.2f (collapsed to near-black)",
-					tt.result, lstar, tt.bg, tt.minLstar)
-			}
-		})
-	}
-}
-
-func TestGeneratePaletteColor8Dim(t *testing.T) {
-	hues := []string{"#e91e63", "#f59e0b", "#22c55e", "#06b6d4", "#8b5cf6", "#ef4444"}
-
-	for _, base := range hues {
-		t.Run(base, func(t *testing.T) {
-			palette := GeneratePalette(base, PaletteOptions{IsLight: false, UseDPS: true})
-
-			bgRatio := ContrastRatio(palette.Color8.Hex, palette.Color0.Hex)
-			if bgRatio < 1.5 || bgRatio > 3.0 {
-				t.Errorf("Color8 %s vs bg %s ratio %.2f, expected 1.5-3.0 (bright black stays near bg)",
-					palette.Color8.Hex, palette.Color0.Hex, bgRatio)
-			}
-
-			sepRatio := ContrastRatio(palette.Color4.Hex, palette.Color8.Hex)
-			if sepRatio < 2.0 {
-				t.Errorf("Color4 %s vs Color8 %s ratio %.2f, expected >= 2.0 (blue must not collide with bright black)",
-					palette.Color4.Hex, palette.Color8.Hex, sepRatio)
-			}
-		})
-	}
-}
-
-func TestGeneratePaletteLightColor8StaysLight(t *testing.T) {
-	palette := GeneratePalette("#f59e0b", PaletteOptions{IsLight: true, UseDPS: true})
-
-	lstar := getLstar(palette.Color8.Hex)
-	if lstar < 60.0 {
-		t.Errorf("light mode Color8 %s has L* %.2f, expected >= 60 (dim grey, not near-black)",
-			palette.Color8.Hex, lstar)
-	}
-
-	bgRatio := ContrastRatio(palette.Color8.Hex, palette.Color0.Hex)
-	if bgRatio > 3.0 {
-		t.Errorf("light mode Color8 %s vs bg %s ratio %.2f, expected <= 3.0",
-			palette.Color8.Hex, palette.Color0.Hex, bgRatio)
-	}
-}

core/internal/desktop/mime.go

@@ -302,22 +302,6 @@ func AppsForMime(mimeType string) []string {
 	return out
 }
 
-// HandlersForMime lists launchable handler entries for a mime type,
-// excluding Terminal=true and NoDisplay=true desktop entries so pickers
-// only offer graphical applications.
-func HandlersForMime(mimeType string) []*Entry {
-	ids := AppsForMime(mimeType)
-	out := make([]*Entry, 0, len(ids))
-	for _, id := range ids {
-		entry := EntryByID(id)
-		if entry == nil || entry.Hidden || entry.NoDisplay || entry.Terminal {
-			continue
-		}
-		out = append(out, entry)
-	}
-	return out
-}
-
 func QueryDefaults(mimeTypes []string) map[string]string {
 	out := make(map[string]string, len(mimeTypes))
 	for _, m := range mimeTypes {

core/internal/desktop/mimeapps.go

@@ -4,7 +4,6 @@ import (
 	"bufio"
 	"bytes"
 	"fmt"
-	"maps"
 	"os"
 	"path/filepath"
 	"slices"
@@ -82,10 +81,7 @@ func readAssociations(path string) (*MimeAssociations, error) {
 	if err != nil {
 		return nil, err
 	}
-	return associationsFromData(data), nil
-}
 
-func associationsFromData(data []byte) *MimeAssociations {
 	groups := parseGroups(data)
 	assoc := newAssociations()
 
@@ -110,7 +106,7 @@ func associationsFromData(data []byte) *MimeAssociations {
 		}
 	}
 
-	return assoc
+	return assoc, nil
 }
 
 func mergedAssociations() *MimeAssociations {
@@ -148,22 +144,40 @@ func writeUserMimeapps(update func(*MimeAssociations)) error {
 
 	path := mimeappsWritePath()
 
-	original, err := os.ReadFile(path)
-	if err != nil && !os.IsNotExist(err) {
-		return err
+	assoc, err := readAssociations(path)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			return err
+		}
+		assoc = newAssociations()
 	}
 
-	assoc := associationsFromData(original)
 	update(assoc)
 
-	rendered, err := renderMimeapps(original, assoc)
-	if err != nil {
-		return err
+	var buf bytes.Buffer
+	w := bufio.NewWriter(&buf)
+
+	var writeErr error
+	writeSection := func(name string, entries map[string]string) {
+		fmt.Fprintf(w, "[%s]\n", name)
+		keys := make([]string, 0, len(entries))
+		for k := range entries {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+		for _, k := range keys {
+			v := entries[k]
+			if !isSafeIniField(k) || !isSafeIniField(v) {
+				if writeErr == nil {
+					writeErr = fmt.Errorf("invalid mimeapps.list field %q=%q", k, v)
+				}
+				continue
+			}
+			fmt.Fprintf(w, "%s=%s\n", k, v)
+		}
+		fmt.Fprintln(w)
 	}
-	return atomicWriteFile(path, rendered)
-}
 
-func managedGroups(assoc *MimeAssociations) (map[string]map[string]string, error) {
 	flatten := func(m map[string][]string) map[string]string {
 		out := make(map[string]string, len(m))
 		for k, list := range m {
@@ -172,172 +186,22 @@ func managedGroups(assoc *MimeAssociations) (map[string]map[string]string, error
 		return out
 	}
 
-	groups := map[string]map[string]string{
-		groupDefaults: maps.Clone(assoc.Defaults),
-		groupAdded:    flatten(assoc.Added),
-		groupRemoved:  flatten(assoc.Removed),
-	}
-	for name, entries := range groups {
-		for k, v := range entries {
-			if isSafeIniField(k) && isSafeIniField(v) {
-				continue
-			}
-			return nil, fmt.Errorf("invalid mimeapps.list field in [%s]: %q=%q", name, k, v)
-		}
-	}
-	return groups, nil
-}
+	writeSection(groupDefaults, assoc.Defaults)
+	writeSection(groupAdded, flatten(assoc.Added))
+	writeSection(groupRemoved, flatten(assoc.Removed))
 
-// renderMimeapps rewrites only the three association groups defined by the
-// mime-apps spec (https://specifications.freedesktop.org/mime-apps-spec/),
-// keeping comments, blank lines, and unrelated groups verbatim.
-func renderMimeapps(original []byte, assoc *MimeAssociations) ([]byte, error) {
-	managed, err := managedGroups(assoc)
-	if err != nil {
-		return nil, err
+	if writeErr != nil {
+		return writeErr
 	}
 
-	written := map[string]map[string]bool{
-		groupDefaults: {},
-		groupAdded:    {},
-		groupRemoved:  {},
-	}
-
-	var out []string
-
-	flushMissing := func(group string) {
-		entries, ok := managed[group]
-		if !ok {
-			return
-		}
-		keys := make([]string, 0, len(entries))
-		for k := range entries {
-			if !written[group][k] {
-				keys = append(keys, k)
-			}
-		}
-		if len(keys) == 0 {
-			return
-		}
-		sort.Strings(keys)
-
-		insertAt := len(out)
-		for insertAt > 0 && strings.TrimSpace(out[insertAt-1]) == "" {
-			insertAt--
-		}
-		lines := make([]string, 0, len(keys))
-		for _, k := range keys {
-			written[group][k] = true
-			lines = append(lines, k+"="+entries[k])
-		}
-		tail := append([]string(nil), out[insertAt:]...)
-		out = append(out[:insertAt], append(lines, tail...)...)
-	}
-
-	current := ""
-	scanner := bufio.NewScanner(bytes.NewReader(original))
-	scanner.Buffer(make([]byte, 64*1024), 1024*1024)
-	for scanner.Scan() {
-		line := scanner.Text()
-		trimmed := strings.TrimSpace(line)
-
-		if strings.HasPrefix(trimmed, "[") && strings.HasSuffix(trimmed, "]") {
-			flushMissing(current)
-			current = trimmed[1 : len(trimmed)-1]
-			out = append(out, line)
-			continue
-		}
-
-		entries, isManaged := managed[current]
-		if !isManaged {
-			out = append(out, line)
-			continue
-		}
-
-		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
-			out = append(out, line)
-			continue
-		}
-
-		eq := strings.IndexByte(trimmed, '=')
-		if eq <= 0 {
-			out = append(out, line)
-			continue
-		}
-
-		key := strings.TrimSpace(trimmed[:eq])
-		val, keep := entries[key]
-		if !keep || written[current][key] {
-			continue
-		}
-		written[current][key] = true
-		out = append(out, key+"="+val)
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, err
-	}
-	flushMissing(current)
-
-	for _, group := range []string{groupDefaults, groupAdded, groupRemoved} {
-		entries := managed[group]
-		pending := make([]string, 0, len(entries))
-		for k := range entries {
-			if !written[group][k] {
-				pending = append(pending, k)
-			}
-		}
-		if len(pending) == 0 {
-			continue
-		}
-		sort.Strings(pending)
-
-		if len(out) > 0 && strings.TrimSpace(out[len(out)-1]) != "" {
-			out = append(out, "")
-		}
-		out = append(out, "["+group+"]")
-		for _, k := range pending {
-			written[group][k] = true
-			out = append(out, k+"="+entries[k])
-		}
-	}
-
-	if len(out) == 0 {
-		return nil, nil
-	}
-	return []byte(strings.Join(out, "\n") + "\n"), nil
-}
-
-func atomicWriteFile(path string, data []byte) error {
-	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := w.Flush(); err != nil {
 		return err
 	}
 
-	tmp, err := os.CreateTemp(dir, ".mimeapps-*.tmp")
-	if err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return err
 	}
-	tmpPath := tmp.Name()
-
-	if _, err := tmp.Write(data); err != nil {
-		tmp.Close()
-		os.Remove(tmpPath)
-		return err
-	}
-	if err := tmp.Chmod(0o644); err != nil {
-		tmp.Close()
-		os.Remove(tmpPath)
-		return err
-	}
-	if err := tmp.Close(); err != nil {
-		os.Remove(tmpPath)
-		return err
-	}
-	if err := os.Rename(tmpPath, path); err != nil {
-		os.Remove(tmpPath)
-		return err
-	}
-	return nil
+	return os.WriteFile(path, buf.Bytes(), 0o644)
 }
 
 func setDefaultAssociation(mimeType, desktopID string) error {

core/internal/desktop/mimeapps_test.go

@@ -1,210 +0,0 @@
-package desktop
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestSetDefaultsPreservesUnrelatedContent(t *testing.T) {
-	configHome, _ := setupFakeXDG(t)
-	path := filepath.Join(configHome, "mimeapps.list")
-	writeFile(t, path, `# managed by hand
-[Default Applications]
-text/html=firefox.desktop
-# pinned image viewer
-image/png=eog.desktop
-
-[Added Associations]
-text/html=firefox.desktop;
-
-[Custom Section]
-foo=bar
-`)
-
-	if err := SetDefaults([]string{"inode/directory", "x-scheme-handler/sftp"}, "org.kde.dolphin.desktop"); err != nil {
-		t.Fatal(err)
-	}
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := string(data)
-
-	preserved := []string{
-		"# managed by hand",
-		"# pinned image viewer",
-		"text/html=firefox.desktop",
-		"image/png=eog.desktop",
-		"[Custom Section]",
-		"foo=bar",
-	}
-	for _, want := range preserved {
-		if !strings.Contains(got, want) {
-			t.Errorf("rewrite lost %q:\n%s", want, got)
-		}
-	}
-
-	written := []string{
-		"inode/directory=org.kde.dolphin.desktop",
-		"x-scheme-handler/sftp=org.kde.dolphin.desktop",
-	}
-	for _, want := range written {
-		if !strings.Contains(got, want) {
-			t.Errorf("rewrite missing %q:\n%s", want, got)
-		}
-	}
-
-	if got := GetDefault("inode/directory"); got != "org.kde.dolphin.desktop" {
-		t.Errorf("GetDefault(inode/directory) = %q", got)
-	}
-	if got := GetDefault("x-scheme-handler/sftp"); got != "org.kde.dolphin.desktop" {
-		t.Errorf("GetDefault(x-scheme-handler/sftp) = %q", got)
-	}
-}
-
-func TestSetDefaultReplacesKeyInPlace(t *testing.T) {
-	configHome, _ := setupFakeXDG(t)
-	path := filepath.Join(configHome, "mimeapps.list")
-	writeFile(t, path, `[Default Applications]
-inode/directory=foot.desktop
-text/html=firefox.desktop
-`)
-
-	if err := SetDefault("inode/directory", "org.gnome.Nautilus.desktop"); err != nil {
-		t.Fatal(err)
-	}
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := string(data)
-
-	if n := strings.Count(got, "inode/directory=org.gnome.Nautilus.desktop\n"); n != 1 {
-		t.Errorf("expected exactly one replaced default line, got %d:\n%s", n, got)
-	}
-	if strings.Contains(got, "foot.desktop") {
-		t.Errorf("old default still present:\n%s", got)
-	}
-	if !strings.Contains(got, "text/html=firefox.desktop") {
-		t.Errorf("unrelated default lost:\n%s", got)
-	}
-}
-
-func TestSetDefaultsCreatesFileWhenAbsent(t *testing.T) {
-	configHome, _ := setupFakeXDG(t)
-	path := filepath.Join(configHome, "mimeapps.list")
-
-	if err := SetDefaults([]string{"inode/directory", "x-scheme-handler/sftp"}, "org.kde.dolphin"); err != nil {
-		t.Fatal(err)
-	}
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := string(data)
-
-	expected := []string{
-		"[Default Applications]",
-		"inode/directory=org.kde.dolphin.desktop",
-		"x-scheme-handler/sftp=org.kde.dolphin.desktop",
-		"[Added Associations]",
-	}
-	for _, want := range expected {
-		if !strings.Contains(got, want) {
-			t.Errorf("new file missing %q:\n%s", want, got)
-		}
-	}
-
-	entries, err := os.ReadDir(configHome)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, e := range entries {
-		if strings.HasSuffix(e.Name(), ".tmp") {
-			t.Errorf("leftover temp file %q", e.Name())
-		}
-	}
-}
-
-func TestSetDefaultClearsRemovedAssociation(t *testing.T) {
-	configHome, _ := setupFakeXDG(t)
-	path := filepath.Join(configHome, "mimeapps.list")
-	writeFile(t, path, `[Removed Associations]
-inode/directory=org.kde.dolphin.desktop;other.desktop;
-`)
-
-	if err := SetDefault("inode/directory", "org.kde.dolphin.desktop"); err != nil {
-		t.Fatal(err)
-	}
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := string(data)
-
-	if !strings.Contains(got, "inode/directory=other.desktop;") {
-		t.Errorf("unrelated removed entry lost:\n%s", got)
-	}
-	if strings.Contains(got, "org.kde.dolphin.desktop;other.desktop") {
-		t.Errorf("chosen app still in removed list:\n%s", got)
-	}
-	if got := GetDefault("inode/directory"); got != "org.kde.dolphin.desktop" {
-		t.Errorf("GetDefault = %q", got)
-	}
-}
-
-func TestHandlersForMimeExcludesTerminalAndNoDisplay(t *testing.T) {
-	_, dataHome := setupFakeXDG(t)
-	apps := filepath.Join(dataHome, "applications")
-	writeFile(t, filepath.Join(apps, "org.kde.dolphin.desktop"), `[Desktop Entry]
-Type=Application
-Name=Dolphin
-Icon=system-file-manager
-MimeType=inode/directory;
-`)
-	writeFile(t, filepath.Join(apps, "ghost-term.desktop"), `[Desktop Entry]
-Type=Application
-Name=Ghost Terminal
-Terminal=true
-MimeType=inode/directory;
-`)
-	writeFile(t, filepath.Join(apps, "hidden-fm.desktop"), `[Desktop Entry]
-Type=Application
-Name=Hidden FM
-NoDisplay=true
-MimeType=inode/directory;
-`)
-	writeFile(t, filepath.Join(apps, "mimeinfo.cache"), `[MIME Cache]
-inode/directory=ghost-term.desktop;org.kde.dolphin.desktop;hidden-fm.desktop;stale.desktop;
-`)
-
-	handlers := HandlersForMime("inode/directory")
-	byID := make(map[string]*Entry, len(handlers))
-	for _, h := range handlers {
-		byID[h.ID] = h
-	}
-
-	dolphin := byID["org.kde.dolphin.desktop"]
-	if dolphin == nil {
-		t.Fatal("org.kde.dolphin.desktop missing from handlers")
-	}
-	if dolphin.Name != "Dolphin" {
-		t.Errorf("Name = %q", dolphin.Name)
-	}
-	if dolphin.Icon != "system-file-manager" {
-		t.Errorf("Icon = %q", dolphin.Icon)
-	}
-
-	excluded := []string{"ghost-term.desktop", "hidden-fm.desktop", "stale.desktop"}
-	for _, id := range excluded {
-		if byID[id] != nil {
-			t.Errorf("%s should be excluded from handlers", id)
-		}
-	}
-}

core/internal/distros/arch.go

@@ -118,6 +118,7 @@ func (a *ArchDistribution) DetectDependenciesWithTerminal(ctx context.Context, w
 	}
 
 	dependencies = append(dependencies, a.detectMatugen())
+	dependencies = append(dependencies, a.detectDgop())
 	dependencies = append(dependencies, a.detectDanksearch())
 	dependencies = append(dependencies, a.detectDankCalendar())
 
@@ -218,6 +219,7 @@ func (a *ArchDistribution) GetPackageMappingWithVariants(wm deps.WindowManager,
 		"quickshell":              a.getQuickshellMapping(variants["quickshell"]),
 		"dms-greeter":             a.getDMSGreeterMapping(variants["dms-greeter"]),
 		"matugen":                 a.getMatugenMapping(variants["matugen"]),
+		"dgop":                    {Name: "dgop", Repository: RepoTypeSystem},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeSystem},
 		"kitty":                   {Name: "kitty", Repository: RepoTypeSystem},
 		"alacritty":               {Name: "alacritty", Repository: RepoTypeSystem},
@@ -657,7 +659,7 @@ func (a *ArchDistribution) installAURPackages(ctx context.Context, packages []st
 }
 
 func (a *ArchDistribution) reorderAURPackages(packages []string) []string {
-	dmsDepencies := []string{"quickshell", "quickshell-git"}
+	dmsDepencies := []string{"quickshell", "quickshell-git", "dgop"}
 
 	var deps []string
 	var others []string

core/internal/distros/base.go

@@ -103,6 +103,10 @@ func (b *BaseDistribution) detectMatugen() deps.Dependency {
 	return b.detectCommand("matugen", "Material Design color generation tool")
 }
 
+func (b *BaseDistribution) detectDgop() deps.Dependency {
+	return b.detectCommand("dgop", "Desktop portal management tool")
+}
+
 func (b *BaseDistribution) detectDanksearch() deps.Dependency {
 	return b.detectOptionalPackage("danksearch", "File indexing and search service", b.commandExists("dsearch") || b.commandExists("danksearch"))
 }

core/internal/distros/debian.go

@@ -70,6 +70,7 @@ func (d *DebianDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 	}
 
 	dependencies = append(dependencies, d.detectMatugen())
+	dependencies = append(dependencies, d.detectDgop())
 	dependencies = append(dependencies, d.detectDanksearch())
 	dependencies = append(dependencies, d.detectDankCalendar())
 
@@ -134,6 +135,7 @@ func (d *DebianDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		"quickshell":              d.getQuickshellMapping(variants["quickshell"]),
 		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
+		"dgop":                    {Name: "dgop", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"danksearch":              {Name: "danksearch", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"dankcalendar":            {Name: "dankcalendar-git", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
@@ -472,8 +474,13 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 		return fmt.Errorf("failed to get OS info: %w", err)
 	}
 
-	obsRepo := debianOBSRepoVersion(osInfo, readDebianAPTSuites())
-	d.log(fmt.Sprintf("Using OBS Debian repository: %s", obsRepo))
+	// Determine Debian version for OBS repository URL
+	debianVersion := "Debian_13"
+	if osInfo.VersionID == "testing" {
+		debianVersion = "Debian_Testing"
+	} else if osInfo.VersionCodename == "sid" || osInfo.VersionID == "sid" || strings.Contains(strings.ToLower(osInfo.PrettyName), "sid") || strings.Contains(strings.ToLower(osInfo.PrettyName), "unstable") {
+		debianVersion = "Debian_Unstable"
+	}
 
 	for _, pkg := range obsPkgs {
 		if pkg.RepoURL != "" && !enabledRepos[pkg.RepoURL] {
@@ -482,11 +489,12 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 			// RepoURL format: "home:AvengeMedia:danklinux"
 			repoPath := strings.ReplaceAll(pkg.RepoURL, ":", ":/")
 			repoName := strings.ReplaceAll(pkg.RepoURL, ":", "-")
-			baseURL := fmt.Sprintf("https://download.opensuse.org/repositories/%s/%s", repoPath, obsRepo)
+			baseURL := fmt.Sprintf("https://download.opensuse.org/repositories/%s/%s", repoPath, debianVersion)
 
 			// Check if repository already exists
 			listFile := fmt.Sprintf("/etc/apt/sources.list.d/%s.list", repoName)
-			if debianOBSListFileMatches(listFile, obsRepo) {
+			checkCmd := exec.CommandContext(ctx, "test", "-f", listFile)
+			if checkCmd.Run() == nil {
 				d.log(fmt.Sprintf("OBS repo %s already exists, skipping", pkg.RepoURL))
 				enabledRepos[pkg.RepoURL] = true
 				continue
@@ -660,6 +668,10 @@ func (d *DebianDistribution) installBuildDependencies(ctx context.Context, manua
 			if err := d.installRust(ctx, sudoPassword, progressChan); err != nil {
 				return fmt.Errorf("failed to install Rust: %w", err)
 			}
+		case "dgop":
+			if err := d.installGo(ctx, sudoPassword, progressChan); err != nil {
+				return fmt.Errorf("failed to install Go: %w", err)
+			}
 		}
 	}
 
@@ -718,6 +730,24 @@ func (d *DebianDistribution) installRust(ctx context.Context, sudoPassword strin
 	return nil
 }
 
+func (d *DebianDistribution) installGo(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+	if d.commandExists("go") {
+		return nil
+	}
+
+	progressChan <- InstallProgressMsg{
+		Phase:       PhaseSystemPackages,
+		Progress:    0.87,
+		Step:        "Installing Go...",
+		IsComplete:  false,
+		NeedsSudo:   true,
+		CommandInfo: "sudo apt-get install golang-go",
+	}
+
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y golang-go")
+	return d.runWithProgress(installCmd, progressChan, PhaseSystemPackages, 0.87, 0.90)
+}
+
 func (d *DebianDistribution) InstallManualPackages(ctx context.Context, packages []string, variantMap map[string]deps.PackageVariant, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	if len(packages) == 0 {
 		return nil

core/internal/distros/debian_obs.go

@@ -1,172 +0,0 @@
-package distros
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-const (
-	obsRepoDebian13       = "Debian_13"
-	obsRepoDebianTesting  = "Debian_Testing"
-	obsRepoDebianUnstable = "Debian_Unstable"
-)
-
-func debianOBSRepoVersion(info *OSInfo, aptSuites []string) string {
-	hasSuite := make(map[string]bool, len(aptSuites))
-	for _, suite := range aptSuites {
-		hasSuite[normalizeDebianSuite(suite)] = true
-	}
-
-	// APT suites distinguish testing from sid. os-release cannot: both currently
-	// report VERSION_CODENAME=forky and PRETTY_NAME="Debian GNU/Linux forky/sid"
-	if hasSuite["sid"] || hasSuite["unstable"] {
-		return obsRepoDebianUnstable
-	}
-	if hasSuite["testing"] || hasSuite["forky"] {
-		return obsRepoDebianTesting
-	}
-	if hasSuite["trixie"] || hasSuite["stable"] {
-		return obsRepoDebian13
-	}
-
-	if info == nil {
-		return obsRepoDebian13
-	}
-
-	id := strings.ToLower(strings.TrimSpace(info.VersionID))
-	code := strings.ToLower(strings.TrimSpace(info.VersionCodename))
-
-	if code == "sid" || id == "sid" {
-		return obsRepoDebianUnstable
-	}
-	if id == "13" || code == "trixie" {
-		return obsRepoDebian13
-	}
-	if id != "" && id != "testing" {
-		return obsRepoDebian13
-	}
-	// Prefer Testing when os-release is the shared forky/sid string. Unstable
-	// OBS packages can require a newer glibc than Testing ships.
-	return obsRepoDebianTesting
-}
-
-func debianOBSListFileMatches(path, debianVersion string) bool {
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return false
-	}
-	return debianOBSListPointsAt(string(data), debianVersion)
-}
-
-func debianOBSListPointsAt(contents, debianVersion string) bool {
-	return strings.Contains(contents, "/"+debianVersion+"/")
-}
-
-func readDebianAPTSuites() []string {
-	var chunks []string
-	if data, err := os.ReadFile("/etc/apt/sources.list"); err == nil {
-		chunks = append(chunks, string(data))
-	}
-	matches, _ := filepath.Glob("/etc/apt/sources.list.d/*")
-	for _, path := range matches {
-		if !strings.HasSuffix(path, ".list") && !strings.HasSuffix(path, ".sources") {
-			continue
-		}
-		data, err := os.ReadFile(path)
-		if err != nil {
-			continue
-		}
-		chunks = append(chunks, string(data))
-	}
-	return debianAPTSuites(strings.Join(chunks, "\n"))
-}
-
-func debianAPTSuites(sources string) []string {
-	seen := make(map[string]bool)
-	var suites []string
-	add := func(raw string) {
-		suite := normalizeDebianSuite(raw)
-		if suite == "" || seen[suite] {
-			return
-		}
-		seen[suite] = true
-		suites = append(suites, suite)
-	}
-
-	var stanza []string
-	flushStanza := func() {
-		if len(stanza) == 0 {
-			return
-		}
-		enabled := true
-		var stanzaSuites []string
-		for _, line := range stanza {
-			key, val, ok := strings.Cut(line, ":")
-			if !ok {
-				continue
-			}
-			switch strings.ToLower(strings.TrimSpace(key)) {
-			case "enabled":
-				switch strings.ToLower(strings.TrimSpace(val)) {
-				case "no", "false", "0":
-					enabled = false
-				}
-			case "suites":
-				stanzaSuites = strings.Fields(val)
-			}
-		}
-		if enabled {
-			for _, suite := range stanzaSuites {
-				add(suite)
-			}
-		}
-		stanza = nil
-	}
-
-	for _, raw := range strings.Split(sources, "\n") {
-		line := strings.TrimSpace(raw)
-		if line == "" {
-			flushStanza()
-			continue
-		}
-		if strings.HasPrefix(line, "#") {
-			continue
-		}
-		lower := strings.ToLower(line)
-		if strings.HasPrefix(lower, "deb ") || strings.HasPrefix(lower, "deb-src ") {
-			flushStanza()
-			if suite := suiteFromDebLine(line); suite != "" {
-				add(suite)
-			}
-			continue
-		}
-		stanza = append(stanza, line)
-	}
-	flushStanza()
-	return suites
-}
-
-func suiteFromDebLine(line string) string {
-	if i := strings.Index(line, "["); i != -1 {
-		if j := strings.Index(line, "]"); j > i {
-			line = strings.TrimSpace(line[:i] + " " + line[j+1:])
-		}
-	}
-	fields := strings.Fields(line)
-	if len(fields) < 3 {
-		return ""
-	}
-	return fields[2]
-}
-
-func normalizeDebianSuite(suite string) string {
-	suite = strings.ToLower(strings.TrimSpace(suite))
-	suite = strings.Trim(suite, "/")
-	for _, suffix := range []string{"-security", "-updates", "-backports", "-proposed-updates"} {
-		if strings.HasSuffix(suite, suffix) {
-			return strings.TrimSuffix(suite, suffix)
-		}
-	}
-	return suite
-}

core/internal/distros/fedora.go

@@ -103,6 +103,7 @@ func (f *FedoraDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 	}
 
 	dependencies = append(dependencies, f.detectMatugen())
+	dependencies = append(dependencies, f.detectDgop())
 	dependencies = append(dependencies, f.detectDanksearch())
 	dependencies = append(dependencies, f.detectDankCalendar())
 
@@ -138,6 +139,7 @@ func (f *FedoraDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 		"dms (DankMaterialShell)": f.getDmsMapping(variants["dms (DankMaterialShell)"]),
+		"dgop":                    {Name: "dgop", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 		"danksearch":              {Name: "danksearch", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 		"dankcalendar":            {Name: "dankcalendar-git", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 	}

core/internal/distros/gentoo.go

@@ -53,11 +53,6 @@ func NewGentooDistribution(config DistroConfig, logChan chan<- string) *GentooDi
 	}
 }
 
-func emergeInstallArgs(packages []string) []string {
-	args := []string{"emerge", "--ask=n", "--quiet", "--autounmask-continue=y", "--autounmask-keep-keywords=y", "--autounmask-keep-masks=y"}
-	return append(args, packages...)
-}
-
 func (g *GentooDistribution) getArchKeyword() string {
 	arch := runtime.GOARCH
 	switch arch {
@@ -117,6 +112,7 @@ func (g *GentooDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 	}
 
 	dependencies = append(dependencies, g.detectMatugen())
+	dependencies = append(dependencies, g.detectDgop())
 	dependencies = append(dependencies, g.detectDanksearch())
 
 	return dependencies, nil
@@ -175,6 +171,7 @@ func (g *GentooDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		"quickshell":              g.getQuickshellMapping(variants["quickshell"]),
 		"matugen":                 {Name: "x11-misc/matugen", Repository: RepoTypeGURU, AcceptKeywords: archKeyword},
 		"dms (DankMaterialShell)": g.getDmsMapping(),
+		"dgop":                    {Name: "gui-apps/dgop", Repository: RepoTypeGURU, AcceptKeywords: archKeyword},
 		"danksearch":              {Name: "gui-apps/danksearch", Repository: RepoTypeGURU, AcceptKeywords: archKeyword},
 	}
 
@@ -322,7 +319,6 @@ func (g *GentooDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 	}
 	g.log("Portage tree synced successfully")
 
-	args := emergeInstallArgs(missingPkgs)
 	g.log(fmt.Sprintf("Installing prerequisites: %s", strings.Join(missingPkgs, ", ")))
 	progressChan <- InstallProgressMsg{
 		Phase:       PhasePrerequisites,
@@ -330,10 +326,12 @@ func (g *GentooDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		Step:        fmt.Sprintf("Installing %d prerequisites...", len(missingPkgs)),
 		IsComplete:  false,
 		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		CommandInfo: fmt.Sprintf("sudo emerge --ask=n %s", strings.Join(missingPkgs, " ")),
 		LogOutput:   fmt.Sprintf("Installing prerequisites: %s", strings.Join(missingPkgs, ", ")),
 	}
 
+	args := []string{"emerge", "--ask=n", "--quiet"}
+	args = append(args, missingPkgs...)
 	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	output, err := cmd.CombinedOutput()
 	if err != nil {
@@ -523,7 +521,8 @@ func (g *GentooDistribution) installPortagePackages(ctx context.Context, package
 		}
 	}
 
-	args := emergeInstallArgs(packageNames)
+	args := []string{"emerge", "--ask=n", "--quiet"}
+	args = append(args, packageNames...)
 
 	progressChan <- InstallProgressMsg{
 		Phase:       PhaseSystemPackages,
@@ -714,7 +713,8 @@ func (g *GentooDistribution) installGURUPackages(ctx context.Context, packages [
 		guruPackages[i] = pkg + "::guru"
 	}
 
-	args := emergeInstallArgs(guruPackages)
+	args := []string{"emerge", "--ask=n", "--quiet"}
+	args = append(args, guruPackages...)
 
 	progressChan <- InstallProgressMsg{
 		Phase:       PhaseAURPackages,

core/internal/distros/manual_packages.go

@@ -59,6 +59,10 @@ func (m *ManualPackageInstaller) InstallManualPackages(ctx context.Context, pack
 			if err := m.installDankMaterialShell(ctx, variant, sudoPassword, progressChan); err != nil {
 				return fmt.Errorf("failed to install DankMaterialShell: %w", err)
 			}
+		case "dgop":
+			if err := m.installDgop(ctx, sudoPassword, progressChan); err != nil {
+				return fmt.Errorf("failed to install dgop: %w", err)
+			}
 		case "niri":
 			if err := m.installNiri(ctx, sudoPassword, progressChan); err != nil {
 				return fmt.Errorf("failed to install niri: %w", err)
@@ -91,6 +95,66 @@ func (m *ManualPackageInstaller) InstallManualPackages(ctx context.Context, pack
 	return nil
 }
 
+func (m *ManualPackageInstaller) installDgop(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+	m.log("Installing dgop from source...")
+
+	homeDir := os.Getenv("HOME")
+	if homeDir == "" {
+		return fmt.Errorf("HOME environment variable not set")
+	}
+
+	cacheDir := filepath.Join(homeDir, ".cache", "dankinstall")
+	if err := os.MkdirAll(cacheDir, 0o755); err != nil {
+		return fmt.Errorf("failed to create cache directory: %w", err)
+	}
+
+	tmpDir := filepath.Join(cacheDir, "dgop-build")
+	if err := os.MkdirAll(tmpDir, 0o755); err != nil {
+		return fmt.Errorf("failed to create temp directory: %w", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	progressChan <- InstallProgressMsg{
+		Phase:       PhaseSystemPackages,
+		Progress:    0.1,
+		Step:        "Cloning dgop repository...",
+		IsComplete:  false,
+		CommandInfo: "git clone https://github.com/AvengeMedia/dgop.git",
+	}
+
+	cloneCmd := exec.CommandContext(ctx, "git", "clone", "https://github.com/AvengeMedia/dgop.git", tmpDir)
+	if err := cloneCmd.Run(); err != nil {
+		m.logError("failed to clone dgop repository", err)
+		return fmt.Errorf("failed to clone dgop repository: %w", err)
+	}
+
+	buildCmd := exec.CommandContext(ctx, "make")
+	buildCmd.Dir = tmpDir
+	buildCmd.Env = append(os.Environ(), "TMPDIR="+cacheDir)
+	if err := m.runWithProgressStep(buildCmd, progressChan, PhaseSystemPackages, 0.4, 0.7, "Building dgop..."); err != nil {
+		return fmt.Errorf("failed to build dgop: %w", err)
+	}
+
+	progressChan <- InstallProgressMsg{
+		Phase:       PhaseSystemPackages,
+		Progress:    0.7,
+		Step:        "Installing dgop...",
+		IsComplete:  false,
+		NeedsSudo:   true,
+		CommandInfo: "sudo make install",
+	}
+
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "make install")
+	installCmd.Dir = tmpDir
+	if err := installCmd.Run(); err != nil {
+		m.logError("failed to install dgop", err)
+		return fmt.Errorf("failed to install dgop: %w", err)
+	}
+
+	m.log("dgop installed successfully from source")
+	return nil
+}
+
 func (m *ManualPackageInstaller) installNiri(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	m.log("Installing niri from source...")
 

core/internal/distros/opensuse.go

@@ -90,6 +90,7 @@ func (o *OpenSUSEDistribution) DetectDependenciesWithTerminal(ctx context.Contex
 	}
 
 	dependencies = append(dependencies, o.detectMatugen())
+	dependencies = append(dependencies, o.detectDgop())
 	dependencies = append(dependencies, o.detectDanksearch())
 	dependencies = append(dependencies, o.detectDankCalendar())
 
@@ -129,6 +130,7 @@ func (o *OpenSUSEDistribution) GetPackageMappingWithVariants(wm deps.WindowManag
 		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
+		"dgop":                    {Name: "dgop", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"danksearch":              {Name: "danksearch", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"dankcalendar":            {Name: "dankcalendar-git", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 	}

core/internal/distros/osinfo.go

@@ -104,7 +104,7 @@ func IsUnsupportedDistro(distroID, versionID string) bool {
 
 	if distroID == "debian" {
 		// unstable/sid support
-		if versionID == "sid" || versionID == "testing" {
+		if versionID == "sid" {
 			return false
 		}
 		if versionID == "" {

core/internal/distros/ubuntu.go

@@ -79,6 +79,7 @@ func (u *UbuntuDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 	}
 
 	dependencies = append(dependencies, u.detectMatugen())
+	dependencies = append(dependencies, u.detectDgop())
 	dependencies = append(dependencies, u.detectDanksearch())
 	dependencies = append(dependencies, u.detectDankCalendar())
 
@@ -123,6 +124,7 @@ func (u *UbuntuDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		"quickshell":              u.getQuickshellMapping(variants["quickshell"]),
 		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
+		"dgop":                    {Name: "dgop", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"danksearch":              {Name: "danksearch", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"dankcalendar":            {Name: "dankcalendar-git", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
@@ -575,6 +577,10 @@ func (u *UbuntuDistribution) installBuildDependencies(ctx context.Context, manua
 			if err := u.installRust(ctx, sudoPassword, progressChan); err != nil {
 				return fmt.Errorf("failed to install Rust: %w", err)
 			}
+		case "dgop":
+			if err := u.installGo(ctx, sudoPassword, progressChan); err != nil {
+				return fmt.Errorf("failed to install Go: %w", err)
+			}
 		}
 	}
 
@@ -634,6 +640,53 @@ func (u *UbuntuDistribution) installRust(ctx context.Context, sudoPassword strin
 	return nil
 }
 
+func (u *UbuntuDistribution) installGo(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+	if u.commandExists("go") {
+		return nil
+	}
+
+	progressChan <- InstallProgressMsg{
+		Phase:       PhaseSystemPackages,
+		Progress:    0.87,
+		Step:        "Adding Go PPA repository...",
+		IsComplete:  false,
+		NeedsSudo:   true,
+		CommandInfo: "sudo add-apt-repository ppa:longsleep/golang-backports",
+	}
+
+	addPPACmd := privesc.ExecCommand(ctx, sudoPassword,
+		"add-apt-repository -y ppa:longsleep/golang-backports")
+	if err := u.runWithProgress(addPPACmd, progressChan, PhaseSystemPackages, 0.87, 0.88); err != nil {
+		return fmt.Errorf("failed to add Go PPA: %w", err)
+	}
+
+	progressChan <- InstallProgressMsg{
+		Phase:       PhaseSystemPackages,
+		Progress:    0.88,
+		Step:        "Updating package lists...",
+		IsComplete:  false,
+		NeedsSudo:   true,
+		CommandInfo: "sudo apt-get update",
+	}
+
+	updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
+	if err := u.runWithProgress(updateCmd, progressChan, PhaseSystemPackages, 0.88, 0.89); err != nil {
+		return fmt.Errorf("failed to update package lists after adding Go PPA: %w", err)
+	}
+
+	progressChan <- InstallProgressMsg{
+		Phase:       PhaseSystemPackages,
+		Progress:    0.89,
+		Step:        "Installing Go...",
+		IsComplete:  false,
+		NeedsSudo:   true,
+		CommandInfo: "sudo apt-get install golang-go",
+	}
+
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get install -y golang-go")
+	return u.runWithProgress(installCmd, progressChan, PhaseSystemPackages, 0.89, 0.90)
+}
+
 func (u *UbuntuDistribution) InstallManualPackages(ctx context.Context, packages []string, variantMap map[string]deps.PackageVariant, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	if len(packages) == 0 {
 		return nil

core/internal/distros/void.go

@@ -83,6 +83,7 @@ func (v *VoidDistribution) DetectDependenciesWithTerminal(ctx context.Context, w
 	}
 
 	dependencies = append(dependencies, v.detectMatugen())
+	dependencies = append(dependencies, v.detectDgop())
 	dependencies = append(dependencies, v.detectDanksearch())
 	dependencies = append(dependencies, v.detectDankCalendar())
 
@@ -182,6 +183,7 @@ func (v *VoidDistribution) GetPackageMappingWithVariants(wm deps.WindowManager,
 		"matugen":                 {Name: "matugen", Repository: RepoTypeSystem},
 		"dms (DankMaterialShell)": v.getDmsMapping(variants["dms (DankMaterialShell)"]),
 		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeXBPS, RepoURL: VoidDMSRepo},
+		"dgop":                    {Name: "dgop", Repository: RepoTypeXBPS, RepoURL: VoidDankLinuxRepo},
 		"danksearch":              {Name: "danksearch", Repository: RepoTypeXBPS, RepoURL: VoidDankLinuxRepo},
 		"dankcalendar":            {Name: "dankcalendar", Repository: RepoTypeXBPS, RepoURL: VoidDankLinuxRepo},
 	}

core/internal/errdefs/errdefs.go

@@ -1,15 +1,9 @@
 package errdefs
 
-import (
-	dankerrdefs "github.com/AvengeMedia/dankgo/errdefs"
-)
-
-type ErrorType = dankerrdefs.ErrorType
-
-type CustomError = dankerrdefs.CustomError
+type ErrorType int
 
 const (
-	ErrTypeNotLinux ErrorType = dankerrdefs.AppErrorBase + iota
+	ErrTypeNotLinux ErrorType = iota
 	ErrTypeInvalidArchitecture
 	ErrTypeUnsupportedDistribution
 	ErrTypeUnsupportedVersion
@@ -28,8 +22,20 @@ const (
 	ErrTypeGeneric
 )
 
+type CustomError struct {
+	Type    ErrorType
+	Message string
+}
+
+func (e *CustomError) Error() string {
+	return e.Message
+}
+
 func NewCustomError(errType ErrorType, message string) error {
-	return dankerrdefs.NewCustomError(errType, message)
+	return &CustomError{
+		Type:    errType,
+		Message: message,
+	}
 }
 
 const (
@@ -41,10 +47,6 @@ const (
 	ErrWifiDisabled     = "wifi-disabled"
 	ErrAlreadyConnected = "already-connected"
 	ErrConnectionFailed = "connection-failed"
-
-	ErrHotspotIPConfigFailed   = "hotspot-ip-config-failed"
-	ErrHotspotSupplicantFailed = "hotspot-supplicant-failed"
-	ErrHotspotFailed           = "hotspot-failed"
 )
 
 var (

core/internal/geolocation/client.go

@@ -6,7 +6,37 @@ func NewClient() Client {
 	geoclueClient, err := newGeoClueClient()
 	if err != nil {
 		log.Warnf("GeoClue2 unavailable: %v", err)
-		return newIpClient()
+		return newSeededIpClient()
 	}
+
+	loc, _ := geoclueClient.GetLocation()
+	if loc.Latitude != 0 || loc.Longitude != 0 {
+		log.Info("Using GeoClue2 location")
+		return geoclueClient
+	}
+
+	log.Info("GeoClue2 has no fix yet, seeding with IP location")
+	ipLoc, err := fetchIPLocation()
+	if err != nil {
+		log.Warnf("IP location seed failed: %v", err)
+		return geoclueClient
+	}
+
+	log.Info("Seeded GeoClue2 with IP location")
+	geoclueClient.SeedLocation(Location{Latitude: ipLoc.Latitude, Longitude: ipLoc.Longitude})
 	return geoclueClient
 }
+
+func newSeededIpClient() *IpClient {
+	client := newIpClient()
+	ipLoc, err := fetchIPLocation()
+	if err != nil {
+		log.Warnf("IP location also failed: %v", err)
+		return client
+	}
+
+	log.Info("Using IP location")
+	client.currLocation.Latitude = ipLoc.Latitude
+	client.currLocation.Longitude = ipLoc.Longitude
+	return client
+}

core/internal/geolocation/client_geoclue.go

@@ -5,8 +5,8 @@ import (
 	"sync"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
-	"github.com/AvengeMedia/dankgo/dbusutil"
-	"github.com/AvengeMedia/dankgo/syncmap"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/dbusutil"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/syncmap"
 	"github.com/godbus/dbus/v5"
 )
 
@@ -34,7 +34,6 @@ const (
 type GeoClueClient struct {
 	currLocation  *Location
 	locationMutex sync.RWMutex
-	seedOnce      sync.Once
 
 	dbusConn   *dbus.Conn
 	clientPath dbus.ObjectPath
@@ -231,29 +230,14 @@ func (c *GeoClueClient) SeedLocation(loc Location) {
 }
 
 func (c *GeoClueClient) GetLocation() (Location, error) {
-	loc := c.currentLocation()
-	if loc.Latitude != 0 || loc.Longitude != 0 {
-		return loc, nil
-	}
-
-	c.seedOnce.Do(func() {
-		ipLoc, err := fetchIPLocation()
-		if err != nil {
-			log.Warnf("GeoClue2 has no fix, IP location seed failed: %v", err)
-			return
-		}
-		log.Info("Seeded GeoClue2 with IP location")
-		c.SeedLocation(Location{Latitude: ipLoc.Latitude, Longitude: ipLoc.Longitude})
-	})
-
-	return c.currentLocation(), nil
-}
-
-func (c *GeoClueClient) currentLocation() Location {
 	c.locationMutex.RLock()
 	defer c.locationMutex.RUnlock()
 	if c.currLocation == nil {
-		return Location{}
+		return Location{
+			Latitude:  0.0,
+			Longitude: 0.0,
+		}, nil
 	}
-	return *c.currLocation
+	stateCopy := *c.currLocation
+	return stateCopy, nil
 }

core/internal/greeter/assets/apparmor/usr.bin.dms-greeter

@@ -0,0 +1,91 @@
+# AppArmor profile for dms-greeter
+#
+# Managed by DMS — regenerated on every `dms greeter install` / `dms greeter sync`.
+# Manual edits will be overwritten on next sync.
+#
+# Mode: complain  (denials are logged, nothing is blocked)
+# To switch to enforce after validating with `aa-logprof`:
+#   sudo aa-enforce /etc/apparmor.d/usr.bin.dms-greeter
+#
+#include <tunables/global>
+
+profile dms-greeter /usr/bin/dms-greeter flags=(complain) {
+  #include <abstractions/base>
+  #include <abstractions/bash>
+
+  # The launcher script itself
+  /usr/bin/dms-greeter r,
+
+  # Cache directory — created by dms greeter sync/enable with greeter:greeter ownership
+  /var/cache/dms-greeter/     rw,
+  /var/cache/dms-greeter/**   rwlk,
+
+  # DMS config — packaged path
+  /usr/share/quickshell/dms-greeter/    r,
+  /usr/share/quickshell/dms-greeter/**  r,
+  /usr/share/quickshell/               r,
+  /usr/share/quickshell/**             r,
+
+  # DMS config — system and user overrides
+  /etc/dms/    r,
+  /etc/dms/**  r,
+  /usr/share/dms/    r,
+  /usr/share/dms/**  r,
+  /home/*/.config/quickshell/    r,
+  /home/*/.config/quickshell/**  r,
+  /root/.config/quickshell/     r,
+  /root/.config/quickshell/**   r,
+
+  # greetd / PAM — read-only for session setup
+  /etc/greetd/    r,
+  /etc/greetd/**  r,
+  /etc/pam.d/     r,
+  /etc/pam.d/**   r,
+  /usr/lib/pam.d/ r,
+  /usr/lib/pam.d/** r,
+
+  # Compositor binaries — run unconfined so each compositor uses its own profile
+  /usr/bin/niri        Ux,
+  /usr/bin/hyprland    Ux,
+  /usr/bin/Hyprland    Ux,
+  /usr/bin/sway        Ux,
+  /usr/bin/labwc       Ux,
+  /usr/bin/scroll      Ux,
+  /usr/bin/miracle-wm  Ux,
+  /usr/bin/mango       Ux,
+
+  # Quickshell — run unconfined (has its own compositor profile on some distros)
+  /usr/bin/qs          Ux,
+  /usr/bin/quickshell  Ux,
+
+  # Wayland / XDG runtime (pipewire, wireplumber, wayland socket)
+  /run/user/[0-9]*/               rw,
+  /run/user/[0-9]*/**             rw,
+
+  # DRM / GPU devices (required for Wayland compositor startup)
+  /dev/dri/      r,
+  /dev/dri/*     rw,
+  /dev/udmabuf   rw,
+
+  # Input devices
+  /dev/input/    r,
+  /dev/input/*   r,
+
+  # Systemd journal / logging
+  /run/systemd/journal/socket  rw,
+  /dev/log                     rw,
+
+  # Shell helper binaries invoked by the launcher script
+  /usr/bin/env      ix,
+  /usr/bin/mkdir    ix,
+  /usr/bin/cat      ix,
+  /usr/bin/grep     ix,
+  /usr/bin/dirname  ix,
+  /usr/bin/basename ix,
+  /usr/bin/command  ix,
+  /bin/env          ix,
+  /bin/mkdir        ix,
+
+  # Signal management (compositor lifecycle)
+  signal (send, receive) set=("term", "int", "hup", "kill"),
+}

core/internal/greeter/installer_test.go

@@ -0,0 +1,350 @@
+package greeter
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func writeTestFile(t *testing.T, path string, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("failed to create parent dir for %s: %v", path, err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("failed to write %s: %v", path, err)
+	}
+}
+
+func TestResolveGreeterThemeSyncState(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		settingsJSON            string
+		sessionJSON             string
+		wantSourcePath          string
+		wantResolvedWallpaper   string
+		wantDynamicOverrideUsed bool
+	}{
+		{
+			name: "dynamic theme with greeter wallpaper override uses generated greeter colors",
+			settingsJSON: `{
+  "currentThemeName": "dynamic",
+  "greeterWallpaperPath": "Pictures/blue.jpg",
+  "matugenScheme": "scheme-tonal-spot",
+  "iconTheme": "Papirus"
+}`,
+			sessionJSON:             `{"isLightMode":true}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "greeter-colors", "dms-colors.json"),
+			wantResolvedWallpaper:   filepath.Join("Pictures", "blue.jpg"),
+			wantDynamicOverrideUsed: true,
+		},
+		{
+			name: "dynamic theme without override uses desktop colors",
+			settingsJSON: `{
+  "currentThemeName": "dynamic",
+  "greeterWallpaperPath": ""
+}`,
+			sessionJSON:             `{"isLightMode":false}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "dms-colors.json"),
+			wantResolvedWallpaper:   "",
+			wantDynamicOverrideUsed: false,
+		},
+		{
+			name: "non-dynamic theme keeps desktop colors even with override wallpaper",
+			settingsJSON: `{
+  "currentThemeName": "purple",
+  "greeterWallpaperPath": "/tmp/blue.jpg"
+}`,
+			sessionJSON:             `{"isLightMode":false}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "dms-colors.json"),
+			wantResolvedWallpaper:   "/tmp/blue.jpg",
+			wantDynamicOverrideUsed: false,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			homeDir := t.TempDir()
+			writeTestFile(t, filepath.Join(homeDir, ".config", "DankMaterialShell", "settings.json"), tt.settingsJSON)
+			writeTestFile(t, filepath.Join(homeDir, ".local", "state", "DankMaterialShell", "session.json"), tt.sessionJSON)
+
+			state, err := resolveGreeterThemeSyncState(homeDir)
+			if err != nil {
+				t.Fatalf("resolveGreeterThemeSyncState returned error: %v", err)
+			}
+
+			if got := state.effectiveColorsSource(homeDir); got != filepath.Join(homeDir, tt.wantSourcePath) {
+				t.Fatalf("effectiveColorsSource = %q, want %q", got, filepath.Join(homeDir, tt.wantSourcePath))
+			}
+
+			wantResolvedWallpaper := tt.wantResolvedWallpaper
+			if wantResolvedWallpaper != "" && !filepath.IsAbs(wantResolvedWallpaper) {
+				wantResolvedWallpaper = filepath.Join(homeDir, wantResolvedWallpaper)
+			}
+			if state.ResolvedGreeterWallpaperPath != wantResolvedWallpaper {
+				t.Fatalf("ResolvedGreeterWallpaperPath = %q, want %q", state.ResolvedGreeterWallpaperPath, wantResolvedWallpaper)
+			}
+
+			if state.UsesDynamicWallpaperOverride != tt.wantDynamicOverrideUsed {
+				t.Fatalf("UsesDynamicWallpaperOverride = %v, want %v", state.UsesDynamicWallpaperOverride, tt.wantDynamicOverrideUsed)
+			}
+		})
+	}
+}
+
+func TestUpsertInitialSession(t *testing.T) {
+	t.Parallel()
+
+	baseConfig := `[terminal]
+vt = 1
+
+[default_session]
+user = "greeter"
+command = "/usr/bin/dms-greeter --command niri"
+`
+
+	t.Run("inserts initial session", func(t *testing.T) {
+		t.Parallel()
+		got := upsertInitialSession(baseConfig, "alice", "/var/cache/dms-greeter", true)
+		if !strings.Contains(got, "[initial_session]") {
+			t.Fatalf("expected [initial_session] section, got:\n%s", got)
+		}
+		if !strings.Contains(got, `user = "alice"`) {
+			t.Fatalf("expected alice user in initial session, got:\n%s", got)
+		}
+		if !strings.Contains(got, `dms greeter launch-session --from-memory --cache-dir`) {
+			t.Fatalf("expected stable launch-session command, got:\n%s", got)
+		}
+		if strings.Contains(got, `exec niri`) {
+			t.Fatalf("initial session must not bake the desktop Exec command, got:\n%s", got)
+		}
+	})
+
+	t.Run("updates existing initial session", func(t *testing.T) {
+		t.Parallel()
+		existing := baseConfig + `
+[initial_session]
+user = "bob"
+command = "old-command"
+`
+		got := upsertInitialSession(existing, "alice", "/var/cache/dms-greeter", true)
+		if strings.Contains(got, `user = "bob"`) {
+			t.Fatalf("expected bob to be replaced, got:\n%s", got)
+		}
+		if !strings.Contains(got, `dms greeter launch-session --from-memory`) {
+			t.Fatalf("expected launch-session command, got:\n%s", got)
+		}
+	})
+
+	t.Run("removes initial session when disabled", func(t *testing.T) {
+		t.Parallel()
+		existing := baseConfig + `
+[initial_session]
+user = "alice"
+command = "niri"
+`
+		got := upsertInitialSession(existing, "", "", false)
+		if strings.Contains(got, "[initial_session]") {
+			t.Fatalf("expected initial session removed, got:\n%s", got)
+		}
+		if !strings.Contains(got, "[default_session]") {
+			t.Fatalf("expected default session preserved, got:\n%s", got)
+		}
+	})
+}
+
+func TestStripDesktopExecCodes(t *testing.T) {
+	t.Parallel()
+
+	got := stripDesktopExecCodes("niri --session %f")
+	want := "niri --session"
+	if got != want {
+		t.Fatalf("stripDesktopExecCodes = %q, want %q", got, want)
+	}
+}
+
+func TestBuildGreetdCommand(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name          string
+		wrapper       string
+		compositor    string
+		dmsPath       string
+		useVoidLogind bool
+		want          string
+	}{
+		{
+			name:       "standard command",
+			wrapper:    "/usr/bin/dms-greeter",
+			compositor: "Niri",
+			want:       "/usr/bin/dms-greeter --command niri --cache-dir /var/cache/dms-greeter",
+		},
+		{
+			name:          "void selects elogind and keeps custom DMS path",
+			wrapper:       "/usr/bin/dms-greeter",
+			compositor:    "Niri",
+			dmsPath:       "/usr/share/quickshell/dms-greeter",
+			useVoidLogind: true,
+			want:          "env LIBSEAT_BACKEND=logind DMS_VOID=1 /usr/bin/dms-greeter --command niri --cache-dir /var/cache/dms-greeter -p /usr/share/quickshell/dms-greeter",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := buildGreetdCommand(tt.wrapper, tt.compositor, tt.dmsPath, tt.useVoidLogind); got != tt.want {
+				t.Fatalf("buildGreetdCommand() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestVoidLogindGreeterCommand(t *testing.T) {
+	t.Parallel()
+
+	const oldCommand = "/usr/bin/dms-greeter --command niri -C /etc/greetd/niri.kdl"
+	const want = "env LIBSEAT_BACKEND=logind DMS_VOID=1 " + oldCommand
+	if got := voidLogindGreeterCommand(oldCommand); got != want {
+		t.Fatalf("voidLogindGreeterCommand() = %q, want %q", got, want)
+	}
+	if got := voidLogindGreeterCommand(want); got != want {
+		t.Fatalf("voidLogindGreeterCommand() must be idempotent, got %q", got)
+	}
+}
+
+func TestResolveGreeterAutoLoginState(t *testing.T) {
+	t.Parallel()
+
+	cacheDir := t.TempDir()
+	homeDir := t.TempDir()
+
+	writeTestFile(t, filepath.Join(cacheDir, "settings.json"), `{
+  "greeterAutoLogin": true,
+  "greeterRememberLastUser": true,
+  "greeterRememberLastSession": true
+}`)
+	writeTestFile(t, filepath.Join(cacheDir, ".local/state/memory.json"), `{
+  "lastSuccessfulUser": "alice",
+  "lastSessionDesktopId": "niri.desktop"
+}`)
+
+	enabled, loginUser, sessionID, err := resolveGreeterAutoLoginState(cacheDir, homeDir)
+	if err != nil {
+		t.Fatalf("resolveGreeterAutoLoginState returned error: %v", err)
+	}
+	if !enabled || loginUser != "alice" || sessionID != "niri.desktop" {
+		t.Fatalf("got enabled=%v user=%q session=%q", enabled, loginUser, sessionID)
+	}
+}
+
+func TestResolveGreeterAutoLoginStateIgnoresStaleSessionExec(t *testing.T) {
+	t.Parallel()
+
+	cacheDir := t.TempDir()
+	homeDir := t.TempDir()
+
+	writeTestFile(t, filepath.Join(cacheDir, "settings.json"), `{
+  "greeterAutoLogin": true,
+  "greeterRememberLastUser": true,
+  "greeterRememberLastSession": true
+}`)
+	writeTestFile(t, filepath.Join(cacheDir, ".local/state/memory.json"), `{
+  "lastSuccessfulUser": "alice",
+  "lastSessionId": "/nix/store/old-session/share/wayland-sessions/example.desktop",
+  "lastSessionExec": "/nix/store/old-session/bin/start-example-session"
+}`)
+
+	enabled, loginUser, sessionID, err := resolveGreeterAutoLoginState(cacheDir, homeDir)
+	if err != nil {
+		t.Fatalf("resolveGreeterAutoLoginState returned error: %v", err)
+	}
+	if !enabled || loginUser != "alice" || sessionID != "example.desktop" {
+		t.Fatalf("got enabled=%v user=%q session=%q", enabled, loginUser, sessionID)
+	}
+
+	got := upsertInitialSession("", loginUser, cacheDir, true)
+	if strings.Contains(got, "/nix/store/old-session") {
+		t.Fatalf("initial session must not include stale store path, got:\n%s", got)
+	}
+}
+
+func TestResolveGreeterAutoLoginStateIgnoresMemoryFlag(t *testing.T) {
+	t.Parallel()
+
+	cacheDir := t.TempDir()
+	homeDir := t.TempDir()
+
+	writeTestFile(t, filepath.Join(cacheDir, "settings.json"), `{
+  "greeterAutoLogin": false,
+  "greeterRememberLastUser": true,
+  "greeterRememberLastSession": true
+}`)
+	writeTestFile(t, filepath.Join(cacheDir, ".local/state/memory.json"), `{
+  "autoLoginEnabled": true,
+  "lastSuccessfulUser": "alice",
+  "lastSessionExec": "niri"
+}`)
+
+	enabled, loginUser, sessionID, err := resolveGreeterAutoLoginState(cacheDir, homeDir)
+	if err != nil {
+		t.Fatalf("resolveGreeterAutoLoginState returned error: %v", err)
+	}
+	if enabled || loginUser != "" || sessionID != "" {
+		t.Fatalf("expected disabled with empty user/session, got enabled=%v user=%q session=%q", enabled, loginUser, sessionID)
+	}
+}
+
+func TestResolveSessionExecInDirs(t *testing.T) {
+	t.Parallel()
+
+	oldDir := filepath.Join(t.TempDir(), "wayland-sessions")
+	newDir := filepath.Join(t.TempDir(), "wayland-sessions")
+	writeTestFile(t, filepath.Join(oldDir, "example.desktop"), `[Desktop Entry]
+Name=Example Session
+Exec=/nix/store/old-session/bin/start-example-session
+`)
+	writeTestFile(t, filepath.Join(newDir, "example.desktop"), `[Desktop Entry]
+Name=Example Session
+Exec=/run/current-system/sw/bin/start-example-session
+`)
+
+	got, err := resolveSessionExecInDirs("example.desktop", []string{newDir, oldDir})
+	if err != nil {
+		t.Fatalf("resolveSessionExecInDirs returned error: %v", err)
+	}
+	if got != "/run/current-system/sw/bin/start-example-session" {
+		t.Fatalf("resolveSessionExecInDirs = %q", got)
+	}
+}
+
+func TestClearGreeterAutoLoginMemory(t *testing.T) {
+	t.Parallel()
+
+	memoryPath := filepath.Join(t.TempDir(), "memory.json")
+	writeTestFile(t, memoryPath, `{
+  "autoLoginEnabled": true,
+  "lastSuccessfulUser": "alice"
+}`)
+
+	if err := clearGreeterAutoLoginMemory(memoryPath, ""); err != nil {
+		t.Fatalf("clearGreeterAutoLoginMemory returned error: %v", err)
+	}
+
+	data, err := os.ReadFile(memoryPath)
+	if err != nil {
+		t.Fatalf("failed to read memory file: %v", err)
+	}
+	if strings.Contains(string(data), "autoLoginEnabled") {
+		t.Fatalf("expected autoLoginEnabled removed, got: %s", string(data))
+	}
+	if !strings.Contains(string(data), "lastSuccessfulUser") {
+		t.Fatalf("expected other memory fields preserved, got: %s", string(data))
+	}
+}

core/internal/greeter/session_launcher.go

@@ -0,0 +1,200 @@
+package greeter
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"syscall"
+)
+
+func sessionDesktopIDFromPath(path string) string {
+	id := strings.TrimSpace(path)
+	if id == "" {
+		return ""
+	}
+	if strings.ContainsAny(id, "/\\") {
+		id = filepath.Base(id)
+	}
+	if id == "" {
+		return ""
+	}
+	if !strings.HasSuffix(id, ".desktop") {
+		id += ".desktop"
+	}
+	return id
+}
+
+func sessionDesktopIDFromMemory(mem greeterAutoLoginMemory) string {
+	if id := sessionDesktopIDFromPath(mem.LastSessionDesktopID); id != "" {
+		return id
+	}
+	return sessionDesktopIDFromPath(mem.LastSessionID)
+}
+
+func sessionDesktopDirs() []string {
+	seen := make(map[string]bool)
+	dirs := make([]string, 0, 8)
+
+	addBase := func(base string) {
+		base = strings.TrimSpace(base)
+		if base == "" {
+			return
+		}
+		for _, sub := range []string{"wayland-sessions", "xsessions"} {
+			dir := filepath.Join(base, sub)
+			if seen[dir] {
+				continue
+			}
+			seen[dir] = true
+			dirs = append(dirs, dir)
+		}
+	}
+
+	if dataHome := os.Getenv("XDG_DATA_HOME"); dataHome != "" {
+		addBase(dataHome)
+	} else if home, err := os.UserHomeDir(); err == nil && home != "" {
+		addBase(filepath.Join(home, ".local", "share"))
+	}
+
+	if dataDirs := os.Getenv("XDG_DATA_DIRS"); dataDirs != "" {
+		for _, dir := range strings.Split(dataDirs, ":") {
+			addBase(dir)
+		}
+	} else {
+		addBase("/usr/local/share")
+		addBase("/usr/share")
+	}
+
+	return dirs
+}
+
+func ResolveSessionExec(sessionID string) (string, error) {
+	return resolveSessionExecInDirs(sessionID, sessionDesktopDirs())
+}
+
+func resolveSessionExecInDirs(sessionID string, dirs []string) (string, error) {
+	id := sessionDesktopIDFromPath(sessionID)
+	if id == "" {
+		return "", fmt.Errorf("session id is empty")
+	}
+
+	for _, dir := range dirs {
+		path := filepath.Join(dir, id)
+		execLine, err := execFromDesktopFile(path)
+		if err == nil {
+			return execLine, nil
+		}
+		if !os.IsNotExist(err) {
+			return "", err
+		}
+	}
+
+	return "", fmt.Errorf("session desktop file %q was not found", id)
+}
+
+// parseExecString splits a Desktop Entry Exec= value into argv without
+// involving a shell, mirroring quickshell's DesktopEntry::parseExecString
+// (string quoting, value escapes, field code stripping).
+func parseExecString(execLine string) []string {
+	var args []string
+	var cur strings.Builder
+	inString := false
+	escape := 0
+	percent := false
+
+	for _, c := range execLine {
+		switch {
+		case escape == 0 && c == '\\':
+			escape = 1
+		case inString:
+			switch {
+			case c == '\\':
+				escape++
+				if escape == 4 {
+					cur.WriteByte('\\')
+					escape = 0
+				}
+			case escape == 2:
+				cur.WriteRune(c)
+				escape = 0
+			case escape != 0:
+				switch c {
+				case 's':
+					cur.WriteByte(' ')
+				case 'n':
+					cur.WriteByte('\n')
+				case 't':
+					cur.WriteByte('\t')
+				case 'r':
+					cur.WriteByte('\r')
+				default:
+					cur.WriteRune(c)
+				}
+				escape = 0
+			case c == '"' || c == '\'':
+				inString = false
+			default:
+				cur.WriteRune(c)
+			}
+		case escape != 0:
+			cur.WriteRune(c)
+			escape = 0
+		case percent:
+			if c == '%' {
+				cur.WriteByte('%')
+			}
+			percent = false
+		case c == '%':
+			percent = true
+		case c == '"' || c == '\'':
+			inString = true
+		case c == ' ':
+			if cur.Len() > 0 {
+				args = append(args, cur.String())
+				cur.Reset()
+			}
+		default:
+			cur.WriteRune(c)
+		}
+	}
+	if cur.Len() > 0 {
+		args = append(args, cur.String())
+	}
+	return args
+}
+
+func LaunchSessionByID(sessionID string) error {
+	execLine, err := ResolveSessionExec(sessionID)
+	if err != nil {
+		return err
+	}
+
+	argv := parseExecString(strings.TrimSpace(execLine))
+	if len(argv) == 0 {
+		return fmt.Errorf("session %q has an empty Exec command", sessionID)
+	}
+
+	resolved, err := exec.LookPath(argv[0])
+	if err != nil {
+		return fmt.Errorf("session %q command %q not found: %w", sessionID, argv[0], err)
+	}
+
+	env := append(os.Environ(), "XDG_SESSION_TYPE=wayland")
+	return syscall.Exec(resolved, argv, env)
+}
+
+func LaunchSessionFromMemory(cacheDir, homeDir string) error {
+	enabled, _, sessionID, err := resolveGreeterAutoLoginState(cacheDir, homeDir)
+	if err != nil {
+		return err
+	}
+	if !enabled {
+		return fmt.Errorf("greeter auto-login is disabled")
+	}
+	if sessionID == "" {
+		return fmt.Errorf("greeter auto-login has no remembered session")
+	}
+	return LaunchSessionByID(sessionID)
+}

core/internal/greeter/session_launcher_test.go

@@ -0,0 +1,57 @@
+package greeter
+
+import (
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+func TestParseExecString(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		exec string
+		want []string
+	}{
+		{"plain", "niri --session", []string{"niri", "--session"}},
+		{"extra spaces", "niri   --session", []string{"niri", "--session"}},
+		{"double quoted arg", `env "with space" run`, []string{"env", "with space", "run"}},
+		{"single quoted arg", `env 'with space' run`, []string{"env", "with space", "run"}},
+		{"escaped quote in quotes", `sh "say \\"hi\\""`, []string{"sh", `say "hi"`}},
+		{"field code dropped", "gnome-session %U", []string{"gnome-session"}},
+		{"field code mid-arg", "app --url=%u --run", []string{"app", "--url=", "--run"}},
+		{"literal percent", "app 100%% done", []string{"app", "100%", "done"}},
+		{"shell metachars stay literal", "sh -c $(reboot); echo", []string{"sh", "-c", "$(reboot);", "echo"}},
+		{"empty", "", nil},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := parseExecString(tt.exec); !reflect.DeepEqual(got, tt.want) {
+				t.Fatalf("parseExecString(%q) = %#v, want %#v", tt.exec, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestExecFromDesktopFileOnlyReadsDesktopEntryGroup(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "example.desktop")
+	writeTestFile(t, path, `[Desktop Action other]
+Exec=/wrong/binary
+
+[Desktop Entry]
+Name=Example
+Exec = /right/binary --flag
+`)
+
+	got, err := execFromDesktopFile(path)
+	if err != nil {
+		t.Fatalf("execFromDesktopFile returned error: %v", err)
+	}
+	if got != "/right/binary --flag" {
+		t.Fatalf("execFromDesktopFile = %q, want %q", got, "/right/binary --flag")
+	}
+}

core/internal/greeter/user_cache_sync.go

@@ -0,0 +1,548 @@
+package greeter
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
+)
+
+var monitorWallpaperSanitizer = regexp.MustCompile(`[^a-zA-Z0-9]+`)
+
+func userGreeterCacheDir(cacheDir, username string) string {
+	return filepath.Join(cacheDir, "users", username)
+}
+
+func isUserOwnedGreeterCacheSlot(path, username string) bool {
+	if strings.TrimSpace(username) == "" {
+		return false
+	}
+	userDir, err := filepath.Abs(userGreeterCacheDir(GreeterCacheDir, username))
+	if err != nil {
+		return false
+	}
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return false
+	}
+	return abs == userDir || strings.HasPrefix(abs, userDir+string(filepath.Separator))
+}
+
+func UserIsInGreeterGroup(username string) bool {
+	group := DetectGreeterGroup()
+	if !utils.HasGroup(group) {
+		return false
+	}
+	groupsCmd := exec.Command("groups", username)
+	groupsOutput, err := groupsCmd.Output()
+	if err != nil {
+		return false
+	}
+	return strings.Contains(string(groupsOutput), group)
+}
+
+func CanSyncOwnUserGreeterProfile(username string) bool {
+	currentUser, err := user.Current()
+	if err != nil || currentUser.Username != username {
+		return false
+	}
+	if !UserIsInGreeterGroup(username) {
+		return false
+	}
+	usersDir := filepath.Join(GreeterCacheDir, "users")
+	if st, err := os.Stat(usersDir); err != nil || !st.IsDir() {
+		return false
+	}
+	testFile := filepath.Join(usersDir, ".write-test-"+username)
+	file, err := os.OpenFile(testFile, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o660)
+	if err != nil {
+		return false
+	}
+	_ = file.Close()
+	_ = os.Remove(testFile)
+	return true
+}
+
+func GreeterProfileSyncReady() bool {
+	if command := readGreeterSessionCommand(); command != "" && strings.Contains(command, "dms-greeter") {
+		return true
+	}
+	usersDir := filepath.Join(GreeterCacheDir, "users")
+	st, err := os.Stat(usersDir)
+	return err == nil && st.IsDir()
+}
+
+func readGreeterSessionCommand() string {
+	data, err := os.ReadFile("/etc/greetd/config.toml")
+	if err != nil {
+		return ""
+	}
+	inDefaultSession := false
+	for line := range strings.SplitSeq(string(data), "\n") {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "[") && strings.HasSuffix(trimmed, "]") {
+			inDefaultSession = strings.EqualFold(strings.Trim(trimmed, "[]"), "default_session")
+			continue
+		}
+		if !inDefaultSession {
+			continue
+		}
+		if idx := strings.Index(trimmed, "#"); idx >= 0 {
+			trimmed = strings.TrimSpace(trimmed[:idx])
+		}
+		if !strings.HasPrefix(trimmed, "command") {
+			continue
+		}
+		parts := strings.SplitN(trimmed, "=", 2)
+		if len(parts) != 2 {
+			continue
+		}
+		command := strings.Trim(strings.TrimSpace(parts[1]), `"`)
+		if command != "" {
+			return command
+		}
+	}
+	return ""
+}
+
+// SyncUserProfileCache writes the current user's theme slot under users/<username>/
+// without modifying greetd or other system configuration. Requires membership in the
+// greeter group and a prior full greeter setup by an administrator.
+func SyncUserProfileCache(logFunc func(string)) error {
+	if logFunc == nil {
+		logFunc = func(string) {}
+	}
+	if !GreeterProfileSyncReady() {
+		return fmt.Errorf("greeter is not set up on this system yet; an administrator must run 'dms greeter install' or 'dms greeter sync' once first")
+	}
+
+	currentUser, err := user.Current()
+	if err != nil {
+		return fmt.Errorf("failed to resolve current user: %w", err)
+	}
+	if !CanSyncOwnUserGreeterProfile(currentUser.Username) {
+		group := DetectGreeterGroup()
+		return fmt.Errorf("cannot sync greeter profile: you must be in the %s group with write access to %s/users\nAsk an administrator to run:\n  sudo usermod -aG %s %s\nThen log out and back in before running:\n  dms greeter sync --profile",
+			group, GreeterCacheDir, group, currentUser.Username)
+	}
+
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return fmt.Errorf("failed to get user home directory: %w", err)
+	}
+
+	state, err := resolveGreeterThemeSyncState(homeDir)
+	if err != nil {
+		return fmt.Errorf("failed to resolve greeter color source: %w", err)
+	}
+
+	if err := syncUserGreeterCacheSlot(homeDir, GreeterCacheDir, currentUser.Username, state, logFunc, userSlotSyncOpts{
+		profileOnly: true,
+	}); err != nil {
+		return err
+	}
+
+	logFunc(fmt.Sprintf("  → %s/users/%s/", GreeterCacheDir, currentUser.Username))
+	return nil
+}
+
+func canWriteUserGreeterCacheSlot(dest, username string) bool {
+	return isUserOwnedGreeterCacheSlot(dest, username) && CanSyncOwnUserGreeterProfile(username)
+}
+
+type userSlotSyncOpts struct {
+	sudoPassword string
+	profileOnly  bool
+	username     string
+}
+
+func (o userSlotSyncOpts) useDirectWrite(dest string) bool {
+	if !o.profileOnly {
+		return false
+	}
+	return canWriteUserGreeterCacheSlot(dest, o.username)
+}
+
+func isGreeterCachePath(path string) bool {
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return true
+	}
+	cacheAbs, err := filepath.Abs(GreeterCacheDir)
+	if err != nil {
+		return true
+	}
+	if abs == cacheAbs {
+		return true
+	}
+	return strings.HasPrefix(abs, cacheAbs+string(filepath.Separator))
+}
+
+func greeterCacheOwner() string {
+	greeterGroup := DetectGreeterGroup()
+	daemonUser := DetectGreeterUser()
+	return daemonUser + ":" + greeterGroup
+}
+
+func ensureGreeterCacheSubdir(dir string, opts userSlotSyncOpts) error {
+	if opts.useDirectWrite(dir) {
+		if err := os.MkdirAll(dir, 0o770); err != nil {
+			return fmt.Errorf("failed to create cache directory %s: %w", dir, err)
+		}
+		return nil
+	}
+
+	if err := privesc.Run(context.Background(), opts.sudoPassword, "mkdir", "-p", dir); err != nil {
+		return fmt.Errorf("failed to create cache directory %s: %w", dir, err)
+	}
+
+	owner := greeterCacheOwner()
+	if err := privesc.Run(context.Background(), opts.sudoPassword, "chown", owner, dir); err != nil {
+		if fallbackErr := privesc.Run(context.Background(), opts.sudoPassword, "chown", "root:"+DetectGreeterGroup(), dir); fallbackErr != nil {
+			return fmt.Errorf("failed to set ownership on %s: %w", dir, err)
+		}
+	}
+	if err := privesc.Run(context.Background(), opts.sudoPassword, "chmod", "2770", dir); err != nil {
+		return fmt.Errorf("failed to set permissions on %s: %w", dir, err)
+	}
+	return nil
+}
+
+func setGreeterCacheFileOwnership(path, sudoPassword string) error {
+	owner := greeterCacheOwner()
+	if err := privesc.Run(context.Background(), sudoPassword, "chown", owner, path); err != nil {
+		if fallbackErr := privesc.Run(context.Background(), sudoPassword, "chown", "root:"+DetectGreeterGroup(), path); fallbackErr != nil {
+			return fmt.Errorf("failed to set ownership on %s: %w", path, err)
+		}
+	}
+	if err := privesc.Run(context.Background(), sudoPassword, "chmod", "644", path); err != nil {
+		return fmt.Errorf("failed to set permissions on %s: %w", path, err)
+	}
+	return nil
+}
+
+func syncUserGreeterCacheSlot(homeDir, cacheDir, username string, state greeterThemeSyncState, logFunc func(string), opts userSlotSyncOpts) error {
+	if strings.TrimSpace(username) == "" {
+		return nil
+	}
+	opts.username = username
+
+	userDir := userGreeterCacheDir(cacheDir, username)
+	if err := ensureGreeterCacheSubdir(userDir, opts); err != nil {
+		return err
+	}
+
+	settingsPath := filepath.Join(homeDir, ".config", "DankMaterialShell", "settings.json")
+	settingsBytes, err := os.ReadFile(settingsPath)
+	if err != nil {
+		return fmt.Errorf("failed to read settings for user cache slot: %w", err)
+	}
+
+	settingsMap := map[string]any{}
+	if strings.TrimSpace(string(settingsBytes)) != "" {
+		if err := json.Unmarshal(settingsBytes, &settingsMap); err != nil {
+			return fmt.Errorf("failed to parse settings for user cache slot: %w", err)
+		}
+	}
+
+	if customTheme, ok := settingsMap["customThemeFile"].(string); ok && strings.TrimSpace(customTheme) != "" {
+		resolvedTheme := customTheme
+		if !filepath.IsAbs(resolvedTheme) {
+			resolvedTheme = filepath.Join(homeDir, resolvedTheme)
+		}
+		if st, statErr := os.Stat(resolvedTheme); statErr == nil && !st.IsDir() {
+			destTheme := filepath.Join(userDir, "custom-theme.json")
+			if err := copyFileWithPrivesc(resolvedTheme, destTheme, opts); err != nil {
+				return err
+			}
+			settingsMap["customThemeFile"] = destTheme
+		}
+	}
+
+	settingsBytes, err = json.Marshal(settingsMap)
+	if err != nil {
+		return fmt.Errorf("failed to marshal settings for user cache slot: %w", err)
+	}
+	if err := writeFileWithPrivesc(filepath.Join(userDir, "settings.json"), settingsBytes, opts); err != nil {
+		return err
+	}
+
+	sessionPath := filepath.Join(homeDir, ".local", "state", "DankMaterialShell", "session.json")
+	sessionBytes, err := os.ReadFile(sessionPath)
+	if err != nil {
+		return fmt.Errorf("failed to read session for user cache slot: %w", err)
+	}
+
+	sessionMap := map[string]any{}
+	if strings.TrimSpace(string(sessionBytes)) != "" {
+		if err := json.Unmarshal(sessionBytes, &sessionMap); err != nil {
+			return fmt.Errorf("failed to parse session for user cache slot: %w", err)
+		}
+	}
+
+	if err := localizeSessionWallpapers(sessionMap, userDir, opts); err != nil {
+		return err
+	}
+
+	sessionBytes, err = json.Marshal(sessionMap)
+	if err != nil {
+		return fmt.Errorf("failed to marshal session for user cache slot: %w", err)
+	}
+	if err := writeFileWithPrivesc(filepath.Join(userDir, "session.json"), sessionBytes, opts); err != nil {
+		return err
+	}
+
+	colorsSource := state.effectiveColorsSource(homeDir)
+	if err := copyFileWithPrivesc(colorsSource, filepath.Join(userDir, "colors.json"), opts); err != nil {
+		return fmt.Errorf("failed to copy colors for user cache slot: %w", err)
+	}
+
+	if err := syncUserProfileImage(homeDir, userDir, opts); err != nil {
+		return err
+	}
+
+	rootOverride := filepath.Join(cacheDir, "greeter_wallpaper_override.jpg")
+	userOverride := filepath.Join(userDir, "greeter_wallpaper_override.jpg")
+	if st, statErr := os.Stat(rootOverride); statErr == nil && !st.IsDir() {
+		if err := copyFileWithPrivesc(rootOverride, userOverride, opts); err != nil {
+			return fmt.Errorf("failed to copy greeter wallpaper override for user cache slot: %w", err)
+		}
+	} else if opts.useDirectWrite(userOverride) {
+		_ = os.Remove(userOverride)
+	} else {
+		_ = privesc.Run(context.Background(), opts.sudoPassword, "rm", "-f", userOverride)
+	}
+
+	logFunc(fmt.Sprintf("✓ Synced per-user greeter cache for %s", username))
+	return nil
+}
+
+func localizeSessionWallpapers(session map[string]any, userDir string, opts userSlotSyncOpts) error {
+	stringKeys := []struct {
+		key    string
+		prefix string
+	}{
+		{"wallpaperPath", "wallpaper"},
+		{"wallpaperPathLight", "wallpaper-light"},
+		{"wallpaperPathDark", "wallpaper-dark"},
+	}
+	for _, item := range stringKeys {
+		if err := localizeWallpaperStringField(session, item.key, userDir, item.prefix, opts); err != nil {
+			return err
+		}
+	}
+
+	mapKeys := []struct {
+		key    string
+		prefix string
+	}{
+		{"monitorWallpapers", "wallpaper-monitor"},
+		{"monitorWallpapersLight", "wallpaper-monitor-light"},
+		{"monitorWallpapersDark", "wallpaper-monitor-dark"},
+	}
+	for _, item := range mapKeys {
+		if err := localizeWallpaperMapField(session, item.key, userDir, item.prefix, opts); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func localizeWallpaperStringField(session map[string]any, key, userDir, prefix string, opts userSlotSyncOpts) error {
+	raw, ok := session[key]
+	if !ok {
+		return nil
+	}
+	path, ok := raw.(string)
+	if !ok || strings.TrimSpace(path) == "" {
+		return nil
+	}
+	dest, err := copyWallpaperIntoUserCache(path, userDir, prefix, opts)
+	if err != nil {
+		return err
+	}
+	if dest != "" {
+		session[key] = dest
+	}
+	return nil
+}
+
+func localizeWallpaperMapField(session map[string]any, key, userDir, prefix string, opts userSlotSyncOpts) error {
+	raw, ok := session[key]
+	if !ok || raw == nil {
+		return nil
+	}
+	values, ok := raw.(map[string]any)
+	if !ok {
+		return nil
+	}
+	for monitor, rawPath := range values {
+		path, ok := rawPath.(string)
+		if !ok || strings.TrimSpace(path) == "" {
+			continue
+		}
+		safeMonitor := monitorWallpaperSanitizer.ReplaceAllString(monitor, "-")
+		dest, err := copyWallpaperIntoUserCache(path, userDir, prefix+"-"+safeMonitor, opts)
+		if err != nil {
+			return err
+		}
+		if dest != "" {
+			values[monitor] = dest
+		}
+	}
+	return nil
+}
+
+func copyWallpaperIntoUserCache(srcPath, userDir, prefix string, opts userSlotSyncOpts) (string, error) {
+	if strings.TrimSpace(srcPath) == "" {
+		return "", nil
+	}
+	st, err := os.Stat(srcPath)
+	if err != nil || st.IsDir() {
+		return "", nil
+	}
+	ext := filepath.Ext(srcPath)
+	if ext == "" {
+		ext = ".jpg"
+	}
+	dest := filepath.Join(userDir, prefix+ext)
+	if err := copyFileWithPrivesc(srcPath, dest, opts); err != nil {
+		return "", err
+	}
+	return dest, nil
+}
+
+func copyFileWithPrivesc(src, dest string, opts userSlotSyncOpts) error {
+	if opts.useDirectWrite(dest) {
+		if err := os.MkdirAll(filepath.Dir(dest), 0o770); err != nil {
+			return fmt.Errorf("failed to create parent dir for %s: %w", dest, err)
+		}
+		data, err := os.ReadFile(src)
+		if err != nil {
+			return fmt.Errorf("failed to read %s: %w", src, err)
+		}
+		if err := os.WriteFile(dest, data, 0o644); err != nil {
+			return fmt.Errorf("failed to write %s: %w", dest, err)
+		}
+		return nil
+	}
+
+	if !isGreeterCachePath(dest) {
+		if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+			return fmt.Errorf("failed to create parent dir for %s: %w", dest, err)
+		}
+		data, err := os.ReadFile(src)
+		if err != nil {
+			return fmt.Errorf("failed to read %s: %w", src, err)
+		}
+		if err := os.WriteFile(dest, data, 0o644); err != nil {
+			return fmt.Errorf("failed to write %s: %w", dest, err)
+		}
+		return nil
+	}
+
+	_ = privesc.Run(context.Background(), opts.sudoPassword, "rm", "-f", dest)
+	if err := privesc.Run(context.Background(), opts.sudoPassword, "cp", src, dest); err != nil {
+		return fmt.Errorf("failed to copy %s to %s: %w", src, dest, err)
+	}
+	return setGreeterCacheFileOwnership(dest, opts.sudoPassword)
+}
+
+func writeFileWithPrivesc(path string, data []byte, opts userSlotSyncOpts) error {
+	if opts.useDirectWrite(path) {
+		if err := os.MkdirAll(filepath.Dir(path), 0o770); err != nil {
+			return fmt.Errorf("failed to create parent dir for %s: %w", path, err)
+		}
+		if err := os.WriteFile(path, data, 0o644); err != nil {
+			return fmt.Errorf("failed to write %s: %w", path, err)
+		}
+		return nil
+	}
+
+	if !isGreeterCachePath(path) {
+		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+			return fmt.Errorf("failed to create parent dir for %s: %w", path, err)
+		}
+		if err := os.WriteFile(path, data, 0o644); err != nil {
+			return fmt.Errorf("failed to write %s: %w", path, err)
+		}
+		return nil
+	}
+
+	tmp, err := os.CreateTemp("", "dms-greeter-user-cache-*")
+	if err != nil {
+		return fmt.Errorf("failed to create temp file for %s: %w", path, err)
+	}
+	tmpPath := tmp.Name()
+	if _, err := tmp.Write(data); err != nil {
+		_ = tmp.Close()
+		_ = os.Remove(tmpPath)
+		return fmt.Errorf("failed to write temp file for %s: %w", path, err)
+	}
+	if err := tmp.Close(); err != nil {
+		_ = os.Remove(tmpPath)
+		return fmt.Errorf("failed to close temp file for %s: %w", path, err)
+	}
+	defer os.Remove(tmpPath)
+
+	_ = privesc.Run(context.Background(), opts.sudoPassword, "rm", "-f", path)
+	if err := privesc.Run(context.Background(), opts.sudoPassword, "cp", tmpPath, path); err != nil {
+		return fmt.Errorf("failed to install %s: %w", path, err)
+	}
+	return setGreeterCacheFileOwnership(path, opts.sudoPassword)
+}
+
+func resolveUserProfileImageSource(homeDir string) string {
+	candidates := []string{
+		filepath.Join(homeDir, ".face"),
+		filepath.Join(homeDir, ".face.icon"),
+	}
+	if homeDir != "" {
+		username := filepath.Base(homeDir)
+		if username != "" && username != "." && username != string(filepath.Separator) {
+			candidates = append([]string{filepath.Join("/var/lib/AccountsService/icons", username)}, candidates...)
+		}
+	}
+	for _, src := range candidates {
+		st, err := os.Stat(src)
+		if err == nil && !st.IsDir() && st.Size() > 0 {
+			return src
+		}
+	}
+	return ""
+}
+
+func syncUserProfileImage(homeDir, userDir string, opts userSlotSyncOpts) error {
+	for _, name := range []string{"profile.jpg", "profile.jpeg", "profile.png", "profile.webp"} {
+		path := filepath.Join(userDir, name)
+		if opts.useDirectWrite(path) {
+			_ = os.Remove(path)
+		} else {
+			_ = privesc.Run(context.Background(), opts.sudoPassword, "rm", "-f", path)
+		}
+	}
+
+	src := resolveUserProfileImageSource(homeDir)
+	if src == "" {
+		return nil
+	}
+
+	ext := filepath.Ext(src)
+	if ext == "" {
+		ext = ".jpg"
+	}
+	dest := filepath.Join(userDir, "profile"+ext)
+	if err := copyFileWithPrivesc(src, dest, opts); err != nil {
+		return fmt.Errorf("failed to copy profile image for user cache slot: %w", err)
+	}
+	return nil
+}

core/internal/greeter/user_cache_sync_test.go

@@ -0,0 +1,81 @@
+package greeter
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestUserGreeterCacheDir(t *testing.T) {
+	t.Parallel()
+
+	got := userGreeterCacheDir("/var/cache/dms-greeter", "alice")
+	want := filepath.Join("/var/cache/dms-greeter", "users", "alice")
+	if got != want {
+		t.Fatalf("userGreeterCacheDir() = %q, want %q", got, want)
+	}
+}
+
+func TestResolveUserProfileImageSource(t *testing.T) {
+	t.Parallel()
+
+	homeDir := t.TempDir()
+	facePath := filepath.Join(homeDir, ".face")
+	writeTestFile(t, facePath, "face")
+
+	got := resolveUserProfileImageSource(homeDir)
+	if got != facePath {
+		t.Fatalf("resolveUserProfileImageSource() = %q, want %q", got, facePath)
+	}
+}
+
+func TestIsUserOwnedGreeterCacheSlot(t *testing.T) {
+	t.Parallel()
+
+	slot := filepath.Join(GreeterCacheDir, "users", "alice", "settings.json")
+	if !isUserOwnedGreeterCacheSlot(slot, "alice") {
+		t.Fatalf("expected alice to own %q", slot)
+	}
+	if isUserOwnedGreeterCacheSlot(slot, "bob") {
+		t.Fatalf("expected bob not to own alice slot")
+	}
+	if isUserOwnedGreeterCacheSlot(filepath.Join(GreeterCacheDir, "settings.json"), "alice") {
+		t.Fatalf("expected root cache file not to be a user slot")
+	}
+}
+
+func TestLocalizeSessionWallpapers(t *testing.T) {
+	t.Parallel()
+
+	homeDir := t.TempDir()
+	userDir := filepath.Join(homeDir, "users", "alice")
+	wallpaperPath := filepath.Join(homeDir, "wall.jpg")
+	writeTestFile(t, wallpaperPath, "wallpaper")
+
+	session := map[string]any{
+		"wallpaperPath": wallpaperPath,
+		"monitorWallpapers": map[string]any{
+			"DP-1": wallpaperPath,
+		},
+	}
+
+	if err := localizeSessionWallpapers(session, userDir, userSlotSyncOpts{}); err != nil {
+		t.Fatalf("localizeSessionWallpapers returned error: %v", err)
+	}
+
+	gotPath, ok := session["wallpaperPath"].(string)
+	if !ok || gotPath == "" {
+		t.Fatalf("expected localized wallpaperPath, got %#v", session["wallpaperPath"])
+	}
+	if gotPath == wallpaperPath {
+		t.Fatalf("expected copied wallpaper path, still points to source")
+	}
+
+	monitorMap, ok := session["monitorWallpapers"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected monitorWallpapers map")
+	}
+	monitorPath, ok := monitorMap["DP-1"].(string)
+	if !ok || monitorPath == "" || monitorPath == wallpaperPath {
+		t.Fatalf("expected localized monitor wallpaper, got %#v", monitorMap["DP-1"])
+	}
+}

core/internal/headless/runner.go

@@ -9,8 +9,8 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/greeter"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
 )
 
 // ErrConfirmationRequired is returned when --yes is not set and the user
@@ -223,12 +223,16 @@ func (r *Runner) Run() error {
 
 	// 9. Greeter setup (if dms-greeter was included)
 	if !disabledItems["dms-greeter"] && r.depExists(dependencies, "dms-greeter") {
+		compositorName := "niri"
+		if wm == deps.WindowManagerHyprland {
+			compositorName = "Hyprland"
+		}
 		fmt.Fprintln(os.Stdout, "Configuring DMS greeter...")
 		logFunc := func(line string) {
 			r.log(line)
 			fmt.Fprintf(os.Stdout, "  greeter: %s\n", line)
 		}
-		if err := utils.RunDmsGreeterInstall(sudoPassword, logFunc); err != nil {
+		if err := greeter.AutoSetupGreeter(compositorName, sudoPassword, logFunc); err != nil {
 			// Non-fatal, matching TUI behavior
 			fmt.Fprintf(os.Stderr, "Warning: greeter setup issue (non-fatal): %v\n", err)
 		}

core/internal/keybinds/providers/hyprland.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
@@ -225,44 +224,6 @@ func (h *HyprlandProvider) validateAction(action string) error {
 	return nil
 }
 
-var luaExprActionPattern = regexp.MustCompile(`^(function\s*\(|hl\.)`)
-
-// isRawLuaActionText reports that action is a Lua expression to re-emit
-// verbatim rather than freeform dispatcher text to wrap for hyprctl. The
-// balance check keeps malformed input from corrupting the generated file.
-func isRawLuaActionText(action string) bool {
-	if !luaExprActionPattern.MatchString(action) {
-		return false
-	}
-	depth := 0
-	var quote byte
-	escaped := false
-	for i := 0; i < len(action); i++ {
-		c := action[i]
-		switch {
-		case escaped:
-			escaped = false
-		case quote != 0:
-			switch c {
-			case '\\':
-				escaped = true
-			case quote:
-				quote = 0
-			}
-		case c == '"' || c == '\'':
-			quote = c
-		case c == '(':
-			depth++
-		case c == ')':
-			depth--
-			if depth < 0 {
-				return false
-			}
-		}
-	}
-	return depth == 0 && quote == 0 && !escaped
-}
-
 func (h *HyprlandProvider) SetBind(key, action, description string, options map[string]any) error {
 	if err := h.ensureWritableConfig(); err != nil {
 		return err
@@ -293,12 +254,11 @@ func (h *HyprlandProvider) SetBind(key, action, description string, options map[
 	canonicalKey := canonicalHyprlandOverrideKey(key)
 	normalizedKey := hyprlandOverrideMapKey(canonicalKey)
 	existingBinds[normalizedKey] = &hyprlandOverrideBind{
-		Key:          canonicalKey,
-		Action:       action,
-		Description:  description,
-		Flags:        flags,
-		Options:      options,
-		RawLuaAction: isRawLuaActionText(action),
+		Key:         canonicalKey,
+		Action:      action,
+		Description: description,
+		Flags:       flags,
+		Options:     options,
 	}
 
 	return h.writeOverrideBinds(existingBinds)

core/internal/keybinds/providers/hyprland_parser_test.go

@@ -463,56 +463,6 @@ func TestHyprlandSetBindLeavesConfOnlyInstallReadOnly(t *testing.T) {
 	}
 }
 
-func TestIsRawLuaActionText(t *testing.T) {
-	cases := []struct {
-		action string
-		want   bool
-	}{
-		{`function() hl.plugin.scrolloverview.overview("toggle") end`, true},
-		{`hl.dsp.exec_cmd("foo")`, true},
-		{`hl.dsp.no_op()`, true},
-		{"workspace 3", false},
-		{"exec zeditor", false},
-		{`function() hl.foo( end`, false},
-		{`function() hl.foo("a) end`, false},
-		{`hl.foo()) hl.bar((`, false},
-	}
-	for _, tc := range cases {
-		if got := isRawLuaActionText(tc.action); got != tc.want {
-			t.Errorf("isRawLuaActionText(%q) = %v, want %v", tc.action, got, tc.want)
-		}
-	}
-}
-
-func TestHyprlandSetBindPreservesRawLuaAction(t *testing.T) {
-	tmpDir := t.TempDir()
-	dmsDir := filepath.Join(tmpDir, "dms")
-	if err := os.MkdirAll(dmsDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dmsDir, "binds-user.lua"), []byte("-- DMS user keybind overrides\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	provider := NewHyprlandProvider(tmpDir)
-	rawAction := `function() hl.plugin.scrolloverview.overview("toggle") end`
-	if err := provider.SetBind("SUPER + G", rawAction, "Toggle overview", nil); err != nil {
-		t.Fatal(err)
-	}
-
-	data, err := os.ReadFile(filepath.Join(dmsDir, "binds-user.lua"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := string(data)
-	if !strings.Contains(got, `hl.bind("SUPER + G", `+rawAction) {
-		t.Fatalf("expected raw Lua action to be written verbatim, got:\n%s", got)
-	}
-	if strings.Contains(got, "hyprctl dispatch function") {
-		t.Fatalf("expected raw Lua action to not be wrapped in hyprctl dispatch, got:\n%s", got)
-	}
-}
-
 func TestHyprlandSetBindUpdatesSpacedLuaOverrideWithoutDuplicates(t *testing.T) {
 	tmpDir := t.TempDir()
 	dmsDir := filepath.Join(tmpDir, "dms")

core/internal/log/log.go

@@ -1,32 +1,220 @@
 package log
 
 import (
-	danklog "github.com/AvengeMedia/dankgo/log"
+	"io"
+	"os"
+	"regexp"
+	"strings"
+	"sync"
+
+	"github.com/charmbracelet/lipgloss"
+	cblog "github.com/charmbracelet/log"
+	"github.com/mattn/go-isatty"
+	"github.com/muesli/termenv"
 )
 
-type Logger = danklog.Logger
+// Logger embeds the Charm Logger and adds Printf/Fatalf
+type Logger struct{ *cblog.Logger }
 
-func init() {
-	danklog.SetEnvPrefix("DMS")
+// Printf routes goose/info-style logs through Infof.
+func (l *Logger) Printf(format string, v ...any) { l.Infof(format, v...) }
+
+// Fatalf keeps goose’s contract of exiting the program.
+func (l *Logger) Fatalf(format string, v ...any) { l.Logger.Fatalf(format, v...) }
+
+var (
+	logger     *Logger
+	initLogger sync.Once
+
+	logMu     sync.Mutex
+	logFile   *os.File
+	logStderr io.Writer = os.Stderr
+
+	ansiRe = regexp.MustCompile(`\x1b\[[0-9;]*[a-zA-Z]`)
+)
+
+// ansiStripWriter strips ANSI escape sequences before forwarding to w. Used
+// for the file sink so colored stderr stays colored while the file stays plain.
+type ansiStripWriter struct{ w io.Writer }
+
+func (a *ansiStripWriter) Write(p []byte) (int, error) {
+	stripped := ansiRe.ReplaceAll(p, nil)
+	if _, err := a.w.Write(stripped); err != nil {
+		return 0, err
+	}
+	return len(p), nil
 }
 
-func GetLogger() *Logger { return danklog.GetLogger() }
+func parseLogLevel(level string) cblog.Level {
+	switch strings.ToLower(level) {
+	case "debug":
+		return cblog.DebugLevel
+	case "info":
+		return cblog.InfoLevel
+	case "warn", "warning":
+		return cblog.WarnLevel
+	case "error":
+		return cblog.ErrorLevel
+	case "fatal":
+		return cblog.FatalLevel
+	default:
+		return cblog.InfoLevel
+	}
+}
 
-func GetQtLoggingRules() string { return danklog.GetQtLoggingRules() }
+func GetQtLoggingRules() string {
+	level := os.Getenv("DMS_LOG_LEVEL")
+	if level == "" {
+		level = "info"
+	}
 
-func SetLevel(level string) { danklog.SetLevel(level) }
+	// scene carries QML engine warnings (e.g. QQuickImage "Cannot open" cache
+	// probes); suppressed except at debug level
+	var rules []string
+	switch strings.ToLower(level) {
+	case "fatal":
+		rules = []string{"*.debug=false", "*.info=false", "*.warning=false", "*.critical=false"}
+	case "error":
+		rules = []string{"*.debug=false", "*.info=false", "*.warning=false"}
+	case "warn", "warning":
+		rules = []string{"*.debug=false", "*.info=false", "scene.warning=false"}
+	case "info":
+		rules = []string{"*.debug=false", "scene.warning=false"}
+	case "debug":
+		return ""
+	default:
+		rules = []string{"*.debug=false", "scene.warning=false"}
+	}
 
-func SetLogFile(path string) error { return danklog.SetLogFile(path) }
+	return strings.Join(rules, ";")
+}
 
-func ApplyEnvOverrides() { danklog.ApplyEnvOverrides() }
+// GetLogger returns a logger instance
+func GetLogger() *Logger {
+	initLogger.Do(func() {
+		styles := cblog.DefaultStyles()
+		// Attempt to match the colors used by qml/quickshell logs
+		styles.Levels[cblog.FatalLevel] = lipgloss.NewStyle().
+			SetString(" FATAL").
+			Foreground(lipgloss.Color("1"))
+		styles.Levels[cblog.ErrorLevel] = lipgloss.NewStyle().
+			SetString(" ERROR").
+			Foreground(lipgloss.Color("9"))
+		styles.Levels[cblog.WarnLevel] = lipgloss.NewStyle().
+			SetString("  WARN").
+			Foreground(lipgloss.Color("3"))
+		styles.Levels[cblog.InfoLevel] = lipgloss.NewStyle().
+			SetString("  INFO").
+			Foreground(lipgloss.Color("2"))
+		styles.Levels[cblog.DebugLevel] = lipgloss.NewStyle().
+			SetString(" DEBUG").
+			Foreground(lipgloss.Color("4"))
 
-func Debug(msg any, keyvals ...any)  { danklog.Debug(msg, keyvals...) }
-func Debugf(format string, v ...any) { danklog.Debugf(format, v...) }
-func Info(msg any, keyvals ...any)   { danklog.Info(msg, keyvals...) }
-func Infof(format string, v ...any)  { danklog.Infof(format, v...) }
-func Warn(msg any, keyvals ...any)   { danklog.Warn(msg, keyvals...) }
-func Warnf(format string, v ...any)  { danklog.Warnf(format, v...) }
-func Error(msg any, keyvals ...any)  { danklog.Error(msg, keyvals...) }
-func Errorf(format string, v ...any) { danklog.Errorf(format, v...) }
-func Fatal(msg any, keyvals ...any)  { danklog.Fatal(msg, keyvals...) }
-func Fatalf(format string, v ...any) { danklog.Fatalf(format, v...) }
+		base := cblog.New(logStderr)
+		base.SetStyles(styles)
+		base.SetReportTimestamp(false)
+
+		level := cblog.InfoLevel
+		if envLevel := os.Getenv("DMS_LOG_LEVEL"); envLevel != "" {
+			level = parseLogLevel(envLevel)
+		}
+		base.SetLevel(level)
+		base.SetPrefix(" go")
+
+		logger = &Logger{base}
+
+		if path := os.Getenv("DMS_LOG_FILE"); path != "" {
+			logMu.Lock()
+			_ = setLogFile(logger, path)
+			logMu.Unlock()
+		}
+	})
+	return logger
+}
+
+// SetLevel updates the active log level. Accepts the same strings as
+// DMS_LOG_LEVEL. Unknown values default to info.
+func SetLevel(level string) {
+	GetLogger().SetLevel(parseLogLevel(level))
+}
+
+// SetLogFile makes the logger append to path in addition to stderr. Passing an
+// empty string detaches the file sink. Atomic per-line writes (≤PIPE_BUF) on
+// O_APPEND keep concurrent Go and QML writers from corrupting each other.
+//
+// Color handling: charmbracelet/log auto-detects color support from its
+// io.Writer, and io.MultiWriter doesn't pass that through, so we force the ANSI
+// profile when stderr is a TTY and route the file through ansiStripWriter so
+// the file stays plain while stderr keeps its colors.
+func SetLogFile(path string) error {
+	l := GetLogger()
+	logMu.Lock()
+	defer logMu.Unlock()
+	return setLogFile(l, path)
+}
+
+func setLogFile(l *Logger, path string) error {
+	if logFile != nil {
+		logFile.Close()
+		logFile = nil
+	}
+
+	if path == "" {
+		l.SetOutput(logStderr)
+		applyColorProfile(l, logStderr)
+		return nil
+	}
+
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_APPEND|os.O_CREATE, 0o644)
+	if err != nil {
+		return err
+	}
+	logFile = f
+	out := io.MultiWriter(logStderr, &ansiStripWriter{w: f})
+	l.SetOutput(out)
+	applyColorProfile(l, logStderr)
+	return nil
+}
+
+// applyColorProfile forces the renderer's color profile to match what stderr
+// would produce on its own, undoing the auto-downgrade triggered by wrapping
+// stderr in a non-TTY writer (e.g. io.MultiWriter).
+func applyColorProfile(l *Logger, stderr io.Writer) {
+	f, ok := stderr.(*os.File)
+	if !ok {
+		l.SetColorProfile(termenv.Ascii)
+		return
+	}
+	if isatty.IsTerminal(f.Fd()) {
+		l.SetColorProfile(termenv.ANSI)
+		return
+	}
+	l.SetColorProfile(termenv.Ascii)
+}
+
+// ApplyEnvOverrides re-reads DMS_LOG_LEVEL and DMS_LOG_FILE and reconfigures
+// the singleton. Safe to call after CLI flags have rewritten the environment.
+func ApplyEnvOverrides() {
+	GetLogger()
+	if level := os.Getenv("DMS_LOG_LEVEL"); level != "" {
+		SetLevel(level)
+	}
+	if path := os.Getenv("DMS_LOG_FILE"); path != "" {
+		if err := SetLogFile(path); err != nil {
+			Warnf("Failed to open log file %q: %v", path, err)
+		}
+	}
+}
+
+// * Convenience wrappers
+
+func Debug(msg any, keyvals ...any)  { GetLogger().Debug(msg, keyvals...) }
+func Debugf(format string, v ...any) { GetLogger().Debugf(format, v...) }
+func Info(msg any, keyvals ...any)   { GetLogger().Info(msg, keyvals...) }
+func Infof(format string, v ...any)  { GetLogger().Infof(format, v...) }
+func Warn(msg any, keyvals ...any)   { GetLogger().Warn(msg, keyvals...) }
+func Warnf(format string, v ...any)  { GetLogger().Warnf(format, v...) }
+func Error(msg any, keyvals ...any)  { GetLogger().Error(msg, keyvals...) }
+func Errorf(format string, v ...any) { GetLogger().Errorf(format, v...) }
+func Fatal(msg any, keyvals ...any)  { GetLogger().Fatal(msg, keyvals...) }
+func Fatalf(format string, v ...any) { GetLogger().Fatalf(format, v...) }

core/internal/matugen/matugen.go

@@ -44,7 +44,6 @@ type TemplateDef struct {
 	ID                 string
 	Commands           []string
 	Flatpaks           []string
-	ConfigDirs         []string
 	ConfigFile         string
 	Kind               TemplateKind
 	RunUnconditionally bool
@@ -61,9 +60,9 @@ var templateRegistry = []TemplateDef{
 	{ID: "firefox", Commands: []string{"firefox"}, ConfigFile: "firefox.toml"},
 	{ID: "pywalfox", Commands: []string{"pywalfox"}, ConfigFile: "pywalfox.toml"},
 	{ID: "zenbrowser", Commands: []string{"zen", "zen-browser", "zen-beta", "zen-twilight"}, Flatpaks: []string{"app.zen_browser.zen"}, ConfigFile: "zenbrowser.toml"},
-	{ID: "vesktop", Commands: []string{"vesktop"}, Flatpaks: []string{"dev.vencord.Vesktop"}, ConfigDirs: []string{"vesktop"}, ConfigFile: "vesktop.toml"},
-	{ID: "vencord", Commands: []string{"discord", "Discord", "discord-canary", "DiscordCanary"}, Flatpaks: []string{"com.discordapp.Discord", "com.discordapp.DiscordCanary"}, ConfigDirs: []string{"Vencord"}, ConfigFile: "vencord.toml"},
-	{ID: "equibop", Commands: []string{"equibop"}, ConfigDirs: []string{"equibop"}, ConfigFile: "equibop.toml"},
+	{ID: "vesktop", Commands: []string{"vesktop"}, Flatpaks: []string{"dev.vencord.Vesktop"}, ConfigFile: "vesktop.toml"},
+	{ID: "vencord", Commands: []string{"discord", "Discord", "discord-canary", "DiscordCanary"}, Flatpaks: []string{"com.discordapp.Discord", "com.discordapp.DiscordCanary"}, ConfigFile: "vencord.toml"},
+	{ID: "equibop", Commands: []string{"equibop"}, ConfigFile: "equibop.toml"},
 	{ID: "ghostty", Commands: []string{"ghostty"}, ConfigFile: "ghostty.toml", Kind: TemplateKindTerminal},
 	{ID: "kitty", Commands: []string{"kitty"}, ConfigFile: "kitty.toml", Kind: TemplateKindTerminal},
 	{ID: "foot", Commands: []string{"foot"}, ConfigFile: "foot.toml", Kind: TemplateKindTerminal},
@@ -386,12 +385,8 @@ func buildOnce(opts *Options) (bool, error) {
 		default:
 			syncAccentColor(primaryDark)
 		}
-		refreshGTKTheme(opts.Mode)
-		refreshGTKColorScheme()
-	}
-
-	if isDMSKDEColorSchemeActive(opts.ConfigDir) {
-		applyKDEColorScheme(opts.Mode)
+		refreshGTK(opts.Mode)
+		refreshGTK4()
 	}
 
 	if !opts.ShouldSkipTemplate("qt6ct") && appExists(opts.AppChecker, []string{"qt6ct"}, nil) {
@@ -464,22 +459,25 @@ output_path = '%s'
 		case TemplateKindGTK:
 			switch opts.Mode {
 			case ColorModeLight:
-				appendConfig(opts, cfgFile, nil, nil, nil, "gtk3-light.toml")
+				appendConfig(opts, cfgFile, nil, nil, "gtk3-light.toml")
 			default:
-				appendConfig(opts, cfgFile, nil, nil, nil, "gtk3-dark.toml")
+				appendConfig(opts, cfgFile, nil, nil, "gtk3-dark.toml")
 			}
 		case TemplateKindTerminal:
 			appendTerminalConfig(opts, cfgFile, tmpDir, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
 		case TemplateKindVSCode:
-			for _, editor := range vscodeEditors {
-				appendVSCodeConfig(cfgFile, editor.name, editor.extensionsDir(homeDir), opts.ShellDir)
-			}
+			appendVSCodeConfig(cfgFile, "vscode", filepath.Join(homeDir, ".vscode/extensions"), opts.ShellDir)
+			appendVSCodeConfig(cfgFile, "codium", filepath.Join(homeDir, ".vscode-oss/extensions"), opts.ShellDir)
+			appendVSCodeConfig(cfgFile, "codeoss", filepath.Join(homeDir, ".config/Code - OSS/extensions"), opts.ShellDir)
+			appendVSCodeConfig(cfgFile, "cursor", filepath.Join(homeDir, ".cursor/extensions"), opts.ShellDir)
+			appendVSCodeConfig(cfgFile, "windsurf", filepath.Join(homeDir, ".windsurf/extensions"), opts.ShellDir)
+			appendVSCodeConfig(cfgFile, "vscode-insiders", filepath.Join(homeDir, ".vscode-insiders/extensions"), opts.ShellDir)
 		case TemplateKindEmacs:
 			if utils.EmacsConfigDir() != "" {
-				appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigDirs, tmpl.ConfigFile)
+				appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
 			}
 		default:
-			appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigDirs, tmpl.ConfigFile)
+			appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
 		}
 	}
 
@@ -514,14 +512,13 @@ func appendConfig(
 	cfgFile *os.File,
 	checkCmd []string,
 	checkFlatpaks []string,
-	checkConfigDirs []string,
 	fileName string,
 ) {
 	configPath := filepath.Join(opts.ShellDir, "matugen", "configs", fileName)
 	if _, err := os.Stat(configPath); err != nil {
 		return
 	}
-	if !appExists(opts.AppChecker, checkCmd, checkFlatpaks) && !configDirExists(checkConfigDirs) {
+	if !appExists(opts.AppChecker, checkCmd, checkFlatpaks) {
 		return
 	}
 	data, err := os.ReadFile(configPath)
@@ -602,20 +599,6 @@ func templateSessionActive(tmpl TemplateDef) bool {
 	return err == nil
 }
 
-func configDirExists(names []string) bool {
-	configHome := utils.XDGConfigHome()
-	if configHome == "" {
-		return false
-	}
-	for _, name := range names {
-		info, err := os.Stat(filepath.Join(configHome, name))
-		if err == nil && info.IsDir() {
-			return true
-		}
-	}
-	return false
-}
-
 func appExists(checker utils.AppChecker, checkCmd []string, checkFlatpaks []string) bool {
 	// Both nil is treated as "skip check" / unconditionally run
 	if checkCmd == nil && checkFlatpaks == nil {
@@ -630,23 +613,6 @@ func appExists(checker utils.AppChecker, checkCmd []string, checkFlatpaks []stri
 	return false
 }
 
-type vscodeEditor struct {
-	name    string
-	dataDir string
-}
-
-var vscodeEditors = []vscodeEditor{
-	{"vscode", ".vscode"},
-	{"codium", ".vscode-oss"},
-	{"cursor", ".cursor"},
-	{"windsurf", ".windsurf"},
-	{"vscode-insiders", ".vscode-insiders"},
-}
-
-func (e vscodeEditor) extensionsDir(homeDir string) string {
-	return filepath.Join(homeDir, e.dataDir, "extensions")
-}
-
 func appendVSCodeConfig(cfgFile *os.File, name, extBaseDir, shellDir string) {
 	pattern := filepath.Join(extBaseDir, "danklinux.dms-theme-*")
 	matches, err := filepath.Glob(pattern)
@@ -925,7 +891,7 @@ func generateDank16Variants(primaryDark, primaryLight, surface string, mode Colo
 }
 
 func isDMSGTKActive(configDir string) bool {
-	gtkCSS := filepath.Join(configDir, "gtk-4.0", "gtk.css")
+	gtkCSS := filepath.Join(configDir, "gtk-3.0", "gtk.css")
 
 	info, err := os.Lstat(gtkCSS)
 	if err != nil {
@@ -941,73 +907,11 @@ func isDMSGTKActive(configDir string) bool {
 	return err == nil && strings.Contains(string(data), "dank-colors.css")
 }
 
-// isDMSKDEColorSchemeActive only flips the scheme when the user is already on a
-// DankMatugen one, leaving Breeze (or anything else) untouched.
-func isDMSKDEColorSchemeActive(configDir string) bool {
-	data, err := os.ReadFile(filepath.Join(configDir, "kdeglobals"))
-	if err != nil {
-		return false
-	}
-
-	inGeneral := false
-	for _, line := range strings.Split(string(data), "\n") {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "[") {
-			inGeneral = line == "[General]"
-			continue
-		}
-		if !inGeneral {
-			continue
-		}
-		if name, ok := strings.CutPrefix(line, "ColorScheme="); ok {
-			return strings.HasPrefix(strings.TrimSpace(name), "DankMatugen")
-		}
-	}
-	return false
-}
-
-func applyKDEColorScheme(mode ColorMode) {
-	if !utils.CommandExists("plasma-apply-colorscheme") {
-		return
-	}
-
-	scheme := "DankMatugenDark"
-	if mode == ColorModeLight {
-		scheme = "DankMatugenLight"
-	}
-
-	log.Infof("Applying KDE color scheme: %s", scheme)
-	if err := exec.Command("plasma-apply-colorscheme", scheme).Run(); err != nil {
-		log.Warnf("Failed to apply KDE color scheme: %v", err)
-	}
-}
-
-func gtkThemeInstalled(theme string) bool {
-	home, _ := os.UserHomeDir()
-	candidates := []string{
-		filepath.Join(home, ".local/share/themes", theme),
-		filepath.Join(home, ".themes", theme),
-		filepath.Join("/usr/share/themes", theme),
-		filepath.Join("/usr/local/share/themes", theme),
-	}
-	for _, dir := range candidates {
-		if info, err := os.Stat(dir); err == nil && info.IsDir() {
-			return true
-		}
-	}
-	return false
-}
-
-func refreshGTKTheme(mode ColorMode) {
-	theme := mode.GTKTheme()
-	if !gtkThemeInstalled(theme) {
-		log.Infof("Skipping gtk-theme refresh: %s is not installed", theme)
-		return
-	}
+func refreshGTK(mode ColorMode) {
 	if err := utils.GsettingsSet("org.gnome.desktop.interface", "gtk-theme", ""); err != nil {
 		log.Warnf("Failed to reset gtk-theme: %v", err)
 	}
-	if err := utils.GsettingsSet("org.gnome.desktop.interface", "gtk-theme", theme); err != nil {
+	if err := utils.GsettingsSet("org.gnome.desktop.interface", "gtk-theme", mode.GTKTheme()); err != nil {
 		log.Warnf("Failed to set gtk-theme: %v", err)
 	}
 }
@@ -1028,8 +932,8 @@ func expectColorSchemeEcho(scheme string) {
 // apps reload ~/.config/gtk-4.0 CSS (a gtk-theme flip does not). But apps
 // following the portal color-scheme (Chromium) can drop the restore signal
 // mid-repaint and latch the wrong mode, so this is opt-in.
-func refreshGTKColorScheme() {
-	if os.Getenv("DMS_ENABLE_GTK_REFRESH") != "1" {
+func refreshGTK4() {
+	if os.Getenv("DMS_ENABLE_GTK4_REFRESH") != "1" {
 		return
 	}
 	output, err := utils.GsettingsGet("org.gnome.desktop.interface", "color-scheme")
@@ -1047,13 +951,13 @@ func refreshGTKColorScheme() {
 
 	expectColorSchemeEcho(toggle)
 	if err := utils.GsettingsSet("org.gnome.desktop.interface", "color-scheme", toggle); err != nil {
-		log.Warnf("Failed to toggle color-scheme for GTK refresh: %v", err)
+		log.Warnf("Failed to toggle color-scheme for GTK4 refresh: %v", err)
 		return
 	}
-	time.Sleep(50 * time.Millisecond)
+	time.Sleep(400 * time.Millisecond)
 	expectColorSchemeEcho(current)
 	if err := utils.GsettingsSet("org.gnome.desktop.interface", "color-scheme", current); err != nil {
-		log.Warnf("Failed to restore color-scheme for GTK refresh: %v", err)
+		log.Warnf("Failed to restore color-scheme for GTK4 refresh: %v", err)
 	}
 }
 
@@ -1076,6 +980,26 @@ func signalTerminals(opts *Options) {
 	}
 }
 
+func signalByName(name string, sig syscall.Signal) {
+	entries, err := os.ReadDir("/proc")
+	if err != nil {
+		return
+	}
+	for _, entry := range entries {
+		pid, err := strconv.Atoi(entry.Name())
+		if err != nil {
+			continue
+		}
+		comm, err := os.ReadFile(filepath.Join("/proc", entry.Name(), "comm"))
+		if err != nil {
+			continue
+		}
+		if strings.TrimSpace(string(comm)) == name {
+			syscall.Kill(pid, sig)
+		}
+	}
+}
+
 func syncColorScheme(mode ColorMode) {
 	scheme := "prefer-dark"
 	if mode == ColorModeLight {
@@ -1172,7 +1096,7 @@ func CheckTemplates(checker utils.AppChecker) []TemplateCheck {
 		case tmpl.Kind == TemplateKindEmacs:
 			detected = appExists(checker, tmpl.Commands, tmpl.Flatpaks) && utils.EmacsConfigDir() != ""
 		default:
-			detected = (appExists(checker, tmpl.Commands, tmpl.Flatpaks) || configDirExists(tmpl.ConfigDirs)) && templateSessionActive(tmpl)
+			detected = appExists(checker, tmpl.Commands, tmpl.Flatpaks) && templateSessionActive(tmpl)
 		}
 
 		checks = append(checks, TemplateCheck{ID: tmpl.ID, Detected: detected})
@@ -1182,8 +1106,16 @@ func CheckTemplates(checker utils.AppChecker) []TemplateCheck {
 }
 
 func checkVSCodeExtension(homeDir string) bool {
-	for _, editor := range vscodeEditors {
-		pattern := filepath.Join(editor.extensionsDir(homeDir), "danklinux.dms-theme-*")
+	extDirs := []string{
+		filepath.Join(homeDir, ".vscode/extensions"),
+		filepath.Join(homeDir, ".vscode-oss/extensions"),
+		filepath.Join(homeDir, ".config/Code - OSS/extensions"),
+		filepath.Join(homeDir, ".cursor/extensions"),
+		filepath.Join(homeDir, ".windsurf/extensions"),
+	}
+
+	for _, extDir := range extDirs {
+		pattern := filepath.Join(extDir, "danklinux.dms-theme-*")
 		if matches, err := filepath.Glob(pattern); err == nil && len(matches) > 0 {
 			return true
 		}

core/internal/matugen/matugen_test.go

@@ -38,7 +38,7 @@ func TestAppendConfigBinaryExists(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, []string{"sh"}, nil, nil, "test.toml")
+	appendConfig(opts, cfgFile, []string{"sh"}, nil, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -82,7 +82,7 @@ func TestAppendConfigBinaryDoesNotExist(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{}, nil, "test.toml")
+	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{}, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -122,7 +122,7 @@ func TestAppendConfigFlatpakExists(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, nil, []string{"app.zen_browser.zen"}, nil, "test.toml")
+	appendConfig(opts, cfgFile, nil, []string{"app.zen_browser.zen"}, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -163,7 +163,7 @@ func TestAppendConfigFlatpakDoesNotExist(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, []string{}, []string{"com.nonexistent.flatpak"}, nil, "test.toml")
+	appendConfig(opts, cfgFile, []string{}, []string{"com.nonexistent.flatpak"}, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -203,7 +203,7 @@ func TestAppendConfigBothExist(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, []string{"sh"}, []string{"app.zen_browser.zen"}, nil, "test.toml")
+	appendConfig(opts, cfgFile, []string{"sh"}, []string{"app.zen_browser.zen"}, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -244,7 +244,7 @@ func TestAppendConfigNeitherExists(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{"com.nonexistent.flatpak"}, nil, "test.toml")
+	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{"com.nonexistent.flatpak"}, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -281,7 +281,7 @@ func TestAppendConfigNoChecks(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir}
 
-	appendConfig(opts, cfgFile, nil, nil, nil, "test.toml")
+	appendConfig(opts, cfgFile, nil, nil, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -312,7 +312,7 @@ func TestAppendConfigFileDoesNotExist(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir}
 
-	appendConfig(opts, cfgFile, nil, nil, nil, "nonexistent.toml")
+	appendConfig(opts, cfgFile, nil, nil, "nonexistent.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -487,90 +487,3 @@ func TestBuildMergedConfigSkipsMangowcWithoutActiveSession(t *testing.T) {
 	}
 	assert.NotContains(t, string(output), "[templates.dmsmango]")
 }
-
-func TestAppendConfigConfigDirExists(t *testing.T) {
-	tempDir := t.TempDir()
-
-	shellDir := filepath.Join(tempDir, "shell")
-	configsDir := filepath.Join(shellDir, "matugen", "configs")
-	if err := os.MkdirAll(configsDir, 0o755); err != nil {
-		t.Fatalf("failed to create configs dir: %v", err)
-	}
-
-	testConfig := "vencord config content"
-	if err := os.WriteFile(filepath.Join(configsDir, "vencord.toml"), []byte(testConfig), 0o644); err != nil {
-		t.Fatalf("failed to write config: %v", err)
-	}
-
-	configHome := filepath.Join(tempDir, "config")
-	if err := os.MkdirAll(filepath.Join(configHome, "Vencord"), 0o755); err != nil {
-		t.Fatalf("failed to create Vencord config dir: %v", err)
-	}
-	t.Setenv("XDG_CONFIG_HOME", configHome)
-
-	outFile := filepath.Join(tempDir, "output.toml")
-	cfgFile, err := os.Create(outFile)
-	if err != nil {
-		t.Fatalf("failed to create output file: %v", err)
-	}
-	defer cfgFile.Close()
-
-	mockChecker := mocks_utils.NewMockAppChecker(t)
-	mockChecker.EXPECT().AnyCommandExists("nonexistent-binary-12345").Return(false)
-	mockChecker.EXPECT().AnyFlatpakExists("com.nonexistent.flatpak").Return(false)
-
-	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
-
-	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{"com.nonexistent.flatpak"}, []string{"Vencord"}, "vencord.toml")
-
-	cfgFile.Close()
-	output, err := os.ReadFile(outFile)
-	if err != nil {
-		t.Fatalf("failed to read output: %v", err)
-	}
-
-	assert.Equal(t, testConfig+"\n", string(output))
-}
-
-func TestAppendConfigConfigDirDoesNotExist(t *testing.T) {
-	tempDir := t.TempDir()
-
-	shellDir := filepath.Join(tempDir, "shell")
-	configsDir := filepath.Join(shellDir, "matugen", "configs")
-	if err := os.MkdirAll(configsDir, 0o755); err != nil {
-		t.Fatalf("failed to create configs dir: %v", err)
-	}
-
-	if err := os.WriteFile(filepath.Join(configsDir, "vencord.toml"), []byte("vencord config content"), 0o644); err != nil {
-		t.Fatalf("failed to write config: %v", err)
-	}
-
-	configHome := filepath.Join(tempDir, "config")
-	if err := os.MkdirAll(configHome, 0o755); err != nil {
-		t.Fatalf("failed to create config home: %v", err)
-	}
-	t.Setenv("XDG_CONFIG_HOME", configHome)
-
-	outFile := filepath.Join(tempDir, "output.toml")
-	cfgFile, err := os.Create(outFile)
-	if err != nil {
-		t.Fatalf("failed to create output file: %v", err)
-	}
-	defer cfgFile.Close()
-
-	mockChecker := mocks_utils.NewMockAppChecker(t)
-	mockChecker.EXPECT().AnyCommandExists("nonexistent-binary-12345").Return(false)
-	mockChecker.EXPECT().AnyFlatpakExists("com.nonexistent.flatpak").Return(false)
-
-	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
-
-	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{"com.nonexistent.flatpak"}, []string{"Vencord"}, "vencord.toml")
-
-	cfgFile.Close()
-	output, err := os.ReadFile(outFile)
-	if err != nil {
-		t.Fatalf("failed to read output: %v", err)
-	}
-
-	assert.Empty(t, string(output))
-}

core/internal/matugen/signal_freebsd.go

@@ -1,16 +0,0 @@
-package matugen
-
-import (
-	"os/exec"
-	"strings"
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-// procfs(5) is optional on FreeBSD; pkill(1) from base queries the kernel
-// directly.
-func signalByName(name string, sig syscall.Signal) {
-	signame := strings.TrimPrefix(unix.SignalName(sig), "SIG")
-	exec.Command("pkill", "-"+signame, "-x", name).Run()
-}

core/internal/matugen/signal_linux.go

@@ -1,29 +0,0 @@
-package matugen
-
-import (
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"syscall"
-)
-
-func signalByName(name string, sig syscall.Signal) {
-	entries, err := os.ReadDir("/proc")
-	if err != nil {
-		return
-	}
-	for _, entry := range entries {
-		pid, err := strconv.Atoi(entry.Name())
-		if err != nil {
-			continue
-		}
-		comm, err := os.ReadFile(filepath.Join("/proc", entry.Name(), "comm"))
-		if err != nil {
-			continue
-		}
-		if strings.TrimSpace(string(comm)) == name {
-			syscall.Kill(pid, sig)
-		}
-	}
-}

core/internal/mocks/wlclient/mock_WaylandDisplay.go

@@ -5,7 +5,7 @@
 package mocks_wlclient
 
 import (
-	"github.com/AvengeMedia/dankgo/wayland/client"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 	mock "github.com/stretchr/testify/mock"
 )
 

core/internal/mocks/wlcontext/mock_WaylandContext.go

@@ -5,7 +5,7 @@
 package mocks_wlcontext
 
 import (
-	"github.com/AvengeMedia/dankgo/wayland/client"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 	mock "github.com/stretchr/testify/mock"
 )
 

core/internal/pam/pam.go

@@ -5,20 +5,30 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
+	"time"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
 )
 
 const (
+	GreeterPamManagedBlockStart = "# BEGIN DMS GREETER AUTH (managed by dms greeter sync)"
+	GreeterPamManagedBlockEnd   = "# END DMS GREETER AUTH"
+
 	LockscreenPamManagedBlockStart = "# BEGIN DMS LOCKSCREEN AUTH (managed by dms greeter sync)"
 	LockscreenPamManagedBlockEnd   = "# END DMS LOCKSCREEN AUTH"
 
 	LockscreenU2FPamManagedBlockStart = "# BEGIN DMS LOCKSCREEN U2F AUTH (managed by dms auth sync)"
 	LockscreenU2FPamManagedBlockEnd   = "# END DMS LOCKSCREEN U2F AUTH"
 
+	legacyGreeterPamFprintComment = "# DMS greeter fingerprint"
+	legacyGreeterPamU2FComment    = "# DMS greeter U2F"
+
+	GreetdPamPath       = "/etc/pam.d/greetd"
 	DankshellPamPath    = "/etc/pam.d/dankshell"
 	DankshellU2FPamPath = "/etc/pam.d/dankshell-u2f"
 )
@@ -28,8 +38,7 @@ const (
 // rest cover distros (or minimal installs) with no /etc/pam.d/login.
 // lockscreenPamBaseDirs mirrors libpam's search order: /etc overrides, then the
 // vendor dir (/usr/lib) and the stateless-distro default (/usr/share).
-// /usr/local/etc/pam.d is OpenPAM's ports dir on FreeBSD (openpam_configure).
-var lockscreenPamBaseDirs = []string{"/etc/pam.d", "/usr/lib/pam.d", "/usr/share/pam.d", "/usr/local/etc/pam.d"}
+var lockscreenPamBaseDirs = []string{"/etc/pam.d", "/usr/lib/pam.d", "/usr/share/pam.d"}
 
 // Standalone auth+account services, most universal first. login exists almost
 // everywhere (util-linux); system-* cover Fedora/Arch/Gentoo/SUSE-Leap.
@@ -41,15 +50,13 @@ var lockscreenPamEntryCandidates = []string{
 }
 
 // Fallback for distros with no standalone login service, only shared building
-// blocks: openSUSE/Debian (common-*), Alpine/postmarketOS (base-*), FreeBSD
-// (system holds both stanzas, included by login).
+// blocks: openSUSE/Debian (common-*), Alpine/postmarketOS (base-*).
 var lockscreenPamSharedIncludePairs = []struct {
 	auth    string
 	account string
 }{
 	{auth: "common-auth", account: "common-account"},
 	{auth: "base-auth", account: "base-account"},
-	{auth: "system", account: "system"},
 }
 
 var includedPamAuthFiles = []string{
@@ -60,28 +67,34 @@ var includedPamAuthFiles = []string{
 	"system-local-login",
 	"common-auth-pc",
 	"login",
-	"system",
 }
 
 type AuthSettings struct {
-	EnableFprint bool `json:"enableFprint"`
-	EnableU2f    bool `json:"enableU2f"`
+	EnableFprint                bool `json:"enableFprint"`
+	EnableU2f                   bool `json:"enableU2f"`
+	GreeterEnableFprint         bool `json:"greeterEnableFprint"`
+	GreeterEnableU2f            bool `json:"greeterEnableU2f"`
+	GreeterPamExternallyManaged bool `json:"greeterPamExternallyManaged"`
 }
 
 type SyncAuthOptions struct {
-	HomeDir string
+	HomeDir          string
+	ForceGreeterAuth bool
 }
 
 type syncDeps struct {
-	pamDir           string
-	dankshellPath    string
-	dankshellU2fPath string
-	isNixOS          func() bool
-	readFile         func(string) ([]byte, error)
-	stat             func(string) (os.FileInfo, error)
-	createTemp       func(string, string) (*os.File, error)
-	removeFile       func(string) error
-	runSudoCmd       func(string, string, ...string) error
+	pamDir                             string
+	greetdPath                         string
+	dankshellPath                      string
+	dankshellU2fPath                   string
+	isNixOS                            func() bool
+	readFile                           func(string) ([]byte, error)
+	stat                               func(string) (os.FileInfo, error)
+	createTemp                         func(string, string) (*os.File, error)
+	removeFile                         func(string) error
+	runSudoCmd                         func(string, string, ...string) error
+	pamModuleExists                    func(string) bool
+	fingerprintAvailableForCurrentUser func() bool
 }
 
 type lockscreenPamIncludeDirective struct {
@@ -137,6 +150,7 @@ func (r lockscreenPamResolver) locate(target string) (string, error) {
 func defaultSyncDeps() syncDeps {
 	return syncDeps{
 		pamDir:           "/etc/pam.d",
+		greetdPath:       GreetdPamPath,
 		dankshellPath:    DankshellPamPath,
 		dankshellU2fPath: DankshellU2FPamPath,
 		isNixOS:          IsNixOS,
@@ -147,6 +161,8 @@ func defaultSyncDeps() syncDeps {
 		runSudoCmd: func(password, command string, args ...string) error {
 			return privesc.Run(context.Background(), password, append([]string{command}, args...)...)
 		},
+		pamModuleExists:                    pamModuleExists,
+		fingerprintAvailableForCurrentUser: FingerprintAuthAvailableForCurrentUser,
 	}
 }
 
@@ -175,10 +191,22 @@ func ReadAuthSettings(homeDir string) (AuthSettings, error) {
 	return settings, nil
 }
 
+func ReadGreeterAuthToggles(homeDir string) (enableFprint bool, enableU2f bool, err error) {
+	settings, err := ReadAuthSettings(homeDir)
+	if err != nil {
+		return false, false, err
+	}
+	return settings.GreeterEnableFprint, settings.GreeterEnableU2f, nil
+}
+
 func SyncAuthConfig(logFunc func(string), sudoPassword string, options SyncAuthOptions) error {
 	return syncAuthConfigWithDeps(logFunc, sudoPassword, options, defaultSyncDeps())
 }
 
+func RemoveManagedGreeterPamBlock(logFunc func(string), sudoPassword string) error {
+	return removeManagedGreeterPamBlockWithDeps(logFunc, sudoPassword, defaultSyncDeps())
+}
+
 func syncAuthConfigWithDeps(logFunc func(string), sudoPassword string, options SyncAuthOptions, deps syncDeps) error {
 	homeDir := strings.TrimSpace(options.HomeDir)
 	if homeDir == "" {
@@ -201,9 +229,99 @@ func syncAuthConfigWithDeps(logFunc func(string), sudoPassword string, options S
 		return err
 	}
 
+	if _, err := deps.stat(deps.greetdPath); err != nil {
+		if os.IsNotExist(err) {
+			logFunc("ℹ /etc/pam.d/greetd not found. Skipping greeter PAM sync.")
+			return nil
+		}
+		return fmt.Errorf("failed to inspect %s: %w", deps.greetdPath, err)
+	}
+
+	if settings.GreeterPamExternallyManaged {
+		if err := removeManagedGreeterPamBlockWithDeps(logFunc, sudoPassword, deps); err != nil {
+			return err
+		}
+		logFunc("ℹ /etc/pam.d/greetd is externally managed. Skipping DMS greeter PAM sync.")
+		return nil
+	}
+
+	if err := syncGreeterPamConfigWithDeps(logFunc, sudoPassword, settings, options.ForceGreeterAuth, deps); err != nil {
+		return err
+	}
+
 	return nil
 }
 
+func removeManagedGreeterPamBlockWithDeps(logFunc func(string), sudoPassword string, deps syncDeps) error {
+	if deps.isNixOS() {
+		return nil
+	}
+
+	data, err := deps.readFile(deps.greetdPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return fmt.Errorf("failed to read %s: %w", deps.greetdPath, err)
+	}
+
+	originalContent := string(data)
+	stripped, removed := stripManagedGreeterPamBlock(originalContent)
+	strippedAgain, removedLegacy := stripLegacyGreeterPamLines(stripped)
+	if !removed && !removedLegacy {
+		return nil
+	}
+
+	if err := writeManagedPamFile(strippedAgain, deps.greetdPath, sudoPassword, deps); err != nil {
+		return fmt.Errorf("failed to write %s: %w", deps.greetdPath, err)
+	}
+
+	logFunc("✓ Removed DMS managed PAM block from " + deps.greetdPath)
+	return nil
+}
+
+func ParseManagedGreeterPamAuth(pamText string) (managed bool, fingerprint bool, u2f bool, legacy bool) {
+	if pamText == "" {
+		return false, false, false, false
+	}
+
+	lines := strings.Split(pamText, "\n")
+	inManaged := false
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		switch trimmed {
+		case GreeterPamManagedBlockStart:
+			managed = true
+			inManaged = true
+			continue
+		case GreeterPamManagedBlockEnd:
+			inManaged = false
+			continue
+		}
+
+		if strings.HasPrefix(trimmed, legacyGreeterPamFprintComment) || strings.HasPrefix(trimmed, legacyGreeterPamU2FComment) {
+			legacy = true
+		}
+		if !inManaged {
+			continue
+		}
+		if strings.Contains(trimmed, "pam_fprintd") {
+			fingerprint = true
+		}
+		if strings.Contains(trimmed, "pam_u2f") {
+			u2f = true
+		}
+	}
+
+	return managed, fingerprint, u2f, legacy
+}
+
+func StripManagedGreeterPamContent(pamText string) (string, bool) {
+	stripped, removed := stripManagedGreeterPamBlock(pamText)
+	stripped, removedLegacy := stripLegacyGreeterPamLines(stripped)
+	return stripped, removed || removedLegacy
+}
+
 func PamTextIncludesFile(pamText, filename string) bool {
 	lines := strings.Split(pamText, "\n")
 	for _, line := range lines {
@@ -912,6 +1030,186 @@ func syncLockscreenU2FPamConfigWithDeps(logFunc func(string), sudoPassword strin
 	return nil
 }
 
+func stripManagedGreeterPamBlock(content string) (string, bool) {
+	lines := strings.Split(content, "\n")
+	filtered := make([]string, 0, len(lines))
+	inManagedBlock := false
+	removed := false
+
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == GreeterPamManagedBlockStart {
+			inManagedBlock = true
+			removed = true
+			continue
+		}
+		if trimmed == GreeterPamManagedBlockEnd {
+			inManagedBlock = false
+			removed = true
+			continue
+		}
+		if inManagedBlock {
+			removed = true
+			continue
+		}
+		filtered = append(filtered, line)
+	}
+
+	return strings.Join(filtered, "\n"), removed
+}
+
+func stripLegacyGreeterPamLines(content string) (string, bool) {
+	lines := strings.Split(content, "\n")
+	filtered := make([]string, 0, len(lines))
+	removed := false
+
+	for i := 0; i < len(lines); i++ {
+		trimmed := strings.TrimSpace(lines[i])
+		if strings.HasPrefix(trimmed, legacyGreeterPamFprintComment) || strings.HasPrefix(trimmed, legacyGreeterPamU2FComment) {
+			removed = true
+			if i+1 < len(lines) {
+				nextLine := strings.TrimSpace(lines[i+1])
+				if strings.HasPrefix(nextLine, "auth") &&
+					(strings.Contains(nextLine, "pam_fprintd") || strings.Contains(nextLine, "pam_u2f")) {
+					i++
+				}
+			}
+			continue
+		}
+		filtered = append(filtered, lines[i])
+	}
+
+	return strings.Join(filtered, "\n"), removed
+}
+
+func insertManagedGreeterPamBlock(content string, blockLines []string, greetdPamPath string) (string, error) {
+	lines := strings.Split(content, "\n")
+	for i, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed != "" && !strings.HasPrefix(trimmed, "#") && strings.HasPrefix(trimmed, "auth") {
+			block := strings.Join(blockLines, "\n")
+			prefix := strings.Join(lines[:i], "\n")
+			suffix := strings.Join(lines[i:], "\n")
+			switch {
+			case prefix == "":
+				return block + "\n" + suffix, nil
+			case suffix == "":
+				return prefix + "\n" + block, nil
+			default:
+				return prefix + "\n" + block + "\n" + suffix, nil
+			}
+		}
+	}
+	return "", fmt.Errorf("no auth directive found in %s", greetdPamPath)
+}
+
+func syncGreeterPamConfigWithDeps(logFunc func(string), sudoPassword string, settings AuthSettings, forceAuth bool, deps syncDeps) error {
+	var wantFprint, wantU2f bool
+	fprintToggleEnabled := forceAuth
+	u2fToggleEnabled := forceAuth
+	if forceAuth {
+		wantFprint = deps.pamModuleExists("pam_fprintd.so")
+		wantU2f = deps.pamModuleExists("pam_u2f.so")
+	} else {
+		fprintToggleEnabled = settings.GreeterEnableFprint
+		u2fToggleEnabled = settings.GreeterEnableU2f
+		fprintModule := deps.pamModuleExists("pam_fprintd.so")
+		u2fModule := deps.pamModuleExists("pam_u2f.so")
+		wantFprint = settings.GreeterEnableFprint && fprintModule
+		wantU2f = settings.GreeterEnableU2f && u2fModule
+		if settings.GreeterEnableFprint && !fprintModule {
+			logFunc("⚠ Warning: greeter fingerprint toggle is enabled, but pam_fprintd.so was not found.")
+		}
+		if settings.GreeterEnableU2f && !u2fModule {
+			logFunc("⚠ Warning: greeter security key toggle is enabled, but pam_u2f.so was not found.")
+		}
+	}
+
+	if deps.isNixOS() {
+		logFunc("ℹ NixOS detected: PAM config is managed by NixOS modules. Skipping DMS PAM block write.")
+		logFunc("  Configure fingerprint/U2F auth via your greetd NixOS module options (e.g. security.pam.services.greetd).")
+		return nil
+	}
+
+	pamData, err := deps.readFile(deps.greetdPath)
+	if err != nil {
+		return fmt.Errorf("failed to read %s: %w", deps.greetdPath, err)
+	}
+	originalContent := string(pamData)
+	content, _ := stripManagedGreeterPamBlock(originalContent)
+	content, _ = stripLegacyGreeterPamLines(content)
+
+	includedFprintFile := detectIncludedPamModule(content, "pam_fprintd.so", deps)
+	includedU2fFile := detectIncludedPamModule(content, "pam_u2f.so", deps)
+	fprintAvailableForCurrentUser := deps.fingerprintAvailableForCurrentUser()
+	if wantFprint && includedFprintFile != "" {
+		logFunc("⚠ pam_fprintd already present in included " + includedFprintFile + " (managed by authselect/pam-auth-update). Skipping DMS fprint block to avoid double-fingerprint auth.")
+		wantFprint = false
+	}
+	if wantU2f && includedU2fFile != "" {
+		logFunc("⚠ pam_u2f already present in included " + includedU2fFile + " (managed by authselect/pam-auth-update). Skipping DMS U2F block to avoid double security-key auth.")
+		wantU2f = false
+	}
+	if !wantFprint && includedFprintFile != "" {
+		if fprintToggleEnabled {
+			logFunc("ℹ Fingerprint auth is still enabled via included " + includedFprintFile + ".")
+			if fprintAvailableForCurrentUser {
+				logFunc("  DMS toggle is enabled, and effective auth is provided by the included PAM stack.")
+			} else {
+				logFunc("  No enrolled fingerprints detected for the current user; password auth remains the effective path.")
+			}
+		} else {
+			if fprintAvailableForCurrentUser {
+				logFunc("ℹ Fingerprint auth is active via included " + includedFprintFile + " while DMS fingerprint toggle is off.")
+				logFunc("  Password login will work but may be delayed while the fingerprint module runs first.")
+				logFunc("  To eliminate the delay, " + pamManagerHintForCurrentDistro())
+			} else {
+				logFunc("ℹ pam_fprintd is present via included " + includedFprintFile + ", but no enrolled fingerprints were detected for the current user.")
+				logFunc("  Password auth remains the effective login path.")
+			}
+		}
+	}
+	if !wantU2f && includedU2fFile != "" {
+		if u2fToggleEnabled {
+			logFunc("ℹ Security-key auth is still enabled via included " + includedU2fFile + ".")
+			logFunc("  DMS toggle is enabled, but effective auth is provided by the included PAM stack.")
+		} else {
+			logFunc("⚠ Security-key auth is active via included " + includedU2fFile + " while DMS security-key toggle is off.")
+			logFunc("  " + pamManagerHintForCurrentDistro())
+		}
+	}
+
+	if wantFprint || wantU2f {
+		blockLines := []string{GreeterPamManagedBlockStart}
+		if wantFprint {
+			blockLines = append(blockLines, "auth sufficient pam_fprintd.so max-tries=2 timeout=10")
+		}
+		if wantU2f {
+			blockLines = append(blockLines, "auth sufficient pam_u2f.so cue nouserok timeout=10")
+		}
+		blockLines = append(blockLines, GreeterPamManagedBlockEnd)
+
+		content, err = insertManagedGreeterPamBlock(content, blockLines, deps.greetdPath)
+		if err != nil {
+			return err
+		}
+	}
+
+	if content == originalContent {
+		return nil
+	}
+
+	if err := writeManagedPamFile(content, deps.greetdPath, sudoPassword, deps); err != nil {
+		return fmt.Errorf("failed to install updated PAM config at %s: %w", deps.greetdPath, err)
+	}
+	if wantFprint || wantU2f {
+		logFunc("✓ Configured greetd PAM for fingerprint/U2F")
+	} else {
+		logFunc("✓ Cleared DMS-managed greeter PAM auth block")
+	}
+	return nil
+}
+
 func writeManagedPamFile(content string, destPath string, sudoPassword string, deps syncDeps) error {
 	tmpFile, err := deps.createTemp("", "dms-pam-*.conf")
 	if err != nil {
@@ -938,6 +1236,26 @@ func writeManagedPamFile(content string, destPath string, sudoPassword string, d
 	return nil
 }
 
+func pamManagerHintForCurrentDistro() string {
+	osInfo, err := distros.GetOSInfo()
+	if err != nil {
+		return "Disable it in your PAM manager (authselect/pam-auth-update) or in the included PAM stack to force password-only greeter login."
+	}
+	config, exists := distros.Registry[osInfo.Distribution.ID]
+	if !exists {
+		return "Disable it in your PAM manager (authselect/pam-auth-update) or in the included PAM stack to force password-only greeter login."
+	}
+
+	switch config.Family {
+	case distros.FamilyFedora:
+		return "Disable it in authselect to force password-only greeter login."
+	case distros.FamilyDebian, distros.FamilyUbuntu:
+		return "Disable it in pam-auth-update to force password-only greeter login."
+	default:
+		return "Disable it in your distro PAM manager (authselect/pam-auth-update) or in the included PAM stack to force password-only greeter login."
+	}
+}
+
 func pamModuleExists(module string) bool {
 	for _, libDir := range []string{
 		"/usr/lib64/security",
@@ -950,9 +1268,6 @@ func pamModuleExists(module string) bool {
 		"/usr/lib/aarch64-linux-gnu/security",
 		"/run/current-system/sw/lib64/security",
 		"/run/current-system/sw/lib/security",
-		"/usr/local/lib/security",
-		"/usr/local/lib",
-		"/usr/lib",
 	} {
 		if _, err := os.Stat(filepath.Join(libDir, module)); err == nil {
 			return true
@@ -960,3 +1275,60 @@ func pamModuleExists(module string) bool {
 	}
 	return false
 }
+
+func hasEnrolledFingerprintOutput(output string) bool {
+	lower := strings.ToLower(output)
+	if strings.Contains(lower, "no fingers enrolled") ||
+		strings.Contains(lower, "no fingerprints enrolled") ||
+		strings.Contains(lower, "no prints enrolled") {
+		return false
+	}
+	if strings.Contains(lower, "has fingers enrolled") ||
+		strings.Contains(lower, "has fingerprints enrolled") {
+		return true
+	}
+	for _, line := range strings.Split(lower, "\n") {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "finger:") {
+			return true
+		}
+		if strings.HasPrefix(trimmed, "- ") && strings.Contains(trimmed, "finger") {
+			return true
+		}
+	}
+	return false
+}
+
+func FingerprintAuthAvailableForCurrentUser() bool {
+	username := strings.TrimSpace(os.Getenv("SUDO_USER"))
+	if username == "" {
+		username = strings.TrimSpace(os.Getenv("USER"))
+	}
+	if username == "" {
+		out, err := exec.Command("id", "-un").Output()
+		if err == nil {
+			username = strings.TrimSpace(string(out))
+		}
+	}
+	return fingerprintAuthAvailableForUser(username)
+}
+
+func fingerprintAuthAvailableForUser(username string) bool {
+	username = strings.TrimSpace(username)
+	if username == "" {
+		return false
+	}
+	if !pamModuleExists("pam_fprintd.so") {
+		return false
+	}
+	if _, err := exec.LookPath("fprintd-list"); err != nil {
+		return false
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, "fprintd-list", username).CombinedOutput()
+	if err != nil {
+		return false
+	}
+	return hasEnrolledFingerprintOutput(string(out))
+}

core/internal/pam/pam_test.go

@@ -18,6 +18,42 @@ func writeTestFile(t *testing.T, path string, content string) {
 	}
 }
 
+type pamTestEnv struct {
+	pamDir               string
+	greetdPath           string
+	dankshellPath        string
+	dankshellU2fPath     string
+	tmpDir               string
+	homeDir              string
+	availableModules     map[string]bool
+	fingerprintAvailable bool
+}
+
+func newPamTestEnv(t *testing.T) *pamTestEnv {
+	t.Helper()
+
+	root := t.TempDir()
+	pamDir := filepath.Join(root, "pam.d")
+	tmpDir := filepath.Join(root, "tmp")
+	homeDir := filepath.Join(root, "home")
+
+	for _, dir := range []string{pamDir, tmpDir, homeDir} {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatalf("failed to create %s: %v", dir, err)
+		}
+	}
+
+	return &pamTestEnv{
+		pamDir:           pamDir,
+		greetdPath:       filepath.Join(pamDir, "greetd"),
+		dankshellPath:    filepath.Join(pamDir, "dankshell"),
+		dankshellU2fPath: filepath.Join(pamDir, "dankshell-u2f"),
+		tmpDir:           tmpDir,
+		homeDir:          homeDir,
+		availableModules: map[string]bool{},
+	}
+}
+
 func (e *pamTestEnv) writePamFile(t *testing.T, name string, content string) {
 	t.Helper()
 	writeTestFile(t, filepath.Join(e.pamDir, name), content)
@@ -28,6 +64,59 @@ func (e *pamTestEnv) writeSettings(t *testing.T, content string) {
 	writeTestFile(t, filepath.Join(e.homeDir, ".config", "DankMaterialShell", "settings.json"), content)
 }
 
+func (e *pamTestEnv) deps(isNixOS bool) syncDeps {
+	return syncDeps{
+		pamDir:           e.pamDir,
+		greetdPath:       e.greetdPath,
+		dankshellPath:    e.dankshellPath,
+		dankshellU2fPath: e.dankshellU2fPath,
+		isNixOS:          func() bool { return isNixOS },
+		readFile:         os.ReadFile,
+		stat:             os.Stat,
+		createTemp: func(_ string, pattern string) (*os.File, error) {
+			return os.CreateTemp(e.tmpDir, pattern)
+		},
+		removeFile: os.Remove,
+		runSudoCmd: func(_ string, command string, args ...string) error {
+			switch command {
+			case "cp":
+				if len(args) != 2 {
+					return fmt.Errorf("unexpected cp args: %v", args)
+				}
+				data, err := os.ReadFile(args[0])
+				if err != nil {
+					return err
+				}
+				if err := os.MkdirAll(filepath.Dir(args[1]), 0o755); err != nil {
+					return err
+				}
+				return os.WriteFile(args[1], data, 0o644)
+			case "chmod":
+				if len(args) != 2 {
+					return fmt.Errorf("unexpected chmod args: %v", args)
+				}
+				return nil
+			case "rm":
+				if len(args) != 2 || args[0] != "-f" {
+					return fmt.Errorf("unexpected rm args: %v", args)
+				}
+				if err := os.Remove(args[1]); err != nil && !os.IsNotExist(err) {
+					return err
+				}
+				return nil
+			default:
+				return fmt.Errorf("unexpected sudo command: %s %v", command, args)
+			}
+		},
+		pamModuleExists: func(module string) bool {
+			return e.availableModules[module]
+		},
+		fingerprintAvailableForCurrentUser: func() bool {
+			return e.fingerprintAvailable
+		},
+	}
+}
+
 func readFileString(t *testing.T, path string) string {
 	t.Helper()
 	data, err := os.ReadFile(path)
@@ -614,6 +703,98 @@ func TestSyncLockscreenU2FPamConfigWithDeps(t *testing.T) {
 	})
 }
 
+func TestSyncGreeterPamConfigWithDeps(t *testing.T) {
+	t.Parallel()
+
+	t.Run("adds managed block for enabled auth modules", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.availableModules["pam_u2f.so"] = true
+		env.writePamFile(t, "greetd", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so\naccount required pam_unix.so\n")
+
+		settings := AuthSettings{GreeterEnableFprint: true, GreeterEnableU2f: true}
+		if err := syncGreeterPamConfigWithDeps(func(string) {}, "", settings, false, env.deps(false)); err != nil {
+			t.Fatalf("syncGreeterPamConfigWithDeps returned error: %v", err)
+		}
+
+		got := readFileString(t, env.greetdPath)
+		for _, want := range []string{
+			GreeterPamManagedBlockStart,
+			"auth sufficient pam_fprintd.so max-tries=2 timeout=10",
+			"auth sufficient pam_u2f.so cue nouserok timeout=10",
+			GreeterPamManagedBlockEnd,
+		} {
+			if !strings.Contains(got, want) {
+				t.Errorf("missing expected string %q in greetd PAM:\n%s", want, got)
+			}
+		}
+		if strings.Index(got, GreeterPamManagedBlockStart) > strings.Index(got, "auth include system-auth") {
+			t.Fatalf("managed block was not inserted before first auth line:\n%s", got)
+		}
+	})
+
+	t.Run("avoids duplicate fingerprint when included stack already provides it", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.fingerprintAvailable = true
+		original := "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n"
+		env.writePamFile(t, "greetd", original)
+		env.writePamFile(t, "system-auth", "auth sufficient pam_fprintd.so max-tries=1\nauth sufficient pam_unix.so\n")
+
+		settings := AuthSettings{GreeterEnableFprint: true}
+		if err := syncGreeterPamConfigWithDeps(func(string) {}, "", settings, false, env.deps(false)); err != nil {
+			t.Fatalf("syncGreeterPamConfigWithDeps returned error: %v", err)
+		}
+
+		got := readFileString(t, env.greetdPath)
+		if got != original {
+			t.Fatalf("greetd PAM changed despite included pam_fprintd stack\ngot:\n%s\nwant:\n%s", got, original)
+		}
+		if strings.Contains(got, GreeterPamManagedBlockStart) {
+			t.Fatalf("managed block should not be inserted when included stack already has pam_fprintd:\n%s", got)
+		}
+	})
+}
+
+func TestRemoveManagedGreeterPamBlockWithDeps(t *testing.T) {
+	t.Parallel()
+
+	env := newPamTestEnv(t)
+	env.writePamFile(t, "greetd", "#%PAM-1.0\n"+
+		legacyGreeterPamFprintComment+"\n"+
+		"auth sufficient pam_fprintd.so max-tries=1\n"+
+		GreeterPamManagedBlockStart+"\n"+
+		"auth sufficient pam_u2f.so cue nouserok timeout=10\n"+
+		GreeterPamManagedBlockEnd+"\n"+
+		"auth include system-auth\n")
+
+	if err := removeManagedGreeterPamBlockWithDeps(func(string) {}, "", env.deps(false)); err != nil {
+		t.Fatalf("removeManagedGreeterPamBlockWithDeps returned error: %v", err)
+	}
+
+	got := readFileString(t, env.greetdPath)
+	if strings.Contains(got, GreeterPamManagedBlockStart) || strings.Contains(got, legacyGreeterPamFprintComment) {
+		t.Fatalf("managed or legacy DMS auth lines remained in greetd PAM:\n%s", got)
+	}
+	if !strings.Contains(got, "auth include system-auth") {
+		t.Fatalf("expected non-DMS greetd auth lines to remain:\n%s", got)
+	}
+}
+
+func (e *pamTestEnv) validateDeps() lockscreenPamValidateDeps {
+	return lockscreenPamValidateDeps{
+		baseDirs:        []string{e.pamDir},
+		readFile:        os.ReadFile,
+		stat:            os.Stat,
+		pamModuleExists: func(module string) bool { return e.availableModules[module] },
+	}
+}
+
 func TestListLockscreenPamServices(t *testing.T) {
 	t.Parallel()
 
@@ -900,98 +1081,10 @@ func containsSubstr(items []string, substr string) bool {
 	return false
 }
 
-type pamTestEnv struct {
-	pamDir           string
-	dankshellPath    string
-	dankshellU2fPath string
-	tmpDir           string
-	homeDir          string
-	availableModules map[string]bool
-}
-
-func newPamTestEnv(t *testing.T) *pamTestEnv {
-	t.Helper()
-
-	root := t.TempDir()
-	pamDir := filepath.Join(root, "pam.d")
-	tmpDir := filepath.Join(root, "tmp")
-	homeDir := filepath.Join(root, "home")
-
-	for _, dir := range []string{pamDir, tmpDir, homeDir} {
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			t.Fatalf("failed to create %s: %v", dir, err)
-		}
-	}
-
-	return &pamTestEnv{
-		pamDir:           pamDir,
-		dankshellPath:    filepath.Join(pamDir, "dankshell"),
-		dankshellU2fPath: filepath.Join(pamDir, "dankshell-u2f"),
-		tmpDir:           tmpDir,
-		homeDir:          homeDir,
-		availableModules: map[string]bool{},
-	}
-}
-
-func (e *pamTestEnv) deps(isNixOS bool) syncDeps {
-	return syncDeps{
-		pamDir:           e.pamDir,
-		dankshellPath:    e.dankshellPath,
-		dankshellU2fPath: e.dankshellU2fPath,
-		isNixOS:          func() bool { return isNixOS },
-		readFile:         os.ReadFile,
-		stat:             os.Stat,
-		createTemp: func(_ string, pattern string) (*os.File, error) {
-			return os.CreateTemp(e.tmpDir, pattern)
-		},
-		removeFile: os.Remove,
-		runSudoCmd: func(_ string, command string, args ...string) error {
-			switch command {
-			case "cp":
-				if len(args) != 2 {
-					return fmt.Errorf("unexpected cp args: %v", args)
-				}
-				data, err := os.ReadFile(args[0])
-				if err != nil {
-					return err
-				}
-				if err := os.MkdirAll(filepath.Dir(args[1]), 0o755); err != nil {
-					return err
-				}
-				return os.WriteFile(args[1], data, 0o644)
-			case "chmod":
-				if len(args) != 2 {
-					return fmt.Errorf("unexpected chmod args: %v", args)
-				}
-				return nil
-			case "rm":
-				if len(args) != 2 || args[0] != "-f" {
-					return fmt.Errorf("unexpected rm args: %v", args)
-				}
-				if err := os.Remove(args[1]); err != nil && !os.IsNotExist(err) {
-					return err
-				}
-				return nil
-			default:
-				return fmt.Errorf("unexpected sudo command: %s %v", command, args)
-			}
-		},
-	}
-}
-
-func (e *pamTestEnv) validateDeps() lockscreenPamValidateDeps {
-	return lockscreenPamValidateDeps{
-		baseDirs:        []string{e.pamDir},
-		readFile:        os.ReadFile,
-		stat:            os.Stat,
-		pamModuleExists: func(module string) bool { return e.availableModules[module] },
-	}
-}
-
 func TestSyncAuthConfigWithDeps(t *testing.T) {
 	t.Parallel()
 
-	t.Run("creates lockscreen targets", func(t *testing.T) {
+	t.Run("creates lockscreen targets and skips greetd when greeter is not installed", func(t *testing.T) {
 		t.Parallel()
 
 		env := newPamTestEnv(t)
@@ -999,7 +1092,10 @@ func TestSyncAuthConfigWithDeps(t *testing.T) {
 		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
 		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so try_first_pass nullok\naccount required pam_access.so\n")
 
-		err := syncAuthConfigWithDeps(func(string) {}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(false))
+		var logs []string
+		err := syncAuthConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(false))
 		if err != nil {
 			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
 		}
@@ -1010,24 +1106,105 @@ func TestSyncAuthConfigWithDeps(t *testing.T) {
 		if got := readFileString(t, env.dankshellU2fPath); got != buildManagedLockscreenU2FPamContent() {
 			t.Fatalf("unexpected dankshell-u2f content:\n%s", got)
 		}
+		if len(logs) == 0 || !strings.Contains(logs[len(logs)-1], "greetd not found") {
+			t.Fatalf("expected greetd skip log, got %v", logs)
+		}
 	})
 
-	t.Run("removes dankshell-u2f when disabled", func(t *testing.T) {
+	t.Run("separate greeter and lockscreen toggles are respected", func(t *testing.T) {
 		t.Parallel()
 
 		env := newPamTestEnv(t)
-		env.writeSettings(t, `{"enableU2f":false}`)
+		env.availableModules["pam_fprintd.so"] = true
+		env.writeSettings(t, `{"enableU2f":false,"greeterEnableFprint":true,"greeterEnableU2f":false}`)
 		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
 		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so try_first_pass nullok\naccount required pam_access.so\n")
-		env.writePamFile(t, "dankshell-u2f", buildManagedLockscreenU2FPamContent())
+		env.writePamFile(t, "greetd", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
 
 		err := syncAuthConfigWithDeps(func(string) {}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(false))
 		if err != nil {
 			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
 		}
 
+		dankshell := readFileString(t, env.dankshellPath)
+		if strings.Contains(dankshell, "pam_fprintd") || strings.Contains(dankshell, "pam_u2f") {
+			t.Fatalf("lockscreen PAM should strip fingerprint and U2F modules:\n%s", dankshell)
+		}
 		if _, err := os.Stat(env.dankshellU2fPath); !os.IsNotExist(err) {
-			t.Fatalf("expected dankshell-u2f to be removed, stat err = %v", err)
+			t.Fatalf("expected dankshell-u2f to remain absent when enableU2f is false, stat err = %v", err)
+		}
+
+		greetd := readFileString(t, env.greetdPath)
+		if !strings.Contains(greetd, "auth sufficient pam_fprintd.so max-tries=2 timeout=10") {
+			t.Fatalf("expected greetd PAM to receive fingerprint auth block:\n%s", greetd)
+		}
+		if strings.Contains(greetd, "auth sufficient pam_u2f.so cue nouserok timeout=10") {
+			t.Fatalf("did not expect greetd PAM to receive U2F auth block:\n%s", greetd)
+		}
+	})
+
+	t.Run("externally managed greetd is stripped and greeter sync skipped", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.writeSettings(t, `{"greeterPamExternallyManaged":true,"greeterEnableFprint":true}`)
+		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so\naccount required pam_unix.so\n")
+		env.writePamFile(t, "greetd", "#%PAM-1.0\nauth include system-auth\n"+
+			GreeterPamManagedBlockStart+"\n"+
+			"auth sufficient pam_fprintd.so max-tries=2 timeout=10\n"+
+			GreeterPamManagedBlockEnd+"\n")
+
+		var logs []string
+		err := syncAuthConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(false))
+		if err != nil {
+			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
+		}
+
+		greetd := readFileString(t, env.greetdPath)
+		if strings.Contains(greetd, GreeterPamManagedBlockStart) || strings.Contains(greetd, "pam_fprintd") {
+			t.Fatalf("expected DMS-managed block stripped from externally managed greetd:\n%s", greetd)
+		}
+		if !strings.Contains(greetd, "auth include system-auth") {
+			t.Fatalf("expected non-DMS greetd lines to remain:\n%s", greetd)
+		}
+		if !containsSubstr(logs, "externally managed") {
+			t.Fatalf("expected externally-managed skip log, got %v", logs)
+		}
+	})
+
+	t.Run("NixOS remains informational and non-mutating", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.availableModules["pam_u2f.so"] = true
+		env.writeSettings(t, `{"enableU2f":true,"greeterEnableFprint":true,"greeterEnableU2f":true}`)
+		originalGreetd := "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n"
+		env.writePamFile(t, "greetd", originalGreetd)
+
+		var logs []string
+		err := syncAuthConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(true))
+		if err != nil {
+			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
+		}
+
+		if _, err := os.Stat(env.dankshellPath); !os.IsNotExist(err) {
+			t.Fatalf("expected dankshell to remain absent on NixOS path, stat err = %v", err)
+		}
+		if _, err := os.Stat(env.dankshellU2fPath); !os.IsNotExist(err) {
+			t.Fatalf("expected dankshell-u2f to remain absent on NixOS path, stat err = %v", err)
+		}
+		if got := readFileString(t, env.greetdPath); got != originalGreetd {
+			t.Fatalf("expected greetd PAM to remain unchanged on NixOS path\ngot:\n%s\nwant:\n%s", got, originalGreetd)
+		}
+		if len(logs) < 2 || !strings.Contains(strings.Join(logs, "\n"), "NixOS detected") {
+			t.Fatalf("expected informational NixOS logs, got %v", logs)
 		}
 	})
 }

core/internal/plugins/lockfile.go

@@ -1,197 +0,0 @@
-package plugins
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/url"
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"strings"
-
-	"github.com/spf13/afero"
-)
-
-const pluginLockfileVersion = 1
-
-var gitCommitPattern = regexp.MustCompile(`^[0-9a-fA-F]{40}$`)
-
-var scpLikeRepoPattern = regexp.MustCompile(`^[^@:/\s]+@[^@:/\s]+:\S+$`)
-
-type PluginLockfile struct {
-	LockfileVersion int                     `json:"lockfileVersion"`
-	Plugins         map[string]LockedPlugin `json:"plugins"`
-}
-
-type LockedPlugin struct {
-	Repo   string `json:"repo"`
-	Path   string `json:"path,omitempty"`
-	Commit string `json:"commit"`
-}
-
-type LockStore struct {
-	fs   afero.Fs
-	path string
-}
-
-func NewLockStore(fs afero.Fs, path string) *LockStore {
-	return &LockStore{fs: fs, path: path}
-}
-
-func NewPluginLockfile() PluginLockfile {
-	return PluginLockfile{
-		LockfileVersion: pluginLockfileVersion,
-		Plugins:         make(map[string]LockedPlugin),
-	}
-}
-
-func (s *LockStore) Path() string {
-	return s.path
-}
-
-func (s *LockStore) Exists() (bool, error) {
-	return afero.Exists(s.fs, s.path)
-}
-
-func (s *LockStore) Load() (PluginLockfile, error) {
-	data, err := afero.ReadFile(s.fs, s.path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return NewPluginLockfile(), nil
-		}
-		return PluginLockfile{}, fmt.Errorf("failed to read plugin lockfile: %w", err)
-	}
-
-	return ParsePluginLockfile(data)
-}
-
-func ParsePluginLockfile(data []byte) (PluginLockfile, error) {
-	var lock PluginLockfile
-	if err := json.Unmarshal(data, &lock); err != nil {
-		return PluginLockfile{}, fmt.Errorf("failed to parse plugin lockfile: %w", err)
-	}
-	if lock.Plugins == nil {
-		lock.Plugins = make(map[string]LockedPlugin)
-	}
-	if err := lock.Validate(); err != nil {
-		return PluginLockfile{}, err
-	}
-	return lock, nil
-}
-
-func (s *LockStore) Write(lock PluginLockfile) error {
-	if err := lock.Validate(); err != nil {
-		return err
-	}
-
-	data, err := json.MarshalIndent(lock, "", "  ")
-	if err != nil {
-		return fmt.Errorf("failed to encode plugin lockfile: %w", err)
-	}
-	data = append(data, '\n')
-
-	if err := s.fs.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {
-		return fmt.Errorf("failed to create plugin lockfile directory: %w", err)
-	}
-
-	tmpPath := s.path + ".tmp"
-	if err := afero.WriteFile(s.fs, tmpPath, data, 0o644); err != nil {
-		return fmt.Errorf("failed to write temporary plugin lockfile: %w", err)
-	}
-	defer s.fs.Remove(tmpPath) //nolint:errcheck
-
-	if err := s.fs.Rename(tmpPath, s.path); err != nil {
-		return fmt.Errorf("failed to replace plugin lockfile: %w", err)
-	}
-	return nil
-}
-
-func (lock PluginLockfile) Validate() error {
-	if lock.LockfileVersion != pluginLockfileVersion {
-		return fmt.Errorf("unsupported plugin lockfile version %d (expected %d)", lock.LockfileVersion, pluginLockfileVersion)
-	}
-
-	repoCommits := make(map[string]string)
-	for id, plugin := range lock.Plugins {
-		if !isSafePluginPathComponent(id) {
-			return fmt.Errorf("invalid locked plugin id: %q", id)
-		}
-		if strings.TrimSpace(plugin.Repo) == "" {
-			return fmt.Errorf("locked plugin %q has no repository", id)
-		}
-		if err := validatePluginRepo(plugin.Repo); err != nil {
-			return fmt.Errorf("locked plugin %q: %w", id, err)
-		}
-		if !gitCommitPattern.MatchString(plugin.Commit) {
-			return fmt.Errorf("locked plugin %q has invalid commit %q", id, plugin.Commit)
-		}
-		if err := validatePluginRepoPath(plugin.Path); err != nil {
-			return fmt.Errorf("locked plugin %q: %w", id, err)
-		}
-		if commit, ok := repoCommits[plugin.Repo]; ok && !strings.EqualFold(commit, plugin.Commit) {
-			return fmt.Errorf("plugins from repository %q must use the same commit", plugin.Repo)
-		}
-		repoCommits[plugin.Repo] = plugin.Commit
-	}
-	return nil
-}
-
-func validatePluginRepo(repo string) error {
-	parsed, err := url.Parse(repo)
-	if err != nil {
-		if scpLikeRepoPattern.MatchString(repo) {
-			return nil
-		}
-		return fmt.Errorf("invalid repository URL %q", repo)
-	}
-	if parsed.User == nil {
-		return nil
-	}
-	if _, hasPassword := parsed.User.Password(); hasPassword {
-		return fmt.Errorf("repository URL must not contain credentials")
-	}
-	switch parsed.Scheme {
-	case "http", "https":
-		return fmt.Errorf("repository URL must not contain credentials")
-	}
-	return nil
-}
-
-func validatePluginRepoPath(path string) error {
-	if path == "" {
-		return nil
-	}
-	clean := filepath.Clean(path)
-	if filepath.IsAbs(clean) || clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
-		return fmt.Errorf("invalid repository path %q", path)
-	}
-	return nil
-}
-
-func (lock PluginLockfile) IDs() []string {
-	ids := make([]string, 0, len(lock.Plugins))
-	for id := range lock.Plugins {
-		ids = append(ids, id)
-	}
-	sort.Strings(ids)
-	return ids
-}
-
-func (lock *PluginLockfile) SetRepositoryCommit(repo, commit string) {
-	for id, plugin := range lock.Plugins {
-		if plugin.Repo != repo {
-			continue
-		}
-		plugin.Commit = commit
-		lock.Plugins[id] = plugin
-	}
-}
-
-func (lock PluginLockfile) Clone() PluginLockfile {
-	cloned := NewPluginLockfile()
-	for id, plugin := range lock.Plugins {
-		cloned.Plugins[id] = plugin
-	}
-	return cloned
-}

core/internal/plugins/lockfile_test.go

@@ -1,111 +0,0 @@
-package plugins
-
-import (
-	"testing"
-
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const testCommit = "0123456789abcdef0123456789abcdef01234567"
-
-func TestPluginLockfileRoundTrip(t *testing.T) {
-	fs := afero.NewMemMapFs()
-	store := NewLockStore(fs, "/config/plugins.lock.json")
-	lock := NewPluginLockfile()
-	lock.Plugins["weather"] = LockedPlugin{
-		Repo:   "https://github.com/example/plugins.git",
-		Path:   "plugins/weather",
-		Commit: testCommit,
-	}
-
-	require.NoError(t, store.Write(lock))
-	loaded, err := store.Load()
-	require.NoError(t, err)
-	assert.Equal(t, lock, loaded)
-
-	data, err := afero.ReadFile(fs, store.Path())
-	require.NoError(t, err)
-	assert.Equal(t, "{\n  \"lockfileVersion\": 1,\n  \"plugins\": {\n    \"weather\": {\n      \"repo\": \"https://github.com/example/plugins.git\",\n      \"path\": \"plugins/weather\",\n      \"commit\": \"0123456789abcdef0123456789abcdef01234567\"\n    }\n  }\n}\n", string(data))
-}
-
-func TestPluginLockfileValidation(t *testing.T) {
-	tests := []struct {
-		name string
-		lock PluginLockfile
-		want string
-	}{
-		{
-			name: "rejects unsupported version",
-			lock: PluginLockfile{LockfileVersion: 2, Plugins: map[string]LockedPlugin{}},
-			want: "unsupported plugin lockfile version",
-		},
-		{
-			name: "rejects unsafe id",
-			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{"../bad": {Repo: "repo", Commit: testCommit}}},
-			want: "invalid locked plugin id",
-		},
-		{
-			name: "rejects unsafe repository path",
-			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{"bad": {Repo: "repo", Path: "../bad", Commit: testCommit}}},
-			want: "invalid repository path",
-		},
-		{
-			name: "rejects abbreviated commit",
-			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{"bad": {Repo: "repo", Commit: "abc123"}}},
-			want: "invalid commit",
-		},
-		{
-			name: "rejects repository credentials",
-			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{"bad": {Repo: "https://[email protected]/plugin.git", Commit: testCommit}}},
-			want: "must not contain credentials",
-		},
-		{
-			name: "rejects ssh password",
-			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{"bad": {Repo: "ssh://git:[email protected]/plugin.git", Commit: testCommit}}},
-			want: "must not contain credentials",
-		},
-		{
-			name: "rejects conflicting monorepo commits",
-			lock: PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{
-				"one": {Repo: "repo", Commit: testCommit},
-				"two": {Repo: "repo", Commit: "1123456789abcdef0123456789abcdef01234567"},
-			}},
-			want: "must use the same commit",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := tt.lock.Validate()
-			require.Error(t, err)
-			assert.Contains(t, err.Error(), tt.want)
-		})
-	}
-}
-
-func TestPluginLockfileAcceptsSSHRemotes(t *testing.T) {
-	repos := []string{
-		"https://github.com/user/plugin.git",
-		"ssh://[email protected]/user/plugin.git",
-		"[email protected]:user/plugin.git",
-	}
-
-	for _, repo := range repos {
-		t.Run(repo, func(t *testing.T) {
-			lock := PluginLockfile{LockfileVersion: 1, Plugins: map[string]LockedPlugin{
-				"plugin": {Repo: repo, Commit: testCommit},
-			}}
-			assert.NoError(t, lock.Validate())
-		})
-	}
-}
-
-func TestMissingPluginLockfileIsEmpty(t *testing.T) {
-	store := NewLockStore(afero.NewMemMapFs(), "/config/plugins.lock.json")
-	lock, err := store.Load()
-	require.NoError(t, err)
-	assert.Equal(t, pluginLockfileVersion, lock.LockfileVersion)
-	assert.Empty(t, lock.Plugins)
-}

core/internal/plugins/manager.go

@@ -16,7 +16,6 @@ import (
 type Manager struct {
 	fs         afero.Fs
 	pluginsDir string
-	lockPath   string
 	gitClient  GitClient
 }
 
@@ -29,7 +28,6 @@ func NewManagerWithFs(fs afero.Fs) (*Manager, error) {
 	return &Manager{
 		fs:         fs,
 		pluginsDir: pluginsDir,
-		lockPath:   getPluginLockPath(),
 		gitClient:  &realGitClient{},
 	}, nil
 }
@@ -43,15 +41,6 @@ func getPluginsDir() string {
 	return filepath.Join(configDir, "DankMaterialShell", "plugins")
 }
 
-func getPluginLockPath() string {
-	configDir, err := os.UserConfigDir()
-	if err != nil {
-		log.Error("failed to get user config dir", "err", err)
-		return ""
-	}
-	return filepath.Join(configDir, "DankMaterialShell", "plugins.lock.json")
-}
-
 func (m *Manager) IsInstalled(plugin Plugin) (bool, error) {
 	path, err := m.findInstalledPath(plugin.ID)
 	if err != nil {
@@ -129,12 +118,7 @@ func (m *Manager) findInDir(dir, pluginID string) (string, error) {
 }
 
 func (m *Manager) Install(plugin Plugin) error {
-	if !isSafePluginPathComponent(plugin.ID) {
-		return fmt.Errorf("invalid plugin id: %q", plugin.ID)
-	}
-
 	pluginPath := filepath.Join(m.pluginsDir, plugin.ID)
-	repoPath := pluginPath
 
 	exists, err := afero.DirExists(m.fs, pluginPath)
 	if err != nil {
@@ -144,18 +128,6 @@ func (m *Manager) Install(plugin Plugin) error {
 	if exists {
 		return fmt.Errorf("plugin already installed: %s", plugin.Name)
 	}
-	if strings.TrimSpace(plugin.Repo) == "" {
-		return fmt.Errorf("plugin repository is required")
-	}
-	if err := validatePluginRepo(plugin.Repo); err != nil {
-		return err
-	}
-	if err := validatePluginRepoPath(plugin.Path); err != nil {
-		return err
-	}
-	if _, err := m.ensureLockfile(); err != nil {
-		return err
-	}
 
 	if err := m.fs.MkdirAll(m.pluginsDir, 0o755); err != nil {
 		return fmt.Errorf("failed to create plugins directory: %w", err)
@@ -168,7 +140,7 @@ func (m *Manager) Install(plugin Plugin) error {
 
 	if plugin.Path != "" {
 		repoName := m.getRepoName(plugin.Repo)
-		repoPath = filepath.Join(reposDir, repoName)
+		repoPath := filepath.Join(reposDir, repoName)
 
 		repoExists, err := afero.DirExists(m.fs, repoPath)
 		if err != nil {
@@ -206,13 +178,12 @@ func (m *Manager) Install(plugin Plugin) error {
 		if err := m.createSymlink(sourcePath, pluginPath); err != nil {
 			return fmt.Errorf("failed to create symlink: %w", err)
 		}
+
 		metaPath := pluginPath + ".meta"
 		metaContent := fmt.Sprintf("repo=%s\npath=%s\nrepodir=%s", plugin.Repo, plugin.Path, repoName)
 		if err := afero.WriteFile(m.fs, metaPath, []byte(metaContent), 0o644); err != nil {
-			m.fs.Remove(pluginPath) //nolint:errcheck
-			return fmt.Errorf("failed to write plugin repository metadata: %w", err)
+			return fmt.Errorf("failed to write metadata: %w", err)
 		}
-
 	} else {
 		if err := m.gitClient.PlainClone(pluginPath, plugin.Repo); err != nil {
 			m.fs.RemoveAll(pluginPath) //nolint:errcheck
@@ -220,16 +191,6 @@ func (m *Manager) Install(plugin Plugin) error {
 		}
 	}
 
-	if err := m.recordInstalledPlugin(plugin, repoPath); err != nil {
-		if plugin.Path != "" {
-			m.fs.Remove(pluginPath)           //nolint:errcheck
-			m.fs.Remove(pluginPath + ".meta") //nolint:errcheck
-		} else {
-			m.fs.RemoveAll(pluginPath) //nolint:errcheck
-		}
-		return fmt.Errorf("failed to update plugin lockfile: %w", err)
-	}
-
 	return nil
 }
 
@@ -246,15 +207,6 @@ func (m *Manager) createSymlink(source, dest string) error {
 }
 
 func (m *Manager) Update(plugin Plugin) error {
-	lock, err := m.ensureLockfile()
-	if err != nil {
-		return err
-	}
-	if locked, ok := lock.Plugins[plugin.ID]; ok {
-		plugin.Repo = locked.Repo
-		plugin.Path = locked.Path
-	}
-
 	pluginPath, err := m.findInstalledPath(plugin.ID)
 	if err != nil {
 		return fmt.Errorf("failed to find plugin: %w", err)
@@ -267,42 +219,46 @@ func (m *Manager) Update(plugin Plugin) error {
 	if strings.HasPrefix(pluginPath, "/etc/xdg/quickshell/dms-plugins") {
 		return fmt.Errorf("cannot update system plugin: %s", plugin.Name)
 	}
-	if plugin.Repo == "" {
-		plugin.Repo, err = m.gitClient.OriginURL(pluginPath)
-		if err != nil {
-			return fmt.Errorf("failed to read plugin origin: %w", err)
+
+	metaPath := pluginPath + ".meta"
+	metaExists, err := afero.Exists(m.fs, metaPath)
+	if err != nil {
+		return fmt.Errorf("failed to check metadata: %w", err)
+	}
+
+	if metaExists {
+		reposDir := filepath.Join(m.pluginsDir, ".repos")
+		repoName := m.getRepoName(plugin.Repo)
+		repoPath := filepath.Join(reposDir, repoName)
+
+		// Try to pull, if it fails (e.g., shallow clone corruption), delete and re-clone
+		if err := m.gitClient.Pull(repoPath); err != nil {
+			// Repository is likely corrupted or has issues, delete and re-clone
+			if err := m.fs.RemoveAll(repoPath); err != nil {
+				return fmt.Errorf("failed to remove corrupted repository: %w", err)
+			}
+
+			if err := m.gitClient.PlainClone(repoPath, plugin.Repo); err != nil {
+				return fmt.Errorf("failed to re-clone repository: %w", err)
+			}
+		}
+	} else {
+		// Try to pull, if it fails, delete and re-clone
+		if err := m.gitClient.Pull(pluginPath); err != nil {
+			if err := m.fs.RemoveAll(pluginPath); err != nil {
+				return fmt.Errorf("failed to remove corrupted plugin: %w", err)
+			}
+
+			if err := m.gitClient.PlainClone(pluginPath, plugin.Repo); err != nil {
+				return fmt.Errorf("failed to re-clone plugin: %w", err)
+			}
 		}
 	}
 
-	repoPath := m.repositoryPath(plugin.ID, LockedPlugin{Repo: plugin.Repo, Path: plugin.Path})
-	if err := m.gitClient.Pull(repoPath); err != nil {
-		if err := m.fs.RemoveAll(repoPath); err != nil {
-			return fmt.Errorf("failed to remove corrupted plugin repository: %w", err)
-		}
-		if err := m.gitClient.PlainClone(repoPath, plugin.Repo); err != nil {
-			return fmt.Errorf("failed to re-clone plugin repository: %w", err)
-		}
-	}
-
-	if err := m.recordInstalledPlugin(plugin, repoPath); err != nil {
-		if locked, ok := lock.Plugins[plugin.ID]; ok {
-			m.gitClient.CheckoutRevision(repoPath, locked.Commit) //nolint:errcheck
-		}
-		return err
-	}
 	return nil
 }
 
 func (m *Manager) Uninstall(plugin Plugin) error {
-	lock, err := m.ensureLockfile()
-	if err != nil {
-		return err
-	}
-	if locked, ok := lock.Plugins[plugin.ID]; ok {
-		plugin.Repo = locked.Repo
-		plugin.Path = locked.Path
-	}
-
 	pluginPath, err := m.findInstalledPath(plugin.ID)
 	if err != nil {
 		return fmt.Errorf("failed to find plugin: %w", err)
@@ -315,64 +271,70 @@ func (m *Manager) Uninstall(plugin Plugin) error {
 	if strings.HasPrefix(pluginPath, "/etc/xdg/quickshell/dms-plugins") {
 		return fmt.Errorf("cannot uninstall system plugin: %s", plugin.Name)
 	}
-	updatedLock := lock.Clone()
-	delete(updatedLock.Plugins, plugin.ID)
-	if err := m.lockStore().Write(updatedLock); err != nil {
-		return err
-	}
-	rollbackLock := func(err error) error {
-		if rollbackErr := m.lockStore().Write(lock); rollbackErr != nil {
-			return fmt.Errorf("%w (also failed to restore plugin lockfile: %v)", err, rollbackErr)
-		}
-		return err
-	}
 
 	metaPath := pluginPath + ".meta"
-	if plugin.Path != "" {
+	metaExists, err := afero.Exists(m.fs, metaPath)
+	if err != nil {
+		return fmt.Errorf("failed to check metadata: %w", err)
+	}
+
+	if metaExists {
 		reposDir := filepath.Join(m.pluginsDir, ".repos")
 		repoName := m.getRepoName(plugin.Repo)
 		repoPath := filepath.Join(reposDir, repoName)
 
-		shouldCleanup, err := m.shouldCleanupRepo(plugin.Repo, plugin.ID)
+		shouldCleanup, err := m.shouldCleanupRepo(repoPath, plugin.Repo, plugin.ID)
 		if err != nil {
-			return rollbackLock(fmt.Errorf("failed to check repo cleanup: %w", err))
+			return fmt.Errorf("failed to check repo cleanup: %w", err)
 		}
 
 		if err := m.fs.Remove(pluginPath); err != nil {
-			return rollbackLock(fmt.Errorf("failed to remove symlink: %w", err))
+			return fmt.Errorf("failed to remove symlink: %w", err)
 		}
 
-		if metaExists, _ := afero.Exists(m.fs, metaPath); metaExists {
-			if err := m.fs.Remove(metaPath); err != nil {
-				return rollbackLock(fmt.Errorf("failed to remove metadata: %w", err))
-			}
+		if err := m.fs.Remove(metaPath); err != nil {
+			return fmt.Errorf("failed to remove metadata: %w", err)
 		}
 
 		if shouldCleanup {
 			if err := m.fs.RemoveAll(repoPath); err != nil {
-				return rollbackLock(fmt.Errorf("failed to cleanup repository: %w", err))
+				return fmt.Errorf("failed to cleanup repository: %w", err)
 			}
 		}
 	} else {
 		if err := m.fs.RemoveAll(pluginPath); err != nil {
-			return rollbackLock(fmt.Errorf("failed to remove plugin: %w", err))
+			return fmt.Errorf("failed to remove plugin: %w", err)
 		}
 	}
 
 	return nil
 }
 
-func (m *Manager) shouldCleanupRepo(repoURL, excludePlugin string) (bool, error) {
-	lock, err := m.ensureLockfile()
+func (m *Manager) shouldCleanupRepo(repoPath, repoURL, excludePlugin string) (bool, error) {
+	installed, err := m.ListInstalled()
 	if err != nil {
 		return false, err
 	}
-	for id, plugin := range lock.Plugins {
+
+	registry, err := NewRegistry()
+	if err != nil {
+		return false, err
+	}
+
+	allPlugins, err := registry.List()
+	if err != nil {
+		return false, err
+	}
+
+	for _, id := range installed {
 		if id == excludePlugin {
 			continue
 		}
-		if plugin.Repo == repoURL && plugin.Path != "" {
-			return false, nil
+
+		for _, p := range allPlugins {
+			if p.ID == id && p.Repo == repoURL && p.Path != "" {
+				return false, nil
+			}
 		}
 	}
 
@@ -494,16 +456,6 @@ func (m *Manager) UninstallByIDOrName(idOrName string) error {
 	if strings.HasPrefix(pluginPath, "/etc/xdg/quickshell/dms-plugins") {
 		return fmt.Errorf("cannot uninstall system plugin: %s", idOrName)
 	}
-	manifest := m.getPluginManifest(pluginPath)
-	if manifest != nil {
-		lock, err := m.ensureLockfile()
-		if err != nil {
-			return err
-		}
-		if locked, ok := lock.Plugins[manifest.ID]; ok {
-			return m.Uninstall(Plugin{ID: manifest.ID, Name: manifest.Name, Repo: locked.Repo, Path: locked.Path})
-		}
-	}
 
 	metaPath := pluginPath + ".meta"
 	metaExists, _ := afero.Exists(m.fs, metaPath)
@@ -536,16 +488,6 @@ func (m *Manager) UpdateByIDOrName(idOrName string) error {
 	if strings.HasPrefix(pluginPath, "/etc/xdg/quickshell/dms-plugins") {
 		return fmt.Errorf("cannot update system plugin: %s", idOrName)
 	}
-	manifest := m.getPluginManifest(pluginPath)
-	if manifest != nil {
-		lock, err := m.ensureLockfile()
-		if err != nil {
-			return err
-		}
-		if locked, ok := lock.Plugins[manifest.ID]; ok {
-			return m.Update(Plugin{ID: manifest.ID, Name: manifest.Name, Repo: locked.Repo, Path: locked.Path})
-		}
-	}
 
 	metaPath := pluginPath + ".meta"
 	metaExists, _ := afero.Exists(m.fs, metaPath)
@@ -560,14 +502,8 @@ func (m *Manager) UpdateByIDOrName(idOrName string) error {
 	if err := m.gitClient.Pull(pluginPath); err != nil {
 		return fmt.Errorf("failed to update plugin: %w", err)
 	}
-	if manifest == nil {
-		return nil
-	}
-	repo, err := m.gitClient.OriginURL(pluginPath)
-	if err != nil {
-		return fmt.Errorf("failed to read plugin origin: %w", err)
-	}
-	return m.recordInstalledPlugin(Plugin{ID: manifest.ID, Name: manifest.Name, Repo: repo}, pluginPath)
+
+	return nil
 }
 
 func (m *Manager) findInstalledPathByIDOrName(idOrName string) (string, error) {
@@ -636,15 +572,6 @@ func (m *Manager) findInDirByIDOrName(dir, idOrName string) (string, error) {
 }
 
 func (m *Manager) HasUpdates(pluginID string, plugin Plugin) (hasUpdates bool, diffURL string, err error) {
-	lock, err := m.ensureLockfile()
-	if err != nil {
-		return false, "", err
-	}
-	if locked, ok := lock.Plugins[pluginID]; ok {
-		plugin.Repo = locked.Repo
-		plugin.Path = locked.Path
-	}
-
 	pluginPath, err := m.findInstalledPath(pluginID)
 	if err != nil {
 		return false, "", fmt.Errorf("failed to find plugin: %w", err)
@@ -658,11 +585,25 @@ func (m *Manager) HasUpdates(pluginID string, plugin Plugin) (hasUpdates bool, d
 		return false, "", nil
 	}
 
-	repoPath := pluginPath
-	if plugin.Path != "" {
-		repoPath = m.repositoryPath(pluginID, LockedPlugin{Repo: plugin.Repo, Path: plugin.Path})
+	metaPath := pluginPath + ".meta"
+	metaExists, err := afero.Exists(m.fs, metaPath)
+	if err != nil {
+		return false, "", fmt.Errorf("failed to check metadata: %w", err)
+	}
+
+	var hasUp bool
+	var localHash, remoteHash string
+	if metaExists {
+		// Plugin is from a monorepo, check the repo directory
+		reposDir := filepath.Join(m.pluginsDir, ".repos")
+		repoName := m.getRepoName(plugin.Repo)
+		repoPath := filepath.Join(reposDir, repoName)
+
+		hasUp, localHash, remoteHash, err = m.gitClient.HasUpdates(repoPath)
+	} else {
+		// Plugin is a standalone repo
+		hasUp, localHash, remoteHash, err = m.gitClient.HasUpdates(pluginPath)
 	}
-	hasUp, localHash, remoteHash, err := m.gitClient.HasUpdates(repoPath)
 
 	if err != nil {
 		return false, "", err

core/internal/plugins/manager_lockfile.go

@@ -1,299 +0,0 @@
-package plugins
-
-import (
-	"fmt"
-	"path/filepath"
-	"strings"
-
-	"github.com/spf13/afero"
-)
-
-func (m *Manager) lockStore() *LockStore {
-	lockPath := m.lockPath
-	if lockPath == "" {
-		lockPath = filepath.Join(filepath.Dir(m.pluginsDir), "plugins.lock.json")
-	}
-	return NewLockStore(m.fs, lockPath)
-}
-
-func (m *Manager) GetLockfilePath() string {
-	return m.lockStore().Path()
-}
-
-func (m *Manager) ensureLockfile() (PluginLockfile, error) {
-	store := m.lockStore()
-	exists, err := store.Exists()
-	if err != nil {
-		return PluginLockfile{}, fmt.Errorf("failed to check plugin lockfile: %w", err)
-	}
-	if exists {
-		return store.Load()
-	}
-
-	lock, _, err := m.SnapshotLockfile()
-	if err != nil {
-		return PluginLockfile{}, err
-	}
-	if err := store.Write(lock); err != nil {
-		return PluginLockfile{}, err
-	}
-	return lock, nil
-}
-
-func (m *Manager) SnapshotLockfile() (PluginLockfile, []string, error) {
-	lock := NewPluginLockfile()
-	warnings := []string{}
-
-	exists, err := afero.DirExists(m.fs, m.pluginsDir)
-	if err != nil {
-		return PluginLockfile{}, nil, fmt.Errorf("failed to check plugins directory: %w", err)
-	}
-	if !exists {
-		return lock, warnings, nil
-	}
-
-	entries, err := afero.ReadDir(m.fs, m.pluginsDir)
-	if err != nil {
-		return PluginLockfile{}, nil, fmt.Errorf("failed to read plugins directory: %w", err)
-	}
-
-	for _, entry := range entries {
-		name := entry.Name()
-		if name == ".repos" || strings.HasSuffix(name, ".meta") {
-			continue
-		}
-
-		pluginPath := filepath.Join(m.pluginsDir, name)
-		manifest := m.getPluginManifest(pluginPath)
-		if manifest == nil || manifest.ID == "" {
-			continue
-		}
-
-		locked, repoPath, err := m.lockedPluginFromInstall(pluginPath)
-		if err != nil {
-			warnings = append(warnings, fmt.Sprintf("%s: %v", manifest.ID, err))
-			continue
-		}
-		commit, err := m.gitClient.CurrentRevision(repoPath)
-		if err != nil {
-			warnings = append(warnings, fmt.Sprintf("%s: cannot read git revision: %v", manifest.ID, err))
-			continue
-		}
-		locked.Commit = commit
-		lock.SetRepositoryCommit(locked.Repo, commit)
-		lock.Plugins[manifest.ID] = locked
-	}
-
-	if err := lock.Validate(); err != nil {
-		return PluginLockfile{}, warnings, err
-	}
-	return lock, warnings, nil
-}
-
-func (m *Manager) lockedPluginFromInstall(pluginPath string) (LockedPlugin, string, error) {
-	metaPath := pluginPath + ".meta"
-	if metaExists, _ := afero.Exists(m.fs, metaPath); metaExists {
-		data, err := afero.ReadFile(m.fs, metaPath)
-		if err != nil {
-			return LockedPlugin{}, "", fmt.Errorf("failed to read legacy metadata: %w", err)
-		}
-		metadata := parseLegacyPluginMetadata(string(data))
-		repo := metadata["repo"]
-		path := metadata["path"]
-		repoDir := metadata["repodir"]
-		if repo == "" || repoDir == "" {
-			return LockedPlugin{}, "", fmt.Errorf("legacy metadata is incomplete")
-		}
-		if err := validatePluginRepo(repo); err != nil {
-			return LockedPlugin{}, "", err
-		}
-		if !isSafePluginPathComponent(repoDir) {
-			return LockedPlugin{}, "", fmt.Errorf("legacy repository directory is invalid")
-		}
-		if err := validatePluginRepoPath(path); err != nil {
-			return LockedPlugin{}, "", err
-		}
-		return LockedPlugin{Repo: repo, Path: path}, filepath.Join(m.pluginsDir, ".repos", repoDir), nil
-	}
-
-	repo, err := m.gitClient.OriginURL(pluginPath)
-	if err != nil {
-		return LockedPlugin{}, "", fmt.Errorf("plugin is not a managed git checkout")
-	}
-	if err := validatePluginRepo(repo); err != nil {
-		return LockedPlugin{}, "", err
-	}
-	return LockedPlugin{Repo: repo}, pluginPath, nil
-}
-
-func parseLegacyPluginMetadata(data string) map[string]string {
-	metadata := make(map[string]string)
-	for _, line := range strings.Split(data, "\n") {
-		key, value, ok := strings.Cut(line, "=")
-		if ok {
-			metadata[strings.TrimSpace(key)] = strings.TrimSpace(value)
-		}
-	}
-	return metadata
-}
-
-func (m *Manager) recordInstalledPlugin(plugin Plugin, repoPath string) error {
-	lock, err := m.ensureLockfile()
-	if err != nil {
-		return err
-	}
-	commit, err := m.gitClient.CurrentRevision(repoPath)
-	if err != nil {
-		return fmt.Errorf("failed to read installed plugin revision: %w", err)
-	}
-
-	lock.SetRepositoryCommit(plugin.Repo, commit)
-	lock.Plugins[plugin.ID] = LockedPlugin{
-		Repo:   plugin.Repo,
-		Path:   plugin.Path,
-		Commit: commit,
-	}
-	return m.lockStore().Write(lock)
-}
-
-func (m *Manager) WriteCurrentLockfile(outputPath string) ([]string, error) {
-	lock, warnings, err := m.SnapshotLockfile()
-	if err != nil {
-		return warnings, err
-	}
-	if err := m.lockStore().Write(lock); err != nil {
-		return warnings, err
-	}
-	if outputPath != "" && outputPath != m.GetLockfilePath() {
-		if err := NewLockStore(m.fs, outputPath).Write(lock); err != nil {
-			return warnings, err
-		}
-	}
-	return warnings, nil
-}
-
-func (m *Manager) RestoreFromLockfile(sourcePath string, prune bool) error {
-	if sourcePath == "" {
-		sourcePath = m.GetLockfilePath()
-	}
-	sourceStore := NewLockStore(m.fs, sourcePath)
-	exists, err := sourceStore.Exists()
-	if err != nil {
-		return fmt.Errorf("failed to check plugin lockfile: %w", err)
-	}
-	if !exists {
-		return fmt.Errorf("plugin lockfile not found: %s", sourcePath)
-	}
-	target, err := sourceStore.Load()
-	if err != nil {
-		return err
-	}
-	current, err := m.ensureLockfile()
-	if err != nil {
-		return err
-	}
-
-	for _, id := range target.IDs() {
-		wanted := target.Plugins[id]
-		installedPath, err := m.findInstalledPath(id)
-		if err != nil {
-			return err
-		}
-
-		if installedPath != "" {
-			existing, managed := current.Plugins[id]
-			if !managed {
-				return fmt.Errorf("plugin %q is already installed but is not managed by the lockfile", id)
-			}
-			if existing.Repo != wanted.Repo || existing.Path != wanted.Path {
-				if err := m.UninstallByIDOrName(id); err != nil {
-					return err
-				}
-				installedPath = ""
-			}
-		}
-
-		plugin := Plugin{ID: id, Name: id, Repo: wanted.Repo, Path: wanted.Path}
-		newlyInstalled := installedPath == ""
-		if installedPath == "" {
-			if err := m.Install(plugin); err != nil {
-				return fmt.Errorf("failed to restore plugin %q: %w", id, err)
-			}
-		}
-
-		repoPath := m.repositoryPath(id, wanted)
-		previousCommit, err := m.gitClient.CurrentRevision(repoPath)
-		if err != nil {
-			if newlyInstalled {
-				m.UninstallByIDOrName(id) //nolint:errcheck
-			}
-			return fmt.Errorf("failed to read current revision for plugin %q: %w", id, err)
-		}
-		if err := m.gitClient.CheckoutRevision(repoPath, wanted.Commit); err != nil {
-			if newlyInstalled {
-				if rollbackErr := m.UninstallByIDOrName(id); rollbackErr != nil {
-					return fmt.Errorf("failed to restore plugin %q at %s: %w (also failed to remove the partial install: %v)", id, wanted.Commit, err, rollbackErr)
-				}
-			}
-			return fmt.Errorf("failed to restore plugin %q at %s: %w", id, wanted.Commit, err)
-		}
-		rollback := func(restoreErr error) error {
-			if newlyInstalled {
-				if rollbackErr := m.UninstallByIDOrName(id); rollbackErr != nil {
-					return fmt.Errorf("%w (also failed to remove the partial install: %v)", restoreErr, rollbackErr)
-				}
-				return restoreErr
-			}
-			if rollbackErr := m.gitClient.CheckoutRevision(repoPath, previousCommit); rollbackErr != nil {
-				return fmt.Errorf("%w (also failed to restore revision %s: %v)", restoreErr, previousCommit, rollbackErr)
-			}
-			return restoreErr
-		}
-		pluginPath := installedPath
-		if pluginPath == "" {
-			pluginPath = filepath.Join(m.pluginsDir, id)
-		}
-		if actualID := m.getPluginID(pluginPath); actualID != id {
-			return rollback(fmt.Errorf("restored plugin %q has manifest id %q", id, actualID))
-		}
-		if err := m.recordInstalledPlugin(plugin, repoPath); err != nil {
-			return rollback(err)
-		}
-		current, err = m.lockStore().Load()
-		if err != nil {
-			return err
-		}
-	}
-
-	if prune {
-		for _, id := range current.IDs() {
-			if _, wanted := target.Plugins[id]; wanted {
-				continue
-			}
-			if err := m.UninstallByIDOrName(id); err != nil {
-				return fmt.Errorf("failed to prune plugin %q: %w", id, err)
-			}
-		}
-		return m.lockStore().Write(target)
-	}
-
-	merged, err := m.lockStore().Load()
-	if err != nil {
-		return err
-	}
-	for id, plugin := range target.Plugins {
-		merged.SetRepositoryCommit(plugin.Repo, plugin.Commit)
-		merged.Plugins[id] = plugin
-	}
-	return m.lockStore().Write(merged)
-}
-
-func (m *Manager) repositoryPath(pluginID string, plugin LockedPlugin) string {
-	if plugin.Path != "" {
-		return filepath.Join(m.pluginsDir, ".repos", m.getRepoName(plugin.Repo))
-	}
-	if installedPath, err := m.findInDir(m.pluginsDir, pluginID); err == nil && installedPath != "" {
-		return installedPath
-	}
-	return filepath.Join(m.pluginsDir, pluginID)
-}

core/internal/plugins/manager_test.go

@@ -1,7 +1,6 @@
 package plugins
 
 import (
-	"errors"
 	"os"
 	"path/filepath"
 	"testing"
@@ -17,7 +16,6 @@ func setupTestManager(t *testing.T) (*Manager, afero.Fs, string) {
 	manager := &Manager{
 		fs:         fs,
 		pluginsDir: pluginsDir,
-		lockPath:   "/config/plugins.lock.json",
 		gitClient:  &mockGitClient{},
 	}
 	return manager, fs, pluginsDir
@@ -247,244 +245,3 @@ func TestManagerGetPluginsDir(t *testing.T) {
 	manager, _, pluginsDir := setupTestManager(t)
 	assert.Equal(t, pluginsDir, manager.GetPluginsDir())
 }
-
-func TestInstallUpdatesLockfile(t *testing.T) {
-	manager, fs, pluginsDir := setupTestManager(t)
-	plugin := Plugin{ID: "test-plugin", Name: "Test Plugin", Repo: "https://github.com/test/plugin.git"}
-	manager.gitClient = &mockGitClient{
-		cloneFunc: func(path, _ string) error {
-			require.NoError(t, fs.MkdirAll(path, 0o755))
-			return afero.WriteFile(fs, filepath.Join(path, "plugin.json"), []byte(`{"id":"test-plugin"}`), 0o644)
-		},
-		revisionFunc: func(string) (string, error) { return testCommit, nil },
-	}
-
-	require.NoError(t, manager.Install(plugin))
-	lock, err := manager.lockStore().Load()
-	require.NoError(t, err)
-	assert.Equal(t, LockedPlugin{Repo: plugin.Repo, Commit: testCommit}, lock.Plugins[plugin.ID])
-	exists, err := afero.Exists(fs, filepath.Join(pluginsDir, plugin.ID))
-	require.NoError(t, err)
-	assert.True(t, exists)
-}
-
-func TestUpdateRefreshesLockedCommit(t *testing.T) {
-	manager, fs, pluginsDir := setupTestManager(t)
-	plugin := Plugin{ID: "test-plugin", Name: "Test Plugin", Repo: "https://github.com/test/plugin.git"}
-	pluginPath := filepath.Join(pluginsDir, plugin.ID)
-	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
-	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"test-plugin"}`), 0o644))
-	require.NoError(t, manager.lockStore().Write(PluginLockfile{
-		LockfileVersion: 1,
-		Plugins: map[string]LockedPlugin{
-			plugin.ID: {Repo: plugin.Repo, Commit: testCommit},
-		},
-	}))
-	newCommit := "1123456789abcdef0123456789abcdef01234567"
-	manager.gitClient = &mockGitClient{
-		pullFunc:     func(string) error { return nil },
-		revisionFunc: func(string) (string, error) { return newCommit, nil },
-	}
-
-	require.NoError(t, manager.Update(plugin))
-	lock, err := manager.lockStore().Load()
-	require.NoError(t, err)
-	assert.Equal(t, newCommit, lock.Plugins[plugin.ID].Commit)
-}
-
-func TestUpdateResolvesRenamedPluginDirectory(t *testing.T) {
-	manager, fs, pluginsDir := setupTestManager(t)
-	plugin := Plugin{ID: "test-plugin", Name: "Test Plugin", Repo: "https://github.com/test/plugin.git"}
-	pluginPath := filepath.Join(pluginsDir, "renamed-dir")
-	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
-	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"test-plugin"}`), 0o644))
-	require.NoError(t, manager.lockStore().Write(PluginLockfile{
-		LockfileVersion: 1,
-		Plugins: map[string]LockedPlugin{
-			plugin.ID: {Repo: plugin.Repo, Commit: testCommit},
-		},
-	}))
-	var pulledPath string
-	manager.gitClient = &mockGitClient{
-		pullFunc: func(path string) error {
-			pulledPath = path
-			return nil
-		},
-		cloneFunc: func(path, _ string) error {
-			t.Fatalf("unexpected clone to %s", path)
-			return nil
-		},
-		revisionFunc: func(string) (string, error) { return testCommit, nil },
-	}
-
-	require.NoError(t, manager.Update(plugin))
-	assert.Equal(t, pluginPath, pulledPath)
-}
-
-func TestUninstallRemovesLockedPlugin(t *testing.T) {
-	manager, fs, pluginsDir := setupTestManager(t)
-	plugin := Plugin{ID: "test-plugin", Name: "Test Plugin", Repo: "https://github.com/test/plugin.git"}
-	pluginPath := filepath.Join(pluginsDir, plugin.ID)
-	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
-	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"test-plugin"}`), 0o644))
-	require.NoError(t, manager.lockStore().Write(PluginLockfile{
-		LockfileVersion: 1,
-		Plugins: map[string]LockedPlugin{
-			plugin.ID: {Repo: plugin.Repo, Commit: testCommit},
-		},
-	}))
-
-	require.NoError(t, manager.Uninstall(plugin))
-	lock, err := manager.lockStore().Load()
-	require.NoError(t, err)
-	assert.NotContains(t, lock.Plugins, plugin.ID)
-}
-
-func TestRestoreFromLockfileInstallsExactCommit(t *testing.T) {
-	manager, fs, _ := setupTestManager(t)
-	wantedCommit := "2123456789abcdef0123456789abcdef01234567"
-	incoming := PluginLockfile{
-		LockfileVersion: 1,
-		Plugins: map[string]LockedPlugin{
-			"restored": {Repo: "https://github.com/test/restored.git", Commit: wantedCommit},
-		},
-	}
-	require.NoError(t, NewLockStore(fs, "/incoming.lock.json").Write(incoming))
-	currentCommit := testCommit
-	manager.gitClient = &mockGitClient{
-		cloneFunc: func(path, _ string) error {
-			require.NoError(t, fs.MkdirAll(path, 0o755))
-			return afero.WriteFile(fs, filepath.Join(path, "plugin.json"), []byte(`{"id":"restored"}`), 0o644)
-		},
-		revisionFunc: func(string) (string, error) { return currentCommit, nil },
-		checkoutFunc: func(_ string, revision string) error {
-			currentCommit = revision
-			return nil
-		},
-	}
-
-	require.NoError(t, manager.RestoreFromLockfile("/incoming.lock.json", false))
-	lock, err := manager.lockStore().Load()
-	require.NoError(t, err)
-	assert.Equal(t, wantedCommit, lock.Plugins["restored"].Commit)
-}
-
-func TestSnapshotLockfileMigratesLegacyMonorepoMetadata(t *testing.T) {
-	manager, fs, pluginsDir := setupTestManager(t)
-	pluginPath := filepath.Join(pluginsDir, "legacy")
-	repoPath := filepath.Join(pluginsDir, ".repos", "legacy-repo")
-	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
-	require.NoError(t, fs.MkdirAll(repoPath, 0o755))
-	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"legacy"}`), 0o644))
-	require.NoError(t, afero.WriteFile(fs, pluginPath+".meta", []byte("repo=https://github.com/test/suite.git\npath=plugins/legacy\nrepodir=legacy-repo"), 0o644))
-	manager.gitClient = &mockGitClient{
-		revisionFunc: func(path string) (string, error) {
-			assert.Equal(t, repoPath, path)
-			return testCommit, nil
-		},
-	}
-
-	lock, warnings, err := manager.SnapshotLockfile()
-	require.NoError(t, err)
-	assert.Empty(t, warnings)
-	assert.Equal(t, LockedPlugin{
-		Repo:   "https://github.com/test/suite.git",
-		Path:   "plugins/legacy",
-		Commit: testCommit,
-	}, lock.Plugins["legacy"])
-}
-
-func TestRecordInstalledPluginUpdatesSharedRepositoryCommit(t *testing.T) {
-	manager, _, _ := setupTestManager(t)
-	repo := "https://github.com/test/suite.git"
-	require.NoError(t, manager.lockStore().Write(PluginLockfile{
-		LockfileVersion: 1,
-		Plugins: map[string]LockedPlugin{
-			"one": {Repo: repo, Path: "plugins/one", Commit: testCommit},
-			"two": {Repo: repo, Path: "plugins/two", Commit: testCommit},
-		},
-	}))
-	newCommit := "3123456789abcdef0123456789abcdef01234567"
-	manager.gitClient = &mockGitClient{
-		revisionFunc: func(string) (string, error) { return newCommit, nil },
-	}
-
-	require.NoError(t, manager.recordInstalledPlugin(Plugin{ID: "one", Repo: repo, Path: "plugins/one"}, "/repo"))
-	lock, err := manager.lockStore().Load()
-	require.NoError(t, err)
-	assert.Equal(t, newCommit, lock.Plugins["one"].Commit)
-	assert.Equal(t, newCommit, lock.Plugins["two"].Commit)
-}
-
-func TestRestoreFromLockfilePrunesManagedPlugins(t *testing.T) {
-	manager, fs, pluginsDir := setupTestManager(t)
-	pluginPath := filepath.Join(pluginsDir, "old")
-	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
-	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"old","name":"Old"}`), 0o644))
-	require.NoError(t, manager.lockStore().Write(PluginLockfile{
-		LockfileVersion: 1,
-		Plugins: map[string]LockedPlugin{
-			"old": {Repo: "https://github.com/test/old.git", Commit: testCommit},
-		},
-	}))
-	require.NoError(t, NewLockStore(fs, "/empty.lock.json").Write(NewPluginLockfile()))
-
-	require.NoError(t, manager.RestoreFromLockfile("/empty.lock.json", true))
-	exists, err := afero.Exists(fs, pluginPath)
-	require.NoError(t, err)
-	assert.False(t, exists)
-	lock, err := manager.lockStore().Load()
-	require.NoError(t, err)
-	assert.Empty(t, lock.Plugins)
-}
-
-func TestRestoreMissingLockfileDoesNotPrune(t *testing.T) {
-	manager, fs, pluginsDir := setupTestManager(t)
-	pluginPath := filepath.Join(pluginsDir, "kept")
-	require.NoError(t, fs.MkdirAll(pluginPath, 0o755))
-	require.NoError(t, afero.WriteFile(fs, filepath.Join(pluginPath, "plugin.json"), []byte(`{"id":"kept"}`), 0o644))
-	require.NoError(t, manager.lockStore().Write(PluginLockfile{
-		LockfileVersion: 1,
-		Plugins: map[string]LockedPlugin{
-			"kept": {Repo: "https://github.com/test/kept.git", Commit: testCommit},
-		},
-	}))
-
-	err := manager.RestoreFromLockfile("/missing.lock.json", true)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "not found")
-	exists, statErr := afero.Exists(fs, pluginPath)
-	require.NoError(t, statErr)
-	assert.True(t, exists)
-}
-
-func TestRestoreFailedRevisionRemovesPartialInstall(t *testing.T) {
-	manager, fs, pluginsDir := setupTestManager(t)
-	incoming := PluginLockfile{
-		LockfileVersion: 1,
-		Plugins: map[string]LockedPlugin{
-			"broken": {Repo: "https://github.com/test/broken.git", Commit: testCommit},
-		},
-	}
-	require.NoError(t, NewLockStore(fs, "/incoming.lock.json").Write(incoming))
-	manager.gitClient = &mockGitClient{
-		cloneFunc: func(path, _ string) error {
-			require.NoError(t, fs.MkdirAll(path, 0o755))
-			return afero.WriteFile(fs, filepath.Join(path, "plugin.json"), []byte(`{"id":"broken"}`), 0o644)
-		},
-		revisionFunc: func(string) (string, error) { return testCommit, nil },
-		checkoutFunc: func(string, string) error {
-			return errors.New("revision unavailable")
-		},
-	}
-
-	err := manager.RestoreFromLockfile("/incoming.lock.json", false)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "revision unavailable")
-	exists, statErr := afero.Exists(fs, filepath.Join(pluginsDir, "broken"))
-	require.NoError(t, statErr)
-	assert.False(t, exists)
-	lock, loadErr := manager.lockStore().Load()
-	require.NoError(t, loadErr)
-	assert.NotContains(t, lock.Plugins, "broken")
-}

core/internal/plugins/registry.go

@@ -2,18 +2,17 @@ package plugins
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/registries"
 	"github.com/go-git/go-git/v6"
-	"github.com/go-git/go-git/v6/plumbing"
 	"github.com/spf13/afero"
 )
 
+const registryRepo = "https://github.com/AvengeMedia/dms-plugin-registry.git"
+
 type Plugin struct {
 	ID           string   `json:"id"`
 	Name         string   `json:"name"`
@@ -34,10 +33,7 @@ type Plugin struct {
 type GitClient interface {
 	PlainClone(path string, url string) error
 	Pull(path string) error
-	OriginURL(path string) (string, error)
 	HasUpdates(path string) (hasUpdates bool, localHash string, remoteHash string, err error)
-	CurrentRevision(path string) (string, error)
-	CheckoutRevision(path string, revision string) error
 }
 
 type realGitClient struct{}
@@ -69,22 +65,6 @@ func (g *realGitClient) Pull(path string) error {
 	return nil
 }
 
-func (g *realGitClient) OriginURL(path string) (string, error) {
-	repo, err := git.PlainOpen(path)
-	if err != nil {
-		return "", err
-	}
-	remote, err := repo.Remote("origin")
-	if err != nil {
-		return "", err
-	}
-	urls := remote.Config().URLs
-	if len(urls) == 0 {
-		return "", errors.New("origin remote has no URL")
-	}
-	return urls[0], nil
-}
-
 func (g *realGitClient) HasUpdates(path string) (bool, string, string, error) {
 	repo, err := git.PlainOpen(path)
 	if err != nil {
@@ -138,53 +118,11 @@ func (g *realGitClient) HasUpdates(path string) (bool, string, string, error) {
 	return localHash != remoteHead, localHash, remoteHead, nil
 }
 
-func (g *realGitClient) CurrentRevision(path string) (string, error) {
-	repo, err := git.PlainOpen(path)
-	if err != nil {
-		return "", err
-	}
-	head, err := repo.Head()
-	if err != nil {
-		return "", err
-	}
-	return head.Hash().String(), nil
-}
-
-func (g *realGitClient) CheckoutRevision(path string, revision string) error {
-	if !gitCommitPattern.MatchString(revision) {
-		return fmt.Errorf("invalid git revision %q", revision)
-	}
-
-	repo, err := git.PlainOpen(path)
-	if err != nil {
-		return err
-	}
-	hash := plumbing.NewHash(revision)
-	if _, objectErr := repo.CommitObject(hash); objectErr != nil {
-		if _, remoteErr := repo.Remote("origin"); remoteErr != nil {
-			return fmt.Errorf("revision %s is not available in repository: %w", revision, objectErr)
-		}
-		fetchErr := repo.Fetch(&git.FetchOptions{})
-		if fetchErr != nil && fetchErr != git.NoErrAlreadyUpToDate {
-			return fmt.Errorf("failed to fetch locked revision: %w", fetchErr)
-		}
-	}
-	if _, err := repo.CommitObject(hash); err != nil {
-		return fmt.Errorf("revision %s is not available in repository: %w", revision, err)
-	}
-	worktree, err := repo.Worktree()
-	if err != nil {
-		return err
-	}
-	return worktree.Reset(&git.ResetOptions{Commit: hash, Mode: git.HardReset})
-}
-
 type Registry struct {
-	fs         afero.Fs
-	cacheDir   string
-	registries []registries.Source
-	plugins    []Plugin
-	git        GitClient
+	fs       afero.Fs
+	cacheDir string
+	plugins  []Plugin
+	git      GitClient
 }
 
 func NewRegistry() (*Registry, error) {
@@ -192,63 +130,63 @@ func NewRegistry() (*Registry, error) {
 }
 
 func NewRegistryWithFs(fs afero.Fs) (*Registry, error) {
+	cacheDir := getCacheDir()
 	return &Registry{
-		fs:         fs,
-		cacheDir:   getCacheDir(),
-		registries: registries.Load(fs),
-		git:        &realGitClient{},
+		fs:       fs,
+		cacheDir: cacheDir,
+		git:      &realGitClient{},
 	}, nil
 }
 
-func (r *Registry) cacheDirFor(src registries.Source) string {
-	return filepath.Join(r.cacheDir, src.Name)
-}
-
 func getCacheDir() string {
 	return filepath.Join(os.TempDir(), "dankdots-plugin-registry")
 }
 
-// A cached clone is reused only when its origin still matches the configured
-// URL; renamed or re-pointed registries re-clone instead of pulling from the
-// stale remote.
-func (r *Registry) updateOne(src registries.Source) error {
-	dir := r.cacheDirFor(src)
-	exists, err := afero.DirExists(r.fs, dir)
+func (r *Registry) Update() error {
+	exists, err := afero.DirExists(r.fs, r.cacheDir)
 	if err != nil {
 		return fmt.Errorf("failed to check cache directory: %w", err)
 	}
 
-	if exists {
-		origin, originErr := r.git.OriginURL(dir)
-		if originErr == nil && origin == src.URL && r.git.Pull(dir) == nil {
-			return nil
+	if !exists {
+		if err := r.fs.MkdirAll(filepath.Dir(r.cacheDir), 0o755); err != nil {
+			return fmt.Errorf("failed to create cache directory: %w", err)
 		}
-		if err := r.fs.RemoveAll(dir); err != nil {
-			return fmt.Errorf("failed to remove stale registry cache: %w", err)
+
+		if err := r.git.PlainClone(r.cacheDir, registryRepo); err != nil {
+			return fmt.Errorf("failed to clone registry: %w", err)
+		}
+	} else {
+		// Try to pull, if it fails (e.g., shallow clone corruption), delete and re-clone
+		if err := r.git.Pull(r.cacheDir); err != nil {
+			// Repository is likely corrupted or has issues, delete and re-clone
+			if err := r.fs.RemoveAll(r.cacheDir); err != nil {
+				return fmt.Errorf("failed to remove corrupted registry: %w", err)
+			}
+
+			if err := r.fs.MkdirAll(filepath.Dir(r.cacheDir), 0o755); err != nil {
+				return fmt.Errorf("failed to create cache directory: %w", err)
+			}
+
+			if err := r.git.PlainClone(r.cacheDir, registryRepo); err != nil {
+				return fmt.Errorf("failed to re-clone registry: %w", err)
+			}
 		}
 	}
 
-	if err := r.fs.MkdirAll(filepath.Dir(dir), 0o755); err != nil {
-		return fmt.Errorf("failed to create cache directory: %w", err)
-	}
-	if err := r.git.PlainClone(dir, src.URL); err != nil {
-		return fmt.Errorf("failed to clone: %w", err)
-	}
-	return nil
+	return r.loadPlugins()
 }
 
-// A registry without a plugins/ directory is a valid themes-only registry.
-func (r *Registry) loadPluginsFrom(dir string) ([]Plugin, error) {
-	pluginsDir := filepath.Join(dir, "plugins")
+func (r *Registry) loadPlugins() error {
+	pluginsDir := filepath.Join(r.cacheDir, "plugins")
+
 	entries, err := afero.ReadDir(r.fs, pluginsDir)
 	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, nil
-		}
-		return nil, fmt.Errorf("failed to read plugins directory: %w", err)
+		return fmt.Errorf("failed to read plugins directory: %w", err)
 	}
 
-	var plugins []Plugin
+	r.plugins = []Plugin{}
+
 	for _, entry := range entries {
 		if entry.IsDir() || filepath.Ext(entry.Name()) != ".json" {
 			continue
@@ -268,51 +206,15 @@ func (r *Registry) loadPluginsFrom(dir string) ([]Plugin, error) {
 			plugin.ID = strings.TrimSuffix(entry.Name(), ".json")
 		}
 
-		plugins = append(plugins, plugin)
+		r.plugins = append(r.plugins, plugin)
 	}
-	return plugins, nil
-}
 
-// Pre-multi-registry caches were a single clone at the base dir; the per-name
-// layout nests under it, so a leftover clone is deleted wholesale first.
-func (r *Registry) resetLegacyCache() {
-	if exists, _ := afero.DirExists(r.fs, filepath.Join(r.cacheDir, ".git")); exists {
-		_ = r.fs.RemoveAll(r.cacheDir)
-	}
-}
-
-// Update refreshes every configured registry, aggregating plugins in
-// declaration order (first occurrence of an ID wins). A failing registry is
-// reported in the joined error but does not block the others.
-func (r *Registry) Update() error {
-	r.resetLegacyCache()
-	r.plugins = []Plugin{}
-	seen := make(map[string]struct{})
-	var errs []error
-	for _, src := range r.registries {
-		if err := r.updateOne(src); err != nil {
-			errs = append(errs, fmt.Errorf("registry %s: %w", src.Name, err))
-			continue
-		}
-		plugins, err := r.loadPluginsFrom(r.cacheDirFor(src))
-		if err != nil {
-			errs = append(errs, fmt.Errorf("registry %s: %w", src.Name, err))
-			continue
-		}
-		for _, p := range plugins {
-			if _, dup := seen[p.ID]; dup {
-				continue
-			}
-			seen[p.ID] = struct{}{}
-			r.plugins = append(r.plugins, p)
-		}
-	}
-	return errors.Join(errs...)
+	return nil
 }
 
 func (r *Registry) List() ([]Plugin, error) {
 	if len(r.plugins) == 0 {
-		if err := r.Update(); err != nil && len(r.plugins) == 0 {
+		if err := r.Update(); err != nil {
 			return nil, err
 		}
 	}

core/internal/plugins/registry_test.go

@@ -2,29 +2,18 @@ package plugins
 
 import (
 	"encoding/json"
-	"errors"
-	"os"
 	"path/filepath"
 	"testing"
-	"time"
 
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/registries"
-	"github.com/go-git/go-git/v6"
-	"github.com/go-git/go-git/v6/plumbing/object"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-const testRegistryURL = "https://example.com/test-registry.git"
-
 type mockGitClient struct {
 	cloneFunc      func(path string, url string) error
 	pullFunc       func(path string) error
-	originFunc     func(path string) (string, error)
 	hasUpdatesFunc func(path string) (bool, string, string, error)
-	revisionFunc   func(path string) (string, error)
-	checkoutFunc   func(path string, revision string) error
 }
 
 func (m *mockGitClient) PlainClone(path string, url string) error {
@@ -41,13 +30,6 @@ func (m *mockGitClient) Pull(path string) error {
 	return nil
 }
 
-func (m *mockGitClient) OriginURL(path string) (string, error) {
-	if m.originFunc != nil {
-		return m.originFunc(path)
-	}
-	return "https://github.com/test/plugin.git", nil
-}
-
 func (m *mockGitClient) HasUpdates(path string) (bool, string, string, error) {
 	if m.hasUpdatesFunc != nil {
 		return m.hasUpdatesFunc(path)
@@ -55,27 +37,11 @@ func (m *mockGitClient) HasUpdates(path string) (bool, string, string, error) {
 	return false, "", "", nil
 }
 
-func (m *mockGitClient) CurrentRevision(path string) (string, error) {
-	if m.revisionFunc != nil {
-		return m.revisionFunc(path)
-	}
-	return "0123456789abcdef0123456789abcdef01234567", nil
-}
-
-func (m *mockGitClient) CheckoutRevision(path string, revision string) error {
-	if m.checkoutFunc != nil {
-		return m.checkoutFunc(path, revision)
-	}
-	return nil
-}
-
 func TestNewRegistry(t *testing.T) {
 	registry, err := NewRegistry()
 	assert.NoError(t, err)
 	assert.NotNil(t, registry)
 	assert.NotEmpty(t, registry.cacheDir)
-	require.NotEmpty(t, registry.registries)
-	assert.Equal(t, registries.OfficialName, registry.registries[0].Name)
 }
 
 func TestGetCacheDir(t *testing.T) {
@@ -83,50 +49,14 @@ func TestGetCacheDir(t *testing.T) {
 	assert.Contains(t, cacheDir, "/tmp/dankdots-plugin-registry")
 }
 
-func TestRealGitClientRevisionCheckout(t *testing.T) {
-	repoPath := t.TempDir()
-	repo, err := git.PlainInit(repoPath, false)
-	require.NoError(t, err)
-	worktree, err := repo.Worktree()
-	require.NoError(t, err)
-	filePath := filepath.Join(repoPath, "value.txt")
-	signature := &object.Signature{Name: "DMS Test", Email: "[email protected]", When: time.Unix(1, 0)}
-
-	require.NoError(t, os.WriteFile(filePath, []byte("one"), 0o644))
-	_, err = worktree.Add("value.txt")
-	require.NoError(t, err)
-	first, err := worktree.Commit("first", &git.CommitOptions{Author: signature})
-	require.NoError(t, err)
-
-	require.NoError(t, os.WriteFile(filePath, []byte("two"), 0o644))
-	_, err = worktree.Add("value.txt")
-	require.NoError(t, err)
-	second, err := worktree.Commit("second", &git.CommitOptions{Author: signature})
-	require.NoError(t, err)
-
-	client := &realGitClient{}
-	revision, err := client.CurrentRevision(repoPath)
-	require.NoError(t, err)
-	assert.Equal(t, second.String(), revision)
-	require.NoError(t, client.CheckoutRevision(repoPath, first.String()))
-
-	revision, err = client.CurrentRevision(repoPath)
-	require.NoError(t, err)
-	assert.Equal(t, first.String(), revision)
-	data, err := os.ReadFile(filePath)
-	require.NoError(t, err)
-	assert.Equal(t, "one", string(data))
-}
-
 func setupTestRegistry(t *testing.T) (*Registry, afero.Fs, string) {
 	fs := afero.NewMemMapFs()
 	tmpDir := "/test-cache"
 	registry := &Registry{
-		fs:         fs,
-		cacheDir:   tmpDir,
-		registries: []registries.Source{{Name: "test", URL: testRegistryURL}},
-		plugins:    []Plugin{},
-		git:        &mockGitClient{},
+		fs:       fs,
+		cacheDir: tmpDir,
+		plugins:  []Plugin{},
+		git:      &mockGitClient{},
 	}
 	return registry, fs, tmpDir
 }
@@ -174,14 +104,14 @@ func TestLoadPlugins(t *testing.T) {
 		createTestPlugin(t, fs, tmpDir, "plugin1.json", plugin1)
 		createTestPlugin(t, fs, tmpDir, "plugin2.json", plugin2)
 
-		plugins, err := registry.loadPluginsFrom(tmpDir)
+		err := registry.loadPlugins()
 		assert.NoError(t, err)
-		assert.Len(t, plugins, 2)
+		assert.Len(t, registry.plugins, 2)
 
-		assert.Equal(t, "TestPlugin1", plugins[0].Name)
-		assert.Equal(t, "TestPlugin2", plugins[1].Name)
-		assert.Equal(t, []string{"dankbar-widget"}, plugins[0].Capabilities)
-		assert.Equal(t, []string{"dep1", "dep2"}, plugins[1].Dependencies)
+		assert.Equal(t, "TestPlugin1", registry.plugins[0].Name)
+		assert.Equal(t, "TestPlugin2", registry.plugins[1].Name)
+		assert.Equal(t, []string{"dankbar-widget"}, registry.plugins[0].Capabilities)
+		assert.Equal(t, []string{"dep1", "dep2"}, registry.plugins[1].Dependencies)
 	})
 
 	t.Run("skips non-json files", func(t *testing.T) {
@@ -206,10 +136,34 @@ func TestLoadPlugins(t *testing.T) {
 		}
 		createTestPlugin(t, fs, tmpDir, "valid.json", plugin)
 
-		plugins, err := registry.loadPluginsFrom(tmpDir)
+		err = registry.loadPlugins()
 		assert.NoError(t, err)
-		assert.Len(t, plugins, 1)
-		assert.Equal(t, "ValidPlugin", plugins[0].Name)
+		assert.Len(t, registry.plugins, 1)
+		assert.Equal(t, "ValidPlugin", registry.plugins[0].Name)
+	})
+
+	t.Run("skips directories", func(t *testing.T) {
+		registry, fs, tmpDir := setupTestRegistry(t)
+
+		pluginsDir := filepath.Join(tmpDir, "plugins")
+		err := fs.MkdirAll(filepath.Join(pluginsDir, "subdir"), 0o755)
+		require.NoError(t, err)
+
+		plugin := Plugin{
+			Name:         "ValidPlugin",
+			Capabilities: []string{"test"},
+			Category:     "test",
+			Repo:         "https://github.com/test/test",
+			Author:       "Test",
+			Description:  "Test",
+			Compositors:  []string{"niri"},
+			Distro:       []string{"any"},
+		}
+		createTestPlugin(t, fs, tmpDir, "valid.json", plugin)
+
+		err = registry.loadPlugins()
+		assert.NoError(t, err)
+		assert.Len(t, registry.plugins, 1)
 	})
 
 	t.Run("skips invalid json files", func(t *testing.T) {
@@ -234,18 +188,18 @@ func TestLoadPlugins(t *testing.T) {
 		}
 		createTestPlugin(t, fs, tmpDir, "valid.json", plugin)
 
-		plugins, err := registry.loadPluginsFrom(tmpDir)
+		err = registry.loadPlugins()
 		assert.NoError(t, err)
-		assert.Len(t, plugins, 1)
-		assert.Equal(t, "ValidPlugin", plugins[0].Name)
+		assert.Len(t, registry.plugins, 1)
+		assert.Equal(t, "ValidPlugin", registry.plugins[0].Name)
 	})
 
-	t.Run("missing plugins directory is a themes-only registry", func(t *testing.T) {
+	t.Run("returns error when plugins directory missing", func(t *testing.T) {
 		registry, _, _ := setupTestRegistry(t)
 
-		plugins, err := registry.loadPluginsFrom(registry.cacheDir)
-		assert.NoError(t, err)
-		assert.Empty(t, plugins)
+		err := registry.loadPlugins()
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "failed to read plugins directory")
 	})
 }
 
@@ -286,40 +240,19 @@ func TestList(t *testing.T) {
 			Distro:       []string{"any"},
 		}
 
-		registry.git = &mockGitClient{
+		mockGit := &mockGitClient{
 			cloneFunc: func(path string, url string) error {
 				createTestPlugin(t, fs, path, "plugin.json", plugin)
 				return nil
 			},
 		}
+		registry.git = mockGit
 
 		plugins, err := registry.List()
 		assert.NoError(t, err)
 		assert.Len(t, plugins, 1)
 		assert.Equal(t, "NewPlugin", plugins[0].Name)
 	})
-
-	t.Run("partial registry failure still returns loaded plugins", func(t *testing.T) {
-		registry, fs, _ := setupTestRegistry(t)
-
-		registry.registries = []registries.Source{
-			{Name: "test", URL: testRegistryURL},
-			{Name: "broken", URL: "https://example.com/broken.git"},
-		}
-		registry.git = &mockGitClient{
-			cloneFunc: func(path string, url string) error {
-				if url != testRegistryURL {
-					return errors.New("clone failed")
-				}
-				createTestPlugin(t, fs, path, "x.json", Plugin{ID: "x", Name: "X"})
-				return nil
-			},
-		}
-
-		plugins, err := registry.List()
-		assert.NoError(t, err)
-		assert.Len(t, plugins, 1)
-	})
 }
 
 func TestUpdate(t *testing.T) {
@@ -338,15 +271,16 @@ func TestUpdate(t *testing.T) {
 		}
 
 		cloneCalled := false
-		registry.git = &mockGitClient{
+		mockGit := &mockGitClient{
 			cloneFunc: func(path string, url string) error {
 				cloneCalled = true
-				assert.Equal(t, testRegistryURL, url)
-				assert.Equal(t, filepath.Join(tmpDir, "test"), path)
+				assert.Equal(t, registryRepo, url)
+				assert.Equal(t, tmpDir, path)
 				createTestPlugin(t, fs, path, "plugin.json", plugin)
 				return nil
 			},
 		}
+		registry.git = mockGit
 
 		err := registry.Update()
 		assert.NoError(t, err)
@@ -355,7 +289,7 @@ func TestUpdate(t *testing.T) {
 		assert.Equal(t, "RepoPlugin", registry.plugins[0].Name)
 	})
 
-	t.Run("pulls when cache exists with matching origin", func(t *testing.T) {
+	t.Run("pulls updates when cache exists", func(t *testing.T) {
 		registry, fs, tmpDir := setupTestRegistry(t)
 
 		plugin := Plugin{
@@ -369,188 +303,24 @@ func TestUpdate(t *testing.T) {
 			Distro:       []string{"any"},
 		}
 
-		subdir := filepath.Join(tmpDir, "test")
-		require.NoError(t, fs.MkdirAll(subdir, 0o755))
+		err := fs.MkdirAll(tmpDir, 0o755)
+		require.NoError(t, err)
 
 		pullCalled := false
-		registry.git = &mockGitClient{
-			originFunc: func(path string) (string, error) {
-				return testRegistryURL, nil
-			},
+		mockGit := &mockGitClient{
 			pullFunc: func(path string) error {
 				pullCalled = true
-				assert.Equal(t, subdir, path)
+				assert.Equal(t, tmpDir, path)
 				createTestPlugin(t, fs, path, "plugin.json", plugin)
 				return nil
 			},
 		}
+		registry.git = mockGit
 
-		err := registry.Update()
+		err = registry.Update()
 		assert.NoError(t, err)
 		assert.True(t, pullCalled)
 		assert.Len(t, registry.plugins, 1)
 		assert.Equal(t, "UpdatedPlugin", registry.plugins[0].Name)
 	})
-
-	t.Run("re-clones when cached origin does not match configured URL", func(t *testing.T) {
-		registry, fs, tmpDir := setupTestRegistry(t)
-
-		subdir := filepath.Join(tmpDir, "test")
-		require.NoError(t, fs.MkdirAll(subdir, 0o755))
-		require.NoError(t, afero.WriteFile(fs, filepath.Join(subdir, "stale"), []byte("x"), 0o644))
-
-		pullCalled := false
-		cloneCalled := false
-		registry.git = &mockGitClient{
-			originFunc: func(path string) (string, error) {
-				return "https://example.com/old-origin.git", nil
-			},
-			pullFunc: func(path string) error {
-				pullCalled = true
-				return nil
-			},
-			cloneFunc: func(path string, url string) error {
-				cloneCalled = true
-				assert.Equal(t, testRegistryURL, url)
-				createTestPlugin(t, fs, path, "x.json", Plugin{ID: "x", Name: "X"})
-				return nil
-			},
-		}
-
-		err := registry.Update()
-		assert.NoError(t, err)
-		assert.False(t, pullCalled, "stale origin must not be pulled")
-		assert.True(t, cloneCalled)
-		exists, _ := afero.Exists(fs, filepath.Join(subdir, "stale"))
-		assert.False(t, exists, "stale cache contents removed before re-clone")
-	})
-
-	t.Run("re-clones when pull fails", func(t *testing.T) {
-		registry, fs, tmpDir := setupTestRegistry(t)
-
-		subdir := filepath.Join(tmpDir, "test")
-		require.NoError(t, fs.MkdirAll(subdir, 0o755))
-
-		cloneCalled := false
-		registry.git = &mockGitClient{
-			originFunc: func(path string) (string, error) {
-				return testRegistryURL, nil
-			},
-			pullFunc: func(path string) error {
-				return errors.New("shallow clone corruption")
-			},
-			cloneFunc: func(path string, url string) error {
-				cloneCalled = true
-				createTestPlugin(t, fs, path, "x.json", Plugin{ID: "x", Name: "X"})
-				return nil
-			},
-		}
-
-		err := registry.Update()
-		assert.NoError(t, err)
-		assert.True(t, cloneCalled)
-	})
-
-	t.Run("aggregates from multiple registries", func(t *testing.T) {
-		registry, fs, _ := setupTestRegistry(t)
-
-		pluginA := Plugin{ID: "a", Name: "PluginA", Compositors: []string{"niri"}, Distro: []string{"any"}}
-		pluginB := Plugin{ID: "b", Name: "PluginB", Compositors: []string{"niri"}, Distro: []string{"any"}}
-
-		registry.registries = []registries.Source{
-			{Name: "official", URL: testRegistryURL},
-			{Name: "louzt", URL: "https://example.com/louzt.git"},
-		}
-
-		registry.git = &mockGitClient{
-			cloneFunc: func(path string, url string) error {
-				switch filepath.Base(path) {
-				case "official":
-					createTestPlugin(t, fs, path, "x.json", pluginA)
-				case "louzt":
-					createTestPlugin(t, fs, path, "x.json", pluginB)
-				}
-				return nil
-			},
-		}
-
-		err := registry.Update()
-		assert.NoError(t, err)
-		assert.Len(t, registry.plugins, 2)
-		assert.Equal(t, "a", registry.plugins[0].ID)
-		assert.Equal(t, "b", registry.plugins[1].ID)
-	})
-
-	t.Run("dedupes by ID with declaration order priority", func(t *testing.T) {
-		registry, fs, _ := setupTestRegistry(t)
-
-		pluginOfficial := Plugin{ID: "weather", Name: "OfficialWeather", Compositors: []string{"niri"}, Distro: []string{"any"}}
-		pluginLouzt := Plugin{ID: "weather", Name: "LouztWeather", Compositors: []string{"niri"}, Distro: []string{"any"}}
-
-		registry.registries = []registries.Source{
-			{Name: "official", URL: testRegistryURL},
-			{Name: "louzt", URL: "https://example.com/louzt.git"},
-		}
-
-		registry.git = &mockGitClient{
-			cloneFunc: func(path string, url string) error {
-				switch filepath.Base(path) {
-				case "official":
-					createTestPlugin(t, fs, path, "x.json", pluginOfficial)
-				case "louzt":
-					createTestPlugin(t, fs, path, "x.json", pluginLouzt)
-				}
-				return nil
-			},
-		}
-
-		err := registry.Update()
-		assert.NoError(t, err)
-		assert.Len(t, registry.plugins, 1)
-		assert.Equal(t, "OfficialWeather", registry.plugins[0].Name)
-	})
-
-	t.Run("continues past failing registry and reports it", func(t *testing.T) {
-		registry, fs, _ := setupTestRegistry(t)
-
-		registry.registries = []registries.Source{
-			{Name: "broken", URL: "https://example.com/broken.git"},
-			{Name: "test", URL: testRegistryURL},
-		}
-		registry.git = &mockGitClient{
-			cloneFunc: func(path string, url string) error {
-				if url != testRegistryURL {
-					return errors.New("network unreachable")
-				}
-				createTestPlugin(t, fs, path, "x.json", Plugin{ID: "x", Name: "X"})
-				return nil
-			},
-		}
-
-		err := registry.Update()
-		assert.Error(t, err)
-		assert.Contains(t, err.Error(), "registry broken")
-		assert.Len(t, registry.plugins, 1, "healthy registry still loads")
-	})
-
-	t.Run("removes legacy single-clone cache at base", func(t *testing.T) {
-		registry, fs, tmpDir := setupTestRegistry(t)
-
-		require.NoError(t, fs.MkdirAll(filepath.Join(tmpDir, ".git"), 0o755))
-		createTestPlugin(t, fs, tmpDir, "legacy.json", Plugin{ID: "legacy", Name: "Legacy"})
-
-		registry.git = &mockGitClient{
-			cloneFunc: func(path string, url string) error {
-				createTestPlugin(t, fs, path, "x.json", Plugin{ID: "x", Name: "X"})
-				return nil
-			},
-		}
-
-		err := registry.Update()
-		assert.NoError(t, err)
-		exists, _ := afero.DirExists(fs, filepath.Join(tmpDir, ".git"))
-		assert.False(t, exists, "legacy clone removed")
-		assert.Len(t, registry.plugins, 1)
-		assert.Equal(t, "x", registry.plugins[0].ID)
-	})
 }