fix(nix): restore pre-wrap Qt paths for launcher-spawned apps

.github/release.yml

@@ -1,23 +0,0 @@
-# Categories for GitHub's auto-generated release notes
-changelog:
-  exclude:
-    authors:
-      - github-actions[bot]
-      - dependabot[bot]
-    labels:
-      - internal
-  categories:
-    - title: Breaking Changes
-      labels: [breaking]
-    - title: Features
-      labels: [feature]
-    - title: Fixes
-      labels: [fix]
-    - title: Packaging
-      labels: [packaging]
-    - title: Internationalization
-      labels: [i18n]
-    - title: Documentation
-      labels: [docs]
-    - title: Other Changes
-      labels: ["*"]

.github/scripts/publish-void-r2.sh

@@ -1,170 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-usage() {
-    echo "usage: $0 download|publish" >&2
-    exit 2
-}
-
-require_env() {
-    local name
-    for name in "$@"; do
-        if [[ -z "${!name:-}" ]]; then
-            echo "error: $name is required" >&2
-            exit 2
-        fi
-    done
-}
-
-require_env R2_BUCKET R2_ENDPOINT R2_PREFIX REPOSITORY_DIR
-
-aws_r2() {
-    aws --endpoint-url "$R2_ENDPOINT" "$@"
-}
-
-download() {
-    mkdir -p "$REPOSITORY_DIR/current" "$REPOSITORY_DIR/previous-current"
-
-    aws_r2 s3 sync \
-        "s3://${R2_BUCKET}/${R2_PREFIX}/current/" \
-        "$REPOSITORY_DIR/current/" \
-        --only-show-errors
-
-    cp -a "$REPOSITORY_DIR/current/." "$REPOSITORY_DIR/previous-current/"
-}
-
-build_manifest() {
-    local packages='[]'
-    local file filename pkgver name version revision sha size
-
-    for file in "$REPOSITORY_DIR"/current/*.xbps; do
-        filename="$(basename "$file")"
-        pkgver="$(xbps-uhelper binpkgver "$filename")"
-        name="$(xbps-uhelper getpkgname "$pkgver")"
-        version="$(xbps-uhelper getpkgversion "$pkgver")"
-        revision="$(xbps-uhelper getpkgrevision "$pkgver")"
-        version="${version%_"${revision}"}"
-        sha="$(sha256sum "$file" | cut -d' ' -f1)"
-        size="$(stat -c '%s' "$file")"
-        packages="$(jq \
-            --arg name "$name" \
-            --arg version "$version" \
-            --arg revision "$revision" \
-            --arg filename "$filename" \
-            --arg sha256 "$sha" \
-            --argjson size "$size" \
-            '. + [{name: $name, version: $version, revision: $revision, filename: $filename, sha256: $sha256, size: $size}]' \
-            <<<"$packages")"
-    done
-
-    jq -n \
-        --arg repository "$R2_PREFIX" \
-        --arg source_commit "$SOURCE_COMMIT" \
-        --arg published_at "$PUBLISHED_AT" \
-        --argjson packages "$packages" \
-        '{schema: 1, repository: $repository, source_commit: $source_commit, published_at: $published_at, packages: $packages}' \
-        > "$REPOSITORY_DIR/current/manifest.json"
-}
-
-verify_immutable_packages() {
-    local file previous
-
-    for file in "$REPOSITORY_DIR"/current/*.xbps "$REPOSITORY_DIR"/current/*.sig2; do
-        previous="$REPOSITORY_DIR/previous-current/$(basename "$file")"
-        if [[ -f "$previous" ]] && ! cmp -s "$previous" "$file"; then
-            echo "error: refusing to replace immutable object $(basename "$file")" >&2
-            echo "bump the XBPS revision or version before publishing a changed build" >&2
-            exit 1
-        fi
-    done
-}
-
-archive_retired() {
-    local old filename
-    local archive_prefix="archive/${R2_PREFIX}/${PUBLISHED_AT//:/-}"
-
-    shopt -s nullglob
-    for old in "$REPOSITORY_DIR"/previous-current/*.xbps "$REPOSITORY_DIR"/previous-current/*.sig2; do
-        filename="$(basename "$old")"
-        if [[ ! -e "$REPOSITORY_DIR/current/$filename" ]]; then
-            aws_r2 s3 cp \
-                "$old" \
-                "s3://${R2_BUCKET}/${archive_prefix}/${filename}" \
-                --cache-control 'private,no-store' \
-                --only-show-errors
-        fi
-    done
-}
-
-upload_current() {
-    local file filename old
-
-    # Versioned package objects must exist before repodata can reference them.
-    for file in "$REPOSITORY_DIR"/current/*.xbps "$REPOSITORY_DIR"/current/*.sig2; do
-        filename="$(basename "$file")"
-        aws_r2 s3 cp \
-            "$file" \
-            "s3://${R2_BUCKET}/${R2_PREFIX}/current/${filename}" \
-            --cache-control 'public,max-age=31536000,immutable' \
-            --only-show-errors
-    done
-
-    aws_r2 s3 cp \
-        "$REPOSITORY_DIR/current/x86_64-repodata" \
-        "s3://${R2_BUCKET}/${R2_PREFIX}/current/x86_64-repodata" \
-        --cache-control 'no-cache' \
-        --only-show-errors
-
-    # The manifest is the publication marker and is always uploaded last.
-    aws_r2 s3 cp \
-        "$REPOSITORY_DIR/current/manifest.json" \
-        "s3://${R2_BUCKET}/${R2_PREFIX}/current/manifest.json" \
-        --cache-control 'no-cache' \
-        --only-show-errors
-
-    # Once the new index and marker are live, remove objects no longer referenced.
-    shopt -s nullglob
-    for old in "$REPOSITORY_DIR"/previous-current/*; do
-        filename="$(basename "$old")"
-        if [[ ! -e "$REPOSITORY_DIR/current/$filename" ]]; then
-            aws_r2 s3 rm \
-                "s3://${R2_BUCKET}/${R2_PREFIX}/current/${filename}" \
-                --only-show-errors
-        fi
-    done
-}
-
-publish() {
-    require_env SOURCE_COMMIT
-    PUBLISHED_AT="${PUBLISHED_AT:-$(date -u +'%Y-%m-%dT%H:%M:%SZ')}"
-    export PUBLISHED_AT
-
-    shopt -s nullglob
-    local packages=("$REPOSITORY_DIR"/current/*.xbps)
-    if (( ${#packages[@]} == 0 )); then
-        echo "error: refusing to publish an empty XBPS repository" >&2
-        exit 1
-    fi
-    [[ -s "$REPOSITORY_DIR/current/x86_64-repodata" ]] || {
-        echo "error: x86_64-repodata is missing or empty" >&2
-        exit 1
-    }
-    for file in "${packages[@]}"; do
-        [[ -s "${file}.sig2" ]] || {
-            echo "error: signature is missing for $(basename "$file")" >&2
-            exit 1
-        }
-    done
-
-    verify_immutable_packages
-    build_manifest
-    archive_retired
-    upload_current
-}
-
-case "${1:-}" in
-    download) download ;;
-    publish) publish ;;
-    *) usage ;;
-esac

.github/workflows/common-parity.yml

@@ -1,56 +0,0 @@
-name: Sync flake.lock to dank-qml-common
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - "dank-qml-common"
-    branches:
-      - master
-
-permissions:
-  contents: write
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Create GitHub App token
-        id: app_token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-          token: ${{ steps.app_token.outputs.token }}
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v31
-
-      - name: Point flake input at the submodule commit
-        run: |
-          set -euo pipefail
-          submodule_rev=$(git ls-tree HEAD dank-qml-common --object-only)
-          flake_rev=$(python3 -c "import json; print(json.load(open('flake.lock'))['nodes']['dank-qml-common']['locked']['rev'])")
-          [ "$submodule_rev" = "$flake_rev" ] && { echo "flake.lock already matches $submodule_rev"; exit 0; }
-          nix flake lock --override-input dank-qml-common "github:AvengeMedia/dank-qml-common/$submodule_rev"
-
-      - name: Commit and push flake.lock update
-        env:
-          GH_TOKEN: ${{ steps.app_token.outputs.token }}
-        run: |
-          set -euo pipefail
-          if git diff --quiet flake.lock; then
-            echo "No changes to flake.lock"
-            exit 0
-          fi
-          git config user.name "dms-ci[bot]"
-          git config user.email "dms-ci[bot]@users.noreply.github.com"
-          git add flake.lock
-          git commit -m "nix: sync flake.lock to dank-qml-common submodule"
-          git pull --rebase origin ${{ github.ref_name }}
-          git push https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git HEAD:${{ github.ref_name }}

.github/workflows/dms-stable.yml

@@ -7,17 +7,14 @@ on:
 
 permissions:
   contents: write
-  issues: write
 
 jobs:
   update-stable:
-    # skip prerelease tags
-    if: ${{ !contains(github.ref_name, '-') }}
     runs-on: ubuntu-latest
     steps:
       - name: Create GitHub App token
         id: app_token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@v1
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -31,54 +28,4 @@ jobs:
       - name: Push to stable branch
         env:
           GH_TOKEN: ${{ steps.app_token.outputs.token }}
-        run: |
-          set -euo pipefail
-          # don't roll stable backwards
-          if git fetch origin stable --quiet 2>/dev/null; then
-            stable_tag=$(git describe --tags --abbrev=0 FETCH_HEAD 2>/dev/null || echo "v0.0.0")
-            newest=$(printf '%s\n%s\n' "$stable_tag" "${GITHUB_REF_NAME}" | sort -V | tail -1)
-            if [ "$newest" != "${GITHUB_REF_NAME}" ]; then
-              echo "skipping: ${GITHUB_REF_NAME} is older than stable (${stable_tag})"
-              exit 0
-            fi
-          fi
-          git push "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" HEAD:refs/heads/stable --force
-
-  cut-release-branch:
-    # create stable-X.Y at each vX.Y.0 tag
-    if: ${{ !contains(github.ref_name, '-') }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Create GitHub App token
-        id: app_token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-          token: ${{ steps.app_token.outputs.token }}
-
-      - name: Create release branch
-        env:
-          GH_TOKEN: ${{ steps.app_token.outputs.token }}
-        run: |
-          set -euo pipefail
-          if [[ ! "${GITHUB_REF_NAME}" =~ ^v([0-9]+)\.([0-9]+)\.0$ ]]; then
-            echo "not a vX.Y.0 tag, no release branch to cut"
-            exit 0
-          fi
-          branch="stable-${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
-          if git ls-remote --exit-code origin "refs/heads/${branch}" >/dev/null 2>&1; then
-            echo "${branch} already exists"
-            exit 0
-          fi
-          git push "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" "HEAD:refs/heads/${branch}"
-          echo "created ${branch} at ${GITHUB_REF_NAME}"
-          GH_TOKEN="${{ secrets.GITHUB_TOKEN }}" gh label create "port ${branch}" \
-            --repo "${{ github.repository }}" \
-            --description "Auto-port merged PR to ${branch}" --color 0e8a16 ||
-            echo "label 'port ${branch}' may already exist"
+        run: git push https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git HEAD:refs/heads/stable --force

.github/workflows/go-ci.yml

@@ -8,7 +8,7 @@ on:
       - "core/**"
       - ".github/workflows/go-ci.yml"
   pull_request:
-    branches: [master, main, "stable-*"]
+    branches: [master, main]
     paths:
       - "core/**"
       - ".github/workflows/go-ci.yml"
@@ -27,8 +27,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
-        with:
-          submodules: recursive
 
       - name: Install flatpak
         run: sudo apt update && sudo apt install -y flatpak
@@ -50,39 +48,8 @@ jobs:
       - name: Build dms
         run: go build -v ./cmd/dms
 
-      - name: Build dms (embedded shell)
-        run: make build
-
       - name: Build dms (distropkg)
-        run: go build -v -tags 'distro_binary withshell' ./cmd/dms
+        run: go build -v -tags distro_binary ./cmd/dms
 
       - name: Build dankinstall
         run: go build -v ./cmd/dankinstall
-
-  build-freebsd:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: core
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          submodules: recursive
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: ./core/go.mod
-
-      - name: Build all packages
-        env:
-          GOOS: freebsd
-          CGO_ENABLED: 0
-        run: go build -v ./...
-
-      - name: Build dms (distropkg, embedded shell)
-        run: |
-          make sync-shell
-          GOOS=freebsd CGO_ENABLED=0 go build -v -tags 'distro_binary withshell' ./cmd/dms

.github/workflows/nix-pr-check.yml

@@ -2,7 +2,7 @@ name: Nix flake and NixOS tests
 
 on:
   pull_request:
-    branches: [master, main, "stable-*"]
+    branches: [master, main]
     paths:
       - "flake.*"
       - "distro/nix/**"
@@ -33,6 +33,8 @@ jobs:
       - name: Run NixOS service start test
         run: nix build .#nixosTests.x86_64-linux.nixos-service-start-module -L
 
+      - name: Run greeter niri test
+        run: nix build .#nixosTests.x86_64-linux.greeter-niri-module -L
 
       - name: Run home-manager module test
         run: nix build .#nixosTests.x86_64-linux.home-manager-module -L

.github/workflows/point-release.yml

@@ -1,107 +0,0 @@
-name: Point release
-
-# Cuts vX.Y.Z from stable-X.Y: runs the port audit (warn-only), bumps
-# quickshell/VERSION, tags, and dispatches the Release workflow. Distro
-# builds are dispatched separately.
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Point release version (e.g. 1.5.1)"
-        required: true
-        type: string
-      notify_issues:
-        description: "Comment on open related/fixes issues asking reporters to retest"
-        required: false
-        type: boolean
-        default: true
-
-permissions:
-  contents: write
-  actions: write
-
-concurrency:
-  group: point-release
-  cancel-in-progress: false
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    env:
-      VERSION: ${{ inputs.version }}
-    steps:
-      - name: Validate version and derive branch
-        id: derive
-        run: |
-          set -euo pipefail
-          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::version must be X.Y.Z (got '$VERSION')"; exit 1
-          fi
-          echo "branch=stable-${VERSION%.*}" >> "$GITHUB_OUTPUT"
-          echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
-
-      - name: Create GitHub App token
-        id: app_token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - name: Checkout release branch
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ steps.derive.outputs.branch }}
-          fetch-depth: 0
-          token: ${{ steps.app_token.outputs.token }}
-
-      - name: Preflight — verify Release workflow is dispatchable
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          gh api "repos/${{ github.repository }}/actions/workflows/release.yml" \
-            --jq '.state' | grep -qx active ||
-            { echo "::error::release.yml is not dispatchable; aborting before any push"; exit 1; }
-
-      - name: Port audit (informational)
-        env:
-          GH_TOKEN: ${{ steps.app_token.outputs.token }}
-        run: |
-          bash scripts/port-audit.sh "${{ steps.derive.outputs.branch }}" ||
-            echo "::warning::port audit failed; continuing"
-
-      - name: Bump VERSION, tag, and push
-        env:
-          GH_TOKEN: ${{ steps.app_token.outputs.token }}
-          TAG: ${{ steps.derive.outputs.tag }}
-          BRANCH: ${{ steps.derive.outputs.branch }}
-        run: |
-          set -euo pipefail
-          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
-            echo "::error::tag ${TAG} already exists"; exit 1
-          fi
-          git config user.name "dms-ci[bot]"
-          git config user.email "dms-ci[bot]@users.noreply.github.com"
-
-          echo "${TAG}" > quickshell/VERSION
-          git add quickshell/VERSION
-          git commit -m "bump VERSION to ${TAG}"
-          git tag "${TAG}"
-          git push "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" "HEAD:${BRANCH}" "refs/tags/${TAG}"
-
-      - name: Dispatch Release workflow
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh workflow run release.yml --ref "${{ steps.derive.outputs.tag }}" \
-            -f tag="${{ steps.derive.outputs.tag }}" \
-            -f notify_issues="${{ inputs.notify_issues }}"
-
-      - name: Next steps
-        run: |
-          {
-            echo "## ${{ steps.derive.outputs.tag }} tagged on ${{ steps.derive.outputs.branch }} — Release workflow dispatched"
-            echo ""
-            echo "Distro builds are manual: run the per-distro workflows (COPR/OBS/PPA/XBPS) once the release is published."
-          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/port-audit.yml

@@ -1,30 +0,0 @@
-name: Port audit
-
-# On-demand report of master commits not yet ported to a release branch.
-# Updates the "Port status: <branch>" tracking issue and the step summary.
-
-on:
-  workflow_dispatch:
-    inputs:
-      target:
-        description: "Release branch to audit (default: newest release/*)"
-        required: false
-        type: string
-
-permissions:
-  contents: read
-  issues: write
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Run audit
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: bash scripts/port-audit.sh ${{ inputs.target }} --issue

.github/workflows/port.yml

@@ -1,101 +0,0 @@
-name: Port to release branch
-
-# Ports flagged commits from master onto stable-X.Y branches:
-#   - "port 1.5" flag in a commit message pushed to master — own line or
-#     mid-line; separators : / - or space; "stable-1.5" also accepted;
-#     comma lists ("Port: 1.5, 1.4") work in the own-line form
-#   - "port stable-1.5" label on a merged PR
-# Conflicts are reported to the "Port status: <branch>" tracking issue.
-
-on:
-  push:
-    branches: [master]
-  pull_request_target:
-    types: [closed, labeled]
-
-permissions:
-  contents: write
-  issues: write
-
-concurrency:
-  group: port-engine
-  cancel-in-progress: false
-
-jobs:
-  port:
-    name: Port flagged commits
-    runs-on: ubuntu-latest
-    steps:
-      - name: Create GitHub App token
-        id: app_token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      # Base-repo code only; PR head code is never checked out or executed.
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: master
-          fetch-depth: 0
-          token: ${{ steps.app_token.outputs.token }}
-
-      - name: Port trailer-flagged commits
-        if: github.event_name == 'push'
-        env:
-          GH_TOKEN: ${{ steps.app_token.outputs.token }}
-          COMMITS: ${{ toJSON(github.event.commits) }}
-        run: |
-          set -euo pipefail
-          git config user.name "dms-ci[bot]"
-          git config user.email "dms-ci[bot]@users.noreply.github.com"
-
-          for sha in $(jq -r '.[].id' <<<"$COMMITS"); do
-            git cat-file -e "$sha" 2>/dev/null || continue
-            # skip merge commits (handled by the label path)
-            [ "$(git rev-list --no-walk --count --min-parents=2 "$sha")" -eq 0 ] || continue
-
-            # own-line form (supports comma lists), validated version-shaped
-            t1=$(git log -1 --format=%B "$sha" |
-              { grep -iE '^Port[:/ -]' || true; } | sed -E 's|^port[-:/ ]+||I' | tr ',' '\n' |
-              sed 's/[[:space:]]//g; /^$/d' | sed -E 's,^stable-,,I' |
-              { grep -E '^[0-9]+\.[0-9]+(\.[0-9]+)?$' || true; })
-            # mid-line form, e.g. "fix thing fixes #2802 port 1.5"
-            t2=$(git log -1 --format=%B "$sha" |
-              { grep -oiE '\bport[-: /]+(stable-)?[0-9]+\.[0-9]+(\.[0-9]+)?\b' || true; } |
-              sed -E 's|^port[-:/ ]+||I' | sed -E 's,^stable-,,I')
-            targets=$(printf '%s\n%s\n' "$t1" "$t2" | sed '/^$/d' | sort -u)
-            for ver in $targets; do
-              echo "::group::port $sha -> stable-$ver"
-              bash scripts/port.sh "stable-$ver" "$sha"
-              echo "::endgroup::"
-            done
-          done
-
-      - name: Port label-flagged PR
-        if: >
-          github.event_name == 'pull_request_target' &&
-          github.event.pull_request.merged == true &&
-          (github.event.action == 'closed' ||
-           (github.event.action == 'labeled' && startsWith(github.event.label.name, 'port ')))
-        env:
-          GH_TOKEN: ${{ steps.app_token.outputs.token }}
-          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
-          MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
-          PORT_SOURCE_PR: ${{ github.event.pull_request.number }}
-        run: |
-          set -euo pipefail
-          git config user.name "dms-ci[bot]"
-          git config user.email "dms-ci[bot]@users.noreply.github.com"
-
-          targets=$(jq -r '.[] | select(startswith("port ")) | sub("^port +"; "")' <<<"$LABELS" |
-            sed -E 's,^stable-,,' | sort -u)
-          [ -n "$targets" ] || { echo "no port labels, nothing to do"; exit 0; }
-          [ -n "$MERGE_SHA" ] || { echo "::error::PR has no merge commit sha"; exit 1; }
-
-          for ver in $targets; do
-            echo "::group::port PR #${PORT_SOURCE_PR} ($MERGE_SHA) -> stable-$ver"
-            bash scripts/port.sh "stable-$ver" "$MERGE_SHA"
-            echo "::endgroup::"
-          done

.github/workflows/prek.yml

@@ -3,15 +3,13 @@ name: Pre-commit Checks
 on:
   push:
   pull_request:
-    branches: [master, main, "stable-*"]
+    branches: [master, main]
 jobs:
   pre-commit-check:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v6
-        with:
-          submodules: recursive
 
       - name: Install flatpak
         run: sudo apt update && sudo apt install -y flatpak

.github/workflows/release.yml

@@ -7,16 +7,10 @@ on:
         description: "Tag to release (e.g., v1.0.1)"
         required: true
         type: string
-      notify_issues:
-        description: "Comment on open related/fixes issues asking reporters to retest"
-        required: false
-        type: boolean
-        default: false
 
 permissions:
   contents: write
   actions: write
-  issues: write
 
 concurrency:
   group: release-${{ inputs.tag }}
@@ -27,11 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        include:
-          - { goos: linux, arch: amd64 }
-          - { goos: linux, arch: arm64 }
-          - { goos: freebsd, arch: amd64 }
-          - { goos: freebsd, arch: arm64 }
+        arch: [amd64, arm64]
 
     defaults:
       run:
@@ -39,8 +29,6 @@ jobs:
 
     env:
       TAG: ${{ inputs.tag }}
-      # linux assets keep their historical arch-only names
-      ASSET: ${{ matrix.goos == 'linux' && matrix.arch || format('{0}-{1}', matrix.goos, matrix.arch) }}
 
     steps:
       - name: Checkout
@@ -48,7 +36,6 @@ jobs:
         with:
           ref: ${{ inputs.tag }}
           fetch-depth: 0
-          submodules: recursive
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -56,7 +43,6 @@ jobs:
           go-version-file: ./core/go.mod
 
       - name: Format check
-        if: matrix.goos == 'linux'
         run: |
           if [ "$(gofmt -s -l . | wc -l)" -gt 0 ]; then
             echo "The following files are not formatted:"
@@ -65,43 +51,38 @@ jobs:
           fi
 
       - name: Run tests
-        if: matrix.goos == 'linux'
         run: go test -v ./...
 
-      - name: Build dankinstall (${{ env.ASSET }})
-        if: matrix.goos == 'linux'
+      - name: Build dankinstall (${{ matrix.arch }})
         env:
-          GOOS: ${{ matrix.goos }}
+          GOOS: linux
           CGO_ENABLED: 0
           GOARCH: ${{ matrix.arch }}
         run: |
           set -eux
           cd cmd/dankinstall
           go build -trimpath -ldflags "-s -w -X main.Version=${TAG}" \
-            -o ../../dankinstall-${{ env.ASSET }}
+            -o ../../dankinstall-${{ matrix.arch }}
           cd ../..
-          gzip -9 -k dankinstall-${{ env.ASSET }}
-          sha256sum dankinstall-${{ env.ASSET }}.gz > dankinstall-${{ env.ASSET }}.gz.sha256
+          gzip -9 -k dankinstall-${{ matrix.arch }}
+          sha256sum dankinstall-${{ matrix.arch }}.gz > dankinstall-${{ matrix.arch }}.gz.sha256
 
-      - name: Sync embedded shell
-        run: make sync-shell
-
-      - name: Build dms (${{ env.ASSET }})
+      - name: Build dms (${{ matrix.arch }})
         env:
-          GOOS: ${{ matrix.goos }}
+          GOOS: linux
           CGO_ENABLED: 0
           GOARCH: ${{ matrix.arch }}
         run: |
           set -eux
           cd cmd/dms
-          go build -trimpath -tags withshell -ldflags "-s -w -X main.Version=${TAG}" \
-            -o ../../dms-${{ env.ASSET }}
+          go build -trimpath -ldflags "-s -w -X main.Version=${TAG}" \
+            -o ../../dms-${{ matrix.arch }}
           cd ../..
-          gzip -9 -k dms-${{ env.ASSET }}
-          sha256sum dms-${{ env.ASSET }}.gz > dms-${{ env.ASSET }}.gz.sha256
+          gzip -9 -k dms-${{ matrix.arch }}
+          sha256sum dms-${{ matrix.arch }}.gz > dms-${{ matrix.arch }}.gz.sha256
 
       - name: Generate shell completions
-        if: matrix.goos == 'linux' && matrix.arch == 'amd64'
+        if: matrix.arch == 'amd64'
         run: |
           set -eux
           chmod +x dms-amd64
@@ -109,58 +90,46 @@ jobs:
           ./dms-amd64 completion fish > completion.fish
           ./dms-amd64 completion zsh > completion.zsh
 
-      - name: Build dms-distropkg (${{ env.ASSET }})
+      - name: Build dms-distropkg (${{ matrix.arch }})
         env:
-          GOOS: ${{ matrix.goos }}
+          GOOS: linux
           CGO_ENABLED: 0
           GOARCH: ${{ matrix.arch }}
         run: |
           set -eux
           cd cmd/dms
-          go build -trimpath -tags 'distro_binary withshell' -ldflags "-s -w -X main.Version=${TAG}" \
-            -o ../../dms-distropkg-${{ env.ASSET }}
+          go build -trimpath -tags distro_binary -ldflags "-s -w -X main.Version=${TAG}" \
+            -o ../../dms-distropkg-${{ matrix.arch }}
           cd ../..
-          gzip -9 -k dms-distropkg-${{ env.ASSET }}
-          sha256sum dms-distropkg-${{ env.ASSET }}.gz > dms-distropkg-${{ env.ASSET }}.gz.sha256
+          gzip -9 -k dms-distropkg-${{ matrix.arch }}
+          sha256sum dms-distropkg-${{ matrix.arch }}.gz > dms-distropkg-${{ matrix.arch }}.gz.sha256
 
-      - name: Upload artifacts (${{ env.ASSET }})
-        if: matrix.goos == 'linux' && matrix.arch == 'arm64'
+      - name: Upload artifacts (${{ matrix.arch }})
+        if: matrix.arch == 'arm64'
         uses: actions/upload-artifact@v5
         with:
-          name: core-assets-${{ env.ASSET }}
+          name: core-assets-${{ matrix.arch }}
           path: |
-            core/dankinstall-${{ env.ASSET }}.gz
-            core/dankinstall-${{ env.ASSET }}.gz.sha256
-            core/dms-${{ env.ASSET }}.gz
-            core/dms-${{ env.ASSET }}.gz.sha256
-            core/dms-distropkg-${{ env.ASSET }}.gz
-            core/dms-distropkg-${{ env.ASSET }}.gz.sha256
-          if-no-files-found: error
-
-      - name: Upload artifacts (${{ env.ASSET }}, no installer)
-        if: matrix.goos != 'linux'
-        uses: actions/upload-artifact@v5
-        with:
-          name: core-assets-${{ env.ASSET }}
-          path: |
-            core/dms-${{ env.ASSET }}.gz
-            core/dms-${{ env.ASSET }}.gz.sha256
-            core/dms-distropkg-${{ env.ASSET }}.gz
-            core/dms-distropkg-${{ env.ASSET }}.gz.sha256
+            core/dankinstall-${{ matrix.arch }}.gz
+            core/dankinstall-${{ matrix.arch }}.gz.sha256
+            core/dms-${{ matrix.arch }}.gz
+            core/dms-${{ matrix.arch }}.gz.sha256
+            core/dms-distropkg-${{ matrix.arch }}.gz
+            core/dms-distropkg-${{ matrix.arch }}.gz.sha256
           if-no-files-found: error
 
       - name: Upload artifacts with completions
-        if: matrix.goos == 'linux' && matrix.arch == 'amd64'
+        if: matrix.arch == 'amd64'
         uses: actions/upload-artifact@v5
         with:
-          name: core-assets-${{ env.ASSET }}
+          name: core-assets-${{ matrix.arch }}
           path: |
-            core/dankinstall-${{ env.ASSET }}.gz
-            core/dankinstall-${{ env.ASSET }}.gz.sha256
-            core/dms-${{ env.ASSET }}.gz
-            core/dms-${{ env.ASSET }}.gz.sha256
-            core/dms-distropkg-${{ env.ASSET }}.gz
-            core/dms-distropkg-${{ env.ASSET }}.gz.sha256
+            core/dankinstall-${{ matrix.arch }}.gz
+            core/dankinstall-${{ matrix.arch }}.gz.sha256
+            core/dms-${{ matrix.arch }}.gz
+            core/dms-${{ matrix.arch }}.gz.sha256
+            core/dms-distropkg-${{ matrix.arch }}.gz
+            core/dms-distropkg-${{ matrix.arch }}.gz.sha256
             core/completion.bash
             core/completion.fish
             core/completion.zsh
@@ -216,13 +185,11 @@ jobs:
         with:
           ref: ${{ inputs.tag }}
           fetch-depth: 0
-          submodules: recursive
 
       - name: Fetch updated tag after version bump
         run: |
           git fetch origin --force tag ${TAG}
           git checkout ${TAG}
-          git submodule update --init --recursive
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -238,23 +205,13 @@ jobs:
 
       - name: Generate Changelog
         id: changelog
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -e
           PREVIOUS_TAG=$(git describe --tags --abbrev=0 "${TAG}^" 2>/dev/null || echo "")
-          CHANGELOG=""
-          if [ -n "$PREVIOUS_TAG" ]; then
-            # PR-based notes with author credits; falls back to raw git log below
-            CHANGELOG=$(python3 scripts/release-notes.py "${PREVIOUS_TAG}..${TAG}" --format github --bare 2>/dev/null || true)
-          fi
-          if [ -z "$CHANGELOG" ]; then
-            echo "release-notes.py unavailable or empty, using git log fallback"
-            if [ -z "$PREVIOUS_TAG" ]; then
-              CHANGELOG=$(git log --oneline --pretty=format:"%an|%s (%h)" | grep -v "^github-actions\[bot\]|" | sed 's/^[^|]*|/- /' | head -50)
-            else
-              CHANGELOG=$(git log --oneline --pretty=format:"%an|%s (%h)" "${PREVIOUS_TAG}..${TAG}" | grep -v "^github-actions\[bot\]|" | sed 's/^[^|]*|/- /')
-            fi
+          if [ -z "$PREVIOUS_TAG" ]; then
+            CHANGELOG=$(git log --oneline --pretty=format:"%an|%s (%h)" | grep -v "^github-actions\[bot\]|" | sed 's/^[^|]*|/- /' | head -50)
+          else
+            CHANGELOG=$(git log --oneline --pretty=format:"%an|%s (%h)" "${PREVIOUS_TAG}..${TAG}" | grep -v "^github-actions\[bot\]|" | sed 's/^[^|]*|/- /')
           fi
 
           cat > RELEASE_BODY.md << 'EOF'
@@ -269,23 +226,16 @@ jobs:
           ### Complete Packages
           - **`dms-full-amd64.tar.gz`** - Complete package for x86_64 systems (CLI binaries + QML source + shell completions + installation guide)
           - **`dms-full-arm64.tar.gz`** - Complete package for ARM64 systems (CLI binaries + QML source + shell completions + installation guide)
-          - **`dms-full-freebsd-amd64.tar.gz`** - Complete package for FreeBSD x86_64 systems
-          - **`dms-full-freebsd-arm64.tar.gz`** - Complete package for FreeBSD ARM64 systems
 
           ### Individual Components
           - **`dms-cli-amd64.gz`** - DMS CLI binary for x86_64 systems
           - **`dms-cli-arm64.gz`** - DMS CLI binary for ARM64 systems
-          - **`dms-cli-freebsd-amd64.gz`** - DMS CLI binary for FreeBSD x86_64 systems
-          - **`dms-cli-freebsd-arm64.gz`** - DMS CLI binary for FreeBSD ARM64 systems
           - **`dms-distropkg-amd64.gz`** - DMS CLI binary built with distro_package tag for AMD64 systems
           - **`dms-distropkg-arm64.gz`** - DMS CLI binary built with distro_package tag for ARM64 systems
-          - **`dms-distropkg-freebsd-amd64.gz`** - DMS CLI binary built with distro_package tag for FreeBSD x86_64 systems
-          - **`dms-distropkg-freebsd-arm64.gz`** - DMS CLI binary built with distro_package tag for FreeBSD ARM64 systems
           - **`dankinstall-amd64.gz`** - Installer binary for x86_64 systems
           - **`dankinstall-arm64.gz`** - Installer binary for ARM64 systems
           - **`dms-cli-<version>.tar.gz`** - Go source code with vendored modules (for distro packaging)
           - **`dms-qml.tar.gz`** - QML source code only
-          - **`dms-source.tar.gz`** - Full repository source with bundled DankCommon (for distro packaging)
 
           ### Checksums
           - **`*.sha256`** - SHA256 checksums for verifying download integrity
@@ -333,22 +283,6 @@ jobs:
           # Copy completions
           cp _core_assets/completion.* _release_assets/ 2>/dev/null || true
 
-          # Replace the DankCommon symlink with real submodule content for packaging
-          rm quickshell/DankCommon
-          cp -r dank-qml-common/DankCommon quickshell/DankCommon
-
-          # Create full source tarball (GitHub tag archives never contain submodule content)
-          VERSION_NUM=${TAG#v}
-          tar --exclude='.git' \
-              --exclude='.github' \
-              --exclude='dank-qml-common' \
-              --exclude='_release_assets' \
-              --exclude='_core_assets' \
-              --exclude='RELEASE_BODY.md' \
-              --transform "s,^\.,DankMaterialShell-${VERSION_NUM},S" \
-              -czf _release_assets/dms-source.tar.gz .
-          (cd _release_assets && sha256sum dms-source.tar.gz > dms-source.tar.gz.sha256)
-
           # Create QML source package (exclude build artifacts and git files)
           # Copy root LICENSE and CONTRIBUTING.md to quickshell/ for packaging
           cp LICENSE CONTRIBUTING.md quickshell/
@@ -365,8 +299,8 @@ jobs:
           # Generate checksum for QML package
           (cd _release_assets && sha256sum dms-qml.tar.gz > dms-qml.tar.gz.sha256)
 
-          # Create full packages for each os/architecture
-          for arch in amd64 arm64 freebsd-amd64 freebsd-arm64; do
+          # Create full packages for each architecture
+          for arch in amd64 arm64; do
             mkdir -p _temp_full/dms
             mkdir -p _temp_full/bin
             mkdir -p _temp_full/completions
@@ -409,16 +343,18 @@ jobs:
 
           ## Installation Steps
 
-          The Quickshell UI is embedded in the `dms` binary. The bundled `dms/`
-          tree is optional — pass it with `-c` or `DMS_SHELL_DIR` to run a
-          modified copy instead of the embedded UI.
+          1. **Install quickshell assets:**
+             ```bash
+             mkdir -p ~/.config/quickshell
+             cp -r dms ~/.config/quickshell/
+             ```
 
-          1. **Install the DMS CLI binaries:**
+          2. **Install the DMS CLI binaries:**
              ```bash
              sudo install -m 755 bin/dms /usr/local/bin/dms
              ```
 
-          2. **Install shell completions (optional):**
+          3. **Install shell completions (optional):**
              ```bash
              # Bash
              sudo install -m 644 completions/completion.bash /usr/share/bash-completion/completions/dms
@@ -430,7 +366,7 @@ jobs:
              sudo install -m 644 completions/completion.zsh /usr/share/zsh/site-functions/_dms
              ```
 
-          3. **Start the shell:**
+          4. **Start the shell:**
              ```bash
              dms run
              ```
@@ -481,19 +417,3 @@ jobs:
           prerelease: ${{ contains(env.TAG, '-') }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      # Ask reporters on still-open "related/fixes #N" issues to retest.
-      # Opt-in via notify_issues (Point release defaults it on). Skipped for
-      # prereleases. Preview: scripts/notify-issues.sh <prev> <tag> --dry-run
-      - name: Notify open issues to retest
-        if: ${{ inputs.notify_issues && !contains(env.TAG, '-') }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          PREVIOUS_TAG=$(git describe --tags --abbrev=0 "${TAG}^" 2>/dev/null || true)
-          if [ -z "$PREVIOUS_TAG" ]; then
-            echo "no previous tag; skipping issue notify"
-            exit 0
-          fi
-          bash scripts/notify-issues.sh "$PREVIOUS_TAG" "$TAG"

.github/workflows/run-copr.yml

@@ -4,12 +4,14 @@ on:
   workflow_dispatch:
     inputs:
       package:
-        description: 'Package to build'
+        description: 'Package to build (dms, dms-greeter, or both)'
         required: false
         default: 'dms'
         type: choice
         options:
           - dms
+          - dms-greeter
+          - both
       version:
         description: 'Versioning (e.g., 1.0.3, leave empty for latest release)'
         required: false
@@ -29,7 +31,11 @@ jobs:
         id: set-packages
         run: |
           PACKAGE_INPUT="${{ github.event.inputs.package || 'dms' }}"
-          echo "packages=[\"$PACKAGE_INPUT\"]" >> $GITHUB_OUTPUT
+          if [ "$PACKAGE_INPUT" = "both" ]; then
+            echo 'packages=["dms","dms-greeter"]' >> $GITHUB_OUTPUT
+          else
+            echo "packages=[\"$PACKAGE_INPUT\"]" >> $GITHUB_OUTPUT
+          fi
 
   build-and-upload:
     needs: determine-packages
@@ -157,6 +163,8 @@ jobs:
           PACKAGE="${{ matrix.package }}"
           if [ "$PACKAGE" = "dms" ]; then
             COPR_PROJECT="avengemedia/dms"
+          elif [ "$PACKAGE" = "dms-greeter" ]; then
+            COPR_PROJECT="avengemedia/danklinux"
           else
             echo "❌ Unknown package: $PACKAGE"
             exit 1

.github/workflows/run-obs.yml

@@ -9,6 +9,7 @@ on:
         type: choice
         options:
           - dms
+          - dms-greeter
           - dms-git
           - all
         default: "dms"
@@ -35,7 +36,6 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          submodules: recursive
 
       - name: Check for updates
         id: check
@@ -74,12 +74,27 @@ jobs:
             fi
           }
 
+          # Helper function to check dms-greeter stable tag
+          check_dms_greeter_stable() {
+            LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
+            local OBS_SPEC=$(curl -s -u "$OBS_USERNAME:$OBS_PASSWORD" "https://api.opensuse.org/source/home:AvengeMedia:danklinux/dms-greeter/dms-greeter.spec" 2>/dev/null || echo "")
+            local OBS_VERSION=$(echo "$OBS_SPEC" | grep "^Version:" | awk '{print $2}' | xargs | sed 's/^v//')
+
+            if [[ -n "$LATEST_TAG" && "$LATEST_TAG" == "v$OBS_VERSION" ]]; then
+              echo "📋 dms-greeter: Tag $LATEST_TAG already exists, skipping"
+              return 1  # No update needed
+            else
+              echo "📋 dms-greeter: New tag ${LATEST_TAG:-unknown} (OBS has ${OBS_VERSION:-none})"
+              return 0  # Update needed
+            fi
+          }
+
           # Main logic
           REBUILD="${{ github.event.inputs.rebuild_release }}"
 
           if [[ "${{ github.ref }}" =~ ^refs/tags/ ]] && [[ -z "${{ github.event.inputs.package }}" ]]; then
-            # Run from tag with no package specified - update stable package
-            echo "packages=dms" >> $GITHUB_OUTPUT
+            # Run from tag with no package specified - update both stable packages
+            echo "packages=dms dms-greeter" >> $GITHUB_OUTPUT
             VERSION="${GITHUB_REF#refs/tags/}"
             echo "version=$VERSION" >> $GITHUB_OUTPUT
             echo "has_updates=true" >> $GITHUB_OUTPUT
@@ -105,7 +120,7 @@ jobs:
               echo "🔄 Manual rebuild requested: $PKG (db$REBUILD)"
 
             elif [[ "$PKG" == "all" ]]; then
-              # Check the stable package and build list of those needing updates
+              # Check each stable package and build list of those needing updates
               PACKAGES_TO_UPDATE=()
               if check_dms_stable; then
                 PACKAGES_TO_UPDATE+=("dms")
@@ -113,6 +128,10 @@ jobs:
                   echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
                 fi
               fi
+              if check_dms_greeter_stable; then
+                PACKAGES_TO_UPDATE+=("dms-greeter")
+                [[ -n "$LATEST_TAG" ]] && echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+              fi
 
               if [[ ${#PACKAGES_TO_UPDATE[@]} -gt 0 ]]; then
                 echo "packages=${PACKAGES_TO_UPDATE[*]}" >> $GITHUB_OUTPUT
@@ -121,7 +140,7 @@ jobs:
               else
                 echo "packages=" >> $GITHUB_OUTPUT
                 echo "has_updates=false" >> $GITHUB_OUTPUT
-                echo "✓ All packages up to date"
+                echo "✓ Both packages up to date"
               fi
 
             elif [[ "$PKG" == "dms-git" ]]; then
@@ -145,6 +164,18 @@ jobs:
                 echo "has_updates=false" >> $GITHUB_OUTPUT
               fi
 
+            elif [[ "$PKG" == "dms-greeter" ]]; then
+              if check_dms_greeter_stable; then
+                echo "packages=$PKG" >> $GITHUB_OUTPUT
+                echo "has_updates=true" >> $GITHUB_OUTPUT
+                if [[ -n "$LATEST_TAG" ]]; then
+                  echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+                fi
+              else
+                echo "packages=" >> $GITHUB_OUTPUT
+                echo "has_updates=false" >> $GITHUB_OUTPUT
+              fi
+
             else
               # Unknown package - proceed anyway
               echo "packages=$PKG" >> $GITHUB_OUTPUT
@@ -168,7 +199,6 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          submodules: recursive
 
       - name: Wait before OBS upload
         run: sleep 3
@@ -189,9 +219,9 @@ jobs:
           elif [[ -n "${{ github.event.inputs.package }}" ]]; then
             # Manual workflow dispatch
 
-            # Determine version for dms stable using the API
+            # Determine version for dms stable and dms-greeter using the API
             # GITHUB_REF is unreliable when "Use workflow from" a tag; API works from any ref
-            if [[ "${{ github.event.inputs.package }}" == "dms" ]] || [[ "${{ github.event.inputs.package }}" == "all" ]]; then
+            if [[ "${{ github.event.inputs.package }}" == "dms" ]] || [[ "${{ github.event.inputs.package }}" == "dms-greeter" ]] || [[ "${{ github.event.inputs.package }}" == "all" ]]; then
               LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
               if [[ -n "$LATEST_TAG" ]]; then
                 echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
@@ -257,7 +287,7 @@ jobs:
             echo " -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE"
           } > "distro/debian/dms-git/debian/changelog"
 
-      - name: Update stable version (dms)
+      - name: Update stable version (dms + dms-greeter)
         if: steps.packages.outputs.version != ''
         run: |
           VERSION="${{ steps.packages.outputs.version }}"
@@ -293,12 +323,25 @@ jobs:
             fi
           fi
 
+          # Update dms-greeter changelog when dms-greeter is in the upload list
+          if [[ "$PACKAGES" == *"dms-greeter"* ]] && [[ -f "distro/debian/dms-greeter/debian/changelog" ]]; then
+            CHANGELOG_DATE=$(date -R)
+            {
+              echo "dms-greeter (${VERSION_NO_V}db1) unstable; urgency=medium"
+              echo ""
+              echo "  * Update to $VERSION stable release"
+              echo ""
+              echo " -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE"
+            } > "distro/debian/dms-greeter/debian/changelog"
+            echo "✓ Updated dms-greeter changelog to ${VERSION_NO_V}db1"
+          fi
+
           # Update Debian _service files for packages in upload list (download_url paths)
           for service in distro/debian/*/_service; do
             if [[ -f "$service" ]]; then
               # Update tar_scm revision parameter (for dms-git)
               sed -i "s|<param name=\"revision\">v[0-9.]*</param>|<param name=\"revision\">$VERSION</param>|" "$service"
-              # Update download_url paths (for dms stable)
+              # Update download_url paths (for dms, dms-greeter stable)
               sed -i "s|/v[0-9.]\+/|/$VERSION/|g" "$service"
               sed -i "s|/tags/v[0-9.]\+\.tar\.gz|/tags/$VERSION.tar.gz|g" "$service"
             fi
@@ -359,7 +402,7 @@ jobs:
           UPLOADED_PACKAGES=()
           SKIPPED_PACKAGES=()
 
-          # PACKAGES can be a space-separated list (from the "all" check)
+          # PACKAGES can be space-separated list (e.g., "dms dms-greeter" from "all" check)
           # Loop through each package and upload
           for PKG in $PACKAGES; do
             echo ""
@@ -462,6 +505,9 @@ jobs:
                 dms-git)
                   echo "- $STATUS_ICON **dms-git** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms-git/dms-git)" >> $GITHUB_STEP_SUMMARY
                   ;;
+                dms-greeter)
+                  echo "- $STATUS_ICON **dms-greeter** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:danklinux/dms-greeter)" >> $GITHUB_STEP_SUMMARY
+                  ;;
               esac
             done
             echo "" >> $GITHUB_STEP_SUMMARY

.github/workflows/run-ppa.yml

@@ -9,6 +9,7 @@ on:
         type: choice
         options:
           - dms
+          - dms-greeter
           - dms-git
           - all
         default: "dms"
@@ -35,7 +36,6 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          submodules: recursive
 
       - name: Install dependencies
         run: |
@@ -94,7 +94,6 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          submodules: recursive
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -134,6 +133,7 @@ jobs:
           case "$PACKAGE" in
             dms) PPA_NAME="dms" ;;
             dms-git) PPA_NAME="dms-git" ;;
+            dms-greeter) PPA_NAME="danklinux" ;;
             *) echo "::error::Unknown package $PACKAGE"; exit 1 ;;
           esac
 
@@ -148,3 +148,4 @@ jobs:
           echo "- **Target:** ${{ matrix.target }}" >> "$GITHUB_STEP_SUMMARY"
           echo "- **DMS PPA:** https://launchpad.net/~avengemedia/+archive/ubuntu/dms/+packages" >> "$GITHUB_STEP_SUMMARY"
           echo "- **DMS-Git PPA:** https://launchpad.net/~avengemedia/+archive/ubuntu/dms-git/+packages" >> "$GITHUB_STEP_SUMMARY"
+          echo "- **DankLinux PPA:** https://launchpad.net/~avengemedia/+archive/ubuntu/danklinux/+packages" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/run-xbps.yml

@@ -3,15 +3,10 @@ name: Void Linux XBPS Repository
 on:
   schedule:
     - cron: "0 2,5,14,17,20,23 * * *" # 9am, 12pm, 3pm, 6pm, 9pm, 12am EST (UTC times shown)
-  # release trigger disabled; dispatch manually after a release
-  # release:
-  #   types: [published]
+  release:
+    types: [published]
   workflow_dispatch:
     inputs:
-      version:
-        description: 'Stable release tag/version to build (e.g. v1.5.0 or 1.5.0). Leave blank to use the selected ref/template version'
-        type: string
-        required: false
       force_rebuild:
         description: 'Force rebuilding packages even if they already exist in the repository'
         type: boolean
@@ -27,66 +22,37 @@ on:
         type: boolean
         required: false
         default: true
+      build_greeter:
+        description: 'Build stable dms-greeter package'
+        type: boolean
+        required: false
+        default: true
 
 permissions:
-  contents: read
-
-concurrency:
-  group: void-xbps-${{ github.ref }}
-  cancel-in-progress: false
+  contents: write
 
 jobs:
-  preflight:
-    name: Check for unpublished changes
-    runs-on: ubuntu-latest
-    outputs:
-      should_build: ${{ steps.check.outputs.should_build }}
-    steps:
-      - name: Check published commit
-        id: check
-        env:
-          MANIFEST_URL: https://void.danklinux.com/dms/current/manifest.json
-        run: |
-          SHOULD_BUILD=true
-          if [ "${{ github.event_name }}" = "schedule" ]; then
-            PUBLISHED_COMMIT="$(curl -fsSL --retry 3 "$MANIFEST_URL" | jq -r '.source_commit // empty' 2>/dev/null || true)"
-            if [ "$PUBLISHED_COMMIT" = "${{ github.sha }}" ]; then
-              SHOULD_BUILD=false
-              echo "${{ github.sha }} is already published; skipping the scheduled build."
-            fi
-          fi
-          echo "should_build=$SHOULD_BUILD" >> "$GITHUB_OUTPUT"
-
   build-and-deploy:
     name: Build & Deploy XBPS packages
     runs-on: ubuntu-latest
-    needs: preflight
-    if: github.repository == 'AvengeMedia/DankMaterialShell' && needs.preflight.outputs.should_build == 'true'
-    env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      AWS_DEFAULT_REGION: auto
-      AWS_EC2_METADATA_DISABLED: true
-      R2_BUCKET: danklinux-void
-      R2_ENDPOINT: https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
-      R2_PREFIX: dms
-      REPOSITORY_DIR: ${{ github.workspace }}/r2-repo
-      SOURCE_COMMIT: ${{ github.sha }}
+    if: github.repository == 'AvengeMedia/DankMaterialShell'
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
         with:
-          ref: ${{ github.event.release.tag_name || (github.event.inputs.version && (startsWith(github.event.inputs.version, 'v') && github.event.inputs.version || format('v{0}', github.event.inputs.version))) || github.ref }}
           fetch-depth: 0
-          submodules: recursive
 
-      - name: Record checked-out source commit
-        run: echo "SOURCE_COMMIT=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
-
-      - name: Download current R2 repository
+      - name: Checkout gh-pages branch
         run: |
-          aws --version
-          bash .github/scripts/publish-void-r2.sh download
+          git clone --branch gh-pages https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git gh-pages-repo || {
+            echo "⚠️ gh-pages branch not found or empty, initializing a new one..."
+            mkdir gh-pages-repo
+            cd gh-pages-repo
+            git init
+            git checkout -b gh-pages
+            git remote add origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git
+            cd ..
+          }
 
       - name: Install XBPS Static Utilities
         run: |
@@ -101,6 +67,7 @@ jobs:
       - name: Inject templates
         run: |
           cp -R distro/void/srcpkgs/dms void-packages/srcpkgs/
+          cp -R distro/void/srcpkgs/dms-greeter void-packages/srcpkgs/
           cp -R distro/void/srcpkgs/dms-git void-packages/srcpkgs/
 
       - name: Enable unprivileged user namespaces (Ubuntu 24.04)
@@ -159,71 +126,45 @@ jobs:
       - name: Configure repositories
         run: |
           # Append the repository to repos-remote templates so xbps-src translates it automatically
-          echo "repository=https://void.danklinux.com/danklinux/current" >> void-packages/etc/xbps.d/repos-remote.conf
-          echo "repository=https://void.danklinux.com/danklinux/current" >> void-packages/etc/xbps.d/repos-remote-x86_64-multilib.conf
+          echo "repository=https://avengemedia.github.io/DankLinux/current" >> void-packages/etc/xbps.d/repos-remote.conf
+          echo "repository=https://avengemedia.github.io/DankLinux/current" >> void-packages/etc/xbps.d/repos-remote-x86_64-multilib.conf
 
           # Add any existing compiled packages to the build cache directory to avoid rebuilds
-          if [ -d "r2-repo/current" ]; then
+          if [ -d "gh-pages-repo/current" ]; then
             mkdir -p void-packages/hostdir/binpkgs
-            cp -L r2-repo/current/*.xbps void-packages/hostdir/binpkgs/ 2>/dev/null || true
+            cp -L gh-pages-repo/current/*.xbps void-packages/hostdir/binpkgs/ 2>/dev/null || true
             xbps-rindex -a void-packages/hostdir/binpkgs/*.xbps 2>/dev/null || true
           fi
 
       - name: Build packages
         run: |
-          mkdir -p r2-repo/current
+          mkdir -p gh-pages-repo/current
 
           BUILD_DMS="${{ github.event.inputs.build_dms || 'true' }}"
+          BUILD_GREETER="${{ github.event.inputs.build_greeter || 'true' }}"
           BUILD_GIT="${{ github.event.inputs.build_git || 'true' }}"
           FORCE_REBUILD="${{ github.event.inputs.force_rebuild || 'false' }}"
 
           if [ "${{ github.event_name }}" = "schedule" ]; then
             BUILD_DMS="false"
+            BUILD_GREETER="false"
             BUILD_GIT="true"
           fi
 
           if [ "${{ github.event_name }}" = "release" ]; then
             BUILD_DMS="true"
+            BUILD_GREETER="true"
             BUILD_GIT="false"
           fi
 
-          RELEASE_TAG=""
-          if [ "${{ github.event_name }}" = "release" ]; then
-            RELEASE_TAG="${{ github.event.release.tag_name }}"
-          elif [ -n "${{ github.event.inputs.version || '' }}" ]; then
-            RELEASE_TAG="${{ github.event.inputs.version }}"
-          elif [ "${{ github.ref_type }}" = "tag" ]; then
-            RELEASE_TAG="${{ github.ref_name }}"
-          fi
-
-          if [ -n "$RELEASE_TAG" ]; then
-            RELEASE_VER="${RELEASE_TAG#v}"
-            ARCHIVE_TAG="v${RELEASE_VER}"
-            echo "Stable release tag:          $ARCHIVE_TAG"
-          else
-            RELEASE_VER=""
-            ARCHIVE_TAG=""
-            echo "Stable release tag:          (template version)"
-          fi
-
           echo "=== Starting Builds ==="
           echo "DMS stable build enabled:     $BUILD_DMS"
+          echo "Greeter stable build enabled: $BUILD_GREETER"
           echo "Git build enabled:            $BUILD_GIT"
           echo "Force rebuild:                $FORCE_REBUILD"
 
           cd void-packages
 
-          if [ -n "$RELEASE_VER" ] && [ "$BUILD_DMS" = "true" ]; then
-            echo "🔧 Updating stable template for $ARCHIVE_TAG"
-            TARBALL="$(mktemp)"
-            curl -fsSL -o "$TARBALL" "https://github.com/${{ github.repository }}/releases/download/${ARCHIVE_TAG}/dms-source.tar.gz"
-            RELEASE_CHECKSUM="$(sha256sum "$TARBALL" | cut -d' ' -f1)"
-            rm -f "$TARBALL"
-
-            sed -i "s/^version=.*/version=${RELEASE_VER}/" srcpkgs/dms/template
-            sed -i "s/^checksum=.*/checksum=${RELEASE_CHECKSUM}/" srcpkgs/dms/template
-          fi
-
           # 1. Build dms-git (development package)
           if [ "$BUILD_GIT" = "true" ]; then
             # Calculate dynamic git version (tag.commits.hash)
@@ -235,9 +176,9 @@ jobs:
             # into $wrksrc (create_wrksrc=yes handles the rest).
             SRC_CACHE="hostdir/sources/dms-git-${GIT_VER}"
             mkdir -p "$SRC_CACHE"
-            tar -czhf "${SRC_CACHE}/dms-git-${GIT_VER}.tar.gz" \
+            tar -czf "${SRC_CACHE}/dms-git-${GIT_VER}.tar.gz" \
               --exclude=void-packages \
-              --exclude=r2-repo \
+              --exclude=gh-pages-repo \
               --exclude=.git \
               --exclude=danklinux \
               -C .. .
@@ -251,13 +192,13 @@ jobs:
 
             EXPECTED_GIT_FILE="dms-git-${GIT_VER}_1.x86_64.xbps"
 
-            if [ -f "../r2-repo/current/$EXPECTED_GIT_FILE" ] && [ "$FORCE_REBUILD" != "true" ]; then
+            if [ -f "../gh-pages-repo/current/$EXPECTED_GIT_FILE" ] && [ "$FORCE_REBUILD" != "true" ]; then
               echo "✅ $EXPECTED_GIT_FILE already exists, skipping build."
             else
               echo "🔨 Compiling dms-git..."
               ./xbps-src pkg dms-git
-              rm -f "../r2-repo/current/${EXPECTED_GIT_FILE}"
-              cp -L "hostdir/binpkgs/${EXPECTED_GIT_FILE}" ../r2-repo/current/
+              rm -f "../gh-pages-repo/current/${EXPECTED_GIT_FILE}"
+              cp -L hostdir/binpkgs/dms-git-*.xbps ../gh-pages-repo/current/
             fi
           fi
 
@@ -267,21 +208,38 @@ jobs:
             STABLE_REV=$(grep -E '^revision=' srcpkgs/dms/template | cut -d= -f2 | tr -d '"')
 
             EXPECTED_DMS_FILE="dms-${STABLE_VER}_${STABLE_REV}.x86_64.xbps"
-            if [ -f "../r2-repo/current/$EXPECTED_DMS_FILE" ] && [ "$FORCE_REBUILD" != "true" ]; then
+            if [ -f "../gh-pages-repo/current/$EXPECTED_DMS_FILE" ] && [ "$FORCE_REBUILD" != "true" ]; then
               echo "✅ $EXPECTED_DMS_FILE already exists, skipping build."
             else
               echo "🔨 Compiling dms ($STABLE_VER)..."
               ./xbps-src pkg dms
-              rm -f "../r2-repo/current/${EXPECTED_DMS_FILE}"
-              cp -L hostdir/binpkgs/dms-${STABLE_VER}_${STABLE_REV}.x86_64.xbps ../r2-repo/current/
+              rm -f "../gh-pages-repo/current/${EXPECTED_DMS_FILE}"
+              cp -L hostdir/binpkgs/dms-${STABLE_VER}_${STABLE_REV}.x86_64.xbps ../gh-pages-repo/current/
+            fi
+          fi
+
+          # 3. Build stable dms-greeter package
+          if [ "$BUILD_GREETER" = "true" ]; then
+            GREETER_VER=$(grep -E '^version=' srcpkgs/dms-greeter/template | cut -d= -f2 | tr -d '"')
+            GREETER_REV=$(grep -E '^revision=' srcpkgs/dms-greeter/template | cut -d= -f2 | tr -d '"')
+
+            EXPECTED_GREETER_FILE="dms-greeter-${GREETER_VER}_${GREETER_REV}.x86_64.xbps"
+            if [ -f "../gh-pages-repo/current/$EXPECTED_GREETER_FILE" ] && [ "$FORCE_REBUILD" != "true" ]; then
+              echo "✅ $EXPECTED_GREETER_FILE already exists, skipping build."
+            else
+              echo "🔨 Compiling dms-greeter ($GREETER_VER)..."
+              ./xbps-src pkg dms-greeter
+              rm -f "../gh-pages-repo/current/${EXPECTED_GREETER_FILE}"
+              cp -L hostdir/binpkgs/dms-greeter-${GREETER_VER}_${GREETER_REV}.x86_64.xbps ../gh-pages-repo/current/
             fi
           fi
 
       - name: Index and sign repository
         run: |
-          cd r2-repo/current
+          cd gh-pages-repo/current
 
-          rm -f *.sig
+          # Clean up any stale or dangling signature files to prevent O_CREAT ENOENT errors
+          rm -f *.sig2 *.sig
 
           # Guard: nothing to index if no .xbps files exist
           if ! ls *.xbps 1>/dev/null 2>&1; then
@@ -291,14 +249,6 @@ jobs:
 
           # Regenerate repo index
           xbps-rindex -a $(pwd)/*.xbps
-          xbps-rindex --remove-obsoletes $(pwd)
-
-          # Remove signatures left behind by obsolete packages. Signatures for
-          # unchanged immutable packages are retained byte-for-byte.
-          for sig in *.sig2; do
-            [ -e "$sig" ] || break
-            [ -f "${sig%.sig2}" ] || rm -f "$sig"
-          done
 
           # Sign repository
           echo "${{ secrets.XBPS_PRIVATE_KEY }}" > /tmp/xbps_privkey.pem
@@ -309,5 +259,10 @@ jobs:
 
           rm -f /tmp/xbps_privkey.pem
 
-      - name: Publish repository to R2
-        run: bash .github/scripts/publish-void-r2.sh publish
+      - name: Deploy to gh-pages branch
+        run: |
+          cd gh-pages-repo
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add current/
+          git diff --quiet && git diff --staged --quiet || (git commit -m "Update XBPS packages [skip ci]" && git push origin gh-pages)

.github/workflows/update-vendor-hash.yml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Create GitHub App token
         id: app_token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@v1
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}

.gitignore

@@ -126,8 +126,3 @@ __pycache__
 distro/void/temp/
 distro/void/hostdir/
 distro/void/masterdir*/
-
-# Often gets built
-core/dms
-
-core/internal/shellembed/dist

.gitmodules

@@ -1,4 +0,0 @@
-[submodule "dank-qml-common"]
-	path = dank-qml-common
-	url = https://github.com/AvengeMedia/dank-qml-common.git
-	branch = master

.pre-commit-config.yaml

@@ -36,14 +36,6 @@ repos:
         language: system
         files: ^quickshell/(.*\.qml|translations/(term_freeze\.json|check_term_freeze\.py|extract_translations\.py))$
         pass_filenames: false
-  - repo: local
-    hooks:
-      - id: i18n-term-variants
-        name: i18n term variants (no case/punctuation duplicates)
-        entry: python3 quickshell/translations/check_term_variants.py
-        language: system
-        files: ^quickshell/(.*\.qml|translations/(check_term_variants\.py|extract_translations\.py))$
-        pass_filenames: false
   - repo: local
     hooks:
       - id: no-console-in-qml

CHANGELOG.MD

@@ -1,13 +1,5 @@
 This file is more of a quick reference so I know what to account for before next releases.
 
-# Next
-- Go core migrated to dankgo (shared log/paths/errdefs/ipc/shellapp)
-- Quickshell UI embedded in the dms binary, -c / DMS_SHELL_DIR override - breaking for setups relying on ~/.config/quickshell/dms auto-discovery (XDG search removed)
-- release binaries + all -git packages build with withshell; sockets/pidfiles/env names unchanged, IPC APIVersion 28 wire-compatible
-- -git packages (AUR dms-shell-git, fedora, opensuse, void, debian, ubuntu) no longer install /usr/share/quickshell/dms; dms greeter install falls back to the embedded UI when the greeter package is present
-- ping over the socket returns {"pong":true} instead of "pong"
-- startup: embedded UI resolution is keyed by build-time .dankrev (no per-start content hashing)
-
 # 1.5.0
 - Overhauled shadows
 - App ID changed to com.danklinux.dms - breaking for window rules

CONTRIBUTING.md

@@ -6,20 +6,6 @@ To contribute fork this repository, make your changes, and open a pull request.
 
 ## Setup
 
-Clone with submodules — the shared widget library ([dank-qml-common](https://github.com/AvengeMedia/dank-qml-common)) is vendored at `dank-qml-common/` and symlinked into `quickshell/DankCommon`:
-
-```bash
-git clone --recurse-submodules https://github.com/AvengeMedia/DankMaterialShell.git
-# or, in an existing clone:
-git submodule update --init
-```
-
-To have `git pull` keep the submodule in sync automatically (moving it to the commit this repo points at, no separate `git submodule update` step), set:
-
-```bash
-git config submodule.recurse true
-```
-
 Install [prek](https://prek.j178.dev/) then activate pre-commit hooks:
 
 ```bash
@@ -42,47 +28,6 @@ This will provide:
 
 The dev shell automatically creates the `.qmlls.ini` file in the `quickshell/` directory.
 
-## Building and running
-
-The Quickshell UI is embedded into the `dms` binary at build time. `make build` copies `quickshell/` into `core/internal/shellembed/dist/` (generated, never committed) and compiles with the `withshell` tag. `make dev` builds without the tag — that binary carries no UI and requires an explicit config dir.
-
-```bash
-make build   # embedded binary at core/bin/dms
-make dev     # untagged development build
-make run     # dev build, then launch against the live quickshell/ tree
-```
-
-The UI config dir resolves in order: `-c <dir>`, `DMS_SHELL_DIR`, the dir a running instance is using, then the embedded UI. Each candidate must contain `shell.qml`. `make run` uses `-c $(pwd)/quickshell`, so QML edits hot-reload from the working tree.
-
-The Go core depends on [dankgo](https://github.com/AvengeMedia/dankgo) for logging, XDG paths, the IPC transport, and the quickshell process lifecycle. To develop against a local dankgo checkout, create a gitignored `go.work` at the repo root:
-
-```
-go 1.26.1
-
-use (
-	./core
-	../dankgo
-)
-```
-
-## Shared widgets (dank-qml-common)
-
-Everything under `quickshell/DankCommon/` (core widgets, the file browser, scroll physics, bundled fonts) is shared across the DMS suite and lives in the `dank-qml-common` submodule. It is a normal git worktree:
-
-1. Edit files under `dank-qml-common/` (or through the `quickshell/DankCommon` symlink — same files) and test in the running shell; hot reload works as usual. For isolated widget work, the library is its own runnable config with a gallery: `qs -c dank-qml-common`.
-2. Commit and PR those changes in the `dank-qml-common` repo: `cd dank-qml-common && git switch -c my-change`, push, open the PR there.
-3. Once merged, bump the pointer here: `make update-common` (updates the submodule and the nix flake input together), then commit alongside any DMS-side changes. If you only bump the submodule, CI syncs `flake.lock` to it automatically on master.
-
-The submodule URL in `.gitmodules` is HTTPS so CI and anonymous clones keep working. To push over SSH instead of being prompted for credentials, add a push rewrite to your git config — fetches stay HTTPS, pushes use SSH:
-
-```bash
-git config --global url."git@github.com:AvengeMedia/".pushInsteadOf "https://github.com/AvengeMedia/"
-```
-
-Shared widgets read app-provided singletons (`Theme`, `SettingsData`, ...) through a documented contract — see the dank-qml-common README. If your change needs a new contract property, add it to the library's stub singletons in the same PR, then to `quickshell/Common/` here when you bump.
-
-Files in `quickshell/Widgets/`, `quickshell/Common/`, and `quickshell/Modals/FileBrowser/` that moved to the library remain in place as thin wrappers, so `import qs.Widgets`, `qs.Common`, and `qs.Modals.FileBrowser` keep working for the shell and for plugins.
-
 ## VSCode Setup
 
 This is a monorepo, the easiest thing to do is to open an editor in either `quickshell`, `core`, or both depending on which part of the project you are working on.
@@ -159,8 +104,6 @@ Text {
 
 Preferably, try to keep new terms to a minimum and re-use existing terms where possible. See `quickshell/translations/en.json` for the list of existing terms. (This isn't always possible obviously, but instead of using `Auto-connect` you would use `Autoconnect` since it's already translated)
 
-Strings inside `quickshell/DankCommon/` are owned by the dank-qml-common repo but stay in the DMS POEditor project — extraction here deliberately skips them, and `scripts/i18nsync.py sync` uploads the union of app terms and the submodule's terms instead (common terms carry the `dank-qml-common` tag). On download the sync splits the exports: app translations go to `quickshell/translations/poexports/`, common translations go to `dank-qml-common/DankCommon/translations/poexports/` for you to commit in that repo and bump. At runtime `I18n` merges both catalogs (app terms win). Other apps (dankcalendar) keep their own POEditor projects and merge the `dank-qml-common`-tagged terms from the DMS project.
-
 ### GO (`core` directory)
 
 1. Install the [Go Extension](https://code.visualstudio.com/docs/languages/go)

Makefile

@@ -6,8 +6,8 @@ BINARY_NAME=dms
 CORE_DIR=core
 BUILD_DIR=$(CORE_DIR)/bin
 PREFIX ?= /usr/local
-INSTALL_DIR=$(DESTDIR)$(PREFIX)/bin
-DATA_DIR=$(DESTDIR)$(PREFIX)/share
+INSTALL_DIR=$(PREFIX)/bin
+DATA_DIR=$(PREFIX)/share
 ICON_DIR=$(DATA_DIR)/icons/hicolor/scalable/apps
 
 USER_HOME := $(if $(SUDO_USER),$(shell getent passwd $(SUDO_USER) | cut -d: -f6),$(HOME))
@@ -18,7 +18,7 @@ SHELL_INSTALL_DIR=$(DATA_DIR)/quickshell/dms
 ASSETS_DIR=assets
 APPLICATIONS_DIR=$(DATA_DIR)/applications
 
-.PHONY: all build dev run clean lint-qml install install-bin install-shell install-completions install-systemd install-icon install-desktop uninstall uninstall-bin uninstall-shell uninstall-completions uninstall-systemd uninstall-icon uninstall-desktop help
+.PHONY: all build clean lint-qml install install-bin install-shell install-completions install-systemd install-icon install-desktop uninstall uninstall-bin uninstall-shell uninstall-completions uninstall-systemd uninstall-icon uninstall-desktop help
 
 all: build
 
@@ -27,12 +27,6 @@ build:
 	@$(MAKE) -C $(CORE_DIR) build
 	@echo "Build complete"
 
-dev:
-	@$(MAKE) -C $(CORE_DIR) dev
-
-run: dev
-	@$(BUILD_DIR)/$(BINARY_NAME) run -c $(CURDIR)/$(SHELL_DIR)
-
 clean:
 	@echo "Cleaning build artifacts..."
 	@$(MAKE) -C $(CORE_DIR) clean
@@ -41,12 +35,6 @@ clean:
 lint-qml:
 	@./quickshell/scripts/qmllint-entrypoints.sh
 
-# Pull the latest dank-qml-common and pin it everywhere it is consumed
-# (submodule pointer + nix flake input). Commit both in one change.
-update-common:
-	git submodule update --remote --merge dank-qml-common
-	nix --extra-experimental-features 'nix-command flakes' flake update dank-qml-common
-
 # Installation targets
 install-bin:
 	@echo "Installing $(BINARY_NAME) to $(INSTALL_DIR)..."
@@ -55,9 +43,8 @@ install-bin:
 
 install-shell:
 	@echo "Installing shell files to $(SHELL_INSTALL_DIR)..."
-	@test -e $(SHELL_DIR)/DankCommon/Widgets/DankIcon.qml || { echo "DankCommon missing: run git submodule update --init"; exit 1; }
 	@mkdir -p $(SHELL_INSTALL_DIR)
-	@cp -rL $(SHELL_DIR)/* $(SHELL_INSTALL_DIR)/
+	@cp -r $(SHELL_DIR)/* $(SHELL_INSTALL_DIR)/
 	@rm -rf $(SHELL_INSTALL_DIR)/.git* $(SHELL_INSTALL_DIR)/.github
 	@echo "Shell files installed"
 
@@ -72,17 +59,13 @@ install-completions:
 	@echo "Shell completions installed"
 
 install-systemd:
-ifneq ($(shell uname),Linux)
-	@echo "Skipping systemd user service (non-Linux); start the shell from your compositor config with 'dms run'"
-else
 	@echo "Installing systemd user service..."
 	@mkdir -p $(SYSTEMD_USER_DIR)
 	@if [ -n "$(SUDO_USER)" ]; then chown -R $(SUDO_USER):"$(id -gn $SUDO_USER)" $(SYSTEMD_USER_DIR); fi
-	@sed 's|/usr/bin/dms|$(PREFIX)/bin/dms|g' $(ASSETS_DIR)/systemd/dms.service > $(SYSTEMD_USER_DIR)/dms.service
+	@sed 's|/usr/bin/dms|$(INSTALL_DIR)/dms|g' $(ASSETS_DIR)/systemd/dms.service > $(SYSTEMD_USER_DIR)/dms.service
 	@chmod 644 $(SYSTEMD_USER_DIR)/dms.service
 	@if [ -n "$(SUDO_USER)" ]; then chown $(SUDO_USER):"$(id -gn $SUDO_USER)" $(SYSTEMD_USER_DIR)/dms.service; fi
 	@echo "Systemd service installed to $(SYSTEMD_USER_DIR)/dms.service"
-endif
 
 install-icon:
 	@echo "Installing icon..."

README.md

@@ -98,7 +98,7 @@ Notification center with grouping, rich text support, and keyboard navigation.
 MPRIS player controls, calendar sync, weather widgets, and clipboard history with image previews.
 
 **Session Management**
-Lock screen, idle detection, auto-lock/suspend with separate AC/battery settings, and a settings front-end for [dank-greeter](https://github.com/AvengeMedia/dank-greeter).
+Lock screen, idle detection, auto-lock/suspend with separate AC/battery settings, and greeter support.
 
 **Plugin System**
 Extend functionality with the [plugin registry](https://plugins.danklinux.com).
@@ -132,17 +132,6 @@ dms plugins search   # Browse plugin registry
 - **Plugins:** [Development guide](https://danklinux.com/docs/dankmaterialshell/plugins-overview)
 - **Support:** [Ko-fi](https://ko-fi.com/avengemediallc)
 
-## Dank Projects
-
-DMS is one piece of the suite. The rest lives in its own repos:
-
-- [dank-greeter](https://github.com/AvengeMedia/dank-greeter) - greetd login screen with the Dank Material aesthetic. The Greeter tab in DMS settings is the front-end for it.
-- [dankcalendar](https://github.com/AvengeMedia/dankcalendar) - Local, Google, Microsoft, and CalDAV calendars for the dank desktop.
-- [dgop](https://github.com/AvengeMedia/dgop) - System monitoring CLI and API that powers the process list and dashboard widgets.
-- [dsearch](https://github.com/AvengeMedia/danksearch) - Fast file search that powers file results in the launcher.
-- [dank-qml-common](https://github.com/AvengeMedia/dank-qml-common) - Shared QML widgets and components used by DMS, dank-greeter, and dankcalendar.
-- [dankgo](https://github.com/AvengeMedia/dankgo) - Common Go modules behind the single binary apps.
-
 ## Development
 
 See component-specific documentation:

core/Makefile

@@ -3,8 +3,6 @@ BINARY_NAME_INSTALL=dankinstall
 SOURCE_DIR=cmd/dms
 SOURCE_DIR_INSTALL=cmd/dankinstall
 BUILD_DIR=bin
-SHELL_SRC=../quickshell
-EMBED_DIR=internal/shellembed/dist
 PREFIX ?= /usr/local
 INSTALL_DIR=$(PREFIX)/bin
 
@@ -23,46 +21,17 @@ BUILD_LDFLAGS=-ldflags='-s -w -X main.Version=$(VERSION) -X main.buildTime=$(BUI
 
 # Architecture to build for dist target (amd64, arm64, or all)
 ARCH ?= all
-# Target OSes for dist builds
-DIST_OSES ?= linux freebsd
 
-ifeq ($(ARCH),all)
-DIST_ARCHS = amd64 arm64
-else
-DIST_ARCHS = $(ARCH)
-endif
-
-.PHONY: all build sync-shell dankinstall dist clean install install-all install-dankinstall uninstall uninstall-all uninstall-dankinstall install-config uninstall-config test fmt vet deps print-version help
+.PHONY: all build dankinstall dist clean install install-all install-dankinstall uninstall uninstall-all uninstall-dankinstall install-config uninstall-config test fmt vet deps print-version help
 
 # Default target
 all: build
 
-# Copy the quickshell UI into the embed dir (gitignored) so tagged builds
-# can bake it into the binary. Dev-only files are stripped; scripts/ is kept
-# minus its dev entries, since Theme.qml and BluetoothService.qml run
-# gtk.sh/qt.sh/bluez-card-profile.lua out of the resolved shell dir.
-# tar -h dereferences the DankCommon submodule symlink; go:embed rejects
-# symlinks. .qmlls.ini is excluded at copy time: it's a symlink into the
-# quickshell runtime VFS and dereferencing it fails whenever the shell isn't
-# running.
-sync-shell:
-	@test -e $(SHELL_SRC)/DankCommon/Widgets/DankIcon.qml || { echo "DankCommon missing: run git submodule update --init"; exit 1; }
-	@rm -rf $(EMBED_DIR)
-	@mkdir -p $(EMBED_DIR)
-	@tar -C $(SHELL_SRC) --exclude=.qmlls.ini -chf - . | tar -C $(EMBED_DIR) -xf -
-	@rm -rf $(EMBED_DIR)/.git* $(EMBED_DIR)/.github
-	@find $(EMBED_DIR) -type d \( -name .claude -o -name .vscode \) -prune -exec rm -rf {} +
-	@rm -f $(EMBED_DIR)/AGENTS.md $(EMBED_DIR)/qmlformat-all.sh
-	@rm -f $(EMBED_DIR)/scripts/i18nsync.py $(EMBED_DIR)/scripts/build-vscode-vsix.sh $(EMBED_DIR)/scripts/qmllint-entrypoints.sh
-	@rm -f $(EMBED_DIR)/scripts/spam-notifications.sh $(EMBED_DIR)/scripts/verify-notifications.sh
-	@rm -f $(EMBED_DIR)/translations/*.py $(EMBED_DIR)/translations/WORKFLOW.md
-	@cd $(EMBED_DIR) && find . -type f -print0 | LC_ALL=C sort -z | xargs -0 sha256sum | sha256sum | cut -c1-16 > .dankrev
-
 # Build the main binary (dms)
-build: sync-shell
+build:
 	@echo "Building $(BINARY_NAME)..."
 	@mkdir -p $(BUILD_DIR)
-	CGO_ENABLED=0 $(GO) build -tags withshell $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME) ./$(SOURCE_DIR)
+	CGO_ENABLED=0 $(GO) build $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME) ./$(SOURCE_DIR)
 	@echo "Build complete: $(BUILD_DIR)/$(BINARY_NAME)"
 
 dankinstall:
@@ -71,18 +40,26 @@ dankinstall:
 	CGO_ENABLED=0 $(GO) build $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME_INSTALL) ./$(SOURCE_DIR_INSTALL)
 	@echo "Build complete: $(BUILD_DIR)/$(BINARY_NAME_INSTALL)"
 
-# Build distro binaries (no update/greeter support) for each DIST_OSES/DIST_ARCHS pair
-dist: sync-shell
-	@echo "Building $(BINARY_NAME) for distribution ($(DIST_OSES) x $(DIST_ARCHS))..."
+# Build distro binaries for amd64 and arm64 (Linux only, no update/greeter support)
+dist:
+ifeq ($(ARCH),all)
+	@echo "Building $(BINARY_NAME) for distribution (amd64 and arm64)..."
 	@mkdir -p $(BUILD_DIR)
-	@for os in $(DIST_OSES); do \
-		for arch in $(DIST_ARCHS); do \
-			echo "Building for $$os/$$arch..."; \
-			CGO_ENABLED=0 GOOS=$$os GOARCH=$$arch $(GO) build -tags 'distro_binary withshell' $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-$$os-$$arch ./$(SOURCE_DIR) || exit 1; \
-			echo "  $(BUILD_DIR)/$(BINARY_NAME)-$$os-$$arch"; \
-		done; \
-	done
-	@echo "Distribution builds complete"
+	@echo "Building for linux/amd64..."
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -tags distro_binary $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64 ./$(SOURCE_DIR)
+	@echo "Building for linux/arm64..."
+	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -tags distro_binary $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64 ./$(SOURCE_DIR)
+	@echo "Distribution builds complete:"
+	@echo "  $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64"
+	@echo "  $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64"
+else
+	@echo "Building $(BINARY_NAME) for distribution ($(ARCH))..."
+	@mkdir -p $(BUILD_DIR)
+	@echo "Building for linux/$(ARCH)..."
+	CGO_ENABLED=0 GOOS=linux GOARCH=$(ARCH) $(GO) build -tags distro_binary $(BUILD_LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-$(ARCH) ./$(SOURCE_DIR)
+	@echo "Distribution build complete:"
+	@echo "  $(BUILD_DIR)/$(BINARY_NAME)-linux-$(ARCH)"
+endif
 
 build-all: build dankinstall
 
@@ -122,7 +99,7 @@ uninstall-dankinstall:
 
 clean:
 	@echo "Cleaning build artifacts..."
-	@rm -rf $(BUILD_DIR) $(EMBED_DIR)
+	@rm -rf $(BUILD_DIR)
 	@echo "Clean complete"
 
 test:
@@ -164,11 +141,10 @@ print-version:
 help:
 	@echo "Available targets:"
 	@echo "  all                 - Build the main binary (dms) (default)"
-	@echo "  build               - Build the main binary (dms) with the embedded UI"
-	@echo "  sync-shell          - Copy quickshell/ into the embed dir (runs before tagged builds)"
+	@echo "  build               - Build the main binary (dms)"
 	@echo "  dankinstall         - Build dankinstall binary"
-	@echo "  dist                - Build dms for linux/freebsd amd64/arm64 (no update/greeter)"
-	@echo "                        Use ARCH=amd64 or ARCH=arm64 and/or DIST_OSES=linux to narrow"
+	@echo "  dist                - Build dms for linux amd64/arm64 (no update/greeter)"
+	@echo "                        Use ARCH=amd64 or ARCH=arm64 to build only one"
 	@echo "  build-all           - Build both binaries"
 	@echo "  install             - Install dms to $(INSTALL_DIR)"
 	@echo "  install-all         - Install both dms and dankinstall to $(INSTALL_DIR)"

core/README.md

@@ -10,7 +10,7 @@ Go-based backend for DankMaterialShell providing system integration, IPC, and in
 Command-line interface and daemon for shell management and system control.
 
 **dankinstall**
-Distribution-aware installer for deploying DMS and compositor configurations on Arch, Fedora, Debian, Ubuntu, openSUSE, Gentoo, and Void. Supports both an interactive TUI and a headless (unattended) mode via CLI flags.
+Distribution-aware installer for deploying DMS and compositor configurations on Arch, Fedora, Debian, Ubuntu, openSUSE, and Gentoo. Supports both an interactive TUI and a headless (unattended) mode via CLI flags.
 
 ## System Integration
 
@@ -78,7 +78,7 @@ Custom IPC via unix socket (JSON API) for shell communication.
 - `dms brightness [list|set]` - Control display/monitor brightness
 - `dms color pick` - Native color picker (see below)
 - `dms update` - Update DMS and dependencies (disabled in distro packages)
-- `dms greeter` - Deprecated; forwards to the standalone [dms-greeter](https://github.com/AvengeMedia/dank-greeter) binary
+- `dms greeter install` - Install greetd greeter (disabled in distro packages)
 
 ### Color Picker
 
@@ -109,7 +109,7 @@ make test         # Run tests
 **Distribution build:**
 
 ```bash
-make dist         # Build without update features
+make dist         # Build without update/greeter features
 ```
 
 Produces `bin/dms-linux-amd64` and `bin/dms-linux-arm64`
@@ -170,7 +170,7 @@ sudo -v && curl -fsSL https://install.danklinux.com | sh -s -- -c hyprland -t ki
 | `--exclude-deps <name,...>` | | Skip specific dependencies |
 | `--replace-configs <name,...>` | | Replace specific configuration files (mutually exclusive with `--replace-configs-all`) |
 | `--replace-configs-all` | | Replace all configuration files (mutually exclusive with `--replace-configs`) |
-| `--yes` | `-y` | Required for headless mode - confirms installation without interactive prompts |
+| `--yes` | `-y` | Required for headless mode — confirms installation without interactive prompts |
 
 Headless mode requires `--yes` to proceed; without it, the installer exits with an error.
 Configuration files are not replaced by default unless `--replace-configs` or `--replace-configs-all` is specified.
@@ -193,7 +193,7 @@ Set the `DANKINSTALL_LOG_DIR` environment variable to override the log directory
 
 ## Supported Distributions
 
-Arch, Fedora, Debian, Ubuntu, openSUSE, Gentoo, Void (and derivatives)
+Arch, Fedora, Debian, Ubuntu, openSUSE, Gentoo (and derivatives)
 
 **Arch Linux**
 Uses `pacman` for system packages, builds AUR packages via `makepkg`, no AUR helper dependency.
@@ -206,7 +206,7 @@ Uses COPR repositories (`avengemedia/danklinux`, `avengemedia/dms`).
 Requires PPA support. Most packages built from source (slow first install).
 
 **Debian**
-Debian 13+ (Trixie), testing, and sid. Stable quickshell from Debian (trixie-backports on 13). Other companions via OBS.
+Debian 13+ (Trixie). niri only, no Hyprland support. Builds from source.
 
 **openSUSE**
 Most packages available in standard repos. Minimal building required.
@@ -214,7 +214,4 @@ Most packages available in standard repos. Minimal building required.
 **Gentoo**
 Uses Portage with GURU overlay. Automatically configures USE flags. Variable success depending on system configuration.
 
-**Void Linux**
-Uses XBPS with the DMS and DankLinux self-hosted repositories.
-
 See installer output for distribution-specific details during installation.

core/cmd/dankinstall/main.go

@@ -23,8 +23,6 @@ var (
 	replaceConfigs    []string
 	replaceConfigsAll bool
 	yes               bool
-	danksearch        bool
-	dankcalendar      bool
 )
 
 var rootCmd = &cobra.Command{
@@ -51,8 +49,6 @@ func init() {
 	rootCmd.Flags().StringSliceVar(&replaceConfigs, "replace-configs", []string{}, "Deploy only named configs (e.g. niri,ghostty)")
 	rootCmd.Flags().BoolVar(&replaceConfigsAll, "replace-configs-all", false, "Deploy and replace all configurations")
 	rootCmd.Flags().BoolVarP(&yes, "yes", "y", false, "Auto-confirm all prompts")
-	rootCmd.Flags().BoolVar(&danksearch, "danksearch", false, "Install danksearch and enable its user indexing service")
-	rootCmd.Flags().BoolVar(&dankcalendar, "dankcalendar", false, "Install dankcalendar")
 }
 
 func main() {
@@ -78,8 +74,6 @@ func runDankinstall(cmd *cobra.Command, args []string) error {
 			"replace-configs",
 			"replace-configs-all",
 			"yes",
-			"danksearch",
-			"dankcalendar",
 		}
 		var set []string
 		for _, name := range headlessOnly {
@@ -115,8 +109,6 @@ func runHeadless() error {
 		ReplaceConfigs:    replaceConfigs,
 		ReplaceConfigsAll: replaceConfigsAll,
 		Yes:               yes,
-		DankSearch:        danksearch,
-		DankCalendar:      dankcalendar,
 	}
 
 	runner := headless.NewRunner(cfg)

core/cmd/dms/commands_auth.go

@@ -1,11 +1,7 @@
 package main
 
 import (
-	"encoding/json"
 	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
@@ -16,7 +12,7 @@ import (
 var authCmd = &cobra.Command{
 	Use:   "auth",
 	Short: "Manage DMS authentication sync",
-	Long:  "Manage PAM/authentication setup for the DMS lock screen",
+	Long:  "Manage shared PAM/authentication setup for DMS greeter and lock screen",
 }
 
 var authSyncCmd = &cobra.Command{
@@ -39,142 +35,9 @@ var authSyncCmd = &cobra.Command{
 	},
 }
 
-var authResolveLockCmd = &cobra.Command{
-	Use:   "resolve-lock",
-	Short: "Generate the lock-screen PAM config from the system auth stack",
-	Long: "Resolve the distribution's PAM auth stack into a self-contained lock-screen config under the user state directory.\n" +
-		"Runs unprivileged (reads /etc/pam.d, writes to the user's state dir) and is used by the shell as a fallback when /etc/pam.d/dankshell is not managed.\n" +
-		"Prints the path of the generated file.",
-	Run: func(cmd *cobra.Command, args []string) {
-		quiet, _ := cmd.Flags().GetBool("quiet")
-		logFunc := func(msg string) {
-			if !quiet {
-				fmt.Println(msg)
-			}
-		}
-		path, err := sharedpam.WriteUserLockscreenPamConfig(logFunc)
-		if err != nil {
-			log.Fatalf("Error resolving lock-screen PAM config: %v", err)
-		}
-		fmt.Println(path)
-	},
-}
-
-var authListServicesCmd = &cobra.Command{
-	Use:   "list-services",
-	Short: "List candidate lock-screen PAM services available on this system",
-	Long:  "Enumerate the lock-screen PAM services that exist on this system and report their resolved auth stack (whether it has an auth directive and whether fingerprint/U2F modules appear inline).",
-	Run: func(cmd *cobra.Command, args []string) {
-		asJSON, _ := cmd.Flags().GetBool("json")
-		services := sharedpam.ListLockscreenPamServices()
-
-		if asJSON {
-			payload := struct {
-				Services []sharedpam.LockscreenPamServiceInfo `json:"services"`
-			}{Services: services}
-			data, err := json.MarshalIndent(payload, "", "  ")
-			if err != nil {
-				log.Fatalf("Error encoding services: %v", err)
-			}
-			fmt.Println(string(data))
-			return
-		}
-
-		if len(services) == 0 {
-			fmt.Println("No candidate lock-screen PAM services found.")
-			return
-		}
-		for _, s := range services {
-			fmt.Printf("%-20s %-30s auth=%-5t fingerprint=%-5t u2f=%t\n", s.Name, s.Path, s.HasAuth, s.InlineFingerprint, s.InlineU2f)
-		}
-	},
-}
-
-var authValidateCmd = &cobra.Command{
-	Use:   "validate",
-	Short: "Validate a PAM service file for use by the DMS lock screen",
-	Long:  "Validate one PAM service (by --service NAME or --path /abs/file) for use as the DMS lock-screen password or dedicated U2F stack. Exits 1 when the file is not usable.",
-	Run: func(cmd *cobra.Command, args []string) {
-		path, _ := cmd.Flags().GetString("path")
-		service, _ := cmd.Flags().GetString("service")
-		purpose, _ := cmd.Flags().GetString("purpose")
-		asJSON, _ := cmd.Flags().GetBool("json")
-
-		if (path == "") == (service == "") {
-			log.Fatalf("Error: exactly one of --path or --service is required")
-		}
-
-		if purpose != "password" && purpose != "u2f" {
-			log.Fatalf("Error: --purpose must be password or u2f")
-		}
-
-		var result sharedpam.LockscreenPamValidation
-		switch {
-		case service != "":
-			if purpose == "u2f" {
-				result = sharedpam.ValidateLockscreenU2fPamService(service)
-			} else {
-				result = sharedpam.ValidateLockscreenPamService(service)
-			}
-		case !filepath.IsAbs(path):
-			result = sharedpam.LockscreenPamValidation{
-				Path:           path,
-				MissingModules: []string{},
-				Warnings:       []string{},
-				Errors:         []string{"--path must be an absolute file path"},
-			}
-		default:
-			if purpose == "u2f" {
-				result = sharedpam.ValidateLockscreenU2fPamPath(path)
-			} else {
-				result = sharedpam.ValidateLockscreenPamPath(path)
-			}
-		}
-
-		if asJSON {
-			data, err := json.MarshalIndent(result, "", "  ")
-			if err != nil {
-				log.Fatalf("Error encoding validation: %v", err)
-			}
-			fmt.Println(string(data))
-		} else {
-			printLockscreenPamValidation(result)
-		}
-
-		if !result.Valid {
-			os.Exit(1)
-		}
-	},
-}
-
-func printLockscreenPamValidation(result sharedpam.LockscreenPamValidation) {
-	fmt.Printf("Path:               %s\n", result.Path)
-	fmt.Printf("Valid:              %t\n", result.Valid)
-	fmt.Printf("Has auth:           %t\n", result.HasAuth)
-	fmt.Printf("Inline fingerprint: %t\n", result.InlineFingerprint)
-	fmt.Printf("Inline U2F:         %t\n", result.InlineU2f)
-	if len(result.MissingModules) > 0 {
-		fmt.Printf("Missing modules:    %s\n", strings.Join(result.MissingModules, ", "))
-	}
-	for _, w := range result.Warnings {
-		fmt.Println("⚠ " + w)
-	}
-	for _, e := range result.Errors {
-		fmt.Println("✗ " + e)
-	}
-}
-
 func init() {
 	authSyncCmd.Flags().BoolP("yes", "y", false, "Non-interactive mode: skip prompts")
 	authSyncCmd.Flags().BoolP("terminal", "t", false, "Run auth sync in a new terminal (for entering sudo password)")
-	authResolveLockCmd.Flags().BoolP("quiet", "q", false, "Only print the resulting file path")
-
-	authListServicesCmd.Flags().Bool("json", false, "Output as JSON")
-
-	authValidateCmd.Flags().String("path", "", "Absolute path to a PAM service file to validate")
-	authValidateCmd.Flags().String("service", "", "Name of a PAM service to resolve across the system PAM dirs")
-	authValidateCmd.Flags().String("purpose", "password", "Validation purpose: password or u2f")
-	authValidateCmd.Flags().Bool("json", false, "Output as JSON")
 }
 
 func syncAuth(nonInteractive bool) error {
@@ -212,31 +75,3 @@ func syncAuthInTerminal(nonInteractive bool) error {
 	shellCmd := shellSyncCmd + `; echo; echo "Authentication sync finished. Closing in 3 seconds..."; sleep 3`
 	return runCommandInTerminal(shellCmd)
 }
-func runCommandInTerminal(shellCmd string) error {
-	terminals := []struct {
-		name string
-		args []string
-	}{
-		{"gnome-terminal", []string{"--", "bash", "-c", shellCmd}},
-		{"konsole", []string{"-e", "bash", "-c", shellCmd}},
-		{"xfce4-terminal", []string{"-e", "bash -c \"" + strings.ReplaceAll(shellCmd, `"`, `\"`) + "\""}},
-		{"ghostty", []string{"-e", "bash", "-c", shellCmd}},
-		{"wezterm", []string{"start", "--", "bash", "-c", shellCmd}},
-		{"alacritty", []string{"-e", "bash", "-c", shellCmd}},
-		{"kitty", []string{"bash", "-c", shellCmd}},
-		{"xterm", []string{"-e", "bash -c \"" + strings.ReplaceAll(shellCmd, `"`, `\"`) + "\""}},
-	}
-	for _, t := range terminals {
-		if _, err := exec.LookPath(t.name); err != nil {
-			continue
-		}
-		cmd := exec.Command(t.name, t.args...)
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-		if err := cmd.Run(); err != nil {
-			return err
-		}
-		return nil
-	}
-	return fmt.Errorf("no terminal emulator found (tried: gnome-terminal, konsole, xfce4-terminal, ghostty, wezterm, alacritty, kitty, xterm)")
-}

core/cmd/dms/commands_common.go

@@ -6,10 +6,10 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/plugins"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/shellembed"
 	"github.com/spf13/cobra"
 )
 
@@ -19,6 +19,63 @@ var versionCmd = &cobra.Command{
 	Run:   runVersion,
 }
 
+var runCmd = &cobra.Command{
+	Use:     "run",
+	Short:   "Launch quickshell with DMS configuration",
+	Long:    "Launch quickshell with DMS configuration (qs -c dms)",
+	PreRunE: findConfig,
+	Run: func(cmd *cobra.Command, args []string) {
+		daemon, _ := cmd.Flags().GetBool("daemon")
+		session, _ := cmd.Flags().GetBool("session")
+		if v, _ := cmd.Flags().GetString("log-level"); v != "" {
+			if err := os.Setenv("DMS_LOG_LEVEL", v); err != nil {
+				log.Fatalf("Failed to set DMS_LOG_LEVEL: %v", err)
+			}
+		}
+		if v, _ := cmd.Flags().GetString("log-file"); v != "" {
+			if err := os.Setenv("DMS_LOG_FILE", v); err != nil {
+				log.Fatalf("Failed to set DMS_LOG_FILE: %v", err)
+			}
+		}
+		log.ApplyEnvOverrides()
+		config.CleanupStrayHyprlandConfFile(log.Infof)
+		if daemon {
+			runShellDaemon(session)
+		} else {
+			runShellInteractive(session)
+		}
+	},
+}
+
+var restartCmd = &cobra.Command{
+	Use:     "restart",
+	Short:   "Restart quickshell with DMS configuration",
+	Long:    "Kill existing DMS shell processes and restart quickshell with DMS configuration",
+	PreRunE: findConfig,
+	Run: func(cmd *cobra.Command, args []string) {
+		restartShell()
+	},
+}
+
+var restartDetachedCmd = &cobra.Command{
+	Use:     "restart-detached <pid>",
+	Hidden:  true,
+	Args:    cobra.ExactArgs(1),
+	PreRunE: findConfig,
+	Run: func(cmd *cobra.Command, args []string) {
+		runDetachedRestart(args[0])
+	},
+}
+
+var killCmd = &cobra.Command{
+	Use:   "kill",
+	Short: "Kill running DMS shell processes",
+	Long:  "Kill all running quickshell processes with DMS configuration",
+	Run: func(cmd *cobra.Command, args []string) {
+		killShell()
+	},
+}
+
 var ipcCmd = &cobra.Command{
 	Use:   "ipc",
 	Short: "Send IPC commands to running DMS shell",
@@ -207,41 +264,29 @@ func formatVersion(version string) string {
 	return fmt.Sprintf("dms %s", version)
 }
 
-var baseVersionRe = regexp.MustCompile(`^([\d.]+)`)
-
-// Installed UI trees, for builds without an embedded UI.
-var shellVersionPaths = []string{
-	"/usr/share/quickshell/dms/VERSION",
-	"/usr/local/share/quickshell/dms/VERSION",
-	"/etc/xdg/quickshell/dms/VERSION",
-}
-
 func getBaseVersion() string {
-	if ver := parseBaseVersion(shellembed.Version()); ver != "" {
-		return ver
+	paths := []string{
+		"/usr/share/quickshell/dms/VERSION",
+		"/usr/local/share/quickshell/dms/VERSION",
+		"/etc/xdg/quickshell/dms/VERSION",
 	}
 
-	for _, path := range shellVersionPaths {
-		content, err := os.ReadFile(path)
-		if err != nil {
-			continue
-		}
-		if ver := parseBaseVersion(string(content)); ver != "" {
-			return ver
+	for _, path := range paths {
+		if content, err := os.ReadFile(path); err == nil {
+			ver := strings.TrimSpace(string(content))
+			ver = strings.TrimPrefix(ver, "v")
+			if re := regexp.MustCompile(`^([\d.]+)`); re.MatchString(ver) {
+				if matches := re.FindStringSubmatch(ver); matches != nil {
+					return matches[1]
+				}
+			}
 		}
 	}
 
+	// Fallback
 	return "1.0.2"
 }
 
-func parseBaseVersion(raw string) string {
-	matches := baseVersionRe.FindStringSubmatch(strings.TrimPrefix(strings.TrimSpace(raw), "v"))
-	if matches == nil {
-		return ""
-	}
-	return matches[1]
-}
-
 func startDebugServer() error {
 	server.CLIVersion = Version
 	return server.Start(true)
@@ -698,9 +743,12 @@ func checkAllPluginsCLI() error {
 }
 
 func getCommonCommands() []*cobra.Command {
-	commands := shellApp.Commands()
-	return append(commands, []*cobra.Command{
+	return []*cobra.Command{
 		versionCmd,
+		runCmd,
+		restartCmd,
+		restartDetachedCmd,
+		killCmd,
 		ipcCmd,
 		debugSrvCmd,
 		pluginsCmd,
@@ -711,7 +759,6 @@ func getCommonCommands() []*cobra.Command {
 		greeterCmd,
 		setupCmd,
 		colorCmd,
-		qrCmd,
 		screenshotCmd,
 		notifyActionCmd,
 		notifyCmd,
@@ -727,5 +774,5 @@ func getCommonCommands() []*cobra.Command {
 		trashCmd,
 		systemCmd,
 		switchUserCmd,
-	}...)
+	}
 }

core/cmd/dms/commands_doctor.go

@@ -320,7 +320,6 @@ func checkEnvironmentVars() []checkResult {
 	var results []checkResult
 	results = append(results, checkEnvVar("QT_QPA_PLATFORMTHEME")...)
 	results = append(results, checkEnvVar("QS_ICON_THEME")...)
-	results = append(results, checkXDGMenuPrefix()...)
 	return results
 }
 
@@ -335,29 +334,6 @@ func checkEnvVar(name string) []checkResult {
 	return nil
 }
 
-func checkXDGMenuPrefix() []checkResult {
-	menuPrefix := os.Getenv("XDG_MENU_PREFIX")
-	if menuPrefix != "" {
-		if checkXDGMenuFile(menuPrefix) {
-			return []checkResult{{catEnvironment, "XDG_MENU_PREFIX", statusInfo, menuPrefix, "", doctorDocsURL + "#xdg-menu-prefix"}}
-		}
-		return []checkResult{{catEnvironment, "XDG_MENU_PREFIX", statusWarn, fmt.Sprintf("%s (menu file not found)", menuPrefix), fmt.Sprintf("Dolphin 'Open with…' dialog may be empty. Ensure /etc/xdg/menus/%sapplications.menu exists.", menuPrefix), doctorDocsURL + "#xdg-menu-prefix"}}
-	}
-	if _, err := exec.LookPath("keditfiletype"); err == nil {
-		return []checkResult{{catEnvironment, "XDG_MENU_PREFIX", statusWarn, "Not set", "Dolphin file associations and 'Open with…' dialog may be empty. Set XDG_MENU_PREFIX=plasma- in your compositor's environment block.", doctorDocsURL + "#xdg-menu-prefix"}}
-	}
-	if doctorVerbose {
-		return []checkResult{{catEnvironment, "XDG_MENU_PREFIX", statusInfo, "Not set", "", doctorDocsURL + "#xdg-menu-prefix"}}
-	}
-	return nil
-}
-
-func checkXDGMenuFile(prefix string) bool {
-	menuPath := fmt.Sprintf("/etc/xdg/menus/%sapplications.menu", prefix)
-	_, err := os.Stat(menuPath)
-	return err == nil
-}
-
 func readOSRelease() map[string]string {
 	result := make(map[string]string)
 	data, err := os.ReadFile("/etc/os-release")
@@ -401,12 +377,12 @@ func checkVersions(qsMissingFeatures bool) []checkResult {
 }
 
 func getDMSShellVersion() (version, path string) {
-	if err := shellApp.ResolveConfig(nil, nil); err == nil && shellApp.ConfigPath() != "" {
-		versionFile := filepath.Join(shellApp.ConfigPath(), "VERSION")
+	if err := findConfig(nil, nil); err == nil && configPath != "" {
+		versionFile := filepath.Join(configPath, "VERSION")
 		if data, err := os.ReadFile(versionFile); err == nil {
-			return strings.TrimSpace(string(data)), shellApp.ConfigPath()
+			return strings.TrimSpace(string(data)), configPath
 		}
-		return "installed", shellApp.ConfigPath()
+		return "installed", configPath
 	}
 
 	if dmsPath, err := config.LocateDMSConfig(); err == nil {
@@ -450,8 +426,8 @@ func checkDMSInstallation() []checkResult {
 	var results []checkResult
 
 	dmsPath := ""
-	if err := shellApp.ResolveConfig(nil, nil); err == nil && shellApp.ConfigPath() != "" {
-		dmsPath = shellApp.ConfigPath()
+	if err := findConfig(nil, nil); err == nil && configPath != "" {
+		dmsPath = configPath
 	} else if path, err := config.LocateDMSConfig(); err == nil {
 		dmsPath = path
 	}
@@ -833,8 +809,6 @@ func detectNetworkBackend(stackResult *network.DetectResult) string {
 		return "systemd-networkd"
 	case network.BackendConnMan:
 		return "ConnMan"
-	case network.BackendWpaSupplicant:
-		return "wpa_supplicant"
 	default:
 		return ""
 	}
@@ -912,7 +886,6 @@ func checkOptionalDependencies() []checkResult {
 		{"cava", "cava", "Audio visualizer", true},
 		{"khal", "khal", "Calendar events", false},
 		{"danksearch", "dsearch", "File search", false},
-		{"dankcalendar", "dcal", "Calendar app", false},
 		{"fprintd", "fprintd-list", "Fingerprint auth", false},
 	}
 

core/cmd/dms/commands_features.go

@@ -26,7 +26,7 @@ var updateCmd = &cobra.Command{
 	Use:     "update",
 	Short:   "Update DankMaterialShell to the latest version",
 	Long:    "Update DankMaterialShell to the latest version using the appropriate package manager for your distribution",
-	PreRunE: shellApp.ResolveConfig,
+	PreRunE: findConfig,
 	Run: func(cmd *cobra.Command, args []string) {
 		runUpdate()
 	},
@@ -98,7 +98,7 @@ func runUpdate() {
 	}
 
 	log.Info("Update complete! Restarting DMS...")
-	shellApp.Restart()
+	restartShell()
 }
 
 func updateArchLinux() error {
@@ -250,10 +250,6 @@ func updateOtherDistros() error {
 		return fmt.Errorf("failed to fetch changes: %w", err)
 	}
 
-	if err := updateSubmodules(); err != nil {
-		return fmt.Errorf("failed to update submodules: %w", err)
-	}
-
 	if currentTag != "" {
 		latestTagCmd := exec.Command("git", "tag", "-l", "v*", "--sort=-version:refname")
 		latestTagOutput, err := latestTagCmd.Output()
@@ -295,10 +291,6 @@ func updateOtherDistros() error {
 			return fmt.Errorf("update cancelled")
 		}
 
-		if err := updateSubmodules(); err != nil {
-			return fmt.Errorf("failed to update submodules: %w", err)
-		}
-
 		fmt.Printf("\nUpdate complete! Updated from %s to %s\n", currentTag, latestTag)
 		return nil
 	}
@@ -328,21 +320,10 @@ func updateOtherDistros() error {
 		return fmt.Errorf("update cancelled")
 	}
 
-	if err := updateSubmodules(); err != nil {
-		return fmt.Errorf("failed to update submodules: %w", err)
-	}
-
 	fmt.Println("\nUpdate complete!")
 	return nil
 }
 
-func updateSubmodules() error {
-	submoduleCmd := exec.Command("git", "submodule", "update", "--init", "--recursive")
-	submoduleCmd.Stdout = os.Stdout
-	submoduleCmd.Stderr = os.Stderr
-	return submoduleCmd.Run()
-}
-
 func offerReclone(dmsPath string) bool {
 	fmt.Println("\nWould you like to backup and re-clone the repository? (y/N): ")
 	reader := bufio.NewReader(os.Stdin)
@@ -361,7 +342,7 @@ func offerReclone(dmsPath string) bool {
 	}
 
 	fmt.Println("Cloning fresh copy...")
-	cloneCmd := exec.Command("git", "clone", "--recurse-submodules", "https://github.com/AvengeMedia/DankMaterialShell.git", dmsPath)
+	cloneCmd := exec.Command("git", "clone", "https://github.com/AvengeMedia/DankMaterialShell.git", dmsPath)
 	cloneCmd.Stdout = os.Stdout
 	cloneCmd.Stderr = os.Stderr
 	if err := cloneCmd.Run(); err != nil {

core/cmd/dms/commands_greeter_test.go

@@ -0,0 +1,143 @@
+package main
+
+import (
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	sharedpam "github.com/AvengeMedia/DankMaterialShell/core/internal/pam"
+	"github.com/spf13/cobra"
+)
+
+func TestSyncGreeterConfigsAndAuthDelegatesSharedAuth(t *testing.T) {
+	origGreeterConfigSyncFn := greeterConfigSyncFn
+	origSharedAuthSyncFn := sharedAuthSyncFn
+	t.Cleanup(func() {
+		greeterConfigSyncFn = origGreeterConfigSyncFn
+		sharedAuthSyncFn = origSharedAuthSyncFn
+	})
+
+	var calls []string
+	greeterConfigSyncFn = func(dmsPath, compositor string, logFunc func(string), sudoPassword string) error {
+		if dmsPath != "/tmp/dms" {
+			t.Fatalf("unexpected dmsPath %q", dmsPath)
+		}
+		if compositor != "niri" {
+			t.Fatalf("unexpected compositor %q", compositor)
+		}
+		if sudoPassword != "" {
+			t.Fatalf("expected empty sudoPassword, got %q", sudoPassword)
+		}
+		calls = append(calls, "configs")
+		return nil
+	}
+
+	var gotOptions sharedpam.SyncAuthOptions
+	sharedAuthSyncFn = func(logFunc func(string), sudoPassword string, options sharedpam.SyncAuthOptions) error {
+		if sudoPassword != "" {
+			t.Fatalf("expected empty sudoPassword, got %q", sudoPassword)
+		}
+		gotOptions = options
+		calls = append(calls, "auth")
+		return nil
+	}
+
+	err := syncGreeterConfigsAndAuth("/tmp/dms", "niri", func(string) {}, sharedpam.SyncAuthOptions{
+		ForceGreeterAuth: true,
+	}, func() {
+		calls = append(calls, "before-auth")
+	})
+	if err != nil {
+		t.Fatalf("syncGreeterConfigsAndAuth returned error: %v", err)
+	}
+
+	wantCalls := []string{"configs", "before-auth", "auth"}
+	if !reflect.DeepEqual(calls, wantCalls) {
+		t.Fatalf("call order = %v, want %v", calls, wantCalls)
+	}
+	if !gotOptions.ForceGreeterAuth {
+		t.Fatalf("expected ForceGreeterAuth to be true, got %+v", gotOptions)
+	}
+}
+
+func TestSyncGreeterConfigsAndAuthStopsOnConfigError(t *testing.T) {
+	origGreeterConfigSyncFn := greeterConfigSyncFn
+	origSharedAuthSyncFn := sharedAuthSyncFn
+	t.Cleanup(func() {
+		greeterConfigSyncFn = origGreeterConfigSyncFn
+		sharedAuthSyncFn = origSharedAuthSyncFn
+	})
+
+	greeterConfigSyncFn = func(string, string, func(string), string) error {
+		return errors.New("config sync failed")
+	}
+
+	authCalled := false
+	sharedAuthSyncFn = func(func(string), string, sharedpam.SyncAuthOptions) error {
+		authCalled = true
+		return nil
+	}
+
+	err := syncGreeterConfigsAndAuth("/tmp/dms", "niri", func(string) {}, sharedpam.SyncAuthOptions{}, nil)
+	if err == nil || err.Error() != "config sync failed" {
+		t.Fatalf("expected config sync error, got %v", err)
+	}
+	if authCalled {
+		t.Fatal("expected auth sync not to run after config sync failure")
+	}
+}
+
+func TestGreeterStatusStateDirUsesNixOSDefault(t *testing.T) {
+	if got := greeterStatusStateDir("", true); got != nixOSGreeterStateDir {
+		t.Fatalf("greeterStatusStateDir() = %q, want %q", got, nixOSGreeterStateDir)
+	}
+}
+
+func TestGreeterStatusStateDirHonorsExplicitOverrideOnNixOS(t *testing.T) {
+	command := "dms-greeter --cache-dir /srv/dms-greeter --command niri"
+	if got := greeterStatusStateDir(command, true); got != "/srv/dms-greeter" {
+		t.Fatalf("greeterStatusStateDir() = %q, want %q", got, "/srv/dms-greeter")
+	}
+}
+
+func TestRejectNixOSGreeterMutationBlocksImperativeCommands(t *testing.T) {
+	origGreeterIsNixOSFn := greeterIsNixOSFn
+	greeterIsNixOSFn = func() bool { return true }
+	t.Cleanup(func() {
+		greeterIsNixOSFn = origGreeterIsNixOSFn
+	})
+
+	for _, commandName := range []string{"install", "enable", "sync", "uninstall"} {
+		t.Run(commandName, func(t *testing.T) {
+			root := &cobra.Command{Use: "dms"}
+			greeterCommand := &cobra.Command{Use: "greeter"}
+			mutationCommand := &cobra.Command{Use: commandName}
+			root.AddCommand(greeterCommand)
+			greeterCommand.AddCommand(mutationCommand)
+
+			err := rejectNixOSGreeterMutation(mutationCommand)
+			if err == nil {
+				t.Fatalf("expected NixOS greeter %s to be rejected", commandName)
+			}
+			if !strings.Contains(err.Error(), "dms greeter "+commandName+" is disabled on NixOS") {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if strings.Contains(err.Error(), "/var/cache/dms-greeter") {
+				t.Fatalf("NixOS remediation should not recommend the non-NixOS cache path: %v", err)
+			}
+		})
+	}
+}
+
+func TestRejectNixOSGreeterMutationAllowsOtherDistros(t *testing.T) {
+	origGreeterIsNixOSFn := greeterIsNixOSFn
+	greeterIsNixOSFn = func() bool { return false }
+	t.Cleanup(func() {
+		greeterIsNixOSFn = origGreeterIsNixOSFn
+	})
+
+	if err := rejectNixOSGreeterMutation(&cobra.Command{Use: "sync"}); err != nil {
+		t.Fatalf("expected non-NixOS greeter command to be allowed, got %v", err)
+	}
+}

core/cmd/dms/commands_qr.go

@@ -1,265 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"io"
-	"os"
-	"strings"
-
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/qrcode"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/models"
-	"github.com/mattn/go-isatty"
-	"github.com/spf13/cobra"
-)
-
-var (
-	qrEcc         string
-	qrVersion     int
-	qrOutput      string
-	qrStdout      bool
-	qrClipboard   bool
-	qrCopyText    bool
-	qrRender      bool
-	qrNoRender    bool
-	qrInvert      bool
-	qrQuietZone   int
-	qrModuleSize  int
-	qrFg          string
-	qrBg          string
-	qrTransparent bool
-	qrBorder      int
-	qrShape       string
-	qrLogo        string
-	qrLogoScale   int
-
-	qrWifiPassword string
-	qrWifiSecurity string
-	qrWifiHidden   bool
-)
-
-var qrCmd = &cobra.Command{
-	Use:   "qr [text]",
-	Short: "Generate QR codes",
-	Long: `Generate a QR code from text, stdin, or a WiFi network.
-
-By default the code is rendered to the terminal when stdout is a TTY, or
-written as PNG bytes to stdout when piped. Use flags to also copy to the
-clipboard, save a PNG, or tune encoding and colors.
-
-Input:
-  dms qr "https://example.com"     # encode an argument
-  echo -n "data" | dms qr          # encode stdin
-  dms qr -                         # encode stdin explicitly
-
-Output (combine freely):
-  dms qr "text" --clipboard        # copy PNG image to clipboard
-  dms qr "text" --copy-text        # copy the source text to clipboard
-  dms qr "text" -o code.png        # save a PNG file
-  dms qr "text" > code.png         # PNG to stdout (piped)
-  dms qr "text" --render           # force terminal render
-
-Encoding & style:
-  --ecc L|M|Q|H                    # error correction (default M)
-  --qr-version 10                  # force symbol version (1-40)
-  --module-size 12 --fg '#000' ... # PNG sizing and colors
-  --shape circle                   # round modules
-  --logo icon.png                  # center logo (bumps --ecc to H)
-  --invert                         # flip colors for light terminals
-
-WiFi:
-  dms qr wifi MySSID -p secret     # build from an explicit password
-  dms qr wifi MySSID               # pull the saved secret from the shell`,
-	Args: cobra.ArbitraryArgs,
-	Run:  runQR,
-}
-
-var qrWifiCmd = &cobra.Command{
-	Use:   "wifi <ssid>",
-	Short: "Generate a WiFi QR code",
-	Long: `Generate a QR code that joins a WiFi network when scanned.
-
-With --password the code is built entirely offline. Without it, the saved
-credentials are fetched from the running DMS shell (like the network panel).`,
-	Args: cobra.ExactArgs(1),
-	Run:  runQRWifi,
-}
-
-func init() {
-	qrCmd.PersistentFlags().StringVar(&qrEcc, "ecc", "", "Error correction level: L, M, Q, H (default M, or H with --logo)")
-	qrCmd.PersistentFlags().IntVar(&qrVersion, "qr-version", 0, "Force QR symbol version 1-40 (0 = auto)")
-	qrCmd.PersistentFlags().StringVarP(&qrOutput, "output", "o", "", "Write a PNG to this file")
-	qrCmd.PersistentFlags().BoolVar(&qrStdout, "stdout", false, "Write PNG bytes to stdout")
-	qrCmd.PersistentFlags().BoolVar(&qrClipboard, "clipboard", false, "Copy the PNG image to the clipboard")
-	qrCmd.PersistentFlags().BoolVar(&qrCopyText, "copy-text", false, "Copy the source text to the clipboard")
-	qrCmd.PersistentFlags().BoolVar(&qrRender, "render", false, "Force terminal rendering")
-	qrCmd.PersistentFlags().BoolVar(&qrNoRender, "no-render", false, "Never render to the terminal")
-	qrCmd.PersistentFlags().BoolVar(&qrInvert, "invert", false, "Swap colors (for light terminals)")
-	qrCmd.PersistentFlags().IntVar(&qrQuietZone, "quiet-zone", 2, "Terminal margin in modules")
-	qrCmd.PersistentFlags().IntVar(&qrModuleSize, "module-size", 0, "PNG pixels per module (0 = auto)")
-	qrCmd.PersistentFlags().StringVar(&qrFg, "fg", "", "Dark module color (#RGB or #RRGGBB)")
-	qrCmd.PersistentFlags().StringVar(&qrBg, "bg", "", "Light module color (#RGB or #RRGGBB)")
-	qrCmd.PersistentFlags().BoolVar(&qrTransparent, "transparent", false, "Transparent PNG background")
-	qrCmd.PersistentFlags().IntVar(&qrBorder, "border", -1, "PNG border in pixels (-1 = auto)")
-	qrCmd.PersistentFlags().StringVar(&qrShape, "shape", "square", "PNG module shape (square, circle)")
-	qrCmd.PersistentFlags().StringVar(&qrLogo, "logo", "", "Center a PNG/JPEG logo on the PNG output")
-	qrCmd.PersistentFlags().IntVar(&qrLogoScale, "logo-scale", 0, "Max logo size as 1/N of the code (0 = library default of 5)")
-
-	qrWifiCmd.Flags().StringVarP(&qrWifiPassword, "password", "p", "", "WiFi password (offline build)")
-	qrWifiCmd.Flags().StringVar(&qrWifiSecurity, "security", "WPA", "Security type (WPA, WEP, nopass)")
-	qrWifiCmd.Flags().BoolVar(&qrWifiHidden, "hidden", false, "Mark the network as hidden")
-
-	qrCmd.AddCommand(qrWifiCmd)
-}
-
-func runQR(cmd *cobra.Command, args []string) {
-	text := strings.Join(args, " ")
-	if text == "" || text == "-" {
-		data, err := io.ReadAll(os.Stdin)
-		if err != nil {
-			fatalf("Error reading stdin: %v", err)
-		}
-		text = strings.TrimRight(string(data), "\n")
-	}
-	if text == "" {
-		fatalf("Error: no input (provide text, pipe stdin, or use a subcommand)")
-	}
-	emitQR(text)
-}
-
-func runQRWifi(cmd *cobra.Command, args []string) {
-	ssid := args[0]
-	if qrWifiPassword != "" || strings.EqualFold(qrWifiSecurity, "nopass") {
-		emitQR(qrcode.WiFiString(qrWifiSecurity, ssid, qrWifiPassword, qrWifiHidden))
-		return
-	}
-
-	content, err := fetchWifiQRContent(ssid)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		fmt.Fprintln(os.Stderr, "Hint: pass --password to build the code without the shell.")
-		os.Exit(1)
-	}
-	if qrWifiHidden {
-		content = strings.TrimSuffix(content, ";") + "H:true;;"
-	}
-	emitQR(content)
-}
-
-func emitQR(text string) {
-	renderTerm := shouldRenderTerminal()
-	pngToStdout := qrStdout || (!renderTerm && qrOutput == "" && !qrClipboard && !qrCopyText)
-
-	if pngToStdout || qrOutput != "" || qrClipboard {
-		png, err := qrcode.RenderPNG(text, qrcode.ImageOptions{
-			ECC:         effectiveEcc(),
-			Version:     qrVersion,
-			ModuleSize:  qrModuleSize,
-			Fg:          qrFg,
-			Bg:          qrBg,
-			Transparent: qrTransparent,
-			Border:      qrBorder,
-			Shape:       qrShape,
-			Logo:        qrLogo,
-			LogoScale:   qrLogoScale,
-		})
-		if err != nil {
-			fatalf("Error encoding QR: %v", err)
-		}
-		emitPNG(png, pngToStdout)
-	}
-
-	if qrCopyText {
-		if err := clipboard.CopyText(text); err != nil {
-			fatalf("Error copying text: %v", err)
-		}
-	}
-
-	if !renderTerm {
-		return
-	}
-	out, err := qrcode.RenderTerminal(text, qrcode.TermOptions{
-		ECC:       effectiveEcc(),
-		Version:   qrVersion,
-		QuietZone: qrQuietZone,
-		Invert:    qrInvert,
-		Fg:        qrFg,
-		Bg:        qrBg,
-	})
-	if err != nil {
-		fatalf("Error rendering QR: %v", err)
-	}
-	dst := os.Stdout
-	if pngToStdout {
-		dst = os.Stderr
-	}
-	fmt.Fprint(dst, out)
-}
-
-func emitPNG(png []byte, toStdout bool) {
-	if qrOutput != "" {
-		if err := os.WriteFile(qrOutput, png, 0o644); err != nil {
-			fatalf("Error writing file: %v", err)
-		}
-		fmt.Fprintln(os.Stderr, qrOutput)
-	}
-	if toStdout {
-		os.Stdout.Write(png)
-	}
-	if qrClipboard {
-		if err := clipboard.Copy(png, "image/png"); err != nil {
-			fatalf("Error copying image: %v", err)
-		}
-	}
-}
-
-func shouldRenderTerminal() bool {
-	switch {
-	case qrNoRender:
-		return false
-	case qrRender:
-		return true
-	case qrStdout, qrOutput != "", qrClipboard, qrCopyText:
-		return false
-	default:
-		return isatty.IsTerminal(os.Stdout.Fd())
-	}
-}
-
-func effectiveEcc() string {
-	switch {
-	case qrEcc != "":
-		return qrEcc
-	case qrLogo != "":
-		return "H"
-	default:
-		return "M"
-	}
-}
-
-func fatalf(format string, args ...any) {
-	fmt.Fprintf(os.Stderr, format+"\n", args...)
-	os.Exit(1)
-}
-
-func fetchWifiQRContent(ssid string) (string, error) {
-	resp, err := sendServerRequest(models.Request{
-		ID:     1,
-		Method: "network.qrcode-content",
-		Params: map[string]any{"ssid": ssid},
-	})
-	if err != nil {
-		return "", err
-	}
-	if resp.Error != "" {
-		return "", fmt.Errorf("%s", resp.Error)
-	}
-	if resp.Result == nil {
-		return "", fmt.Errorf("empty response")
-	}
-	content, ok := (*resp.Result).(string)
-	if !ok {
-		return "", fmt.Errorf("unexpected response format")
-	}
-	return content, nil
-}

core/cmd/dms/commands_root.go

@@ -1,9 +1,19 @@
 package main
 
 import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/spf13/cobra"
 )
 
+var customConfigPath string
+var configPath string
+
 var rootCmd = &cobra.Command{
 	Use:   "dms",
 	Short: "dms CLI",
@@ -11,5 +21,54 @@ var rootCmd = &cobra.Command{
 }
 
 func init() {
-	rootCmd.PersistentFlags().StringVarP(shellApp.CustomConfigVar(), "config", "c", "", "Path to a UI config dir (containing shell.qml) to use instead of the embedded UI (env: DMS_SHELL_DIR)")
+	rootCmd.PersistentFlags().StringVarP(&customConfigPath, "config", "c", "", "Specify a custom path to the DMS config directory")
+}
+
+func findConfig(cmd *cobra.Command, args []string) error {
+	if customConfigPath != "" {
+		log.Debug("Custom config path provided via -c flag: %s", customConfigPath)
+		shellPath := filepath.Join(customConfigPath, "shell.qml")
+
+		info, statErr := os.Stat(shellPath)
+
+		if statErr == nil && !info.IsDir() {
+			configPath = customConfigPath
+			log.Debug("Using config from: %s", configPath)
+			return nil
+		}
+
+		if statErr != nil {
+			return fmt.Errorf("custom config path error: %w", statErr)
+		}
+
+		return fmt.Errorf("path is a directory, not a file: %s", shellPath)
+	}
+
+	configStateFile := filepath.Join(getRuntimeDir(), "danklinux.path")
+	if data, readErr := os.ReadFile(configStateFile); readErr == nil {
+		if len(getAllDMSPIDs()) == 0 {
+			os.Remove(configStateFile)
+		} else {
+			statePath := strings.TrimSpace(string(data))
+			shellPath := filepath.Join(statePath, "shell.qml")
+
+			if info, statErr := os.Stat(shellPath); statErr == nil && !info.IsDir() {
+				log.Debug("Using config from active session state file: %s", statePath)
+				configPath = statePath
+				log.Debug("Using config from: %s", configPath)
+				return nil
+			}
+			os.Remove(configStateFile)
+		}
+	}
+
+	log.Debug("No custom path or active session, searching default XDG locations...")
+	var err error
+	configPath, err = config.LocateDMSConfig()
+	if err != nil {
+		return err
+	}
+
+	log.Debug("Using config from: %s", configPath)
+	return nil
 }

core/cmd/dms/commands_screenshot.go

@@ -2,7 +2,6 @@ package main
 
 import (
 	"bytes"
-	"encoding/json"
 	"fmt"
 	"os"
 	"os/exec"
@@ -28,19 +27,8 @@ var (
 	ssNoConfirm   bool
 	ssReset       bool
 	ssStdout      bool
-	ssJSON        bool
 )
 
-type screenshotMetadata struct {
-	Status string  `json:"status"`
-	Path   string  `json:"path,omitempty"`
-	Width  int     `json:"width,omitempty"`
-	Height int     `json:"height,omitempty"`
-	Scale  float64 `json:"scale,omitempty"`
-	Mime   string  `json:"mime,omitempty"`
-	Error  string  `json:"error,omitempty"`
-}
-
 var screenshotCmd = &cobra.Command{
 	Use:   "screenshot",
 	Short: "Capture screenshots",
@@ -51,9 +39,8 @@ Modes:
   full        - Capture the focused output
   all         - Capture all outputs combined
   output      - Capture a specific output by name
-  window      - Capture the focused window (Hyprland/Mango/niri)
+  window      - Capture the focused window (Hyprland/Mango)
   last        - Capture the last selected region
-  scroll      - Select a region, then scroll to capture a stitched tall image
 
 Output format (--format):
   png         - PNG format (default)
@@ -72,10 +59,7 @@ Examples:
   dms screenshot --no-file           # Clipboard only
   dms screenshot --no-confirm        # Region capture on mouse release
   dms screenshot --cursor=on         # Include cursor
-  dms screenshot -f jpg -q 85        # JPEG with quality 85
-  dms screenshot --json              # Print capture metadata as JSON
-  dms screenshot scroll              # Scroll capture, Enter finishes / Esc cancels
-  dms screenshot scroll --interval 250`,
+  dms screenshot -f jpg -q 85        # JPEG with quality 85`,
 }
 
 var ssRegionCmd = &cobra.Command{
@@ -113,33 +97,10 @@ If no previous region exists, falls back to interactive selection.`,
 var ssWindowCmd = &cobra.Command{
 	Use:   "window",
 	Short: "Capture the focused window",
-	Long:  `Capture the currently focused window. Supported on Hyprland, Mango, and niri.`,
+	Long:  `Capture the currently focused window. Supported on Hyprland and Mango.`,
 	Run:   runScreenshotWindow,
 }
 
-var ssScrollInterval int
-
-var ssScrollCmd = &cobra.Command{
-	Use:   "scroll",
-	Short: "Capture a scrolling region stitched into one tall image",
-	Long: `Select a region, then scroll the content beneath with the mouse wheel or
-touchpad while frames are captured and stitched vertically. Finish with the
-on-screen done button; cancel with the cancel button. Enter and Esc work
-everywhere: most compositors hold the keyboard on the overlay (keyboard
-scrolling does not reach the app there), while Hyprland leaves the keyboard
-with the application — keyboard scrolling works, and Enter/Esc act through
-temporary global binds for the session. The cursor is never included in
-frames.
-
-Frames are stitched continuously while scrolling, and revisited content is
-never duplicated — scrolling up past the starting point extends the image
-upward. Content jumped past faster than capture can follow is skipped rather
-than stitched incorrectly.
-
-Rotated outputs are not supported.`,
-	Run: runScreenshotScroll,
-}
-
 var ssListCmd = &cobra.Command{
 	Use:   "list",
 	Short: "List available outputs",
@@ -167,12 +128,8 @@ func init() {
 	screenshotCmd.PersistentFlags().BoolVar(&ssNoConfirm, "no-confirm", false, "Region mode: capture on mouse release without Enter/Space confirmation")
 	screenshotCmd.PersistentFlags().BoolVar(&ssReset, "reset", false, "Reset saved last-region preselection before capturing")
 	screenshotCmd.PersistentFlags().BoolVar(&ssStdout, "stdout", false, "Output image to stdout (for piping to swappy, etc.)")
-	screenshotCmd.PersistentFlags().BoolVar(&ssJSON, "json", false, "Print capture metadata as JSON")
-
-	ssScrollCmd.Flags().IntVar(&ssScrollInterval, "interval", 45, "Capture interval in milliseconds (30-1000)")
 
 	screenshotCmd.AddCommand(ssRegionCmd)
-	screenshotCmd.AddCommand(ssScrollCmd)
 	screenshotCmd.AddCommand(ssFullCmd)
 	screenshotCmd.AddCommand(ssAllCmd)
 	screenshotCmd.AddCommand(ssOutputCmd)
@@ -231,54 +188,25 @@ func setPopoutScreenshotMode(begin bool) {
 		fn = "begin"
 	}
 	cmdArgs := []string{"ipc"}
-	if pid, ok := shellApp.SessionPID(); ok {
+	if pid, ok := getFirstDMSPID(); ok {
 		cmdArgs = append(cmdArgs, "--pid", strconv.Itoa(pid))
 	} else {
-		if err := shellApp.ResolveConfig(nil, nil); err != nil {
+		if err := findConfig(nil, nil); err != nil {
 			return
 		}
 		if qsHasAnyDisplay() {
 			cmdArgs = append(cmdArgs, "--any-display")
 		}
-		cmdArgs = append(cmdArgs, "-p", shellApp.ConfigPath())
+		cmdArgs = append(cmdArgs, "-p", configPath)
 	}
 	cmdArgs = append(cmdArgs, "call", "screenshot", fn)
 	_ = exec.Command("qs", cmdArgs...).Run()
 }
 
-func writeScreenshotJSON(meta screenshotMetadata) {
-	_ = json.NewEncoder(os.Stdout).Encode(meta)
-}
-
-func exitScreenshotError(context string, err error) {
-	if ssJSON {
-		writeScreenshotJSON(screenshotMetadata{Status: "error", Error: err.Error()})
-		os.Exit(1)
-	}
-	fmt.Fprintf(os.Stderr, "Error%s: %v\n", context, err)
-	os.Exit(1)
-}
-
-func formatMime(format screenshot.Format) string {
-	switch format {
-	case screenshot.FormatJPEG:
-		return "image/jpeg"
-	case screenshot.FormatPPM:
-		return "image/x-portable-pixmap"
-	default:
-		return "image/png"
-	}
-}
-
 func runScreenshot(config screenshot.Config) {
-	if ssJSON && config.Stdout {
-		fmt.Fprintln(os.Stderr, "Error: --json cannot be combined with --stdout")
-		os.Exit(1)
-	}
-
 	// Region select needs the keyboard; drop popout grabs for its duration.
 	result, err := func() (*screenshot.CaptureResult, error) {
-		interactive := config.Mode == screenshot.ModeRegion || config.Mode == screenshot.ModeLastRegion || config.Mode == screenshot.ModeScroll
+		interactive := config.Mode == screenshot.ModeRegion || config.Mode == screenshot.ModeLastRegion
 		if interactive {
 			setPopoutScreenshotMode(true)
 			defer setPopoutScreenshotMode(false)
@@ -287,13 +215,11 @@ func runScreenshot(config screenshot.Config) {
 	}()
 
 	if err != nil {
-		exitScreenshotError("", err)
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
 	}
 
 	if result == nil {
-		if ssJSON {
-			writeScreenshotJSON(screenshotMetadata{Status: "aborted", Error: "User cancelled selection"})
-		}
 		os.Exit(0)
 	}
 
@@ -305,7 +231,8 @@ func runScreenshot(config screenshot.Config) {
 
 	if config.Stdout {
 		if err := writeImageToStdout(result.Buffer, config.Format, config.Quality, result.Format); err != nil {
-			exitScreenshotError(" writing to stdout", err)
+			fmt.Fprintf(os.Stderr, "Error writing to stdout: %v\n", err)
+			os.Exit(1)
 		}
 		return
 	}
@@ -325,37 +252,22 @@ func runScreenshot(config screenshot.Config) {
 
 		filePath = filepath.Join(outputDir, filename)
 		if err := screenshot.WriteToFileWithFormat(result.Buffer, filePath, config.Format, config.Quality, result.Format); err != nil {
-			exitScreenshotError(" writing file", err)
-		}
-		if !ssJSON {
-			fmt.Println(filePath)
+			fmt.Fprintf(os.Stderr, "Error writing file: %v\n", err)
+			os.Exit(1)
 		}
+		fmt.Println(filePath)
 	}
 
 	if config.Clipboard {
 		if err := copyImageToClipboard(result.Buffer, config.Format, config.Quality, result.Format); err != nil {
-			exitScreenshotError(" copying to clipboard", err)
+			fmt.Fprintf(os.Stderr, "Error copying to clipboard: %v\n", err)
+			os.Exit(1)
 		}
-		if !ssJSON && !config.SaveFile {
+		if !config.SaveFile {
 			fmt.Println("Copied to clipboard")
 		}
 	}
 
-	if ssJSON {
-		scale := result.Scale
-		if scale <= 0 {
-			scale = 1.0
-		}
-		writeScreenshotJSON(screenshotMetadata{
-			Status: "success",
-			Path:   filePath,
-			Width:  result.Buffer.Width,
-			Height: result.Buffer.Height,
-			Scale:  scale,
-			Mime:   formatMime(config.Format),
-		})
-	}
-
 	if config.Notify {
 		thumbData, thumbW, thumbH := bufferToRGBThumbnail(result.Buffer, 256, result.Format)
 		screenshot.SendNotification(screenshot.NotifyResult{
@@ -466,12 +378,6 @@ func runScreenshotRegion(cmd *cobra.Command, args []string) {
 	runScreenshot(config)
 }
 
-func runScreenshotScroll(cmd *cobra.Command, args []string) {
-	config := getScreenshotConfig(screenshot.ModeScroll)
-	config.IntervalMs = min(max(ssScrollInterval, 30), 1000)
-	runScreenshot(config)
-}
-
 func runScreenshotFull(cmd *cobra.Command, args []string) {
 	config := getScreenshotConfig(screenshot.ModeFullScreen)
 	runScreenshot(config)

core/cmd/dms/commands_setup.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/greeter"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
@@ -204,12 +204,7 @@ func detectTerminal() (string, error) {
 }
 
 func detectCompositorForSetup() (string, error) {
-	var compositors []string
-	for _, candidate := range []string{"niri", "Hyprland", "mango"} {
-		if utils.CommandExists(candidate) {
-			compositors = append(compositors, candidate)
-		}
-	}
+	compositors := greeter.DetectCompositors()
 
 	switch len(compositors) {
 	case 0:
@@ -218,20 +213,11 @@ func detectCompositorForSetup() (string, error) {
 		return strings.ToLower(compositors[0]), nil
 	}
 
-	fmt.Println("Multiple compositors detected:")
-	for i, compositor := range compositors {
-		fmt.Printf("%d) %s\n", i+1, compositor)
+	selected, err := greeter.PromptCompositorChoice(compositors)
+	if err != nil {
+		return "", err
 	}
-	fmt.Printf("\nChoice (1-%d): ", len(compositors))
-
-	var response string
-	fmt.Scanln(&response)
-	choice := 0
-	fmt.Sscanf(strings.TrimSpace(response), "%d", &choice)
-	if choice < 1 || choice > len(compositors) {
-		return "", fmt.Errorf("invalid choice")
-	}
-	return strings.ToLower(compositors[choice-1]), nil
+	return strings.ToLower(selected), nil
 }
 
 func runSetupDmsConfig(name string) error {
@@ -312,9 +298,6 @@ func runSetup() error {
 	if wmSelected {
 		if wm == deps.WindowManagerMango {
 			useSystemd = false
-		} else if isVoidSetup() {
-			useSystemd = false
-			fmt.Println("\nVoid Linux detected; deploying non-systemd session config.")
 		} else {
 			useSystemd = promptSystemd()
 		}
@@ -389,15 +372,6 @@ func runSetup() error {
 	return nil
 }
 
-func isVoidSetup() bool {
-	osInfo, err := distros.GetOSInfo()
-	if err != nil {
-		return false
-	}
-	config, exists := distros.Registry[osInfo.Distribution.ID]
-	return exists && config.Family == distros.FamilyVoid
-}
-
 // Add user to the input group for the evdev manager for inut state tracking.
 // Caps Lock OSD and the Caps Lock bar indicator.
 func ensureInputGroup() {

core/cmd/dms/commands_system.go

@@ -47,7 +47,6 @@ var (
 	sysUpdateJSON       bool
 	sysUpdateNoFlatpak  bool
 	sysUpdateNoAUR      bool
-	sysUpdateIgnore     []string
 	sysUpdateIntervalS  int
 	sysUpdateListPmTime = 5 * time.Minute
 )
@@ -59,7 +58,6 @@ func init() {
 	systemUpdateCmd.Flags().BoolVar(&sysUpdateJSON, "json", false, "Output as JSON (with --check)")
 	systemUpdateCmd.Flags().BoolVar(&sysUpdateNoFlatpak, "no-flatpak", false, "Skip the Flatpak overlay")
 	systemUpdateCmd.Flags().BoolVar(&sysUpdateNoAUR, "no-aur", false, "Skip the AUR (paru/yay only)")
-	systemUpdateCmd.Flags().StringSliceVar(&sysUpdateIgnore, "ignore", nil, "Skip specific packages (repeatable or comma-separated)")
 	systemUpdateCmd.Flags().IntVar(&sysUpdateIntervalS, "interval", -1, "Set the DMS server poll interval in seconds and exit (requires running server)")
 
 	systemCmd.AddCommand(systemUpdateCmd)
@@ -194,7 +192,6 @@ func runSystemUpdateApply() {
 		Targets:        pkgs,
 		IncludeFlatpak: !sysUpdateNoFlatpak,
 		IncludeAUR:     !sysUpdateNoAUR,
-		Ignored:        sysUpdateIgnore,
 		DryRun:         sysUpdateDry,
 		UseSudo:        true,
 	}
@@ -237,19 +234,12 @@ func collectUpdates(ctx context.Context, backends []sysupdate.Backend) ([]sysupd
 }
 
 func filterUpdateTargets(pkgs []sysupdate.Package) []sysupdate.Package {
-	if !sysUpdateNoAUR && len(sysUpdateIgnore) == 0 {
+	if !sysUpdateNoAUR {
 		return pkgs
 	}
-	ignored := make(map[string]bool, len(sysUpdateIgnore))
-	for _, name := range sysUpdateIgnore {
-		ignored[name] = true
-	}
 	out := pkgs[:0]
 	for _, p := range pkgs {
-		if sysUpdateNoAUR && p.Repo == sysupdate.RepoAUR {
-			continue
-		}
-		if ignored[p.Name] {
+		if p.Repo == sysupdate.RepoAUR {
 			continue
 		}
 		out = append(out, p)

core/cmd/dms/init_service.go

@@ -0,0 +1,114 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
+)
+
+// runit (Void Linux) service helpers. Services live in /etc/sv and are "enabled"
+// by symlinking them into the /var/service supervision dir, so the greeter
+// commands branch on isRunit() instead of shelling systemctl.
+
+const (
+	runitSvDir      = "/etc/sv"
+	runitServiceDir = "/var/service"
+)
+
+// isRunit reports whether this system is supervised by runit (Void Linux).
+func isRunit() bool {
+	if fi, err := os.Stat("/run/runit"); err == nil && fi.IsDir() {
+		return true
+	}
+	if _, err := os.Stat("/run/systemd/system"); err == nil {
+		return false
+	}
+	if fi, err := os.Stat(runitServiceDir); err == nil && fi.IsDir() {
+		return true
+	}
+	return false
+}
+
+func runitServiceInstalled(name string) bool {
+	fi, err := os.Stat(runitSvDir + "/" + name)
+	return err == nil && fi.IsDir()
+}
+
+func runitServiceEnabled(name string) bool {
+	_, err := os.Lstat(runitServiceDir + "/" + name)
+	return err == nil
+}
+
+// enableRunitService links a service into /var/service (idempotent).
+func enableRunitService(name string) error {
+	if !runitServiceInstalled(name) {
+		return fmt.Errorf("runit service %q not found in %s", name, runitSvDir)
+	}
+	if runitServiceEnabled(name) {
+		return nil
+	}
+	return privesc.Run(context.Background(), "", "ln", "-sf",
+		runitSvDir+"/"+name, runitServiceDir+"/"+name)
+}
+
+// disableRunitService removes a service's supervision symlink.
+func disableRunitService(name string) error {
+	if !runitServiceEnabled(name) {
+		return nil
+	}
+	return privesc.Run(context.Background(), "", "rm", "-f",
+		runitServiceDir+"/"+name)
+}
+
+// ensureRunitSeat sets up the seat access a Wayland greeter needs on runit (the
+// equivalent of logind on systemd): enables seatd and adds the greeter user to
+// the seat/video/input groups. Failures are reported but non-fatal.
+func ensureRunitSeat(greeterUser string) {
+	if runitServiceInstalled("seatd") {
+		if err := enableRunitService("seatd"); err != nil {
+			fmt.Printf("  ⚠ could not enable seatd: %v\n", err)
+		} else {
+			fmt.Println("  ✓ seatd enabled")
+		}
+	} else {
+		fmt.Println("  ⚠ seatd not installed — the greeter compositor needs it for GPU/seat access")
+	}
+	if err := privesc.Run(context.Background(), "", "usermod", "-aG", "_seatd,video,input", greeterUser); err != nil {
+		fmt.Printf("  ⚠ could not add %s to seat groups: %v\n", greeterUser, err)
+	} else {
+		fmt.Printf("  ✓ %s added to seat groups (_seatd, video, input)\n", greeterUser)
+	}
+}
+
+// ensureGreetdPamRundir adds pam_rundir to the greetd PAM stack so the post-login
+// session gets an XDG_RUNTIME_DIR on systems without logind (Void with seatd).
+// Appended outside DMS's managed auth block so it survives `dms greeter sync`.
+func ensureGreetdPamRundir() {
+	const pamPath = "/etc/pam.d/greetd"
+	data, err := os.ReadFile(pamPath)
+	if err != nil {
+		fmt.Printf("  ⚠ could not read %s: %v\n", pamPath, err)
+		return
+	}
+	if strings.Contains(string(data), "pam_rundir") {
+		return
+	}
+	line := "session    optional    pam_rundir.so"
+	if err := privesc.Run(context.Background(), "", "sh", "-c",
+		fmt.Sprintf("printf '%%s\\n' %q >> %s", line, pamPath)); err != nil {
+		fmt.Printf("  ⚠ could not add pam_rundir to %s: %v\n", pamPath, err)
+		return
+	}
+	fmt.Println("  ✓ pam_rundir added to greetd PAM (provides XDG_RUNTIME_DIR for the session)")
+}
+
+// startGreeterHint returns the init-appropriate "start greetd now" command.
+func startGreeterHint() string {
+	if isRunit() {
+		return "  sudo sv up greetd"
+	}
+	return "  sudo systemctl start greetd"
+}

core/cmd/dms/main.go

@@ -12,7 +12,15 @@ import (
 var Version = "dev"
 
 func init() {
-	authCmd.AddCommand(authSyncCmd, authResolveLockCmd, authListServicesCmd, authValidateCmd)
+	runCmd.Flags().BoolP("daemon", "d", false, "Run in daemon mode")
+	runCmd.Flags().Bool("daemon-child", false, "Internal flag for daemon child process")
+	runCmd.Flags().Bool("session", false, "Session managed (like as a systemd unit)")
+	runCmd.Flags().String("log-level", "", "Log level: debug, info, warn, error, fatal (overrides DMS_LOG_LEVEL)")
+	runCmd.Flags().String("log-file", "", "Append logs to this file in addition to stderr (overrides DMS_LOG_FILE)")
+	runCmd.Flags().MarkHidden("daemon-child")
+
+	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd, greeterLaunchSessionCmd)
+	authCmd.AddCommand(authSyncCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
 	updateCmd.AddCommand(updateCheckCmd)
 	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)

core/cmd/dms/main_distro.go

@@ -12,7 +12,15 @@ import (
 var Version = "dev"
 
 func init() {
-	authCmd.AddCommand(authSyncCmd, authResolveLockCmd, authListServicesCmd, authValidateCmd)
+	runCmd.Flags().BoolP("daemon", "d", false, "Run in daemon mode")
+	runCmd.Flags().Bool("daemon-child", false, "Internal flag for daemon child process")
+	runCmd.Flags().Bool("session", false, "Session managed (like as a systemd unit)")
+	runCmd.Flags().String("log-level", "", "Log level: debug, info, warn, error, fatal (overrides DMS_LOG_LEVEL)")
+	runCmd.Flags().String("log-file", "", "Append logs to this file in addition to stderr (overrides DMS_LOG_FILE)")
+	runCmd.Flags().MarkHidden("daemon-child")
+
+	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd, greeterLaunchSessionCmd)
+	authCmd.AddCommand(authSyncCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
 	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
 	rootCmd.AddCommand(getCommonCommands()...)

core/cmd/dms/server_client.go

@@ -101,8 +101,11 @@ func getServerSocketPath() string {
 		runtimeDir = os.TempDir()
 	}
 
-	if sessionSock, ok := shellApp.SessionSocketPath(); ok {
-		return sessionSock
+	if parentPID, ok := sessionParentPID(os.Getenv("WAYLAND_DISPLAY")); ok {
+		sessionSock := filepath.Join(runtimeDir, fmt.Sprintf("danklinux-%d.sock", parentPID))
+		if _, err := os.Stat(sessionSock); err == nil {
+			return sessionSock
+		}
 	}
 
 	entries, err := os.ReadDir(runtimeDir)

core/cmd/dms/shell.go

@@ -4,26 +4,585 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
+	"os/signal"
 	"path/filepath"
 	"slices"
 	"strconv"
 	"strings"
 	"sync"
+	"syscall"
 	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/server"
 )
 
 type ipcTargets map[string]map[string][]string
 
-var qsHasAnyDisplay = sync.OnceValue(func() bool {
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+// getProcessExitCode returns the exit code from a ProcessState.
+// For normal exits, returns the exit code directly.
+// For signal termination, returns 128 + signal number (Unix convention).
+func getProcessExitCode(state *os.ProcessState) int {
+	if state == nil {
+		return 1
+	}
+	if code := state.ExitCode(); code != -1 {
+		return code
+	}
+	// Process was killed by signal - extract signal number
+	if status, ok := state.Sys().(syscall.WaitStatus); ok {
+		if status.Signaled() {
+			return 128 + int(status.Signal())
+		}
+	}
+	return 1
+}
+
+var isSessionManaged bool
+
+func execDetachedRestart(targetPID int) {
+	selfPath, err := os.Executable()
+	if err != nil {
+		return
+	}
+
+	cmd := exec.Command(selfPath, "restart-detached", strconv.Itoa(targetPID))
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Setsid: true,
+	}
+	cmd.Start()
+}
+
+func runDetachedRestart(targetPIDStr string) {
+	targetPID, err := strconv.Atoi(targetPIDStr)
+	if err != nil {
+		return
+	}
+
+	time.Sleep(200 * time.Millisecond)
+
+	proc, err := os.FindProcess(targetPID)
+	if err == nil {
+		proc.Signal(syscall.SIGTERM)
+	}
+
+	time.Sleep(500 * time.Millisecond)
+
+	killShell()
+	runShellDaemon(false)
+}
+
+func getRuntimeDir() string {
+	if runtime := os.Getenv("XDG_RUNTIME_DIR"); runtime != "" {
+		return runtime
+	}
+	return os.TempDir()
+}
+
+func appendLogEnv(env []string) []string {
+	if v := os.Getenv("DMS_LOG_LEVEL"); v != "" {
+		env = append(env, "DMS_LOG_LEVEL="+v)
+	}
+	if v := os.Getenv("DMS_LOG_FILE"); v != "" {
+		env = append(env, "DMS_LOG_FILE="+v)
+	}
+	return env
+}
+
+func hasSystemdRun() bool {
+	_, err := exec.LookPath("systemd-run")
+	return err == nil
+}
+
+func getPIDFilePath() string {
+	return filepath.Join(getRuntimeDir(), fmt.Sprintf("danklinux-%d.pid", os.Getpid()))
+}
+
+func getSessionFilePath() string {
+	return filepath.Join(getRuntimeDir(), fmt.Sprintf("danklinux-%d.session", os.Getpid()))
+}
+
+func writePIDFile(childPID int) error {
+	pidFile := getPIDFilePath()
+	if display := os.Getenv("WAYLAND_DISPLAY"); display != "" {
+		if err := os.WriteFile(getSessionFilePath(), []byte(display), 0o644); err != nil {
+			log.Warnf("Failed to write session file: %v", err)
+		}
+	}
+	return os.WriteFile(pidFile, []byte(strconv.Itoa(childPID)), 0o644)
+}
+
+func removePIDFile() {
+	os.Remove(getPIDFilePath())
+	os.Remove(getSessionFilePath())
+}
+
+func getAllDMSPIDs() []int {
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return nil
+	}
+
+	var pids []int
+
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), "danklinux-") || !strings.HasSuffix(entry.Name(), ".pid") {
+			continue
+		}
+
+		pidFile := filepath.Join(dir, entry.Name())
+		data, err := os.ReadFile(pidFile)
+		if err != nil {
+			continue
+		}
+
+		childPID, err := strconv.Atoi(strings.TrimSpace(string(data)))
+		if err != nil {
+			os.Remove(pidFile)
+			continue
+		}
+
+		proc, err := os.FindProcess(childPID)
+		if err != nil {
+			os.Remove(pidFile)
+			continue
+		}
+
+		if err := proc.Signal(syscall.Signal(0)); err != nil {
+			os.Remove(pidFile)
+			continue
+		}
+
+		pids = append(pids, childPID)
+
+		parentPIDStr := strings.TrimPrefix(entry.Name(), "danklinux-")
+		parentPIDStr = strings.TrimSuffix(parentPIDStr, ".pid")
+		if parentPID, err := strconv.Atoi(parentPIDStr); err == nil {
+			if parentProc, err := os.FindProcess(parentPID); err == nil {
+				if err := parentProc.Signal(syscall.Signal(0)); err == nil {
+					pids = append(pids, parentPID)
+				}
+			}
+		}
+	}
+
+	return pids
+}
+
+func runShellInteractive(session bool) {
+	isSessionManaged = session
+	go printASCII()
+	fmt.Fprintf(os.Stderr, "dms %s\n", Version)
+
+	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
-	cmd := exec.CommandContext(ctx, "qs", "ipc", "--help")
-	cmd.WaitDelay = 500 * time.Millisecond
-	out, err := cmd.Output()
+
+	socketPath := server.GetSocketPath()
+
+	configStateFile := filepath.Join(getRuntimeDir(), "danklinux.path")
+	if err := os.WriteFile(configStateFile, []byte(configPath), 0o644); err != nil {
+		log.Warnf("Failed to write config state file: %v", err)
+	}
+	defer os.Remove(configStateFile)
+
+	errChan := make(chan error, 2)
+
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				errChan <- fmt.Errorf("server panic: %v", r)
+			}
+		}()
+		server.CLIVersion = Version
+		if err := server.Start(false); err != nil {
+			errChan <- fmt.Errorf("server error: %w", err)
+		}
+	}()
+
+	ensureFontCache()
+	log.Infof("Spawning quickshell with -p %s", configPath)
+
+	cmd := exec.CommandContext(ctx, "qs", "-p", configPath)
+	cmd.Env = append(os.Environ(), "DMS_SOCKET="+socketPath)
+	if os.Getenv("QT_LOGGING_RULES") == "" {
+		if qtRules := log.GetQtLoggingRules(); qtRules != "" {
+			cmd.Env = append(cmd.Env, "QT_LOGGING_RULES="+qtRules)
+		}
+	}
+
+	if isSessionManaged && hasSystemdRun() {
+		cmd.Env = append(cmd.Env, "DMS_DEFAULT_LAUNCH_PREFIX=systemd-run --user --scope")
+	}
+
+	homeDir, err := os.UserHomeDir()
+	if err == nil && os.Getenv("DMS_DISABLE_HOT_RELOAD") == "" {
+		if !strings.HasPrefix(configPath, homeDir) {
+			cmd.Env = append(cmd.Env, "DMS_DISABLE_HOT_RELOAD=1")
+		}
+	}
+
+	if os.Getenv("QT_QPA_PLATFORMTHEME") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORMTHEME=gtk3")
+	}
+	if os.Getenv("QT_QPA_PLATFORMTHEME_QT6") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORMTHEME_QT6=gtk3")
+	}
+	if os.Getenv("QT_QPA_PLATFORM") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORM=wayland;xcb")
+	}
+	if os.Getenv("QSG_USE_SIMPLE_ANIMATION_DRIVER") == "" {
+		cmd.Env = append(cmd.Env, "QSG_USE_SIMPLE_ANIMATION_DRIVER=1")
+	}
+
+	cmd.Env = appendLogEnv(cmd.Env)
+
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	tracker := &stderrTracker{parent: os.Stderr}
+	cmd.Stderr = tracker
+
+	startTime := time.Now()
+	if err := cmd.Start(); err != nil {
+		log.Fatalf("Error starting quickshell: %v", err)
+	}
+
+	// Write PID file for the quickshell child process
+	if err := writePIDFile(cmd.Process.Pid); err != nil {
+		log.Warnf("Failed to write PID file: %v", err)
+	}
+	defer removePIDFile()
+
+	defer func() {
+		if cmd.Process != nil {
+			cmd.Process.Signal(syscall.SIGTERM)
+		}
+	}()
+
+	sigChan := make(chan os.Signal, 1)
+	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM, syscall.SIGUSR1)
+
+	go func() {
+		if err := cmd.Wait(); err != nil {
+			errChan <- fmt.Errorf("quickshell exited: %w", err)
+		} else {
+			errChan <- fmt.Errorf("quickshell exited")
+		}
+	}()
+
+	for {
+		select {
+		case sig := <-sigChan:
+			if sig == syscall.SIGUSR1 {
+				if isSessionManaged {
+					log.Infof("Received SIGUSR1, exiting for systemd restart...")
+					cancel()
+					cmd.Process.Signal(syscall.SIGTERM)
+					os.Remove(socketPath)
+					os.Exit(1)
+				}
+				log.Infof("Received SIGUSR1, spawning detached restart process...")
+				execDetachedRestart(os.Getpid())
+				return
+			}
+
+			// Check if qs already crashed before we got SIGTERM (systemd sends SIGTERM when D-Bus name is released)
+			select {
+			case <-errChan:
+				cancel()
+				os.Remove(socketPath)
+				exitCode := getProcessExitCode(cmd.ProcessState)
+				logStartupFailure(startTime, exitCode, tracker)
+				os.Exit(exitCode)
+			case <-time.After(500 * time.Millisecond):
+			}
+
+			log.Infof("\nReceived signal %v, shutting down...", sig)
+			cancel()
+			cmd.Process.Signal(syscall.SIGTERM)
+			os.Remove(socketPath)
+			return
+
+		case err := <-errChan:
+			log.Error(err)
+			cancel()
+			if cmd.Process != nil {
+				cmd.Process.Signal(syscall.SIGTERM)
+			}
+			os.Remove(socketPath)
+			exitCode := getProcessExitCode(cmd.ProcessState)
+			logStartupFailure(startTime, exitCode, tracker)
+			os.Exit(exitCode)
+		}
+	}
+}
+
+func restartShell() {
+	pids := getAllDMSPIDs()
+
+	if len(pids) == 0 {
+		log.Info("No running DMS shell instances found. Starting daemon...")
+		runShellDaemon(false)
+		return
+	}
+
+	currentPid := os.Getpid()
+	uniquePids := make(map[int]bool)
+
+	for _, pid := range pids {
+		if pid != currentPid {
+			uniquePids[pid] = true
+		}
+	}
+
+	for pid := range uniquePids {
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			log.Errorf("Error finding process %d: %v", pid, err)
+			continue
+		}
+
+		if err := proc.Signal(syscall.Signal(0)); err != nil {
+			continue
+		}
+
+		if err := proc.Signal(syscall.SIGUSR1); err != nil {
+			log.Errorf("Error sending SIGUSR1 to process %d: %v", pid, err)
+		} else {
+			log.Infof("Sent SIGUSR1 to DMS process with PID %d", pid)
+		}
+	}
+}
+
+func killShell() {
+	pids := getAllDMSPIDs()
+
+	if len(pids) == 0 {
+		log.Info("No running DMS shell instances found.")
+		return
+	}
+
+	currentPid := os.Getpid()
+	uniquePids := make(map[int]bool)
+
+	for _, pid := range pids {
+		if pid != currentPid {
+			uniquePids[pid] = true
+		}
+	}
+
+	for pid := range uniquePids {
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			log.Errorf("Error finding process %d: %v", pid, err)
+			continue
+		}
+
+		if err := proc.Signal(syscall.Signal(0)); err != nil {
+			continue
+		}
+
+		if err := proc.Kill(); err != nil {
+			log.Errorf("Error killing process %d: %v", pid, err)
+		} else {
+			log.Infof("Killed DMS process with PID %d", pid)
+		}
+	}
+
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return
+	}
+
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), "danklinux-") {
+			continue
+		}
+		if strings.HasSuffix(entry.Name(), ".pid") || strings.HasSuffix(entry.Name(), ".session") {
+			os.Remove(filepath.Join(dir, entry.Name()))
+		}
+	}
+}
+
+func runShellDaemon(session bool) {
+	isSessionManaged = session
+	isDaemonChild := slices.Contains(os.Args, "--daemon-child")
+
+	if !isDaemonChild {
+		fmt.Fprintf(os.Stderr, "dms %s\n", Version)
+
+		cmd := exec.Command(os.Args[0], "run", "-d", "--daemon-child")
+		cmd.Env = os.Environ()
+
+		cmd.SysProcAttr = &syscall.SysProcAttr{
+			Setsid: true,
+		}
+
+		if err := cmd.Start(); err != nil {
+			log.Fatalf("Error starting daemon: %v", err)
+		}
+
+		log.Infof("DMS shell daemon started (PID: %d)", cmd.Process.Pid)
+		return
+	}
+
+	fmt.Fprintf(os.Stderr, "dms %s\n", Version)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	socketPath := server.GetSocketPath()
+
+	configStateFile := filepath.Join(getRuntimeDir(), "danklinux.path")
+	if err := os.WriteFile(configStateFile, []byte(configPath), 0o644); err != nil {
+		log.Warnf("Failed to write config state file: %v", err)
+	}
+	defer os.Remove(configStateFile)
+
+	errChan := make(chan error, 2)
+
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				errChan <- fmt.Errorf("server panic: %v", r)
+			}
+		}()
+		server.CLIVersion = Version
+		if err := server.Start(false); err != nil {
+			errChan <- fmt.Errorf("server error: %w", err)
+		}
+	}()
+
+	ensureFontCache()
+	log.Infof("Spawning quickshell with -p %s", configPath)
+
+	cmd := exec.CommandContext(ctx, "qs", "-p", configPath)
+	cmd.Env = append(os.Environ(), "DMS_SOCKET="+socketPath)
+	if os.Getenv("QT_LOGGING_RULES") == "" {
+		if qtRules := log.GetQtLoggingRules(); qtRules != "" {
+			cmd.Env = append(cmd.Env, "QT_LOGGING_RULES="+qtRules)
+		}
+	}
+
+	// ! TODO - remove when QS 0.3 is up and we can use the pragma
+	cmd.Env = append(cmd.Env, "QS_APP_ID=com.danklinux.dms")
+
+	if isSessionManaged && hasSystemdRun() {
+		cmd.Env = append(cmd.Env, "DMS_DEFAULT_LAUNCH_PREFIX=systemd-run --user --scope")
+	}
+
+	homeDir, err := os.UserHomeDir()
+	if err == nil && os.Getenv("DMS_DISABLE_HOT_RELOAD") == "" {
+		if !strings.HasPrefix(configPath, homeDir) {
+			cmd.Env = append(cmd.Env, "DMS_DISABLE_HOT_RELOAD=1")
+		}
+	}
+
+	if os.Getenv("QT_QPA_PLATFORMTHEME") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORMTHEME=gtk3")
+	}
+	if os.Getenv("QT_QPA_PLATFORMTHEME_QT6") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORMTHEME_QT6=gtk3")
+	}
+	if os.Getenv("QT_QPA_PLATFORM") == "" {
+		cmd.Env = append(cmd.Env, "QT_QPA_PLATFORM=wayland;xcb")
+	}
+	if os.Getenv("QSG_USE_SIMPLE_ANIMATION_DRIVER") == "" {
+		cmd.Env = append(cmd.Env, "QSG_USE_SIMPLE_ANIMATION_DRIVER=1")
+	}
+
+	cmd.Env = appendLogEnv(cmd.Env)
+
+	devNull, err := os.OpenFile("/dev/null", os.O_RDWR, 0)
+	if err != nil {
+		log.Fatalf("Error opening /dev/null: %v", err)
+	}
+	defer devNull.Close()
+
+	cmd.Stdin = devNull
+	cmd.Stdout = devNull
+	tracker := &stderrTracker{parent: devNull}
+	cmd.Stderr = tracker
+
+	startTime := time.Now()
+	if err := cmd.Start(); err != nil {
+		log.Fatalf("Error starting daemon: %v", err)
+	}
+
+	// Write PID file for the quickshell child process
+	if err := writePIDFile(cmd.Process.Pid); err != nil {
+		log.Warnf("Failed to write PID file: %v", err)
+	}
+	defer removePIDFile()
+
+	defer func() {
+		if cmd.Process != nil {
+			cmd.Process.Signal(syscall.SIGTERM)
+		}
+	}()
+
+	sigChan := make(chan os.Signal, 1)
+	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM, syscall.SIGUSR1)
+
+	go func() {
+		if err := cmd.Wait(); err != nil {
+			errChan <- fmt.Errorf("quickshell exited: %w", err)
+		} else {
+			errChan <- fmt.Errorf("quickshell exited")
+		}
+	}()
+
+	for {
+		select {
+		case sig := <-sigChan:
+			if sig == syscall.SIGUSR1 {
+				if isSessionManaged {
+					log.Infof("Received SIGUSR1, exiting for systemd restart...")
+					cancel()
+					cmd.Process.Signal(syscall.SIGTERM)
+					os.Remove(socketPath)
+					os.Exit(1)
+				}
+				log.Infof("Received SIGUSR1, spawning detached restart process...")
+				execDetachedRestart(os.Getpid())
+				return
+			}
+
+			// Check if qs already crashed before we got SIGTERM (systemd sends SIGTERM when D-Bus name is released)
+			select {
+			case <-errChan:
+				cancel()
+				os.Remove(socketPath)
+				exitCode := getProcessExitCode(cmd.ProcessState)
+				logStartupFailure(startTime, exitCode, tracker)
+				os.Exit(exitCode)
+			case <-time.After(500 * time.Millisecond):
+			}
+
+			cancel()
+			cmd.Process.Signal(syscall.SIGTERM)
+			os.Remove(socketPath)
+			return
+
+		case <-errChan:
+			cancel()
+			if cmd.Process != nil {
+				cmd.Process.Signal(syscall.SIGTERM)
+			}
+			os.Remove(socketPath)
+			exitCode := getProcessExitCode(cmd.ProcessState)
+			logStartupFailure(startTime, exitCode, tracker)
+			os.Exit(exitCode)
+		}
+	}
+}
+
+var qsHasAnyDisplay = sync.OnceValue(func() bool {
+	out, err := exec.Command("qs", "ipc", "--help").Output()
 	if err != nil {
 		return false
 	}
@@ -61,17 +620,17 @@ func parseTargetsFromIPCShowOutput(output string) ipcTargets {
 
 func buildQsIPCBaseArgs() ([]string, error) {
 	cmdArgs := []string{"ipc"}
-	switch pid, ok := shellApp.SessionPID(); {
+	switch pid, ok := getSessionDMSPID(); {
 	case ok:
 		cmdArgs = append(cmdArgs, "--pid", strconv.Itoa(pid))
 	default:
-		if err := shellApp.ResolveConfig(nil, nil); err != nil {
+		if err := findConfig(nil, nil); err != nil {
 			return nil, err
 		}
 		if qsHasAnyDisplay() {
 			cmdArgs = append(cmdArgs, "--any-display")
 		}
-		cmdArgs = append(cmdArgs, "-p", shellApp.ConfigPath())
+		cmdArgs = append(cmdArgs, "-p", configPath)
 	}
 	return cmdArgs, nil
 }
@@ -83,10 +642,7 @@ func getShellIPCCompletions(args []string, _ string) []string {
 		return nil
 	}
 	cmdArgs := append(baseArgs, "show")
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, "qs", cmdArgs...)
-	cmd.WaitDelay = 500 * time.Millisecond
+	cmd := exec.Command("qs", cmdArgs...)
 	var targets ipcTargets
 
 	if output, err := cmd.Output(); err == nil {
@@ -128,6 +684,101 @@ func getShellIPCCompletions(args []string, _ string) []string {
 	return nil
 }
 
+func getFirstDMSPID() (int, bool) {
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return 0, false
+	}
+
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), "danklinux-") || !strings.HasSuffix(entry.Name(), ".pid") {
+			continue
+		}
+
+		data, err := os.ReadFile(filepath.Join(dir, entry.Name()))
+		if err != nil {
+			continue
+		}
+
+		pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+		if err != nil {
+			continue
+		}
+
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			continue
+		}
+
+		if proc.Signal(syscall.Signal(0)) != nil {
+			continue
+		}
+
+		return pid, true
+	}
+
+	return 0, false
+}
+
+func sessionParentPID(display string) (int, bool) {
+	if display == "" {
+		return 0, false
+	}
+
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return 0, false
+	}
+
+	for _, entry := range entries {
+		name := entry.Name()
+		if !strings.HasPrefix(name, "danklinux-") || !strings.HasSuffix(name, ".session") {
+			continue
+		}
+
+		data, err := os.ReadFile(filepath.Join(dir, name))
+		if err != nil || strings.TrimSpace(string(data)) != display {
+			continue
+		}
+
+		parentStr := strings.TrimSuffix(strings.TrimPrefix(name, "danklinux-"), ".session")
+		parentPID, err := strconv.Atoi(parentStr)
+		if err != nil {
+			continue
+		}
+
+		return parentPID, true
+	}
+
+	return 0, false
+}
+
+func getSessionDMSPID() (int, bool) {
+	parentPID, ok := sessionParentPID(os.Getenv("WAYLAND_DISPLAY"))
+	if !ok {
+		return getFirstDMSPID()
+	}
+
+	data, err := os.ReadFile(filepath.Join(getRuntimeDir(), fmt.Sprintf("danklinux-%d.pid", parentPID)))
+	if err != nil {
+		return getFirstDMSPID()
+	}
+
+	pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+	if err != nil {
+		return getFirstDMSPID()
+	}
+
+	proc, err := os.FindProcess(pid)
+	if err != nil || proc.Signal(syscall.Signal(0)) != nil {
+		return getFirstDMSPID()
+	}
+
+	return pid, true
+}
+
 func runShellIPCCommand(args []string) {
 	if len(args) == 0 {
 		printIPCHelp()
@@ -280,12 +931,36 @@ func rebuildFontCache() {
 	}
 }
 
+type stderrTracker struct {
+	mu     sync.Mutex
+	buf    strings.Builder
+	parent io.Writer
+}
+
+func (s *stderrTracker) Write(p []byte) (n int, err error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.buf.Len() < 8192 {
+		s.buf.Write(p)
+	}
+	if s.parent != nil {
+		return s.parent.Write(p)
+	}
+	return len(p), nil
+}
+
+func (s *stderrTracker) String() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.buf.String()
+}
+
 // logStartupFailure logs diagnostic advice if qs crashes within 5s of launch.
-func logStartupFailure(exitCode int, uptime time.Duration, stderrTail string) {
-	if uptime >= 5*time.Second || exitCode == 0 || exitCode > 128 {
+func logStartupFailure(startTime time.Time, exitCode int, tracker *stderrTracker) {
+	if time.Since(startTime) >= 5*time.Second || exitCode == 0 || exitCode > 128 {
 		return
 	}
-	if containsFontCrashSignature(stderrTail) {
+	if containsFontCrashSignature(tracker.String()) {
 		log.Errorf("DMS startup failed due to a potential font/rendering crash. Try running 'fc-cache -fv' and restarting DMS.")
 	} else {
 		log.Errorf("DMS startup failed (exit code %d). Run 'dms doctor' for more diagnostics.", exitCode)

core/cmd/dms/shellapp.go

@@ -1,82 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/server"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/shellembed"
-	"github.com/AvengeMedia/dankgo/shellapp"
-)
-
-var shellApp = shellapp.New(shellapp.Config{
-	ID:        "danklinux",
-	EnvPrefix: "DMS",
-	QSAppID:   "com.danklinux.dms",
-	Version:   Version,
-	Embedded:  embeddedShell{},
-	Boot:      bootBackend,
-	PreLaunch: preLaunch,
-	ExtraEnv:  dmsExtraEnv,
-	OnUIExit:  logStartupFailure,
-})
-
-type embeddedShell struct{}
-
-func (embeddedShell) Available() bool { return shellembed.Available() }
-
-func (embeddedShell) Extract(baseDir string) (string, error) { return shellembed.Extract(baseDir) }
-
-func (embeddedShell) Prune(baseDir, keep string) { shellembed.Prune(baseDir, keep) }
-
-type dmsBackend struct {
-	srv  *server.Server
-	done chan error
-}
-
-func (b *dmsBackend) SocketPath() string { return b.srv.SocketPath() }
-
-func (b *dmsBackend) Close() { b.srv.Close() }
-
-func (b *dmsBackend) Done() <-chan error { return b.done }
-
-func bootBackend(ctx context.Context) (shellapp.Backend, error) {
-	config.CleanupStrayHyprlandConfFile(log.Infof)
-	server.CLIVersion = Version
-
-	srv := server.New()
-	if err := srv.Listen(); err != nil {
-		return nil, err
-	}
-
-	backend := &dmsBackend{srv: srv, done: make(chan error, 1)}
-	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				backend.done <- fmt.Errorf("server panic: %v", r)
-			}
-		}()
-		backend.done <- srv.Serve(false)
-	}()
-
-	return backend, nil
-}
-
-func preLaunch() {
-	go printASCII()
-	ensureFontCache()
-}
-
-func dmsExtraEnv(string) []string {
-	var env []string
-	if selfPath, err := os.Executable(); err == nil {
-		env = append(env, "DMS_EXECUTABLE="+selfPath)
-	}
-	if os.Getenv("QSG_USE_SIMPLE_ANIMATION_DRIVER") == "" {
-		env = append(env, "QSG_USE_SIMPLE_ANIMATION_DRIVER=1")
-	}
-	return env
-}

core/cmd/dms/utils.go

@@ -1,7 +1,9 @@
 package main
 
 import (
+	"fmt"
 	"os/exec"
+	"slices"
 	"strings"
 )
 
@@ -26,3 +28,62 @@ func isArchPackageInstalled(packageName string) bool {
 	err := cmd.Run()
 	return err == nil
 }
+
+type systemdServiceState struct {
+	Name         string
+	EnabledState string
+	NeedsDisable bool
+	Exists       bool
+}
+
+// checkSystemdServiceEnabled returns (state, should_disable, error) for a systemd service
+func checkSystemdServiceEnabled(serviceName string) (string, bool, error) {
+	cmd := exec.Command("systemctl", "is-enabled", serviceName)
+	output, err := cmd.Output()
+
+	stateStr := strings.TrimSpace(string(output))
+
+	if err != nil {
+		knownStates := []string{"disabled", "masked", "masked-runtime", "not-found", "enabled", "enabled-runtime", "static", "indirect", "alias"}
+		isKnownState := slices.Contains(knownStates, stateStr)
+
+		if !isKnownState {
+			return stateStr, false, fmt.Errorf("systemctl is-enabled failed: %w (output: %s)", err, stateStr)
+		}
+	}
+
+	shouldDisable := false
+	switch stateStr {
+	case "enabled", "enabled-runtime", "static", "indirect", "alias":
+		shouldDisable = true
+	case "disabled", "masked", "masked-runtime", "not-found":
+		shouldDisable = false
+	default:
+		shouldDisable = true
+	}
+
+	return stateStr, shouldDisable, nil
+}
+
+func getSystemdServiceState(serviceName string) (*systemdServiceState, error) {
+	state := &systemdServiceState{
+		Name:   serviceName,
+		Exists: false,
+	}
+
+	enabledState, needsDisable, err := checkSystemdServiceEnabled(serviceName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to check enabled state: %w", err)
+	}
+
+	state.EnabledState = enabledState
+	state.NeedsDisable = needsDisable
+
+	if enabledState == "not-found" {
+		state.Exists = false
+		return state, nil
+	}
+
+	state.Exists = true
+	return state, nil
+}

core/go.mod

@@ -1,13 +1,14 @@
 module github.com/AvengeMedia/DankMaterialShell/core
 
-go 1.26.4
+go 1.26.1
 
 require (
 	github.com/Wifx/gonetworkmanager/v2 v2.2.0
-	github.com/alecthomas/chroma/v2 v2.27.0
+	github.com/alecthomas/chroma/v2 v2.24.1
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/charmbracelet/log v1.0.0
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/godbus/dbus/v5 v5.2.2
 	github.com/holoplot/go-evdev v0.0.0-20260504100651-66d1748fe847
@@ -17,12 +18,12 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/yeqown/go-qrcode/v2 v2.2.5
 	github.com/yeqown/go-qrcode/writer/standard v1.3.0
-	github.com/yuin/goldmark v1.8.4
+	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	go.etcd.io/bbolt v1.5.0
+	go.etcd.io/bbolt v1.4.3
 	go4.org/mem v0.0.0-20240501181205-ae6ca9944745
-	golang.org/x/image v0.44.0
-	tailscale.com v1.100.0
+	golang.org/x/image v0.39.0
+	tailscale.com v1.96.5
 )
 
 require (
@@ -30,28 +31,28 @@ require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/akutz/memconn v0.1.0 // indirect
-	github.com/charmbracelet/log v1.0.0 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
-	github.com/cloudflare/circl v1.6.4 // indirect
-	github.com/coder/websocket v1.8.15 // indirect
-	github.com/dblohm7/wingoes v0.0.0-20260526185140-fb298caac7ca // indirect
-	github.com/dlclark/regexp2/v2 v2.5.1 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/coder/websocket v1.8.14 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/dblohm7/wingoes v0.0.0-20250822163801-6d8e6105c62d // indirect
+	github.com/dlclark/regexp2 v1.12.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/fogleman/gg v1.3.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/go-git/gcfg/v2 v2.0.2 // indirect
-	github.com/go-git/go-billy/v6 v6.0.0-alpha.1 // indirect
-	github.com/go-json-experiment/json v0.0.0-20260623181947-01eb4420fa68 // indirect
+	github.com/go-git/go-billy/v6 v6.0.0-20260504142752-cb8e9d337266 // indirect
+	github.com/go-json-experiment/json v0.0.0-20260430182902-b6187a392ed4 // indirect
 	github.com/go-logfmt/logfmt v0.6.1 // indirect
 	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
 	github.com/jsimonetti/rtnetlink v1.4.2 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
-	github.com/mdlayher/netlink v1.11.2 // indirect
-	github.com/mdlayher/socket v0.6.1 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/mdlayher/netlink v1.11.1 // indirect
+	github.com/mdlayher/socket v0.6.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
@@ -61,15 +62,14 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yeqown/reedsolomon v1.0.0 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
-	golang.org/x/crypto v0.54.0 // indirect
-	golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 	golang.zx2c4.com/wireguard/windows v1.0.1 // indirect
 )
 
 require (
-	github.com/AvengeMedia/dankgo v0.0.0-20260721162324-38d48943054d
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
@@ -79,22 +79,22 @@ require (
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/go-git/go-git/v6 v6.0.0-alpha.4
+	github.com/go-git/go-git/v6 v6.0.0-alpha.2
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0
-	github.com/mattn/go-isatty v0.0.23
+	github.com/mattn/go-isatty v0.0.22
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.24 // indirect
+	github.com/mattn/go-runewidth v0.0.23 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/muesli/termenv v0.16.0
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/sys v0.47.0
-	golang.org/x/text v0.40.0
+	golang.org/x/sys v0.43.0
+	golang.org/x/text v0.36.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 

core/go.sum

@@ -1,7 +1,5 @@
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-github.com/AvengeMedia/dankgo v0.0.0-20260721162324-38d48943054d h1:EZN2x2uAX975Uvw4MByqWaaVTp2fOJrNTl4V4EQbSn8=
-github.com/AvengeMedia/dankgo v0.0.0-20260721162324-38d48943054d/go.mod h1:7p7cfydr4WM1G6eOPFlANXF3IV5du3FoA4CbDPprHAo=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
@@ -13,8 +11,8 @@ github.com/akutz/memconn v0.1.0/go.mod h1:Jo8rI7m0NieZyLI5e2CDlRdRqRRB4S7Xp77ukD
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.2.0/go.mod h1:vf4zrexSH54oEjJ7EdB65tGNHmH3pGZmVkgTP5RHvAs=
-github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
-github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
+github.com/alecthomas/chroma/v2 v2.24.1 h1:m5ffpfZbIb++k8AqFEKy9uVgY12xIQtBsQlc6DfZJQM=
+github.com/alecthomas/chroma/v2 v2.24.1/go.mod h1:l+ohZ9xRXIbGe7cIW+YZgOGbvuVLjMps/FYN/CwuabI=
 github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
@@ -50,23 +48,25 @@ github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSE
 github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/cloudflare/circl v1.6.4 h1:pOXuDTCEYyzydgUpQ0CQz3LsinKjiSk6nNP5Lt5K64U=
-github.com/cloudflare/circl v1.6.4/go.mod h1:YxarevkLlbaHuWsxG6vmYNWBEsSp4pnp7j+4VljMavY=
-github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA=
-github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=
+github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creachadair/taskgroup v0.13.2 h1:3KyqakBuFsm3KkXi/9XIb0QcA8tEzLHLgaoidf0MdVc=
 github.com/creachadair/taskgroup v0.13.2/go.mod h1:i3V1Zx7H8RjwljUEeUWYT30Lmb9poewSb2XI1yTwD0g=
+github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
+github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dblohm7/wingoes v0.0.0-20260526185140-fb298caac7ca h1:h1Awca4lQOspNR/2eeo04Ricn5NixDX9mb17WSAgLhQ=
-github.com/dblohm7/wingoes v0.0.0-20260526185140-fb298caac7ca/go.mod h1:2TGl1jRJrRpbzykmg7asHm3h08TqutUgQqY5v9k/g3c=
+github.com/dblohm7/wingoes v0.0.0-20250822163801-6d8e6105c62d h1:QRKpU+9ZBDs62LyBfwhZkJdB5DJX2Sm3p4kUh7l1aA0=
+github.com/dblohm7/wingoes v0.0.0-20250822163801-6d8e6105c62d/go.mod h1:SUxUaAK/0UG5lYyZR1L1nC4AaYYvSSYTWQSH3FPcxKU=
 github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2/v2 v2.5.1 h1:E5Ug7Dh264W1ymdySmiHNcDG7fmsR307APCE5R07a20=
-github.com/dlclark/regexp2/v2 v2.5.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
+github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
+github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
@@ -85,14 +85,14 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo=
 github.com/go-git/gcfg/v2 v2.0.2/go.mod h1:/lv2NsxvhepuMrldsFilrgct6pxzpGdSRC13ydTLSLs=
-github.com/go-git/go-billy/v6 v6.0.0-alpha.1 h1:xVjAR4oUvrKy7/Xuw/lLlV3gkxR3KO2H8W+MamuVVsQ=
-github.com/go-git/go-billy/v6 v6.0.0-alpha.1/go.mod h1:eaCUpHbedW7//EwcYmUDfJe2N6sJC9O12AT0OTqJR1E=
-github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1 h1:gmqi2jvsreu0s8JMLylYDFq4sbjHwwlhktMw0DUg3mA=
-github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1/go.mod h1:ECf1MqJlBdYpKggBrOXjo/0EnvRZx6D++I86UYjPgAQ=
-github.com/go-git/go-git/v6 v6.0.0-alpha.4 h1:aDTc2UGanmaE7FkGLSlBEB9nohMnQ+RKXcfq/D+esDQ=
-github.com/go-git/go-git/v6 v6.0.0-alpha.4/go.mod h1:4ODa/G7hPWrh4Y+7lmt59Ij3zW38IEfvRoAZxLYYBhc=
-github.com/go-json-experiment/json v0.0.0-20260623181947-01eb4420fa68 h1:KZaTBSyshWX3MP5jukJcNSuXDQTO+rNpt0J564dX/eg=
-github.com/go-json-experiment/json v0.0.0-20260623181947-01eb4420fa68/go.mod h1:tphK2c80bpPhMOI4v6bIc2xWywPfbqi1Z06+RcrMkDg=
+github.com/go-git/go-billy/v6 v6.0.0-20260504142752-cb8e9d337266 h1:wH21vHuv323v9x78JNFNJ6P7HEAsdwr9yq2k9/o4zEE=
+github.com/go-git/go-billy/v6 v6.0.0-20260504142752-cb8e9d337266/go.mod h1:CdBVp7CXl9l3sOyNEog46cP1Pvx/hjCe9AD0mtaIUYU=
+github.com/go-git/go-git-fixtures/v6 v6.0.0-20260405195209-b16dd39735e0 h1:XoTsdvaghuVfIr7HpNTmFDLu2nz3I2iGqyn6Uk6MkJc=
+github.com/go-git/go-git-fixtures/v6 v6.0.0-20260405195209-b16dd39735e0/go.mod h1:1Lr7/vYEYyl6Ir9Ku0tKrCIRreM5zovv0Jdx2MPSM4s=
+github.com/go-git/go-git/v6 v6.0.0-alpha.2 h1:T3loNtDuAixNzXtlQxZhnYiYpaQ3CA4vn9RssAniEeI=
+github.com/go-git/go-git/v6 v6.0.0-alpha.2/go.mod h1:oCD3i19CTz7gBpeb11ZZqL91WzqbMq9avn5KpUYy/Ak=
+github.com/go-json-experiment/json v0.0.0-20260430182902-b6187a392ed4 h1:2WmHkJINIjgXXYDGik8d3oJvFA3DAwPy00csDJ3vo+o=
+github.com/go-json-experiment/json v0.0.0-20260430182902-b6187a392ed4/go.mod h1:tphK2c80bpPhMOI4v6bIc2xWywPfbqi1Z06+RcrMkDg=
 github.com/go-logfmt/logfmt v0.6.1 h1:4hvbpePJKnIzH1B+8OR/JPbTx37NktoI9LE2QZBBkvE=
 github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/z6CO0XAk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
@@ -117,8 +117,8 @@ github.com/jsimonetti/rtnetlink v1.4.2 h1:Df9w9TZ3npHTyDn0Ev9e1uzmN2odmXd0QX+J5G
 github.com/jsimonetti/rtnetlink v1.4.2/go.mod h1:92s6LJdE+1iOrw+F2/RO7LYI2Qd8pPpFNNUYW06gcoM=
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
-github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
-github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -128,16 +128,16 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
 github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/mattn/go-isatty v0.0.23 h1:cYwCQTQf3HB6xUC+BtyCLZNr7IzbOmoZbmssVNzSyiQ=
-github.com/mattn/go-isatty v0.0.23/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75 h1:P8UmIzZMYDR+NGImiFvErt6VWfIRPuGM+vyjiEdkmIw=
 github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
-github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
-github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mdlayher/netlink v1.11.2 h1:HKh2jqe+omdSWcQ88nrT7INE61B0NXfiSPFdgL4YbNI=
-github.com/mdlayher/netlink v1.11.2/go.mod h1:uT2Yc/QLaZubzDpZIBi9d4GoeLwtp3x1AMeqSRrK2sA=
-github.com/mdlayher/socket v0.6.1 h1:M7uj2NtuujUY4mYr1C57NmfNiRHbkKpnBxO856lsc3A=
-github.com/mdlayher/socket v0.6.1/go.mod h1:+/SGtqc9V+5dAuRgQsU0fGBI+oRDiW7O2Obx10OIWfg=
+github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
+github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mdlayher/netlink v1.11.1 h1:T136gDS6Gkt+hLncaBwKdW5GpEC8Z0ykqimOebVoal0=
+github.com/mdlayher/netlink v1.11.1/go.mod h1:ao4LjamyK4Uq9L8+fQzqFYpAncbeCdwbvd9Edv/pYnc=
+github.com/mdlayher/socket v0.6.0 h1:ScZPaAGyO1icQnbFrhPM8mnXyMu9qukC1K4ZoM2IQKU=
+github.com/mdlayher/socket v0.6.0/go.mod h1:q7vozUAnxSqnjHc12Fik5yUKIzfZ8ITCfMkhOtE9z18=
 github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
 github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
@@ -180,8 +180,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 h1:Gzfnfk2TWrk8Jj4P4c1a3CtQyMaTVCznlkLZI++hok4=
 github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55/go.mod h1:4k4QO+dQ3R5FofL+SanAUZe+/QfeK0+OIuwDIRu2vSg=
-github.com/tailscale/wireguard-go v0.0.0-20260527010701-b48af7099cad h1:Ky26FR5yZ5IKEB0xtm5A8xSTb06ImY7kxBFrvgOmJSg=
-github.com/tailscale/wireguard-go v0.0.0-20260527010701-b48af7099cad/go.mod h1:6SerzcvHWQchKO2BfNdmquA77CHSECZuFl+D9fp4RnI=
+github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da h1:jVRUZPRs9sqyKlYHHzHjAqKN+6e/Vog6NpHYeNPJqOw=
+github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da/go.mod h1:BOm5fXUBFM+m9woLNBoxI9TaBXXhGNP50LX/TGIvGb4=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
@@ -193,36 +193,36 @@ github.com/yeqown/go-qrcode/writer/standard v1.3.0/go.mod h1:O4MbzsotGCvy8upYPCR
 github.com/yeqown/reedsolomon v1.0.0 h1:x1h/Ej/uJnNu8jaX7GLHBWmZKCAWjEJTetkqaabr4B0=
 github.com/yeqown/reedsolomon v1.0.0/go.mod h1:P76zpcn2TCuL0ul1Fso373qHRc69LKwAw/Iy6g1WiiM=
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.8.4 h1:oat/nd3U6NeQqFEL3xpEJq7d7c86NI+DbSNGAs4xnjA=
-github.com/yuin/goldmark v1.8.4/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark v1.8.2 h1:kEGpgqJXdgbkhcOgBxkC0X0PmoPG1ZyoZ117rDVp4zE=
+github.com/yuin/goldmark v1.8.2/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
-go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
-go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
+go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
+go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go4.org/mem v0.0.0-20240501181205-ae6ca9944745 h1:Tl++JLUCe4sxGu8cTpDzRLd3tN7US4hOxG5YpKCzkek=
 go4.org/mem v0.0.0-20240501181205-ae6ca9944745/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
-golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597 h1:qLvzZeaANDgyVOA8pyHCOStGlXn0rseXma+GQjeuv2g=
-golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
-golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
-golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
+golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
 golang.zx2c4.com/wireguard/windows v1.0.1 h1:eOxiDVbywPC+ZQqvdCK7x+ZwWXKbYv50TtH8ysFIbw8=
@@ -235,5 +235,5 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-tailscale.com v1.100.0 h1:nm/M/dEaW9RaRsGUjW2HsSDpsZ60Jwd9k4gNW9tTFiE=
-tailscale.com v1.100.0/go.mod h1:DQ9YBy85DpNlSyeU2XRIWzbAu3RsGp/frv+Khg57meE=
+tailscale.com v1.96.5 h1:gNkfA/KSZAl6jCH9cj8urq00HRWItDDTtGsyATI89jA=
+tailscale.com v1.96.5/go.mod h1:/3lnZBYb2UEwnN0MNu2SDXUtT06AGd5k0s+OWx3WmcY=

core/internal/config/deployer.go

@@ -61,10 +61,6 @@ func (cd *ConfigDeployer) DeployConfigurationsSelectiveWithReinstalls(ctx contex
 	return cd.deployConfigurationsInternal(ctx, wm, terminal, installedDeps, replaceConfigs, reinstallItems, true)
 }
 
-func (cd *ConfigDeployer) DeployConfigurationsSelectiveWithReinstallsAndSystemd(ctx context.Context, wm deps.WindowManager, terminal deps.Terminal, installedDeps []deps.Dependency, replaceConfigs map[string]bool, reinstallItems map[string]bool, useSystemd bool) ([]DeploymentResult, error) {
-	return cd.deployConfigurationsInternal(ctx, wm, terminal, installedDeps, replaceConfigs, reinstallItems, useSystemd)
-}
-
 func (cd *ConfigDeployer) deployConfigurationsInternal(ctx context.Context, wm deps.WindowManager, terminal deps.Terminal, installedDeps []deps.Dependency, replaceConfigs map[string]bool, reinstallItems map[string]bool, useSystemd bool) ([]DeploymentResult, error) {
 	var results []DeploymentResult
 

core/internal/config/embedded/ghostty.conf

@@ -20,8 +20,8 @@ mouse-hide-while-typing = true
 copy-on-select = false
 confirm-close-surface = false
 
-# Disable in-app Ghostty toast notifications
-app-notifications = false
+# Disable annoying copied to clipboard
+app-notifications = no-clipboard-copy,no-config-reload
 
 # Key bindings for common actions
 #keybind = ctrl+c=copy_to_clipboard

core/internal/config/embedded/hypr-binds.lua

@@ -9,7 +9,7 @@ hl.bind("SUPER + M", hl.dsp.exec_cmd("dms ipc call processlist focusOrToggle"))
 hl.bind("SUPER + comma", hl.dsp.exec_cmd("dms ipc call settings focusOrToggle"))
 hl.bind("SUPER + N", hl.dsp.exec_cmd("dms ipc call notifications toggle"))
 hl.bind("SUPER + SHIFT + N", hl.dsp.exec_cmd("dms ipc call notepad toggle"))
-hl.bind("SUPER + Y", hl.dsp.exec_cmd("dms ipc call dash toggle wallpaper"))
+hl.bind("SUPER + Y", hl.dsp.exec_cmd("dms ipc call dankdash wallpaper"))
 hl.bind("SUPER + TAB", hl.dsp.exec_cmd("dms ipc call hypr toggleOverview"))
 hl.bind("SUPER + O", hl.dsp.exec_cmd("dms ipc call hypr toggleOverview"))
 hl.bind("SUPER + X", hl.dsp.exec_cmd("dms ipc call powermenu toggle"))

core/internal/config/embedded/hyprland.lua

@@ -11,8 +11,7 @@ end)
 
 hl.config({
 	input = {
-		-- empty inherits XKB_DEFAULT_LAYOUT (libxkbcommon), falls back to "us"
-		kb_layout = "",
+		kb_layout = "us",
 		numlock_by_default = true,
 		follow_mouse = 0,
 		touchpad = {

core/internal/config/embedded/mango-binds.conf

@@ -22,7 +22,7 @@ bind=SUPER,n,spawn,dms ipc call notifications toggle
 # Notepad
 bind=SUPER+SHIFT,n,spawn,dms ipc call notepad toggle
 # Browse Wallpapers
-bind=SUPER,y,spawn,dms ipc call dash toggle wallpaper
+bind=SUPER,y,spawn,dms ipc call dankdash wallpaper
 # Power Menu
 bind=SUPER,x,spawn,dms ipc call powermenu toggle
 # Cycle Display Profile

core/internal/config/embedded/niri-binds.kdl

@@ -24,7 +24,7 @@ binds {
         spawn "dms" "ipc" "call" "settings" "focusOrToggle";
     }
     Mod+Y hotkey-overlay-title="Browse Wallpapers" {
-        spawn "dms" "ipc" "call" "dash" "toggle" "wallpaper";
+        spawn "dms" "ipc" "call" "dankdash" "wallpaper";
     }
     Mod+N hotkey-overlay-title="Notification Center" { spawn "dms" "ipc" "call" "notifications" "toggle"; }
     Mod+Shift+N hotkey-overlay-title="Notepad" { spawn "dms" "ipc" "call" "notepad" "toggle"; }
@@ -51,24 +51,24 @@ binds {
     XF86AudioMicMute allow-when-locked=true {
         spawn "dms" "ipc" "call" "audio" "micmute";
     }
-    XF86AudioPause allow-when-locked=true {
-        spawn "dms" "ipc" "call" "mpris" "playPause";
-    }
-    XF86AudioPlay allow-when-locked=true {
-        spawn "dms" "ipc" "call" "mpris" "playPause";
-    }
-    XF86AudioPrev allow-when-locked=true {
-        spawn "dms" "ipc" "call" "mpris" "previous";
-    }
-    XF86AudioNext allow-when-locked=true {
-        spawn "dms" "ipc" "call" "mpris" "next";
-    }
-    Ctrl+XF86AudioRaiseVolume allow-when-locked=true {
-        spawn "dms" "ipc" "call" "mpris" "increment" "3";
-    }
-    Ctrl+XF86AudioLowerVolume allow-when-locked=true {
-        spawn "dms" "ipc" "call" "mpris" "decrement" "3";
-    }
+		XF86AudioPause allow-when-locked=true {
+		    spawn "dms" "ipc" "call" "mpris" "playPause";
+		}
+		XF86AudioPlay allow-when-locked=true {
+		    spawn "dms" "ipc" "call" "mpris" "playPause";
+		}
+		XF86AudioPrev allow-when-locked=true {
+		    spawn "dms" "ipc" "call" "mpris" "previous";
+		}
+		XF86AudioNext allow-when-locked=true {
+		    spawn "dms" "ipc" "call" "mpris" "next";
+		}
+        Ctrl+XF86AudioRaiseVolume allow-when-locked=true {
+            spawn "dms" "ipc" "call" "mpris" "increment" "3";
+        }
+        Ctrl+XF86AudioLowerVolume allow-when-locked=true {
+            spawn "dms" "ipc" "call" "mpris" "decrement" "3";
+        }
 
     // === Brightness Controls ===
     XF86MonBrightnessUp allow-when-locked=true {

core/internal/config/embedded/niri-greeter.kdl

@@ -0,0 +1,17 @@
+hotkey-overlay {
+    skip-at-startup
+}
+
+environment {
+    DMS_RUN_GREETER "1"
+}
+
+gestures {
+    hot-corners {
+        off
+    }
+}
+
+layout {
+    background-color "#000000"
+}

core/internal/config/embedded/niri-layout.kdl

@@ -20,10 +20,3 @@ window-rule {
     tiled-state true
     draw-border-with-background false
 }
-
-layer-rule {
-    exclude namespace="^dms:bar$"
-    background-effect {
-        xray false
-    }
-}

core/internal/config/embedded/niri.kdl

@@ -265,9 +265,9 @@ recent-windows {
 }
 
 // Include dms files
-include optional=true "dms/colors.kdl"
-include optional=true "dms/layout.kdl"
-include optional=true "dms/alttab.kdl"
-include optional=true "dms/binds.kdl"
-include optional=true "dms/outputs.kdl"
-include optional=true "dms/cursor.kdl"
+include "dms/colors.kdl"
+include "dms/layout.kdl"
+include "dms/alttab.kdl"
+include "dms/binds.kdl"
+include "dms/outputs.kdl"
+include "dms/cursor.kdl"

core/internal/config/niri.go

@@ -16,3 +16,6 @@ var NiriAlttabConfig string
 
 //go:embed embedded/niri-binds.kdl
 var NiriBindsConfig string
+
+//go:embed embedded/niri-greeter.kdl
+var NiriGreeterConfig string

core/internal/desktop/mimeapps.go

@@ -133,11 +133,6 @@ func mergedAssociations() *MimeAssociations {
 	return merged
 }
 
-// isSafeIniField rejects values that would corrupt a key=value line in mimeapps.list
-func isSafeIniField(s string) bool {
-	return !strings.ContainsAny(s, "\n\r[]")
-}
-
 func writeUserMimeapps(update func(*MimeAssociations)) error {
 	mimeappsWriteMu.Lock()
 	defer mimeappsWriteMu.Unlock()
@@ -157,7 +152,6 @@ func writeUserMimeapps(update func(*MimeAssociations)) error {
 	var buf bytes.Buffer
 	w := bufio.NewWriter(&buf)
 
-	var writeErr error
 	writeSection := func(name string, entries map[string]string) {
 		fmt.Fprintf(w, "[%s]\n", name)
 		keys := make([]string, 0, len(entries))
@@ -166,14 +160,7 @@ func writeUserMimeapps(update func(*MimeAssociations)) error {
 		}
 		sort.Strings(keys)
 		for _, k := range keys {
-			v := entries[k]
-			if !isSafeIniField(k) || !isSafeIniField(v) {
-				if writeErr == nil {
-					writeErr = fmt.Errorf("invalid mimeapps.list field %q=%q", k, v)
-				}
-				continue
-			}
-			fmt.Fprintf(w, "%s=%s\n", k, v)
+			fmt.Fprintf(w, "%s=%s\n", k, entries[k])
 		}
 		fmt.Fprintln(w)
 	}
@@ -190,10 +177,6 @@ func writeUserMimeapps(update func(*MimeAssociations)) error {
 	writeSection(groupAdded, flatten(assoc.Added))
 	writeSection(groupRemoved, flatten(assoc.Removed))
 
-	if writeErr != nil {
-		return writeErr
-	}
-
 	if err := w.Flush(); err != nil {
 		return err
 	}

core/internal/distros/arch.go

@@ -119,30 +119,10 @@ func (a *ArchDistribution) DetectDependenciesWithTerminal(ctx context.Context, w
 
 	dependencies = append(dependencies, a.detectMatugen())
 	dependencies = append(dependencies, a.detectDgop())
-	dependencies = append(dependencies, a.detectDanksearch())
-	dependencies = append(dependencies, a.detectDankCalendar())
 
 	return dependencies, nil
 }
 
-func (a *ArchDistribution) detectDanksearch() deps.Dependency {
-	dep := a.BaseDistribution.detectDanksearch()
-	dep.CanToggle = true
-	if a.packageInstalled("dsearch-git") {
-		dep.Variant = deps.VariantGit
-	}
-	return dep
-}
-
-func (a *ArchDistribution) detectDankCalendar() deps.Dependency {
-	dep := a.BaseDistribution.detectDankCalendar()
-	dep.CanToggle = true
-	if a.packageInstalled("dankcalendar-git") {
-		dep.Variant = deps.VariantGit
-	}
-	return dep
-}
-
 func (a *ArchDistribution) detectXDGPortal() deps.Dependency {
 	return a.detectPackage("xdg-desktop-portal-gtk", "Desktop integration portal for GTK", a.packageInstalled("xdg-desktop-portal-gtk"))
 }
@@ -152,13 +132,7 @@ func (a *ArchDistribution) detectAccountsService() deps.Dependency {
 }
 
 func (a *ArchDistribution) detectDMSGreeter() deps.Dependency {
-	installed := a.packageInstalled("greetd-dms-greeter-git") || a.packageInstalled("greetd-dms-greeter-bin")
-	dep := a.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", installed)
-	dep.CanToggle = true
-	if a.packageInstalled("greetd-dms-greeter-git") {
-		dep.Variant = deps.VariantGit
-	}
-	return dep
+	return a.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", a.packageInstalled("greetd-dms-greeter-git"))
 }
 
 func (a *ArchDistribution) packageInstalled(pkg string) bool {
@@ -217,7 +191,7 @@ func (a *ArchDistribution) GetPackageMappingWithVariants(wm deps.WindowManager,
 		"dms (DankMaterialShell)": a.getDMSMapping(variants["dms (DankMaterialShell)"]),
 		"git":                     {Name: "git", Repository: RepoTypeSystem},
 		"quickshell":              a.getQuickshellMapping(variants["quickshell"]),
-		"dms-greeter":             a.getDMSGreeterMapping(variants["dms-greeter"]),
+		"dms-greeter":             {Name: "greetd-dms-greeter-git", Repository: RepoTypeAUR},
 		"matugen":                 a.getMatugenMapping(variants["matugen"]),
 		"dgop":                    {Name: "dgop", Repository: RepoTypeSystem},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeSystem},
@@ -225,8 +199,6 @@ func (a *ArchDistribution) GetPackageMappingWithVariants(wm deps.WindowManager,
 		"alacritty":               {Name: "alacritty", Repository: RepoTypeSystem},
 		"xdg-desktop-portal-gtk":  {Name: "xdg-desktop-portal-gtk", Repository: RepoTypeSystem},
 		"accountsservice":         {Name: "accountsservice", Repository: RepoTypeSystem},
-		"danksearch":              a.getDanksearchMapping(variants["danksearch"]),
-		"dankcalendar":            a.getDankCalendarMapping(variants["dankcalendar"]),
 	}
 
 	switch wm {
@@ -281,27 +253,6 @@ func (a *ArchDistribution) getMatugenMapping(variant deps.PackageVariant) Packag
 	return PackageMapping{Name: "matugen", Repository: RepoTypeSystem}
 }
 
-func (a *ArchDistribution) getDanksearchMapping(variant deps.PackageVariant) PackageMapping {
-	if variant == deps.VariantGit {
-		return PackageMapping{Name: "dsearch-git", Repository: RepoTypeAUR}
-	}
-	return PackageMapping{Name: "dsearch-bin", Repository: RepoTypeAUR}
-}
-
-func (a *ArchDistribution) getDankCalendarMapping(variant deps.PackageVariant) PackageMapping {
-	if variant == deps.VariantGit {
-		return PackageMapping{Name: "dankcalendar-git", Repository: RepoTypeAUR}
-	}
-	return PackageMapping{Name: "dankcalendar-bin", Repository: RepoTypeAUR}
-}
-
-func (a *ArchDistribution) getDMSGreeterMapping(variant deps.PackageVariant) PackageMapping {
-	if variant == deps.VariantGit {
-		return PackageMapping{Name: "greetd-dms-greeter-git", Repository: RepoTypeAUR}
-	}
-	return PackageMapping{Name: "greetd-dms-greeter-bin", Repository: RepoTypeAUR}
-}
-
 func (a *ArchDistribution) getDMSMapping(variant deps.PackageVariant) PackageMapping {
 	if forceDMSGit || variant == deps.VariantGit {
 		return PackageMapping{Name: "dms-shell-git", Repository: RepoTypeAUR}

core/internal/distros/base.go

@@ -107,14 +107,6 @@ func (b *BaseDistribution) detectDgop() deps.Dependency {
 	return b.detectCommand("dgop", "Desktop portal management tool")
 }
 
-func (b *BaseDistribution) detectDanksearch() deps.Dependency {
-	return b.detectOptionalPackage("danksearch", "File indexing and search service", b.commandExists("dsearch") || b.commandExists("danksearch"))
-}
-
-func (b *BaseDistribution) detectDankCalendar() deps.Dependency {
-	return b.detectOptionalPackage("dankcalendar", "Calendar application", b.commandExists("dcal") || b.commandExists("dankcalendar"))
-}
-
 func (b *BaseDistribution) detectDMS() deps.Dependency {
 	dmsPath := filepath.Join(os.Getenv("HOME"), ".config/quickshell/dms")
 

core/internal/distros/debian.go

@@ -71,8 +71,6 @@ func (d *DebianDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 
 	dependencies = append(dependencies, d.detectMatugen())
 	dependencies = append(dependencies, d.detectDgop())
-	dependencies = append(dependencies, d.detectDanksearch())
-	dependencies = append(dependencies, d.detectDankCalendar())
 
 	return dependencies, nil
 }
@@ -137,8 +135,6 @@ func (d *DebianDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		"matugen":                 {Name: "matugen", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"dgop":                    {Name: "dgop", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
-		"danksearch":              {Name: "danksearch", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
-		"dankcalendar":            {Name: "dankcalendar-git", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 	}
 
 	if wm == deps.WindowManagerNiri {
@@ -161,60 +157,7 @@ func (d *DebianDistribution) getQuickshellMapping(variant deps.PackageVariant) P
 	if forceQuickshellGit || variant == deps.VariantGit {
 		return PackageMapping{Name: "quickshell-git", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"}
 	}
-	// Debian 13 ships stable quickshell in trixie-backports only.
-	if d.debianNeedsQuickshellBackports() {
-		return PackageMapping{Name: "quickshell/trixie-backports", Repository: RepoTypeSystem}
-	}
-	return PackageMapping{Name: "quickshell", Repository: RepoTypeSystem}
-}
-
-func (d *DebianDistribution) debianNeedsQuickshellBackports() bool {
-	osInfo, err := GetOSInfo()
-	if err != nil {
-		return false
-	}
-	return osInfo.VersionID == "13" || strings.EqualFold(osInfo.VersionCodename, "trixie")
-}
-
-func (d *DebianDistribution) ensureQuickshellBackports(ctx context.Context, systemPkgs []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
-	needsBackports := false
-	for _, pkg := range systemPkgs {
-		if strings.Contains(pkg, "trixie-backports") {
-			needsBackports = true
-			break
-		}
-	}
-	if !needsBackports {
-		return nil
-	}
-
-	policyOut, err := exec.CommandContext(ctx, "apt-cache", "policy").Output()
-	if err == nil && strings.Contains(string(policyOut), "trixie-backports") {
-		d.log("trixie-backports already configured")
-		return nil
-	}
-
-	listFile := "/etc/apt/sources.list.d/trixie-backports.list"
-	repoLine := "deb http://deb.debian.org/debian trixie-backports main contrib non-free non-free-firmware"
-
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.30,
-		Step:        "Enabling trixie-backports for quickshell...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("echo '%s' | sudo tee %s", repoLine, listFile),
-		LogOutput:   "Debian 13 ships quickshell in trixie-backports",
-	}
-
-	addCmd := privesc.ExecCommand(ctx, sudoPassword,
-		fmt.Sprintf("bash -c \"echo '%s' | tee %s\"", repoLine, listFile))
-	if err := d.runWithProgress(addCmd, progressChan, PhaseSystemPackages, 0.30, 0.31); err != nil {
-		return err
-	}
-
-	updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
-	return d.runWithProgress(updateCmd, progressChan, PhaseSystemPackages, 0.31, 0.33)
+	return PackageMapping{Name: "quickshell", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"}
 }
 
 func (d *DebianDistribution) getNiriMapping(variant deps.PackageVariant) PackageMapping {
@@ -319,10 +262,6 @@ func (d *DebianDistribution) InstallPackages(ctx context.Context, dependencies [
 		}
 	}
 
-	if err := d.ensureQuickshellBackports(ctx, systemPkgs, sudoPassword, progressChan); err != nil {
-		return fmt.Errorf("failed to enable trixie-backports for quickshell: %w", err)
-	}
-
 	// System Packages
 	if len(systemPkgs) > 0 {
 		progressChan <- InstallProgressMsg{

core/internal/distros/dsearch_service.go

@@ -1,34 +0,0 @@
-package distros
-
-import (
-	"context"
-	"fmt"
-	"os/exec"
-)
-
-// SetupDsearchService enables the dsearch.service user unit. Enablement failures
-// are returned for the caller to surface as a non-fatal warning.
-func SetupDsearchService(ctx context.Context, logf func(string)) error {
-	if logf == nil {
-		logf = func(string) {}
-	}
-
-	if err := runSystemctlUser(ctx, "daemon-reload"); err != nil {
-		return err
-	}
-
-	if err := runSystemctlUser(ctx, "enable", "--now", "dsearch.service"); err != nil {
-		return err
-	}
-	logf("Enabled dsearch.service")
-
-	return nil
-}
-
-func runSystemctlUser(ctx context.Context, args ...string) error {
-	cmd := exec.CommandContext(ctx, "systemctl", append([]string{"--user"}, args...)...)
-	if output, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("systemctl --user %v failed: %w: %s", args, err, string(output))
-	}
-	return nil
-}

core/internal/distros/fedora.go

@@ -104,8 +104,6 @@ func (f *FedoraDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 
 	dependencies = append(dependencies, f.detectMatugen())
 	dependencies = append(dependencies, f.detectDgop())
-	dependencies = append(dependencies, f.detectDanksearch())
-	dependencies = append(dependencies, f.detectDankCalendar())
 
 	return dependencies, nil
 }
@@ -140,8 +138,6 @@ func (f *FedoraDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		"matugen":                 {Name: "matugen", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 		"dms (DankMaterialShell)": f.getDmsMapping(variants["dms (DankMaterialShell)"]),
 		"dgop":                    {Name: "dgop", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
-		"danksearch":              {Name: "danksearch", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
-		"dankcalendar":            {Name: "dankcalendar-git", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 	}
 
 	switch wm {

core/internal/distros/gentoo.go

@@ -113,7 +113,6 @@ func (g *GentooDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 
 	dependencies = append(dependencies, g.detectMatugen())
 	dependencies = append(dependencies, g.detectDgop())
-	dependencies = append(dependencies, g.detectDanksearch())
 
 	return dependencies, nil
 }
@@ -172,7 +171,6 @@ func (g *GentooDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		"matugen":                 {Name: "x11-misc/matugen", Repository: RepoTypeGURU, AcceptKeywords: archKeyword},
 		"dms (DankMaterialShell)": g.getDmsMapping(),
 		"dgop":                    {Name: "gui-apps/dgop", Repository: RepoTypeGURU, AcceptKeywords: archKeyword},
-		"danksearch":              {Name: "gui-apps/danksearch", Repository: RepoTypeGURU, AcceptKeywords: archKeyword},
 	}
 
 	switch wm {

core/internal/distros/interface.go

@@ -17,7 +17,6 @@ const (
 	FamilyDebian DistroFamily = "debian"
 	FamilyNix    DistroFamily = "nix"
 	FamilyGentoo DistroFamily = "gentoo"
-	FamilyVoid   DistroFamily = "void"
 )
 
 // PackageManagerType defines the package manager a distro uses
@@ -30,7 +29,6 @@ const (
 	PackageManagerZypper  PackageManagerType = "zypper"
 	PackageManagerNix     PackageManagerType = "nix"
 	PackageManagerPortage PackageManagerType = "portage"
-	PackageManagerXBPS    PackageManagerType = "xbps"
 )
 
 // RepositoryType defines the type of repository for a package
@@ -44,7 +42,6 @@ const (
 	RepoTypeOBS    RepositoryType = "obs"    // OpenBuild Service (Debian/OpenSUSE)
 	RepoTypeFlake  RepositoryType = "flake"  // Nix flake
 	RepoTypeGURU   RepositoryType = "guru"   // Gentoo GURU
-	RepoTypeXBPS   RepositoryType = "xbps"   // Custom XBPS repository
 	RepoTypeManual RepositoryType = "manual" // Manual build from source
 )
 

core/internal/distros/manual_packages.go

@@ -520,7 +520,7 @@ func (m *ManualPackageInstaller) installDankMaterialShell(ctx context.Context, v
 			Progress:    0.90,
 			Step:        "Cloning DankMaterialShell...",
 			IsComplete:  false,
-			CommandInfo: "git clone --recurse-submodules https://github.com/AvengeMedia/DankMaterialShell.git",
+			CommandInfo: "git clone https://github.com/AvengeMedia/DankMaterialShell.git",
 		}
 
 		configDir := filepath.Dir(dmsPath)
@@ -528,7 +528,7 @@ func (m *ManualPackageInstaller) installDankMaterialShell(ctx context.Context, v
 			return fmt.Errorf("failed to create quickshell config directory: %w", err)
 		}
 
-		cloneCmd := exec.CommandContext(ctx, "git", "clone", "--recurse-submodules",
+		cloneCmd := exec.CommandContext(ctx, "git", "clone",
 			"https://github.com/AvengeMedia/DankMaterialShell.git", dmsPath)
 		if err := cloneCmd.Run(); err != nil {
 			return fmt.Errorf("failed to clone DankMaterialShell: %w", err)
@@ -553,8 +553,6 @@ func (m *ManualPackageInstaller) installDankMaterialShell(ctx context.Context, v
 			return nil
 		}
 
-		m.syncDMSSubmodules(ctx, dmsPath)
-
 		m.log(fmt.Sprintf("Checked out latest tag: %s", latestTag))
 		m.log("DankMaterialShell cloned successfully")
 		return nil
@@ -593,8 +591,6 @@ func (m *ManualPackageInstaller) installDankMaterialShell(ctx context.Context, v
 			return nil
 		}
 
-		m.syncDMSSubmodules(ctx, dmsPath)
-
 		m.log("DankMaterialShell updated successfully (git variant)")
 		return nil
 	}
@@ -613,19 +609,10 @@ func (m *ManualPackageInstaller) installDankMaterialShell(ctx context.Context, v
 		return nil
 	}
 
-	m.syncDMSSubmodules(ctx, dmsPath)
-
 	m.log(fmt.Sprintf("Updated to tag: %s", latestTag))
 	return nil
 }
 
-func (m *ManualPackageInstaller) syncDMSSubmodules(ctx context.Context, dmsPath string) {
-	submoduleCmd := exec.CommandContext(ctx, "git", "-C", dmsPath, "submodule", "update", "--init", "--recursive")
-	if err := submoduleCmd.Run(); err != nil {
-		m.logError("Failed to update submodules", err)
-	}
-}
-
 func (m *ManualPackageInstaller) installXwaylandSatellite(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	m.log("Installing xwayland-satellite from source...")
 

core/internal/distros/minimal_install.go

@@ -7,7 +7,7 @@ type minimalInstallGroup struct {
 
 func shouldPreferMinimalInstall(pkg string) bool {
 	switch pkg {
-	case "niri", "niri-git", "hyprland", "hyprland-git":
+	case "niri", "niri-git":
 		return true
 	default:
 		return false

core/internal/distros/opensuse.go

@@ -91,8 +91,6 @@ func (o *OpenSUSEDistribution) DetectDependenciesWithTerminal(ctx context.Contex
 
 	dependencies = append(dependencies, o.detectMatugen())
 	dependencies = append(dependencies, o.detectDgop())
-	dependencies = append(dependencies, o.detectDanksearch())
-	dependencies = append(dependencies, o.detectDankCalendar())
 
 	return dependencies, nil
 }
@@ -131,8 +129,6 @@ func (o *OpenSUSEDistribution) GetPackageMappingWithVariants(wm deps.WindowManag
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"dgop":                    {Name: "dgop", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
-		"danksearch":              {Name: "danksearch", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
-		"dankcalendar":            {Name: "dankcalendar-git", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 	}
 
 	switch wm {

core/internal/distros/ubuntu.go

@@ -80,8 +80,6 @@ func (u *UbuntuDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 
 	dependencies = append(dependencies, u.detectMatugen())
 	dependencies = append(dependencies, u.detectDgop())
-	dependencies = append(dependencies, u.detectDanksearch())
-	dependencies = append(dependencies, u.detectDankCalendar())
 
 	return dependencies, nil
 }
@@ -126,8 +124,6 @@ func (u *UbuntuDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		"matugen":                 {Name: "matugen", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"dgop":                    {Name: "dgop", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
-		"danksearch":              {Name: "danksearch", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
-		"dankcalendar":            {Name: "dankcalendar-git", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 	}
 
 	switch wm {

core/internal/distros/void.go

@@ -1,541 +0,0 @@
-package distros
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
-)
-
-const (
-	VoidDMSRepo       = "https://void.danklinux.com/dms/current"
-	VoidDankLinuxRepo = "https://void.danklinux.com/danklinux/current"
-	VoidHyprlandRepo  = "https://mirror.black-hole.dev/x86_64"
-
-	voidRunitSvDir      = "/etc/sv"
-	voidRunitServiceDir = "/var/service"
-)
-
-func init() {
-	Register("void", "#478061", FamilyVoid, func(config DistroConfig, logChan chan<- string) Distribution {
-		return NewVoidDistribution(config, logChan)
-	})
-}
-
-type VoidDistribution struct {
-	*BaseDistribution
-	config DistroConfig
-}
-
-func NewVoidDistribution(config DistroConfig, logChan chan<- string) *VoidDistribution {
-	return &VoidDistribution{
-		BaseDistribution: NewBaseDistribution(logChan),
-		config:           config,
-	}
-}
-
-func (v *VoidDistribution) GetID() string {
-	return v.config.ID
-}
-
-func (v *VoidDistribution) GetColorHex() string {
-	return v.config.ColorHex
-}
-
-func (v *VoidDistribution) GetFamily() DistroFamily {
-	return v.config.Family
-}
-
-func (v *VoidDistribution) GetPackageManager() PackageManagerType {
-	return PackageManagerXBPS
-}
-
-func (v *VoidDistribution) DetectDependencies(ctx context.Context, wm deps.WindowManager) ([]deps.Dependency, error) {
-	return v.DetectDependenciesWithTerminal(ctx, wm, deps.TerminalGhostty)
-}
-
-func (v *VoidDistribution) DetectDependenciesWithTerminal(ctx context.Context, wm deps.WindowManager, terminal deps.Terminal) ([]deps.Dependency, error) {
-	var dependencies []deps.Dependency
-
-	dependencies = append(dependencies, v.detectDMS())
-	dependencies = append(dependencies, v.detectSpecificTerminal(terminal))
-	dependencies = append(dependencies, v.detectGit())
-	dependencies = append(dependencies, v.detectWindowManager(wm))
-	dependencies = append(dependencies, v.detectQuickshell())
-	dependencies = append(dependencies, v.detectDMSGreeter())
-	dependencies = append(dependencies, v.detectXDGPortal())
-	dependencies = append(dependencies, v.detectAccountsService())
-	dependencies = append(dependencies, v.detectDBus())
-	dependencies = append(dependencies, v.detectElogind())
-	dependencies = append(dependencies, v.detectMesaDri())
-
-	if wm == deps.WindowManagerHyprland {
-		dependencies = append(dependencies, v.detectHyprlandTools()...)
-	}
-
-	if wm == deps.WindowManagerNiri || wm == deps.WindowManagerMango {
-		dependencies = append(dependencies, v.detectXwaylandSatellite())
-	}
-
-	dependencies = append(dependencies, v.detectMatugen())
-	dependencies = append(dependencies, v.detectDgop())
-	dependencies = append(dependencies, v.detectDanksearch())
-	dependencies = append(dependencies, v.detectDankCalendar())
-
-	return dependencies, nil
-}
-
-func (v *VoidDistribution) detectDMS() deps.Dependency {
-	status := deps.StatusMissing
-	version := ""
-	variant := deps.VariantStable
-
-	if v.packageInstalled("dms-git") {
-		status = deps.StatusInstalled
-		version = v.packageVersion("dms-git")
-		variant = deps.VariantGit
-	} else if v.packageInstalled("dms") {
-		status = deps.StatusInstalled
-		version = v.packageVersion("dms")
-	} else if v.commandExists("dms") {
-		status = deps.StatusInstalled
-	}
-
-	return deps.Dependency{
-		Name:        "dms (DankMaterialShell)",
-		Status:      status,
-		Version:     version,
-		Description: "Desktop Management System package",
-		Required:    true,
-		Variant:     variant,
-		CanToggle:   true,
-	}
-}
-
-func (v *VoidDistribution) detectQuickshell() deps.Dependency {
-	dep := v.BaseDistribution.detectQuickshell()
-	dep.CanToggle = false
-	return dep
-}
-
-func (v *VoidDistribution) detectXDGPortal() deps.Dependency {
-	return v.detectPackage("xdg-desktop-portal-gtk", "Desktop integration portal for GTK", v.packageInstalled("xdg-desktop-portal-gtk"))
-}
-
-func (v *VoidDistribution) detectDMSGreeter() deps.Dependency {
-	return v.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", v.packageInstalled("dms-greeter"))
-}
-
-func (v *VoidDistribution) detectAccountsService() deps.Dependency {
-	return v.detectPackage("accountsservice", "D-Bus interface for user account query and manipulation", v.packageInstalled("accountsservice"))
-}
-
-func (v *VoidDistribution) detectDBus() deps.Dependency {
-	return v.detectPackage("dbus", "D-Bus system and session message bus", v.packageInstalled("dbus"))
-}
-
-func (v *VoidDistribution) detectElogind() deps.Dependency {
-	return v.detectPackage("elogind", "loginctl/logind provider for power management and session tracking", v.packageInstalled("elogind") || v.commandExists("loginctl"))
-}
-
-func (v *VoidDistribution) detectMesaDri() deps.Dependency {
-	return v.detectPackage("mesa-dri", "Mesa DRI/EGL drivers (GPU rendering; compositors find no outputs without it)", v.packageInstalled("mesa-dri"))
-}
-
-func (v *VoidDistribution) detectXwaylandSatellite() deps.Dependency {
-	return v.detectPackage("xwayland-satellite", "Xwayland support", v.packageInstalled("xwayland-satellite"))
-}
-
-func (v *VoidDistribution) packageInstalled(pkg string) bool {
-	return exec.Command("xbps-query", pkg).Run() == nil
-}
-
-func (v *VoidDistribution) packageVersion(pkg string) string {
-	output, err := exec.Command("xbps-query", "-p", "pkgver", pkg).Output()
-	if err != nil {
-		return ""
-	}
-	return strings.TrimSpace(string(output))
-}
-
-func (v *VoidDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
-	return v.GetPackageMappingWithVariants(wm, make(map[string]deps.PackageVariant))
-}
-
-func (v *VoidDistribution) GetPackageMappingWithVariants(wm deps.WindowManager, variants map[string]deps.PackageVariant) map[string]PackageMapping {
-	packages := map[string]PackageMapping{
-		"git":                    {Name: "git", Repository: RepoTypeSystem},
-		"ghostty":                {Name: "ghostty", Repository: RepoTypeSystem},
-		"kitty":                  {Name: "kitty", Repository: RepoTypeSystem},
-		"alacritty":              {Name: "alacritty", Repository: RepoTypeSystem},
-		"xdg-desktop-portal-gtk": {Name: "xdg-desktop-portal-gtk", Repository: RepoTypeSystem},
-		"accountsservice":        {Name: "accountsservice", Repository: RepoTypeSystem},
-		"dbus":                   {Name: "dbus", Repository: RepoTypeSystem},
-		"elogind":                {Name: "elogind", Repository: RepoTypeSystem},
-		"mesa-dri":               {Name: "mesa-dri", Repository: RepoTypeSystem},
-
-		"quickshell":              {Name: "quickshell", Repository: RepoTypeSystem},
-		"matugen":                 {Name: "matugen", Repository: RepoTypeSystem},
-		"dms (DankMaterialShell)": v.getDmsMapping(variants["dms (DankMaterialShell)"]),
-		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeXBPS, RepoURL: VoidDMSRepo},
-		"dgop":                    {Name: "dgop", Repository: RepoTypeXBPS, RepoURL: VoidDankLinuxRepo},
-		"danksearch":              {Name: "danksearch", Repository: RepoTypeXBPS, RepoURL: VoidDankLinuxRepo},
-		"dankcalendar":            {Name: "dankcalendar", Repository: RepoTypeXBPS, RepoURL: VoidDankLinuxRepo},
-	}
-
-	switch wm {
-	case deps.WindowManagerHyprland:
-		packages["hyprland"] = PackageMapping{Name: "hyprland", Repository: RepoTypeXBPS, RepoURL: VoidHyprlandRepo}
-		packages["hyprctl"] = PackageMapping{Name: "hyprland", Repository: RepoTypeXBPS, RepoURL: VoidHyprlandRepo}
-		packages["jq"] = PackageMapping{Name: "jq", Repository: RepoTypeSystem}
-	case deps.WindowManagerNiri:
-		packages["niri"] = PackageMapping{Name: "niri", Repository: RepoTypeSystem}
-		packages["xwayland-satellite"] = PackageMapping{Name: "xwayland-satellite", Repository: RepoTypeSystem}
-	case deps.WindowManagerMango:
-		packages["mango"] = PackageMapping{Name: "mangowc", Repository: RepoTypeSystem}
-		packages["xwayland-satellite"] = PackageMapping{Name: "xwayland-satellite", Repository: RepoTypeSystem}
-	}
-
-	return packages
-}
-
-func (v *VoidDistribution) getDmsMapping(variant deps.PackageVariant) PackageMapping {
-	if variant == deps.VariantStable {
-		return PackageMapping{Name: "dms", Repository: RepoTypeXBPS, RepoURL: VoidDMSRepo}
-	}
-	return PackageMapping{Name: "dms-git", Repository: RepoTypeXBPS, RepoURL: VoidDMSRepo}
-}
-
-func (v *VoidDistribution) InstallPrerequisites(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
-	progressChan <- InstallProgressMsg{
-		Phase:      PhasePrerequisites,
-		Progress:   0.06,
-		Step:       "Checking XBPS...",
-		IsComplete: false,
-		LogOutput:  "Checking for xbps-install",
-	}
-
-	if _, err := exec.LookPath("xbps-install"); err != nil {
-		return fmt.Errorf("xbps-install not found; Void Linux package tools are required: %w", err)
-	}
-
-	return nil
-}
-
-func (v *VoidDistribution) InstallPackages(ctx context.Context, dependencies []deps.Dependency, wm deps.WindowManager, sudoPassword string, reinstallFlags map[string]bool, disabledFlags map[string]bool, skipGlobalUseFlags bool, progressChan chan<- InstallProgressMsg) error {
-	progressChan <- InstallProgressMsg{
-		Phase:      PhasePrerequisites,
-		Progress:   0.05,
-		Step:       "Checking system prerequisites...",
-		IsComplete: false,
-		LogOutput:  "Starting prerequisite check...",
-	}
-
-	if wm == deps.WindowManagerHyprland {
-		arch, err := v.xbpsArch(ctx)
-		if err != nil {
-			return fmt.Errorf("failed to detect XBPS architecture for Hyprland repository selection: %w", err)
-		}
-		if arch != "x86_64" {
-			return fmt.Errorf("hyprland on Void Linux is installed from %s, which currently provides x86_64 packages only (detected %s)", VoidHyprlandRepo, arch)
-		}
-	}
-
-	if err := v.InstallPrerequisites(ctx, sudoPassword, progressChan); err != nil {
-		return fmt.Errorf("failed to install prerequisites: %w", err)
-	}
-
-	systemPkgs, xbpsPkgs := v.categorizePackages(dependencies, wm, reinstallFlags, disabledFlags)
-
-	if len(xbpsPkgs) > 0 {
-		progressChan <- InstallProgressMsg{
-			Phase:      PhaseSystemPackages,
-			Progress:   0.15,
-			Step:       "Enabling DMS XBPS repositories...",
-			IsComplete: false,
-			NeedsSudo:  true,
-			LogOutput:  "Setting up custom XBPS repositories for DMS packages",
-		}
-		if err := v.enableXBPSRepos(ctx, xbpsPkgs, sudoPassword, progressChan); err != nil {
-			return fmt.Errorf("failed to enable XBPS repositories: %w", err)
-		}
-	}
-
-	allPkgs := v.uniquePackageNames(systemPkgs, v.extractPackageNames(xbpsPkgs))
-	if len(allPkgs) > 0 {
-		progressChan <- InstallProgressMsg{
-			Phase:      PhaseSystemPackages,
-			Progress:   0.35,
-			Step:       fmt.Sprintf("Installing %d XBPS packages...", len(allPkgs)),
-			IsComplete: false,
-			NeedsSudo:  true,
-			LogOutput:  fmt.Sprintf("Installing XBPS packages: %s", strings.Join(allPkgs, ", ")),
-		}
-		if err := v.installXBPSPackages(ctx, allPkgs, sudoPassword, progressChan); err != nil {
-			return fmt.Errorf("failed to install XBPS packages: %w", err)
-		}
-	}
-
-	progressChan <- InstallProgressMsg{
-		Phase:      PhaseConfiguration,
-		Progress:   0.90,
-		Step:       "Configuring system...",
-		IsComplete: false,
-		LogOutput:  "Starting post-installation configuration...",
-	}
-
-	v.log("Void Linux detected; DMS environment and autostart will be configured in the compositor config instead of systemd")
-	if err := v.ensureSessionServices(ctx, sudoPassword, progressChan); err != nil {
-		return fmt.Errorf("failed to enable Void session services: %w", err)
-	}
-
-	progressChan <- InstallProgressMsg{
-		Phase:      PhaseComplete,
-		Progress:   1.0,
-		Step:       "Installation complete!",
-		IsComplete: true,
-		LogOutput:  "All packages installed and configured successfully",
-	}
-
-	return nil
-}
-
-func (v *VoidDistribution) ensureSessionServices(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
-	if !v.isRunitSystem() {
-		v.log("Void runit service directory not detected; skipping dbus/elogind service enablement")
-		return nil
-	}
-
-	// D-Bus activation alone starts elogind without its wrapper mounts; the runit service is required.
-	for _, service := range []string{"dbus", "elogind"} {
-		if !v.runitServiceInstalled(service) {
-			v.log(fmt.Sprintf("Warning: %s runit service not found in %s; power/session actions may not work until %s is installed", service, voidRunitSvDir, service))
-			continue
-		}
-		if v.runitServiceEnabled(service) {
-			v.log(fmt.Sprintf("Void runit service %s already enabled", service))
-			continue
-		}
-
-		progressChan <- InstallProgressMsg{
-			Phase:       PhaseConfiguration,
-			Progress:    0.92,
-			Step:        fmt.Sprintf("Enabling %s runit service...", service),
-			IsComplete:  false,
-			NeedsSudo:   true,
-			CommandInfo: fmt.Sprintf("sudo ln -sf %s %s", filepath.Join(voidRunitSvDir, service), filepath.Join(voidRunitServiceDir, service)),
-			LogOutput:   fmt.Sprintf("Enabling Void runit service: %s", service),
-		}
-
-		cmd := privesc.ExecCommand(ctx, sudoPassword, fmt.Sprintf("ln -sf %s %s", filepath.Join(voidRunitSvDir, service), filepath.Join(voidRunitServiceDir, service)))
-		if err := v.runWithProgress(cmd, progressChan, PhaseConfiguration, 0.92, 0.95); err != nil {
-			return fmt.Errorf("failed to enable %s runit service: %w", service, err)
-		}
-		v.log(fmt.Sprintf("✓ Enabled %s runit service", service))
-	}
-
-	return nil
-}
-
-func (v *VoidDistribution) isRunitSystem() bool {
-	if fi, err := os.Stat("/run/runit"); err == nil && fi.IsDir() {
-		return true
-	}
-	if _, err := os.Stat("/run/systemd/system"); err == nil {
-		return false
-	}
-	if fi, err := os.Stat(voidRunitServiceDir); err == nil && fi.IsDir() {
-		return true
-	}
-	return false
-}
-
-func (v *VoidDistribution) runitServiceInstalled(name string) bool {
-	fi, err := os.Stat(filepath.Join(voidRunitSvDir, name))
-	return err == nil && fi.IsDir()
-}
-
-func (v *VoidDistribution) runitServiceEnabled(name string) bool {
-	_, err := os.Lstat(filepath.Join(voidRunitServiceDir, name))
-	return err == nil
-}
-
-func (v *VoidDistribution) categorizePackages(dependencies []deps.Dependency, wm deps.WindowManager, reinstallFlags map[string]bool, disabledFlags map[string]bool) ([]string, []PackageMapping) {
-	systemPkgs := []string{}
-	xbpsPkgs := []PackageMapping{}
-
-	variantMap := make(map[string]deps.PackageVariant)
-	for _, dep := range dependencies {
-		variantMap[dep.Name] = dep.Variant
-	}
-
-	packageMap := v.GetPackageMappingWithVariants(wm, variantMap)
-
-	for _, dep := range dependencies {
-		if disabledFlags[dep.Name] {
-			continue
-		}
-
-		if dep.Status == deps.StatusInstalled && !reinstallFlags[dep.Name] {
-			continue
-		}
-
-		pkgInfo, exists := packageMap[dep.Name]
-		if !exists {
-			v.log(fmt.Sprintf("Warning: No package mapping for %s", dep.Name))
-			continue
-		}
-
-		switch pkgInfo.Repository {
-		case RepoTypeXBPS:
-			xbpsPkgs = append(xbpsPkgs, pkgInfo)
-		case RepoTypeSystem:
-			systemPkgs = append(systemPkgs, pkgInfo.Name)
-		}
-	}
-
-	return systemPkgs, xbpsPkgs
-}
-
-func (v *VoidDistribution) enableXBPSRepos(ctx context.Context, xbpsPkgs []PackageMapping, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
-	enabledRepos := make(map[string]bool)
-	enabledRepoURLs := []string{}
-
-	for _, pkg := range xbpsPkgs {
-		if pkg.RepoURL == "" || enabledRepos[pkg.RepoURL] {
-			continue
-		}
-
-		repoName := v.xbpsRepoName(pkg.RepoURL)
-		confPath := filepath.Join("/etc/xbps.d", repoName+".conf")
-		repoLine := fmt.Sprintf("repository=%s", pkg.RepoURL)
-		repoFileContent := repoLine + "\n"
-
-		if content, err := os.ReadFile(confPath); err == nil && string(content) == repoFileContent {
-			v.log(fmt.Sprintf("XBPS repo %s already configured, skipping", pkg.RepoURL))
-			enabledRepos[pkg.RepoURL] = true
-			enabledRepoURLs = append(enabledRepoURLs, pkg.RepoURL)
-			continue
-		}
-
-		progressChan <- InstallProgressMsg{
-			Phase:       PhaseSystemPackages,
-			Progress:    0.18,
-			Step:        fmt.Sprintf("Adding XBPS repo %s...", repoName),
-			IsComplete:  false,
-			NeedsSudo:   true,
-			CommandInfo: fmt.Sprintf("echo 'repository=%s' | sudo tee %s", pkg.RepoURL, confPath),
-			LogOutput:   fmt.Sprintf("Adding XBPS repository: %s", pkg.RepoURL),
-		}
-
-		mkdirCmd := privesc.ExecCommand(ctx, sudoPassword, "mkdir -p /etc/xbps.d")
-		if err := v.runWithProgress(mkdirCmd, progressChan, PhaseSystemPackages, 0.18, 0.19); err != nil {
-			return fmt.Errorf("failed to create /etc/xbps.d: %w", err)
-		}
-
-		writeCmd := privesc.ExecCommand(ctx, sudoPassword,
-			fmt.Sprintf("bash -c 'printf \"%%s\\n\" %q > %s'", repoLine, confPath))
-		if err := v.runWithProgress(writeCmd, progressChan, PhaseSystemPackages, 0.19, 0.22); err != nil {
-			return fmt.Errorf("failed to add XBPS repo %s: %w", pkg.RepoURL, err)
-		}
-
-		enabledRepos[pkg.RepoURL] = true
-		enabledRepoURLs = append(enabledRepoURLs, pkg.RepoURL)
-	}
-
-	if len(enabledRepos) > 0 {
-		syncArgs := []string{"xbps-install", "-Sy", "-i"}
-		for _, repoURL := range enabledRepoURLs {
-			syncArgs = append(syncArgs, "--repository", repoURL)
-		}
-		syncCommand := strings.Join(syncArgs, " ")
-
-		progressChan <- InstallProgressMsg{
-			Phase:       PhaseSystemPackages,
-			Progress:    0.25,
-			Step:        "Synchronizing XBPS repositories...",
-			IsComplete:  false,
-			NeedsSudo:   true,
-			CommandInfo: "sudo sh -c 'yes y | " + syncCommand + "'",
-			LogOutput:   "Synchronizing XBPS repository indexes",
-		}
-
-		syncCmd := privesc.ExecCommand(ctx, sudoPassword, "sh -c 'yes y | "+syncCommand+"'")
-		if err := v.runWithProgress(syncCmd, progressChan, PhaseSystemPackages, 0.25, 0.30); err != nil {
-			return fmt.Errorf("failed to synchronize XBPS repositories: %w", err)
-		}
-	}
-
-	return nil
-}
-
-func (v *VoidDistribution) xbpsRepoName(repoURL string) string {
-	switch repoURL {
-	case VoidDMSRepo:
-		return "dms"
-	case VoidDankLinuxRepo:
-		return "danklinux"
-	case VoidHyprlandRepo:
-		return "hyprland"
-	default:
-		name := strings.TrimPrefix(repoURL, "https://")
-		name = strings.TrimPrefix(name, "http://")
-		name = strings.NewReplacer("/", "-", ".", "-").Replace(name)
-		return name
-	}
-}
-
-func (v *VoidDistribution) xbpsArch(ctx context.Context) (string, error) {
-	output, err := exec.CommandContext(ctx, "xbps-uhelper", "arch").Output()
-	if err != nil {
-		return "", err
-	}
-	return strings.TrimSpace(string(output)), nil
-}
-
-func (v *VoidDistribution) installXBPSPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
-	if len(packages) == 0 {
-		return nil
-	}
-
-	args := append([]string{"xbps-install", "-Sy"}, packages...)
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing XBPS packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
-	}
-
-	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return v.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.85)
-}
-
-func (v *VoidDistribution) extractPackageNames(packages []PackageMapping) []string {
-	names := make([]string, len(packages))
-	for i, pkg := range packages {
-		names[i] = pkg.Name
-	}
-	return names
-}
-
-func (v *VoidDistribution) uniquePackageNames(groups ...[]string) []string {
-	seen := make(map[string]bool)
-	var unique []string
-	for _, group := range groups {
-		for _, pkg := range group {
-			if pkg == "" || seen[pkg] {
-				continue
-			}
-			seen[pkg] = true
-			unique = append(unique, pkg)
-		}
-	}
-	return unique
-}

core/internal/errdefs/errdefs.go

@@ -1,15 +1,9 @@
 package errdefs
 
-import (
-	dankerrdefs "github.com/AvengeMedia/dankgo/errdefs"
-)
-
-type ErrorType = dankerrdefs.ErrorType
-
-type CustomError = dankerrdefs.CustomError
+type ErrorType int
 
 const (
-	ErrTypeNotLinux ErrorType = dankerrdefs.AppErrorBase + iota
+	ErrTypeNotLinux ErrorType = iota
 	ErrTypeInvalidArchitecture
 	ErrTypeUnsupportedDistribution
 	ErrTypeUnsupportedVersion
@@ -28,8 +22,20 @@ const (
 	ErrTypeGeneric
 )
 
+type CustomError struct {
+	Type    ErrorType
+	Message string
+}
+
+func (e *CustomError) Error() string {
+	return e.Message
+}
+
 func NewCustomError(errType ErrorType, message string) error {
-	return dankerrdefs.NewCustomError(errType, message)
+	return &CustomError{
+		Type:    errType,
+		Message: message,
+	}
 }
 
 const (
@@ -41,10 +47,6 @@ const (
 	ErrWifiDisabled     = "wifi-disabled"
 	ErrAlreadyConnected = "already-connected"
 	ErrConnectionFailed = "connection-failed"
-
-	ErrHotspotIPConfigFailed   = "hotspot-ip-config-failed"
-	ErrHotspotSupplicantFailed = "hotspot-supplicant-failed"
-	ErrHotspotFailed           = "hotspot-failed"
 )
 
 var (

core/internal/geolocation/client_geoclue.go

@@ -5,8 +5,8 @@ import (
 	"sync"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
-	"github.com/AvengeMedia/dankgo/dbusutil"
-	"github.com/AvengeMedia/dankgo/syncmap"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/dbusutil"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/syncmap"
 	"github.com/godbus/dbus/v5"
 )
 
@@ -132,7 +132,7 @@ func (c *GeoClueClient) startSignalPump() error {
 	if err := c.dbusConn.AddMatchSignal(
 		dbus.WithMatchObjectPath(c.clientPath),
 		dbus.WithMatchInterface(dbusGeoClueClientInterface),
-		dbus.WithMatchMember("LocationUpdated"),
+		dbus.WithMatchSender(dbusGeoClueClientLocationUpdated),
 	); err != nil {
 		return err
 	}

core/internal/greeter/assets/apparmor/usr.bin.dms-greeter

@@ -0,0 +1,91 @@
+# AppArmor profile for dms-greeter
+#
+# Managed by DMS — regenerated on every `dms greeter install` / `dms greeter sync`.
+# Manual edits will be overwritten on next sync.
+#
+# Mode: complain  (denials are logged, nothing is blocked)
+# To switch to enforce after validating with `aa-logprof`:
+#   sudo aa-enforce /etc/apparmor.d/usr.bin.dms-greeter
+#
+#include <tunables/global>
+
+profile dms-greeter /usr/bin/dms-greeter flags=(complain) {
+  #include <abstractions/base>
+  #include <abstractions/bash>
+
+  # The launcher script itself
+  /usr/bin/dms-greeter r,
+
+  # Cache directory — created by dms greeter sync/enable with greeter:greeter ownership
+  /var/cache/dms-greeter/     rw,
+  /var/cache/dms-greeter/**   rwlk,
+
+  # DMS config — packaged path
+  /usr/share/quickshell/dms-greeter/    r,
+  /usr/share/quickshell/dms-greeter/**  r,
+  /usr/share/quickshell/               r,
+  /usr/share/quickshell/**             r,
+
+  # DMS config — system and user overrides
+  /etc/dms/    r,
+  /etc/dms/**  r,
+  /usr/share/dms/    r,
+  /usr/share/dms/**  r,
+  /home/*/.config/quickshell/    r,
+  /home/*/.config/quickshell/**  r,
+  /root/.config/quickshell/     r,
+  /root/.config/quickshell/**   r,
+
+  # greetd / PAM — read-only for session setup
+  /etc/greetd/    r,
+  /etc/greetd/**  r,
+  /etc/pam.d/     r,
+  /etc/pam.d/**   r,
+  /usr/lib/pam.d/ r,
+  /usr/lib/pam.d/** r,
+
+  # Compositor binaries — run unconfined so each compositor uses its own profile
+  /usr/bin/niri        Ux,
+  /usr/bin/hyprland    Ux,
+  /usr/bin/Hyprland    Ux,
+  /usr/bin/sway        Ux,
+  /usr/bin/labwc       Ux,
+  /usr/bin/scroll      Ux,
+  /usr/bin/miracle-wm  Ux,
+  /usr/bin/mango       Ux,
+
+  # Quickshell — run unconfined (has its own compositor profile on some distros)
+  /usr/bin/qs          Ux,
+  /usr/bin/quickshell  Ux,
+
+  # Wayland / XDG runtime (pipewire, wireplumber, wayland socket)
+  /run/user/[0-9]*/               rw,
+  /run/user/[0-9]*/**             rw,
+
+  # DRM / GPU devices (required for Wayland compositor startup)
+  /dev/dri/      r,
+  /dev/dri/*     rw,
+  /dev/udmabuf   rw,
+
+  # Input devices
+  /dev/input/    r,
+  /dev/input/*   r,
+
+  # Systemd journal / logging
+  /run/systemd/journal/socket  rw,
+  /dev/log                     rw,
+
+  # Shell helper binaries invoked by the launcher script
+  /usr/bin/env      ix,
+  /usr/bin/mkdir    ix,
+  /usr/bin/cat      ix,
+  /usr/bin/grep     ix,
+  /usr/bin/dirname  ix,
+  /usr/bin/basename ix,
+  /usr/bin/command  ix,
+  /bin/env          ix,
+  /bin/mkdir        ix,
+
+  # Signal management (compositor lifecycle)
+  signal (send, receive) set=("term", "int", "hup", "kill"),
+}

core/internal/greeter/installer_test.go

@@ -0,0 +1,300 @@
+package greeter
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func writeTestFile(t *testing.T, path string, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("failed to create parent dir for %s: %v", path, err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("failed to write %s: %v", path, err)
+	}
+}
+
+func TestResolveGreeterThemeSyncState(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		settingsJSON            string
+		sessionJSON             string
+		wantSourcePath          string
+		wantResolvedWallpaper   string
+		wantDynamicOverrideUsed bool
+	}{
+		{
+			name: "dynamic theme with greeter wallpaper override uses generated greeter colors",
+			settingsJSON: `{
+  "currentThemeName": "dynamic",
+  "greeterWallpaperPath": "Pictures/blue.jpg",
+  "matugenScheme": "scheme-tonal-spot",
+  "iconTheme": "Papirus"
+}`,
+			sessionJSON:             `{"isLightMode":true}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "greeter-colors", "dms-colors.json"),
+			wantResolvedWallpaper:   filepath.Join("Pictures", "blue.jpg"),
+			wantDynamicOverrideUsed: true,
+		},
+		{
+			name: "dynamic theme without override uses desktop colors",
+			settingsJSON: `{
+  "currentThemeName": "dynamic",
+  "greeterWallpaperPath": ""
+}`,
+			sessionJSON:             `{"isLightMode":false}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "dms-colors.json"),
+			wantResolvedWallpaper:   "",
+			wantDynamicOverrideUsed: false,
+		},
+		{
+			name: "non-dynamic theme keeps desktop colors even with override wallpaper",
+			settingsJSON: `{
+  "currentThemeName": "purple",
+  "greeterWallpaperPath": "/tmp/blue.jpg"
+}`,
+			sessionJSON:             `{"isLightMode":false}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "dms-colors.json"),
+			wantResolvedWallpaper:   "/tmp/blue.jpg",
+			wantDynamicOverrideUsed: false,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			homeDir := t.TempDir()
+			writeTestFile(t, filepath.Join(homeDir, ".config", "DankMaterialShell", "settings.json"), tt.settingsJSON)
+			writeTestFile(t, filepath.Join(homeDir, ".local", "state", "DankMaterialShell", "session.json"), tt.sessionJSON)
+
+			state, err := resolveGreeterThemeSyncState(homeDir)
+			if err != nil {
+				t.Fatalf("resolveGreeterThemeSyncState returned error: %v", err)
+			}
+
+			if got := state.effectiveColorsSource(homeDir); got != filepath.Join(homeDir, tt.wantSourcePath) {
+				t.Fatalf("effectiveColorsSource = %q, want %q", got, filepath.Join(homeDir, tt.wantSourcePath))
+			}
+
+			wantResolvedWallpaper := tt.wantResolvedWallpaper
+			if wantResolvedWallpaper != "" && !filepath.IsAbs(wantResolvedWallpaper) {
+				wantResolvedWallpaper = filepath.Join(homeDir, wantResolvedWallpaper)
+			}
+			if state.ResolvedGreeterWallpaperPath != wantResolvedWallpaper {
+				t.Fatalf("ResolvedGreeterWallpaperPath = %q, want %q", state.ResolvedGreeterWallpaperPath, wantResolvedWallpaper)
+			}
+
+			if state.UsesDynamicWallpaperOverride != tt.wantDynamicOverrideUsed {
+				t.Fatalf("UsesDynamicWallpaperOverride = %v, want %v", state.UsesDynamicWallpaperOverride, tt.wantDynamicOverrideUsed)
+			}
+		})
+	}
+}
+
+func TestUpsertInitialSession(t *testing.T) {
+	t.Parallel()
+
+	baseConfig := `[terminal]
+vt = 1
+
+[default_session]
+user = "greeter"
+command = "/usr/bin/dms-greeter --command niri"
+`
+
+	t.Run("inserts initial session", func(t *testing.T) {
+		t.Parallel()
+		got := upsertInitialSession(baseConfig, "alice", "/var/cache/dms-greeter", true)
+		if !strings.Contains(got, "[initial_session]") {
+			t.Fatalf("expected [initial_session] section, got:\n%s", got)
+		}
+		if !strings.Contains(got, `user = "alice"`) {
+			t.Fatalf("expected alice user in initial session, got:\n%s", got)
+		}
+		if !strings.Contains(got, `dms greeter launch-session --from-memory --cache-dir`) {
+			t.Fatalf("expected stable launch-session command, got:\n%s", got)
+		}
+		if strings.Contains(got, `exec niri`) {
+			t.Fatalf("initial session must not bake the desktop Exec command, got:\n%s", got)
+		}
+	})
+
+	t.Run("updates existing initial session", func(t *testing.T) {
+		t.Parallel()
+		existing := baseConfig + `
+[initial_session]
+user = "bob"
+command = "old-command"
+`
+		got := upsertInitialSession(existing, "alice", "/var/cache/dms-greeter", true)
+		if strings.Contains(got, `user = "bob"`) {
+			t.Fatalf("expected bob to be replaced, got:\n%s", got)
+		}
+		if !strings.Contains(got, `dms greeter launch-session --from-memory`) {
+			t.Fatalf("expected launch-session command, got:\n%s", got)
+		}
+	})
+
+	t.Run("removes initial session when disabled", func(t *testing.T) {
+		t.Parallel()
+		existing := baseConfig + `
+[initial_session]
+user = "alice"
+command = "niri"
+`
+		got := upsertInitialSession(existing, "", "", false)
+		if strings.Contains(got, "[initial_session]") {
+			t.Fatalf("expected initial session removed, got:\n%s", got)
+		}
+		if !strings.Contains(got, "[default_session]") {
+			t.Fatalf("expected default session preserved, got:\n%s", got)
+		}
+	})
+}
+
+func TestStripDesktopExecCodes(t *testing.T) {
+	t.Parallel()
+
+	got := stripDesktopExecCodes("niri --session %f")
+	want := "niri --session"
+	if got != want {
+		t.Fatalf("stripDesktopExecCodes = %q, want %q", got, want)
+	}
+}
+
+func TestResolveGreeterAutoLoginState(t *testing.T) {
+	t.Parallel()
+
+	cacheDir := t.TempDir()
+	homeDir := t.TempDir()
+
+	writeTestFile(t, filepath.Join(cacheDir, "settings.json"), `{
+  "greeterAutoLogin": true,
+  "greeterRememberLastUser": true,
+  "greeterRememberLastSession": true
+}`)
+	writeTestFile(t, filepath.Join(cacheDir, ".local/state/memory.json"), `{
+  "lastSuccessfulUser": "alice",
+  "lastSessionDesktopId": "niri.desktop"
+}`)
+
+	enabled, loginUser, sessionID, err := resolveGreeterAutoLoginState(cacheDir, homeDir)
+	if err != nil {
+		t.Fatalf("resolveGreeterAutoLoginState returned error: %v", err)
+	}
+	if !enabled || loginUser != "alice" || sessionID != "niri.desktop" {
+		t.Fatalf("got enabled=%v user=%q session=%q", enabled, loginUser, sessionID)
+	}
+}
+
+func TestResolveGreeterAutoLoginStateIgnoresStaleSessionExec(t *testing.T) {
+	t.Parallel()
+
+	cacheDir := t.TempDir()
+	homeDir := t.TempDir()
+
+	writeTestFile(t, filepath.Join(cacheDir, "settings.json"), `{
+  "greeterAutoLogin": true,
+  "greeterRememberLastUser": true,
+  "greeterRememberLastSession": true
+}`)
+	writeTestFile(t, filepath.Join(cacheDir, ".local/state/memory.json"), `{
+  "lastSuccessfulUser": "alice",
+  "lastSessionId": "/nix/store/old-session/share/wayland-sessions/example.desktop",
+  "lastSessionExec": "/nix/store/old-session/bin/start-example-session"
+}`)
+
+	enabled, loginUser, sessionID, err := resolveGreeterAutoLoginState(cacheDir, homeDir)
+	if err != nil {
+		t.Fatalf("resolveGreeterAutoLoginState returned error: %v", err)
+	}
+	if !enabled || loginUser != "alice" || sessionID != "example.desktop" {
+		t.Fatalf("got enabled=%v user=%q session=%q", enabled, loginUser, sessionID)
+	}
+
+	got := upsertInitialSession("", loginUser, cacheDir, true)
+	if strings.Contains(got, "/nix/store/old-session") {
+		t.Fatalf("initial session must not include stale store path, got:\n%s", got)
+	}
+}
+
+func TestResolveGreeterAutoLoginStateIgnoresMemoryFlag(t *testing.T) {
+	t.Parallel()
+
+	cacheDir := t.TempDir()
+	homeDir := t.TempDir()
+
+	writeTestFile(t, filepath.Join(cacheDir, "settings.json"), `{
+  "greeterAutoLogin": false,
+  "greeterRememberLastUser": true,
+  "greeterRememberLastSession": true
+}`)
+	writeTestFile(t, filepath.Join(cacheDir, ".local/state/memory.json"), `{
+  "autoLoginEnabled": true,
+  "lastSuccessfulUser": "alice",
+  "lastSessionExec": "niri"
+}`)
+
+	enabled, loginUser, sessionID, err := resolveGreeterAutoLoginState(cacheDir, homeDir)
+	if err != nil {
+		t.Fatalf("resolveGreeterAutoLoginState returned error: %v", err)
+	}
+	if enabled || loginUser != "" || sessionID != "" {
+		t.Fatalf("expected disabled with empty user/session, got enabled=%v user=%q session=%q", enabled, loginUser, sessionID)
+	}
+}
+
+func TestResolveSessionExecInDirs(t *testing.T) {
+	t.Parallel()
+
+	oldDir := filepath.Join(t.TempDir(), "wayland-sessions")
+	newDir := filepath.Join(t.TempDir(), "wayland-sessions")
+	writeTestFile(t, filepath.Join(oldDir, "example.desktop"), `[Desktop Entry]
+Name=Example Session
+Exec=/nix/store/old-session/bin/start-example-session
+`)
+	writeTestFile(t, filepath.Join(newDir, "example.desktop"), `[Desktop Entry]
+Name=Example Session
+Exec=/run/current-system/sw/bin/start-example-session
+`)
+
+	got, err := resolveSessionExecInDirs("example.desktop", []string{newDir, oldDir})
+	if err != nil {
+		t.Fatalf("resolveSessionExecInDirs returned error: %v", err)
+	}
+	if got != "/run/current-system/sw/bin/start-example-session" {
+		t.Fatalf("resolveSessionExecInDirs = %q", got)
+	}
+}
+
+func TestClearGreeterAutoLoginMemory(t *testing.T) {
+	t.Parallel()
+
+	memoryPath := filepath.Join(t.TempDir(), "memory.json")
+	writeTestFile(t, memoryPath, `{
+  "autoLoginEnabled": true,
+  "lastSuccessfulUser": "alice"
+}`)
+
+	if err := clearGreeterAutoLoginMemory(memoryPath, ""); err != nil {
+		t.Fatalf("clearGreeterAutoLoginMemory returned error: %v", err)
+	}
+
+	data, err := os.ReadFile(memoryPath)
+	if err != nil {
+		t.Fatalf("failed to read memory file: %v", err)
+	}
+	if strings.Contains(string(data), "autoLoginEnabled") {
+		t.Fatalf("expected autoLoginEnabled removed, got: %s", string(data))
+	}
+	if !strings.Contains(string(data), "lastSuccessfulUser") {
+		t.Fatalf("expected other memory fields preserved, got: %s", string(data))
+	}
+}

core/internal/greeter/session_launcher.go

@@ -0,0 +1,122 @@
+package greeter
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+)
+
+func sessionDesktopIDFromPath(path string) string {
+	id := strings.TrimSpace(path)
+	if id == "" {
+		return ""
+	}
+	if strings.ContainsAny(id, "/\\") {
+		id = filepath.Base(id)
+	}
+	if id == "" {
+		return ""
+	}
+	if !strings.HasSuffix(id, ".desktop") {
+		id += ".desktop"
+	}
+	return id
+}
+
+func sessionDesktopIDFromMemory(mem greeterAutoLoginMemory) string {
+	if id := sessionDesktopIDFromPath(mem.LastSessionDesktopID); id != "" {
+		return id
+	}
+	return sessionDesktopIDFromPath(mem.LastSessionID)
+}
+
+func sessionDesktopDirs() []string {
+	seen := make(map[string]bool)
+	dirs := make([]string, 0, 8)
+
+	addBase := func(base string) {
+		base = strings.TrimSpace(base)
+		if base == "" {
+			return
+		}
+		for _, sub := range []string{"wayland-sessions", "xsessions"} {
+			dir := filepath.Join(base, sub)
+			if seen[dir] {
+				continue
+			}
+			seen[dir] = true
+			dirs = append(dirs, dir)
+		}
+	}
+
+	if dataHome := os.Getenv("XDG_DATA_HOME"); dataHome != "" {
+		addBase(dataHome)
+	} else if home, err := os.UserHomeDir(); err == nil && home != "" {
+		addBase(filepath.Join(home, ".local", "share"))
+	}
+
+	if dataDirs := os.Getenv("XDG_DATA_DIRS"); dataDirs != "" {
+		for _, dir := range strings.Split(dataDirs, ":") {
+			addBase(dir)
+		}
+	} else {
+		addBase("/usr/local/share")
+		addBase("/usr/share")
+	}
+
+	return dirs
+}
+
+func ResolveSessionExec(sessionID string) (string, error) {
+	return resolveSessionExecInDirs(sessionID, sessionDesktopDirs())
+}
+
+func resolveSessionExecInDirs(sessionID string, dirs []string) (string, error) {
+	id := sessionDesktopIDFromPath(sessionID)
+	if id == "" {
+		return "", fmt.Errorf("session id is empty")
+	}
+
+	for _, dir := range dirs {
+		path := filepath.Join(dir, id)
+		execLine, err := execFromDesktopFile(path)
+		if err == nil {
+			return execLine, nil
+		}
+		if !os.IsNotExist(err) {
+			return "", err
+		}
+	}
+
+	return "", fmt.Errorf("session desktop file %q was not found", id)
+}
+
+func LaunchSessionByID(sessionID string) error {
+	execLine, err := ResolveSessionExec(sessionID)
+	if err != nil {
+		return err
+	}
+	execLine = strings.TrimSpace(stripDesktopExecCodes(execLine))
+	if execLine == "" {
+		return fmt.Errorf("session %q has an empty Exec command", sessionID)
+	}
+
+	env := append(os.Environ(), "XDG_SESSION_TYPE=wayland")
+	return syscall.Exec("/bin/sh", []string{"sh", "-c", "exec " + execLine}, env)
+}
+
+func LaunchSessionFromMemory(cacheDir, homeDir string) error {
+	enabled, _, sessionID, err := resolveGreeterAutoLoginState(cacheDir, homeDir)
+	if err != nil {
+		return err
+	}
+	if !enabled {
+		return fmt.Errorf("greeter auto-login is disabled")
+	}
+	if sessionID == "" {
+		return fmt.Errorf("greeter auto-login has no remembered session")
+	}
+	return LaunchSessionByID(sessionID)
+}

core/internal/greeter/user_cache_sync.go

@@ -0,0 +1,548 @@
+package greeter
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
+)
+
+var monitorWallpaperSanitizer = regexp.MustCompile(`[^a-zA-Z0-9]+`)
+
+func userGreeterCacheDir(cacheDir, username string) string {
+	return filepath.Join(cacheDir, "users", username)
+}
+
+func isUserOwnedGreeterCacheSlot(path, username string) bool {
+	if strings.TrimSpace(username) == "" {
+		return false
+	}
+	userDir, err := filepath.Abs(userGreeterCacheDir(GreeterCacheDir, username))
+	if err != nil {
+		return false
+	}
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return false
+	}
+	return abs == userDir || strings.HasPrefix(abs, userDir+string(filepath.Separator))
+}
+
+func UserIsInGreeterGroup(username string) bool {
+	group := DetectGreeterGroup()
+	if !utils.HasGroup(group) {
+		return false
+	}
+	groupsCmd := exec.Command("groups", username)
+	groupsOutput, err := groupsCmd.Output()
+	if err != nil {
+		return false
+	}
+	return strings.Contains(string(groupsOutput), group)
+}
+
+func CanSyncOwnUserGreeterProfile(username string) bool {
+	currentUser, err := user.Current()
+	if err != nil || currentUser.Username != username {
+		return false
+	}
+	if !UserIsInGreeterGroup(username) {
+		return false
+	}
+	usersDir := filepath.Join(GreeterCacheDir, "users")
+	if st, err := os.Stat(usersDir); err != nil || !st.IsDir() {
+		return false
+	}
+	testFile := filepath.Join(usersDir, ".write-test-"+username)
+	file, err := os.OpenFile(testFile, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o660)
+	if err != nil {
+		return false
+	}
+	_ = file.Close()
+	_ = os.Remove(testFile)
+	return true
+}
+
+func GreeterProfileSyncReady() bool {
+	if command := readGreeterSessionCommand(); command != "" && strings.Contains(command, "dms-greeter") {
+		return true
+	}
+	usersDir := filepath.Join(GreeterCacheDir, "users")
+	st, err := os.Stat(usersDir)
+	return err == nil && st.IsDir()
+}
+
+func readGreeterSessionCommand() string {
+	data, err := os.ReadFile("/etc/greetd/config.toml")
+	if err != nil {
+		return ""
+	}
+	inDefaultSession := false
+	for line := range strings.SplitSeq(string(data), "\n") {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "[") && strings.HasSuffix(trimmed, "]") {
+			inDefaultSession = strings.EqualFold(strings.Trim(trimmed, "[]"), "default_session")
+			continue
+		}
+		if !inDefaultSession {
+			continue
+		}
+		if idx := strings.Index(trimmed, "#"); idx >= 0 {
+			trimmed = strings.TrimSpace(trimmed[:idx])
+		}
+		if !strings.HasPrefix(trimmed, "command") {
+			continue
+		}
+		parts := strings.SplitN(trimmed, "=", 2)
+		if len(parts) != 2 {
+			continue
+		}
+		command := strings.Trim(strings.TrimSpace(parts[1]), `"`)
+		if command != "" {
+			return command
+		}
+	}
+	return ""
+}
+
+// SyncUserProfileCache writes the current user's theme slot under users/<username>/
+// without modifying greetd or other system configuration. Requires membership in the
+// greeter group and a prior full greeter setup by an administrator.
+func SyncUserProfileCache(logFunc func(string)) error {
+	if logFunc == nil {
+		logFunc = func(string) {}
+	}
+	if !GreeterProfileSyncReady() {
+		return fmt.Errorf("greeter is not set up on this system yet; an administrator must run 'dms greeter install' or 'dms greeter sync' once first")
+	}
+
+	currentUser, err := user.Current()
+	if err != nil {
+		return fmt.Errorf("failed to resolve current user: %w", err)
+	}
+	if !CanSyncOwnUserGreeterProfile(currentUser.Username) {
+		group := DetectGreeterGroup()
+		return fmt.Errorf("cannot sync greeter profile: you must be in the %s group with write access to %s/users\nAsk an administrator to run:\n  sudo usermod -aG %s %s\nThen log out and back in before running:\n  dms greeter sync --profile",
+			group, GreeterCacheDir, group, currentUser.Username)
+	}
+
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return fmt.Errorf("failed to get user home directory: %w", err)
+	}
+
+	state, err := resolveGreeterThemeSyncState(homeDir)
+	if err != nil {
+		return fmt.Errorf("failed to resolve greeter color source: %w", err)
+	}
+
+	if err := syncUserGreeterCacheSlot(homeDir, GreeterCacheDir, currentUser.Username, state, logFunc, userSlotSyncOpts{
+		profileOnly: true,
+	}); err != nil {
+		return err
+	}
+
+	logFunc(fmt.Sprintf("  → %s/users/%s/", GreeterCacheDir, currentUser.Username))
+	return nil
+}
+
+func canWriteUserGreeterCacheSlot(dest, username string) bool {
+	return isUserOwnedGreeterCacheSlot(dest, username) && CanSyncOwnUserGreeterProfile(username)
+}
+
+type userSlotSyncOpts struct {
+	sudoPassword string
+	profileOnly  bool
+	username     string
+}
+
+func (o userSlotSyncOpts) useDirectWrite(dest string) bool {
+	if !o.profileOnly {
+		return false
+	}
+	return canWriteUserGreeterCacheSlot(dest, o.username)
+}
+
+func isGreeterCachePath(path string) bool {
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return true
+	}
+	cacheAbs, err := filepath.Abs(GreeterCacheDir)
+	if err != nil {
+		return true
+	}
+	if abs == cacheAbs {
+		return true
+	}
+	return strings.HasPrefix(abs, cacheAbs+string(filepath.Separator))
+}
+
+func greeterCacheOwner() string {
+	greeterGroup := DetectGreeterGroup()
+	daemonUser := DetectGreeterUser()
+	return daemonUser + ":" + greeterGroup
+}
+
+func ensureGreeterCacheSubdir(dir string, opts userSlotSyncOpts) error {
+	if opts.useDirectWrite(dir) {
+		if err := os.MkdirAll(dir, 0o770); err != nil {
+			return fmt.Errorf("failed to create cache directory %s: %w", dir, err)
+		}
+		return nil
+	}
+
+	if err := privesc.Run(context.Background(), opts.sudoPassword, "mkdir", "-p", dir); err != nil {
+		return fmt.Errorf("failed to create cache directory %s: %w", dir, err)
+	}
+
+	owner := greeterCacheOwner()
+	if err := privesc.Run(context.Background(), opts.sudoPassword, "chown", owner, dir); err != nil {
+		if fallbackErr := privesc.Run(context.Background(), opts.sudoPassword, "chown", "root:"+DetectGreeterGroup(), dir); fallbackErr != nil {
+			return fmt.Errorf("failed to set ownership on %s: %w", dir, err)
+		}
+	}
+	if err := privesc.Run(context.Background(), opts.sudoPassword, "chmod", "2770", dir); err != nil {
+		return fmt.Errorf("failed to set permissions on %s: %w", dir, err)
+	}
+	return nil
+}
+
+func setGreeterCacheFileOwnership(path, sudoPassword string) error {
+	owner := greeterCacheOwner()
+	if err := privesc.Run(context.Background(), sudoPassword, "chown", owner, path); err != nil {
+		if fallbackErr := privesc.Run(context.Background(), sudoPassword, "chown", "root:"+DetectGreeterGroup(), path); fallbackErr != nil {
+			return fmt.Errorf("failed to set ownership on %s: %w", path, err)
+		}
+	}
+	if err := privesc.Run(context.Background(), sudoPassword, "chmod", "644", path); err != nil {
+		return fmt.Errorf("failed to set permissions on %s: %w", path, err)
+	}
+	return nil
+}
+
+func syncUserGreeterCacheSlot(homeDir, cacheDir, username string, state greeterThemeSyncState, logFunc func(string), opts userSlotSyncOpts) error {
+	if strings.TrimSpace(username) == "" {
+		return nil
+	}
+	opts.username = username
+
+	userDir := userGreeterCacheDir(cacheDir, username)
+	if err := ensureGreeterCacheSubdir(userDir, opts); err != nil {
+		return err
+	}
+
+	settingsPath := filepath.Join(homeDir, ".config", "DankMaterialShell", "settings.json")
+	settingsBytes, err := os.ReadFile(settingsPath)
+	if err != nil {
+		return fmt.Errorf("failed to read settings for user cache slot: %w", err)
+	}
+
+	settingsMap := map[string]any{}
+	if strings.TrimSpace(string(settingsBytes)) != "" {
+		if err := json.Unmarshal(settingsBytes, &settingsMap); err != nil {
+			return fmt.Errorf("failed to parse settings for user cache slot: %w", err)
+		}
+	}
+
+	if customTheme, ok := settingsMap["customThemeFile"].(string); ok && strings.TrimSpace(customTheme) != "" {
+		resolvedTheme := customTheme
+		if !filepath.IsAbs(resolvedTheme) {
+			resolvedTheme = filepath.Join(homeDir, resolvedTheme)
+		}
+		if st, statErr := os.Stat(resolvedTheme); statErr == nil && !st.IsDir() {
+			destTheme := filepath.Join(userDir, "custom-theme.json")
+			if err := copyFileWithPrivesc(resolvedTheme, destTheme, opts); err != nil {
+				return err
+			}
+			settingsMap["customThemeFile"] = destTheme
+		}
+	}
+
+	settingsBytes, err = json.Marshal(settingsMap)
+	if err != nil {
+		return fmt.Errorf("failed to marshal settings for user cache slot: %w", err)
+	}
+	if err := writeFileWithPrivesc(filepath.Join(userDir, "settings.json"), settingsBytes, opts); err != nil {
+		return err
+	}
+
+	sessionPath := filepath.Join(homeDir, ".local", "state", "DankMaterialShell", "session.json")
+	sessionBytes, err := os.ReadFile(sessionPath)
+	if err != nil {
+		return fmt.Errorf("failed to read session for user cache slot: %w", err)
+	}
+
+	sessionMap := map[string]any{}
+	if strings.TrimSpace(string(sessionBytes)) != "" {
+		if err := json.Unmarshal(sessionBytes, &sessionMap); err != nil {
+			return fmt.Errorf("failed to parse session for user cache slot: %w", err)
+		}
+	}
+
+	if err := localizeSessionWallpapers(sessionMap, userDir, opts); err != nil {
+		return err
+	}
+
+	sessionBytes, err = json.Marshal(sessionMap)
+	if err != nil {
+		return fmt.Errorf("failed to marshal session for user cache slot: %w", err)
+	}
+	if err := writeFileWithPrivesc(filepath.Join(userDir, "session.json"), sessionBytes, opts); err != nil {
+		return err
+	}
+
+	colorsSource := state.effectiveColorsSource(homeDir)
+	if err := copyFileWithPrivesc(colorsSource, filepath.Join(userDir, "colors.json"), opts); err != nil {
+		return fmt.Errorf("failed to copy colors for user cache slot: %w", err)
+	}
+
+	if err := syncUserProfileImage(homeDir, userDir, opts); err != nil {
+		return err
+	}
+
+	rootOverride := filepath.Join(cacheDir, "greeter_wallpaper_override.jpg")
+	userOverride := filepath.Join(userDir, "greeter_wallpaper_override.jpg")
+	if st, statErr := os.Stat(rootOverride); statErr == nil && !st.IsDir() {
+		if err := copyFileWithPrivesc(rootOverride, userOverride, opts); err != nil {
+			return fmt.Errorf("failed to copy greeter wallpaper override for user cache slot: %w", err)
+		}
+	} else if opts.useDirectWrite(userOverride) {
+		_ = os.Remove(userOverride)
+	} else {
+		_ = privesc.Run(context.Background(), opts.sudoPassword, "rm", "-f", userOverride)
+	}
+
+	logFunc(fmt.Sprintf("✓ Synced per-user greeter cache for %s", username))
+	return nil
+}
+
+func localizeSessionWallpapers(session map[string]any, userDir string, opts userSlotSyncOpts) error {
+	stringKeys := []struct {
+		key    string
+		prefix string
+	}{
+		{"wallpaperPath", "wallpaper"},
+		{"wallpaperPathLight", "wallpaper-light"},
+		{"wallpaperPathDark", "wallpaper-dark"},
+	}
+	for _, item := range stringKeys {
+		if err := localizeWallpaperStringField(session, item.key, userDir, item.prefix, opts); err != nil {
+			return err
+		}
+	}
+
+	mapKeys := []struct {
+		key    string
+		prefix string
+	}{
+		{"monitorWallpapers", "wallpaper-monitor"},
+		{"monitorWallpapersLight", "wallpaper-monitor-light"},
+		{"monitorWallpapersDark", "wallpaper-monitor-dark"},
+	}
+	for _, item := range mapKeys {
+		if err := localizeWallpaperMapField(session, item.key, userDir, item.prefix, opts); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func localizeWallpaperStringField(session map[string]any, key, userDir, prefix string, opts userSlotSyncOpts) error {
+	raw, ok := session[key]
+	if !ok {
+		return nil
+	}
+	path, ok := raw.(string)
+	if !ok || strings.TrimSpace(path) == "" {
+		return nil
+	}
+	dest, err := copyWallpaperIntoUserCache(path, userDir, prefix, opts)
+	if err != nil {
+		return err
+	}
+	if dest != "" {
+		session[key] = dest
+	}
+	return nil
+}
+
+func localizeWallpaperMapField(session map[string]any, key, userDir, prefix string, opts userSlotSyncOpts) error {
+	raw, ok := session[key]
+	if !ok || raw == nil {
+		return nil
+	}
+	values, ok := raw.(map[string]any)
+	if !ok {
+		return nil
+	}
+	for monitor, rawPath := range values {
+		path, ok := rawPath.(string)
+		if !ok || strings.TrimSpace(path) == "" {
+			continue
+		}
+		safeMonitor := monitorWallpaperSanitizer.ReplaceAllString(monitor, "-")
+		dest, err := copyWallpaperIntoUserCache(path, userDir, prefix+"-"+safeMonitor, opts)
+		if err != nil {
+			return err
+		}
+		if dest != "" {
+			values[monitor] = dest
+		}
+	}
+	return nil
+}
+
+func copyWallpaperIntoUserCache(srcPath, userDir, prefix string, opts userSlotSyncOpts) (string, error) {
+	if strings.TrimSpace(srcPath) == "" {
+		return "", nil
+	}
+	st, err := os.Stat(srcPath)
+	if err != nil || st.IsDir() {
+		return "", nil
+	}
+	ext := filepath.Ext(srcPath)
+	if ext == "" {
+		ext = ".jpg"
+	}
+	dest := filepath.Join(userDir, prefix+ext)
+	if err := copyFileWithPrivesc(srcPath, dest, opts); err != nil {
+		return "", err
+	}
+	return dest, nil
+}
+
+func copyFileWithPrivesc(src, dest string, opts userSlotSyncOpts) error {
+	if opts.useDirectWrite(dest) {
+		if err := os.MkdirAll(filepath.Dir(dest), 0o770); err != nil {
+			return fmt.Errorf("failed to create parent dir for %s: %w", dest, err)
+		}
+		data, err := os.ReadFile(src)
+		if err != nil {
+			return fmt.Errorf("failed to read %s: %w", src, err)
+		}
+		if err := os.WriteFile(dest, data, 0o644); err != nil {
+			return fmt.Errorf("failed to write %s: %w", dest, err)
+		}
+		return nil
+	}
+
+	if !isGreeterCachePath(dest) {
+		if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+			return fmt.Errorf("failed to create parent dir for %s: %w", dest, err)
+		}
+		data, err := os.ReadFile(src)
+		if err != nil {
+			return fmt.Errorf("failed to read %s: %w", src, err)
+		}
+		if err := os.WriteFile(dest, data, 0o644); err != nil {
+			return fmt.Errorf("failed to write %s: %w", dest, err)
+		}
+		return nil
+	}
+
+	_ = privesc.Run(context.Background(), opts.sudoPassword, "rm", "-f", dest)
+	if err := privesc.Run(context.Background(), opts.sudoPassword, "cp", src, dest); err != nil {
+		return fmt.Errorf("failed to copy %s to %s: %w", src, dest, err)
+	}
+	return setGreeterCacheFileOwnership(dest, opts.sudoPassword)
+}
+
+func writeFileWithPrivesc(path string, data []byte, opts userSlotSyncOpts) error {
+	if opts.useDirectWrite(path) {
+		if err := os.MkdirAll(filepath.Dir(path), 0o770); err != nil {
+			return fmt.Errorf("failed to create parent dir for %s: %w", path, err)
+		}
+		if err := os.WriteFile(path, data, 0o644); err != nil {
+			return fmt.Errorf("failed to write %s: %w", path, err)
+		}
+		return nil
+	}
+
+	if !isGreeterCachePath(path) {
+		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+			return fmt.Errorf("failed to create parent dir for %s: %w", path, err)
+		}
+		if err := os.WriteFile(path, data, 0o644); err != nil {
+			return fmt.Errorf("failed to write %s: %w", path, err)
+		}
+		return nil
+	}
+
+	tmp, err := os.CreateTemp("", "dms-greeter-user-cache-*")
+	if err != nil {
+		return fmt.Errorf("failed to create temp file for %s: %w", path, err)
+	}
+	tmpPath := tmp.Name()
+	if _, err := tmp.Write(data); err != nil {
+		_ = tmp.Close()
+		_ = os.Remove(tmpPath)
+		return fmt.Errorf("failed to write temp file for %s: %w", path, err)
+	}
+	if err := tmp.Close(); err != nil {
+		_ = os.Remove(tmpPath)
+		return fmt.Errorf("failed to close temp file for %s: %w", path, err)
+	}
+	defer os.Remove(tmpPath)
+
+	_ = privesc.Run(context.Background(), opts.sudoPassword, "rm", "-f", path)
+	if err := privesc.Run(context.Background(), opts.sudoPassword, "cp", tmpPath, path); err != nil {
+		return fmt.Errorf("failed to install %s: %w", path, err)
+	}
+	return setGreeterCacheFileOwnership(path, opts.sudoPassword)
+}
+
+func resolveUserProfileImageSource(homeDir string) string {
+	candidates := []string{
+		filepath.Join(homeDir, ".face"),
+		filepath.Join(homeDir, ".face.icon"),
+	}
+	if homeDir != "" {
+		username := filepath.Base(homeDir)
+		if username != "" && username != "." && username != string(filepath.Separator) {
+			candidates = append([]string{filepath.Join("/var/lib/AccountsService/icons", username)}, candidates...)
+		}
+	}
+	for _, src := range candidates {
+		st, err := os.Stat(src)
+		if err == nil && !st.IsDir() && st.Size() > 0 {
+			return src
+		}
+	}
+	return ""
+}
+
+func syncUserProfileImage(homeDir, userDir string, opts userSlotSyncOpts) error {
+	for _, name := range []string{"profile.jpg", "profile.jpeg", "profile.png", "profile.webp"} {
+		path := filepath.Join(userDir, name)
+		if opts.useDirectWrite(path) {
+			_ = os.Remove(path)
+		} else {
+			_ = privesc.Run(context.Background(), opts.sudoPassword, "rm", "-f", path)
+		}
+	}
+
+	src := resolveUserProfileImageSource(homeDir)
+	if src == "" {
+		return nil
+	}
+
+	ext := filepath.Ext(src)
+	if ext == "" {
+		ext = ".jpg"
+	}
+	dest := filepath.Join(userDir, "profile"+ext)
+	if err := copyFileWithPrivesc(src, dest, opts); err != nil {
+		return fmt.Errorf("failed to copy profile image for user cache slot: %w", err)
+	}
+	return nil
+}

core/internal/greeter/user_cache_sync_test.go

@@ -0,0 +1,81 @@
+package greeter
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestUserGreeterCacheDir(t *testing.T) {
+	t.Parallel()
+
+	got := userGreeterCacheDir("/var/cache/dms-greeter", "alice")
+	want := filepath.Join("/var/cache/dms-greeter", "users", "alice")
+	if got != want {
+		t.Fatalf("userGreeterCacheDir() = %q, want %q", got, want)
+	}
+}
+
+func TestResolveUserProfileImageSource(t *testing.T) {
+	t.Parallel()
+
+	homeDir := t.TempDir()
+	facePath := filepath.Join(homeDir, ".face")
+	writeTestFile(t, facePath, "face")
+
+	got := resolveUserProfileImageSource(homeDir)
+	if got != facePath {
+		t.Fatalf("resolveUserProfileImageSource() = %q, want %q", got, facePath)
+	}
+}
+
+func TestIsUserOwnedGreeterCacheSlot(t *testing.T) {
+	t.Parallel()
+
+	slot := filepath.Join(GreeterCacheDir, "users", "alice", "settings.json")
+	if !isUserOwnedGreeterCacheSlot(slot, "alice") {
+		t.Fatalf("expected alice to own %q", slot)
+	}
+	if isUserOwnedGreeterCacheSlot(slot, "bob") {
+		t.Fatalf("expected bob not to own alice slot")
+	}
+	if isUserOwnedGreeterCacheSlot(filepath.Join(GreeterCacheDir, "settings.json"), "alice") {
+		t.Fatalf("expected root cache file not to be a user slot")
+	}
+}
+
+func TestLocalizeSessionWallpapers(t *testing.T) {
+	t.Parallel()
+
+	homeDir := t.TempDir()
+	userDir := filepath.Join(homeDir, "users", "alice")
+	wallpaperPath := filepath.Join(homeDir, "wall.jpg")
+	writeTestFile(t, wallpaperPath, "wallpaper")
+
+	session := map[string]any{
+		"wallpaperPath": wallpaperPath,
+		"monitorWallpapers": map[string]any{
+			"DP-1": wallpaperPath,
+		},
+	}
+
+	if err := localizeSessionWallpapers(session, userDir, userSlotSyncOpts{}); err != nil {
+		t.Fatalf("localizeSessionWallpapers returned error: %v", err)
+	}
+
+	gotPath, ok := session["wallpaperPath"].(string)
+	if !ok || gotPath == "" {
+		t.Fatalf("expected localized wallpaperPath, got %#v", session["wallpaperPath"])
+	}
+	if gotPath == wallpaperPath {
+		t.Fatalf("expected copied wallpaper path, still points to source")
+	}
+
+	monitorMap, ok := session["monitorWallpapers"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected monitorWallpapers map")
+	}
+	monitorPath, ok := monitorMap["DP-1"].(string)
+	if !ok || monitorPath == "" || monitorPath == wallpaperPath {
+		t.Fatalf("expected localized monitor wallpaper, got %#v", monitorMap["DP-1"])
+	}
+}

core/internal/headless/runner.go

@@ -9,8 +9,8 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/greeter"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
-	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
 )
 
 // ErrConfirmationRequired is returned when --yes is not set and the user
@@ -41,8 +41,6 @@ type Config struct {
 	ReplaceConfigs    []string // specific configs to deploy (e.g. "niri", "ghostty")
 	ReplaceConfigsAll bool     // deploy/replace all configurations
 	Yes               bool
-	DankSearch        bool // install danksearch and enable its user service
-	DankCalendar      bool // install dankcalendar
 }
 
 // Runner orchestrates unattended (headless) installation.
@@ -216,50 +214,35 @@ func (r *Runner) Run() error {
 		return fmt.Errorf("package installation failed: %w", err)
 	}
 
-	useSystemd := true
-	if distroConfig, exists := distros.Registry[osInfo.Distribution.ID]; exists && distroConfig.Family == distros.FamilyVoid {
-		useSystemd = false
-	}
-
 	// 9. Greeter setup (if dms-greeter was included)
 	if !disabledItems["dms-greeter"] && r.depExists(dependencies, "dms-greeter") {
+		compositorName := "niri"
+		if wm == deps.WindowManagerHyprland {
+			compositorName = "Hyprland"
+		}
 		fmt.Fprintln(os.Stdout, "Configuring DMS greeter...")
 		logFunc := func(line string) {
 			r.log(line)
 			fmt.Fprintf(os.Stdout, "  greeter: %s\n", line)
 		}
-		if err := utils.RunDmsGreeterInstall(sudoPassword, logFunc); err != nil {
+		if err := greeter.AutoSetupGreeter(compositorName, sudoPassword, logFunc); err != nil {
 			// Non-fatal, matching TUI behavior
 			fmt.Fprintf(os.Stderr, "Warning: greeter setup issue (non-fatal): %v\n", err)
 		}
 	}
 
-	// 9b. danksearch service setup (if danksearch was included)
-	if useSystemd && !disabledItems["danksearch"] && r.depExists(dependencies, "danksearch") {
-		fmt.Fprintln(os.Stdout, "Enabling danksearch service...")
-		logFunc := func(line string) {
-			r.log(line)
-			fmt.Fprintf(os.Stdout, "  danksearch: %s\n", line)
-		}
-		if err := distros.SetupDsearchService(context.Background(), logFunc); err != nil {
-			// Non-fatal, matching greeter behavior
-			fmt.Fprintf(os.Stderr, "Warning: danksearch service setup issue (non-fatal): %v\n", err)
-		}
-	}
-
 	// 10. Deploy configurations
 	fmt.Fprintln(os.Stdout, "Deploying configurations...")
 	r.log("Starting configuration deployment")
 
 	deployer := config.NewConfigDeployer(r.logChan)
-	results, err := deployer.DeployConfigurationsSelectiveWithReinstallsAndSystemd(
+	results, err := deployer.DeployConfigurationsSelectiveWithReinstalls(
 		context.Background(),
 		wm,
 		terminal,
 		dependencies,
 		replaceConfigs,
 		reinstallItems,
-		useSystemd,
 	)
 	if err != nil {
 		return fmt.Errorf("configuration deployment failed: %w", err)
@@ -284,31 +267,19 @@ func (r *Runner) Run() error {
 }
 
 // buildDisabledItems computes the set of dependencies that should be skipped
-// during installation. Optional components are opt-in (disabled by default),
-// then re-enabled by the dedicated flags and --include-deps.
+// during installation, applying the --include-deps and --exclude-deps filters.
+// dms-greeter is disabled by default (opt-in), matching TUI behavior.
 func (r *Runner) buildDisabledItems(dependencies []deps.Dependency) (map[string]bool, error) {
 	disabledItems := make(map[string]bool)
 
+	// dms-greeter is opt-in (disabled by default), matching TUI behavior
 	for i := range dependencies {
-		if !dependencies[i].Required {
-			disabledItems[dependencies[i].Name] = true
+		if dependencies[i].Name == "dms-greeter" {
+			disabledItems["dms-greeter"] = true
+			break
 		}
 	}
 
-	// Dedicated flags resolve before include/exclude
-	if r.cfg.DankSearch {
-		if !r.depExists(dependencies, "danksearch") {
-			return nil, fmt.Errorf("--danksearch: not available on this distribution")
-		}
-		delete(disabledItems, "danksearch")
-	}
-	if r.cfg.DankCalendar {
-		if !r.depExists(dependencies, "dankcalendar") {
-			return nil, fmt.Errorf("--dankcalendar: not available on this distribution")
-		}
-		delete(disabledItems, "dankcalendar")
-	}
-
 	// Process --include-deps (enable items that are disabled by default)
 	for _, name := range r.cfg.IncludeDeps {
 		name = strings.TrimSpace(name)

core/internal/headless/runner_test.go

@@ -342,21 +342,17 @@ func TestConfigReplaceConfigsStoredCorrectly(t *testing.T) {
 
 func TestBuildDisabledItems(t *testing.T) {
 	dependencies := []deps.Dependency{
-		{Name: "niri", Status: deps.StatusInstalled, Required: true},
-		{Name: "ghostty", Status: deps.StatusMissing, Required: true},
-		{Name: "dms (DankMaterialShell)", Status: deps.StatusInstalled, Required: true},
+		{Name: "niri", Status: deps.StatusInstalled},
+		{Name: "ghostty", Status: deps.StatusMissing},
+		{Name: "dms (DankMaterialShell)", Status: deps.StatusInstalled},
 		{Name: "dms-greeter", Status: deps.StatusMissing},
-		{Name: "danksearch", Status: deps.StatusMissing},
-		{Name: "dankcalendar", Status: deps.StatusMissing},
-		{Name: "waybar", Status: deps.StatusMissing, Required: true},
+		{Name: "waybar", Status: deps.StatusMissing},
 	}
 
 	tests := []struct {
 		name         string
 		includeDeps  []string
 		excludeDeps  []string
-		dankSearch   bool
-		dankCalendar bool
 		deps         []deps.Dependency // nil means use the shared fixture
 		wantErr      bool
 		errContains  string   // substring expected in error message
@@ -364,20 +360,19 @@ func TestBuildDisabledItems(t *testing.T) {
 		wantEnabled  []string // dep names that should NOT be in disabledItems (extra check)
 	}{
 		{
-			name:         "no flags set, optional deps disabled by default",
-			wantDisabled: []string{"dms-greeter", "danksearch", "dankcalendar"},
+			name:         "no flags set, dms-greeter disabled by default",
+			wantDisabled: []string{"dms-greeter"},
 			wantEnabled:  []string{"niri", "ghostty", "waybar"},
 		},
 		{
-			name:         "include dms-greeter enables it",
-			includeDeps:  []string{"dms-greeter"},
-			wantEnabled:  []string{"dms-greeter"},
-			wantDisabled: []string{"danksearch", "dankcalendar"},
+			name:        "include dms-greeter enables it",
+			includeDeps: []string{"dms-greeter"},
+			wantEnabled: []string{"dms-greeter"},
 		},
 		{
 			name:         "exclude a regular dep",
 			excludeDeps:  []string{"waybar"},
-			wantDisabled: []string{"dms-greeter", "danksearch", "dankcalendar", "waybar"},
+			wantDisabled: []string{"dms-greeter", "waybar"},
 		},
 		{
 			name:        "include unknown dep returns error",
@@ -404,53 +399,24 @@ func TestBuildDisabledItems(t *testing.T) {
 			wantDisabled: []string{"dms-greeter"},
 		},
 		{
-			name:         "whitespace entries are skipped",
-			includeDeps:  []string{"  ", "dms-greeter"},
-			wantEnabled:  []string{"dms-greeter"},
-			wantDisabled: []string{"danksearch", "dankcalendar"},
+			name:        "whitespace entries are skipped",
+			includeDeps: []string{"  ", "dms-greeter"},
+			wantEnabled: []string{"dms-greeter"},
 		},
 		{
-			name: "no optional deps present, nothing disabled by default",
+			name: "no dms-greeter in deps, nothing disabled by default",
 			deps: []deps.Dependency{
-				{Name: "niri", Status: deps.StatusInstalled, Required: true},
+				{Name: "niri", Status: deps.StatusInstalled},
 			},
 			wantEnabled: []string{"niri"},
 		},
-		{
-			name:         "danksearch flag enables it",
-			dankSearch:   true,
-			wantEnabled:  []string{"danksearch"},
-			wantDisabled: []string{"dms-greeter", "dankcalendar"},
-		},
-		{
-			name:         "dankcalendar flag enables it",
-			dankCalendar: true,
-			wantEnabled:  []string{"dankcalendar"},
-			wantDisabled: []string{"dms-greeter", "danksearch"},
-		},
-		{
-			name:        "danksearch flag when unavailable errors",
-			dankSearch:  true,
-			deps:        []deps.Dependency{{Name: "niri", Status: deps.StatusInstalled, Required: true}},
-			wantErr:     true,
-			errContains: "--danksearch",
-		},
-		{
-			name:         "dankcalendar flag when unavailable errors",
-			dankCalendar: true,
-			deps:         []deps.Dependency{{Name: "niri", Status: deps.StatusInstalled, Required: true}},
-			wantErr:      true,
-			errContains:  "--dankcalendar",
-		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			r := NewRunner(Config{
-				IncludeDeps:  tt.includeDeps,
-				ExcludeDeps:  tt.excludeDeps,
-				DankSearch:   tt.dankSearch,
-				DankCalendar: tt.dankCalendar,
+				IncludeDeps: tt.includeDeps,
+				ExcludeDeps: tt.excludeDeps,
 			})
 			d := tt.deps
 			if d == nil {

core/internal/keybinds/providers/hyprland.go

@@ -299,9 +299,6 @@ type hyprlandOverrideBind struct {
 	Options     map[string]any
 	// Unbind: negative override (hl.unbind only, no rebind).
 	Unbind bool
-	// RawLuaAction: Action is a custom hl.* Lua expression round-tripped from an
-	// existing Lua override; re-emit it verbatim instead of quoting it.
-	RawLuaAction bool
 }
 
 func (h *HyprlandProvider) ensureWritableConfig() error {
@@ -1049,26 +1046,18 @@ func luaActionStringFromHyprlangAction(action string) string {
 	if expr, ok := luaActionStringFromKnownHyprlandAction(action); ok {
 		return expr
 	}
-	// Unrecognized dispatchers are freeform text, not Lua; forward them to
-	// hyprctl quoted so a stray `"` can't produce broken Lua output.
-	return luaHyprctlDispatchFunction(action)
+	return action
 }
 
-// luaExprToInternalAction converts a parsed Lua bind expression back into
-// "dispatcher params" text. isRawLua reports that expr matched no known hl.*
-// shape and must be re-emitted verbatim as Lua on write-back.
-func luaExprToInternalAction(expr string) (action string, isRawLua bool) {
+func luaExprToInternalAction(expr string) string {
 	d, p := luaExprToDispatcherParams(expr)
-	if d == expr && p == "" {
-		return expr, true
-	}
 	if d == "exec" && p != "" && !strings.HasPrefix(p, "hyprctl dispatch lua:") {
-		return "exec " + p, false
+		return "exec " + p
 	}
 	if p != "" {
-		return d + " " + p, false
+		return d + " " + p
 	}
-	return d, false
+	return d
 }
 
 func luaBindOptions(bind *hyprlandOverrideBind) []string {
@@ -1086,25 +1075,20 @@ func luaBindOptions(bind *hyprlandOverrideBind) []string {
 }
 
 func writeLuaBindLine(sb *strings.Builder, bind *hyprlandOverrideBind) {
-	key := strconv.Quote(formatLuaBindKey(bind.Key))
+	key := formatLuaBindKey(bind.Key)
 	if bind.Unbind {
-		fmt.Fprintf(sb, `hl.unbind(%s)`, key)
+		fmt.Fprintf(sb, `hl.unbind("%s")`, key)
 		sb.WriteByte('\n')
 		return
 	}
-	var expr string
-	if bind.RawLuaAction {
-		expr = bind.Action
-	} else {
-		expr = luaActionStringFromHyprlangAction(bind.Action)
-	}
+	expr := luaActionStringFromHyprlangAction(bind.Action)
 	opts := luaBindOptions(bind)
-	fmt.Fprintf(sb, `hl.unbind(%s)`, key)
+	fmt.Fprintf(sb, `hl.unbind("%s")`, key)
 	sb.WriteByte('\n')
 	if len(opts) > 0 {
-		fmt.Fprintf(sb, `hl.bind(%s, %s, { %s })`, key, expr, strings.Join(opts, ", "))
+		fmt.Fprintf(sb, `hl.bind("%s", %s, { %s })`, key, expr, strings.Join(opts, ", "))
 	} else {
-		fmt.Fprintf(sb, `hl.bind(%s, %s)`, key, expr)
+		fmt.Fprintf(sb, `hl.bind("%s", %s)`, key, expr)
 	}
 	sb.WriteByte('\n')
 }
@@ -1120,18 +1104,17 @@ func parseLuaBindOverrideLine(line string) (*hyprlandOverrideBind, bool) {
 	}
 	internalKey := luaKeyComboToInternalKey(kbc)
 
-	action, isRawLua := luaExprToInternalAction(actionExpr)
+	action := luaExprToInternalAction(actionExpr)
 	flags := luaBindOptFlags(optSuffix)
 	description := luaBindOptDescription(optSuffix)
 	if description == "" {
 		description = luaLineTrailingComment(line)
 	}
 	return &hyprlandOverrideBind{
-		Key:          internalKey,
-		Action:       action,
-		Description:  description,
-		Flags:        flags,
-		RawLuaAction: isRawLua,
+		Key:         internalKey,
+		Action:      action,
+		Description: description,
+		Flags:       flags,
 	}, true
 }
 
@@ -1171,7 +1154,7 @@ func readLuaOrHyprlangOverride(path string) (map[string]*hyprlandOverrideBind, e
 	if err != nil {
 		return nil, err
 	}
-	lines := expandLuaConfigLines(strings.Split(string(data), "\n"))
+	lines := strings.Split(string(data), "\n")
 	parser := NewHyprlandParser("")
 	pendingUnbinds := make(map[string]string)
 	for _, line := range lines {

core/internal/keybinds/providers/hyprland_lua_expand.go

@@ -1,414 +0,0 @@
-package providers
-
-import (
-	"maps"
-	"regexp"
-	"strconv"
-	"strings"
-)
-
-// Lua configs can express binds dynamically: variables (mainMod .. " + C"),
-// tostring() calls, and numeric for loops (workspace binds). This resolves such
-// expressions to literal key combos so the static bind parser can read them.
-
-const luaMaxLoopIterations = 1000
-
-var (
-	luaAssignRE     = regexp.MustCompile(`^(?:local\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+)$`)
-	luaForRE        = regexp.MustCompile(`^for\s+([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(-?\d+)\s*,\s*(-?\d+)\s*(?:,\s*(-?\d+)\s*)?do\b(.*)$`)
-	luaTostringRE   = regexp.MustCompile(`to(?:string|number)\s*\(\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*'|-?\d+(?:\.\d+)?)\s*\)`)
-	luaBlockOpenRE  = regexp.MustCompile(`\b(?:function|for|while|if)\b`)
-	luaBlockCloseRE = regexp.MustCompile(`\bend\b`)
-	luaNumberRE     = regexp.MustCompile(`^-?\d+(?:\.\d+)?$`)
-)
-
-type luaVarEnv map[string]string
-
-type luaForHeader struct {
-	varName string
-	start   int
-	stop    int
-	step    int
-	inline  string
-}
-
-func expandLuaConfigLines(lines []string) []string {
-	return expandLuaBlock(lines, luaVarEnv{})
-}
-
-func expandLuaBlock(lines []string, env luaVarEnv) []string {
-	out := make([]string, 0, len(lines))
-	for i := 0; i < len(lines); i++ {
-		code := strings.TrimSpace(luaStripLineComment(lines[i]))
-
-		if name, value, ok := parseLuaStringAssignment(code, env); ok {
-			env[name] = value
-			out = append(out, lines[i])
-			continue
-		}
-
-		header, ok := parseLuaForHeader(code)
-		if !ok {
-			out = append(out, resolveLuaDynamicLine(lines[i], env))
-			continue
-		}
-
-		body, consumed, complete := collectLuaForBody(header, lines, i)
-		if !complete {
-			out = append(out, resolveLuaDynamicLine(lines[i], env))
-			continue
-		}
-		out = append(out, expandLuaForLoop(header, body, env)...)
-		i = consumed
-	}
-	return out
-}
-
-func parseLuaStringAssignment(code string, env luaVarEnv) (name, value string, ok bool) {
-	m := luaAssignRE.FindStringSubmatch(code)
-	if m == nil {
-		return "", "", false
-	}
-	value, ok = evalLuaConcat(m[2], env)
-	if !ok {
-		return "", "", false
-	}
-	return m[1], value, true
-}
-
-func parseLuaForHeader(code string) (luaForHeader, bool) {
-	m := luaForRE.FindStringSubmatch(code)
-	if m == nil {
-		return luaForHeader{}, false
-	}
-	start, _ := strconv.Atoi(m[2])
-	stop, _ := strconv.Atoi(m[3])
-	step := 1
-	if m[4] != "" {
-		step, _ = strconv.Atoi(m[4])
-	}
-	if step == 0 {
-		return luaForHeader{}, false
-	}
-	return luaForHeader{varName: m[1], start: start, stop: stop, step: step, inline: strings.TrimSpace(m[5])}, true
-}
-
-func collectLuaForBody(header luaForHeader, lines []string, headerIdx int) (body []string, consumed int, complete bool) {
-	depth := 1
-	if header.inline != "" {
-		delta := luaBlockDelta(header.inline)
-		if depth+delta <= 0 {
-			if stmt := strings.TrimSpace(strings.TrimSuffix(strings.TrimSpace(header.inline), "end")); stmt != "" {
-				body = append(body, stmt)
-			}
-			return body, headerIdx, true
-		}
-		depth += delta
-		body = append(body, header.inline)
-	}
-	for j := headerIdx + 1; j < len(lines); j++ {
-		delta := luaBlockDelta(lines[j])
-		if depth+delta <= 0 {
-			return body, j, true
-		}
-		depth += delta
-		body = append(body, lines[j])
-	}
-	return nil, headerIdx, false
-}
-
-func expandLuaForLoop(header luaForHeader, body []string, env luaVarEnv) []string {
-	var out []string
-	inRange := func(v int) bool {
-		if header.step > 0 {
-			return v <= header.stop
-		}
-		return v >= header.stop
-	}
-	count := 0
-	for v := header.start; inRange(v); v += header.step {
-		if count++; count > luaMaxLoopIterations {
-			break
-		}
-		value := strconv.Itoa(v)
-		iterLines := make([]string, len(body))
-		for k, bl := range body {
-			iterLines[k] = substituteLuaIdent(bl, header.varName, value)
-		}
-		out = append(out, expandLuaBlock(iterLines, cloneLuaEnv(env))...)
-	}
-	return out
-}
-
-func luaBlockDelta(line string) int {
-	masked := luaMaskStrings(line)
-	return len(luaBlockOpenRE.FindAllString(masked, -1)) - len(luaBlockCloseRE.FindAllString(masked, -1))
-}
-
-func resolveLuaDynamicLine(line string, env luaVarEnv) string {
-	if !strings.Contains(line, "hl.bind") && !strings.Contains(line, "hl.unbind") {
-		return line
-	}
-	line = normalizeLuaToString(line)
-	return rewriteLuaBindKeyArg(line, env)
-}
-
-func normalizeLuaToString(line string) string {
-	return luaTostringRE.ReplaceAllStringFunc(line, func(m string) string {
-		inner := luaTostringRE.FindStringSubmatch(m)[1]
-		if inner[0] == '"' || inner[0] == '\'' {
-			return inner
-		}
-		return strconv.Quote(inner)
-	})
-}
-
-func rewriteLuaBindKeyArg(line string, env luaVarEnv) string {
-	for _, fn := range []string{"hl.bind", "hl.unbind"} {
-		idx := strings.Index(line, fn)
-		if idx < 0 {
-			continue
-		}
-		open := skipLuaWS(line, idx+len(fn))
-		if open >= len(line) || line[open] != '(' {
-			continue
-		}
-		argStart := skipLuaWS(line, open+1)
-		expr, end, ok := parseLuaFirstArgExpr(line, argStart)
-		if !ok || isLuaPlainStringArg(expr) {
-			continue
-		}
-		value, ok := evalLuaConcat(expr, env)
-		if !ok {
-			continue
-		}
-		return line[:argStart] + strconv.Quote(value) + line[end:]
-	}
-	return line
-}
-
-func evalLuaConcat(expr string, env luaVarEnv) (string, bool) {
-	parts := splitLuaConcat(expr)
-	var sb strings.Builder
-	for _, part := range parts {
-		value, ok := evalLuaOperand(part, env)
-		if !ok {
-			return "", false
-		}
-		sb.WriteString(value)
-	}
-	return sb.String(), true
-}
-
-func evalLuaOperand(op string, env luaVarEnv) (string, bool) {
-	op = strings.TrimSpace(op)
-	if op == "" {
-		return "", false
-	}
-	switch op[0] {
-	case '"', '\'':
-		s, next, ok := parseLuaStringLiteral(op, 0)
-		return s, next == len(op) && ok
-	}
-	if luaNumberRE.MatchString(op) {
-		return op, true
-	}
-	if inner, ok := luaUnwrapCall(op, "tostring"); ok {
-		return evalLuaConcat(inner, env)
-	}
-	if inner, ok := luaUnwrapCall(op, "tonumber"); ok {
-		return evalLuaConcat(inner, env)
-	}
-	if value, ok := env[op]; ok {
-		return value, true
-	}
-	return "", false
-}
-
-func splitLuaConcat(expr string) []string {
-	var parts []string
-	parenDepth, braceDepth, bracketDepth := 0, 0, 0
-	inStr := byte(0)
-	esc := false
-	start := 0
-	for i := 0; i < len(expr); i++ {
-		c := expr[i]
-		if inStr != 0 {
-			switch {
-			case esc:
-				esc = false
-			case c == '\\' && inStr == '"':
-				esc = true
-			case c == inStr:
-				inStr = 0
-			}
-			continue
-		}
-		switch c {
-		case '"', '\'':
-			inStr = c
-		case '(':
-			parenDepth++
-		case ')':
-			if parenDepth > 0 {
-				parenDepth--
-			}
-		case '{':
-			braceDepth++
-		case '}':
-			if braceDepth > 0 {
-				braceDepth--
-			}
-		case '[':
-			bracketDepth++
-		case ']':
-			if bracketDepth > 0 {
-				bracketDepth--
-			}
-		case '.':
-			if parenDepth == 0 && braceDepth == 0 && bracketDepth == 0 && i+1 < len(expr) && expr[i+1] == '.' {
-				parts = append(parts, expr[start:i])
-				i++
-				start = i + 1
-			}
-		}
-	}
-	return append(parts, expr[start:])
-}
-
-func substituteLuaIdent(line, name, value string) string {
-	if !strings.Contains(line, name) {
-		return line
-	}
-	var sb strings.Builder
-	inStr := byte(0)
-	esc := false
-	for i := 0; i < len(line); {
-		c := line[i]
-		if inStr != 0 {
-			sb.WriteByte(c)
-			switch {
-			case esc:
-				esc = false
-			case c == '\\' && inStr == '"':
-				esc = true
-			case c == inStr:
-				inStr = 0
-			}
-			i++
-			continue
-		}
-		if c == '"' || c == '\'' {
-			inStr = c
-			sb.WriteByte(c)
-			i++
-			continue
-		}
-		if isLuaIdentStart(c) {
-			j := i + 1
-			for j < len(line) && isLuaIdentByte(line[j]) {
-				j++
-			}
-			word := line[i:j]
-			if word == name && (i == 0 || line[i-1] != '.') {
-				sb.WriteString(value)
-			} else {
-				sb.WriteString(word)
-			}
-			i = j
-			continue
-		}
-		sb.WriteByte(c)
-		i++
-	}
-	return sb.String()
-}
-
-func luaMaskStrings(line string) string {
-	b := []byte(line)
-	inStr := byte(0)
-	esc := false
-	for i := 0; i < len(b); i++ {
-		c := b[i]
-		if inStr != 0 {
-			wasEnd := !esc && c == inStr
-			esc = !esc && c == '\\' && inStr == '"'
-			b[i] = ' '
-			if wasEnd {
-				inStr = 0
-			}
-			continue
-		}
-		switch c {
-		case '"', '\'':
-			inStr = c
-			b[i] = ' '
-		case '-':
-			if i+1 < len(b) && b[i+1] == '-' {
-				for ; i < len(b); i++ {
-					b[i] = ' '
-				}
-			}
-		}
-	}
-	return string(b)
-}
-
-func luaStripLineComment(line string) string {
-	inStr := byte(0)
-	esc := false
-	for i := 0; i+1 < len(line); i++ {
-		c := line[i]
-		if inStr != 0 {
-			switch {
-			case esc:
-				esc = false
-			case c == '\\' && inStr == '"':
-				esc = true
-			case c == inStr:
-				inStr = 0
-			}
-			continue
-		}
-		switch c {
-		case '"', '\'':
-			inStr = c
-		case '-':
-			if line[i+1] == '-' {
-				return line[:i]
-			}
-		}
-	}
-	return line
-}
-
-func luaUnwrapCall(op, fn string) (string, bool) {
-	op = strings.TrimSpace(op)
-	if !strings.HasPrefix(op, fn) {
-		return "", false
-	}
-	rest := strings.TrimSpace(op[len(fn):])
-	if !strings.HasPrefix(rest, "(") || !strings.HasSuffix(rest, ")") {
-		return "", false
-	}
-	return rest[1 : len(rest)-1], true
-}
-
-func isLuaPlainStringArg(expr string) bool {
-	expr = strings.TrimSpace(expr)
-	if expr == "" || (expr[0] != '"' && expr[0] != '\'') {
-		return false
-	}
-	_, next, ok := parseLuaStringLiteral(expr, 0)
-	return ok && next == len(expr)
-}
-
-func isLuaIdentStart(c byte) bool {
-	return c == '_' || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
-}
-
-func cloneLuaEnv(env luaVarEnv) luaVarEnv {
-	clone := make(luaVarEnv, len(env))
-	maps.Copy(clone, env)
-	return clone
-}

core/internal/keybinds/providers/hyprland_lua_expand_test.go

@@ -1,134 +0,0 @@
-package providers
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestExpandLuaConfigLinesVariableConcat(t *testing.T) {
-	lines := []string{
-		`local mainMod = "SUPER"`,
-		`hl.bind(mainMod .. " + C", hl.dsp.window.close())`,
-		`hl.bind(mainMod .. " + H", hl.dsp.focus({direction = "l"}))`,
-		`hl.bind("ALT + TAB", hl.dsp.window.cycle_next({}))`,
-	}
-	got := expandLuaConfigLines(lines)
-
-	want := []string{
-		`hl.bind("SUPER + C",`,
-		`hl.bind("SUPER + H",`,
-		`hl.bind("ALT + TAB",`,
-	}
-	joined := strings.Join(got, "\n")
-	for _, w := range want {
-		if !strings.Contains(joined, w) {
-			t.Errorf("expanded output missing %q\n---\n%s", w, joined)
-		}
-	}
-}
-
-func TestExpandLuaConfigLinesForLoop(t *testing.T) {
-	lines := []string{
-		`local mainMod = "SUPER"`,
-		`for i = 1, 3 do`,
-		`    hl.bind(mainMod .. " + " .. i, hl.dsp.focus({workspace = tostring(i)}))`,
-		`    hl.bind(mainMod .. " SHIFT + " .. i, hl.dsp.window.move({workspace = tostring(i)}))`,
-		`end`,
-	}
-	got := strings.Join(expandLuaConfigLines(lines), "\n")
-
-	for _, w := range []string{
-		`hl.bind("SUPER + 1",`,
-		`hl.bind("SUPER + 2",`,
-		`hl.bind("SUPER + 3",`,
-		`hl.bind("SUPER SHIFT + 3",`,
-		`{workspace = "1"}`,
-	} {
-		if !strings.Contains(got, w) {
-			t.Errorf("expanded loop missing %q\n---\n%s", w, got)
-		}
-	}
-}
-
-func TestParseLuaLinesDynamicBinds(t *testing.T) {
-	content := strings.Join([]string{
-		`local mainMod = "SUPER"`,
-		`hl.bind(mainMod .. " + C", hl.dsp.window.close())`,
-		`hl.bind("ALT + TAB", hl.dsp.window.cycle_next({}))`,
-		`for i = 1, 2 do`,
-		`    hl.bind(mainMod .. " + " .. i, hl.dsp.focus({workspace = tostring(i)}))`,
-		`end`,
-	}, "\n")
-
-	parser := NewHyprlandParser("")
-	section, err := parser.parseLuaLines(content, "", "test.lua", "")
-	if err != nil {
-		t.Fatalf("parseLuaLines: %v", err)
-	}
-
-	keys := map[string]*HyprlandKeyBinding{}
-	for i := range section.Keybinds {
-		kb := &section.Keybinds[i]
-		keys[parser.formatBindKey(kb)] = kb
-	}
-
-	for _, want := range []string{"SUPER+C", "ALT+TAB", "SUPER+1", "SUPER+2"} {
-		if _, ok := keys[want]; !ok {
-			t.Errorf("missing bind %q; got %v", want, keysList(keys))
-		}
-	}
-	if kb := keys["SUPER+C"]; kb != nil && kb.Dispatcher != "killactive" {
-		t.Errorf("SUPER+C dispatcher = %q, want killactive", kb.Dispatcher)
-	}
-	if kb := keys["SUPER+1"]; kb != nil {
-		if kb.Dispatcher != "workspace" || kb.Params != "1" {
-			t.Errorf("SUPER+1 = %q %q, want workspace 1", kb.Dispatcher, kb.Params)
-		}
-	}
-}
-
-func keysList(m map[string]*HyprlandKeyBinding) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	return out
-}
-
-func TestEvalLuaConcat(t *testing.T) {
-	env := luaVarEnv{"mainMod": "SUPER", "i": "5"}
-	tests := []struct {
-		expr string
-		want string
-		ok   bool
-	}{
-		{`mainMod .. " + C"`, "SUPER + C", true},
-		{`mainMod .. " + " .. i`, "SUPER + 5", true},
-		{`mainMod .. " + " .. tostring(i)`, "SUPER + 5", true},
-		{`"ALT + TAB"`, "ALT + TAB", true},
-		{`mainMod .. someFunc()`, "", false},
-		{`unknownVar .. "x"`, "", false},
-	}
-	for _, tt := range tests {
-		got, ok := evalLuaConcat(tt.expr, env)
-		if ok != tt.ok || (ok && got != tt.want) {
-			t.Errorf("evalLuaConcat(%q) = %q,%v want %q,%v", tt.expr, got, ok, tt.want, tt.ok)
-		}
-	}
-}
-
-func TestSubstituteLuaIdent(t *testing.T) {
-	tests := []struct {
-		line, name, value, want string
-	}{
-		{`hl.bind(m .. " + " .. i, x)`, "i", "3", `hl.bind(m .. " + " .. 3, x)`},
-		{`hl.dsp.exec("light -i")`, "i", "3", `hl.dsp.exec("light -i")`},
-		{`foo.i`, "i", "3", `foo.i`},
-		{`tostring(i)`, "i", "3", `tostring(3)`},
-	}
-	for _, tt := range tests {
-		if got := substituteLuaIdent(tt.line, tt.name, tt.value); got != tt.want {
-			t.Errorf("substituteLuaIdent(%q,%q,%q) = %q, want %q", tt.line, tt.name, tt.value, got, tt.want)
-		}
-	}
-}

core/internal/keybinds/providers/hyprland_parser.go

@@ -623,7 +623,7 @@ func (p *HyprlandParser) parseLuaLines(content string, baseDir, absPath, section
 	prevSource := p.currentSource
 	p.currentSource = absPath
 
-	lines := expandLuaConfigLines(strings.Split(content, "\n"))
+	lines := strings.Split(content, "\n")
 	boundInFile := make(map[string]bool)
 	for _, line := range lines {
 		trimmed := strings.TrimSpace(line)

core/internal/keybinds/providers/hyprland_parser_test.go

@@ -147,10 +147,9 @@ hl.bind("SUPER + N", hl.dsp.exec_cmd("dms ipc call notepad toggle"), { descripti
 func TestWriteLuaBindLineLeavesCustomLuaDispatcherRaw(t *testing.T) {
 	var sb strings.Builder
 	writeLuaBindLine(&sb, &hyprlandOverrideBind{
-		Key:          "Super+u",
-		Action:       "hl.dsp.no_op()",
-		Description:  "Custom Lua",
-		RawLuaAction: true,
+		Key:         "Super+u",
+		Action:      "hl.dsp.no_op()",
+		Description: "Custom Lua",
 	})
 
 	want := `hl.unbind("SUPER + U")
@@ -160,24 +159,6 @@ hl.bind("SUPER + U", hl.dsp.no_op(), { description = "Custom Lua" })`
 	}
 }
 
-func TestWriteLuaBindLineQuotesUnrecognizedActionWithoutRawLuaFlag(t *testing.T) {
-	var sb strings.Builder
-	writeLuaBindLine(&sb, &hyprlandOverrideBind{
-		Key:    "Super+u",
-		Action: `customdispatcher "),os.execute("id")--`,
-	})
-
-	got := sb.String()
-	if !strings.Contains(got, "hl.exec_cmd(") {
-		t.Fatalf("expected unrecognized action to go through the hyprctl-dispatch wrapper, got %q", got)
-	}
-	// an unpaired bare quote means the action broke out of its string literal
-	withoutEscapedQuotes := strings.ReplaceAll(got, `\"`, "")
-	if n := strings.Count(withoutEscapedQuotes, `"`); n%2 != 0 {
-		t.Fatalf("action broke out of its string literal (%d unpaired quotes): %q", n, got)
-	}
-}
-
 func TestLuaActionStringFromHyprlangActionUsesNativeDispatchers(t *testing.T) {
 	tests := []struct {
 		action string
@@ -245,12 +226,15 @@ func TestParseLuaBindLineHandlesFunctionDispatcherFallback(t *testing.T) {
 	}
 }
 
-func TestLuaActionStringFromHyprlangActionAlwaysQuotesUnrecognizedText(t *testing.T) {
+func TestLuaActionStringLeavesCustomLuaDispatcherRaw(t *testing.T) {
 	got := luaActionStringFromHyprlangAction("hl.dsp.no_op()")
-	want := `function() hl.exec_cmd("hyprctl dispatch hl.dsp.no_op()") end`
+	want := `hl.dsp.no_op()`
 	if got != want {
 		t.Fatalf("luaActionStringFromHyprlangAction() = %q, want %q", got, want)
 	}
+	if strings.Contains(got, "hl.dispatch") || strings.Contains(got, "hyprctl dispatch") {
+		t.Fatalf("expected custom Lua dispatcher expression to stay raw, got %q", got)
+	}
 }
 
 func TestReadLuaOverrideMigratesTrailingCommentToDescription(t *testing.T) {

core/internal/log/log.go

@@ -1,32 +1,213 @@
 package log
 
 import (
-	danklog "github.com/AvengeMedia/dankgo/log"
+	"io"
+	"os"
+	"regexp"
+	"strings"
+	"sync"
+
+	"github.com/charmbracelet/lipgloss"
+	cblog "github.com/charmbracelet/log"
+	"github.com/mattn/go-isatty"
+	"github.com/muesli/termenv"
 )
 
-type Logger = danklog.Logger
+// Logger embeds the Charm Logger and adds Printf/Fatalf
+type Logger struct{ *cblog.Logger }
 
-func init() {
-	danklog.SetEnvPrefix("DMS")
+// Printf routes goose/info-style logs through Infof.
+func (l *Logger) Printf(format string, v ...any) { l.Infof(format, v...) }
+
+// Fatalf keeps goose’s contract of exiting the program.
+func (l *Logger) Fatalf(format string, v ...any) { l.Logger.Fatalf(format, v...) }
+
+var (
+	logger     *Logger
+	initLogger sync.Once
+
+	logMu     sync.Mutex
+	logFile   *os.File
+	logStderr io.Writer = os.Stderr
+
+	ansiRe = regexp.MustCompile(`\x1b\[[0-9;]*[a-zA-Z]`)
+)
+
+// ansiStripWriter strips ANSI escape sequences before forwarding to w. Used
+// for the file sink so colored stderr stays colored while the file stays plain.
+type ansiStripWriter struct{ w io.Writer }
+
+func (a *ansiStripWriter) Write(p []byte) (int, error) {
+	stripped := ansiRe.ReplaceAll(p, nil)
+	if _, err := a.w.Write(stripped); err != nil {
+		return 0, err
+	}
+	return len(p), nil
 }
 
-func GetLogger() *Logger { return danklog.GetLogger() }
+func parseLogLevel(level string) cblog.Level {
+	switch strings.ToLower(level) {
+	case "debug":
+		return cblog.DebugLevel
+	case "info":
+		return cblog.InfoLevel
+	case "warn", "warning":
+		return cblog.WarnLevel
+	case "error":
+		return cblog.ErrorLevel
+	case "fatal":
+		return cblog.FatalLevel
+	default:
+		return cblog.InfoLevel
+	}
+}
 
-func GetQtLoggingRules() string { return danklog.GetQtLoggingRules() }
+func GetQtLoggingRules() string {
+	level := os.Getenv("DMS_LOG_LEVEL")
+	if level == "" {
+		level = "info"
+	}
 
-func SetLevel(level string) { danklog.SetLevel(level) }
+	var rules []string
+	switch strings.ToLower(level) {
+	case "fatal":
+		rules = []string{"*.debug=false", "*.info=false", "*.warning=false", "*.critical=false"}
+	case "error":
+		rules = []string{"*.debug=false", "*.info=false", "*.warning=false"}
+	case "warn", "warning":
+		rules = []string{"*.debug=false", "*.info=false"}
+	case "info":
+		rules = []string{"*.debug=false"}
+	case "debug":
+		return ""
+	default:
+		rules = []string{"*.debug=false"}
+	}
 
-func SetLogFile(path string) error { return danklog.SetLogFile(path) }
+	return strings.Join(rules, ";")
+}
 
-func ApplyEnvOverrides() { danklog.ApplyEnvOverrides() }
+// GetLogger returns a logger instance
+func GetLogger() *Logger {
+	initLogger.Do(func() {
+		styles := cblog.DefaultStyles()
+		// Attempt to match the colors used by qml/quickshell logs
+		styles.Levels[cblog.FatalLevel] = lipgloss.NewStyle().
+			SetString(" FATAL").
+			Foreground(lipgloss.Color("1"))
+		styles.Levels[cblog.ErrorLevel] = lipgloss.NewStyle().
+			SetString(" ERROR").
+			Foreground(lipgloss.Color("9"))
+		styles.Levels[cblog.WarnLevel] = lipgloss.NewStyle().
+			SetString("  WARN").
+			Foreground(lipgloss.Color("3"))
+		styles.Levels[cblog.InfoLevel] = lipgloss.NewStyle().
+			SetString("  INFO").
+			Foreground(lipgloss.Color("2"))
+		styles.Levels[cblog.DebugLevel] = lipgloss.NewStyle().
+			SetString(" DEBUG").
+			Foreground(lipgloss.Color("4"))
 
-func Debug(msg any, keyvals ...any)  { danklog.Debug(msg, keyvals...) }
-func Debugf(format string, v ...any) { danklog.Debugf(format, v...) }
-func Info(msg any, keyvals ...any)   { danklog.Info(msg, keyvals...) }
-func Infof(format string, v ...any)  { danklog.Infof(format, v...) }
-func Warn(msg any, keyvals ...any)   { danklog.Warn(msg, keyvals...) }
-func Warnf(format string, v ...any)  { danklog.Warnf(format, v...) }
-func Error(msg any, keyvals ...any)  { danklog.Error(msg, keyvals...) }
-func Errorf(format string, v ...any) { danklog.Errorf(format, v...) }
-func Fatal(msg any, keyvals ...any)  { danklog.Fatal(msg, keyvals...) }
-func Fatalf(format string, v ...any) { danklog.Fatalf(format, v...) }
+		base := cblog.New(logStderr)
+		base.SetStyles(styles)
+		base.SetReportTimestamp(false)
+
+		level := cblog.InfoLevel
+		if envLevel := os.Getenv("DMS_LOG_LEVEL"); envLevel != "" {
+			level = parseLogLevel(envLevel)
+		}
+		base.SetLevel(level)
+		base.SetPrefix(" go")
+
+		logger = &Logger{base}
+
+		if path := os.Getenv("DMS_LOG_FILE"); path != "" {
+			_ = SetLogFile(path)
+		}
+	})
+	return logger
+}
+
+// SetLevel updates the active log level. Accepts the same strings as
+// DMS_LOG_LEVEL. Unknown values default to info.
+func SetLevel(level string) {
+	GetLogger().SetLevel(parseLogLevel(level))
+}
+
+// SetLogFile makes the logger append to path in addition to stderr. Passing an
+// empty string detaches the file sink. Atomic per-line writes (≤PIPE_BUF) on
+// O_APPEND keep concurrent Go and QML writers from corrupting each other.
+//
+// Color handling: charmbracelet/log auto-detects color support from its
+// io.Writer, and io.MultiWriter doesn't pass that through, so we force the ANSI
+// profile when stderr is a TTY and route the file through ansiStripWriter so
+// the file stays plain while stderr keeps its colors.
+func SetLogFile(path string) error {
+	logMu.Lock()
+	defer logMu.Unlock()
+
+	if logFile != nil {
+		logFile.Close()
+		logFile = nil
+	}
+
+	l := GetLogger()
+	if path == "" {
+		l.SetOutput(logStderr)
+		applyColorProfile(l, logStderr)
+		return nil
+	}
+
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_APPEND|os.O_CREATE, 0o644)
+	if err != nil {
+		return err
+	}
+	logFile = f
+	out := io.MultiWriter(logStderr, &ansiStripWriter{w: f})
+	l.SetOutput(out)
+	applyColorProfile(l, logStderr)
+	return nil
+}
+
+// applyColorProfile forces the renderer's color profile to match what stderr
+// would produce on its own, undoing the auto-downgrade triggered by wrapping
+// stderr in a non-TTY writer (e.g. io.MultiWriter).
+func applyColorProfile(l *Logger, stderr io.Writer) {
+	f, ok := stderr.(*os.File)
+	if !ok {
+		l.SetColorProfile(termenv.Ascii)
+		return
+	}
+	if isatty.IsTerminal(f.Fd()) {
+		l.SetColorProfile(termenv.ANSI)
+		return
+	}
+	l.SetColorProfile(termenv.Ascii)
+}
+
+// ApplyEnvOverrides re-reads DMS_LOG_LEVEL and DMS_LOG_FILE and reconfigures
+// the singleton. Safe to call after CLI flags have rewritten the environment.
+func ApplyEnvOverrides() {
+	GetLogger()
+	if level := os.Getenv("DMS_LOG_LEVEL"); level != "" {
+		SetLevel(level)
+	}
+	if path := os.Getenv("DMS_LOG_FILE"); path != "" {
+		if err := SetLogFile(path); err != nil {
+			Warnf("Failed to open log file %q: %v", path, err)
+		}
+	}
+}
+
+// * Convenience wrappers
+
+func Debug(msg any, keyvals ...any)  { GetLogger().Debug(msg, keyvals...) }
+func Debugf(format string, v ...any) { GetLogger().Debugf(format, v...) }
+func Info(msg any, keyvals ...any)   { GetLogger().Info(msg, keyvals...) }
+func Infof(format string, v ...any)  { GetLogger().Infof(format, v...) }
+func Warn(msg any, keyvals ...any)   { GetLogger().Warn(msg, keyvals...) }
+func Warnf(format string, v ...any)  { GetLogger().Warnf(format, v...) }
+func Error(msg any, keyvals ...any)  { GetLogger().Error(msg, keyvals...) }
+func Errorf(format string, v ...any) { GetLogger().Errorf(format, v...) }
+func Fatal(msg any, keyvals ...any)  { GetLogger().Fatal(msg, keyvals...) }
+func Fatalf(format string, v ...any) { GetLogger().Fatalf(format, v...) }

core/internal/matugen/matugen.go

@@ -44,7 +44,6 @@ type TemplateDef struct {
 	ID                 string
 	Commands           []string
 	Flatpaks           []string
-	ConfigDirs         []string
 	ConfigFile         string
 	Kind               TemplateKind
 	RunUnconditionally bool
@@ -61,9 +60,9 @@ var templateRegistry = []TemplateDef{
 	{ID: "firefox", Commands: []string{"firefox"}, ConfigFile: "firefox.toml"},
 	{ID: "pywalfox", Commands: []string{"pywalfox"}, ConfigFile: "pywalfox.toml"},
 	{ID: "zenbrowser", Commands: []string{"zen", "zen-browser", "zen-beta", "zen-twilight"}, Flatpaks: []string{"app.zen_browser.zen"}, ConfigFile: "zenbrowser.toml"},
-	{ID: "vesktop", Commands: []string{"vesktop"}, Flatpaks: []string{"dev.vencord.Vesktop"}, ConfigDirs: []string{"vesktop"}, ConfigFile: "vesktop.toml"},
-	{ID: "vencord", Commands: []string{"discord", "Discord", "discord-canary", "DiscordCanary"}, Flatpaks: []string{"com.discordapp.Discord", "com.discordapp.DiscordCanary"}, ConfigDirs: []string{"Vencord"}, ConfigFile: "vencord.toml"},
-	{ID: "equibop", Commands: []string{"equibop"}, ConfigDirs: []string{"equibop"}, ConfigFile: "equibop.toml"},
+	{ID: "vesktop", Commands: []string{"vesktop"}, Flatpaks: []string{"dev.vencord.Vesktop"}, ConfigFile: "vesktop.toml"},
+	{ID: "vencord", Commands: []string{"discord", "Discord", "discord-canary", "DiscordCanary"}, Flatpaks: []string{"com.discordapp.Discord", "com.discordapp.DiscordCanary"}, ConfigFile: "vencord.toml"},
+	{ID: "equibop", Commands: []string{"equibop"}, ConfigFile: "equibop.toml"},
 	{ID: "ghostty", Commands: []string{"ghostty"}, ConfigFile: "ghostty.toml", Kind: TemplateKindTerminal},
 	{ID: "kitty", Commands: []string{"kitty"}, ConfigFile: "kitty.toml", Kind: TemplateKindTerminal},
 	{ID: "foot", Commands: []string{"foot"}, ConfigFile: "foot.toml", Kind: TemplateKindTerminal},
@@ -261,15 +260,15 @@ func Run(opts Options) error {
 		return buildErr
 	}
 
-	if opts.SyncModeWithPortal {
-		syncColorScheme(opts.Mode)
-	}
-
 	if !changed {
 		log.Info("No color changes detected, skipping refresh")
 		return ErrNoChanges
 	}
 
+	if opts.SyncModeWithPortal {
+		syncColorScheme(opts.Mode)
+	}
+
 	log.Info("Done")
 	return nil
 }
@@ -390,10 +389,6 @@ func buildOnce(opts *Options) (bool, error) {
 		refreshGTK4()
 	}
 
-	if isDMSKDEColorSchemeActive(opts.ConfigDir) {
-		applyKDEColorScheme(opts.Mode)
-	}
-
 	if !opts.ShouldSkipTemplate("qt6ct") && appExists(opts.AppChecker, []string{"qt6ct"}, nil) {
 		refreshQt6ct()
 	}
@@ -464,9 +459,9 @@ output_path = '%s'
 		case TemplateKindGTK:
 			switch opts.Mode {
 			case ColorModeLight:
-				appendConfig(opts, cfgFile, nil, nil, nil, "gtk3-light.toml")
+				appendConfig(opts, cfgFile, nil, nil, "gtk3-light.toml")
 			default:
-				appendConfig(opts, cfgFile, nil, nil, nil, "gtk3-dark.toml")
+				appendConfig(opts, cfgFile, nil, nil, "gtk3-dark.toml")
 			}
 		case TemplateKindTerminal:
 			appendTerminalConfig(opts, cfgFile, tmpDir, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
@@ -479,10 +474,10 @@ output_path = '%s'
 			appendVSCodeConfig(cfgFile, "vscode-insiders", filepath.Join(homeDir, ".vscode-insiders/extensions"), opts.ShellDir)
 		case TemplateKindEmacs:
 			if utils.EmacsConfigDir() != "" {
-				appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigDirs, tmpl.ConfigFile)
+				appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
 			}
 		default:
-			appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigDirs, tmpl.ConfigFile)
+			appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
 		}
 	}
 
@@ -517,14 +512,13 @@ func appendConfig(
 	cfgFile *os.File,
 	checkCmd []string,
 	checkFlatpaks []string,
-	checkConfigDirs []string,
 	fileName string,
 ) {
 	configPath := filepath.Join(opts.ShellDir, "matugen", "configs", fileName)
 	if _, err := os.Stat(configPath); err != nil {
 		return
 	}
-	if !appExists(opts.AppChecker, checkCmd, checkFlatpaks) && !configDirExists(checkConfigDirs) {
+	if !appExists(opts.AppChecker, checkCmd, checkFlatpaks) {
 		return
 	}
 	data, err := os.ReadFile(configPath)
@@ -605,20 +599,6 @@ func templateSessionActive(tmpl TemplateDef) bool {
 	return err == nil
 }
 
-func configDirExists(names []string) bool {
-	configHome := utils.XDGConfigHome()
-	if configHome == "" {
-		return false
-	}
-	for _, name := range names {
-		info, err := os.Stat(filepath.Join(configHome, name))
-		if err == nil && info.IsDir() {
-			return true
-		}
-	}
-	return false
-}
-
 func appExists(checker utils.AppChecker, checkCmd []string, checkFlatpaks []string) bool {
 	// Both nil is treated as "skip check" / unconditionally run
 	if checkCmd == nil && checkFlatpaks == nil {
@@ -927,47 +907,6 @@ func isDMSGTKActive(configDir string) bool {
 	return err == nil && strings.Contains(string(data), "dank-colors.css")
 }
 
-// isDMSKDEColorSchemeActive only flips the scheme when the user is already on a
-// DankMatugen one, leaving Breeze (or anything else) untouched.
-func isDMSKDEColorSchemeActive(configDir string) bool {
-	data, err := os.ReadFile(filepath.Join(configDir, "kdeglobals"))
-	if err != nil {
-		return false
-	}
-
-	inGeneral := false
-	for _, line := range strings.Split(string(data), "\n") {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "[") {
-			inGeneral = line == "[General]"
-			continue
-		}
-		if !inGeneral {
-			continue
-		}
-		if name, ok := strings.CutPrefix(line, "ColorScheme="); ok {
-			return strings.HasPrefix(strings.TrimSpace(name), "DankMatugen")
-		}
-	}
-	return false
-}
-
-func applyKDEColorScheme(mode ColorMode) {
-	if !utils.CommandExists("plasma-apply-colorscheme") {
-		return
-	}
-
-	scheme := "DankMatugenDark"
-	if mode == ColorModeLight {
-		scheme = "DankMatugenLight"
-	}
-
-	log.Infof("Applying KDE color scheme: %s", scheme)
-	if err := exec.Command("plasma-apply-colorscheme", scheme).Run(); err != nil {
-		log.Warnf("Failed to apply KDE color scheme: %v", err)
-	}
-}
-
 func refreshGTK(mode ColorMode) {
 	if err := utils.GsettingsSet("org.gnome.desktop.interface", "gtk-theme", ""); err != nil {
 		log.Warnf("Failed to reset gtk-theme: %v", err)
@@ -1041,19 +980,32 @@ func signalTerminals(opts *Options) {
 	}
 }
 
+func signalByName(name string, sig syscall.Signal) {
+	entries, err := os.ReadDir("/proc")
+	if err != nil {
+		return
+	}
+	for _, entry := range entries {
+		pid, err := strconv.Atoi(entry.Name())
+		if err != nil {
+			continue
+		}
+		comm, err := os.ReadFile(filepath.Join("/proc", entry.Name(), "comm"))
+		if err != nil {
+			continue
+		}
+		if strings.TrimSpace(string(comm)) == name {
+			syscall.Kill(pid, sig)
+		}
+	}
+}
+
 func syncColorScheme(mode ColorMode) {
 	scheme := "prefer-dark"
 	if mode == ColorModeLight {
 		scheme = "default"
 	}
 
-	if cur, err := utils.GsettingsGet("org.gnome.desktop.interface", "color-scheme"); err == nil {
-		cur = strings.Trim(cur, "'")
-		if cur == scheme || (mode == ColorModeLight && cur == "prefer-light") {
-			return
-		}
-	}
-
 	if err := utils.GsettingsSet("org.gnome.desktop.interface", "color-scheme", scheme); err != nil {
 		log.Warnf("Failed to sync color-scheme: %v", err)
 	}
@@ -1104,9 +1056,6 @@ func closestAdwaitaAccent(primaryHex string) string {
 
 func syncAccentColor(primaryHex string) {
 	accent := closestAdwaitaAccent(primaryHex)
-	if cur, err := utils.GsettingsGet("org.gnome.desktop.interface", "accent-color"); err == nil && strings.Trim(cur, "'") == accent {
-		return
-	}
 	log.Infof("Setting GNOME accent color: %s", accent)
 	if err := utils.GsettingsSet("org.gnome.desktop.interface", "accent-color", accent); err != nil {
 		log.Warnf("Failed to set accent-color: %v", err)
@@ -1137,7 +1086,7 @@ func CheckTemplates(checker utils.AppChecker) []TemplateCheck {
 		case tmpl.Kind == TemplateKindEmacs:
 			detected = appExists(checker, tmpl.Commands, tmpl.Flatpaks) && utils.EmacsConfigDir() != ""
 		default:
-			detected = (appExists(checker, tmpl.Commands, tmpl.Flatpaks) || configDirExists(tmpl.ConfigDirs)) && templateSessionActive(tmpl)
+			detected = appExists(checker, tmpl.Commands, tmpl.Flatpaks) && templateSessionActive(tmpl)
 		}
 
 		checks = append(checks, TemplateCheck{ID: tmpl.ID, Detected: detected})

core/internal/matugen/matugen_test.go

@@ -38,7 +38,7 @@ func TestAppendConfigBinaryExists(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, []string{"sh"}, nil, nil, "test.toml")
+	appendConfig(opts, cfgFile, []string{"sh"}, nil, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -82,7 +82,7 @@ func TestAppendConfigBinaryDoesNotExist(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{}, nil, "test.toml")
+	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{}, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -122,7 +122,7 @@ func TestAppendConfigFlatpakExists(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, nil, []string{"app.zen_browser.zen"}, nil, "test.toml")
+	appendConfig(opts, cfgFile, nil, []string{"app.zen_browser.zen"}, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -163,7 +163,7 @@ func TestAppendConfigFlatpakDoesNotExist(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, []string{}, []string{"com.nonexistent.flatpak"}, nil, "test.toml")
+	appendConfig(opts, cfgFile, []string{}, []string{"com.nonexistent.flatpak"}, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -203,7 +203,7 @@ func TestAppendConfigBothExist(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, []string{"sh"}, []string{"app.zen_browser.zen"}, nil, "test.toml")
+	appendConfig(opts, cfgFile, []string{"sh"}, []string{"app.zen_browser.zen"}, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -244,7 +244,7 @@ func TestAppendConfigNeitherExists(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
 
-	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{"com.nonexistent.flatpak"}, nil, "test.toml")
+	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{"com.nonexistent.flatpak"}, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -281,7 +281,7 @@ func TestAppendConfigNoChecks(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir}
 
-	appendConfig(opts, cfgFile, nil, nil, nil, "test.toml")
+	appendConfig(opts, cfgFile, nil, nil, "test.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -312,7 +312,7 @@ func TestAppendConfigFileDoesNotExist(t *testing.T) {
 
 	opts := &Options{ShellDir: shellDir}
 
-	appendConfig(opts, cfgFile, nil, nil, nil, "nonexistent.toml")
+	appendConfig(opts, cfgFile, nil, nil, "nonexistent.toml")
 
 	cfgFile.Close()
 	output, err := os.ReadFile(outFile)
@@ -487,90 +487,3 @@ func TestBuildMergedConfigSkipsMangowcWithoutActiveSession(t *testing.T) {
 	}
 	assert.NotContains(t, string(output), "[templates.dmsmango]")
 }
-
-func TestAppendConfigConfigDirExists(t *testing.T) {
-	tempDir := t.TempDir()
-
-	shellDir := filepath.Join(tempDir, "shell")
-	configsDir := filepath.Join(shellDir, "matugen", "configs")
-	if err := os.MkdirAll(configsDir, 0o755); err != nil {
-		t.Fatalf("failed to create configs dir: %v", err)
-	}
-
-	testConfig := "vencord config content"
-	if err := os.WriteFile(filepath.Join(configsDir, "vencord.toml"), []byte(testConfig), 0o644); err != nil {
-		t.Fatalf("failed to write config: %v", err)
-	}
-
-	configHome := filepath.Join(tempDir, "config")
-	if err := os.MkdirAll(filepath.Join(configHome, "Vencord"), 0o755); err != nil {
-		t.Fatalf("failed to create Vencord config dir: %v", err)
-	}
-	t.Setenv("XDG_CONFIG_HOME", configHome)
-
-	outFile := filepath.Join(tempDir, "output.toml")
-	cfgFile, err := os.Create(outFile)
-	if err != nil {
-		t.Fatalf("failed to create output file: %v", err)
-	}
-	defer cfgFile.Close()
-
-	mockChecker := mocks_utils.NewMockAppChecker(t)
-	mockChecker.EXPECT().AnyCommandExists("nonexistent-binary-12345").Return(false)
-	mockChecker.EXPECT().AnyFlatpakExists("com.nonexistent.flatpak").Return(false)
-
-	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
-
-	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{"com.nonexistent.flatpak"}, []string{"Vencord"}, "vencord.toml")
-
-	cfgFile.Close()
-	output, err := os.ReadFile(outFile)
-	if err != nil {
-		t.Fatalf("failed to read output: %v", err)
-	}
-
-	assert.Equal(t, testConfig+"\n", string(output))
-}
-
-func TestAppendConfigConfigDirDoesNotExist(t *testing.T) {
-	tempDir := t.TempDir()
-
-	shellDir := filepath.Join(tempDir, "shell")
-	configsDir := filepath.Join(shellDir, "matugen", "configs")
-	if err := os.MkdirAll(configsDir, 0o755); err != nil {
-		t.Fatalf("failed to create configs dir: %v", err)
-	}
-
-	if err := os.WriteFile(filepath.Join(configsDir, "vencord.toml"), []byte("vencord config content"), 0o644); err != nil {
-		t.Fatalf("failed to write config: %v", err)
-	}
-
-	configHome := filepath.Join(tempDir, "config")
-	if err := os.MkdirAll(configHome, 0o755); err != nil {
-		t.Fatalf("failed to create config home: %v", err)
-	}
-	t.Setenv("XDG_CONFIG_HOME", configHome)
-
-	outFile := filepath.Join(tempDir, "output.toml")
-	cfgFile, err := os.Create(outFile)
-	if err != nil {
-		t.Fatalf("failed to create output file: %v", err)
-	}
-	defer cfgFile.Close()
-
-	mockChecker := mocks_utils.NewMockAppChecker(t)
-	mockChecker.EXPECT().AnyCommandExists("nonexistent-binary-12345").Return(false)
-	mockChecker.EXPECT().AnyFlatpakExists("com.nonexistent.flatpak").Return(false)
-
-	opts := &Options{ShellDir: shellDir, AppChecker: mockChecker}
-
-	appendConfig(opts, cfgFile, []string{"nonexistent-binary-12345"}, []string{"com.nonexistent.flatpak"}, []string{"Vencord"}, "vencord.toml")
-
-	cfgFile.Close()
-	output, err := os.ReadFile(outFile)
-	if err != nil {
-		t.Fatalf("failed to read output: %v", err)
-	}
-
-	assert.Empty(t, string(output))
-}

core/internal/matugen/signal_freebsd.go

@@ -1,16 +0,0 @@
-package matugen
-
-import (
-	"os/exec"
-	"strings"
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-// procfs(5) is optional on FreeBSD; pkill(1) from base queries the kernel
-// directly.
-func signalByName(name string, sig syscall.Signal) {
-	signame := strings.TrimPrefix(unix.SignalName(sig), "SIG")
-	exec.Command("pkill", "-"+signame, "-x", name).Run()
-}

core/internal/matugen/signal_linux.go

@@ -1,29 +0,0 @@
-package matugen
-
-import (
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"syscall"
-)
-
-func signalByName(name string, sig syscall.Signal) {
-	entries, err := os.ReadDir("/proc")
-	if err != nil {
-		return
-	}
-	for _, entry := range entries {
-		pid, err := strconv.Atoi(entry.Name())
-		if err != nil {
-			continue
-		}
-		comm, err := os.ReadFile(filepath.Join("/proc", entry.Name(), "comm"))
-		if err != nil {
-			continue
-		}
-		if strings.TrimSpace(string(comm)) == name {
-			syscall.Kill(pid, sig)
-		}
-	}
-}

core/internal/pam/pam_test.go

@@ -18,6 +18,42 @@ func writeTestFile(t *testing.T, path string, content string) {
 	}
 }
 
+type pamTestEnv struct {
+	pamDir               string
+	greetdPath           string
+	dankshellPath        string
+	dankshellU2fPath     string
+	tmpDir               string
+	homeDir              string
+	availableModules     map[string]bool
+	fingerprintAvailable bool
+}
+
+func newPamTestEnv(t *testing.T) *pamTestEnv {
+	t.Helper()
+
+	root := t.TempDir()
+	pamDir := filepath.Join(root, "pam.d")
+	tmpDir := filepath.Join(root, "tmp")
+	homeDir := filepath.Join(root, "home")
+
+	for _, dir := range []string{pamDir, tmpDir, homeDir} {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatalf("failed to create %s: %v", dir, err)
+		}
+	}
+
+	return &pamTestEnv{
+		pamDir:           pamDir,
+		greetdPath:       filepath.Join(pamDir, "greetd"),
+		dankshellPath:    filepath.Join(pamDir, "dankshell"),
+		dankshellU2fPath: filepath.Join(pamDir, "dankshell-u2f"),
+		tmpDir:           tmpDir,
+		homeDir:          homeDir,
+		availableModules: map[string]bool{},
+	}
+}
+
 func (e *pamTestEnv) writePamFile(t *testing.T, name string, content string) {
 	t.Helper()
 	writeTestFile(t, filepath.Join(e.pamDir, name), content)
@@ -28,6 +64,59 @@ func (e *pamTestEnv) writeSettings(t *testing.T, content string) {
 	writeTestFile(t, filepath.Join(e.homeDir, ".config", "DankMaterialShell", "settings.json"), content)
 }
 
+func (e *pamTestEnv) deps(isNixOS bool) syncDeps {
+	return syncDeps{
+		pamDir:           e.pamDir,
+		greetdPath:       e.greetdPath,
+		dankshellPath:    e.dankshellPath,
+		dankshellU2fPath: e.dankshellU2fPath,
+		isNixOS:          func() bool { return isNixOS },
+		readFile:         os.ReadFile,
+		stat:             os.Stat,
+		createTemp: func(_ string, pattern string) (*os.File, error) {
+			return os.CreateTemp(e.tmpDir, pattern)
+		},
+		removeFile: os.Remove,
+		runSudoCmd: func(_ string, command string, args ...string) error {
+			switch command {
+			case "cp":
+				if len(args) != 2 {
+					return fmt.Errorf("unexpected cp args: %v", args)
+				}
+				data, err := os.ReadFile(args[0])
+				if err != nil {
+					return err
+				}
+				if err := os.MkdirAll(filepath.Dir(args[1]), 0o755); err != nil {
+					return err
+				}
+				return os.WriteFile(args[1], data, 0o644)
+			case "chmod":
+				if len(args) != 2 {
+					return fmt.Errorf("unexpected chmod args: %v", args)
+				}
+				return nil
+			case "rm":
+				if len(args) != 2 || args[0] != "-f" {
+					return fmt.Errorf("unexpected rm args: %v", args)
+				}
+				if err := os.Remove(args[1]); err != nil && !os.IsNotExist(err) {
+					return err
+				}
+				return nil
+			default:
+				return fmt.Errorf("unexpected sudo command: %s %v", command, args)
+			}
+		},
+		pamModuleExists: func(module string) bool {
+			return e.availableModules[module]
+		},
+		fingerprintAvailableForCurrentUser: func() bool {
+			return e.fingerprintAvailable
+		},
+	}
+}
+
 func readFileString(t *testing.T, path string) string {
 	t.Helper()
 	data, err := os.ReadFile(path)
@@ -157,31 +246,6 @@ func TestBuildManagedLockscreenPamContent(t *testing.T) {
 				"session optional pam_lastlog.so silent":   1,
 			},
 		},
-		{
-			name: "falls back to system-auth when login is absent",
-			files: map[string]string{
-				"system-auth": "#%PAM-1.0\nauth sufficient pam_unix.so try_first_pass nullok\naccount required pam_unix.so\n",
-			},
-			wantContains: []string{
-				"auth sufficient pam_unix.so try_first_pass nullok",
-				"account required pam_unix.so",
-			},
-		},
-		{
-			name: "no usable service when none of the candidates exist",
-			files: map[string]string{
-				"other": "#%PAM-1.0\nauth required pam_deny.so\n",
-			},
-			wantErr: "no usable PAM auth service found",
-		},
-		{
-			name: "existing login with bad include is authoritative and does not fall back",
-			files: map[string]string{
-				"login":       "#%PAM-1.0\nauth include missing-auth\n",
-				"system-auth": "#%PAM-1.0\nauth sufficient pam_unix.so\naccount required pam_unix.so\n",
-			},
-			wantErr: "failed to read PAM file",
-		},
 		{
 			name: "missing include fails",
 			files: map[string]string{
@@ -217,7 +281,7 @@ func TestBuildManagedLockscreenPamContent(t *testing.T) {
 				env.writePamFile(t, name, content)
 			}
 
-			content, err := buildManagedLockscreenPamContent([]string{env.pamDir}, os.ReadFile)
+			content, err := buildManagedLockscreenPamContent(env.pamDir, os.ReadFile)
 			if tt.wantErr != "" {
 				if err == nil {
 					t.Fatalf("expected error containing %q, got nil", tt.wantErr)
@@ -250,192 +314,6 @@ func TestBuildManagedLockscreenPamContent(t *testing.T) {
 	}
 }
 
-// Real /etc/pam.d layouts of the non-Arch-shaped distros (#2789).
-func TestBuildManagedLockscreenPamContent_DistroShapes(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name            string
-		files           map[string]string
-		wantContains    []string
-		wantNotContains []string
-	}{
-		{
-			// openSUSE: `include` (not @include), common-auth symlinked to
-			// common-auth-pc (here just a plain file), bracketed securetty
-			// control, keyring modules, pam_sss.
-			name: "openSUSE include + common-auth + bracket control",
-			files: map[string]string{
-				"login": "#%PAM-1.0\n" +
-					"auth     requisite      pam_nologin.so\n" +
-					"auth     [user_unknown=ignore success=ok ignore=ignore auth_err=die default=bad] pam_securetty.so\n" +
-					"auth     include        common-auth\n" +
-					"account  include        common-account\n" +
-					"session  required       pam_loginuid.so\n" +
-					"session  include        common-session\n",
-				"common-auth": "auth    required    pam_env.so\n" +
-					"auth    optional    pam_gnome_keyring.so\n" +
-					"auth    sufficient  pam_unix.so try_first_pass\n" +
-					"auth    required    pam_sss.so use_first_pass\n",
-				"common-account": "account required pam_unix.so try_first_pass\naccount sufficient pam_localuser.so\n",
-				"common-session": "session optional pam_gnome_keyring.so auto_start\n",
-			},
-			wantContains: []string{
-				"pam_securetty.so",
-				"auth    sufficient  pam_unix.so try_first_pass",
-				"auth    required    pam_sss.so use_first_pass",
-				"account required pam_unix.so try_first_pass",
-			},
-		},
-		{
-			name: "openSUSE without login stitches common-auth and common-account",
-			files: map[string]string{
-				"common-auth": "auth    required    pam_env.so\n" +
-					"auth    optional    pam_gnome_keyring.so\n" +
-					"auth    sufficient  pam_unix.so try_first_pass\n" +
-					"auth    required    pam_sss.so use_first_pass\n",
-				"common-account": "account required pam_unix.so try_first_pass\n" +
-					"account sufficient pam_localuser.so\n" +
-					"account required pam_sss.so use_first_pass\n",
-			},
-			wantContains: []string{
-				"auth    sufficient  pam_unix.so try_first_pass",
-				"auth    required    pam_sss.so use_first_pass",
-				"account required pam_unix.so try_first_pass",
-				"account required pam_sss.so use_first_pass",
-			},
-		},
-		{
-			name: "openSUSE with only common-auth resolves auth-only",
-			files: map[string]string{
-				"common-auth": "auth sufficient pam_unix.so try_first_pass\nauth required pam_deny.so\n",
-			},
-			wantContains: []string{"auth sufficient pam_unix.so try_first_pass"},
-			wantNotContains: []string{
-				"account",
-			},
-		},
-		{
-			name: "Debian @include common-auth and common-account",
-			files: map[string]string{
-				"login": "#%PAM-1.0\n" +
-					"auth       requisite  pam_nologin.so\n" +
-					"@include common-auth\n" +
-					"@include common-account\n" +
-					"session    required   pam_loginuid.so\n" +
-					"@include common-session\n",
-				"common-auth": "auth\t[success=1 default=ignore]\tpam_unix.so nullok\n" +
-					"auth\trequisite\t\t\tpam_deny.so\n" +
-					"auth\trequired\t\t\tpam_permit.so\n",
-				"common-account": "account\t[success=1 new_authtok_reqd=done default=ignore]\tpam_unix.so\naccount\trequisite\t\t\tpam_deny.so\n",
-				"common-session": "session\t[default=1]\t\t\tpam_permit.so\n",
-			},
-			wantContains: []string{
-				"auth\t[success=1 default=ignore]\tpam_unix.so nullok",
-				"account\t[success=1 new_authtok_reqd=done default=ignore]\tpam_unix.so",
-			},
-		},
-		{
-			name: "NixOS flat login with absolute paths and dash directives",
-			files: map[string]string{
-				"login": "#%PAM-1.0\n" +
-					"auth required /nix/store/abc-pam/lib/security/pam_unix.so likeauth nullok try_first_pass\n" +
-					"auth sufficient /nix/store/abc-pam-u2f/lib/security/pam_u2f.so\n" +
-					"-auth optional /nix/store/abc-kbd/lib/security/pam_gnome_keyring.so\n" +
-					"account required /nix/store/abc-pam/lib/security/pam_unix.so\n" +
-					"-session optional /nix/store/abc-sd/lib/security/pam_systemd.so\n",
-			},
-			wantContains: []string{
-				"auth required /nix/store/abc-pam/lib/security/pam_unix.so likeauth nullok try_first_pass",
-				"-auth optional /nix/store/abc-kbd/lib/security/pam_gnome_keyring.so",
-				"account required /nix/store/abc-pam/lib/security/pam_unix.so",
-			},
-			wantNotContains: []string{"pam_u2f"},
-		},
-		{
-			name: "Gentoo deep include chain login->system-local-login->system-login->system-auth",
-			files: map[string]string{
-				"login":              "#%PAM-1.0\nauth\tinclude\t\tsystem-local-login\naccount\tinclude\t\tsystem-local-login\n",
-				"system-local-login": "auth\trequired\tpam_group.so\nauth\tinclude\t\tsystem-login\naccount\tinclude\t\tsystem-login\n",
-				"system-login":       "auth\tinclude\t\tsystem-auth\naccount\tinclude\t\tsystem-auth\n",
-				"system-auth":        "auth\trequired\tpam_env.so\nauth\tsufficient\tpam_unix.so try_first_pass likeauth nullok\nauth\trequired\tpam_deny.so\naccount\trequired\tpam_unix.so\n",
-			},
-			wantContains: []string{
-				"auth\trequired\tpam_group.so",
-				"auth\tsufficient\tpam_unix.so try_first_pass likeauth nullok",
-				"account\trequired\tpam_unix.so",
-			},
-		},
-		{
-			name: "no login, entry falls through to system-auth",
-			files: map[string]string{
-				"system-auth": "#%PAM-1.0\n" +
-					"auth        required      pam_env.so\n" +
-					"auth        sufficient    pam_unix.so nullok\n" +
-					"auth        sufficient    pam_sss.so forward_pass\n" +
-					"auth        required      pam_deny.so\n" +
-					"account     required      pam_unix.so\n" +
-					"account     [default=bad success=ok user_unknown=ignore] pam_sss.so\n",
-			},
-			wantContains: []string{
-				"auth        sufficient    pam_unix.so nullok",
-				"auth        sufficient    pam_sss.so forward_pass",
-				"account     required      pam_unix.so",
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			env := newPamTestEnv(t)
-			for name, content := range tt.files {
-				env.writePamFile(t, name, content)
-			}
-
-			content, err := buildManagedLockscreenPamContent([]string{env.pamDir}, os.ReadFile)
-			if err != nil {
-				t.Fatalf("buildManagedLockscreenPamContent returned error: %v", err)
-			}
-			if !strings.Contains(content, "auth") {
-				t.Fatalf("resolved content has no auth line:\n%s", content)
-			}
-			for _, want := range tt.wantContains {
-				if !strings.Contains(content, want) {
-					t.Errorf("missing expected string %q in output:\n%s", want, content)
-				}
-			}
-			for _, notWant := range tt.wantNotContains {
-				if strings.Contains(content, notWant) {
-					t.Errorf("unexpected string %q found in output:\n%s", notWant, content)
-				}
-			}
-		})
-	}
-}
-
-func TestBuildManagedLockscreenPamContent_VendorDirFallback(t *testing.T) {
-	t.Parallel()
-
-	// Stateless/vendored-PAM systems (Clear Linux) ship the stack in
-	// /usr/lib|share/pam.d with /etc/pam.d empty; includes resolve in that dir.
-	etcDir := t.TempDir()
-	vendorDir := t.TempDir()
-	writeTestFile(t, filepath.Join(vendorDir, "login"), "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
-	writeTestFile(t, filepath.Join(vendorDir, "system-auth"), "auth sufficient pam_unix.so nullok\naccount required pam_unix.so\n")
-
-	content, err := buildManagedLockscreenPamContent([]string{etcDir, vendorDir}, os.ReadFile)
-	if err != nil {
-		t.Fatalf("buildManagedLockscreenPamContent returned error: %v", err)
-	}
-	for _, want := range []string{"auth sufficient pam_unix.so nullok", "account required pam_unix.so"} {
-		if !strings.Contains(content, want) {
-			t.Errorf("missing %q in output:\n%s", want, content)
-		}
-	}
-}
-
 func TestSyncLockscreenPamConfigWithDeps(t *testing.T) {
 	t.Parallel()
 
@@ -522,8 +400,8 @@ func TestSyncLockscreenPamConfigWithDeps(t *testing.T) {
 		if err != nil {
 			t.Fatalf("syncLockscreenPamConfigWithDeps returned error on NixOS path: %v", err)
 		}
-		if len(logs) == 0 || !strings.Contains(logs[0], "NixOS detected") || !strings.Contains(logs[0], "sanitized password-only service") {
-			t.Fatalf("expected NixOS informational log describing the user-state fallback, got %v", logs)
+		if len(logs) == 0 || !strings.Contains(logs[0], "NixOS detected") || !strings.Contains(logs[0], "/etc/pam.d/login") {
+			t.Fatalf("expected NixOS informational log mentioning /etc/pam.d/login, got %v", logs)
 		}
 		if _, err := os.Stat(env.dankshellPath); !os.IsNotExist(err) {
 			t.Fatalf("expected no dankshell file to be written on NixOS path, stat err = %v", err)
@@ -614,384 +492,93 @@ func TestSyncLockscreenU2FPamConfigWithDeps(t *testing.T) {
 	})
 }
 
-func TestListLockscreenPamServices(t *testing.T) {
+func TestSyncGreeterPamConfigWithDeps(t *testing.T) {
 	t.Parallel()
 
-	t.Run("dedupes by name with earlier base dir winning", func(t *testing.T) {
-		t.Parallel()
-
-		etcDir := t.TempDir()
-		vendorDir := t.TempDir()
-		// login exists in both dirs; system-auth only in the vendor dir.
-		writeTestFile(t, filepath.Join(etcDir, "login"), "#%PAM-1.0\nauth required pam_unix.so\naccount required pam_unix.so\n")
-		writeTestFile(t, filepath.Join(vendorDir, "login"), "#%PAM-1.0\nauth required pam_deny.so\n")
-		writeTestFile(t, filepath.Join(vendorDir, "system-auth"), "#%PAM-1.0\nauth sufficient pam_unix.so\naccount required pam_unix.so\n")
-
-		services := listLockscreenPamServices([]string{etcDir, vendorDir}, os.ReadFile)
-		if len(services) != 2 {
-			t.Fatalf("expected 2 services (login, system-auth), got %d: %+v", len(services), services)
-		}
-		byName := map[string]LockscreenPamServiceInfo{}
-		for _, s := range services {
-			byName[s.Name] = s
-		}
-		login, ok := byName["login"]
-		if !ok {
-			t.Fatalf("expected login service, got %+v", services)
-		}
-		if login.Dir != etcDir || login.Path != filepath.Join(etcDir, "login") {
-			t.Fatalf("expected login to resolve in earlier dir %s, got dir=%s path=%s", etcDir, login.Dir, login.Path)
-		}
-		if !login.HasAuth {
-			t.Fatalf("expected login to report hasAuth")
-		}
-		if byName["system-auth"].Dir != vendorDir {
-			t.Fatalf("expected system-auth to resolve in vendor dir, got %s", byName["system-auth"].Dir)
-		}
-	})
-
-	t.Run("include resolution sets hasAuth and detects inline fprintd/u2f", func(t *testing.T) {
+	t.Run("adds managed block for enabled auth modules", func(t *testing.T) {
 		t.Parallel()
 
 		env := newPamTestEnv(t)
-		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
-		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so\nauth sufficient pam_fprintd.so\nauth sufficient pam_u2f.so cue\naccount required pam_unix.so\n")
-
-		services := listLockscreenPamServices([]string{env.pamDir}, os.ReadFile)
-		var login LockscreenPamServiceInfo
-		for _, s := range services {
-			if s.Name == "login" {
-				login = s
-			}
-		}
-		if !login.HasAuth {
-			t.Fatalf("expected hasAuth via resolved include")
-		}
-		if !login.InlineFingerprint || !login.InlineU2f {
-			t.Fatalf("expected inline fingerprint and u2f detection, got %+v", login)
-		}
-	})
-}
-
-func TestValidateLockscreenPam(t *testing.T) {
-	t.Parallel()
-
-	t.Run("valid service with resolved auth", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.availableModules["pam_unix.so"] = true
-		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
-		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so\naccount required pam_unix.so\n")
-
-		result := validateLockscreenPam("login", "", env.validateDeps())
-		if !result.Valid {
-			t.Fatalf("expected valid result, got %+v", result)
-		}
-		if !result.HasAuth {
-			t.Fatalf("expected hasAuth true")
-		}
-		if len(result.Errors) != 0 {
-			t.Fatalf("expected no errors, got %v", result.Errors)
-		}
-	})
-
-	t.Run("path outside base dirs is read directly", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.availableModules["pam_unix.so"] = true
-		outside := filepath.Join(t.TempDir(), "custom-pam")
-		writeTestFile(t, outside, "#%PAM-1.0\nauth sufficient pam_unix.so\naccount required pam_unix.so\n")
-
-		result := validateLockscreenPam("", outside, env.validateDeps())
-		if !result.Valid || result.Path != outside {
-			t.Fatalf("expected valid result for outside path, got %+v", result)
-		}
-	})
-
-	t.Run("missing module produces warning and missingModules but stays valid", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.availableModules["pam_unix.so"] = true
-		env.writePamFile(t, "system-auth", "#%PAM-1.0\nauth sufficient pam_unix.so\nauth required pam_absent.so\naccount required pam_unix.so\n")
-
-		result := validateLockscreenPam("system-auth", "", env.validateDeps())
-		if !result.Valid {
-			t.Fatalf("expected valid despite missing module, got %+v", result)
-		}
-		if len(result.MissingModules) != 1 || result.MissingModules[0] != "pam_absent.so" {
-			t.Fatalf("expected missing pam_absent.so, got %v", result.MissingModules)
-		}
-		if !containsSubstr(result.Warnings, "pam_absent.so") {
-			t.Fatalf("expected warning about missing module, got %v", result.Warnings)
-		}
-	})
-
-	t.Run("unknown directive is a warning not an error", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.availableModules["pam_unix.so"] = true
-		env.availableModules["pam_foo.so"] = true
-		env.writePamFile(t, "system-auth", "#%PAM-1.0\nauth sufficient pam_unix.so\nbadtype required pam_foo.so\naccount required pam_unix.so\n")
-
-		result := validateLockscreenPam("system-auth", "", env.validateDeps())
-		if !result.Valid {
-			t.Fatalf("expected valid with unknown directive, got %+v", result)
-		}
-		if len(result.Errors) != 0 {
-			t.Fatalf("expected no errors, got %v", result.Errors)
-		}
-		if !containsSubstr(result.Warnings, "unsupported PAM directive") {
-			t.Fatalf("expected unsupported directive warning, got %v", result.Warnings)
-		}
-	})
-
-	t.Run("cyclic include is an error", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\n")
-		env.writePamFile(t, "system-auth", "auth include login\n")
-
-		result := validateLockscreenPam("login", "", env.validateDeps())
-		if result.Valid {
-			t.Fatalf("expected invalid on cyclic include, got %+v", result)
-		}
-		if !containsSubstr(result.Errors, "cyclic PAM include detected") {
-			t.Fatalf("expected cyclic include error, got %v", result.Errors)
-		}
-	})
-
-	t.Run("no auth directives is an error", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.availableModules["pam_unix.so"] = true
-		env.writePamFile(t, "system-auth", "#%PAM-1.0\naccount required pam_unix.so\n")
-
-		result := validateLockscreenPam("system-auth", "", env.validateDeps())
-		if result.Valid {
-			t.Fatalf("expected invalid when no auth directives, got %+v", result)
-		}
-		if !containsSubstr(result.Errors, "no auth directives") {
-			t.Fatalf("expected no-auth error, got %v", result.Errors)
-		}
-	})
-
-	t.Run("missing file is an error", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		result := validateLockscreenPam("", filepath.Join(env.pamDir, "does-not-exist"), env.validateDeps())
-		if result.Valid || len(result.Errors) == 0 {
-			t.Fatalf("expected invalid for missing file, got %+v", result)
-		}
-	})
-
-	t.Run("inline fingerprint and u2f produce warnings", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.availableModules["pam_unix.so"] = true
 		env.availableModules["pam_fprintd.so"] = true
 		env.availableModules["pam_u2f.so"] = true
-		env.writePamFile(t, "system-auth", "#%PAM-1.0\nauth sufficient pam_unix.so\nauth sufficient pam_fprintd.so\nauth sufficient pam_u2f.so cue\naccount required pam_unix.so\n")
+		env.writePamFile(t, "greetd", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so\naccount required pam_unix.so\n")
 
-		result := validateLockscreenPam("system-auth", "", env.validateDeps())
-		if !result.Valid {
-			t.Fatalf("expected valid, got %+v", result)
+		settings := AuthSettings{GreeterEnableFprint: true, GreeterEnableU2f: true}
+		if err := syncGreeterPamConfigWithDeps(func(string) {}, "", settings, false, env.deps(false)); err != nil {
+			t.Fatalf("syncGreeterPamConfigWithDeps returned error: %v", err)
 		}
-		if !result.InlineFingerprint || !result.InlineU2f {
-			t.Fatalf("expected inline flags set, got %+v", result)
+
+		got := readFileString(t, env.greetdPath)
+		for _, want := range []string{
+			GreeterPamManagedBlockStart,
+			"auth sufficient pam_fprintd.so max-tries=1 timeout=5",
+			"auth sufficient pam_u2f.so cue nouserok timeout=10",
+			GreeterPamManagedBlockEnd,
+		} {
+			if !strings.Contains(got, want) {
+				t.Errorf("missing expected string %q in greetd PAM:\n%s", want, got)
+			}
 		}
-		if !containsSubstr(result.Warnings, "pam_fprintd") || !containsSubstr(result.Warnings, "pam_u2f") {
-			t.Fatalf("expected double-prompt warnings, got %v", result.Warnings)
+		if strings.Index(got, GreeterPamManagedBlockStart) > strings.Index(got, "auth include system-auth") {
+			t.Fatalf("managed block was not inserted before first auth line:\n%s", got)
+		}
+	})
+
+	t.Run("avoids duplicate fingerprint when included stack already provides it", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.fingerprintAvailable = true
+		original := "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n"
+		env.writePamFile(t, "greetd", original)
+		env.writePamFile(t, "system-auth", "auth sufficient pam_fprintd.so max-tries=1\nauth sufficient pam_unix.so\n")
+
+		settings := AuthSettings{GreeterEnableFprint: true}
+		if err := syncGreeterPamConfigWithDeps(func(string) {}, "", settings, false, env.deps(false)); err != nil {
+			t.Fatalf("syncGreeterPamConfigWithDeps returned error: %v", err)
+		}
+
+		got := readFileString(t, env.greetdPath)
+		if got != original {
+			t.Fatalf("greetd PAM changed despite included pam_fprintd stack\ngot:\n%s\nwant:\n%s", got, original)
+		}
+		if strings.Contains(got, GreeterPamManagedBlockStart) {
+			t.Fatalf("managed block should not be inserted when included stack already has pam_fprintd:\n%s", got)
 		}
 	})
 }
 
-func TestValidateLockscreenU2fPam(t *testing.T) {
+func TestRemoveManagedGreeterPamBlockWithDeps(t *testing.T) {
 	t.Parallel()
 
-	t.Run("accepts a dedicated U2F stack with custom options", func(t *testing.T) {
-		t.Parallel()
+	env := newPamTestEnv(t)
+	env.writePamFile(t, "greetd", "#%PAM-1.0\n"+
+		legacyGreeterPamFprintComment+"\n"+
+		"auth sufficient pam_fprintd.so max-tries=1\n"+
+		GreeterPamManagedBlockStart+"\n"+
+		"auth sufficient pam_u2f.so cue nouserok timeout=10\n"+
+		GreeterPamManagedBlockEnd+"\n"+
+		"auth include system-auth\n")
 
-		env := newPamTestEnv(t)
-		env.availableModules["pam_u2f.so"] = true
-		env.writePamFile(t, "dankshell-u2f", "#%PAM-1.0\nauth required pam_u2f.so cue authfile=/etc/u2f-mappings\naccount required pam_permit.so\n")
-
-		result := validateLockscreenU2fPam("dankshell-u2f", "", env.validateDeps())
-		if !result.Valid {
-			t.Fatalf("expected valid dedicated U2F stack, got %+v", result)
-		}
-		if !result.InlineU2f {
-			t.Fatalf("expected inline U2F detection, got %+v", result)
-		}
-		if containsSubstr(result.Warnings, "double-prompt") {
-			t.Fatalf("dedicated U2F validation should not warn about its expected U2F module: %v", result.Warnings)
-		}
-	})
-
-	t.Run("rejects a primary login stack that also prompts for a password", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.availableModules["pam_unix.so"] = true
-		env.availableModules["pam_u2f.so"] = true
-		env.writePamFile(t, "login", "#%PAM-1.0\nauth required pam_unix.so\nauth required pam_u2f.so cue\naccount required pam_unix.so\n")
-
-		result := validateLockscreenU2fPam("login", "", env.validateDeps())
-		if result.Valid {
-			t.Fatalf("expected mixed password/U2F stack to be rejected, got %+v", result)
-		}
-		if !containsSubstr(result.Errors, "pam_unix.so") || !containsSubstr(result.Errors, "dedicated security-key") {
-			t.Fatalf("expected actionable mixed-stack error, got %v", result.Errors)
-		}
-	})
-
-	t.Run("rejects a stack without pam_u2f", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.availableModules["pam_unix.so"] = true
-		env.writePamFile(t, "password-only", "#%PAM-1.0\nauth required pam_unix.so\n")
-
-		result := validateLockscreenU2fPam("password-only", "", env.validateDeps())
-		if result.Valid || !containsSubstr(result.Errors, "pam_u2f") {
-			t.Fatalf("expected missing-U2F error, got %+v", result)
-		}
-	})
-
-	t.Run("does not accept a similarly named module as pam_u2f", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.availableModules["pam_u2f_helper.so"] = true
-		env.writePamFile(t, "not-u2f", "#%PAM-1.0\nauth required pam_u2f_helper.so\n")
-
-		result := validateLockscreenU2fPam("not-u2f", "", env.validateDeps())
-		if result.Valid || !containsSubstr(result.Errors, "no pam_u2f auth directive") {
-			t.Fatalf("expected exact pam_u2f module validation, got %+v", result)
-		}
-	})
-
-	t.Run("rejects a missing pam_u2f module", func(t *testing.T) {
-		t.Parallel()
-
-		env := newPamTestEnv(t)
-		env.writePamFile(t, "dankshell-u2f", "#%PAM-1.0\nauth required pam_u2f.so cue\n")
-
-		result := validateLockscreenU2fPam("dankshell-u2f", "", env.validateDeps())
-		if result.Valid || !containsSubstr(result.Errors, "pam_u2f.so is not installed") {
-			t.Fatalf("expected missing-module error, got %+v", result)
-		}
-	})
-}
-
-func containsSubstr(items []string, substr string) bool {
-	for _, item := range items {
-		if strings.Contains(item, substr) {
-			return true
-		}
-	}
-	return false
-}
-
-type pamTestEnv struct {
-	pamDir           string
-	dankshellPath    string
-	dankshellU2fPath string
-	tmpDir           string
-	homeDir          string
-	availableModules map[string]bool
-}
-
-func newPamTestEnv(t *testing.T) *pamTestEnv {
-	t.Helper()
-
-	root := t.TempDir()
-	pamDir := filepath.Join(root, "pam.d")
-	tmpDir := filepath.Join(root, "tmp")
-	homeDir := filepath.Join(root, "home")
-
-	for _, dir := range []string{pamDir, tmpDir, homeDir} {
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			t.Fatalf("failed to create %s: %v", dir, err)
-		}
+	if err := removeManagedGreeterPamBlockWithDeps(func(string) {}, "", env.deps(false)); err != nil {
+		t.Fatalf("removeManagedGreeterPamBlockWithDeps returned error: %v", err)
 	}
 
-	return &pamTestEnv{
-		pamDir:           pamDir,
-		dankshellPath:    filepath.Join(pamDir, "dankshell"),
-		dankshellU2fPath: filepath.Join(pamDir, "dankshell-u2f"),
-		tmpDir:           tmpDir,
-		homeDir:          homeDir,
-		availableModules: map[string]bool{},
+	got := readFileString(t, env.greetdPath)
+	if strings.Contains(got, GreeterPamManagedBlockStart) || strings.Contains(got, legacyGreeterPamFprintComment) {
+		t.Fatalf("managed or legacy DMS auth lines remained in greetd PAM:\n%s", got)
 	}
-}
-
-func (e *pamTestEnv) deps(isNixOS bool) syncDeps {
-	return syncDeps{
-		pamDir:           e.pamDir,
-		dankshellPath:    e.dankshellPath,
-		dankshellU2fPath: e.dankshellU2fPath,
-		isNixOS:          func() bool { return isNixOS },
-		readFile:         os.ReadFile,
-		stat:             os.Stat,
-		createTemp: func(_ string, pattern string) (*os.File, error) {
-			return os.CreateTemp(e.tmpDir, pattern)
-		},
-		removeFile: os.Remove,
-		runSudoCmd: func(_ string, command string, args ...string) error {
-			switch command {
-			case "cp":
-				if len(args) != 2 {
-					return fmt.Errorf("unexpected cp args: %v", args)
-				}
-				data, err := os.ReadFile(args[0])
-				if err != nil {
-					return err
-				}
-				if err := os.MkdirAll(filepath.Dir(args[1]), 0o755); err != nil {
-					return err
-				}
-				return os.WriteFile(args[1], data, 0o644)
-			case "chmod":
-				if len(args) != 2 {
-					return fmt.Errorf("unexpected chmod args: %v", args)
-				}
-				return nil
-			case "rm":
-				if len(args) != 2 || args[0] != "-f" {
-					return fmt.Errorf("unexpected rm args: %v", args)
-				}
-				if err := os.Remove(args[1]); err != nil && !os.IsNotExist(err) {
-					return err
-				}
-				return nil
-			default:
-				return fmt.Errorf("unexpected sudo command: %s %v", command, args)
-			}
-		},
-	}
-}
-
-func (e *pamTestEnv) validateDeps() lockscreenPamValidateDeps {
-	return lockscreenPamValidateDeps{
-		baseDirs:        []string{e.pamDir},
-		readFile:        os.ReadFile,
-		stat:            os.Stat,
-		pamModuleExists: func(module string) bool { return e.availableModules[module] },
+	if !strings.Contains(got, "auth include system-auth") {
+		t.Fatalf("expected non-DMS greetd auth lines to remain:\n%s", got)
 	}
 }
 
 func TestSyncAuthConfigWithDeps(t *testing.T) {
 	t.Parallel()
 
-	t.Run("creates lockscreen targets", func(t *testing.T) {
+	t.Run("creates lockscreen targets and skips greetd when greeter is not installed", func(t *testing.T) {
 		t.Parallel()
 
 		env := newPamTestEnv(t)
@@ -999,7 +586,10 @@ func TestSyncAuthConfigWithDeps(t *testing.T) {
 		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
 		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so try_first_pass nullok\naccount required pam_access.so\n")
 
-		err := syncAuthConfigWithDeps(func(string) {}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(false))
+		var logs []string
+		err := syncAuthConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(false))
 		if err != nil {
 			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
 		}
@@ -1010,24 +600,72 @@ func TestSyncAuthConfigWithDeps(t *testing.T) {
 		if got := readFileString(t, env.dankshellU2fPath); got != buildManagedLockscreenU2FPamContent() {
 			t.Fatalf("unexpected dankshell-u2f content:\n%s", got)
 		}
+		if len(logs) == 0 || !strings.Contains(logs[len(logs)-1], "greetd not found") {
+			t.Fatalf("expected greetd skip log, got %v", logs)
+		}
 	})
 
-	t.Run("removes dankshell-u2f when disabled", func(t *testing.T) {
+	t.Run("separate greeter and lockscreen toggles are respected", func(t *testing.T) {
 		t.Parallel()
 
 		env := newPamTestEnv(t)
-		env.writeSettings(t, `{"enableU2f":false}`)
+		env.availableModules["pam_fprintd.so"] = true
+		env.writeSettings(t, `{"enableU2f":false,"greeterEnableFprint":true,"greeterEnableU2f":false}`)
 		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
 		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so try_first_pass nullok\naccount required pam_access.so\n")
-		env.writePamFile(t, "dankshell-u2f", buildManagedLockscreenU2FPamContent())
+		env.writePamFile(t, "greetd", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
 
 		err := syncAuthConfigWithDeps(func(string) {}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(false))
 		if err != nil {
 			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
 		}
 
+		dankshell := readFileString(t, env.dankshellPath)
+		if strings.Contains(dankshell, "pam_fprintd") || strings.Contains(dankshell, "pam_u2f") {
+			t.Fatalf("lockscreen PAM should strip fingerprint and U2F modules:\n%s", dankshell)
+		}
 		if _, err := os.Stat(env.dankshellU2fPath); !os.IsNotExist(err) {
-			t.Fatalf("expected dankshell-u2f to be removed, stat err = %v", err)
+			t.Fatalf("expected dankshell-u2f to remain absent when enableU2f is false, stat err = %v", err)
+		}
+
+		greetd := readFileString(t, env.greetdPath)
+		if !strings.Contains(greetd, "auth sufficient pam_fprintd.so max-tries=1 timeout=5") {
+			t.Fatalf("expected greetd PAM to receive fingerprint auth block:\n%s", greetd)
+		}
+		if strings.Contains(greetd, "auth sufficient pam_u2f.so cue nouserok timeout=10") {
+			t.Fatalf("did not expect greetd PAM to receive U2F auth block:\n%s", greetd)
+		}
+	})
+
+	t.Run("NixOS remains informational and non-mutating", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.availableModules["pam_u2f.so"] = true
+		env.writeSettings(t, `{"enableU2f":true,"greeterEnableFprint":true,"greeterEnableU2f":true}`)
+		originalGreetd := "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n"
+		env.writePamFile(t, "greetd", originalGreetd)
+
+		var logs []string
+		err := syncAuthConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(true))
+		if err != nil {
+			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
+		}
+
+		if _, err := os.Stat(env.dankshellPath); !os.IsNotExist(err) {
+			t.Fatalf("expected dankshell to remain absent on NixOS path, stat err = %v", err)
+		}
+		if _, err := os.Stat(env.dankshellU2fPath); !os.IsNotExist(err) {
+			t.Fatalf("expected dankshell-u2f to remain absent on NixOS path, stat err = %v", err)
+		}
+		if got := readFileString(t, env.greetdPath); got != originalGreetd {
+			t.Fatalf("expected greetd PAM to remain unchanged on NixOS path\ngot:\n%s\nwant:\n%s", got, originalGreetd)
+		}
+		if len(logs) < 2 || !strings.Contains(strings.Join(logs, "\n"), "NixOS detected") {
+			t.Fatalf("expected informational NixOS logs, got %v", logs)
 		}
 	})
 }

core/internal/plugins/manager.go

@@ -64,20 +64,7 @@ func (m *Manager) findInstalledPath(pluginID string) (string, error) {
 	return m.findInDir(systemDir, pluginID)
 }
 
-// isSafePluginPathComponent rejects ids that aren't a single path component,
-// so filepath.Join can't resolve (and later RemoveAll) outside the plugins dir
-func isSafePluginPathComponent(s string) bool {
-	if s == "" || s == "." || s == ".." {
-		return false
-	}
-	return !strings.ContainsAny(s, "/\\")
-}
-
 func (m *Manager) findInDir(dir, pluginID string) (string, error) {
-	if !isSafePluginPathComponent(pluginID) {
-		return "", fmt.Errorf("invalid plugin id: %q", pluginID)
-	}
-
 	// First, check if folder with exact ID name exists
 	exactPath := filepath.Join(dir, pluginID)
 	if exists, _ := afero.DirExists(m.fs, exactPath); exists {
@@ -520,10 +507,6 @@ func (m *Manager) findInstalledPathByIDOrName(idOrName string) (string, error) {
 }
 
 func (m *Manager) findInDirByIDOrName(dir, idOrName string) (string, error) {
-	if !isSafePluginPathComponent(idOrName) {
-		return "", fmt.Errorf("invalid plugin id/name: %q", idOrName)
-	}
-
 	// Check exact folder name match first
 	exactPath := filepath.Join(dir, idOrName)
 	if exists, _ := afero.DirExists(m.fs, exactPath); exists {

core/internal/privesc/privesc.go

@@ -135,14 +135,15 @@ func EscapeSingleQuotes(s string) string {
 }
 
 // MakeCommand returns a bash command string that runs `command` with the
-// detected tool, prompting interactively on a TTY where applicable. The
-// sudo-with-password case lives in ExecCommand, which pipes the password via
-// stdin so it never lands in argv.
+// detected tool. When the tool supports stdin passwords and password is
+// non-empty, the password is piped in. Otherwise the tool is invoked with
+// no non-interactive flag so that an interactive TTY prompt is still
+// possible for CLI callers.
 //
 // If detection fails, the returned shell string exits 1 with an error
 // message so callers that treat the *exec.Cmd as infallible still fail
 // deterministically.
-func MakeCommand(command string) string {
+func MakeCommand(password, command string) string {
 	t, err := Detect()
 	if err != nil {
 		return failingShell(err)
@@ -150,6 +151,9 @@ func MakeCommand(command string) string {
 
 	switch t {
 	case ToolSudo:
+		if password != "" {
+			return fmt.Sprintf("echo '%s' | sudo -S %s", EscapeSingleQuotes(password), command)
+		}
 		return fmt.Sprintf("sudo %s", command)
 	case ToolDoas:
 		return fmt.Sprintf("doas sh -c '%s'", EscapeSingleQuotes(command))
@@ -162,19 +166,9 @@ func MakeCommand(command string) string {
 
 // ExecCommand builds an exec.Cmd that runs `command` as root via the
 // detected tool. Detection errors surface at Run() time as a failing
-// command writing a clear error to stderr. A sudo password is piped via
-// stdin (sudo -S) so it never appears in argv.
+// command writing a clear error to stderr.
 func ExecCommand(ctx context.Context, password, command string) *exec.Cmd {
-	t, err := Detect()
-	if err != nil {
-		return exec.CommandContext(ctx, "bash", "-c", failingShell(err))
-	}
-	if t == ToolSudo && password != "" {
-		cmd := exec.CommandContext(ctx, "sudo", "-S", "sh", "-c", command)
-		cmd.Stdin = strings.NewReader(password + "\n")
-		return cmd
-	}
-	return exec.CommandContext(ctx, "bash", "-c", MakeCommand(command))
+	return exec.CommandContext(ctx, "bash", "-c", MakeCommand(password, command))
 }
 
 // ExecArgv builds an exec.Cmd that runs argv as root via the detected tool.

core/internal/proto/wlr_output_management/output_management.go

@@ -34,7 +34,7 @@ import (
 	"unsafe"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
-	"github.com/AvengeMedia/dankgo/syncmap"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/syncmap"
 )
 
 func registerServerProxy(ctx *client.Context, proxy client.Proxy, serverID uint32) {

core/internal/qmlchecks/greeter_session_memory_test.go

@@ -0,0 +1,22 @@
+package qmlchecks
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestGreeterRememberLastSessionFallsBackToDesktopID(t *testing.T) {
+	data, err := os.ReadFile("../../../quickshell/Modules/Greetd/GreeterContent.qml")
+	if err != nil {
+		t.Fatalf("read greeter QML: %v", err)
+	}
+
+	content := string(data)
+	if !strings.Contains(content, "GreetdMemory.lastSessionDesktopId || desktopIdFromPath(GreetdMemory.lastSessionId)") {
+		t.Fatalf("remembered greeter sessions should derive a desktop id from legacy absolute session paths")
+	}
+	if !strings.Contains(content, "GreeterState.sessionDesktopIds[i] === savedDesktopId") {
+		t.Fatalf("remembered greeter sessions should match current sessions by desktop id")
+	}
+}

core/internal/qmlchecks/lockscreen_input_test.go

@@ -23,25 +23,3 @@ func TestLockScreenPasswordFieldBypassesTextInputIME(t *testing.T) {
 		t.Fatalf("passwordField should handle physical key text manually instead of relying on a text input control")
 	}
 }
-
-func TestLockScreenPamSupportsManagedAndSystemPolicies(t *testing.T) {
-	data, err := os.ReadFile("../../../quickshell/Modules/Lock/Pam.qml")
-	if err != nil {
-		t.Fatalf("read lock screen PAM QML: %v", err)
-	}
-
-	content := string(data)
-	for _, required := range []string{
-		"SettingsData.lockPamExternallyManaged",
-		"SettingsData.lockU2fPamPath",
-		"customU2fPamActive",
-		"u2fSuppressedByPrimaryPam",
-	} {
-		if !strings.Contains(content, required) {
-			t.Fatalf("lock screen PAM must contain %q", required)
-		}
-	}
-	if strings.Contains(content, "runningFromNixStore || resolveUserPam.running") {
-		t.Fatalf("DMS-managed policy must generate the sanitized user PAM stack on Nix-store installs")
-	}
-}

core/internal/qrcode/qrcode.go

@@ -1,282 +0,0 @@
-package qrcode
-
-import (
-	"bytes"
-	"fmt"
-	"image"
-	"image/color"
-	_ "image/jpeg"
-	_ "image/png"
-	"os"
-	"strings"
-
-	qr "github.com/yeqown/go-qrcode/v2"
-	"github.com/yeqown/go-qrcode/writer/standard"
-)
-
-type TermOptions struct {
-	ECC       string
-	Version   int
-	QuietZone int
-	Invert    bool
-	Fg        string
-	Bg        string
-}
-
-type ImageOptions struct {
-	ECC         string
-	Version     int
-	ModuleSize  int
-	Fg          string
-	Bg          string
-	Transparent bool
-	Border      int
-	Shape       string
-	Logo        string
-	LogoScale   int
-}
-
-var wifiEscaper = strings.NewReplacer(`\`, `\\`, `;`, `\;`, `,`, `\,`, `:`, `\:`, `"`, `\"`)
-
-func WiFiString(security, ssid, password string, hidden bool) string {
-	if security == "" {
-		security = "WPA"
-	}
-	var b strings.Builder
-	fmt.Fprintf(&b, "WIFI:T:%s;S:%s;", security, wifiEscaper.Replace(ssid))
-	if !strings.EqualFold(security, "nopass") {
-		fmt.Fprintf(&b, "P:%s;", wifiEscaper.Replace(password))
-	}
-	if hidden {
-		b.WriteString("H:true;")
-	}
-	b.WriteString(";")
-	return b.String()
-}
-
-// Colors are painted explicitly on both halves of each ▀ cell so polarity
-// does not depend on the terminal theme.
-func RenderTerminal(text string, opt TermOptions) (string, error) {
-	fg, err := parseColor(opt.Fg, color.RGBA{A: 255})
-	if err != nil {
-		return "", err
-	}
-	bg, err := parseColor(opt.Bg, color.RGBA{R: 255, G: 255, B: 255, A: 255})
-	if err != nil {
-		return "", err
-	}
-	if opt.Invert {
-		fg, bg = bg, fg
-	}
-
-	mat, err := encode(text, opt.ECC, opt.Version)
-	if err != nil {
-		return "", err
-	}
-	grid := bitmapWithQuietZone(mat, opt.QuietZone)
-
-	var b strings.Builder
-	for y := 0; y < len(grid); y += 2 {
-		for x := range grid[y] {
-			top := moduleColor(grid[y][x], fg, bg)
-			bottom := bg
-			if y+1 < len(grid) {
-				bottom = moduleColor(grid[y+1][x], fg, bg)
-			}
-			fmt.Fprintf(&b, "\x1b[38;2;%d;%d;%dm\x1b[48;2;%d;%d;%dm▀", top.R, top.G, top.B, bottom.R, bottom.G, bottom.B)
-		}
-		b.WriteString("\x1b[0m\n")
-	}
-	return b.String(), nil
-}
-
-func RenderPNG(text string, opt ImageOptions) ([]byte, error) {
-	encOpts, err := encodeOptions(opt.ECC, opt.Version)
-	if err != nil {
-		return nil, err
-	}
-	imgOpts, err := imageOptions(opt)
-	if err != nil {
-		return nil, err
-	}
-
-	q, err := qr.NewWith(text, encOpts...)
-	if err != nil {
-		return nil, err
-	}
-
-	var buf bytes.Buffer
-	w := standard.NewWithWriter(nopCloser{&buf}, imgOpts...)
-	if err := q.Save(w); err != nil {
-		return nil, err
-	}
-	return buf.Bytes(), nil
-}
-
-func encodeOptions(ecc string, version int) ([]qr.EncodeOption, error) {
-	eccOpt, err := eccOption(ecc)
-	if err != nil {
-		return nil, err
-	}
-	opts := []qr.EncodeOption{eccOpt}
-	switch {
-	case version == 0:
-	case version >= 1 && version <= 40:
-		opts = append(opts, qr.WithVersion(version))
-	default:
-		return nil, fmt.Errorf("QR version must be 1-40, got %d", version)
-	}
-	return opts, nil
-}
-
-func eccOption(level string) (qr.EncodeOption, error) {
-	switch strings.ToUpper(level) {
-	case "", "M":
-		return qr.WithErrorCorrectionLevel(qr.ErrorCorrectionMedium), nil
-	case "L":
-		return qr.WithErrorCorrectionLevel(qr.ErrorCorrectionLow), nil
-	case "Q":
-		return qr.WithErrorCorrectionLevel(qr.ErrorCorrectionQuart), nil
-	case "H":
-		return qr.WithErrorCorrectionLevel(qr.ErrorCorrectionHighest), nil
-	default:
-		return nil, fmt.Errorf("invalid error correction level %q (want L, M, Q, or H)", level)
-	}
-}
-
-func imageOptions(opt ImageOptions) ([]standard.ImageOption, error) {
-	if opt.ModuleSize < 0 || opt.ModuleSize > 255 {
-		return nil, fmt.Errorf("module size must be 0-255, got %d", opt.ModuleSize)
-	}
-
-	opts := []standard.ImageOption{standard.WithBuiltinImageEncoder(standard.PNG_FORMAT)}
-	if opt.ModuleSize > 0 {
-		opts = append(opts, standard.WithQRWidth(uint8(opt.ModuleSize)))
-	}
-	if opt.Border >= 0 {
-		opts = append(opts, standard.WithBorderWidth(opt.Border))
-	}
-
-	switch {
-	case opt.Transparent:
-		opts = append(opts, standard.WithBgTransparent())
-	case opt.Bg != "":
-		c, err := parseColor(opt.Bg, color.RGBA{})
-		if err != nil {
-			return nil, err
-		}
-		opts = append(opts, standard.WithBgColor(c))
-	}
-	if opt.Fg != "" {
-		c, err := parseColor(opt.Fg, color.RGBA{})
-		if err != nil {
-			return nil, err
-		}
-		opts = append(opts, standard.WithFgColor(c))
-	}
-
-	switch strings.ToLower(opt.Shape) {
-	case "", "square":
-	case "circle":
-		opts = append(opts, standard.WithCircleShape())
-	default:
-		return nil, fmt.Errorf("invalid shape %q (want square or circle)", opt.Shape)
-	}
-
-	if opt.Logo != "" {
-		img, err := loadImage(opt.Logo)
-		if err != nil {
-			return nil, err
-		}
-		opts = append(opts, standard.WithLogoImage(img))
-		if opt.LogoScale > 0 {
-			opts = append(opts, standard.WithLogoSizeMultiplier(opt.LogoScale))
-		}
-	}
-	return opts, nil
-}
-
-func encode(text, ecc string, version int) (qr.Matrix, error) {
-	opts, err := encodeOptions(ecc, version)
-	if err != nil {
-		return qr.Matrix{}, err
-	}
-	q, err := qr.NewWith(text, opts...)
-	if err != nil {
-		return qr.Matrix{}, err
-	}
-	mw := &matrixWriter{}
-	if err := q.Save(mw); err != nil {
-		return qr.Matrix{}, err
-	}
-	return mw.mat, nil
-}
-
-func bitmapWithQuietZone(mat qr.Matrix, quiet int) [][]bool {
-	if quiet < 0 {
-		quiet = 0
-	}
-	src := mat.Bitmap()
-	h := len(src)
-	w := 0
-	if h > 0 {
-		w = len(src[0])
-	}
-	out := make([][]bool, h+quiet*2)
-	for y := range out {
-		out[y] = make([]bool, w+quiet*2)
-	}
-	for y := range h {
-		for x := range w {
-			out[y+quiet][x+quiet] = src[y][x]
-		}
-	}
-	return out
-}
-
-func moduleColor(dark bool, fg, bg color.RGBA) color.RGBA {
-	if dark {
-		return fg
-	}
-	return bg
-}
-
-func parseColor(hex string, def color.RGBA) (color.RGBA, error) {
-	hex = strings.TrimPrefix(strings.TrimSpace(hex), "#")
-	if hex == "" {
-		return def, nil
-	}
-	if len(hex) == 3 {
-		hex = fmt.Sprintf("%c%c%c%c%c%c", hex[0], hex[0], hex[1], hex[1], hex[2], hex[2])
-	}
-	var r, g, b int
-	if len(hex) != 6 {
-		return def, fmt.Errorf("invalid color %q (want #RGB or #RRGGBB)", hex)
-	}
-	if _, err := fmt.Sscanf(hex, "%02x%02x%02x", &r, &g, &b); err != nil {
-		return def, fmt.Errorf("invalid color %q (want #RGB or #RRGGBB)", hex)
-	}
-	return color.RGBA{R: uint8(r), G: uint8(g), B: uint8(b), A: 255}, nil
-}
-
-func loadImage(path string) (image.Image, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-	img, _, err := image.Decode(f)
-	if err != nil {
-		return nil, fmt.Errorf("decode %s: %w", path, err)
-	}
-	return img, nil
-}
-
-type matrixWriter struct{ mat qr.Matrix }
-
-func (w *matrixWriter) Write(m qr.Matrix) error { w.mat = m; return nil }
-func (w *matrixWriter) Close() error            { return nil }
-
-type nopCloser struct{ *bytes.Buffer }
-
-func (nopCloser) Close() error { return nil }

core/internal/screenshot/compositor.go

@@ -30,30 +30,41 @@ func DetectCompositor() Compositor {
 		return detectedCompositor
 	}
 
-	candidates := []struct {
-		socket     string
-		needsStat  bool
-		compositor Compositor
-	}{
-		{os.Getenv("MANGO_INSTANCE_SIGNATURE"), true, CompositorMango},
-		{os.Getenv("NIRI_SOCKET"), true, CompositorNiri},
-		{os.Getenv("SCROLLSOCK"), true, CompositorScroll},
-		{os.Getenv("MIRACLESOCK"), true, CompositorMiracle},
-		{os.Getenv("SWAYSOCK"), true, CompositorSway},
-		{os.Getenv("HYPRLAND_INSTANCE_SIGNATURE"), false, CompositorHyprland},
-	}
+	hyprlandSig := os.Getenv("HYPRLAND_INSTANCE_SIGNATURE")
+	niriSocket := os.Getenv("NIRI_SOCKET")
+	swaySocket := os.Getenv("SWAYSOCK")
+	scrollSocket := os.Getenv("SCROLLSOCK")
+	miracleSocket := os.Getenv("MIRACLESOCK")
+	mangoSocket := os.Getenv("MANGO_INSTANCE_SIGNATURE")
 
-	// A stale env var from a previous session must not mask the live compositor
-	for _, c := range candidates {
-		if c.socket == "" {
-			continue
+	switch {
+	case mangoSocket != "":
+		if _, err := os.Stat(mangoSocket); err == nil {
+			detectedCompositor = CompositorMango
+			return detectedCompositor
 		}
-		if c.needsStat {
-			if _, err := os.Stat(c.socket); err != nil {
-				continue
-			}
+	case niriSocket != "":
+		if _, err := os.Stat(niriSocket); err == nil {
+			detectedCompositor = CompositorNiri
+			return detectedCompositor
 		}
-		detectedCompositor = c.compositor
+	case scrollSocket != "":
+		if _, err := os.Stat(scrollSocket); err == nil {
+			detectedCompositor = CompositorScroll
+			return detectedCompositor
+		}
+	case miracleSocket != "":
+		if _, err := os.Stat(miracleSocket); err == nil {
+			detectedCompositor = CompositorMiracle
+			return detectedCompositor
+		}
+	case swaySocket != "":
+		if _, err := os.Stat(swaySocket); err == nil {
+			detectedCompositor = CompositorSway
+			return detectedCompositor
+		}
+	case hyprlandSig != "":
+		detectedCompositor = CompositorHyprland
 		return detectedCompositor
 	}
 
@@ -79,7 +90,7 @@ func GetActiveWindow() (*WindowGeometry, error) {
 	case CompositorMango:
 		return getMangoActiveWindow()
 	default:
-		return nil, fmt.Errorf("window capture requires Hyprland, Mango, or niri")
+		return nil, fmt.Errorf("window capture requires Hyprland or Mango")
 	}
 }
 

core/internal/screenshot/encode.go

@@ -54,58 +54,6 @@ func BufferToImageWithFormat(buf *ShmBuffer, format uint32) *image.RGBA {
 	return img
 }
 
-func ImageToBuffer(img image.Image) (*ShmBuffer, error) {
-	bounds := img.Bounds()
-	w, h := bounds.Dx(), bounds.Dy()
-	buf, err := CreateShmBuffer(w, h, w*4)
-	if err != nil {
-		return nil, err
-	}
-
-	data := buf.Data()
-	switch src := img.(type) {
-	case *image.NRGBA:
-		for y := range h {
-			srcOff := y * src.Stride
-			dstOff := y * buf.Stride
-			for x := range w {
-				si, di := srcOff+x*4, dstOff+x*4
-				a := uint32(src.Pix[si+3])
-				data[di+0] = uint8(uint32(src.Pix[si+2]) * a / 255)
-				data[di+1] = uint8(uint32(src.Pix[si+1]) * a / 255)
-				data[di+2] = uint8(uint32(src.Pix[si+0]) * a / 255)
-				data[di+3] = uint8(a)
-			}
-		}
-	case *image.RGBA:
-		for y := range h {
-			srcOff := y * src.Stride
-			dstOff := y * buf.Stride
-			for x := range w {
-				si, di := srcOff+x*4, dstOff+x*4
-				data[di+0] = src.Pix[si+2]
-				data[di+1] = src.Pix[si+1]
-				data[di+2] = src.Pix[si+0]
-				data[di+3] = src.Pix[si+3]
-			}
-		}
-	default:
-		for y := range h {
-			dstOff := y * buf.Stride
-			for x := range w {
-				cr, cg, cb, ca := img.At(bounds.Min.X+x, bounds.Min.Y+y).RGBA()
-				di := dstOff + x*4
-				data[di+0] = uint8(cb >> 8)
-				data[di+1] = uint8(cg >> 8)
-				data[di+2] = uint8(cr >> 8)
-				data[di+3] = uint8(ca >> 8)
-			}
-		}
-	}
-	buf.Format = FormatARGB8888
-	return buf, nil
-}
-
 func EncodePNG(w io.Writer, img image.Image) error {
 	enc := png.Encoder{CompressionLevel: png.BestSpeed}
 	return enc.Encode(w, img)

core/internal/screenshot/niri_window.go

@@ -1,164 +0,0 @@
-package screenshot
-
-import (
-	"bufio"
-	"encoding/json"
-	"fmt"
-	"image"
-	"image/png"
-	"net"
-	"os"
-	"path/filepath"
-	"time"
-)
-
-const niriScreenshotTimeout = 5 * time.Second
-
-// CaptureNiriWindowImage captures the focused window through niri's
-// ScreenshotWindow action; niri replies before writing the file, so a second
-// event-stream connection waits for ScreenshotCaptured. niri also copies the
-// capture to its own clipboard, which cannot be disabled.
-func CaptureNiriWindowImage(showPointer bool) (image.Image, error) {
-	socket := os.Getenv("NIRI_SOCKET")
-	if socket == "" {
-		return nil, fmt.Errorf("NIRI_SOCKET not set")
-	}
-
-	dir := os.Getenv("XDG_RUNTIME_DIR")
-	if dir == "" {
-		dir = os.TempDir()
-	}
-	path := filepath.Join(dir, fmt.Sprintf("dms-window-%d.png", os.Getpid()))
-
-	events, err := subscribeNiriEvents(socket)
-	if err != nil {
-		return nil, err
-	}
-	defer events.Close()
-
-	if err := requestNiriWindowScreenshot(socket, path, showPointer); err != nil {
-		return nil, err
-	}
-	defer os.Remove(path)
-
-	if err := awaitNiriScreenshot(events, path); err != nil {
-		return nil, err
-	}
-
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, fmt.Errorf("open niri screenshot: %w", err)
-	}
-	defer f.Close()
-
-	img, err := png.Decode(f)
-	if err != nil {
-		return nil, fmt.Errorf("decode niri screenshot: %w", err)
-	}
-	return img, nil
-}
-
-func subscribeNiriEvents(socket string) (net.Conn, error) {
-	conn, err := net.DialTimeout("unix", socket, 2*time.Second)
-	if err != nil {
-		return nil, fmt.Errorf("connect niri socket: %w", err)
-	}
-	_ = conn.SetDeadline(time.Now().Add(niriScreenshotTimeout))
-
-	if _, err := conn.Write([]byte("\"EventStream\"\n")); err != nil {
-		conn.Close()
-		return nil, fmt.Errorf("subscribe niri events: %w", err)
-	}
-	return conn, nil
-}
-
-func awaitNiriScreenshot(events net.Conn, path string) error {
-	scanner := bufio.NewScanner(events)
-	scanner.Buffer(make([]byte, 0, 64<<10), 1<<20)
-
-	for scanner.Scan() {
-		var event struct {
-			ScreenshotCaptured *struct {
-				Path string `json:"path"`
-			} `json:"ScreenshotCaptured"`
-		}
-		if json.Unmarshal(scanner.Bytes(), &event) != nil {
-			continue
-		}
-		if event.ScreenshotCaptured != nil && event.ScreenshotCaptured.Path == path {
-			return nil
-		}
-	}
-
-	if err := scanner.Err(); err != nil {
-		return fmt.Errorf("await niri screenshot: %w", err)
-	}
-	return fmt.Errorf("niri event stream closed before screenshot completed")
-}
-
-func requestNiriWindowScreenshot(socket, path string, showPointer bool) error {
-	conn, err := net.DialTimeout("unix", socket, 2*time.Second)
-	if err != nil {
-		return fmt.Errorf("connect niri socket: %w", err)
-	}
-	defer conn.Close()
-	_ = conn.SetDeadline(time.Now().Add(3 * time.Second))
-
-	request := map[string]any{
-		"Action": map[string]any{
-			"ScreenshotWindow": map[string]any{
-				"id":            nil,
-				"write_to_disk": true,
-				"show_pointer":  showPointer,
-				"path":          path,
-			},
-		},
-	}
-	payload, err := json.Marshal(request)
-	if err != nil {
-		return err
-	}
-	if _, err := conn.Write(append(payload, '\n')); err != nil {
-		return fmt.Errorf("niri request: %w", err)
-	}
-
-	line, err := bufio.NewReader(conn).ReadBytes('\n')
-	if err != nil {
-		return fmt.Errorf("niri reply: %w", err)
-	}
-
-	var reply map[string]json.RawMessage
-	if err := json.Unmarshal(line, &reply); err != nil {
-		return fmt.Errorf("parse niri reply: %w", err)
-	}
-	if raw, ok := reply["Err"]; ok {
-		var msg string
-		_ = json.Unmarshal(raw, &msg)
-		return fmt.Errorf("niri screenshot: %s", msg)
-	}
-	return nil
-}
-
-func (s *Screenshoter) captureNiriWindow() (*CaptureResult, error) {
-	img, err := CaptureNiriWindowImage(s.config.Cursor == CursorOn)
-	if err != nil {
-		return nil, err
-	}
-
-	buf, err := ImageToBuffer(img)
-	if err != nil {
-		return nil, err
-	}
-
-	scale := 1.0
-	if output := s.findOutputByName(GetFocusedMonitor()); output != nil {
-		scale = output.effectiveScale()
-	}
-
-	return &CaptureResult{
-		Buffer:    buf,
-		YInverted: false,
-		Format:    uint32(FormatARGB8888),
-		Scale:     scale,
-	}, nil
-}