(dms): Add input group to dms setup

- Suppress fix/warnings

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,32 +7,32 @@ body:
     attributes:
       value: |
         ## DankMaterialShell Bug Report
-        Limit your report to one issue per submission unless closely related
-  - type: checkboxes
+        Limit your report to one issue per submission unless similarly related
+  - type: dropdown
     id: compositor
     attributes:
       label: Compositor
       options:
-        - label: Niri
-        - label: Hyprland
-        - label: MangoWC (dwl)
-        - label: Sway
+        - Niri
+        - Hyprland
+        - MangoWC (dwl)
+        - Sway
     validations:
       required: true
-  - type: checkboxes
+  - type: dropdown
     id: distribution
     attributes:
       label: Distribution
       options:
-        - label: Arch Linux
-        - label: CachyOS
-        - label: Fedora
-        - label: NixOS
-        - label: Debian
-        - label: Ubuntu
-        - label: Gentoo
-        - label: OpenSUSE
-        - label: Other (specify below)
+        - Arch Linux
+        - CachyOS
+        - Fedora
+        - NixOS
+        - Debian
+        - Ubuntu
+        - Gentoo
+        - OpenSUSE
+        - Other (specify below)
     validations:
       required: true
   - type: input
@@ -42,12 +42,45 @@ body:
       placeholder: e.g., PikaOS, Void Linux, etc.
     validations:
       required: false
+  - type: dropdown
+    id: installation_method
+    attributes:
+      label: Select your Installation Method
+      options:
+        - DankInstaller
+        - Distro Packaging
+        - Source
+    validations:
+      required: true
+  - type: dropdown
+    id: original_installation_method
+    attributes:
+      label: Was this your original Installation method?
+      options:
+        - "Yes"
+        - No (specify below)
+      default: 0
+    validations:
+      required: false
+  - type: input
+    id: original_installation_method_specify
+    attributes:
+      label: If no, specify
+      placeholder: e.g., Distro Packaging, then Source
+    validations:
+      required: false
   - type: textarea
     id: dms_doctor
     attributes:
-      label: dms doctor -v
-      description: Output of `dms doctor -v` command
-      placeholder: Paste the output of `dms doctor -v` here
+      label: dms doctor -vC
+      description: Output of `dms doctor -vC` command — paste between the details tags below to keep it collapsed in the issue
+      placeholder: Paste the output of `dms doctor -vC` here
+      value: |
+        <details>
+        <summary>Click to expand</summary>
+
+
+        </details>
     validations:
       required: true
   - type: textarea
@@ -69,7 +102,7 @@ body:
   - type: textarea
     id: steps_to_reproduce
     attributes:
-      label: Steps to Reproduce & Installation Method
+      label: Steps to Reproduce
       description: Please provide detailed steps to reproduce the issue
       placeholder: |
         1. ...

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -23,18 +23,25 @@ body:
       placeholder: Why is this feature important?
     validations:
       required: false
-  - type: checkboxes
+  - type: dropdown
     id: compositor
     attributes:
       label: Compositor(s)
       description: Is this feature specific to one or more compositors?
       options:
-        - label: All compositors
-        - label: Niri
-        - label: Hyprland
-        - label: MangoWC (dwl)
-        - label: Sway
-        - label: Other (specify below)
+        - All compositors
+        - Niri
+        - Hyprland
+        - MangoWC (dwl)
+        - Sway
+        - Other (specify below)
+    validations:
+      required: true
+  - type: input
+    id: compositor_other
+    attributes:
+      label: If Other, please specify
+      placeholder: e.g., Wayfire, Mutter, etc.
     validations:
       required: false
   - type: textarea

.github/ISSUE_TEMPLATE/support_request.yml

@@ -7,32 +7,87 @@ body:
     attributes:
       value: |
         ## DankMaterialShell Support Request
-  - type: checkboxes
+  - type: dropdown
     id: compositor
     attributes:
       label: Compositor
       options:
-        - label: Niri
-        - label: Hyprland
-        - label: MangoWC (dwl)
-        - label: Sway
-        - label: Other (specify below)
+        - Niri
+        - Hyprland
+        - MangoWC (dwl)
+        - Sway
+        - Other (specify below)
+    validations:
+      required: true
+  - type: input
+    id: compositor_other
+    attributes:
+      label: If Other, please specify
+      placeholder: e.g., Wayfire, Mutter, etc.
     validations:
       required: false
-  - type: input
+  - type: dropdown
     id: distribution
     attributes:
       label: Distribution
-      description: Which Linux distribution are you using? (e.g., Arch, Fedora, Debian, etc.)
-      placeholder: Your Linux distribution
+      options:
+        - Arch Linux
+        - CachyOS
+        - Fedora
+        - NixOS
+        - Debian
+        - Ubuntu
+        - Gentoo
+        - OpenSUSE
+        - Other (specify below)
+    validations:
+      required: true
+  - type: input
+    id: distribution_other
+    attributes:
+      label: If Other, please specify
+      placeholder: e.g., PikaOS, Void Linux, etc.
+    validations:
+      required: false
+  - type: dropdown
+    id: installation_method
+    attributes:
+      label: Select your Installation Method
+      options:
+        - DankInstaller
+        - Distro Packaging
+        - Source
+    validations:
+      required: true
+  - type: dropdown
+    id: original_installation_method_different
+    attributes:
+      label: Was your original Installation method different?
+      options:
+        - "Yes"
+        - No (specify below)
+      default: 0
+    validations:
+      required: false
+  - type: input
+    id: original_installation_method_specify
+    attributes:
+      label: If no, specify
+      placeholder: e.g., Distro Packaging, then Source
     validations:
       required: false
   - type: textarea
     id: dms_doctor
     attributes:
-      label: dms doctor -v
-      description: Output of `dms doctor -v` command
-      placeholder: Paste the output of `dms doctor -v` here
+      label: dms doctor -vC
+      description: Output of `dms doctor -vC` command — paste between the lines below to keep it collapsed in the issue
+      placeholder: Paste the output of `dms doctor -vC` here
+      value: |
+        <details>
+        <summary>Click to expand</summary>
+
+
+        </details>
     validations:
       required: false
   - type: textarea

.github/workflows/backup/run-obs.yml.bak

@@ -1,383 +0,0 @@
-name: Update OBS Packages
-
-on:
-  workflow_dispatch:
-    inputs:
-      package:
-        description: "Package to update (dms, dms-git, or all)"
-        required: false
-        default: "all"
-      force_upload:
-        description: "Force upload without version check"
-        required: false
-        default: "false"
-        type: choice
-        options:
-          - "false"
-          - "true"
-      rebuild_release:
-        description: "Release number for rebuilds (e.g., 2, 3, 4 to increment spec Release)"
-        required: false
-        default: ""
-  push:
-    tags:
-      - "v*"
-  schedule:
-    - cron: "0 */3 * * *" # Every 3 hours for dms-git builds
-
-jobs:
-  check-updates:
-    name: Check for updates
-    runs-on: ubuntu-latest
-
-    outputs:
-      has_updates: ${{ steps.check.outputs.has_updates }}
-      packages: ${{ steps.check.outputs.packages }}
-      version: ${{ steps.check.outputs.version }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install OSC
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y osc
-
-          mkdir -p ~/.config/osc
-          cat > ~/.config/osc/oscrc << EOF
-          [general]
-          apiurl = https://api.opensuse.org
-
-          [https://api.opensuse.org]
-          user = ${{ secrets.OBS_USERNAME }}
-          pass = ${{ secrets.OBS_PASSWORD }}
-          EOF
-          chmod 600 ~/.config/osc/oscrc
-
-      - name: Check for updates
-        id: check
-        run: |
-          if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-            echo "packages=dms" >> $GITHUB_OUTPUT
-            VERSION="${GITHUB_REF#refs/tags/}"
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-            echo "Triggered by tag: $VERSION (always update)"
-          elif [[ "${{ github.event_name }}" == "schedule" ]]; then
-            echo "packages=dms-git" >> $GITHUB_OUTPUT
-            echo "Checking if dms-git source has changed..."
-
-            # Get current commit hash (8 chars to match spec format)
-            CURRENT_COMMIT=$(git rev-parse --short=8 HEAD)
-
-            # Check OBS for last uploaded commit
-            OBS_BASE="$HOME/.cache/osc-checkouts"
-            mkdir -p "$OBS_BASE"
-            OBS_PROJECT="home:AvengeMedia:dms-git"
-
-            if [[ -d "$OBS_BASE/$OBS_PROJECT/dms-git" ]]; then
-              cd "$OBS_BASE/$OBS_PROJECT/dms-git"
-              osc up -q 2>/dev/null || true
-
-              # Extract commit hash from spec Version line & format like; 0.6.2+git2264.a679be68
-              if [[ -f "dms-git.spec" ]]; then
-                OBS_COMMIT=$(grep "^Version:" "dms-git.spec" | grep -oP '\.[a-f0-9]{8}' | tr -d '.' || echo "")
-
-                if [[ -n "$OBS_COMMIT" ]]; then
-                  if [[ "$CURRENT_COMMIT" == "$OBS_COMMIT" ]]; then
-                    echo "has_updates=false" >> $GITHUB_OUTPUT
-                    echo "📋 Commit $CURRENT_COMMIT already uploaded to OBS, skipping"
-                  else
-                    echo "has_updates=true" >> $GITHUB_OUTPUT
-                    echo "📋 New commit detected: $CURRENT_COMMIT (OBS has $OBS_COMMIT)"
-                  fi
-                else
-                  echo "has_updates=true" >> $GITHUB_OUTPUT
-                  echo "📋 Could not extract OBS commit, proceeding with update"
-                fi
-              else
-                echo "has_updates=true" >> $GITHUB_OUTPUT
-                echo "📋 No spec file in OBS, proceeding with update"
-              fi
-
-              cd "${{ github.workspace }}"
-            else
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-              echo "📋 First upload to OBS, update needed"
-            fi
-          elif [[ "${{ github.event.inputs.force_upload }}" == "true" ]]; then
-            PKG="${{ github.event.inputs.package }}"
-            if [[ -z "$PKG" || "$PKG" == "all" ]]; then
-              echo "packages=all" >> $GITHUB_OUTPUT
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-              echo "🚀 Force upload: all packages"
-            else
-              echo "packages=$PKG" >> $GITHUB_OUTPUT
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-              echo "🚀 Force upload: $PKG"
-            fi
-          elif [[ -n "${{ github.event.inputs.package }}" ]]; then
-            echo "packages=${{ github.event.inputs.package }}" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-            echo "Manual trigger: ${{ github.event.inputs.package }}"
-          else
-            echo "packages=all" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-          fi
-
-  update-obs:
-    name: Upload to OBS
-    needs: check-updates
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    if: |
-      github.event.inputs.force_upload == 'true' ||
-      github.event_name == 'workflow_dispatch' ||
-      needs.check-updates.outputs.has_updates == 'true'
-
-    steps:
-      - name: Generate GitHub App Token
-        id: generate_token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ steps.generate_token.outputs.token }}
-
-      - name: Check if last commit was automated
-        id: check-loop
-        run: |
-          LAST_COMMIT_MSG=$(git log -1 --pretty=%B | head -1)
-          if [[ "$LAST_COMMIT_MSG" == "ci: Auto-update PPA packages"* ]] || [[ "$LAST_COMMIT_MSG" == "ci: Auto-update OBS packages"* ]]; then
-            echo "⏭️ Last commit was automated ($LAST_COMMIT_MSG), skipping to prevent infinite loop"
-            echo "skip=true" >> $GITHUB_OUTPUT
-          else
-            echo "✅ Last commit was not automated, proceeding"
-            echo "skip=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Determine packages to update
-        if: steps.check-loop.outputs.skip != 'true'
-        id: packages
-        run: |
-          if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-            echo "packages=dms" >> $GITHUB_OUTPUT
-            VERSION="${GITHUB_REF#refs/tags/}"
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "Triggered by tag: $VERSION"
-          elif [[ "${{ github.event_name }}" == "schedule" ]]; then
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
-            echo "Triggered by schedule: updating git package"
-          elif [[ -n "${{ github.event.inputs.package }}" ]]; then
-            echo "packages=${{ github.event.inputs.package }}" >> $GITHUB_OUTPUT
-            echo "Manual trigger: ${{ github.event.inputs.package }}"
-          else
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Update dms-git spec version
-        if: steps.check-loop.outputs.skip != 'true' && (contains(steps.packages.outputs.packages, 'dms-git') || steps.packages.outputs.packages == 'all')
-        run: |
-          # Get commit info for dms-git versioning
-          COMMIT_HASH=$(git rev-parse --short=8 HEAD)
-          COMMIT_COUNT=$(git rev-list --count HEAD)
-          BASE_VERSION=$(grep -oP '^Version:\s+\K[0-9.]+' distro/opensuse/dms.spec | head -1 || echo "0.6.2")
-
-          NEW_VERSION="${BASE_VERSION}+git${COMMIT_COUNT}.${COMMIT_HASH}"
-          echo "📦 Updating dms-git.spec to version: $NEW_VERSION"
-
-          # Update version in spec
-          sed -i "s/^Version:.*/Version:        $NEW_VERSION/" distro/opensuse/dms-git.spec
-
-          # Add changelog entry
-          DATE_STR=$(date "+%a %b %d %Y")
-          CHANGELOG_ENTRY="* $DATE_STR Avenge Media <AvengeMedia.US@gmail.com> - ${NEW_VERSION}-1\n- Git snapshot (commit $COMMIT_COUNT: $COMMIT_HASH)"
-          sed -i "/%changelog/a\\$CHANGELOG_ENTRY" distro/opensuse/dms-git.spec
-
-      - name: Update Debian dms-git changelog version
-        if: steps.check-loop.outputs.skip != 'true' && (contains(steps.packages.outputs.packages, 'dms-git') || steps.packages.outputs.packages == 'all')
-        run: |
-          # Get commit info for dms-git versioning
-          COMMIT_HASH=$(git rev-parse --short=8 HEAD)
-          COMMIT_COUNT=$(git rev-list --count HEAD)
-          BASE_VERSION=$(grep -oP '^Version:\s+\K[0-9.]+' distro/opensuse/dms.spec | head -1 || echo "0.6.2")
-
-          # Debian version format: 0.6.2+git2256.9162e314
-          NEW_VERSION="${BASE_VERSION}+git${COMMIT_COUNT}.${COMMIT_HASH}"
-          echo "📦 Updating Debian dms-git changelog to version: $NEW_VERSION"
-
-          CHANGELOG_DATE=$(date -R)
-
-          CHANGELOG_FILE="distro/debian/dms-git/debian/changelog"
-
-          # Get current version from changelog
-          CURRENT_VERSION=$(head -1 "$CHANGELOG_FILE" | sed 's/.*(\([^)]*\)).*/\1/')
-
-          echo "Current Debian version: $CURRENT_VERSION"
-          echo "New version: $NEW_VERSION"
-
-          # Only update if version changed
-          if [ "$CURRENT_VERSION" != "$NEW_VERSION" ]; then
-            # Create new changelog entry at top
-            TEMP_CHANGELOG=$(mktemp)
-
-            cat > "$TEMP_CHANGELOG" << EOF
-          dms-git ($NEW_VERSION) nightly; urgency=medium
-
-            * Git snapshot (commit $COMMIT_COUNT: $COMMIT_HASH)
-
-           -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE
-
-          EOF
-
-            # Prepend to existing changelog
-            cat "$CHANGELOG_FILE" >> "$TEMP_CHANGELOG"
-            mv "$TEMP_CHANGELOG" "$CHANGELOG_FILE"
-
-            echo "✓ Updated Debian changelog: $CURRENT_VERSION → $NEW_VERSION"
-          else
-            echo "✓ Debian changelog already at version $NEW_VERSION"
-          fi
-
-      - name: Update dms stable version
-        if: steps.check-loop.outputs.skip != 'true' && steps.packages.outputs.version != ''
-        run: |
-          VERSION="${{ steps.packages.outputs.version }}"
-          VERSION_NO_V="${VERSION#v}"
-          echo "Updating packaging to version $VERSION_NO_V"
-
-          # Update openSUSE dms spec (stable only)
-          sed -i "s/^Version:.*/Version:        $VERSION_NO_V/" distro/opensuse/dms.spec
-
-          # Update openSUSE spec changelog
-          DATE_STR=$(date "+%a %b %d %Y")
-          CHANGELOG_ENTRY="* $DATE_STR AvengeMedia <maintainer@avengemedia.com> - ${VERSION_NO_V}-1\\n- Update to stable $VERSION release\\n- Bug fixes and improvements"
-          sed -i "/%changelog/a\\$CHANGELOG_ENTRY\\n" distro/opensuse/dms.spec
-
-          # Update Debian _service files (both tar_scm and download_url formats)
-          for service in distro/debian/*/_service; do
-            if [[ -f "$service" ]]; then
-              # Update tar_scm revision parameter (for dms-git)
-              sed -i "s|<param name=\"revision\">v[0-9.]*</param>|<param name=\"revision\">$VERSION</param>|" "$service"
-
-              # Update download_url paths (for dms stable)
-              sed -i "s|/v[0-9.]\+/|/$VERSION/|g" "$service"
-              sed -i "s|/tags/v[0-9.]\+\.tar\.gz|/tags/$VERSION.tar.gz|g" "$service"
-            fi
-          done
-
-          # Update Debian changelog for dms stable
-          if [[ -f "distro/debian/dms/debian/changelog" ]]; then
-            CHANGELOG_DATE=$(date -R)
-            TEMP_CHANGELOG=$(mktemp)
-
-            cat > "$TEMP_CHANGELOG" << EOF
-          dms ($VERSION_NO_V) stable; urgency=medium
-
-            * Update to $VERSION stable release
-            * Bug fixes and improvements
-
-           -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE
-
-          EOF
-
-            cat "distro/debian/dms/debian/changelog" >> "$TEMP_CHANGELOG"
-            mv "$TEMP_CHANGELOG" "distro/debian/dms/debian/changelog"
-
-            echo "✓ Updated Debian changelog to $VERSION_NO_V"
-          fi
-
-      - name: Install Go
-        if: steps.check-loop.outputs.skip != 'true'
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.24"
-
-      - name: Install OSC
-        if: steps.check-loop.outputs.skip != 'true'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y osc
-
-          mkdir -p ~/.config/osc
-          cat > ~/.config/osc/oscrc << EOF
-          [general]
-          apiurl = https://api.opensuse.org
-
-          [https://api.opensuse.org]
-          user = ${{ secrets.OBS_USERNAME }}
-          pass = ${{ secrets.OBS_PASSWORD }}
-          EOF
-          chmod 600 ~/.config/osc/oscrc
-
-      - name: Upload to OBS
-        if: steps.check-loop.outputs.skip != 'true'
-        env:
-          FORCE_UPLOAD: ${{ github.event.inputs.force_upload }}
-          REBUILD_RELEASE: ${{ github.event.inputs.rebuild_release }}
-        run: |
-          PACKAGES="${{ steps.packages.outputs.packages }}"
-          MESSAGE="Automated update from GitHub Actions"
-
-          if [[ -n "${{ steps.packages.outputs.version }}" ]]; then
-            MESSAGE="Update to ${{ steps.packages.outputs.version }}"
-          fi
-
-          if [[ "$PACKAGES" == "all" ]]; then
-            bash distro/scripts/obs-upload.sh dms "$MESSAGE"
-            bash distro/scripts/obs-upload.sh dms-git "Automated git update"
-          else
-            bash distro/scripts/obs-upload.sh "$PACKAGES" "$MESSAGE"
-          fi
-
-      - name: Get changed packages
-        if: steps.check-loop.outputs.skip != 'true'
-        id: changed-packages
-        run: |
-          # Check if there are any changes to commit
-          if git diff --exit-code distro/debian/ distro/opensuse/ >/dev/null 2>&1; then
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-            echo "📋 No changelog or spec changes to commit"
-          else
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-            # Get list of changed packages for commit message
-            CHANGED_DEB=$(git diff --name-only distro/debian/ 2>/dev/null | grep 'debian/changelog' | xargs dirname 2>/dev/null | xargs dirname 2>/dev/null | xargs basename 2>/dev/null | tr '\n' ', ' | sed 's/, $//' || echo "")
-            CHANGED_SUSE=$(git diff --name-only distro/opensuse/ 2>/dev/null | grep '\.spec$' | sed 's|distro/opensuse/||' | sed 's/\.spec$//' | tr '\n' ', ' | sed 's/, $//' || echo "")
-
-            PKGS=$(echo "$CHANGED_DEB,$CHANGED_SUSE" | tr ',' '\n' | grep -v '^$' | sort -u | tr '\n' ',' | sed 's/,$//')
-            echo "packages=$PKGS" >> $GITHUB_OUTPUT
-            echo "📋 Changed packages: $PKGS"
-          fi
-
-      - name: Commit packaging changes
-        if: steps.check-loop.outputs.skip != 'true' && steps.changed-packages.outputs.has_changes == 'true'
-        run: |
-          git config user.name "dms-ci[bot]"
-          git config user.email "dms-ci[bot]@users.noreply.github.com"
-          git add distro/debian/*/debian/changelog distro/opensuse/*.spec
-          git commit -m "ci: Auto-update OBS packages [${{ steps.changed-packages.outputs.packages }}]" -m "🤖 Automated by GitHub Actions"
-          git pull --rebase origin master
-          git push
-
-      - name: Summary
-        run: |
-          echo "### OBS Package Update Complete" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- **Packages**: ${{ steps.packages.outputs.packages }}" >> $GITHUB_STEP_SUMMARY
-          if [[ -n "${{ steps.packages.outputs.version }}" ]]; then
-            echo "- **Version**: ${{ steps.packages.outputs.version }}" >> $GITHUB_STEP_SUMMARY
-          fi
-          if [[ "${{ needs.check-updates.outputs.has_updates }}" == "false" ]]; then
-            echo "- **Status**: Skipped (no changes detected)" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "- **Project**: https://build.opensuse.org/project/show/home:AvengeMedia" >> $GITHUB_STEP_SUMMARY

.github/workflows/backup/run-ppa.yml.bak

@@ -1,298 +0,0 @@
-name: Update PPA Packages
-
-on:
-  workflow_dispatch:
-    inputs:
-      package:
-        description: "Package to upload (dms, dms-git, dms-greeter, or all)"
-        required: false
-        default: "dms-git"
-      force_upload:
-        description: "Force upload without version check"
-        required: false
-        default: "false"
-        type: choice
-        options:
-          - "false"
-          - "true"
-      rebuild_release:
-        description: "Release number for rebuilds (e.g., 2, 3, 4 for ppa2, ppa3, ppa4)"
-        required: false
-        default: ""
-  schedule:
-    - cron: "0 */3 * * *" # Every 3 hours for dms-git builds
-
-jobs:
-  check-updates:
-    name: Check for updates
-    runs-on: ubuntu-latest
-
-    outputs:
-      has_updates: ${{ steps.check.outputs.has_updates }}
-      packages: ${{ steps.check.outputs.packages }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Check for updates
-        id: check
-        run: |
-          if [[ "${{ github.event_name }}" == "schedule" ]]; then
-            echo "packages=dms-git" >> $GITHUB_OUTPUT
-            echo "Checking if dms-git source has changed..."
-
-            # Get current commit hash (8 chars to match changelog format)
-            CURRENT_COMMIT=$(git rev-parse --short=8 HEAD)
-
-            # Extract commit hash from changelog
-            # Format: dms-git (0.6.2+git2264.c5c5ce84) questing; urgency=medium
-            CHANGELOG_FILE="distro/ubuntu/dms-git/debian/changelog"
-
-            if [[ -f "$CHANGELOG_FILE" ]]; then
-              CHANGELOG_COMMIT=$(head -1 "$CHANGELOG_FILE" | grep -oP '\.[a-f0-9]{8}' | tr -d '.' || echo "")
-
-              if [[ -n "$CHANGELOG_COMMIT" ]]; then
-                if [[ "$CURRENT_COMMIT" == "$CHANGELOG_COMMIT" ]]; then
-                  echo "has_updates=false" >> $GITHUB_OUTPUT
-                  echo "📋 Commit $CURRENT_COMMIT already in changelog, skipping upload"
-                else
-                  echo "has_updates=true" >> $GITHUB_OUTPUT
-                  echo "📋 New commit detected: $CURRENT_COMMIT (changelog has $CHANGELOG_COMMIT)"
-                fi
-              else
-                echo "has_updates=true" >> $GITHUB_OUTPUT
-                echo "📋 Could not extract commit from changelog, proceeding with upload"
-              fi
-            else
-              echo "has_updates=true" >> $GITHUB_OUTPUT
-              echo "📋 No changelog file found, proceeding with upload"
-            fi
-          elif [[ -n "${{ github.event.inputs.package }}" ]]; then
-            echo "packages=${{ github.event.inputs.package }}" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-            echo "Manual trigger: ${{ github.event.inputs.package }}"
-          else
-            echo "packages=dms-git" >> $GITHUB_OUTPUT
-            echo "has_updates=true" >> $GITHUB_OUTPUT
-          fi
-
-  upload-ppa:
-    name: Upload to PPA
-    needs: check-updates
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    if: |
-      github.event.inputs.force_upload == 'true' ||
-      github.event_name == 'workflow_dispatch' ||
-      needs.check-updates.outputs.has_updates == 'true'
-
-    steps:
-      - name: Generate GitHub App Token
-        id: generate_token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ steps.generate_token.outputs.token }}
-
-      - name: Check if last commit was automated
-        id: check-loop
-        run: |
-          LAST_COMMIT_MSG=$(git log -1 --pretty=%B | head -1)
-          if [[ "$LAST_COMMIT_MSG" == "ci: Auto-update PPA packages"* ]] || [[ "$LAST_COMMIT_MSG" == "ci: Auto-update OBS packages"* ]]; then
-            echo "⏭️ Last commit was automated ($LAST_COMMIT_MSG), skipping to prevent infinite loop"
-            echo "skip=true" >> $GITHUB_OUTPUT
-          else
-            echo "✅ Last commit was not automated, proceeding"
-            echo "skip=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Set up Go
-        if: steps.check-loop.outputs.skip != 'true'
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.24"
-          cache: false
-
-      - name: Install build dependencies
-        if: steps.check-loop.outputs.skip != 'true'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            debhelper \
-            devscripts \
-            dput \
-            lftp \
-            build-essential \
-            fakeroot \
-            dpkg-dev
-
-      - name: Configure GPG
-        if: steps.check-loop.outputs.skip != 'true'
-        env:
-          GPG_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-        run: |
-          echo "$GPG_KEY" | gpg --import
-          GPG_KEY_ID=$(gpg --list-secret-keys --keyid-format LONG | grep sec | awk '{print $2}' | cut -d'/' -f2)
-          echo "DEBSIGN_KEYID=$GPG_KEY_ID" >> $GITHUB_ENV
-
-      - name: Determine packages to upload
-        if: steps.check-loop.outputs.skip != 'true'
-        id: packages
-        run: |
-          if [[ "${{ github.event.inputs.force_upload }}" == "true" ]]; then
-            PKG="${{ github.event.inputs.package }}"
-            if [[ -z "$PKG" || "$PKG" == "all" ]]; then
-              echo "packages=all" >> $GITHUB_OUTPUT
-              echo "🚀 Force upload: all packages"
-            else
-              echo "packages=$PKG" >> $GITHUB_OUTPUT
-              echo "🚀 Force upload: $PKG"
-            fi
-          elif [[ "${{ github.event_name }}" == "schedule" ]]; then
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
-            echo "Triggered by schedule: uploading git package"
-          elif [[ -n "${{ github.event.inputs.package }}" ]]; then
-            # Manual package selection should respect change detection
-            SELECTED_PKG="${{ github.event.inputs.package }}"
-            UPDATED_PKG="${{ needs.check-updates.outputs.packages }}"
-
-            # Check if manually selected package is in the updated list
-            if [[ "$UPDATED_PKG" == *"$SELECTED_PKG"* ]] || [[ "$SELECTED_PKG" == "all" ]]; then
-              echo "packages=$SELECTED_PKG" >> $GITHUB_OUTPUT
-              echo "📦 Manual selection (has updates): $SELECTED_PKG"
-            else
-              echo "packages=" >> $GITHUB_OUTPUT
-              echo "⚠️ Manual selection '$SELECTED_PKG' has no updates - skipping (use force_upload to override)"
-            fi
-          else
-            echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Upload to PPA
-        if: steps.check-loop.outputs.skip != 'true'
-        run: |
-          PACKAGES="${{ steps.packages.outputs.packages }}"
-          REBUILD_RELEASE="${{ github.event.inputs.rebuild_release }}"
-
-          if [[ -z "$PACKAGES" ]]; then
-            echo "No packages selected for upload. Skipping."
-            exit 0
-          fi
-
-          # Build command arguments
-          BUILD_ARGS=()
-          if [[ -n "$REBUILD_RELEASE" ]]; then
-            BUILD_ARGS+=("$REBUILD_RELEASE")
-            echo "✓ Using rebuild release number: ppa$REBUILD_RELEASE"
-          fi
-
-          if [[ "$PACKAGES" == "all" ]]; then
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "Uploading dms to PPA..."
-            if [ -n "$REBUILD_RELEASE" ]; then
-              echo "🔄 Using rebuild release number: ppa$REBUILD_RELEASE"
-            fi
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            bash distro/scripts/ppa-upload.sh dms dms questing "${BUILD_ARGS[@]}"
-
-            echo ""
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "Uploading dms-git to PPA..."
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            bash distro/scripts/ppa-upload.sh dms-git dms-git questing "${BUILD_ARGS[@]}"
-
-            echo ""
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "Uploading dms-greeter to PPA..."
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            bash distro/scripts/ppa-upload.sh dms-greeter danklinux questing "${BUILD_ARGS[@]}"
-          else
-            # Map package to PPA name
-            case "$PACKAGES" in
-              dms)
-                PPA_NAME="dms"
-                ;;
-              dms-git)
-                PPA_NAME="dms-git"
-                ;;
-              dms-greeter)
-                PPA_NAME="danklinux"
-                ;;
-              *)
-                PPA_NAME="$PACKAGES"
-                ;;
-            esac
-
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            echo "Uploading $PACKAGES to PPA..."
-            echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            bash distro/scripts/ppa-upload.sh "$PACKAGES" "$PPA_NAME" questing "${BUILD_ARGS[@]}"
-          fi
-
-      - name: Get changed packages
-        if: steps.check-loop.outputs.skip != 'true'
-        id: changed-packages
-        run: |
-          # Check if there are any changelog changes to commit
-          if git diff --exit-code distro/ubuntu/ >/dev/null 2>&1; then
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-            echo "📋 No changelog changes to commit"
-          else
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-            # Get list of changed packages for commit message (deduplicate)
-            CHANGED=$(git diff --name-only distro/ubuntu/ | grep 'debian/changelog' | sed 's|/debian/changelog||' | xargs -I{} basename {} | sort -u | tr '\n' ',' | sed 's/,$//')
-            echo "packages=$CHANGED" >> $GITHUB_OUTPUT
-            echo "📋 Changed packages: $CHANGED"
-            echo "📋 Debug - Changed files:"
-            git diff --name-only distro/ubuntu/ | grep 'debian/changelog' || echo "No changelog files found"
-          fi
-
-      - name: Commit changelog changes
-        if: steps.check-loop.outputs.skip != 'true' && steps.changed-packages.outputs.has_changes == 'true'
-        run: |
-          git config user.name "dms-ci[bot]"
-          git config user.email "dms-ci[bot]@users.noreply.github.com"
-          git add distro/ubuntu/*/debian/changelog
-          git commit -m "ci: Auto-update PPA packages [${{ steps.changed-packages.outputs.packages }}]" -m "🤖 Automated by GitHub Actions"
-          git pull --rebase origin master
-          git push
-
-      - name: Summary
-        run: |
-          echo "### PPA Package Upload Complete" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- **Packages**: ${{ steps.packages.outputs.packages }}" >> $GITHUB_STEP_SUMMARY
-
-          if [[ "${{ needs.check-updates.outputs.has_updates }}" == "false" ]]; then
-            echo "- **Status**: Skipped (no changes detected)" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          PACKAGES="${{ steps.packages.outputs.packages }}"
-          if [[ "$PACKAGES" == "all" ]]; then
-            echo "- **PPA dms**: https://launchpad.net/~avengemedia/+archive/ubuntu/dms/+packages" >> $GITHUB_STEP_SUMMARY
-            echo "- **PPA dms-git**: https://launchpad.net/~avengemedia/+archive/ubuntu/dms-git/+packages" >> $GITHUB_STEP_SUMMARY
-            echo "- **PPA danklinux**: https://launchpad.net/~avengemedia/+archive/ubuntu/danklinux/+packages" >> $GITHUB_STEP_SUMMARY
-          elif [[ "$PACKAGES" == "dms" ]]; then
-            echo "- **PPA**: https://launchpad.net/~avengemedia/+archive/ubuntu/dms/+packages" >> $GITHUB_STEP_SUMMARY
-          elif [[ "$PACKAGES" == "dms-git" ]]; then
-            echo "- **PPA**: https://launchpad.net/~avengemedia/+archive/ubuntu/dms-git/+packages" >> $GITHUB_STEP_SUMMARY
-          elif [[ "$PACKAGES" == "dms-greeter" ]]; then
-            echo "- **PPA**: https://launchpad.net/~avengemedia/+archive/ubuntu/danklinux/+packages" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          if [[ -n "${{ steps.packages.outputs.version }}" ]]; then
-            echo "- **Version**: ${{ steps.packages.outputs.version }}" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Builds will appear once Launchpad processes the uploads." >> $GITHUB_STEP_SUMMARY

.github/workflows/dms-stable.yml

@@ -20,7 +20,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           token: ${{ steps.app_token.outputs.token }}

.github/workflows/go-ci.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install flatpak
         run: sudo apt update && sudo apt install -y flatpak
@@ -38,7 +38,7 @@ jobs:
         run: sudo flatpak install -y org.freedesktop.Platform/x86_64/24.08 app.zen_browser.zen
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: ./core/go.mod
 

.github/workflows/nix-pr-check.yml

@@ -1,4 +1,4 @@
-name: Check nix flake
+name: Nix flake and NixOS tests
 
 on:
   pull_request:
@@ -9,15 +9,35 @@ on:
 jobs:
   check-flake:
     runs-on: ubuntu-latest
+    timeout-minutes: 120
     steps:
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Install Nix
         uses: cachix/install-nix-action@v31
+        with:
+          enable_kvm: true
+          extra_nix_config: |
+            system-features = nixos-test benchmark big-parallel kvm
 
       - name: Check the flake
-        run: nix flake check
+        run: nix flake check -L
+
+      - name: Run NixOS module test
+        run: nix build .#nixosTests.x86_64-linux.nixos-module -L
+
+      - name: Run NixOS service start test
+        run: nix build .#nixosTests.x86_64-linux.nixos-service-start-module -L
+
+      - name: Run greeter niri test
+        run: nix build .#nixosTests.x86_64-linux.greeter-niri-module -L
+
+      - name: Run home-manager module test
+        run: nix build .#nixosTests.x86_64-linux.home-manager-module -L
+
+      - name: Run niri home-manager module test
+        run: nix build .#nixosTests.x86_64-linux.niri-home-module -L

.github/workflows/prek.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install flatpak
         run: sudo apt update && sudo apt install -y flatpak
@@ -21,7 +21,7 @@ jobs:
         run: sudo flatpak install -y org.freedesktop.Platform/x86_64/24.08 app.zen_browser.zen
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: core/go.mod
 

.github/workflows/release.yml

@@ -32,13 +32,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ inputs.tag }}
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: ./core/go.mod
 
@@ -106,7 +106,7 @@ jobs:
 
       - name: Upload artifacts (${{ matrix.arch }})
         if: matrix.arch == 'arm64'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: core-assets-${{ matrix.arch }}
           path: |
@@ -120,7 +120,7 @@ jobs:
 
       - name: Upload artifacts with completions
         if: matrix.arch == 'amd64'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: core-assets-${{ matrix.arch }}
           path: |
@@ -147,7 +147,7 @@ jobs:
   #         private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
   #     - name: Checkout
-  #       uses: actions/checkout@v4
+  #       uses: actions/checkout@v6
   #       with:
   #         token: ${{ steps.app_token.outputs.token }}
   #         fetch-depth: 0
@@ -181,7 +181,7 @@ jobs:
       TAG: ${{ inputs.tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ inputs.tag }}
           fetch-depth: 0
@@ -192,12 +192,12 @@ jobs:
           git checkout ${TAG}
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: ./core/go.mod
 
       - name: Download core artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           pattern: core-assets-*
           merge-multiple: true

.github/workflows/run-copr.yml

@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Determine version
         id: version
@@ -134,7 +134,7 @@ jobs:
           rpm -qpi "$SRPM"
 
       - name: Upload SRPM artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: ${{ matrix.package }}-stable-srpm-${{ steps.version.outputs.version }}
           path: ${{ steps.build.outputs.srpm_path }}

.github/workflows/run-obs.yml

@@ -9,6 +9,7 @@ on:
         type: choice
         options:
           - dms
+          - dms-greeter
           - dms-git
           - all
         default: "dms"
@@ -31,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -72,12 +73,27 @@ jobs:
             fi
           }
 
+          # Helper function to check dms-greeter stable tag
+          check_dms_greeter_stable() {
+            LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
+            local OBS_SPEC=$(curl -s -u "$OBS_USERNAME:$OBS_PASSWORD" "https://api.opensuse.org/source/home:AvengeMedia:danklinux/dms-greeter/dms-greeter.spec" 2>/dev/null || echo "")
+            local OBS_VERSION=$(echo "$OBS_SPEC" | grep "^Version:" | awk '{print $2}' | xargs | sed 's/^v//')
+
+            if [[ -n "$LATEST_TAG" && "$LATEST_TAG" == "v$OBS_VERSION" ]]; then
+              echo "📋 dms-greeter: Tag $LATEST_TAG already exists, skipping"
+              return 1  # No update needed
+            else
+              echo "📋 dms-greeter: New tag ${LATEST_TAG:-unknown} (OBS has ${OBS_VERSION:-none})"
+              return 0  # Update needed
+            fi
+          }
+
           # Main logic
           REBUILD="${{ github.event.inputs.rebuild_release }}"
 
-          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-            # Tag selected or pushed - always update stable package
-            echo "packages=dms" >> $GITHUB_OUTPUT
+          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]] && [[ -z "${{ github.event.inputs.package }}" ]]; then
+            # Run from tag with no package specified - update both stable packages
+            echo "packages=dms dms-greeter" >> $GITHUB_OUTPUT
             VERSION="${GITHUB_REF#refs/tags/}"
             echo "version=$VERSION" >> $GITHUB_OUTPUT
             echo "has_updates=true" >> $GITHUB_OUTPUT
@@ -103,15 +119,18 @@ jobs:
               echo "🔄 Manual rebuild requested: $PKG (db$REBUILD)"
 
             elif [[ "$PKG" == "all" ]]; then
-              # Check each package and build list of those needing updates
+              # Check each stable package and build list of those needing updates
               PACKAGES_TO_UPDATE=()
-              check_dms_git && PACKAGES_TO_UPDATE+=("dms-git")
               if check_dms_stable; then
                 PACKAGES_TO_UPDATE+=("dms")
                 if [[ -n "$LATEST_TAG" ]]; then
                   echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
                 fi
               fi
+              if check_dms_greeter_stable; then
+                PACKAGES_TO_UPDATE+=("dms-greeter")
+                [[ -n "$LATEST_TAG" ]] && echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+              fi
 
               if [[ ${#PACKAGES_TO_UPDATE[@]} -gt 0 ]]; then
                 echo "packages=${PACKAGES_TO_UPDATE[*]}" >> $GITHUB_OUTPUT
@@ -120,7 +139,7 @@ jobs:
               else
                 echo "packages=" >> $GITHUB_OUTPUT
                 echo "has_updates=false" >> $GITHUB_OUTPUT
-                echo "✓ All packages up to date"
+                echo "✓ Both packages up to date"
               fi
 
             elif [[ "$PKG" == "dms-git" ]]; then
@@ -144,6 +163,18 @@ jobs:
                 echo "has_updates=false" >> $GITHUB_OUTPUT
               fi
 
+            elif [[ "$PKG" == "dms-greeter" ]]; then
+              if check_dms_greeter_stable; then
+                echo "packages=$PKG" >> $GITHUB_OUTPUT
+                echo "has_updates=true" >> $GITHUB_OUTPUT
+                if [[ -n "$LATEST_TAG" ]]; then
+                  echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+                fi
+              else
+                echo "packages=" >> $GITHUB_OUTPUT
+                echo "has_updates=false" >> $GITHUB_OUTPUT
+              fi
+
             else
               # Unknown package - proceed anyway
               echo "packages=$PKG" >> $GITHUB_OUTPUT
@@ -164,22 +195,18 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
+      - name: Wait before OBS upload
+        run: sleep 3
+
       - name: Determine packages to update
         id: packages
         run: |
-          # Check if GITHUB_REF points to a tag (works for both push events and workflow_dispatch with tag selected)
-          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-            # Tag selected or pushed - use the tag from GITHUB_REF
-            echo "packages=dms" >> $GITHUB_OUTPUT
-            VERSION="${GITHUB_REF#refs/tags/}"
-            echo "version=$VERSION" >> $GITHUB_OUTPUT
-            echo "Using tag from GITHUB_REF: $VERSION"
-          # Check if check-updates already determined a version (from auto-detection)
-          elif [[ -n "${{ needs.check-updates.outputs.version }}" ]]; then
+          # Use check-updates outputs when available
+          if [[ -n "${{ needs.check-updates.outputs.version }}" ]]; then
             # Use version from check-updates job
             echo "packages=${{ needs.check-updates.outputs.packages }}" >> $GITHUB_OUTPUT
             echo "version=${{ needs.check-updates.outputs.version }}" >> $GITHUB_OUTPUT
@@ -191,40 +218,16 @@ jobs:
           elif [[ -n "${{ github.event.inputs.package }}" ]]; then
             # Manual workflow dispatch
 
-            # Determine version for dms stable
-            if [[ "${{ github.event.inputs.package }}" == "dms" ]]; then
-              # Use github.ref if tag selected, otherwise auto-detect latest
-              if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-                VERSION="${GITHUB_REF#refs/tags/}"
-                echo "version=$VERSION" >> $GITHUB_OUTPUT
-                echo "Using tag from GITHUB_REF: $VERSION"
+            # Determine version for dms stable and dms-greeter using the API
+            # GITHUB_REF is unreliable when "Use workflow from" a tag; API works from any ref
+            if [[ "${{ github.event.inputs.package }}" == "dms" ]] || [[ "${{ github.event.inputs.package }}" == "dms-greeter" ]] || [[ "${{ github.event.inputs.package }}" == "all" ]]; then
+              LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
+              if [[ -n "$LATEST_TAG" ]]; then
+                echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
+                echo "Using latest release from API: $LATEST_TAG"
               else
-                # Auto-detect latest release for dms
-                LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
-                if [[ -n "$LATEST_TAG" ]]; then
-                  echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
-                  echo "Auto-detected latest release: $LATEST_TAG"
-                else
-                  echo "ERROR: Could not auto-detect latest release"
-                  exit 1
-                fi
-              fi
-            elif [[ "${{ github.event.inputs.package }}" == "all" ]]; then
-              # Use github.ref if tag selected, otherwise auto-detect latest
-              if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-                VERSION="${GITHUB_REF#refs/tags/}"
-                echo "version=$VERSION" >> $GITHUB_OUTPUT
-                echo "Using tag from GITHUB_REF: $VERSION"
-              else
-                # Auto-detect latest release for "all"
-                LATEST_TAG=$(curl -s https://api.github.com/repos/AvengeMedia/DankMaterialShell/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": "\([^"]*\)".*/\1/' || echo "")
-                if [[ -n "$LATEST_TAG" ]]; then
-                  echo "version=$LATEST_TAG" >> $GITHUB_OUTPUT
-                  echo "Auto-detected latest release: $LATEST_TAG"
-                else
-                  echo "ERROR: Could not auto-detect latest release"
-                  exit 1
-                fi
+                echo "ERROR: Could not fetch latest release from API"
+                exit 1
               fi
             fi
 
@@ -244,7 +247,7 @@ jobs:
           fi
 
       - name: Update dms-git spec version
-        if: contains(steps.packages.outputs.packages, 'dms-git') || steps.packages.outputs.packages == 'all'
+        if: contains(steps.packages.outputs.packages, 'dms-git')
         run: |
           COMMIT_HASH=$(git rev-parse --short=8 HEAD)
           COMMIT_COUNT=$(git rev-list --count HEAD)
@@ -265,7 +268,7 @@ jobs:
           } > distro/opensuse/dms-git.spec
 
       - name: Update Debian dms-git changelog version
-        if: contains(steps.packages.outputs.packages, 'dms-git') || steps.packages.outputs.packages == 'all'
+        if: contains(steps.packages.outputs.packages, 'dms-git')
         run: |
           COMMIT_HASH=$(git rev-parse --short=8 HEAD)
           COMMIT_COUNT=$(git rev-list --count HEAD)
@@ -283,57 +286,68 @@ jobs:
             echo " -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE"
           } > "distro/debian/dms-git/debian/changelog"
 
-      - name: Update dms stable version
+      - name: Update stable version (dms + dms-greeter)
         if: steps.packages.outputs.version != ''
         run: |
           VERSION="${{ steps.packages.outputs.version }}"
           VERSION_NO_V="${VERSION#v}"
+          PACKAGES="${{ steps.packages.outputs.packages }}"
           echo "==> Updating packaging files to version: $VERSION_NO_V"
 
-          # Update spec file
-          sed -i "s/^Version:.*/Version:        $VERSION_NO_V/" distro/opensuse/dms.spec
+          # Update dms spec and changelog when dms is in the upload list
+          if [[ "$PACKAGES" == *"dms"* ]]; then
+            sed -i "s/^Version:.*/Version:        $VERSION_NO_V/" distro/opensuse/dms.spec
+            UPDATED_VERSION=$(grep -oP '^Version:\s+\K[0-9.]+' distro/opensuse/dms.spec | head -1)
+            echo "✓ dms spec now shows Version: $UPDATED_VERSION"
 
-          # Verify the update
-          UPDATED_VERSION=$(grep -oP '^Version:\s+\K[0-9.]+' distro/opensuse/dms.spec | head -1)
-          echo "✓ Spec file now shows Version: $UPDATED_VERSION"
+            DATE_STR=$(date "+%a %b %d %Y")
+            LOCAL_SPEC_HEAD=$(sed -n '1,/%changelog/{ /%changelog/d; p }' distro/opensuse/dms.spec)
+            {
+              echo "$LOCAL_SPEC_HEAD"
+              echo "%changelog"
+              echo "* $DATE_STR AvengeMedia <maintainer@avengemedia.com> - ${VERSION_NO_V}-1"
+              echo "- Update to stable $VERSION release"
+            } > distro/opensuse/dms.spec
 
-          # Single changelog entry (full history on OBS website)
-          DATE_STR=$(date "+%a %b %d %Y")
-          LOCAL_SPEC_HEAD=$(sed -n '1,/%changelog/{ /%changelog/d; p }' distro/opensuse/dms.spec)
-          {
-            echo "$LOCAL_SPEC_HEAD"
-            echo "%changelog"
-            echo "* $DATE_STR AvengeMedia <maintainer@avengemedia.com> - ${VERSION_NO_V}-1"
-            echo "- Update to stable $VERSION release"
-          } > distro/opensuse/dms.spec
+            if [[ -f "distro/debian/dms/debian/changelog" ]]; then
+              CHANGELOG_DATE=$(date -R)
+              {
+                echo "dms (${VERSION_NO_V}db1) stable; urgency=medium"
+                echo ""
+                echo "  * Update to $VERSION stable release"
+                echo ""
+                echo " -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE"
+              } > "distro/debian/dms/debian/changelog"
+              echo "✓ Updated dms changelog to ${VERSION_NO_V}db1"
+            fi
+          fi
 
-          # Update Debian _service files (both tar_scm and download_url formats)
+          # Update dms-greeter changelog when dms-greeter is in the upload list
+          if [[ "$PACKAGES" == *"dms-greeter"* ]] && [[ -f "distro/debian/dms-greeter/debian/changelog" ]]; then
+            CHANGELOG_DATE=$(date -R)
+            {
+              echo "dms-greeter (${VERSION_NO_V}db1) unstable; urgency=medium"
+              echo ""
+              echo "  * Update to $VERSION stable release"
+              echo ""
+              echo " -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE"
+            } > "distro/debian/dms-greeter/debian/changelog"
+            echo "✓ Updated dms-greeter changelog to ${VERSION_NO_V}db1"
+          fi
+
+          # Update Debian _service files for packages in upload list (download_url paths)
           for service in distro/debian/*/_service; do
             if [[ -f "$service" ]]; then
               # Update tar_scm revision parameter (for dms-git)
               sed -i "s|<param name=\"revision\">v[0-9.]*</param>|<param name=\"revision\">$VERSION</param>|" "$service"
-
-              # Update download_url paths (for dms stable)
+              # Update download_url paths (for dms, dms-greeter stable)
               sed -i "s|/v[0-9.]\+/|/$VERSION/|g" "$service"
               sed -i "s|/tags/v[0-9.]\+\.tar\.gz|/tags/$VERSION.tar.gz|g" "$service"
             fi
           done
 
-          # Update Debian changelog for dms stable (single entry, history on OBS website)
-          if [[ -f "distro/debian/dms/debian/changelog" ]]; then
-            CHANGELOG_DATE=$(date -R)
-            {
-              echo "dms (${VERSION_NO_V}db1) stable; urgency=medium"
-              echo ""
-              echo "  * Update to $VERSION stable release"
-              echo ""
-              echo " -- Avenge Media <AvengeMedia.US@gmail.com>  $CHANGELOG_DATE"
-            } > "distro/debian/dms/debian/changelog"
-            echo "✓ Updated Debian changelog to ${VERSION_NO_V}db1"
-          fi
-
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: ./core/go.mod
 
@@ -354,6 +368,7 @@ jobs:
           chmod 600 ~/.config/osc/oscrc
 
       - name: Upload to OBS
+        id: upload
         env:
           REBUILD_RELEASE: ${{ github.event.inputs.rebuild_release }}
           TAG_VERSION: ${{ steps.packages.outputs.version }}
@@ -362,6 +377,8 @@ jobs:
 
           if [[ -z "$PACKAGES" ]]; then
             echo "✓ No packages need uploading. All up to date!"
+            echo "uploaded_packages=" >> $GITHUB_OUTPUT
+            echo "skipped_packages=" >> $GITHUB_OUTPUT
             exit 0
           fi
 
@@ -371,7 +388,10 @@ jobs:
             echo "==> Version being uploaded: ${{ steps.packages.outputs.version }}"
           fi
 
-          # PACKAGES can be space-separated list (e.g., "dms-git dms" from "all" check)
+          UPLOADED_PACKAGES=()
+          SKIPPED_PACKAGES=()
+
+          # PACKAGES can be space-separated list (e.g., "dms dms-greeter" from "all" check)
           # Loop through each package and upload
           for PKG in $PACKAGES; do
             echo ""
@@ -382,13 +402,37 @@ jobs:
             fi
             echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
+            LOG_FILE=$(mktemp)
+            set +e
             if [[ "$PKG" == "dms-git" ]]; then
-              bash distro/scripts/obs-upload.sh dms-git "Automated git update"
+              bash distro/scripts/obs-upload.sh dms-git "Automated git update" >"$LOG_FILE" 2>&1
             else
-              bash distro/scripts/obs-upload.sh "$PKG" "$MESSAGE"
+              bash distro/scripts/obs-upload.sh "$PKG" "$MESSAGE" >"$LOG_FILE" 2>&1
             fi
+            STATUS=$?
+            set -e
+
+            cat "$LOG_FILE"
+
+            if [[ $STATUS -ne 0 ]]; then
+              rm -f "$LOG_FILE"
+              echo "❌ Upload failed for $PKG"
+              exit $STATUS
+            fi
+
+            if grep -Eq "Exiting gracefully \(no changes needed\)|No changes needed for this package\. Exiting gracefully\." "$LOG_FILE"; then
+              echo "ℹ️  $PKG is already up to date. Skipped."
+              SKIPPED_PACKAGES+=("$PKG")
+            else
+              UPLOADED_PACKAGES+=("$PKG")
+            fi
+
+            rm -f "$LOG_FILE"
           done
 
+          echo "uploaded_packages=${UPLOADED_PACKAGES[*]}" >> $GITHUB_OUTPUT
+          echo "skipped_packages=${SKIPPED_PACKAGES[*]}" >> $GITHUB_OUTPUT
+
       - name: Summary
         if: always()
         run: |
@@ -402,20 +446,59 @@ jobs:
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "All packages are current. Run completed successfully." >> $GITHUB_STEP_SUMMARY
           else
-            echo "**Packages Uploaded:**" >> $GITHUB_STEP_SUMMARY
+            UPLOADED_PACKAGES="${{ steps.upload.outputs.uploaded_packages }}"
+            SKIPPED_PACKAGES="${{ steps.upload.outputs.skipped_packages }}"
+            TOTAL_COUNT=$(wc -w <<<"$PACKAGES" | tr -d ' ')
+            UPLOADED_COUNT=0
+            SKIPPED_COUNT=0
+            if [[ -n "$UPLOADED_PACKAGES" ]]; then
+              UPLOADED_COUNT=$(wc -w <<<"$UPLOADED_PACKAGES" | tr -d ' ')
+            fi
+            if [[ -n "$SKIPPED_PACKAGES" ]]; then
+              SKIPPED_COUNT=$(wc -w <<<"$SKIPPED_PACKAGES" | tr -d ' ')
+            fi
+            in_list() {
+              local item="$1"
+              local list="$2"
+              [[ " $list " == *" $item "* ]]
+            }
+
+            if [[ "${{ job.status }}" == "success" ]]; then
+              echo "**Status:** ✅ Completed successfully" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "**Status:** ❌ Completed with errors" >> $GITHUB_STEP_SUMMARY
+            fi
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Processed:** $TOTAL_COUNT package(s)" >> $GITHUB_STEP_SUMMARY
+            echo "**Uploaded:** $UPLOADED_COUNT package(s)" >> $GITHUB_STEP_SUMMARY
+            echo "**Skipped (up to date):** $SKIPPED_COUNT package(s)" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Packages:**" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
 
             for PKG in $PACKAGES; do
+              STATUS_ICON="✅"
+              STATUS_TEXT="uploaded"
+              if in_list "$PKG" "$SKIPPED_PACKAGES"; then
+                STATUS_ICON="ℹ️"
+                STATUS_TEXT="up to date (skipped)"
+              elif ! in_list "$PKG" "$UPLOADED_PACKAGES"; then
+                STATUS_ICON="❌"
+                STATUS_TEXT="failed"
+              fi
+
               case "$PKG" in
                 dms)
-                  echo "- ✅ **dms** → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms/dms)" >> $GITHUB_STEP_SUMMARY
+                  echo "- $STATUS_ICON **dms** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms/dms)" >> $GITHUB_STEP_SUMMARY
                   ;;
                 dms-git)
-                  echo "- ✅ **dms-git** → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms-git/dms-git)" >> $GITHUB_STEP_SUMMARY
+                  echo "- $STATUS_ICON **dms-git** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:dms-git/dms-git)" >> $GITHUB_STEP_SUMMARY
+                  ;;
+                dms-greeter)
+                  echo "- $STATUS_ICON **dms-greeter** ($STATUS_TEXT) → [View builds](https://build.opensuse.org/package/show/home:AvengeMedia:danklinux/dms-greeter)" >> $GITHUB_STEP_SUMMARY
                   ;;
               esac
             done
-
             echo "" >> $GITHUB_STEP_SUMMARY
 
             if [[ -n "${{ github.event.inputs.rebuild_release }}" ]]; then

.github/workflows/run-ppa.yml

@@ -4,9 +4,15 @@ on:
   workflow_dispatch:
     inputs:
       package:
-        description: "Package to upload (dms, dms-git, dms-greeter, or all)"
-        required: false
-        default: "dms-git"
+        description: "Package to upload"
+        required: true
+        type: choice
+        options:
+          - dms
+          - dms-greeter
+          - dms-git
+          - all
+        default: "dms"
       rebuild_release:
         description: "Release number for rebuilds (e.g., 2, 3, 4 for ppa2, ppa3, ppa4)"
         required: false
@@ -25,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -139,7 +145,7 @@ jobs:
             fi
           else
             # Fallback
-            echo "packages=dms-git" >> $GITHUB_OUTPUT
+            echo "packages=dms" >> $GITHUB_OUTPUT
             echo "has_updates=true" >> $GITHUB_OUTPUT
           fi
 
@@ -151,12 +157,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: ./core/go.mod
           cache: false
@@ -209,7 +215,7 @@ jobs:
             echo "✓ Using rebuild release number: ppa$REBUILD_RELEASE"
           fi
 
-          # PACKAGES can be space-separated list (e.g., "dms-git dms" from "all" check)
+          # PACKAGES can be space-separated list (e.g., "dms-git dms dms-greeter" from "all" check)
           # Loop through each package and upload
           for PKG in $PACKAGES; do
             # Map package to PPA name
@@ -236,7 +242,11 @@ jobs:
               echo "🔄 Using rebuild release number: ppa$REBUILD_RELEASE"
             fi
             echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-            bash distro/scripts/ppa-upload.sh "$PKG" "$PPA_NAME" questing ${REBUILD_RELEASE:+"$REBUILD_RELEASE"}
+            # ppa-upload.sh uploads to questing + resolute when series is omitted
+            if ! bash distro/scripts/ppa-upload.sh "$PKG" "$PPA_NAME" "" ${REBUILD_RELEASE:+"$REBUILD_RELEASE"}; then
+              echo "::error::Upload failed for $PKG"
+              exit 1
+            fi
           done
 
       - name: Summary

.github/workflows/update-vendor-hash.yml

@@ -24,7 +24,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           token: ${{ steps.app_token.outputs.token }}
@@ -40,7 +40,7 @@ jobs:
             echo "Build succeeded, no hash update needed"
             exit 0
           fi
-          new_hash=$(echo "$output" | grep -oP "got:\s+\K\S+" | head -n1)
+          new_hash=$(echo "$output" | grep -oP "got:\s+\K\S+" | head -n1 || true)
           [ -n "$new_hash" ] || { echo "Could not extract new vendorHash"; echo "$output"; exit 1; }
           current_hash=$(grep -oP 'vendorHash = "\K[^"]+' flake.nix)
           [ "$current_hash" = "$new_hash" ] && { echo "vendorHash already up to date"; exit 0; }
@@ -59,8 +59,8 @@ jobs:
             git config user.email "dms-ci[bot]@users.noreply.github.com"
             git add flake.nix
             git commit -m "nix: update vendorHash for go.mod changes" || exit 0
-            git pull --rebase origin master
-            git push https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git HEAD:master
+            git pull --rebase origin ${{ github.ref_name }}
+            git push https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git HEAD:${{ github.ref_name }}
           else
             echo "No changes to flake.nix"
           fi

.pre-commit-config.yaml

@@ -5,11 +5,13 @@ repos:
       - id: trailing-whitespace
       - id: check-yaml
       - id: end-of-file-fixer
-  - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.10.0.1
+  - repo: local
     hooks:
       - id: shellcheck
-        args: [-e, SC2164, -e, SC2001, -e, SC2012, -e, SC2317]
+        name: shellcheck
+        entry: shellcheck -e SC2164 -e SC2001 -e SC2012 -e SC2317
+        language: system
+        types: [shell]
   - repo: local
     hooks:
       - id: go-mod-tidy

CHANGELOG.MD

@@ -1,5 +1,13 @@
 This file is more of a quick reference so I know what to account for before next releases.
 
+# 1.5.0
+- Overhauled shadows
+- App ID changed to com.danklinux.dms - breaking for window rules
+- Greeter stuff
+- Terminal mux
+- Locale overrides
+- new neovim theming
+
 # 1.4.0
 
 - Overhauled system monitor, graphs, styling

CONTRIBUTING.md

@@ -22,7 +22,7 @@ nix develop
 
 This will provide:
 
-- Go 1.24 toolchain (go, gopls, delve, go-tools) and GNU Make
+- Go 1.25+ toolchain (go, gopls, delve, go-tools) and GNU Make
 - Quickshell and required QML packages
 - Properly configured QML2_IMPORT_PATH
 
@@ -86,7 +86,9 @@ touch .qmlls.ini
 
 4. Restart dms to generate the `.qmlls.ini` file
 
-5. Make your changes, test, and open a pull request.
+5. Run `make lint-qml` from the repo root to lint QML entrypoints (requires the `.qmlls.ini` generated above). The script needs the **Qt 6** `qmllint`; it checks `qmllint6`, Fedora's `qmllint-qt6`, `/usr/lib/qt6/bin/qmllint`, then `qmllint` in `PATH`. If your Qt 6 binary lives elsewhere, set `QMLLINT=/path/to/qmllint`.
+
+6. Make your changes, test, and open a pull request.
 
 ### I18n/Localization
 

Makefile

@@ -18,7 +18,7 @@ SHELL_INSTALL_DIR=$(DATA_DIR)/quickshell/dms
 ASSETS_DIR=assets
 APPLICATIONS_DIR=$(DATA_DIR)/applications
 
-.PHONY: all build clean install install-bin install-shell install-completions install-systemd install-icon install-desktop uninstall uninstall-bin uninstall-shell uninstall-completions uninstall-systemd uninstall-icon uninstall-desktop help
+.PHONY: all build clean lint-qml install install-bin install-shell install-completions install-systemd install-icon install-desktop uninstall uninstall-bin uninstall-shell uninstall-completions uninstall-systemd uninstall-icon uninstall-desktop help
 
 all: build
 
@@ -32,6 +32,9 @@ clean:
 	@$(MAKE) -C $(CORE_DIR) clean
 	@echo "Clean complete"
 
+lint-qml:
+	@./quickshell/scripts/qmllint-entrypoints.sh
+
 # Installation targets
 install-bin:
 	@echo "Installing $(BINARY_NAME) to $(INSTALL_DIR)..."
@@ -76,7 +79,7 @@ install-desktop:
 	@update-desktop-database -q $(APPLICATIONS_DIR) 2>/dev/null || true
 	@echo "Desktop entry installed"
 
-install: build install-bin install-shell install-completions install-systemd install-icon install-desktop
+install: install-bin install-shell install-completions install-systemd install-icon install-desktop
 	@echo ""
 	@echo "Installation complete!"
 	@echo ""
@@ -130,6 +133,7 @@ help:
 	@echo "  all (default)        - Build the DMS binary"
 	@echo "  build                - Same as 'all'"
 	@echo "  clean                - Clean build artifacts"
+	@echo "  lint-qml             - Run qmllint on shell entrypoints using the Quickshell tooling VFS"
 	@echo ""
 	@echo "Install:"
 	@echo "  install              - Build and install everything (requires sudo)"

README.md

@@ -13,7 +13,7 @@ Built with [Quickshell](https://quickshell.org/) and [Go](https://go.dev/)
 [![GitHub stars](https://img.shields.io/github/stars/AvengeMedia/DankMaterialShell?style=for-the-badge&labelColor=101418&color=ffd700)](https://github.com/AvengeMedia/DankMaterialShell/stargazers)
 [![GitHub License](https://img.shields.io/github/license/AvengeMedia/DankMaterialShell?style=for-the-badge&labelColor=101418&color=b9c8da)](https://github.com/AvengeMedia/DankMaterialShell/blob/master/LICENSE)
 [![GitHub release](https://img.shields.io/github/v/release/AvengeMedia/DankMaterialShell?style=for-the-badge&labelColor=101418&color=9ccbfb)](https://github.com/AvengeMedia/DankMaterialShell/releases)
-[![AUR version](https://img.shields.io/aur/version/dms-shell-bin?style=for-the-badge&labelColor=101418&color=9ccbfb)](https://aur.archlinux.org/packages/dms-shell-bin)
+[![Arch version](https://img.shields.io/archlinux/v/extra/x86_64/dms-shell?style=for-the-badge&labelColor=101418&color=9ccbfb)](https://archlinux.org/packages/extra/x86_64/dms-shell/)
 [![AUR version (git)](<https://img.shields.io/aur/version/dms-shell-git?style=for-the-badge&labelColor=101418&color=9ccbfb&label=AUR%20(git)>)](https://aur.archlinux.org/packages/dms-shell-git)
 [![Ko-Fi donate](https://img.shields.io/badge/donate-kofi?style=for-the-badge&logo=ko-fi&logoColor=ffffff&label=ko-fi&labelColor=101418&color=f16061&link=https%3A%2F%2Fko-fi.com%2Fdanklinux)](https://ko-fi.com/danklinux)
 

core/.mockery.yml

@@ -28,6 +28,12 @@ packages:
       outpkg: mocks_brightness
     interfaces:
       DBusConn:
+  github.com/AvengeMedia/DankMaterialShell/core/internal/geolocation:
+    config:
+      dir: "internal/mocks/geolocation"
+      outpkg: mocks_geolocation
+    interfaces:
+      Client:
   github.com/AvengeMedia/DankMaterialShell/core/internal/server/network:
     config:
       dir: "internal/mocks/network"

core/.pre-commit-config.yaml

@@ -1,13 +1,26 @@
 repos:
-  - repo: https://github.com/golangci/golangci-lint
-    rev: v2.9.0
-    hooks:
-      - id: golangci-lint-fmt
-        require_serial: true
-      - id: golangci-lint-full
-      - id: golangci-lint-config-verify
   - repo: local
     hooks:
+      - id: golangci-lint-fmt
+        name: golangci-lint-fmt
+        entry: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.3 fmt
+        language: system
+        require_serial: true
+        types: [go]
+        pass_filenames: false
+      - id: golangci-lint-full
+        name: golangci-lint-full
+        entry: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.3 run --fix
+        language: system
+        require_serial: true
+        types: [go]
+        pass_filenames: false
+      - id: golangci-lint-config-verify
+        name: golangci-lint-config-verify
+        entry: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.3 config verify
+        language: system
+        files: \.golangci\.(?:yml|yaml|toml|json)
+        pass_filenames: false
       - id: go-test
         name: go test
         entry: go test ./...

core/Makefile

@@ -63,19 +63,19 @@ endif
 
 build-all: build dankinstall
 
-install: build
+install:
 	@echo "Installing $(BINARY_NAME) to $(INSTALL_DIR)..."
 	@install -D -m 755 $(BUILD_DIR)/$(BINARY_NAME) $(INSTALL_DIR)/$(BINARY_NAME)
 	@echo "Installation complete"
 
-install-all: build-all
+install-all:
 	@echo "Installing $(BINARY_NAME) to $(INSTALL_DIR)..."
 	@install -D -m 755 $(BUILD_DIR)/$(BINARY_NAME) $(INSTALL_DIR)/$(BINARY_NAME)
 	@echo "Installing $(BINARY_NAME_INSTALL) to $(INSTALL_DIR)..."
 	@install -D -m 755 $(BUILD_DIR)/$(BINARY_NAME_INSTALL) $(INSTALL_DIR)/$(BINARY_NAME_INSTALL)
 	@echo "Installation complete"
 
-install-dankinstall: dankinstall
+install-dankinstall:
 	@echo "Installing $(BINARY_NAME_INSTALL) to $(INSTALL_DIR)..."
 	@install -D -m 755 $(BUILD_DIR)/$(BINARY_NAME_INSTALL) $(INSTALL_DIR)/$(BINARY_NAME_INSTALL)
 	@echo "Installation complete"

core/README.md

@@ -10,7 +10,7 @@ Go-based backend for DankMaterialShell providing system integration, IPC, and in
 Command-line interface and daemon for shell management and system control.
 
 **dankinstall**
-Distribution-aware installer with TUI for deploying DMS and compositor configurations on Arch, Fedora, Debian, Ubuntu, openSUSE, and Gentoo.
+Distribution-aware installer for deploying DMS and compositor configurations on Arch, Fedora, Debian, Ubuntu, openSUSE, and Gentoo. Supports both an interactive TUI and a headless (unattended) mode via CLI flags.
 
 ## System Integration
 
@@ -96,7 +96,7 @@ The on-screen preview displays the selected format. JSON output includes hex, RG
 
 ## Building
 
-Requires Go 1.24+
+Requires Go 1.25+
 
 **Development build:**
 
@@ -147,10 +147,50 @@ go-wayland-scanner -i internal/proto/xml/wlr-gamma-control-unstable-v1.xml \
 
 ## Installation via dankinstall
 
+**Interactive (TUI):**
+
 ```bash
 curl -fsSL https://install.danklinux.com | sh
 ```
 
+**Headless (unattended):**
+
+Headless mode requires cached sudo credentials. Run `sudo -v` first:
+
+```bash
+sudo -v && curl -fsSL https://install.danklinux.com | sh -s -- -c niri -t ghostty -y
+sudo -v && curl -fsSL https://install.danklinux.com | sh -s -- -c hyprland -t kitty --include-deps dms-greeter -y
+```
+
+| Flag | Short | Description |
+|------|-------|-------------|
+| `--compositor <niri|hyprland>` | `-c` | Compositor/WM to install (required for headless) |
+| `--term <ghostty|kitty|alacritty>` | `-t` | Terminal emulator (required for headless) |
+| `--include-deps <name,...>` | | Enable optional dependencies (e.g. `dms-greeter`) |
+| `--exclude-deps <name,...>` | | Skip specific dependencies |
+| `--replace-configs <name,...>` | | Replace specific configuration files (mutually exclusive with `--replace-configs-all`) |
+| `--replace-configs-all` | | Replace all configuration files (mutually exclusive with `--replace-configs`) |
+| `--yes` | `-y` | Required for headless mode — confirms installation without interactive prompts |
+
+Headless mode requires `--yes` to proceed; without it, the installer exits with an error.
+Configuration files are not replaced by default unless `--replace-configs` or `--replace-configs-all` is specified.
+`dms-greeter` is disabled by default; use `--include-deps dms-greeter` to enable it.
+
+When no flags are provided, `dankinstall` launches the interactive TUI.
+
+### Headless mode validation rules
+
+Headless mode activates when `--compositor` or `--term` is provided.
+
+- Both `--compositor` and `--term` are required; providing only one results in an error.
+- Headless-only flags (`--include-deps`, `--exclude-deps`, `--replace-configs`, `--replace-configs-all`, `--yes`) are rejected in TUI mode.
+- Positional arguments are not accepted.
+
+### Log file location
+
+`dankinstall` writes logs to `/tmp` by default.
+Set the `DANKINSTALL_LOG_DIR` environment variable to override the log directory.
+
 ## Supported Distributions
 
 Arch, Fedora, Debian, Ubuntu, openSUSE, Gentoo (and derivatives)

core/cmd/dankinstall/main.go

@@ -3,20 +3,152 @@ package main
 import (
 	"fmt"
 	"os"
+	"strings"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/headless"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/tui"
 	tea "github.com/charmbracelet/bubbletea"
+	"github.com/spf13/cobra"
 )
 
 var Version = "dev"
 
+// Flag variables bound via pflag
+var (
+	compositor        string
+	term              string
+	includeDeps       []string
+	excludeDeps       []string
+	replaceConfigs    []string
+	replaceConfigsAll bool
+	yes               bool
+)
+
+var rootCmd = &cobra.Command{
+	Use:   "dankinstall",
+	Short: "Install DankMaterialShell and its dependencies",
+	Long: `dankinstall sets up DankMaterialShell with your chosen compositor and terminal.
+
+Without flags, it launches an interactive TUI. Providing either --compositor
+or --term activates headless (unattended) mode, which requires both flags.
+
+Headless mode requires cached sudo credentials. Run 'sudo -v' beforehand, or
+configure passwordless sudo for your user.`,
+	Args:          cobra.NoArgs,
+	RunE:          runDankinstall,
+	SilenceErrors: true,
+	SilenceUsage:  true,
+}
+
+func init() {
+	rootCmd.Flags().StringVarP(&compositor, "compositor", "c", "", "Compositor/WM to install: niri or hyprland (enables headless mode)")
+	rootCmd.Flags().StringVarP(&term, "term", "t", "", "Terminal emulator to install: ghostty, kitty, or alacritty (enables headless mode)")
+	rootCmd.Flags().StringSliceVar(&includeDeps, "include-deps", []string{}, "Optional deps to enable (e.g. dms-greeter)")
+	rootCmd.Flags().StringSliceVar(&excludeDeps, "exclude-deps", []string{}, "Deps to skip during installation")
+	rootCmd.Flags().StringSliceVar(&replaceConfigs, "replace-configs", []string{}, "Deploy only named configs (e.g. niri,ghostty)")
+	rootCmd.Flags().BoolVar(&replaceConfigsAll, "replace-configs-all", false, "Deploy and replace all configurations")
+	rootCmd.Flags().BoolVarP(&yes, "yes", "y", false, "Auto-confirm all prompts")
+}
+
 func main() {
 	if os.Getuid() == 0 {
 		fmt.Fprintln(os.Stderr, "Error: dankinstall must not be run as root")
 		os.Exit(1)
 	}
 
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func runDankinstall(cmd *cobra.Command, args []string) error {
+	headlessMode := compositor != "" || term != ""
+
+	if !headlessMode {
+		// Reject headless-only flags when running in TUI mode.
+		headlessOnly := []string{
+			"include-deps",
+			"exclude-deps",
+			"replace-configs",
+			"replace-configs-all",
+			"yes",
+		}
+		var set []string
+		for _, name := range headlessOnly {
+			if cmd.Flags().Changed(name) {
+				set = append(set, "--"+name)
+			}
+		}
+		if len(set) > 0 {
+			return fmt.Errorf("flags %s are only valid in headless mode (requires both --compositor and --term)", strings.Join(set, ", "))
+		}
+	}
+
+	if headlessMode {
+		return runHeadless()
+	}
+	return runTUI()
+}
+
+func runHeadless() error {
+	// Validate required flags
+	if compositor == "" {
+		return fmt.Errorf("--compositor is required for headless mode (niri or hyprland)")
+	}
+	if term == "" {
+		return fmt.Errorf("--term is required for headless mode (ghostty, kitty, or alacritty)")
+	}
+
+	cfg := headless.Config{
+		Compositor:        compositor,
+		Terminal:          term,
+		IncludeDeps:       includeDeps,
+		ExcludeDeps:       excludeDeps,
+		ReplaceConfigs:    replaceConfigs,
+		ReplaceConfigsAll: replaceConfigsAll,
+		Yes:               yes,
+	}
+
+	runner := headless.NewRunner(cfg)
+
+	// Set up file logging
+	fileLogger, err := log.NewFileLogger()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Warning: Failed to create log file: %v\n", err)
+	}
+
+	if fileLogger != nil {
+		fmt.Printf("Logging to: %s\n", fileLogger.GetLogPath())
+		fileLogger.StartListening(runner.GetLogChan())
+		defer func() {
+			if err := fileLogger.Close(); err != nil {
+				fmt.Fprintf(os.Stderr, "Warning: Failed to close log file: %v\n", err)
+			}
+		}()
+	} else {
+		// Drain the log channel to prevent blocking sends from deadlocking
+		// downstream components (distros, config deployer) that write to it.
+		// Use an explicit stop signal because this code does not own the
+		// runner log channel and cannot assume it will be closed.
+		defer drainLogChan(runner.GetLogChan())()
+	}
+
+	if err := runner.Run(); err != nil {
+		if fileLogger != nil {
+			fmt.Fprintf(os.Stderr, "\nFull logs are available at: %s\n", fileLogger.GetLogPath())
+		}
+		return err
+	}
+
+	if fileLogger != nil {
+		fmt.Printf("\nFull logs are available at: %s\n", fileLogger.GetLogPath())
+	}
+	return nil
+}
+
+func runTUI() error {
 	fileLogger, err := log.NewFileLogger()
 	if err != nil {
 		fmt.Printf("Warning: Failed to create log file: %v\n", err)
@@ -38,18 +170,50 @@ func main() {
 
 	if fileLogger != nil {
 		fileLogger.StartListening(model.GetLogChan())
+	} else {
+		// Drain the log channel to prevent blocking sends from deadlocking
+		// downstream components (distros, config deployer) that write to it.
+		// Use an explicit stop signal because this code does not own the
+		// model log channel and cannot assume it will be closed.
+		defer drainLogChan(model.GetLogChan())()
 	}
 
 	p := tea.NewProgram(model, tea.WithAltScreen())
 	if _, err := p.Run(); err != nil {
-		fmt.Printf("Error running program: %v\n", err)
 		if logFilePath != "" {
-			fmt.Printf("\nFull logs are available at: %s\n", logFilePath)
+			fmt.Fprintf(os.Stderr, "\nFull logs are available at: %s\n", logFilePath)
 		}
-		os.Exit(1)
+		return fmt.Errorf("error running program: %w", err)
 	}
 
 	if logFilePath != "" {
 		fmt.Printf("\nFull logs are available at: %s\n", logFilePath)
 	}
+	return nil
+}
+
+// drainLogChan starts a goroutine that discards all messages from logCh,
+// preventing blocking sends from deadlocking downstream components. It returns
+// a cleanup function that signals the goroutine to stop and waits for it to
+// exit. Callers should defer the returned function.
+func drainLogChan(logCh <-chan string) func() {
+	drainStop := make(chan struct{})
+	drainDone := make(chan struct{})
+	go func() {
+		defer close(drainDone)
+		for {
+			select {
+			case <-drainStop:
+				return
+			case _, ok := <-logCh:
+				if !ok {
+					return
+				}
+			}
+		}
+	}()
+	return func() {
+		close(drainStop)
+		<-drainDone
+	}
 }

core/cmd/dms/assets/cli-policy.default.json

@@ -0,0 +1,10 @@
+{
+  "policy_version": 1,
+  "blocked_commands": [
+    "greeter install",
+    "greeter enable",
+    "greeter uninstall",
+    "setup"
+  ],
+  "message": "This command is disabled on immutable/image-based systems. Use your distro-native workflow for system-level changes."
+}

core/cmd/dms/commands_auth.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	sharedpam "github.com/AvengeMedia/DankMaterialShell/core/internal/pam"
+	"github.com/spf13/cobra"
+)
+
+var authCmd = &cobra.Command{
+	Use:   "auth",
+	Short: "Manage DMS authentication sync",
+	Long:  "Manage shared PAM/authentication setup for DMS greeter and lock screen",
+}
+
+var authSyncCmd = &cobra.Command{
+	Use:     "sync",
+	Short:   "Sync DMS authentication configuration",
+	Long:    "Apply shared PAM/authentication changes for the lock screen and greeter based on current DMS settings",
+	PreRunE: preRunPrivileged,
+	Run: func(cmd *cobra.Command, args []string) {
+		yes, _ := cmd.Flags().GetBool("yes")
+		term, _ := cmd.Flags().GetBool("terminal")
+		if term {
+			if err := syncAuthInTerminal(yes); err != nil {
+				log.Fatalf("Error launching auth sync in terminal: %v", err)
+			}
+			return
+		}
+		if err := syncAuth(yes); err != nil {
+			log.Fatalf("Error syncing authentication: %v", err)
+		}
+	},
+}
+
+func init() {
+	authSyncCmd.Flags().BoolP("yes", "y", false, "Non-interactive mode: skip prompts")
+	authSyncCmd.Flags().BoolP("terminal", "t", false, "Run auth sync in a new terminal (for entering sudo password)")
+}
+
+func syncAuth(nonInteractive bool) error {
+	if !nonInteractive {
+		fmt.Println("=== DMS Authentication Sync ===")
+		fmt.Println()
+	}
+
+	logFunc := func(msg string) {
+		fmt.Println(msg)
+	}
+
+	if err := sharedpam.SyncAuthConfig(logFunc, "", sharedpam.SyncAuthOptions{}); err != nil {
+		return err
+	}
+
+	if !nonInteractive {
+		fmt.Println("\n=== Authentication Sync Complete ===")
+		fmt.Println("\nAuthentication changes have been applied.")
+	}
+
+	return nil
+}
+
+func syncAuthInTerminal(nonInteractive bool) error {
+	syncFlags := make([]string, 0, 1)
+	if nonInteractive {
+		syncFlags = append(syncFlags, "--yes")
+	}
+
+	shellSyncCmd := "dms auth sync"
+	if len(syncFlags) > 0 {
+		shellSyncCmd += " " + strings.Join(syncFlags, " ")
+	}
+	shellCmd := shellSyncCmd + `; echo; echo "Authentication sync finished. Closing in 3 seconds..."; sleep 3`
+	return runCommandInTerminal(shellCmd)
+}

core/cmd/dms/commands_blur.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/blur"
+	"github.com/spf13/cobra"
+)
+
+var blurCmd = &cobra.Command{
+	Use:   "blur",
+	Short: "Background blur utilities",
+}
+
+var blurCheckCmd = &cobra.Command{
+	Use:   "check",
+	Short: "Check if the compositor supports background blur (ext-background-effect-v1)",
+	Args:  cobra.NoArgs,
+	Run:   runBlurCheck,
+}
+
+func init() {
+	blurCmd.AddCommand(blurCheckCmd)
+}
+
+func runBlurCheck(cmd *cobra.Command, args []string) {
+	supported, err := blur.ProbeSupport()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
+		os.Exit(1)
+	}
+
+	switch supported {
+	case true:
+		fmt.Println("supported")
+	default:
+		fmt.Println("unsupported")
+	}
+}

core/cmd/dms/commands_brightness.go

@@ -236,6 +236,7 @@ func runBrightnessSet(cmd *cobra.Command, args []string) {
 			defer ddc.Close()
 			time.Sleep(100 * time.Millisecond)
 			if err := ddc.SetBrightnessWithExponent(deviceID, percent, exponential, exponent, nil); err == nil {
+				ddc.WaitPending()
 				fmt.Printf("Set %s to %d%%\n", deviceID, percent)
 				return
 			}

core/cmd/dms/commands_clipboard.go

@@ -222,16 +222,19 @@ func init() {
 
 func runClipCopy(cmd *cobra.Command, args []string) {
 	var data []byte
+	copyFromStdin := false
 
 	switch {
 	case len(args) > 0:
 		data = []byte(args[0])
-	default:
+	case clipCopyDownload || clipCopyType == "__multi__":
 		var err error
 		data, err = io.ReadAll(os.Stdin)
 		if err != nil {
 			log.Fatalf("read stdin: %v", err)
 		}
+	default:
+		copyFromStdin = true
 	}
 
 	if clipCopyDownload {
@@ -257,6 +260,13 @@ func runClipCopy(cmd *cobra.Command, args []string) {
 		return
 	}
 
+	if copyFromStdin {
+		if err := clipboard.CopyReader(os.Stdin, clipCopyType, clipCopyForeground, clipCopyPasteOnce); err != nil {
+			log.Fatalf("copy: %v", err)
+		}
+		return
+	}
+
 	if err := clipboard.CopyOpts(data, clipCopyType, clipCopyForeground, clipCopyPasteOnce); err != nil {
 		log.Fatalf("copy: %v", err)
 	}

core/cmd/dms/commands_colorpicker.go

@@ -37,6 +37,9 @@ Output format flags (mutually exclusive, default: --hex):
   --cmyk - CMYK values (C% M% Y% K%)
   --json - JSON with all formats
 
+Optional:
+  --raw - Removes ANSI escape codes and background colors. Use this when piping to other commands
+
 Examples:
   dms color pick                # Pick color, output as hex
   dms color pick --rgb          # Output as RGB
@@ -53,6 +56,7 @@ func init() {
 	colorPickCmd.Flags().Bool("hsv", false, "Output as HSV (H S% V%)")
 	colorPickCmd.Flags().Bool("cmyk", false, "Output as CMYK (C% M% Y% K%)")
 	colorPickCmd.Flags().Bool("json", false, "Output all formats as JSON")
+	colorPickCmd.Flags().Bool("raw", false, "Removes ANSI escape codes and background colors. Use this when piping to other commands")
 	colorPickCmd.Flags().StringVarP(&colorOutputFmt, "output-format", "o", "", "Custom output format template")
 	colorPickCmd.Flags().BoolVarP(&colorAutocopy, "autocopy", "a", false, "Copy result to clipboard")
 	colorPickCmd.Flags().BoolVarP(&colorLowercase, "lowercase", "l", false, "Output hex in lowercase")
@@ -113,7 +117,15 @@ func runColorPick(cmd *cobra.Command, args []string) {
 
 	if jsonOutput {
 		fmt.Println(output)
-	} else if color.IsDark() {
+		return
+	}
+
+	if raw, _ := cmd.Flags().GetBool("raw"); raw {
+		fmt.Printf("%s\n", output)
+		return
+	}
+
+	if color.IsDark() {
 		fmt.Printf("\033[48;2;%d;%d;%dm\033[97m %s \033[0m\n", color.R, color.G, color.B, output)
 	} else {
 		fmt.Printf("\033[48;2;%d;%d;%dm\033[30m %s \033[0m\n", color.R, color.G, color.B, output)

core/cmd/dms/commands_common.go

@@ -64,9 +64,8 @@ var killCmd = &cobra.Command{
 }
 
 var ipcCmd = &cobra.Command{
-	Use:     "ipc [target] [function] [args...]",
-	Short:   "Send IPC commands to running DMS shell",
-	PreRunE: findConfig,
+	Use:   "ipc [target] [function] [args...]",
+	Short: "Send IPC commands to running DMS shell",
 	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		_ = findConfig(cmd, args)
 		return getShellIPCCompletions(args, toComplete), cobra.ShellCompDirectiveNoFileComp
@@ -525,5 +524,8 @@ func getCommonCommands() []*cobra.Command {
 		doctorCmd,
 		configCmd,
 		dlCmd,
+		randrCmd,
+		blurCmd,
+		trashCmd,
 	}
 }

core/cmd/dms/commands_doctor.go

@@ -11,6 +11,7 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/blur"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
@@ -82,7 +83,7 @@ func (ds *DoctorStatus) OKCount() int {
 }
 
 var (
-	quickshellVersionRegex = regexp.MustCompile(`quickshell (\d+\.\d+\.\d+)`)
+	quickshellVersionRegex = regexp.MustCompile(`(?i)quickshell (\d+\.\d+\.\d+)`)
 	hyprlandVersionRegex   = regexp.MustCompile(`v?(\d+\.\d+\.\d+)`)
 	niriVersionRegex       = regexp.MustCompile(`niri (\d+\.\d+)`)
 	swayVersionRegex       = regexp.MustCompile(`sway version (\d+\.\d+)`)
@@ -90,6 +91,7 @@ var (
 	wayfireVersionRegex    = regexp.MustCompile(`wayfire (\d+\.\d+)`)
 	labwcVersionRegex      = regexp.MustCompile(`labwc (\d+\.\d+\.\d+)`)
 	mangowcVersionRegex    = regexp.MustCompile(`mango (\d+\.\d+\.\d+)`)
+	miracleVersionRegex    = regexp.MustCompile(`miracle-wm v?(\d+\.\d+\.\d+)`)
 )
 
 var doctorCmd = &cobra.Command{
@@ -468,6 +470,7 @@ func checkWindowManagers() []checkResult {
 		{"Wayfire", "wayfire", "--version", wayfireVersionRegex, []string{"wayfire"}},
 		{"labwc", "labwc", "--version", labwcVersionRegex, []string{"labwc"}},
 		{"mangowc", "mango", "-v", mangowcVersionRegex, []string{"mango"}},
+		{"Miracle WM", "miracle-wm", "--version", miracleVersionRegex, []string{"miracle-wm"}},
 	}
 
 	var results []checkResult
@@ -500,7 +503,7 @@ func checkWindowManagers() []checkResult {
 		results = append(results, checkResult{
 			catCompositor, "Compositor", statusError,
 			"No supported Wayland compositor found",
-			"Install Hyprland, niri, Sway, River, or Wayfire",
+			"Install Hyprland, niri, Sway, River, Wayfire, or miracle-wm",
 			doctorDocsURL + "#compositor-checks",
 		})
 	}
@@ -509,9 +512,24 @@ func checkWindowManagers() []checkResult {
 		results = append(results, checkResult{catCompositor, "Active", statusInfo, wm, "", doctorDocsURL + "#compositor"})
 	}
 
+	results = append(results, checkCompositorBlurSupport())
+
 	return results
 }
 
+func checkCompositorBlurSupport() checkResult {
+	supported, err := blur.ProbeSupport()
+	if err != nil {
+		return checkResult{catCompositor, "Background Blur", statusInfo, "Unable to verify", err.Error(), doctorDocsURL + "#compositor-checks"}
+	}
+
+	if supported {
+		return checkResult{catCompositor, "Background Blur", statusOK, "Supported", "Compositor supports ext-background-effect-v1", doctorDocsURL + "#compositor-checks"}
+	}
+
+	return checkResult{catCompositor, "Background Blur", statusWarn, "Unsupported", "Compositor does not support ext-background-effect-v1", doctorDocsURL + "#compositor-checks"}
+}
+
 func getVersionFromCommand(cmd, arg string, regex *regexp.Regexp) string {
 	output, err := exec.Command(cmd, arg).CombinedOutput()
 	if err != nil && len(output) == 0 {
@@ -535,6 +553,8 @@ func detectRunningWM() string {
 		return "Hyprland"
 	case os.Getenv("NIRI_SOCKET") != "":
 		return "niri"
+	case os.Getenv("MIRACLESOCK") != "":
+		return "Miracle WM"
 	case os.Getenv("XDG_CURRENT_DESKTOP") != "":
 		return os.Getenv("XDG_CURRENT_DESKTOP")
 	}
@@ -553,6 +573,7 @@ func checkQuickshellFeatures() ([]checkResult, bool) {
 	qmlContent := `
 import QtQuick
 import Quickshell
+import Quickshell.Wayland
 
 ShellRoot {
 	id: root
@@ -561,6 +582,7 @@ ShellRoot {
 	property bool idleMonitorAvailable: false
 	property bool idleInhibitorAvailable: false
 	property bool shortcutInhibitorAvailable: false
+	property bool backgroundBlurAvailable: false
 
 	Timer {
 		interval: 50
@@ -578,16 +600,18 @@ ShellRoot {
 
 			try {
 				var testItem = Qt.createQmlObject(
-					'import Quickshell.Wayland; import QtQuick; QtObject { ' +
+					'import Quickshell; import Quickshell.Wayland; import QtQuick; QtObject { ' +
 					'readonly property bool hasIdleMonitor: typeof IdleMonitor !== "undefined"; ' +
 					'readonly property bool hasIdleInhibitor: typeof IdleInhibitor !== "undefined"; ' +
-					'readonly property bool hasShortcutInhibitor: typeof ShortcutInhibitor !== "undefined" ' +
+					'readonly property bool hasShortcutInhibitor: typeof ShortcutInhibitor !== "undefined"; ' +
+					'readonly property bool hasBackgroundBlur: typeof BackgroundEffect !== "undefined" ' +
 					'}',
 					root
 				)
 				root.idleMonitorAvailable = testItem.hasIdleMonitor
 				root.idleInhibitorAvailable = testItem.hasIdleInhibitor
 				root.shortcutInhibitorAvailable = testItem.hasShortcutInhibitor
+				root.backgroundBlurAvailable = testItem.hasBackgroundBlur
 				testItem.destroy()
 			} catch (e) {}
 
@@ -596,6 +620,8 @@ ShellRoot {
 			console.warn(root.idleInhibitorAvailable ? "FEATURE:IdleInhibitor:OK" : "FEATURE:IdleInhibitor:UNAVAILABLE")
 			console.warn(root.shortcutInhibitorAvailable ? "FEATURE:ShortcutInhibitor:OK" : "FEATURE:ShortcutInhibitor:UNAVAILABLE")
 
+			console.warn(root.backgroundBlurAvailable ? "FEATURE:BackgroundBlur:OK" : "FEATURE:BackgroundBlur:UNAVAILABLE")
+
 			Quickshell.execDetached(["kill", "-TERM", String(Quickshell.processId)])
 		}
 	}
@@ -616,6 +642,7 @@ ShellRoot {
 		{"IdleMonitor", "Idle detection"},
 		{"IdleInhibitor", "Prevent idle/sleep"},
 		{"ShortcutInhibitor", "Allow shortcut management (niri)"},
+		{"BackgroundBlur", "Background blur API support in Quickshell"},
 	}
 
 	var results []checkResult
@@ -649,58 +676,104 @@ func checkI2CAvailability() checkResult {
 	return checkResult{catOptionalFeatures, "I2C/DDC", statusOK, fmt.Sprintf("%d monitor(s) detected", len(devices)), "External monitor brightness control", doctorDocsURL + "#optional-features"}
 }
 
-func checkKImageFormats() checkResult {
+func checkImageFormatPlugins() []checkResult {
 	url := doctorDocsURL + "#optional-features"
-	desc := "Extra image format support (AVIF, HEIF, JXL)"
 
-	pluginDir := findQtPluginDir()
-	if pluginDir == "" {
-		return checkResult{catOptionalFeatures, "kimageformats", statusInfo, "Cannot detect (qtpaths not found)", desc, url}
-	}
-
-	imageFormatsDir := filepath.Join(pluginDir, "imageformats")
-	keyPlugins := []struct{ file, format string }{
-		{"kimg_avif.so", "AVIF"},
-		{"kimg_heif.so", "HEIF"},
-		{"kimg_jxl.so", "JXL"},
-		{"kimg_exr.so", "EXR"},
-	}
-
-	var found []string
-	for _, p := range keyPlugins {
-		if _, err := os.Stat(filepath.Join(imageFormatsDir, p.file)); err == nil {
-			found = append(found, p.format)
+	pluginDirs := findQtPluginDirs()
+	if len(pluginDirs) == 0 {
+		return []checkResult{
+			{catOptionalFeatures, "qt6-imageformats", statusInfo, "Cannot detect (plugin dir not found)", "WebP, TIFF, JP2 support", url},
+			{catOptionalFeatures, "kimageformats", statusInfo, "Cannot detect (plugin dir not found)", "AVIF, HEIF, JXL support", url},
 		}
 	}
 
-	if len(found) == 0 {
-		return checkResult{catOptionalFeatures, "kimageformats", statusWarn, "Not installed", desc, url}
+	type pluginCheck struct {
+		name    string
+		desc    string
+		plugins []struct{ file, format string }
 	}
 
-	details := ""
-	if doctorVerbose {
-		details = fmt.Sprintf("Formats: %s (%s)", strings.Join(found, ", "), imageFormatsDir)
+	checks := []pluginCheck{
+		{
+			name: "qt6-imageformats",
+			desc: "WebP, TIFF, GIF, JP2 support",
+			plugins: []struct{ file, format string }{
+				{"libqwebp.so", "WebP"},
+				{"libqtiff.so", "TIFF"},
+				{"libqgif.so", "GIF"},
+				{"libqjp2.so", "JP2"},
+				{"libqicns.so", "ICNS"},
+			},
+		},
+		{
+			name: "kimageformats",
+			desc: "AVIF, HEIF, JXL support",
+			plugins: []struct{ file, format string }{
+				{"kimg_avif.so", "AVIF"},
+				{"kimg_heif.so", "HEIF"},
+				{"kimg_jxl.so", "JXL"},
+				{"kimg_exr.so", "EXR"},
+			},
+		},
 	}
 
-	return checkResult{catOptionalFeatures, "kimageformats", statusOK, fmt.Sprintf("Installed (%d formats)", len(found)), details, url}
+	var results []checkResult
+	for _, c := range checks {
+		var found []string
+		var foundDirs []string
+		for _, pluginDir := range pluginDirs {
+			imageFormatsDir := filepath.Join(pluginDir, "imageformats")
+			for _, p := range c.plugins {
+				if _, err := os.Stat(filepath.Join(imageFormatsDir, p.file)); err == nil {
+					if !slices.Contains(found, p.format) {
+						found = append(found, p.format)
+					}
+					if !slices.Contains(foundDirs, imageFormatsDir) {
+						foundDirs = append(foundDirs, imageFormatsDir)
+					}
+				}
+			}
+		}
+
+		var result checkResult
+		switch {
+		case len(found) == 0:
+			result = checkResult{catOptionalFeatures, c.name, statusWarn, "Not installed", c.desc, url}
+		default:
+			details := ""
+			if doctorVerbose {
+				details = fmt.Sprintf("Formats: %s (%s)", strings.Join(found, ", "), strings.Join(foundDirs, ":"))
+			}
+			result = checkResult{catOptionalFeatures, c.name, statusOK, fmt.Sprintf("Installed (%d formats)", len(found)), details, url}
+		}
+		results = append(results, result)
+	}
+
+	return results
 }
 
-func findQtPluginDir() string {
-	// Check QT_PLUGIN_PATH env var first (used by NixOS and custom setups)
+func findQtPluginDirs() []string {
+	var dirs []string
+
+	addDir := func(dir string) {
+		if dir != "" {
+			if _, err := os.Stat(filepath.Join(dir, "imageformats")); err == nil {
+				dirs = append(dirs, dir)
+			}
+		}
+	}
+
+	// Check all paths in QT_PLUGIN_PATH env var (used by NixOS and custom setups)
 	if envPath := os.Getenv("QT_PLUGIN_PATH"); envPath != "" {
 		for dir := range strings.SplitSeq(envPath, ":") {
-			if _, err := os.Stat(filepath.Join(dir, "imageformats")); err == nil {
-				return dir
-			}
+			addDir(dir)
 		}
 	}
 
 	// Try qtpaths
 	for _, cmd := range []string{"qtpaths6", "qtpaths"} {
 		if output, err := exec.Command(cmd, "-query", "QT_INSTALL_PLUGINS").Output(); err == nil {
-			if dir := strings.TrimSpace(string(output)); dir != "" {
-				return dir
-			}
+			addDir(strings.TrimSpace(string(output)))
 		}
 	}
 
@@ -711,12 +784,10 @@ func findQtPluginDir() string {
 		"/usr/lib/x86_64-linux-gnu/qt6/plugins",
 		"/usr/lib/aarch64-linux-gnu/qt6/plugins",
 	} {
-		if _, err := os.Stat(filepath.Join(dir, "imageformats")); err == nil {
-			return dir
-		}
+		addDir(dir)
 	}
 
-	return ""
+	return dirs
 }
 
 func detectNetworkBackend(stackResult *network.DetectResult) string {
@@ -773,13 +844,17 @@ func checkOptionalDependencies() []checkResult {
 	results = append(results, checkResult{catOptionalFeatures, "cups-pk-helper", cupsPkStatus, cupsPkMsg, "Printer management", optionalFeaturesURL})
 
 	results = append(results, checkI2CAvailability())
-	results = append(results, checkKImageFormats())
+	results = append(results, checkImageFormatPlugins()...)
 
 	terminals := []string{"ghostty", "kitty", "alacritty", "foot", "wezterm"}
-	if idx := slices.IndexFunc(terminals, utils.CommandExists); idx >= 0 {
-		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusOK, terminals[idx], "", optionalFeaturesURL})
+	terminals = slices.DeleteFunc(terminals, func(t string) bool {
+		return !utils.CommandExists(t)
+	})
+
+	if len(terminals) > 0 {
+		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusOK, strings.Join(terminals, ", "), "", optionalFeaturesURL})
 	} else {
-		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusWarn, "None found", "Install ghostty, kitty, or alacritty", optionalFeaturesURL})
+		results = append(results, checkResult{catOptionalFeatures, "Terminal", statusWarn, "None found", "Install ghostty, kitty, foot or alacritty", optionalFeaturesURL})
 	}
 
 	networkResult, err := network.DetectNetworkStack()
@@ -1035,14 +1110,14 @@ func formatResultsPlain(results []checkResult) string {
 			if currentCategory != -1 {
 				sb.WriteString("\n")
 			}
-			sb.WriteString(fmt.Sprintf("**%s**\n", r.category.String()))
+			fmt.Fprintf(&sb, "**%s**\n", r.category.String())
 			currentCategory = r.category
 		}
 
-		sb.WriteString(fmt.Sprintf("- [%s] %s: %s\n", r.status, r.name, r.message))
+		fmt.Fprintf(&sb, "- [%s] %s: %s\n", r.status, r.name, r.message)
 
 		if doctorVerbose && r.details != "" {
-			sb.WriteString(fmt.Sprintf("  - %s\n", r.details))
+			fmt.Fprintf(&sb, "  - %s\n", r.details)
 		}
 	}
 
@@ -1052,8 +1127,8 @@ func formatResultsPlain(results []checkResult) string {
 	}
 
 	sb.WriteString("\n---\n")
-	sb.WriteString(fmt.Sprintf("**Summary:** %d error(s), %d warning(s), %d ok\n",
-		ds.ErrorCount(), ds.WarningCount(), ds.OKCount()))
+	fmt.Fprintf(&sb, "**Summary:** %d error(s), %d warning(s), %d ok\n",
+		ds.ErrorCount(), ds.WarningCount(), ds.OKCount())
 
 	return sb.String()
 }

core/cmd/dms/commands_features.go

@@ -4,6 +4,7 @@ package main
 
 import (
 	"bufio"
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -15,6 +16,7 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/errdefs"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/version"
 	"github.com/spf13/cobra"
@@ -109,16 +111,37 @@ func updateArchLinux() error {
 	}
 
 	var packageName string
-	if isArchPackageInstalled("dms-shell-bin") {
-		packageName = "dms-shell-bin"
+	var isAUR bool
+	if isArchPackageInstalled("dms-shell") {
+		packageName = "dms-shell"
 	} else if isArchPackageInstalled("dms-shell-git") {
 		packageName = "dms-shell-git"
+		isAUR = true
+	} else if isArchPackageInstalled("dms-shell-bin") {
+		packageName = "dms-shell-bin"
+		isAUR = true
 	} else {
-		fmt.Println("Info: Neither dms-shell-bin nor dms-shell-git package found.")
+		fmt.Println("Info: No dms-shell package found.")
 		fmt.Println("Info: Falling back to git-based update method...")
 		return updateOtherDistros()
 	}
 
+	if !isAUR {
+		fmt.Printf("This will update %s using pacman.\n", packageName)
+		if !confirmUpdate() {
+			return errdefs.ErrUpdateCancelled
+		}
+
+		fmt.Printf("\nRunning: pacman -S %s\n", packageName)
+		if err := privesc.Run(context.Background(), "", "pacman", "-S", "--noconfirm", packageName); err != nil {
+			fmt.Printf("Error: Failed to update using pacman: %v\n", err)
+			return err
+		}
+
+		fmt.Println("dms successfully updated")
+		return nil
+	}
+
 	var helper string
 	var updateCmd *exec.Cmd
 
@@ -454,11 +477,7 @@ func updateDMSBinary() error {
 
 	fmt.Printf("Installing to %s...\n", currentPath)
 
-	replaceCmd := exec.Command("sudo", "install", "-m", "0755", decompressedPath, currentPath)
-	replaceCmd.Stdin = os.Stdin
-	replaceCmd.Stdout = os.Stdout
-	replaceCmd.Stderr = os.Stderr
-	if err := replaceCmd.Run(); err != nil {
+	if err := privesc.Run(context.Background(), "", "install", "-m", "0755", decompressedPath, currentPath); err != nil {
 		return fmt.Errorf("failed to replace binary: %w", err)
 	}
 

core/cmd/dms/commands_greeter_test.go

@@ -0,0 +1,87 @@
+package main
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+
+	sharedpam "github.com/AvengeMedia/DankMaterialShell/core/internal/pam"
+)
+
+func TestSyncGreeterConfigsAndAuthDelegatesSharedAuth(t *testing.T) {
+	origGreeterConfigSyncFn := greeterConfigSyncFn
+	origSharedAuthSyncFn := sharedAuthSyncFn
+	t.Cleanup(func() {
+		greeterConfigSyncFn = origGreeterConfigSyncFn
+		sharedAuthSyncFn = origSharedAuthSyncFn
+	})
+
+	var calls []string
+	greeterConfigSyncFn = func(dmsPath, compositor string, logFunc func(string), sudoPassword string) error {
+		if dmsPath != "/tmp/dms" {
+			t.Fatalf("unexpected dmsPath %q", dmsPath)
+		}
+		if compositor != "niri" {
+			t.Fatalf("unexpected compositor %q", compositor)
+		}
+		if sudoPassword != "" {
+			t.Fatalf("expected empty sudoPassword, got %q", sudoPassword)
+		}
+		calls = append(calls, "configs")
+		return nil
+	}
+
+	var gotOptions sharedpam.SyncAuthOptions
+	sharedAuthSyncFn = func(logFunc func(string), sudoPassword string, options sharedpam.SyncAuthOptions) error {
+		if sudoPassword != "" {
+			t.Fatalf("expected empty sudoPassword, got %q", sudoPassword)
+		}
+		gotOptions = options
+		calls = append(calls, "auth")
+		return nil
+	}
+
+	err := syncGreeterConfigsAndAuth("/tmp/dms", "niri", func(string) {}, sharedpam.SyncAuthOptions{
+		ForceGreeterAuth: true,
+	}, func() {
+		calls = append(calls, "before-auth")
+	})
+	if err != nil {
+		t.Fatalf("syncGreeterConfigsAndAuth returned error: %v", err)
+	}
+
+	wantCalls := []string{"configs", "before-auth", "auth"}
+	if !reflect.DeepEqual(calls, wantCalls) {
+		t.Fatalf("call order = %v, want %v", calls, wantCalls)
+	}
+	if !gotOptions.ForceGreeterAuth {
+		t.Fatalf("expected ForceGreeterAuth to be true, got %+v", gotOptions)
+	}
+}
+
+func TestSyncGreeterConfigsAndAuthStopsOnConfigError(t *testing.T) {
+	origGreeterConfigSyncFn := greeterConfigSyncFn
+	origSharedAuthSyncFn := sharedAuthSyncFn
+	t.Cleanup(func() {
+		greeterConfigSyncFn = origGreeterConfigSyncFn
+		sharedAuthSyncFn = origSharedAuthSyncFn
+	})
+
+	greeterConfigSyncFn = func(string, string, func(string), string) error {
+		return errors.New("config sync failed")
+	}
+
+	authCalled := false
+	sharedAuthSyncFn = func(func(string), string, sharedpam.SyncAuthOptions) error {
+		authCalled = true
+		return nil
+	}
+
+	err := syncGreeterConfigsAndAuth("/tmp/dms", "niri", func(string) {}, sharedpam.SyncAuthOptions{}, nil)
+	if err == nil || err.Error() != "config sync failed" {
+		t.Fatalf("expected config sync error, got %v", err)
+	}
+	if authCalled {
+		t.Fatal("expected auth sync not to run after config sync failure")
+	}
+}

core/cmd/dms/commands_matugen.go

@@ -3,7 +3,9 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"os"
 	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
@@ -55,10 +57,11 @@ func init() {
 		cmd.Flags().Bool("sync-mode-with-portal", false, "Sync color scheme with GNOME portal")
 		cmd.Flags().Bool("terminals-always-dark", false, "Force terminal themes to dark variant")
 		cmd.Flags().String("skip-templates", "", "Comma-separated list of templates to skip")
+		cmd.Flags().Float64("contrast", 0, "Contrast value from -1 to 1 (0 = standard)")
 	}
 
 	matugenQueueCmd.Flags().Bool("wait", true, "Wait for completion")
-	matugenQueueCmd.Flags().Duration("timeout", 30*time.Second, "Timeout for waiting")
+	matugenQueueCmd.Flags().Duration("timeout", 90*time.Second, "Timeout for waiting")
 }
 
 func buildMatugenOptions(cmd *cobra.Command) matugen.Options {
@@ -75,6 +78,7 @@ func buildMatugenOptions(cmd *cobra.Command) matugen.Options {
 	syncModeWithPortal, _ := cmd.Flags().GetBool("sync-mode-with-portal")
 	terminalsAlwaysDark, _ := cmd.Flags().GetBool("terminals-always-dark")
 	skipTemplates, _ := cmd.Flags().GetString("skip-templates")
+	contrast, _ := cmd.Flags().GetFloat64("contrast")
 
 	return matugen.Options{
 		StateDir:            stateDir,
@@ -85,6 +89,7 @@ func buildMatugenOptions(cmd *cobra.Command) matugen.Options {
 		Mode:                matugen.ColorMode(mode),
 		IconTheme:           iconTheme,
 		MatugenType:         matugenType,
+		Contrast:            contrast,
 		RunUserTemplates:    runUserTemplates,
 		StockColors:         stockColors,
 		SyncModeWithPortal:  syncModeWithPortal,
@@ -95,7 +100,11 @@ func buildMatugenOptions(cmd *cobra.Command) matugen.Options {
 
 func runMatugenGenerate(cmd *cobra.Command, args []string) {
 	opts := buildMatugenOptions(cmd)
-	if err := matugen.Run(opts); err != nil {
+	err := matugen.Run(opts)
+	switch {
+	case errors.Is(err, matugen.ErrNoChanges):
+		os.Exit(2)
+	case err != nil:
 		log.Fatalf("Theme generation failed: %v", err)
 	}
 }
@@ -122,6 +131,7 @@ func runMatugenQueue(cmd *cobra.Command, args []string) {
 			"syncModeWithPortal":  opts.SyncModeWithPortal,
 			"terminalsAlwaysDark": opts.TerminalsAlwaysDark,
 			"skipTemplates":       opts.SkipTemplates,
+			"contrast":            opts.Contrast,
 			"wait":                wait,
 		},
 	}
@@ -129,7 +139,11 @@ func runMatugenQueue(cmd *cobra.Command, args []string) {
 	if !wait {
 		if err := sendServerRequestFireAndForget(request); err != nil {
 			log.Info("Server unavailable, running synchronously")
-			if err := matugen.Run(opts); err != nil {
+			err := matugen.Run(opts)
+			switch {
+			case errors.Is(err, matugen.ErrNoChanges):
+				os.Exit(2)
+			case err != nil:
 				log.Fatalf("Theme generation failed: %v", err)
 			}
 			return
@@ -146,11 +160,15 @@ func runMatugenQueue(cmd *cobra.Command, args []string) {
 		resp, ok := tryServerRequest(request)
 		if !ok {
 			log.Info("Server unavailable, running synchronously")
-			if err := matugen.Run(opts); err != nil {
+			err := matugen.Run(opts)
+			switch {
+			case errors.Is(err, matugen.ErrNoChanges):
+				resultCh <- matugen.ErrNoChanges
+			case err != nil:
 				resultCh <- err
-				return
+			default:
+				resultCh <- nil
 			}
-			resultCh <- nil
 			return
 		}
 		if resp.Error != "" {
@@ -162,7 +180,10 @@ func runMatugenQueue(cmd *cobra.Command, args []string) {
 
 	select {
 	case err := <-resultCh:
-		if err != nil {
+		switch {
+		case errors.Is(err, matugen.ErrNoChanges):
+			os.Exit(2)
+		case err != nil:
 			log.Fatalf("Theme generation failed: %v", err)
 		}
 		fmt.Println("Theme generation completed")

core/cmd/dms/commands_randr.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/spf13/cobra"
+)
+
+var randrCmd = &cobra.Command{
+	Use:   "randr",
+	Short: "Query output display information",
+	Long:  "Query Wayland compositor for output names, scales, resolutions and refresh rates via zwlr-output-management",
+	Run:   runRandr,
+}
+
+func init() {
+	randrCmd.Flags().Bool("json", false, "Output in JSON format")
+}
+
+type randrJSON struct {
+	Outputs []randrOutput `json:"outputs"`
+}
+
+func runRandr(cmd *cobra.Command, args []string) {
+	outputs, err := queryRandr()
+	if err != nil {
+		log.Fatalf("%v", err)
+	}
+
+	jsonFlag, _ := cmd.Flags().GetBool("json")
+
+	if jsonFlag {
+		data, err := json.Marshal(randrJSON{Outputs: outputs})
+		if err != nil {
+			log.Fatalf("failed to marshal JSON: %v", err)
+		}
+		fmt.Println(string(data))
+		return
+	}
+
+	for i, out := range outputs {
+		if i > 0 {
+			fmt.Println()
+		}
+		status := "enabled"
+		if !out.Enabled {
+			status = "disabled"
+		}
+		fmt.Printf("%s (%s)\n", out.Name, status)
+		fmt.Printf("  Scale:      %.4g\n", out.Scale)
+		fmt.Printf("  Resolution: %dx%d\n", out.Width, out.Height)
+		if out.Refresh > 0 {
+			fmt.Printf("  Refresh:    %.2f Hz\n", float64(out.Refresh)/1000.0)
+		}
+	}
+}

core/cmd/dms/commands_screenshot.go

@@ -13,16 +13,18 @@ import (
 )
 
 var (
-	ssOutputName    string
-	ssIncludeCursor bool
-	ssFormat        string
-	ssQuality       int
-	ssOutputDir     string
-	ssFilename      string
-	ssNoClipboard   bool
-	ssNoFile        bool
-	ssNoNotify      bool
-	ssStdout        bool
+	ssOutputName  string
+	ssCursor      string
+	ssFormat      string
+	ssQuality     int
+	ssOutputDir   string
+	ssFilename    string
+	ssNoClipboard bool
+	ssNoFile      bool
+	ssNoNotify    bool
+	ssNoConfirm   bool
+	ssReset       bool
+	ssStdout      bool
 )
 
 var screenshotCmd = &cobra.Command{
@@ -50,9 +52,11 @@ Examples:
   dms screenshot output -o DP-1      # Specific output
   dms screenshot window              # Focused window (Hyprland)
   dms screenshot last                # Last region (pre-selected)
+  dms screenshot --reset             # Reset last region pre-selection
   dms screenshot --no-clipboard      # Save file only
   dms screenshot --no-file           # Clipboard only
-  dms screenshot --cursor            # Include cursor
+  dms screenshot --no-confirm        # Region capture on mouse release
+  dms screenshot --cursor=on         # Include cursor
   dms screenshot -f jpg -q 85        # JPEG with quality 85`,
 }
 
@@ -111,7 +115,7 @@ var notifyActionCmd = &cobra.Command{
 
 func init() {
 	screenshotCmd.PersistentFlags().StringVarP(&ssOutputName, "output", "o", "", "Output name for 'output' mode")
-	screenshotCmd.PersistentFlags().BoolVar(&ssIncludeCursor, "cursor", false, "Include cursor in screenshot")
+	screenshotCmd.PersistentFlags().StringVar(&ssCursor, "cursor", "off", "Include cursor in screenshot (on/off)")
 	screenshotCmd.PersistentFlags().StringVarP(&ssFormat, "format", "f", "png", "Output format (png, jpg, ppm)")
 	screenshotCmd.PersistentFlags().IntVarP(&ssQuality, "quality", "q", 90, "JPEG quality (1-100)")
 	screenshotCmd.PersistentFlags().StringVarP(&ssOutputDir, "dir", "d", "", "Output directory")
@@ -119,6 +123,8 @@ func init() {
 	screenshotCmd.PersistentFlags().BoolVar(&ssNoClipboard, "no-clipboard", false, "Don't copy to clipboard")
 	screenshotCmd.PersistentFlags().BoolVar(&ssNoFile, "no-file", false, "Don't save to file")
 	screenshotCmd.PersistentFlags().BoolVar(&ssNoNotify, "no-notify", false, "Don't show notification")
+	screenshotCmd.PersistentFlags().BoolVar(&ssNoConfirm, "no-confirm", false, "Region mode: capture on mouse release without Enter/Space confirmation")
+	screenshotCmd.PersistentFlags().BoolVar(&ssReset, "reset", false, "Reset saved last-region preselection before capturing")
 	screenshotCmd.PersistentFlags().BoolVar(&ssStdout, "stdout", false, "Output image to stdout (for piping to swappy, etc.)")
 
 	screenshotCmd.AddCommand(ssRegionCmd)
@@ -136,10 +142,14 @@ func getScreenshotConfig(mode screenshot.Mode) screenshot.Config {
 	config := screenshot.DefaultConfig()
 	config.Mode = mode
 	config.OutputName = ssOutputName
-	config.IncludeCursor = ssIncludeCursor
+	if strings.EqualFold(ssCursor, "on") {
+		config.Cursor = screenshot.CursorOn
+	}
 	config.Clipboard = !ssNoClipboard
 	config.SaveFile = !ssNoFile
 	config.Notify = !ssNoNotify
+	config.NoConfirm = ssNoConfirm
+	config.Reset = ssReset
 	config.Stdout = ssStdout
 
 	if ssOutputDir != "" {

core/cmd/dms/commands_setup.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 
@@ -11,14 +12,16 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/greeter"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
 	"github.com/spf13/cobra"
 )
 
 var setupCmd = &cobra.Command{
-	Use:   "setup",
-	Short: "Deploy DMS configurations",
-	Long:  "Deploy compositor and terminal configurations with interactive prompts",
+	Use:               "setup",
+	Short:             "Deploy DMS configurations",
+	Long:              "Deploy compositor and terminal configurations with interactive prompts",
+	PersistentPreRunE: preRunPrivileged,
 	Run: func(cmd *cobra.Command, args []string) {
 		if err := runSetup(); err != nil {
 			log.Fatalf("Error during setup: %v", err)
@@ -266,6 +269,8 @@ func runSetupDmsConfig(name string) error {
 func runSetup() error {
 	fmt.Println("=== DMS Configuration Setup ===")
 
+	ensureInputGroup()
+
 	wm, wmSelected := promptCompositor()
 	terminal, terminalSelected := promptTerminal()
 	useSystemd := promptSystemd()
@@ -339,6 +344,37 @@ func runSetup() error {
 	return nil
 }
 
+// Add user to the input group for the evdev manager for inut state tracking.
+// Caps Lock OSD and the Caps Lock bar indicator.
+func ensureInputGroup() {
+	if !utils.HasGroup("input") {
+		return
+	}
+	currentUser := os.Getenv("USER")
+	if currentUser == "" {
+		currentUser = os.Getenv("LOGNAME")
+	}
+	if currentUser == "" {
+		return
+	}
+	out, err := execGroups(currentUser)
+	if err == nil && strings.Contains(out, "input") {
+		fmt.Printf("✓ %s is already in the input group (Caps Lock OSD enabled)\n", currentUser)
+		return
+	}
+	fmt.Println("Adding user to input group for Caps Lock OSD support...")
+	if err := privesc.Run(context.Background(), "", "usermod", "-aG", "input", currentUser); err != nil {
+		fmt.Printf("⚠ Could not add %s to input group (Caps Lock OSD will be unavailable): %v\n", currentUser, err)
+	} else {
+		fmt.Printf("✓ Added %s to input group (logout/login required to take effect)\n", currentUser)
+	}
+}
+
+func execGroups(user string) (string, error) {
+	out, err := exec.Command("groups", user).Output()
+	return string(out), err
+}
+
 func promptCompositor() (deps.WindowManager, bool) {
 	fmt.Println("Select compositor:")
 	fmt.Println("1) Niri")

core/cmd/dms/commands_trash.go

@@ -0,0 +1,122 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/trash"
+	"github.com/spf13/cobra"
+)
+
+var trashCmd = &cobra.Command{
+	Use:   "trash",
+	Short: "Manage the user's trash (XDG Trash spec 1.0)",
+}
+
+var trashPutCmd = &cobra.Command{
+	Use:   "put <path...>",
+	Short: "Move files or directories into the trash",
+	Args:  cobra.MinimumNArgs(1),
+	Run:   runTrashPut,
+}
+
+var trashListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List trashed items across all known trash directories",
+	Run:   runTrashList,
+}
+
+var trashCountCmd = &cobra.Command{
+	Use:   "count",
+	Short: "Print the total number of trashed items",
+	Run:   runTrashCount,
+}
+
+var trashEmptyCmd = &cobra.Command{
+	Use:   "empty",
+	Short: "Permanently delete every trashed item",
+	Run:   runTrashEmpty,
+}
+
+var trashRestoreCmd = &cobra.Command{
+	Use:   "restore <name>",
+	Short: "Restore a trashed item to its original location",
+	Args:  cobra.ExactArgs(1),
+	Run:   runTrashRestore,
+}
+
+var (
+	trashJSONOutput bool
+	trashRestoreDir string
+)
+
+func init() {
+	trashListCmd.Flags().BoolVar(&trashJSONOutput, "json", false, "Output as JSON")
+	trashRestoreCmd.Flags().StringVar(&trashRestoreDir, "trash-dir", "", "Trash directory containing the item (default: home trash)")
+	trashCmd.AddCommand(trashPutCmd, trashListCmd, trashCountCmd, trashEmptyCmd, trashRestoreCmd)
+}
+
+func runTrashPut(cmd *cobra.Command, args []string) {
+	var failed int
+	for _, p := range args {
+		if _, err := trash.Put(p); err != nil {
+			log.Errorf("trash %s: %v", p, err)
+			failed++
+			continue
+		}
+		fmt.Println(p)
+	}
+	if failed > 0 {
+		os.Exit(1)
+	}
+}
+
+func runTrashList(cmd *cobra.Command, args []string) {
+	entries, err := trash.List()
+	if err != nil {
+		log.Fatalf("list trash: %v", err)
+	}
+
+	if trashJSONOutput {
+		if entries == nil {
+			entries = []trash.Entry{}
+		}
+		out, _ := json.MarshalIndent(entries, "", "  ")
+		fmt.Println(string(out))
+		return
+	}
+
+	if len(entries) == 0 {
+		fmt.Println("Trash is empty")
+		return
+	}
+	for _, e := range entries {
+		marker := "F"
+		if e.IsDir {
+			marker = "D"
+		}
+		fmt.Printf("%s  %s  %s  %s\n", marker, e.DeletionDate, e.Name, e.OriginalPath)
+	}
+}
+
+func runTrashCount(cmd *cobra.Command, args []string) {
+	n, err := trash.Count()
+	if err != nil {
+		log.Fatalf("count trash: %v", err)
+	}
+	fmt.Println(n)
+}
+
+func runTrashEmpty(cmd *cobra.Command, args []string) {
+	if err := trash.Empty(); err != nil {
+		log.Fatalf("empty trash: %v", err)
+	}
+}
+
+func runTrashRestore(cmd *cobra.Command, args []string) {
+	if err := trash.Restore(args[0], trashRestoreDir); err != nil {
+		log.Fatalf("restore: %v", err)
+	}
+}

core/cmd/dms/immutable_policy.go

@@ -0,0 +1,285 @@
+package main
+
+import (
+	"bufio"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
+	"github.com/spf13/cobra"
+)
+
+const (
+	cliPolicyPackagedPath = "/usr/share/dms/cli-policy.json"
+	cliPolicyAdminPath    = "/etc/dms/cli-policy.json"
+)
+
+var (
+	immutablePolicyOnce sync.Once
+	immutablePolicy     immutableCommandPolicy
+	immutablePolicyErr  error
+)
+
+//go:embed assets/cli-policy.default.json
+var defaultCLIPolicyJSON []byte
+
+type immutableCommandPolicy struct {
+	ImmutableSystem bool
+	ImmutableReason string
+	BlockedCommands []string
+	Message         string
+}
+
+type cliPolicyFile struct {
+	PolicyVersion   int       `json:"policy_version"`
+	ImmutableSystem *bool     `json:"immutable_system"`
+	BlockedCommands *[]string `json:"blocked_commands"`
+	Message         *string   `json:"message"`
+}
+
+func normalizeCommandSpec(raw string) string {
+	normalized := strings.ToLower(strings.TrimSpace(raw))
+	normalized = strings.TrimPrefix(normalized, "dms ")
+	return strings.Join(strings.Fields(normalized), " ")
+}
+
+func normalizeBlockedCommands(raw []string) []string {
+	normalized := make([]string, 0, len(raw))
+	seen := make(map[string]bool)
+
+	for _, cmd := range raw {
+		spec := normalizeCommandSpec(cmd)
+		if spec == "" || seen[spec] {
+			continue
+		}
+		seen[spec] = true
+		normalized = append(normalized, spec)
+	}
+
+	return normalized
+}
+
+func commandBlockedByPolicy(commandPath string, blocked []string) bool {
+	normalizedPath := normalizeCommandSpec(commandPath)
+	if normalizedPath == "" {
+		return false
+	}
+
+	for _, entry := range blocked {
+		spec := normalizeCommandSpec(entry)
+		if spec == "" {
+			continue
+		}
+		if normalizedPath == spec || strings.HasPrefix(normalizedPath, spec+" ") {
+			return true
+		}
+	}
+
+	return false
+}
+
+func loadPolicyFile(path string) (*cliPolicyFile, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("failed to read %s: %w", path, err)
+	}
+
+	var policy cliPolicyFile
+	if err := json.Unmarshal(data, &policy); err != nil {
+		return nil, fmt.Errorf("failed to parse %s: %w", path, err)
+	}
+
+	return &policy, nil
+}
+
+func mergePolicyFile(base *immutableCommandPolicy, path string) error {
+	policyFile, err := loadPolicyFile(path)
+	if err != nil {
+		return err
+	}
+	if policyFile == nil {
+		return nil
+	}
+
+	if policyFile.ImmutableSystem != nil {
+		base.ImmutableSystem = *policyFile.ImmutableSystem
+	}
+	if policyFile.BlockedCommands != nil {
+		base.BlockedCommands = normalizeBlockedCommands(*policyFile.BlockedCommands)
+	}
+	if policyFile.Message != nil {
+		msg := strings.TrimSpace(*policyFile.Message)
+		if msg != "" {
+			base.Message = msg
+		}
+	}
+
+	return nil
+}
+
+func readOSReleaseMap(path string) map[string]string {
+	values := make(map[string]string)
+
+	file, err := os.Open(path)
+	if err != nil {
+		return values
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		parts := strings.SplitN(line, "=", 2)
+		if len(parts) != 2 {
+			continue
+		}
+		key := strings.ToUpper(strings.TrimSpace(parts[0]))
+		value := strings.Trim(strings.TrimSpace(parts[1]), "\"")
+		values[key] = strings.ToLower(value)
+	}
+
+	return values
+}
+
+func hasAnyToken(text string, tokens ...string) bool {
+	if text == "" {
+		return false
+	}
+	for _, token := range tokens {
+		if strings.Contains(text, token) {
+			return true
+		}
+	}
+	return false
+}
+
+func detectImmutableSystem() (bool, string) {
+	if _, err := os.Stat("/run/ostree-booted"); err == nil {
+		return true, "/run/ostree-booted is present"
+	}
+
+	osRelease := readOSReleaseMap("/etc/os-release")
+	if len(osRelease) == 0 {
+		return false, ""
+	}
+
+	id := osRelease["ID"]
+	idLike := osRelease["ID_LIKE"]
+	variantID := osRelease["VARIANT_ID"]
+	name := osRelease["NAME"]
+	prettyName := osRelease["PRETTY_NAME"]
+
+	immutableIDs := map[string]bool{
+		"bluefin":       true,
+		"bazzite":       true,
+		"silverblue":    true,
+		"kinoite":       true,
+		"sericea":       true,
+		"onyx":          true,
+		"aurora":        true,
+		"fedora-iot":    true,
+		"fedora-coreos": true,
+	}
+	if immutableIDs[id] {
+		return true, "os-release ID=" + id
+	}
+
+	markers := []string{"silverblue", "kinoite", "sericea", "onyx", "bazzite", "bluefin", "aurora", "ostree", "atomic"}
+	if hasAnyToken(variantID, markers...) {
+		return true, "os-release VARIANT_ID=" + variantID
+	}
+	if hasAnyToken(idLike, "ostree", "rpm-ostree") {
+		return true, "os-release ID_LIKE=" + idLike
+	}
+	if hasAnyToken(name, markers...) || hasAnyToken(prettyName, markers...) {
+		return true, "os-release identifies an atomic/ostree variant"
+	}
+
+	return false, ""
+}
+
+func getImmutablePolicy() (*immutableCommandPolicy, error) {
+	immutablePolicyOnce.Do(func() {
+		detectedImmutable, reason := detectImmutableSystem()
+		immutablePolicy = immutableCommandPolicy{
+			ImmutableSystem: detectedImmutable,
+			ImmutableReason: reason,
+			BlockedCommands: []string{"greeter install", "greeter enable", "setup"},
+			Message:         "This command is disabled on immutable/image-based systems. Use your distro-native workflow for system-level changes.",
+		}
+
+		var defaultPolicy cliPolicyFile
+		if err := json.Unmarshal(defaultCLIPolicyJSON, &defaultPolicy); err != nil {
+			immutablePolicyErr = fmt.Errorf("failed to parse embedded default CLI policy: %w", err)
+			return
+		}
+		if defaultPolicy.BlockedCommands != nil {
+			immutablePolicy.BlockedCommands = normalizeBlockedCommands(*defaultPolicy.BlockedCommands)
+		}
+		if defaultPolicy.Message != nil {
+			msg := strings.TrimSpace(*defaultPolicy.Message)
+			if msg != "" {
+				immutablePolicy.Message = msg
+			}
+		}
+
+		if err := mergePolicyFile(&immutablePolicy, cliPolicyPackagedPath); err != nil {
+			immutablePolicyErr = err
+			return
+		}
+		if err := mergePolicyFile(&immutablePolicy, cliPolicyAdminPath); err != nil {
+			immutablePolicyErr = err
+			return
+		}
+	})
+
+	if immutablePolicyErr != nil {
+		return nil, immutablePolicyErr
+	}
+	return &immutablePolicy, nil
+}
+
+func requireMutableSystemCommand(cmd *cobra.Command, _ []string) error {
+	policy, err := getImmutablePolicy()
+	if err != nil {
+		return err
+	}
+	if !policy.ImmutableSystem {
+		return nil
+	}
+
+	commandPath := normalizeCommandSpec(cmd.CommandPath())
+	if !commandBlockedByPolicy(commandPath, policy.BlockedCommands) {
+		return nil
+	}
+
+	reason := ""
+	if policy.ImmutableReason != "" {
+		reason = "Detected immutable system: " + policy.ImmutableReason + "\n"
+	}
+
+	return fmt.Errorf("%s%s\nCommand: dms %s\nPolicy files:\n  %s\n  %s", reason, policy.Message, commandPath, cliPolicyPackagedPath, cliPolicyAdminPath)
+}
+
+// preRunPrivileged combines the immutable-system check with a privesc tool
+// selection prompt (shown only when multiple tools are available and the
+// $DMS_PRIVESC env var isn't set).
+func preRunPrivileged(cmd *cobra.Command, args []string) error {
+	if err := requireMutableSystemCommand(cmd, args); err != nil {
+		return err
+	}
+	if _, err := privesc.PromptCLI(os.Stdout, os.Stdin); err != nil {
+		return err
+	}
+	return nil
+}

core/cmd/dms/main.go

@@ -5,6 +5,7 @@ package main
 import (
 	"os"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 )
 
@@ -16,28 +17,23 @@ func init() {
 	runCmd.Flags().Bool("session", false, "Session managed (like as a systemd unit)")
 	runCmd.Flags().MarkHidden("daemon-child")
 
-	// Add subcommands to greeter
-	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd)
-
-	// Add subcommands to setup
+	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd)
+	authCmd.AddCommand(authSyncCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
-
-	// Add subcommands to update
 	updateCmd.AddCommand(updateCheckCmd)
-
-	// Add subcommands to plugins
 	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
-
-	// Add common commands to root
 	rootCmd.AddCommand(getCommonCommands()...)
 
+	rootCmd.AddCommand(authCmd)
 	rootCmd.AddCommand(updateCmd)
 
 	rootCmd.SetHelpTemplate(getHelpTemplate())
 }
 
 func main() {
-	if os.Geteuid() == 0 {
+	clipboard.MaybeServeAndExit()
+
+	if os.Geteuid() == 0 && !isReadOnlyCommand(os.Args) {
 		log.Fatal("This program should not be run as root. Exiting.")
 	}
 

core/cmd/dms/main_distro.go

@@ -5,36 +5,32 @@ package main
 import (
 	"os"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 )
 
 var Version = "dev"
 
 func init() {
-	// Add flags
 	runCmd.Flags().BoolP("daemon", "d", false, "Run in daemon mode")
 	runCmd.Flags().Bool("daemon-child", false, "Internal flag for daemon child process")
 	runCmd.Flags().Bool("session", false, "Session managed (like as a systemd unit)")
 	runCmd.Flags().MarkHidden("daemon-child")
 
-	// Add subcommands to greeter
-	greeterCmd.AddCommand(greeterSyncCmd, greeterEnableCmd, greeterStatusCmd)
-
-	// Add subcommands to setup
+	greeterCmd.AddCommand(greeterInstallCmd, greeterSyncCmd, greeterEnableCmd, greeterStatusCmd, greeterUninstallCmd)
+	authCmd.AddCommand(authSyncCmd)
 	setupCmd.AddCommand(setupBindsCmd, setupLayoutCmd, setupColorsCmd, setupAlttabCmd, setupOutputsCmd, setupCursorCmd, setupWindowrulesCmd)
-
-	// Add subcommands to plugins
 	pluginsCmd.AddCommand(pluginsBrowseCmd, pluginsListCmd, pluginsInstallCmd, pluginsUninstallCmd, pluginsUpdateCmd)
-
-	// Add common commands to root
 	rootCmd.AddCommand(getCommonCommands()...)
+	rootCmd.AddCommand(authCmd)
 
 	rootCmd.SetHelpTemplate(getHelpTemplate())
 }
 
 func main() {
-	// Block root
-	if os.Geteuid() == 0 {
+	clipboard.MaybeServeAndExit()
+
+	if os.Geteuid() == 0 && !isReadOnlyCommand(os.Args) {
 		log.Fatal("This program should not be run as root. Exiting.")
 	}
 

core/cmd/dms/randr_client.go

@@ -0,0 +1,172 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/wlr_output_management"
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
+)
+
+type randrOutput struct {
+	Name    string  `json:"name"`
+	Scale   float64 `json:"scale"`
+	Width   int32   `json:"width"`
+	Height  int32   `json:"height"`
+	Refresh int32   `json:"refresh"`
+	Enabled bool    `json:"enabled"`
+}
+
+type randrHead struct {
+	name          string
+	enabled       bool
+	scale         float64
+	currentModeID uint32
+	modeIDs       []uint32
+}
+
+type randrMode struct {
+	width   int32
+	height  int32
+	refresh int32
+}
+
+type randrClient struct {
+	display *wlclient.Display
+	ctx     *wlclient.Context
+	manager *wlr_output_management.ZwlrOutputManagerV1
+	heads   map[uint32]*randrHead
+	modes   map[uint32]*randrMode
+	done    bool
+	err     error
+}
+
+func queryRandr() ([]randrOutput, error) {
+	display, err := wlclient.Connect("")
+	if err != nil {
+		return nil, fmt.Errorf("failed to connect to Wayland: %w", err)
+	}
+
+	c := &randrClient{
+		display: display,
+		ctx:     display.Context(),
+		heads:   make(map[uint32]*randrHead),
+		modes:   make(map[uint32]*randrMode),
+	}
+	defer c.ctx.Close()
+
+	registry, err := display.GetRegistry()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get registry: %w", err)
+	}
+
+	registry.SetGlobalHandler(func(e wlclient.RegistryGlobalEvent) {
+		if e.Interface == wlr_output_management.ZwlrOutputManagerV1InterfaceName {
+			mgr := wlr_output_management.NewZwlrOutputManagerV1(c.ctx)
+			version := min(e.Version, 4)
+
+			mgr.SetHeadHandler(func(e wlr_output_management.ZwlrOutputManagerV1HeadEvent) {
+				c.handleHead(e)
+			})
+
+			mgr.SetDoneHandler(func(e wlr_output_management.ZwlrOutputManagerV1DoneEvent) {
+				c.done = true
+			})
+
+			if err := registry.Bind(e.Name, e.Interface, version, mgr); err == nil {
+				c.manager = mgr
+			}
+		}
+	})
+
+	// First roundtrip: discover globals and bind manager
+	syncCallback, err := display.Sync()
+	if err != nil {
+		return nil, fmt.Errorf("failed to sync display: %w", err)
+	}
+	syncCallback.SetDoneHandler(func(e wlclient.CallbackDoneEvent) {
+		if c.manager == nil {
+			c.err = fmt.Errorf("zwlr_output_manager_v1 protocol not supported by compositor")
+			c.done = true
+		}
+		// Otherwise wait for manager's DoneHandler
+	})
+
+	for !c.done {
+		if err := c.ctx.Dispatch(); err != nil {
+			return nil, fmt.Errorf("dispatch error: %w", err)
+		}
+	}
+
+	if c.err != nil {
+		return nil, c.err
+	}
+
+	return c.buildOutputs(), nil
+}
+
+func (c *randrClient) handleHead(e wlr_output_management.ZwlrOutputManagerV1HeadEvent) {
+	handle := e.Head
+	headID := handle.ID()
+
+	head := &randrHead{
+		modeIDs: make([]uint32, 0),
+	}
+	c.heads[headID] = head
+
+	handle.SetNameHandler(func(e wlr_output_management.ZwlrOutputHeadV1NameEvent) {
+		head.name = e.Name
+	})
+
+	handle.SetEnabledHandler(func(e wlr_output_management.ZwlrOutputHeadV1EnabledEvent) {
+		head.enabled = e.Enabled != 0
+	})
+
+	handle.SetScaleHandler(func(e wlr_output_management.ZwlrOutputHeadV1ScaleEvent) {
+		head.scale = e.Scale
+	})
+
+	handle.SetCurrentModeHandler(func(e wlr_output_management.ZwlrOutputHeadV1CurrentModeEvent) {
+		head.currentModeID = e.Mode.ID()
+	})
+
+	handle.SetModeHandler(func(e wlr_output_management.ZwlrOutputHeadV1ModeEvent) {
+		modeHandle := e.Mode
+		modeID := modeHandle.ID()
+
+		head.modeIDs = append(head.modeIDs, modeID)
+
+		mode := &randrMode{}
+		c.modes[modeID] = mode
+
+		modeHandle.SetSizeHandler(func(e wlr_output_management.ZwlrOutputModeV1SizeEvent) {
+			mode.width = e.Width
+			mode.height = e.Height
+		})
+
+		modeHandle.SetRefreshHandler(func(e wlr_output_management.ZwlrOutputModeV1RefreshEvent) {
+			mode.refresh = e.Refresh
+		})
+	})
+}
+
+func (c *randrClient) buildOutputs() []randrOutput {
+	outputs := make([]randrOutput, 0, len(c.heads))
+
+	for _, head := range c.heads {
+		out := randrOutput{
+			Name:    head.name,
+			Scale:   head.scale,
+			Enabled: head.enabled,
+		}
+
+		if mode, ok := c.modes[head.currentModeID]; ok {
+			out.Width = mode.width
+			out.Height = mode.height
+			out.Refresh = mode.refresh
+		}
+
+		outputs = append(outputs, out)
+	}
+
+	return outputs
+}

core/cmd/dms/shell.go

@@ -192,6 +192,9 @@ func runShellInteractive(session bool) {
 		}
 	}
 
+	// ! TODO - remove when QS 0.3 is up and we can use the pragma
+	cmd.Env = append(cmd.Env, "QS_APP_ID=com.danklinux.dms")
+
 	if isSessionManaged && hasSystemdRun() {
 		cmd.Env = append(cmd.Env, "DMS_DEFAULT_LAUNCH_PREFIX=systemd-run --user --scope")
 	}
@@ -432,6 +435,9 @@ func runShellDaemon(session bool) {
 		}
 	}
 
+	// ! TODO - remove when QS 0.3 is up and we can use the pragma
+	cmd.Env = append(cmd.Env, "QS_APP_ID=com.danklinux.dms")
+
 	if isSessionManaged && hasSystemdRun() {
 		cmd.Env = append(cmd.Env, "DMS_DEFAULT_LAUNCH_PREFIX=systemd-run --user --scope")
 	}
@@ -616,6 +622,43 @@ func getShellIPCCompletions(args []string, _ string) []string {
 	return nil
 }
 
+func getFirstDMSPID() (int, bool) {
+	dir := getRuntimeDir()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return 0, false
+	}
+
+	for _, entry := range entries {
+		if !strings.HasPrefix(entry.Name(), "danklinux-") || !strings.HasSuffix(entry.Name(), ".pid") {
+			continue
+		}
+
+		data, err := os.ReadFile(filepath.Join(dir, entry.Name()))
+		if err != nil {
+			continue
+		}
+
+		pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+		if err != nil {
+			continue
+		}
+
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			continue
+		}
+
+		if proc.Signal(syscall.Signal(0)) != nil {
+			continue
+		}
+
+		return pid, true
+	}
+
+	return 0, false
+}
+
 func runShellIPCCommand(args []string) {
 	if len(args) == 0 {
 		printIPCHelp()
@@ -627,10 +670,21 @@ func runShellIPCCommand(args []string) {
 	}
 
 	cmdArgs := []string{"ipc"}
-	if qsHasAnyDisplay() {
-		cmdArgs = append(cmdArgs, "--any-display")
+
+	switch pid, ok := getFirstDMSPID(); {
+	case ok:
+		cmdArgs = append(cmdArgs, "--pid", strconv.Itoa(pid))
+	default:
+		if err := findConfig(nil, nil); err != nil {
+			log.Fatalf("Error finding config: %v", err)
+		}
+		// ! TODO - remove check when QS 0.3 is released
+		if qsHasAnyDisplay() {
+			cmdArgs = append(cmdArgs, "--any-display")
+		}
+		cmdArgs = append(cmdArgs, "-p", configPath)
 	}
-	cmdArgs = append(cmdArgs, "-p", configPath)
+
 	cmdArgs = append(cmdArgs, args...)
 	cmd := exec.Command("qs", cmdArgs...)
 	cmd.Stdin = os.Stdin

core/cmd/dms/utils.go

@@ -7,12 +7,20 @@ import (
 	"strings"
 )
 
-func findCommandPath(cmd string) (string, error) {
-	path, err := exec.LookPath(cmd)
-	if err != nil {
-		return "", fmt.Errorf("command '%s' not found in PATH", cmd)
+// isReadOnlyCommand returns true if the CLI args indicate a command that is
+// safe to run as root (e.g. shell completion, help).
+func isReadOnlyCommand(args []string) bool {
+	for _, arg := range args[1:] {
+		if strings.HasPrefix(arg, "-") {
+			continue
+		}
+		switch arg {
+		case "completion", "help", "__complete":
+			return true
+		}
+		return false
 	}
-	return path, nil
+	return false
 }
 
 func isArchPackageInstalled(packageName string) bool {

core/go.mod

@@ -1,6 +1,8 @@
 module github.com/AvengeMedia/DankMaterialShell/core
 
-go 1.25.0
+go 1.26.0
+
+toolchain go1.26.1
 
 require (
 	github.com/Wifx/gonetworkmanager/v2 v2.2.0
@@ -16,6 +18,8 @@ require (
 	github.com/sblinch/kdl-go v0.0.0-20260121213736-8b7053306ca6
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
+	github.com/yeqown/go-qrcode/v2 v2.2.5
+	github.com/yeqown/go-qrcode/writer/standard v1.3.0
 	github.com/yuin/goldmark v1.7.16
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	go.etcd.io/bbolt v1.4.3
@@ -32,15 +36,19 @@ require (
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/fogleman/gg v1.3.0 // indirect
 	github.com/go-git/gcfg/v2 v2.0.2 // indirect
 	github.com/go-git/go-billy/v6 v6.0.0-20260209124918-37866f83c2d3 // indirect
 	github.com/go-logfmt/logfmt v0.6.1 // indirect
+	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/kevinburke/ssh_config v1.6.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/pjbgf/sha1cd v0.5.0 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/stretchr/objx v0.5.3 // indirect
+	github.com/yeqown/reedsolomon v1.0.0 // indirect
 	golang.org/x/crypto v0.48.0 // indirect
 	golang.org/x/net v0.50.0 // indirect
 )

core/go.sum

@@ -58,6 +58,8 @@ github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
+github.com/fogleman/gg v1.3.0 h1:/7zJX8F6AaYQc57WQCyN9cAIz+4bCJGO9B+dyW29am8=
+github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
@@ -75,6 +77,8 @@ github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
+github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF08vX0COfcOBJRhZ8lUbR+ZWIs0Y5g=
+github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -115,6 +119,8 @@ github.com/pilebones/go-udev v0.9.1 h1:uN72M1C1fgzhsVmBGEM8w9RD1JY4iVsPZpr+Z6rb3
 github.com/pilebones/go-udev v0.9.1/go.mod h1:Bgcl07crebF3JSeS4+nuaRvhWFdCeFoBhXXeAp93XNo=
 github.com/pjbgf/sha1cd v0.5.0 h1:a+UkboSi1znleCDUNT3M5YxjOnN1fz2FhN48FlwCxs0=
 github.com/pjbgf/sha1cd v0.5.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
@@ -142,6 +148,12 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/yeqown/go-qrcode/v2 v2.2.5 h1:HCOe2bSjkhZyYoyyNaXNzh4DJZll6inVJQQw+8228Zk=
+github.com/yeqown/go-qrcode/v2 v2.2.5/go.mod h1:uHpt9CM0V1HeXLz+Wg5MN50/sI/fQhfkZlOM+cOTHxw=
+github.com/yeqown/go-qrcode/writer/standard v1.3.0 h1:chdyhEfRtUPgQtuPeaWVGQ/TQx4rE1PqeoW3U+53t34=
+github.com/yeqown/go-qrcode/writer/standard v1.3.0/go.mod h1:O4MbzsotGCvy8upYPCR91j81dr5XLT7heuljcNXW+oQ=
+github.com/yeqown/reedsolomon v1.0.0 h1:x1h/Ej/uJnNu8jaX7GLHBWmZKCAWjEJTetkqaabr4B0=
+github.com/yeqown/reedsolomon v1.0.0/go.mod h1:P76zpcn2TCuL0ul1Fso373qHRc69LKwAw/Iy6g1WiiM=
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.7.16 h1:n+CJdUxaFMiDUNnWC3dMWCIQJSkxH4uz3ZwQBkAlVNE=
 github.com/yuin/goldmark v1.7.16/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=

core/internal/blur/probe.go

@@ -0,0 +1,35 @@
+package blur
+
+import (
+	wlhelpers "github.com/AvengeMedia/DankMaterialShell/core/internal/wayland/client"
+	client "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
+)
+
+const extBackgroundEffectInterface = "ext_background_effect_manager_v1"
+
+func ProbeSupport() (bool, error) {
+	display, err := client.Connect("")
+	if err != nil {
+		return false, err
+	}
+	defer display.Context().Close()
+
+	registry, err := display.GetRegistry()
+	if err != nil {
+		return false, err
+	}
+
+	found := false
+	registry.SetGlobalHandler(func(e client.RegistryGlobalEvent) {
+		switch e.Interface {
+		case extBackgroundEffectInterface:
+			found = true
+		}
+	})
+
+	if err := wlhelpers.Roundtrip(display, display.Context()); err != nil {
+		return false, err
+	}
+
+	return found, nil
+}

core/internal/clipboard/clipboard.go

@@ -5,55 +5,196 @@ import (
 	"io"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"syscall"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/ext_data_control"
 	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
 
+const envServe = "_DMS_CLIPBOARD_SERVE"
+const envMime = "_DMS_CLIPBOARD_MIME"
+const envPasteOnce = "_DMS_CLIPBOARD_PASTE_ONCE"
+const envCacheFile = "_DMS_CLIPBOARD_CACHE"
+
+// MaybeServeAndExit intercepts before cobra when re-exec'd as a clipboard
+// child. Reads source data into memory, deletes any cache file, then serves.
+func MaybeServeAndExit() {
+	if os.Getenv(envServe) == "" {
+		return
+	}
+
+	mimeType := os.Getenv(envMime)
+	pasteOnce := os.Getenv(envPasteOnce) == "1"
+	cachePath := os.Getenv(envCacheFile)
+
+	var data []byte
+	var err error
+
+	switch {
+	case cachePath != "":
+		data, err = os.ReadFile(cachePath)
+		os.Remove(cachePath)
+	default:
+		data, err = io.ReadAll(os.Stdin)
+	}
+
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "clipboard: read source: %v\n", err)
+		os.Exit(1)
+	}
+
+	if err := serveClipboard(data, mimeType, pasteOnce); err != nil {
+		fmt.Fprintf(os.Stderr, "clipboard: serve: %v\n", err)
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+
 func Copy(data []byte, mimeType string) error {
-	return CopyOpts(data, mimeType, false, false)
+	return copyForkCached(data, mimeType, false)
 }
 
 func CopyOpts(data []byte, mimeType string, foreground, pasteOnce bool) error {
-	if !foreground {
-		return copyFork(data, mimeType, pasteOnce)
+	if foreground {
+		return serveClipboard(data, mimeType, pasteOnce)
 	}
-	return copyServe(data, mimeType, pasteOnce)
+	return copyForkCached(data, mimeType, pasteOnce)
 }
 
-func copyFork(data []byte, mimeType string, pasteOnce bool) error {
-	args := []string{os.Args[0], "cl", "copy", "--foreground"}
-	if pasteOnce {
-		args = append(args, "--paste-once")
+func CopyReader(data io.Reader, mimeType string, foreground, pasteOnce bool) error {
+	if foreground {
+		buf, err := io.ReadAll(data)
+		if err != nil {
+			return fmt.Errorf("read source: %w", err)
+		}
+		return serveClipboard(buf, mimeType, pasteOnce)
 	}
-	args = append(args, "--type", mimeType)
+	return copyFork(data, mimeType, pasteOnce)
+}
 
-	cmd := exec.Command(args[0], args[1:]...)
-	cmd.Stdin = nil
-	cmd.Stdout = nil
+func newForkCmd(mimeType string, pasteOnce bool, extra ...string) *exec.Cmd {
+	cmd := exec.Command(os.Args[0])
 	cmd.Stderr = nil
 	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
-
-	stdin, err := cmd.StdinPipe()
-	if err != nil {
-		return fmt.Errorf("stdin pipe: %w", err)
+	cmd.Env = append(os.Environ(),
+		envServe+"=1",
+		envMime+"="+mimeType,
+	)
+	if pasteOnce {
+		cmd.Env = append(cmd.Env, envPasteOnce+"=1")
 	}
+	cmd.Env = append(cmd.Env, extra...)
+	return cmd
+}
 
+func waitReady(cmd *exec.Cmd) error {
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return fmt.Errorf("stdout pipe: %w", err)
+	}
 	if err := cmd.Start(); err != nil {
 		return fmt.Errorf("start: %w", err)
 	}
-
-	if _, err := stdin.Write(data); err != nil {
-		stdin.Close()
-		return fmt.Errorf("write stdin: %w", err)
+	var buf [1]byte
+	if _, err := stdout.Read(buf[:]); err != nil {
+		return fmt.Errorf("waiting for clipboard ready: %w", err)
 	}
-	stdin.Close()
-
 	return nil
 }
 
-func copyServe(data []byte, mimeType string, pasteOnce bool) error {
+func copyForkCached(data []byte, mimeType string, pasteOnce bool) error {
+	cacheFile, err := createClipboardCacheFile()
+	if err != nil {
+		return fmt.Errorf("create cache file: %w", err)
+	}
+	cachePath := cacheFile.Name()
+
+	if _, err := cacheFile.Write(data); err != nil {
+		cacheFile.Close()
+		os.Remove(cachePath)
+		return fmt.Errorf("write cache file: %w", err)
+	}
+	if err := cacheFile.Close(); err != nil {
+		os.Remove(cachePath)
+		return fmt.Errorf("close cache file: %w", err)
+	}
+
+	cmd := newForkCmd(mimeType, pasteOnce, envCacheFile+"="+cachePath)
+	cmd.Stdin = nil
+	if err := waitReady(cmd); err != nil {
+		os.Remove(cachePath)
+		return err
+	}
+	return nil
+}
+
+func copyFork(data io.Reader, mimeType string, pasteOnce bool) error {
+	cmd := newForkCmd(mimeType, pasteOnce)
+
+	switch src := data.(type) {
+	case *os.File:
+		cmd.Stdin = src
+		return waitReady(cmd)
+
+	default:
+		stdin, err := cmd.StdinPipe()
+		if err != nil {
+			return fmt.Errorf("stdin pipe: %w", err)
+		}
+
+		stdout, err := cmd.StdoutPipe()
+		if err != nil {
+			return fmt.Errorf("stdout pipe: %w", err)
+		}
+
+		if err := cmd.Start(); err != nil {
+			return fmt.Errorf("start: %w", err)
+		}
+		if _, err := io.Copy(stdin, data); err != nil {
+			stdin.Close()
+			return fmt.Errorf("write stdin: %w", err)
+		}
+		if err := stdin.Close(); err != nil {
+			return fmt.Errorf("close stdin: %w", err)
+		}
+
+		var buf [1]byte
+		if _, err := stdout.Read(buf[:]); err != nil {
+			return fmt.Errorf("waiting for clipboard ready: %w", err)
+		}
+		return nil
+	}
+}
+
+func signalReady() {
+	if os.Getenv(envServe) == "" {
+		return
+	}
+	os.Stdout.Write([]byte{1})
+}
+
+func createClipboardCacheFile() (*os.File, error) {
+	preferredDirs := []string{}
+
+	if cacheDir, err := os.UserCacheDir(); err == nil {
+		preferredDirs = append(preferredDirs, filepath.Join(cacheDir, "dms", "clipboard"))
+	}
+	preferredDirs = append(preferredDirs, "/var/tmp/dms/clipboard")
+
+	for _, dir := range preferredDirs {
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			continue
+		}
+		cachedData, err := os.CreateTemp(dir, "dms-clipboard-*")
+		if err == nil {
+			return cachedData, nil
+		}
+	}
+	return os.CreateTemp("", "dms-clipboard-*")
+}
+
+func serveClipboard(data []byte, mimeType string, pasteOnce bool) error {
 	display, err := wlclient.Connect("")
 	if err != nil {
 		return fmt.Errorf("wayland connect: %w", err)
@@ -95,12 +236,10 @@ func copyServe(data []byte, mimeType string, pasteOnce bool) error {
 	if bindErr != nil {
 		return fmt.Errorf("registry bind: %w", bindErr)
 	}
-
 	if dataControlMgr == nil {
 		return fmt.Errorf("compositor does not support ext_data_control_manager_v1")
 	}
 	defer dataControlMgr.Destroy()
-
 	if seat == nil {
 		return fmt.Errorf("no seat available")
 	}
@@ -141,10 +280,10 @@ func copyServe(data []byte, mimeType string, pasteOnce bool) error {
 	pasted := make(chan struct{}, 1)
 
 	source.SetSendHandler(func(e ext_data_control.ExtDataControlSourceV1SendEvent) {
-		defer syscall.Close(e.Fd)
+		_ = syscall.SetNonblock(e.Fd, false)
 		file := os.NewFile(uintptr(e.Fd), "pipe")
 		defer file.Close()
-		file.Write(data)
+		_, _ = file.Write(data)
 		select {
 		case pasted <- struct{}{}:
 		default:
@@ -160,6 +299,7 @@ func copyServe(data []byte, mimeType string, pasteOnce bool) error {
 	}
 
 	display.Roundtrip()
+	signalReady()
 
 	for {
 		select {
@@ -418,12 +558,10 @@ func copyMultiServe(offers []Offer, pasteOnce bool) error {
 	if bindErr != nil {
 		return fmt.Errorf("registry bind: %w", bindErr)
 	}
-
 	if dataControlMgr == nil {
 		return fmt.Errorf("compositor does not support ext_data_control_manager_v1")
 	}
 	defer dataControlMgr.Destroy()
-
 	if seat == nil {
 		return fmt.Errorf("no seat available")
 	}
@@ -451,12 +589,12 @@ func copyMultiServe(offers []Offer, pasteOnce bool) error {
 	pasted := make(chan struct{}, 1)
 
 	source.SetSendHandler(func(e ext_data_control.ExtDataControlSourceV1SendEvent) {
-		defer syscall.Close(e.Fd)
+		_ = syscall.SetNonblock(e.Fd, false)
 		file := os.NewFile(uintptr(e.Fd), "pipe")
 		defer file.Close()
 
 		if data, ok := offerMap[e.MimeType]; ok {
-			file.Write(data)
+			_, _ = file.Write(data)
 		}
 
 		select {

core/internal/colorpicker/picker.go

@@ -39,11 +39,10 @@ type LayerSurface struct {
 	wlSurface   *client.Surface
 	layerSurf   *wlr_layer_shell.ZwlrLayerSurfaceV1
 	viewport    *wp_viewporter.WpViewport
-	wlPool      *client.ShmPool
-	wlBuffer    *client.Buffer
-	bufferBusy  bool
-	oldPool     *client.ShmPool
-	oldBuffer   *client.Buffer
+	wlPools     [2]*client.ShmPool
+	wlBuffers   [2]*client.Buffer
+	slotBusy    [2]bool
+	needsRedraw bool
 	scopyBuffer *client.Buffer
 	configured  bool
 	hidden      bool
@@ -136,6 +135,7 @@ func (p *Picker) Run() (*Color, error) {
 			break
 		}
 
+		p.flushRedraws()
 		p.checkDone()
 	}
 
@@ -164,6 +164,15 @@ func (p *Picker) checkDone() {
 	}
 }
 
+func (p *Picker) flushRedraws() {
+	for _, ls := range p.surfaces {
+		if !ls.needsRedraw {
+			continue
+		}
+		p.redrawSurface(ls)
+	}
+}
+
 func (p *Picker) connect() error {
 	display, err := client.Connect("")
 	if err != nil {
@@ -507,47 +516,45 @@ func (p *Picker) captureForSurface(ls *LayerSurface) {
 }
 
 func (p *Picker) redrawSurface(ls *LayerSurface) {
+	slot := ls.state.FrontIndex()
+	if ls.slotBusy[slot] {
+		ls.needsRedraw = true
+		return
+	}
+
 	var renderBuf *ShmBuffer
-	if ls.hidden {
+	switch {
+	case ls.hidden:
 		renderBuf = ls.state.RedrawScreenOnly()
-	} else {
+	default:
 		renderBuf = ls.state.Redraw()
 	}
 	if renderBuf == nil {
 		return
 	}
 
-	if ls.oldBuffer != nil {
-		ls.oldBuffer.Destroy()
-		ls.oldBuffer = nil
-	}
-	if ls.oldPool != nil {
-		ls.oldPool.Destroy()
-		ls.oldPool = nil
+	ls.needsRedraw = false
+
+	if ls.wlPools[slot] == nil {
+		pool, err := p.shm.CreatePool(renderBuf.Fd(), int32(renderBuf.Size()))
+		if err != nil {
+			return
+		}
+		ls.wlPools[slot] = pool
+
+		wlBuffer, err := pool.CreateBuffer(0, int32(renderBuf.Width), int32(renderBuf.Height), int32(renderBuf.Stride), uint32(ls.state.ScreenFormat()))
+		if err != nil {
+			return
+		}
+		ls.wlBuffers[slot] = wlBuffer
+
+		s := slot
+		wlBuffer.SetReleaseHandler(func(e client.BufferReleaseEvent) {
+			ls.slotBusy[s] = false
+		})
 	}
 
-	ls.oldPool = ls.wlPool
-	ls.oldBuffer = ls.wlBuffer
-	ls.wlPool = nil
-	ls.wlBuffer = nil
-
-	pool, err := p.shm.CreatePool(renderBuf.Fd(), int32(renderBuf.Size()))
-	if err != nil {
-		return
-	}
-	ls.wlPool = pool
-
-	wlBuffer, err := pool.CreateBuffer(0, int32(renderBuf.Width), int32(renderBuf.Height), int32(renderBuf.Stride), uint32(ls.state.ScreenFormat()))
-	if err != nil {
-		return
-	}
-	ls.wlBuffer = wlBuffer
-
-	lsRef := ls
-	wlBuffer.SetReleaseHandler(func(e client.BufferReleaseEvent) {
-		lsRef.bufferBusy = false
-	})
-	ls.bufferBusy = true
+	ls.slotBusy[slot] = true
 
 	logicalW, logicalH := ls.state.LogicalSize()
 	if logicalW == 0 || logicalH == 0 {
@@ -566,7 +573,7 @@ func (p *Picker) redrawSurface(ls *LayerSurface) {
 		}
 		_ = ls.wlSurface.SetBufferScale(bufferScale)
 	}
-	_ = ls.wlSurface.Attach(wlBuffer, 0, 0)
+	_ = ls.wlSurface.Attach(ls.wlBuffers[slot], 0, 0)
 	_ = ls.wlSurface.Damage(0, 0, int32(logicalW), int32(logicalH))
 	_ = ls.wlSurface.Commit()
 
@@ -634,7 +641,7 @@ func (p *Picker) setupPointerHandlers() {
 		}
 
 		p.activeSurface.state.OnPointerMotion(e.SurfaceX, e.SurfaceY)
-		p.redrawSurface(p.activeSurface)
+		p.activeSurface.needsRedraw = true
 	})
 
 	p.pointer.SetLeaveHandler(func(e client.PointerLeaveEvent) {
@@ -655,7 +662,7 @@ func (p *Picker) setupPointerHandlers() {
 			return
 		}
 		p.activeSurface.state.OnPointerMotion(e.SurfaceX, e.SurfaceY)
-		p.redrawSurface(p.activeSurface)
+		p.activeSurface.needsRedraw = true
 	})
 
 	p.pointer.SetButtonHandler(func(e client.PointerButtonEvent) {
@@ -679,17 +686,13 @@ func (p *Picker) cleanup() {
 		if ls.scopyBuffer != nil {
 			ls.scopyBuffer.Destroy()
 		}
-		if ls.oldBuffer != nil {
-			ls.oldBuffer.Destroy()
-		}
-		if ls.oldPool != nil {
-			ls.oldPool.Destroy()
-		}
-		if ls.wlBuffer != nil {
-			ls.wlBuffer.Destroy()
-		}
-		if ls.wlPool != nil {
-			ls.wlPool.Destroy()
+		for i := range ls.wlBuffers {
+			if ls.wlBuffers[i] != nil {
+				ls.wlBuffers[i].Destroy()
+			}
+			if ls.wlPools[i] != nil {
+				ls.wlPools[i].Destroy()
+			}
 		}
 		if ls.viewport != nil {
 			ls.viewport.Destroy()

core/internal/colorpicker/state.go

@@ -274,6 +274,12 @@ func (s *SurfaceState) FrontRenderBuffer() *ShmBuffer {
 	return s.renderBufs[s.front]
 }
 
+func (s *SurfaceState) FrontIndex() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.front
+}
+
 func (s *SurfaceState) SwapBuffers() {
 	s.mu.Lock()
 	s.front ^= 1

core/internal/config/deployer.go

@@ -62,12 +62,31 @@ func (cd *ConfigDeployer) DeployConfigurationsSelectiveWithReinstalls(ctx contex
 func (cd *ConfigDeployer) deployConfigurationsInternal(ctx context.Context, wm deps.WindowManager, terminal deps.Terminal, installedDeps []deps.Dependency, replaceConfigs map[string]bool, reinstallItems map[string]bool, useSystemd bool) ([]DeploymentResult, error) {
 	var results []DeploymentResult
 
+	// Primary config file paths used to detect fresh installs.
+	configPrimaryPaths := map[string]string{
+		"Niri":      filepath.Join(os.Getenv("HOME"), ".config", "niri", "config.kdl"),
+		"Hyprland":  filepath.Join(os.Getenv("HOME"), ".config", "hypr", "hyprland.conf"),
+		"Ghostty":   filepath.Join(os.Getenv("HOME"), ".config", "ghostty", "config"),
+		"Kitty":     filepath.Join(os.Getenv("HOME"), ".config", "kitty", "kitty.conf"),
+		"Alacritty": filepath.Join(os.Getenv("HOME"), ".config", "alacritty", "alacritty.toml"),
+	}
+
 	shouldReplaceConfig := func(configType string) bool {
 		if replaceConfigs == nil {
 			return true
 		}
 		replace, exists := replaceConfigs[configType]
-		return !exists || replace
+		if !exists || replace {
+			return true
+		}
+		// Config is explicitly set to "don't replace" — but still deploy
+		// if the config file doesn't exist yet (fresh install scenario).
+		if primaryPath, ok := configPrimaryPaths[configType]; ok {
+			if _, err := os.Stat(primaryPath); os.IsNotExist(err) {
+				return true
+			}
+		}
+		return false
 	}
 
 	switch wm {

core/internal/config/deployer_test.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"context"
 	"os"
 	"path/filepath"
 	"testing"
@@ -624,3 +625,168 @@ func TestAlacrittyConfigDeployment(t *testing.T) {
 		assert.Contains(t, string(newContent), "decorations = \"None\"")
 	})
 }
+
+func TestShouldReplaceConfigDeployIfMissing(t *testing.T) {
+	allFalse := map[string]bool{
+		"Niri":      false,
+		"Hyprland":  false,
+		"Ghostty":   false,
+		"Kitty":     false,
+		"Alacritty": false,
+	}
+
+	t.Run("replaceConfigs nil deploys config", func(t *testing.T) {
+		tempDir, err := os.MkdirTemp("", "dankinstall-replace-nil-test")
+		require.NoError(t, err)
+		defer os.RemoveAll(tempDir)
+
+		originalHome := os.Getenv("HOME")
+		os.Setenv("HOME", tempDir)
+		defer os.Setenv("HOME", originalHome)
+
+		logChan := make(chan string, 100)
+		cd := NewConfigDeployer(logChan)
+
+		results, err := cd.DeployConfigurationsSelectiveWithReinstalls(
+			context.Background(),
+			deps.WindowManagerNiri,
+			deps.TerminalGhostty,
+			nil, // installedDeps
+			nil, // replaceConfigs
+			nil, // reinstallItems
+		)
+		require.NoError(t, err)
+
+		// With replaceConfigs=nil, all configs should be deployed
+		hasDeployed := false
+		for _, r := range results {
+			if r.Deployed {
+				hasDeployed = true
+				break
+			}
+		}
+		assert.True(t, hasDeployed, "expected at least one config to be deployed when replaceConfigs is nil")
+	})
+
+	t.Run("replaceConfigs all false and config missing deploys config", func(t *testing.T) {
+		tempDir, err := os.MkdirTemp("", "dankinstall-replace-missing-test")
+		require.NoError(t, err)
+		defer os.RemoveAll(tempDir)
+
+		originalHome := os.Getenv("HOME")
+		os.Setenv("HOME", tempDir)
+		defer os.Setenv("HOME", originalHome)
+
+		logChan := make(chan string, 100)
+		cd := NewConfigDeployer(logChan)
+
+		results, err := cd.DeployConfigurationsSelectiveWithReinstalls(
+			context.Background(),
+			deps.WindowManagerNiri,
+			deps.TerminalGhostty,
+			nil,      // installedDeps
+			allFalse, // replaceConfigs — all false
+			nil,      // reinstallItems
+		)
+		require.NoError(t, err)
+
+		// Config files don't exist on disk, so they should still be deployed
+		hasDeployed := false
+		for _, r := range results {
+			if r.Deployed {
+				hasDeployed = true
+				break
+			}
+		}
+		assert.True(t, hasDeployed, "expected configs to be deployed when files are missing, even with replaceConfigs all false")
+	})
+
+	t.Run("replaceConfigs false and config exists skips config", func(t *testing.T) {
+		tempDir, err := os.MkdirTemp("", "dankinstall-replace-exists-test")
+		require.NoError(t, err)
+		defer os.RemoveAll(tempDir)
+
+		originalHome := os.Getenv("HOME")
+		os.Setenv("HOME", tempDir)
+		defer os.Setenv("HOME", originalHome)
+
+		// Create the Ghostty primary config file so shouldReplaceConfig returns false
+		ghosttyPath := filepath.Join(tempDir, ".config", "ghostty", "config")
+		err = os.MkdirAll(filepath.Dir(ghosttyPath), 0o755)
+		require.NoError(t, err)
+		err = os.WriteFile(ghosttyPath, []byte("# existing ghostty config\n"), 0o644)
+		require.NoError(t, err)
+
+		// Also create the Niri primary config file
+		niriPath := filepath.Join(tempDir, ".config", "niri", "config.kdl")
+		err = os.MkdirAll(filepath.Dir(niriPath), 0o755)
+		require.NoError(t, err)
+		err = os.WriteFile(niriPath, []byte("// existing niri config\n"), 0o644)
+		require.NoError(t, err)
+
+		logChan := make(chan string, 100)
+		cd := NewConfigDeployer(logChan)
+
+		results, err := cd.DeployConfigurationsSelectiveWithReinstalls(
+			context.Background(),
+			deps.WindowManagerNiri,
+			deps.TerminalGhostty,
+			nil,      // installedDeps
+			allFalse, // replaceConfigs — all false
+			nil,      // reinstallItems
+		)
+		require.NoError(t, err)
+
+		// Both Niri and Ghostty config files exist, so with all false they should be skipped
+		for _, r := range results {
+			assert.Fail(t, "expected no configs to be deployed", "got deployed config: %s", r.ConfigType)
+		}
+	})
+
+	t.Run("replaceConfigs true and config exists deploys config", func(t *testing.T) {
+		tempDir, err := os.MkdirTemp("", "dankinstall-replace-true-test")
+		require.NoError(t, err)
+		defer os.RemoveAll(tempDir)
+
+		originalHome := os.Getenv("HOME")
+		os.Setenv("HOME", tempDir)
+		defer os.Setenv("HOME", originalHome)
+
+		// Create the Ghostty primary config file
+		ghosttyPath := filepath.Join(tempDir, ".config", "ghostty", "config")
+		err = os.MkdirAll(filepath.Dir(ghosttyPath), 0o755)
+		require.NoError(t, err)
+		err = os.WriteFile(ghosttyPath, []byte("# existing ghostty config\n"), 0o644)
+		require.NoError(t, err)
+
+		logChan := make(chan string, 100)
+		cd := NewConfigDeployer(logChan)
+
+		replaceConfigs := map[string]bool{
+			"Niri":      false,
+			"Hyprland":  false,
+			"Ghostty":   true, // explicitly true
+			"Kitty":     false,
+			"Alacritty": false,
+		}
+
+		results, err := cd.DeployConfigurationsSelectiveWithReinstalls(
+			context.Background(),
+			deps.WindowManagerNiri,
+			deps.TerminalGhostty,
+			nil,            // installedDeps
+			replaceConfigs, // Ghostty=true, rest=false
+			nil,            // reinstallItems
+		)
+		require.NoError(t, err)
+
+		// Ghostty should be deployed because replaceConfigs["Ghostty"]=true
+		foundGhostty := false
+		for _, r := range results {
+			if r.ConfigType == "Ghostty" && r.Deployed {
+				foundGhostty = true
+			}
+		}
+		assert.True(t, foundGhostty, "expected Ghostty config to be deployed when replaceConfigs is true")
+	})
+}

core/internal/config/embedded/hypr-binds.conf

@@ -137,7 +137,7 @@ bind = SUPER, bracketright, layoutmsg, preselect r
 
 # === Sizing & Layout ===
 bind = SUPER, R, layoutmsg, togglesplit
-bind = SUPER CTRL, F, resizeactive, exact 100%
+bind = SUPER CTRL, F, resizeactive, exact 100% 100%
 
 # === Move/resize windows with mainMod + LMB/RMB and dragging ===
 bindmd = SUPER, mouse:272, Move window, movewindow

core/internal/config/embedded/hyprland.conf

@@ -94,13 +94,14 @@ windowrule = tile on, match:class ^(gnome-control-center)$
 windowrule = tile on, match:class ^(pavucontrol)$
 windowrule = tile on, match:class ^(nm-connection-editor)$
 
+windowrule = float on, match:class ^(org\.gnome\.Calculator)$
 windowrule = float on, match:class ^(gnome-calculator)$
 windowrule = float on, match:class ^(galculator)$
 windowrule = float on, match:class ^(blueman-manager)$
 windowrule = float on, match:class ^(org\.gnome\.Nautilus)$
 windowrule = float on, match:class ^(xdg-desktop-portal)$
 
-windowrule = noinitialfocus on, match:class ^(steam)$, match:title ^(notificationtoasts)
+windowrule = no_initial_focus on, match:class ^(steam)$, match:title ^(notificationtoasts)
 windowrule = pin on, match:class ^(steam)$, match:title ^(notificationtoasts)
 
 windowrule = float on, match:class ^(firefox)$, match:title ^(Picture-in-Picture)$
@@ -111,6 +112,7 @@ windowrule = float on, match:class ^(zoom)$
 # windowrule = float on, match:class ^(org.quickshell)$
 
 layerrule = no_anim on, match:namespace ^(quickshell)$
+layerrule = no_anim on, match:namespace ^dms:.*
 
 source = ./dms/colors.conf
 source = ./dms/outputs.conf

core/internal/config/embedded/niri.kdl

@@ -224,6 +224,7 @@ window-rule {
     open-floating false
 }
 window-rule {
+    match app-id=r#"^org\.gnome\.Calculator$"#
     match app-id=r#"^gnome-calculator$"#
     match app-id=r#"^galculator$"#
     match app-id=r#"^blueman-manager$"#
@@ -252,6 +253,7 @@ window-rule {
 // Open dms windows as floating by default
 window-rule {
     match app-id=r#"org.quickshell$"#
+    match app-id=r#"com.danklinux.dms$"#
     open-floating true
 }
 debug {

core/internal/distros/arch.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 func init() {
@@ -26,6 +27,9 @@ func init() {
 	Register("cachyos", "#08A283", FamilyArch, func(config DistroConfig, logChan chan<- string) Distribution {
 		return NewArchDistribution(config, logChan)
 	})
+	Register("catos", "#1793D1", FamilyArch, func(config DistroConfig, logChan chan<- string) Distribution {
+		return NewArchDistribution(config, logChan)
+	})
 	Register("endeavouros", "#7F3FBF", FamilyArch, func(config DistroConfig, logChan chan<- string) Distribution {
 		return NewArchDistribution(config, logChan)
 	})
@@ -94,6 +98,7 @@ func (a *ArchDistribution) DetectDependenciesWithTerminal(ctx context.Context, w
 	dependencies = append(dependencies, a.detectGit())
 	dependencies = append(dependencies, a.detectWindowManager(wm))
 	dependencies = append(dependencies, a.detectQuickshell())
+	dependencies = append(dependencies, a.detectDMSGreeter())
 	dependencies = append(dependencies, a.detectXDGPortal())
 	dependencies = append(dependencies, a.detectAccountsService())
 
@@ -121,12 +126,52 @@ func (a *ArchDistribution) detectAccountsService() deps.Dependency {
 	return a.detectPackage("accountsservice", "D-Bus interface for user account query and manipulation", a.packageInstalled("accountsservice"))
 }
 
+func (a *ArchDistribution) detectDMSGreeter() deps.Dependency {
+	return a.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", a.packageInstalled("greetd-dms-greeter-git"))
+}
+
 func (a *ArchDistribution) packageInstalled(pkg string) bool {
 	cmd := exec.Command("pacman", "-Q", pkg)
 	err := cmd.Run()
 	return err == nil
 }
 
+// parseSRCINFODeps reads a .SRCINFO file and returns runtime dep and makedep package
+func parseSRCINFODeps(srcinfoPath string) (deps []string, makedeps []string, err error) {
+	data, err := os.ReadFile(srcinfoPath)
+	if err != nil {
+		return nil, nil, err
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		line = strings.TrimSpace(line)
+		var pkg string
+		var target *[]string
+		switch {
+		case strings.HasPrefix(line, "makedepends = "):
+			pkg = strings.TrimPrefix(line, "makedepends = ")
+			target = &makedeps
+		case strings.HasPrefix(line, "depends = "):
+			pkg = strings.TrimPrefix(line, "depends = ")
+			target = &deps
+		default:
+			continue
+		}
+		// Strip version constraint (>=, <=, >, <, =) and colon-descriptions
+		if idx := strings.IndexAny(pkg, "><:="); idx >= 0 {
+			pkg = pkg[:idx]
+		}
+		pkg = strings.TrimSpace(pkg)
+		if pkg != "" {
+			*target = append(*target, pkg)
+		}
+	}
+	return deps, makedeps, nil
+}
+
+func (a *ArchDistribution) isInSystemRepo(pkg string) bool {
+	return exec.Command("pacman", "-Si", pkg).Run() == nil
+}
+
 func (a *ArchDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
 	return a.GetPackageMappingWithVariants(wm, make(map[string]deps.PackageVariant))
 }
@@ -136,6 +181,7 @@ func (a *ArchDistribution) GetPackageMappingWithVariants(wm deps.WindowManager,
 		"dms (DankMaterialShell)": a.getDMSMapping(variants["dms (DankMaterialShell)"]),
 		"git":                     {Name: "git", Repository: RepoTypeSystem},
 		"quickshell":              a.getQuickshellMapping(variants["quickshell"]),
+		"dms-greeter":             {Name: "greetd-dms-greeter-git", Repository: RepoTypeAUR},
 		"matugen":                 a.getMatugenMapping(variants["matugen"]),
 		"dgop":                    {Name: "dgop", Repository: RepoTypeSystem},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeSystem},
@@ -197,11 +243,7 @@ func (a *ArchDistribution) getDMSMapping(variant deps.PackageVariant) PackageMap
 		return PackageMapping{Name: "dms-shell-git", Repository: RepoTypeAUR}
 	}
 
-	if a.packageInstalled("dms-shell-bin") {
-		return PackageMapping{Name: "dms-shell-bin", Repository: RepoTypeAUR}
-	}
-
-	return PackageMapping{Name: "dms-shell-bin", Repository: RepoTypeAUR}
+	return PackageMapping{Name: "dms-shell", Repository: RepoTypeSystem}
 }
 
 func (a *ArchDistribution) detectXwaylandSatellite() deps.Dependency {
@@ -251,7 +293,7 @@ func (a *ArchDistribution) InstallPrerequisites(ctx context.Context, sudoPasswor
 		LogOutput:   "Installing base-devel development tools",
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, "pacman -S --needed --noconfirm base-devel")
+	cmd := privesc.ExecCommand(ctx, sudoPassword, "pacman -S --needed --noconfirm base-devel")
 	if err := a.runWithProgress(cmd, progressChan, PhasePrerequisites, 0.08, 0.10); err != nil {
 		return fmt.Errorf("failed to install base-devel: %w", err)
 	}
@@ -283,6 +325,13 @@ func (a *ArchDistribution) InstallPackages(ctx context.Context, dependencies []d
 
 	systemPkgs, aurPkgs, manualPkgs, variantMap := a.categorizePackages(dependencies, wm, reinstallFlags, disabledFlags)
 
+	if slices.Contains(aurPkgs, "quickshell-git") && slices.Contains(systemPkgs, "dms-shell") {
+		if err := a.preinstallQuickshellGit(ctx, sudoPassword, progressChan); err != nil {
+			return fmt.Errorf("failed to preinstall quickshell-git: %w", err)
+		}
+		aurPkgs = slices.DeleteFunc(aurPkgs, func(p string) bool { return p == "quickshell-git" })
+	}
+
 	// Phase 3: System Packages
 	if len(systemPkgs) > 0 {
 		progressChan <- InstallProgressMsg{
@@ -400,6 +449,37 @@ func (a *ArchDistribution) categorizePackages(dependencies []deps.Dependency, wm
 	return systemPkgs, aurPkgs, manualPkgs, variantMap
 }
 
+func (a *ArchDistribution) preinstallQuickshellGit(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+	if a.packageInstalled("quickshell-git") {
+		return nil
+	}
+
+	if a.packageInstalled("quickshell") {
+		progressChan <- InstallProgressMsg{
+			Phase:       PhaseAURPackages,
+			Progress:    0.15,
+			Step:        "Removing stable quickshell...",
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: "sudo pacman -Rdd --noconfirm quickshell",
+			LogOutput:   "Removing stable quickshell so quickshell-git can be installed",
+		}
+		cmd := privesc.ExecCommand(ctx, sudoPassword, "pacman -Rdd --noconfirm quickshell")
+		if err := a.runWithProgress(cmd, progressChan, PhaseAURPackages, 0.15, 0.18); err != nil {
+			return fmt.Errorf("failed to remove stable quickshell: %w", err)
+		}
+	}
+
+	progressChan <- InstallProgressMsg{
+		Phase:       PhaseAURPackages,
+		Progress:    0.18,
+		Step:        "Building quickshell-git before system packages...",
+		IsComplete:  false,
+		CommandInfo: "Installing quickshell-git ahead of dms-shell to avoid conflict",
+	}
+	return a.installSingleAURPackage(ctx, "quickshell-git", sudoPassword, progressChan, 0.18, 0.32)
+}
+
 func (a *ArchDistribution) installSystemPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	if len(packages) == 0 {
 		return nil
@@ -408,6 +488,9 @@ func (a *ArchDistribution) installSystemPackages(ctx context.Context, packages [
 	a.log(fmt.Sprintf("Installing system packages: %s", strings.Join(packages, ", ")))
 
 	args := []string{"pacman", "-S", "--needed", "--noconfirm"}
+	if slices.Contains(packages, "dms-shell") {
+		args = append(args, "--assume-installed", "dms-shell-compositor=1")
+	}
 	args = append(args, packages...)
 
 	progressChan <- InstallProgressMsg{
@@ -419,7 +502,7 @@ func (a *ArchDistribution) installSystemPackages(ctx context.Context, packages [
 		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	return a.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
 }
 
@@ -431,29 +514,10 @@ func (a *ArchDistribution) installAURPackages(ctx context.Context, packages []st
 	a.log(fmt.Sprintf("Installing AUR packages manually: %s", strings.Join(packages, ", ")))
 
 	hasNiri := false
-	hasQuickshell := false
 	for _, pkg := range packages {
 		if pkg == "niri-git" {
 			hasNiri = true
 		}
-		if pkg == "quickshell" || pkg == "quickshell-git" {
-			hasQuickshell = true
-		}
-	}
-
-	// If quickshell is in the list, always reinstall google-breakpad first
-	if hasQuickshell {
-		progressChan <- InstallProgressMsg{
-			Phase:       PhaseAURPackages,
-			Progress:    0.63,
-			Step:        "Reinstalling google-breakpad for quickshell...",
-			IsComplete:  false,
-			CommandInfo: "Reinstalling prerequisite AUR package for quickshell",
-		}
-
-		if err := a.installSingleAURPackage(ctx, "google-breakpad", sudoPassword, progressChan, 0.63, 0.65); err != nil {
-			return fmt.Errorf("failed to reinstall google-breakpad prerequisite for quickshell: %w", err)
-		}
 	}
 
 	// If niri is in the list, install makepkg-git-lfs-proto first if not already installed
@@ -514,7 +578,7 @@ func (a *ArchDistribution) reorderAURPackages(packages []string) []string {
 	var dmsShell []string
 
 	for _, pkg := range packages {
-		if pkg == "dms-shell-git" || pkg == "dms-shell-bin" {
+		if pkg == "dms-shell-git" {
 			dmsShell = append(dmsShell, pkg)
 		} else {
 			isDep := false
@@ -534,6 +598,16 @@ func (a *ArchDistribution) reorderAURPackages(packages []string) []string {
 }
 
 func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sudoPassword string, progressChan chan<- InstallProgressMsg, startProgress, endProgress float64) error {
+	return a.installSingleAURPackageInternal(ctx, pkg, sudoPassword, progressChan, startProgress, endProgress, make(map[string]bool))
+}
+
+func (a *ArchDistribution) installSingleAURPackageInternal(ctx context.Context, pkg, sudoPassword string, progressChan chan<- InstallProgressMsg, startProgress, endProgress float64, visited map[string]bool) error {
+	if visited[pkg] {
+		a.log(fmt.Sprintf("Skipping %s (already being installed, cycle detected)", pkg))
+		return nil
+	}
+	visited[pkg] = true
+
 	homeDir, err := os.UserHomeDir()
 	if err != nil {
 		return fmt.Errorf("failed to get user home directory: %w", err)
@@ -585,7 +659,7 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 		}
 	}
 
-	if pkg == "dms-shell-git" || pkg == "dms-shell-bin" {
+	if pkg == "dms-shell-git" {
 		srcinfoPath := filepath.Join(packageDir, ".SRCINFO")
 		depsToRemove := []string{
 			"depends = quickshell",
@@ -607,54 +681,66 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 		return fmt.Errorf("failed to remove optdepends from .SRCINFO for %s: %w", pkg, err)
 	}
 
-	// Skip dependency installation for dms-shell-git and dms-shell-bin
-	// since we manually manage those dependencies
-	if pkg != "dms-shell-git" && pkg != "dms-shell-bin" {
-		// Pre-install dependencies from .SRCINFO
+	srcinfoPath = filepath.Join(packageDir, ".SRCINFO")
+	{
 		progressChan <- InstallProgressMsg{
 			Phase:       PhaseAURPackages,
 			Progress:    startProgress + 0.3*(endProgress-startProgress),
-			Step:        fmt.Sprintf("Installing dependencies for %s...", pkg),
+			Step:        fmt.Sprintf("Resolving dependencies for %s...", pkg),
 			IsComplete:  false,
-			CommandInfo: "Installing package dependencies and makedepends",
+			CommandInfo: "Classifying dependencies as system or AUR",
 		}
 
-		// Install dependencies and makedepends explicitly
-		srcinfoPath = filepath.Join(packageDir, ".SRCINFO")
-
-		depsCmd := exec.CommandContext(ctx, "bash", "-c",
-			fmt.Sprintf(`
-				deps=$(grep "depends = " "%s" | grep -v "makedepends" | sed 's/.*depends = //' | tr '\n' ' ' | sed 's/[[:space:]]*$//')
-				if [[ "%s" == *"quickshell"* ]]; then
-					deps=$(echo "$deps" | sed 's/google-breakpad//g' | sed 's/  / /g' | sed 's/^ *//g' | sed 's/ *$//g')
-				fi
-				if [ ! -z "$deps" ] && [ "$deps" != " " ]; then
-					echo '%s' | sudo -S pacman -S --needed --noconfirm $deps
-				fi
-			`, srcinfoPath, pkg, sudoPassword))
-
-		if err := a.runWithProgress(depsCmd, progressChan, PhaseAURPackages, startProgress+0.3*(endProgress-startProgress), startProgress+0.35*(endProgress-startProgress)); err != nil {
-			return fmt.Errorf("FAILED to install runtime dependencies for %s: %w", pkg, err)
+		runtimeDeps, makeDeps, err := parseSRCINFODeps(srcinfoPath)
+		if err != nil {
+			return fmt.Errorf("failed to parse .SRCINFO for %s: %w", pkg, err)
 		}
 
-		makedepsCmd := exec.CommandContext(ctx, "bash", "-c",
-			fmt.Sprintf(`
-				makedeps=$(grep -E "^[[:space:]]*makedepends = " "%s" | sed 's/^[[:space:]]*makedepends = //' | tr '\n' ' ')
-				if [ ! -z "$makedeps" ]; then
-					echo '%s' | sudo -S pacman -S --needed --noconfirm $makedeps
-				fi
-			`, srcinfoPath, sudoPassword))
+		seen := make(map[string]bool)
+		var systemPkgs []string
+		var aurPkgs []string
 
-		if err := a.runWithProgress(makedepsCmd, progressChan, PhaseAURPackages, startProgress+0.35*(endProgress-startProgress), startProgress+0.4*(endProgress-startProgress)); err != nil {
-			return fmt.Errorf("FAILED to install make dependencies for %s: %w", pkg, err)
+		for _, dep := range append(runtimeDeps, makeDeps...) {
+			if seen[dep] || a.packageInstalled(dep) {
+				continue
+			}
+			seen[dep] = true
+			if a.isInSystemRepo(dep) {
+				systemPkgs = append(systemPkgs, dep)
+			} else {
+				aurPkgs = append(aurPkgs, dep)
+			}
 		}
-	} else {
-		progressChan <- InstallProgressMsg{
-			Phase:      PhaseAURPackages,
-			Progress:   startProgress + 0.35*(endProgress-startProgress),
-			Step:       fmt.Sprintf("Skipping dependency installation for %s (manually managed)...", pkg),
-			IsComplete: false,
-			LogOutput:  fmt.Sprintf("Dependencies for %s are installed separately", pkg),
+
+		if len(systemPkgs) > 0 {
+			progressChan <- InstallProgressMsg{
+				Phase:       PhaseAURPackages,
+				Progress:    startProgress + 0.32*(endProgress-startProgress),
+				Step:        fmt.Sprintf("Installing %d system dependencies for %s...", len(systemPkgs), pkg),
+				IsComplete:  false,
+				CommandInfo: fmt.Sprintf("sudo pacman -S --needed --noconfirm %s", strings.Join(systemPkgs, " ")),
+			}
+			if err := a.installSystemPackages(ctx, systemPkgs, sudoPassword, progressChan); err != nil {
+				return fmt.Errorf("failed to install system dependencies for %s: %w", pkg, err)
+			}
+		}
+
+		for _, aurDep := range aurPkgs {
+			a.log(fmt.Sprintf("Dependency %s is AUR-only, building from source...", aurDep))
+			progressChan <- InstallProgressMsg{
+				Phase:       PhaseAURPackages,
+				Progress:    startProgress + 0.35*(endProgress-startProgress),
+				Step:        fmt.Sprintf("Installing AUR dependency %s for %s...", aurDep, pkg),
+				IsComplete:  false,
+				CommandInfo: fmt.Sprintf("Building AUR dependency: %s", aurDep),
+			}
+			if err := a.installSingleAURPackageInternal(ctx, aurDep, sudoPassword, progressChan,
+				startProgress+0.35*(endProgress-startProgress),
+				startProgress+0.39*(endProgress-startProgress),
+				visited,
+			); err != nil {
+				return fmt.Errorf("failed to install AUR dependency %s for %s: %w", aurDep, pkg, err)
+			}
 		}
 	}
 
@@ -668,7 +754,7 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 
 	buildCmd := exec.CommandContext(ctx, "makepkg", "--noconfirm")
 	buildCmd.Dir = packageDir
-	buildCmd.Env = append(os.Environ(), "PKGEXT=.pkg.tar") // Disable compression for speed
+	buildCmd.Env = append(os.Environ(), "PKGEXT=.pkg.tar")
 
 	if err := a.runWithProgress(buildCmd, progressChan, PhaseAURPackages, startProgress+0.4*(endProgress-startProgress), startProgress+0.7*(endProgress-startProgress)); err != nil {
 		return fmt.Errorf("failed to build %s: %w", pkg, err)
@@ -683,42 +769,9 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 		CommandInfo: "sudo pacman -U built-package",
 	}
 
-	// Find .pkg.tar* files - for split packages, install the base and any installed compositor variants
 	var files []string
-	if pkg == "dms-shell-git" || pkg == "dms-shell-bin" {
-		// For DMS split packages, install base package
-		pattern := filepath.Join(packageDir, fmt.Sprintf("%s-%s*.pkg.tar*", pkg, "*"))
-		matches, err := filepath.Glob(pattern)
-		if err == nil {
-			for _, match := range matches {
-				basename := filepath.Base(match)
-				// Always include base package
-				if !strings.Contains(basename, "hyprland") && !strings.Contains(basename, "niri") {
-					files = append(files, match)
-				}
-			}
-		}
-
-		// Also update compositor-specific packages if they're installed
-		if strings.HasSuffix(pkg, "-git") {
-			if a.packageInstalled("dms-shell-hyprland-git") {
-				hyprlandPattern := filepath.Join(packageDir, "dms-shell-hyprland-git-*.pkg.tar*")
-				if hyprlandMatches, err := filepath.Glob(hyprlandPattern); err == nil && len(hyprlandMatches) > 0 {
-					files = append(files, hyprlandMatches[0])
-				}
-			}
-			if a.packageInstalled("dms-shell-niri-git") {
-				niriPattern := filepath.Join(packageDir, "dms-shell-niri-git-*.pkg.tar*")
-				if niriMatches, err := filepath.Glob(niriPattern); err == nil && len(niriMatches) > 0 {
-					files = append(files, niriMatches[0])
-				}
-			}
-		}
-	} else {
-		// For other packages, install all built packages
-		matches, _ := filepath.Glob(filepath.Join(packageDir, "*.pkg.tar*"))
-		files = matches
-	}
+	matches, _ := filepath.Glob(filepath.Join(packageDir, "*.pkg.tar*"))
+	files = matches
 
 	if len(files) == 0 {
 		return fmt.Errorf("no package files found after building %s", pkg)
@@ -727,7 +780,7 @@ func (a *ArchDistribution) installSingleAURPackage(ctx context.Context, pkg, sud
 	installArgs := []string{"pacman", "-U", "--noconfirm"}
 	installArgs = append(installArgs, files...)
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(installArgs, " "))
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(installArgs, " "))
 
 	fileNames := make([]string, len(files))
 	for i, f := range files {

core/internal/distros/base.go

@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/version"
 )
 
@@ -55,27 +56,6 @@ func (b *BaseDistribution) logError(message string, err error) {
 	b.log(errorMsg)
 }
 
-// escapeSingleQuotes escapes single quotes in a string for safe use in bash single-quoted strings.
-// It replaces each ' with '\” which closes the quote, adds an escaped quote, and reopens the quote.
-// This prevents shell injection and syntax errors when passwords contain single quotes or apostrophes.
-func escapeSingleQuotes(s string) string {
-	return strings.ReplaceAll(s, "'", "'\\''")
-}
-
-// MakeSudoCommand creates a command string that safely passes password to sudo.
-// This helper escapes special characters in the password to prevent shell injection
-// and syntax errors when passwords contain single quotes, apostrophes, or other special chars.
-func MakeSudoCommand(sudoPassword string, command string) string {
-	return fmt.Sprintf("echo '%s' | sudo -S %s", escapeSingleQuotes(sudoPassword), command)
-}
-
-// ExecSudoCommand creates an exec.Cmd that runs a command with sudo using the provided password.
-// The password is properly escaped to prevent shell injection and syntax errors.
-func ExecSudoCommand(ctx context.Context, sudoPassword string, command string) *exec.Cmd {
-	cmdStr := MakeSudoCommand(sudoPassword, command)
-	return exec.CommandContext(ctx, "bash", "-c", cmdStr)
-}
-
 func (b *BaseDistribution) detectCommand(name, description string) deps.Dependency {
 	status := deps.StatusMissing
 	if b.commandExists(name) {
@@ -102,6 +82,19 @@ func (b *BaseDistribution) detectPackage(name, description string, installed boo
 	}
 }
 
+func (b *BaseDistribution) detectOptionalPackage(name, description string, installed bool) deps.Dependency {
+	status := deps.StatusMissing
+	if installed {
+		status = deps.StatusInstalled
+	}
+	return deps.Dependency{
+		Name:        name,
+		Status:      status,
+		Description: description,
+		Required:    false,
+	}
+}
+
 func (b *BaseDistribution) detectGit() deps.Dependency {
 	return b.detectCommand("git", "Version control system")
 }
@@ -697,7 +690,7 @@ func (b *BaseDistribution) installDMSBinary(ctx context.Context, sudoPassword st
 	}
 
 	// Install to /usr/local/bin
-	installCmd := ExecSudoCommand(ctx, sudoPassword,
+	installCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("cp %s /usr/local/bin/dms", binaryPath))
 	if err := installCmd.Run(); err != nil {
 		return fmt.Errorf("failed to install DMS binary: %w", err)

core/internal/distros/debian.go

@@ -4,10 +4,10 @@ import (
 	"context"
 	"fmt"
 	"os/exec"
-	"runtime"
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 func init() {
@@ -61,6 +61,7 @@ func (d *DebianDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 	dependencies = append(dependencies, d.detectGit())
 	dependencies = append(dependencies, d.detectWindowManager(wm))
 	dependencies = append(dependencies, d.detectQuickshell())
+	dependencies = append(dependencies, d.detectDMSGreeter())
 	dependencies = append(dependencies, d.detectXDGPortal())
 	dependencies = append(dependencies, d.detectAccountsService())
 
@@ -86,10 +87,32 @@ func (d *DebianDistribution) detectAccountsService() deps.Dependency {
 	return d.detectPackage("accountsservice", "D-Bus interface for user account query and manipulation", d.packageInstalled("accountsservice"))
 }
 
+func (d *DebianDistribution) detectDMSGreeter() deps.Dependency {
+	return d.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", d.packageInstalled("dms-greeter"))
+}
+
 func (d *DebianDistribution) packageInstalled(pkg string) bool {
-	cmd := exec.Command("dpkg", "-l", pkg)
-	err := cmd.Run()
-	return err == nil
+	return debianPackageInstalledPrecisely(pkg)
+}
+
+func debianPackageInstalledPrecisely(pkg string) bool {
+	cmd := exec.Command("dpkg-query", "-W", "-f=${db:Status-Status}", pkg)
+	output, err := cmd.Output()
+	if err != nil {
+		return false
+	}
+	return strings.TrimSpace(string(output)) == "installed"
+}
+
+func debianRepoArchitecture(arch string) string {
+	switch arch {
+	case "amd64", "x86_64":
+		return "amd64"
+	case "arm64", "aarch64":
+		return "arm64"
+	default:
+		return arch
+	}
 }
 
 func (d *DebianDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
@@ -108,6 +131,7 @@ func (d *DebianDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		// DMS packages from OBS with variant support
 		"dms (DankMaterialShell)": d.getDmsMapping(variants["dms (DankMaterialShell)"]),
 		"quickshell":              d.getQuickshellMapping(variants["quickshell"]),
+		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"dgop":                    {Name: "dgop", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
@@ -159,7 +183,7 @@ func (d *DebianDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		LogOutput:  "Updating APT package lists",
 	}
 
-	updateCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get update")
+	updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
 	if err := d.runWithProgress(updateCmd, progressChan, PhasePrerequisites, 0.06, 0.07); err != nil {
 		return fmt.Errorf("failed to update package lists: %w", err)
 	}
@@ -176,7 +200,7 @@ func (d *DebianDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 
 	checkCmd := exec.CommandContext(ctx, "dpkg", "-l", "build-essential")
 	if err := checkCmd.Run(); err != nil {
-		cmd := ExecSudoCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y build-essential")
+		cmd := privesc.ExecCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y build-essential")
 		if err := d.runWithProgress(cmd, progressChan, PhasePrerequisites, 0.08, 0.09); err != nil {
 			return fmt.Errorf("failed to install build-essential: %w", err)
 		}
@@ -188,12 +212,12 @@ func (d *DebianDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		Step:        "Installing development dependencies...",
 		IsComplete:  false,
 		NeedsSudo:   true,
-		CommandInfo: "sudo apt-get install -y curl wget git cmake ninja-build pkg-config libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev",
+		CommandInfo: "sudo apt-get install -y curl wget git cmake ninja-build pkg-config gnupg libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev",
 		LogOutput:   "Installing additional development tools",
 	}
 
-	devToolsCmd := ExecSudoCommand(ctx, sudoPassword,
-		"DEBIAN_FRONTEND=noninteractive apt-get install -y curl wget git cmake ninja-build pkg-config libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev libjpeg-dev libpugixml-dev")
+	devToolsCmd := privesc.ExecCommand(ctx, sudoPassword,
+		"DEBIAN_FRONTEND=noninteractive apt-get install -y curl wget git cmake ninja-build pkg-config gnupg libxcb-cursor-dev libglib2.0-dev libpolkit-agent-1-dev libjpeg-dev libpugixml-dev")
 	if err := d.runWithProgress(devToolsCmd, progressChan, PhasePrerequisites, 0.10, 0.12); err != nil {
 		return fmt.Errorf("failed to install development tools: %w", err)
 	}
@@ -373,6 +397,14 @@ func (d *DebianDistribution) extractPackageNames(packages []PackageMapping) []st
 	return names
 }
 
+func (d *DebianDistribution) aptInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"DEBIAN_FRONTEND=noninteractive", "apt-get", "install", "-y"}
+	if minimal {
+		args = append(args, "--no-install-recommends")
+	}
+	return append(args, packages...)
+}
+
 func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []PackageMapping, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	enabledRepos := make(map[string]bool)
 
@@ -410,7 +442,7 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 			keyringPath := fmt.Sprintf("/etc/apt/keyrings/%s.gpg", repoName)
 
 			// Create keyrings directory if it doesn't exist
-			mkdirCmd := ExecSudoCommand(ctx, sudoPassword, "mkdir -p /etc/apt/keyrings")
+			mkdirCmd := privesc.ExecCommand(ctx, sudoPassword, "mkdir -p /etc/apt/keyrings")
 			if err := mkdirCmd.Run(); err != nil {
 				d.log(fmt.Sprintf("Warning: failed to create keyrings directory: %v", err))
 			}
@@ -424,13 +456,13 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 			}
 
 			keyCmd := fmt.Sprintf("bash -c 'rm -f %s && curl -fsSL %s/Release.key | gpg --batch --dearmor -o %s'", keyringPath, baseURL, keyringPath)
-			cmd := ExecSudoCommand(ctx, sudoPassword, keyCmd)
+			cmd := privesc.ExecCommand(ctx, sudoPassword, keyCmd)
 			if err := d.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.18, 0.20); err != nil {
 				return fmt.Errorf("failed to add OBS GPG key for %s: %w", pkg.RepoURL, err)
 			}
 
 			// Add repository
-			repoLine := fmt.Sprintf("deb [signed-by=%s, arch=%s] %s/ /", keyringPath, runtime.GOARCH, baseURL)
+			repoLine := fmt.Sprintf("deb [signed-by=%s arch=%s] %s/ /", keyringPath, debianRepoArchitecture(osInfo.Architecture), baseURL)
 
 			progressChan <- InstallProgressMsg{
 				Phase:       PhaseSystemPackages,
@@ -440,7 +472,7 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 				CommandInfo: fmt.Sprintf("echo '%s' | sudo tee %s", repoLine, listFile),
 			}
 
-			addRepoCmd := ExecSudoCommand(ctx, sudoPassword,
+			addRepoCmd := privesc.ExecCommand(ctx, sudoPassword,
 				fmt.Sprintf("bash -c \"echo '%s' | tee %s\"", repoLine, listFile))
 			if err := d.runWithProgress(addRepoCmd, progressChan, PhaseSystemPackages, 0.20, 0.22); err != nil {
 				return fmt.Errorf("failed to add OBS repo %s: %w", pkg.RepoURL, err)
@@ -460,7 +492,7 @@ func (d *DebianDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Packa
 			CommandInfo: "sudo apt-get update",
 		}
 
-		updateCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get update")
+		updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
 		if err := d.runWithProgress(updateCmd, progressChan, PhaseSystemPackages, 0.25, 0.27); err != nil {
 			return fmt.Errorf("failed to update package lists after adding OBS repos: %w", err)
 		}
@@ -476,20 +508,46 @@ func (d *DebianDistribution) installAPTPackages(ctx context.Context, packages []
 
 	d.log(fmt.Sprintf("Installing APT packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"DEBIAN_FRONTEND=noninteractive", "apt-get", "install", "-y"}
-	args = append(args, packages...)
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
 
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		startProgress := 0.40
+		endProgress := 0.60
+		if totalGroups > 1 {
+			if groupIndex == 1 {
+				endProgress = 0.50
+			} else {
+				startProgress = 0.50
+			}
+		}
+
+		args := d.aptInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       PhaseSystemPackages,
+			Progress:    startProgress,
+			Step:        "Installing system packages...",
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return d.runWithProgress(cmd, progressChan, PhaseSystemPackages, startProgress, endProgress)
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return d.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func (d *DebianDistribution) installBuildDependencies(ctx context.Context, manualPkgs []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -568,7 +626,7 @@ func (d *DebianDistribution) installBuildDependencies(ctx context.Context, manua
 	args := []string{"apt-get", "install", "-y"}
 	args = append(args, depList...)
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	return d.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.80, 0.82)
 }
 
@@ -586,7 +644,7 @@ func (d *DebianDistribution) installRust(ctx context.Context, sudoPassword strin
 		CommandInfo: "sudo apt-get install rustup",
 	}
 
-	rustupInstallCmd := ExecSudoCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y rustup")
+	rustupInstallCmd := privesc.ExecCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y rustup")
 	if err := d.runWithProgress(rustupInstallCmd, progressChan, PhaseSystemPackages, 0.82, 0.83); err != nil {
 		return fmt.Errorf("failed to install rustup: %w", err)
 	}
@@ -625,7 +683,7 @@ func (d *DebianDistribution) installGo(ctx context.Context, sudoPassword string,
 		CommandInfo: "sudo apt-get install golang-go",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y golang-go")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "DEBIAN_FRONTEND=noninteractive apt-get install -y golang-go")
 	return d.runWithProgress(installCmd, progressChan, PhaseSystemPackages, 0.87, 0.90)
 }
 

core/internal/distros/fedora.go

@@ -7,12 +7,16 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 func init() {
 	Register("fedora", "#0B57A4", FamilyFedora, func(config DistroConfig, logChan chan<- string) Distribution {
 		return NewFedoraDistribution(config, logChan)
 	})
+	Register("evernight", "#72B8DC", FamilyFedora, func(config DistroConfig, logChan chan<- string) Distribution {
+		return NewFedoraDistribution(config, logChan)
+	})
 	Register("nobara", "#0B57A4", FamilyFedora, func(config DistroConfig, logChan chan<- string) Distribution {
 		return NewFedoraDistribution(config, logChan)
 	})
@@ -75,6 +79,7 @@ func (f *FedoraDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 	dependencies = append(dependencies, f.detectGit())
 	dependencies = append(dependencies, f.detectWindowManager(wm))
 	dependencies = append(dependencies, f.detectQuickshell())
+	dependencies = append(dependencies, f.detectDMSGreeter())
 	dependencies = append(dependencies, f.detectXDGPortal())
 	dependencies = append(dependencies, f.detectAccountsService())
 
@@ -120,6 +125,7 @@ func (f *FedoraDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 
 		// COPR packages
 		"quickshell":              f.getQuickshellMapping(variants["quickshell"]),
+		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
 		"dms (DankMaterialShell)": f.getDmsMapping(variants["dms (DankMaterialShell)"]),
 		"dgop":                    {Name: "dgop", Repository: RepoTypeCOPR, RepoURL: "avengemedia/danklinux"},
@@ -191,6 +197,10 @@ func (f *FedoraDistribution) detectAccountsService() deps.Dependency {
 	}
 }
 
+func (f *FedoraDistribution) detectDMSGreeter() deps.Dependency {
+	return f.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", f.packageInstalled("dms-greeter"))
+}
+
 func (f *FedoraDistribution) getPrerequisites() []string {
 	return []string{
 		"dnf-plugins-core",
@@ -245,7 +255,7 @@ func (f *FedoraDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 
 	args := []string{"dnf", "install", "-y"}
 	args = append(args, missingPkgs...)
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		f.logError("failed to install prerequisites", err)
@@ -428,7 +438,7 @@ func (f *FedoraDistribution) enableCOPRRepos(ctx context.Context, coprPkgs []Pac
 				CommandInfo: fmt.Sprintf("sudo dnf copr enable -y %s", pkg.RepoURL),
 			}
 
-			cmd := ExecSudoCommand(ctx, sudoPassword,
+			cmd := privesc.ExecCommand(ctx, sudoPassword,
 				fmt.Sprintf("dnf copr enable -y %s 2>&1", pkg.RepoURL))
 			output, err := cmd.CombinedOutput()
 			if err != nil {
@@ -452,7 +462,7 @@ func (f *FedoraDistribution) enableCOPRRepos(ctx context.Context, coprPkgs []Pac
 					CommandInfo: fmt.Sprintf("echo \"priority=1\" | sudo tee -a %s", repoFile),
 				}
 
-				priorityCmd := ExecSudoCommand(ctx, sudoPassword,
+				priorityCmd := privesc.ExecCommand(ctx, sudoPassword,
 					fmt.Sprintf("bash -c 'echo \"priority=1\" | tee -a %s'", repoFile))
 				priorityOutput, err := priorityCmd.CombinedOutput()
 				if err != nil {
@@ -475,28 +485,7 @@ func (f *FedoraDistribution) installDNFPackages(ctx context.Context, packages []
 
 	f.log(fmt.Sprintf("Installing DNF packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"dnf", "install", "-y"}
-
-	for _, pkg := range packages {
-		if pkg == "niri" || pkg == "niri-git" {
-			args = append(args, "--setopt=install_weak_deps=False")
-			break
-		}
-	}
-
-	args = append(args, packages...)
-
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
-	}
-
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return f.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	return f.installDNFGroups(ctx, packages, sudoPassword, progressChan, PhaseSystemPackages, "Installing system packages...", 0.40, 0.60)
 }
 
 func (f *FedoraDistribution) installCOPRPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -506,26 +495,57 @@ func (f *FedoraDistribution) installCOPRPackages(ctx context.Context, packages [
 
 	f.log(fmt.Sprintf("Installing COPR packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"dnf", "install", "-y"}
+	return f.installDNFGroups(ctx, packages, sudoPassword, progressChan, PhaseAURPackages, "Installing COPR packages...", 0.70, 0.85)
+}
 
-	for _, pkg := range packages {
-		if pkg == "niri" || pkg == "niri-git" {
-			args = append(args, "--setopt=install_weak_deps=False")
-			break
+func (f *FedoraDistribution) dnfInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"dnf", "install", "-y"}
+	if minimal {
+		args = append(args, "--setopt=install_weak_deps=False")
+	}
+	return append(args, packages...)
+}
+
+func (f *FedoraDistribution) installDNFGroups(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg, phase InstallPhase, step string, startProgress float64, endProgress float64) error {
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
+
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		groupStart := startProgress
+		groupEnd := endProgress
+		if totalGroups > 1 {
+			midpoint := startProgress + ((endProgress - startProgress) / 2)
+			if groupIndex == 1 {
+				groupEnd = midpoint
+			} else {
+				groupStart = midpoint
+			}
+		}
+
+		args := f.dnfInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       phase,
+			Progress:    groupStart,
+			Step:        step,
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return f.runWithProgress(cmd, progressChan, phase, groupStart, groupEnd)
+	}
+
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
 		}
 	}
-
-	args = append(args, packages...)
-
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseAURPackages,
-		Progress:    0.70,
-		Step:        "Installing COPR packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
-	}
-
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return f.runWithProgress(cmd, progressChan, PhaseAURPackages, 0.70, 0.85)
+	return nil
 }

core/internal/distros/gentoo.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 var GentooGlobalUseFlags = []string{
@@ -201,9 +202,9 @@ func (g *GentooDistribution) setGlobalUseFlags(ctx context.Context, sudoPassword
 
 	var cmd *exec.Cmd
 	if hasUse {
-		cmd = ExecSudoCommand(ctx, sudoPassword, fmt.Sprintf("sed -i 's/^USE=\"\\(.*\\)\"/USE=\"\\1 %s\"/' /etc/portage/make.conf", useFlags))
+		cmd = privesc.ExecCommand(ctx, sudoPassword, fmt.Sprintf("sed -i 's/^USE=\"\\(.*\\)\"/USE=\"\\1 %s\"/' /etc/portage/make.conf", useFlags))
 	} else {
-		cmd = ExecSudoCommand(ctx, sudoPassword, fmt.Sprintf("bash -c \"echo 'USE=\\\"%s\\\"' >> /etc/portage/make.conf\"", useFlags))
+		cmd = privesc.ExecCommand(ctx, sudoPassword, fmt.Sprintf("bash -c \"echo 'USE=\\\"%s\\\"' >> /etc/portage/make.conf\"", useFlags))
 	}
 
 	output, err := cmd.CombinedOutput()
@@ -281,7 +282,7 @@ func (g *GentooDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		LogOutput:   "Syncing Portage tree with emerge --sync",
 	}
 
-	syncCmd := ExecSudoCommand(ctx, sudoPassword, "emerge --sync --quiet")
+	syncCmd := privesc.ExecCommand(ctx, sudoPassword, "emerge --sync --quiet")
 	syncOutput, syncErr := syncCmd.CombinedOutput()
 	if syncErr != nil {
 		g.log(fmt.Sprintf("emerge --sync output: %s", string(syncOutput)))
@@ -302,7 +303,7 @@ func (g *GentooDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 
 	args := []string{"emerge", "--ask=n", "--quiet"}
 	args = append(args, missingPkgs...)
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		g.logError("failed to install prerequisites", err)
@@ -503,14 +504,14 @@ func (g *GentooDistribution) installPortagePackages(ctx context.Context, package
 		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	return g.runWithProgressTimeout(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60, 0)
 }
 
 func (g *GentooDistribution) setPackageUseFlags(ctx context.Context, packageName, useFlags, sudoPassword string) error {
 	packageUseDir := "/etc/portage/package.use"
 
-	mkdirCmd := ExecSudoCommand(ctx, sudoPassword,
+	mkdirCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("mkdir -p %s", packageUseDir))
 	if output, err := mkdirCmd.CombinedOutput(); err != nil {
 		g.log(fmt.Sprintf("mkdir output: %s", string(output)))
@@ -524,7 +525,7 @@ func (g *GentooDistribution) setPackageUseFlags(ctx context.Context, packageName
 	if checkExistingCmd.Run() == nil {
 		g.log(fmt.Sprintf("Updating USE flags for %s from existing entry", packageName))
 		escapedPkg := strings.ReplaceAll(packageName, "/", "\\/")
-		replaceCmd := ExecSudoCommand(ctx, sudoPassword,
+		replaceCmd := privesc.ExecCommand(ctx, sudoPassword,
 			fmt.Sprintf("sed -i '/^%s /d' %s/danklinux; exit_code=$?; exit $exit_code", escapedPkg, packageUseDir))
 		if output, err := replaceCmd.CombinedOutput(); err != nil {
 			g.log(fmt.Sprintf("sed delete output: %s", string(output)))
@@ -532,7 +533,7 @@ func (g *GentooDistribution) setPackageUseFlags(ctx context.Context, packageName
 		}
 	}
 
-	appendCmd := ExecSudoCommand(ctx, sudoPassword,
+	appendCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("bash -c \"echo '%s' >> %s/danklinux\"", useFlagLine, packageUseDir))
 
 	output, err := appendCmd.CombinedOutput()
@@ -557,7 +558,7 @@ func (g *GentooDistribution) syncGURURepo(ctx context.Context, sudoPassword stri
 	}
 
 	// Enable GURU repository
-	enableCmd := ExecSudoCommand(ctx, sudoPassword,
+	enableCmd := privesc.ExecCommand(ctx, sudoPassword,
 		"eselect repository enable guru 2>&1; exit_code=$?; exit $exit_code")
 	output, err := enableCmd.CombinedOutput()
 
@@ -589,7 +590,7 @@ func (g *GentooDistribution) syncGURURepo(ctx context.Context, sudoPassword stri
 		LogOutput:   "Syncing GURU repository",
 	}
 
-	syncCmd := ExecSudoCommand(ctx, sudoPassword,
+	syncCmd := privesc.ExecCommand(ctx, sudoPassword,
 		"emaint sync --repo guru 2>&1; exit_code=$?; exit $exit_code")
 	syncOutput, syncErr := syncCmd.CombinedOutput()
 
@@ -622,7 +623,7 @@ func (g *GentooDistribution) setPackageAcceptKeywords(ctx context.Context, packa
 
 	acceptKeywordsDir := "/etc/portage/package.accept_keywords"
 
-	mkdirCmd := ExecSudoCommand(ctx, sudoPassword,
+	mkdirCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("mkdir -p %s", acceptKeywordsDir))
 	if output, err := mkdirCmd.CombinedOutput(); err != nil {
 		g.log(fmt.Sprintf("mkdir output: %s", string(output)))
@@ -636,7 +637,7 @@ func (g *GentooDistribution) setPackageAcceptKeywords(ctx context.Context, packa
 	if checkExistingCmd.Run() == nil {
 		g.log(fmt.Sprintf("Updating accept keywords for %s from existing entry", packageName))
 		escapedPkg := strings.ReplaceAll(packageName, "/", "\\/")
-		replaceCmd := ExecSudoCommand(ctx, sudoPassword,
+		replaceCmd := privesc.ExecCommand(ctx, sudoPassword,
 			fmt.Sprintf("sed -i '/^%s /d' %s/danklinux; exit_code=$?; exit $exit_code", escapedPkg, acceptKeywordsDir))
 		if output, err := replaceCmd.CombinedOutput(); err != nil {
 			g.log(fmt.Sprintf("sed delete output: %s", string(output)))
@@ -644,7 +645,7 @@ func (g *GentooDistribution) setPackageAcceptKeywords(ctx context.Context, packa
 		}
 	}
 
-	appendCmd := ExecSudoCommand(ctx, sudoPassword,
+	appendCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("bash -c \"echo '%s' >> %s/danklinux\"", keywordLine, acceptKeywordsDir))
 
 	output, err := appendCmd.CombinedOutput()
@@ -695,6 +696,6 @@ func (g *GentooDistribution) installGURUPackages(ctx context.Context, packages [
 		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	return g.runWithProgressTimeout(cmd, progressChan, PhaseAURPackages, 0.70, 0.85, 0)
 }

core/internal/distros/interface.go

@@ -55,6 +55,7 @@ const (
 	PhaseAURPackages
 	PhaseCursorTheme
 	PhaseConfiguration
+	PhaseGreeterSetup
 	PhaseComplete
 )
 

core/internal/distros/manual_packages.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 // ManualPackageInstaller provides methods for installing packages from source
@@ -143,7 +144,7 @@ func (m *ManualPackageInstaller) installDgop(ctx context.Context, sudoPassword s
 		CommandInfo: "sudo make install",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "make install")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "make install")
 	installCmd.Dir = tmpDir
 	if err := installCmd.Run(); err != nil {
 		m.logError("failed to install dgop", err)
@@ -213,7 +214,7 @@ func (m *ManualPackageInstaller) installNiri(ctx context.Context, sudoPassword s
 		CommandInfo: "dpkg -i niri.deb",
 	}
 
-	installDebCmd := ExecSudoCommand(ctx, sudoPassword,
+	installDebCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("dpkg -i %s/target/debian/niri_*.deb", buildDir))
 
 	output, err := installDebCmd.CombinedOutput()
@@ -324,7 +325,7 @@ func (m *ManualPackageInstaller) installQuickshell(ctx context.Context, variant
 		CommandInfo: "sudo cmake --install build",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "cmake --install build")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "cmake --install build")
 	installCmd.Dir = tmpDir
 	if err := installCmd.Run(); err != nil {
 		return fmt.Errorf("failed to install quickshell: %w", err)
@@ -387,7 +388,7 @@ func (m *ManualPackageInstaller) installHyprland(ctx context.Context, sudoPasswo
 		CommandInfo: "sudo make install",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "make install")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "make install")
 	installCmd.Dir = tmpDir
 	if err := installCmd.Run(); err != nil {
 		return fmt.Errorf("failed to install Hyprland: %w", err)
@@ -453,7 +454,7 @@ func (m *ManualPackageInstaller) installGhostty(ctx context.Context, sudoPasswor
 		CommandInfo: "sudo cp zig-out/bin/ghostty /usr/local/bin/",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword,
+	installCmd := privesc.ExecCommand(ctx, sudoPassword,
 		fmt.Sprintf("cp %s/zig-out/bin/ghostty /usr/local/bin/", tmpDir))
 	if err := installCmd.Run(); err != nil {
 		return fmt.Errorf("failed to install Ghostty: %w", err)
@@ -492,16 +493,11 @@ func (m *ManualPackageInstaller) installMatugen(ctx context.Context, sudoPasswor
 		CommandInfo: fmt.Sprintf("sudo cp %s %s", sourcePath, targetPath),
 	}
 
-	copyCmd := exec.CommandContext(ctx, "sudo", "-S", "cp", sourcePath, targetPath)
-	copyCmd.Stdin = strings.NewReader(sudoPassword + "\n")
-	if err := copyCmd.Run(); err != nil {
+	if err := privesc.Run(ctx, sudoPassword, "cp", sourcePath, targetPath); err != nil {
 		return fmt.Errorf("failed to copy matugen to /usr/local/bin: %w", err)
 	}
 
-	// Make it executable
-	chmodCmd := exec.CommandContext(ctx, "sudo", "-S", "chmod", "+x", targetPath)
-	chmodCmd.Stdin = strings.NewReader(sudoPassword + "\n")
-	if err := chmodCmd.Run(); err != nil {
+	if err := privesc.Run(ctx, sudoPassword, "chmod", "+x", targetPath); err != nil {
 		return fmt.Errorf("failed to make matugen executable: %w", err)
 	}
 
@@ -646,15 +642,11 @@ func (m *ManualPackageInstaller) installXwaylandSatellite(ctx context.Context, s
 		CommandInfo: fmt.Sprintf("sudo cp %s %s", sourcePath, targetPath),
 	}
 
-	copyCmd := exec.CommandContext(ctx, "sudo", "-S", "cp", sourcePath, targetPath)
-	copyCmd.Stdin = strings.NewReader(sudoPassword + "\n")
-	if err := copyCmd.Run(); err != nil {
+	if err := privesc.Run(ctx, sudoPassword, "cp", sourcePath, targetPath); err != nil {
 		return fmt.Errorf("failed to copy xwayland-satellite to /usr/local/bin: %w", err)
 	}
 
-	chmodCmd := exec.CommandContext(ctx, "sudo", "-S", "chmod", "+x", targetPath)
-	chmodCmd.Stdin = strings.NewReader(sudoPassword + "\n")
-	if err := chmodCmd.Run(); err != nil {
+	if err := privesc.Run(ctx, sudoPassword, "chmod", "+x", targetPath); err != nil {
 		return fmt.Errorf("failed to make xwayland-satellite executable: %w", err)
 	}
 

core/internal/distros/minimal_install.go

@@ -0,0 +1,44 @@
+package distros
+
+type minimalInstallGroup struct {
+	packages []string
+	minimal  bool
+}
+
+func shouldPreferMinimalInstall(pkg string) bool {
+	switch pkg {
+	case "niri", "niri-git":
+		return true
+	default:
+		return false
+	}
+}
+
+func splitMinimalInstallPackages(packages []string) (normal []string, minimal []string) {
+	for _, pkg := range packages {
+		if shouldPreferMinimalInstall(pkg) {
+			minimal = append(minimal, pkg)
+			continue
+		}
+		normal = append(normal, pkg)
+	}
+	return normal, minimal
+}
+
+func orderedMinimalInstallGroups(packages []string) []minimalInstallGroup {
+	normal, minimal := splitMinimalInstallPackages(packages)
+	groups := make([]minimalInstallGroup, 0, 2)
+	if len(minimal) > 0 {
+		groups = append(groups, minimalInstallGroup{
+			packages: minimal,
+			minimal:  true,
+		})
+	}
+	if len(normal) > 0 {
+		groups = append(groups, minimalInstallGroup{
+			packages: normal,
+			minimal:  false,
+		})
+	}
+	return groups
+}

core/internal/distros/opensuse.go

@@ -6,9 +6,11 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"slices"
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 func init() {
@@ -29,6 +31,8 @@ type OpenSUSEDistribution struct {
 	config DistroConfig
 }
 
+const openSUSENiriWaylandServerPackage = "libwayland-server0"
+
 func NewOpenSUSEDistribution(config DistroConfig, logChan chan<- string) *OpenSUSEDistribution {
 	base := NewBaseDistribution(logChan)
 	return &OpenSUSEDistribution{
@@ -71,6 +75,7 @@ func (o *OpenSUSEDistribution) DetectDependenciesWithTerminal(ctx context.Contex
 	dependencies = append(dependencies, o.detectGit())
 	dependencies = append(dependencies, o.detectWindowManager(wm))
 	dependencies = append(dependencies, o.detectQuickshell())
+	dependencies = append(dependencies, o.detectDMSGreeter())
 	dependencies = append(dependencies, o.detectXDGPortal())
 	dependencies = append(dependencies, o.detectAccountsService())
 
@@ -100,6 +105,10 @@ func (o *OpenSUSEDistribution) packageInstalled(pkg string) bool {
 	return err == nil
 }
 
+func (o *OpenSUSEDistribution) detectDMSGreeter() deps.Dependency {
+	return o.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", o.packageInstalled("dms-greeter"))
+}
+
 func (o *OpenSUSEDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
 	return o.GetPackageMappingWithVariants(wm, make(map[string]deps.PackageVariant))
 }
@@ -116,6 +125,7 @@ func (o *OpenSUSEDistribution) GetPackageMappingWithVariants(wm deps.WindowManag
 		// DMS packages from OBS
 		"dms (DankMaterialShell)": o.getDmsMapping(variants["dms (DankMaterialShell)"]),
 		"quickshell":              o.getQuickshellMapping(variants["quickshell"]),
+		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
 		"dgop":                    {Name: "dgop", Repository: RepoTypeOBS, RepoURL: "home:AvengeMedia:danklinux"},
@@ -193,35 +203,7 @@ func (o *OpenSUSEDistribution) detectAccountsService() deps.Dependency {
 }
 
 func (o *OpenSUSEDistribution) getPrerequisites() []string {
-	return []string{
-		"make",
-		"unzip",
-		"gcc",
-		"gcc-c++",
-		"cmake",
-		"ninja",
-		"pkgconf-pkg-config",
-		"git",
-		"qt6-base-devel",
-		"qt6-declarative-devel",
-		"qt6-declarative-private-devel",
-		"qt6-shadertools",
-		"qt6-shadertools-devel",
-		"qt6-wayland-devel",
-		"qt6-waylandclient-private-devel",
-		"spirv-tools-devel",
-		"cli11-devel",
-		"wayland-protocols-devel",
-		"libgbm-devel",
-		"libdrm-devel",
-		"pipewire-devel",
-		"jemalloc-devel",
-		"wayland-utils",
-		"Mesa-libGLESv3-devel",
-		"pam-devel",
-		"glib2-devel",
-		"polkit-devel",
-	}
+	return []string{}
 }
 
 func (o *OpenSUSEDistribution) InstallPrerequisites(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -269,7 +251,7 @@ func (o *OpenSUSEDistribution) InstallPrerequisites(ctx context.Context, sudoPas
 
 	args := []string{"zypper", "install", "-y"}
 	args = append(args, missingPkgs...)
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		o.logError("failed to install prerequisites", err)
@@ -291,6 +273,10 @@ func (o *OpenSUSEDistribution) InstallPackages(ctx context.Context, dependencies
 		LogOutput:  "Starting prerequisite check...",
 	}
 
+	if err := o.disableInstallMediaRepos(ctx, sudoPassword, progressChan); err != nil {
+		return fmt.Errorf("failed to disable install media repositories: %w", err)
+	}
+
 	if err := o.InstallPrerequisites(ctx, sudoPassword, progressChan); err != nil {
 		return fmt.Errorf("failed to install prerequisites: %w", err)
 	}
@@ -321,7 +307,7 @@ func (o *OpenSUSEDistribution) InstallPackages(ctx context.Context, dependencies
 			NeedsSudo:  true,
 			LogOutput:  fmt.Sprintf("Installing system packages: %s", strings.Join(systemPkgs, ", ")),
 		}
-		if err := o.installZypperPackages(ctx, systemPkgs, sudoPassword, progressChan); err != nil {
+		if err := o.installZypperPackages(ctx, systemPkgs, sudoPassword, progressChan, PhaseSystemPackages, "Installing system packages...", 0.40, 0.60); err != nil {
 			return fmt.Errorf("failed to install zypper packages: %w", err)
 		}
 	}
@@ -336,7 +322,7 @@ func (o *OpenSUSEDistribution) InstallPackages(ctx context.Context, dependencies
 			IsComplete: false,
 			LogOutput:  fmt.Sprintf("Installing OBS packages: %s", strings.Join(obsPkgNames, ", ")),
 		}
-		if err := o.installZypperPackages(ctx, obsPkgNames, sudoPassword, progressChan); err != nil {
+		if err := o.installZypperPackages(ctx, obsPkgNames, sudoPassword, progressChan, PhaseAURPackages, "Installing OBS packages...", 0.70, 0.85); err != nil {
 			return fmt.Errorf("failed to install OBS packages: %w", err)
 		}
 	}
@@ -426,9 +412,32 @@ func (o *OpenSUSEDistribution) categorizePackages(dependencies []deps.Dependency
 		}
 	}
 
+	systemPkgs = o.appendMissingSystemPackages(systemPkgs, openSUSENiriRuntimePackages(wm, disabledFlags))
+
 	return systemPkgs, obsPkgs, manualPkgs, variantMap
 }
 
+func openSUSENiriRuntimePackages(wm deps.WindowManager, disabledFlags map[string]bool) []string {
+	if wm != deps.WindowManagerNiri || disabledFlags["niri"] {
+		return nil
+	}
+
+	return []string{openSUSENiriWaylandServerPackage}
+}
+
+func (o *OpenSUSEDistribution) appendMissingSystemPackages(systemPkgs []string, extraPkgs []string) []string {
+	for _, pkg := range extraPkgs {
+		if slices.Contains(systemPkgs, pkg) || o.packageInstalled(pkg) {
+			continue
+		}
+
+		o.log(fmt.Sprintf("Adding openSUSE runtime package: %s", pkg))
+		systemPkgs = append(systemPkgs, pkg)
+	}
+
+	return systemPkgs
+}
+
 func (o *OpenSUSEDistribution) extractPackageNames(packages []PackageMapping) []string {
 	names := make([]string, len(packages))
 	for i, pkg := range packages {
@@ -478,7 +487,7 @@ func (o *OpenSUSEDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Pac
 				CommandInfo: fmt.Sprintf("sudo zypper addrepo %s", repoURL),
 			}
 
-			cmd := ExecSudoCommand(ctx, sudoPassword,
+			cmd := privesc.ExecCommand(ctx, sudoPassword,
 				fmt.Sprintf("zypper addrepo -f %s", repoURL))
 			if err := o.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.20, 0.22); err != nil {
 				o.log(fmt.Sprintf("OBS repo %s add failed (may already exist): %v", pkg.RepoURL, err))
@@ -499,7 +508,7 @@ func (o *OpenSUSEDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Pac
 			CommandInfo: "sudo zypper --gpg-auto-import-keys refresh",
 		}
 
-		refreshCmd := ExecSudoCommand(ctx, sudoPassword, "zypper --gpg-auto-import-keys refresh")
+		refreshCmd := privesc.ExecCommand(ctx, sudoPassword, "zypper --gpg-auto-import-keys refresh")
 		if err := o.runWithProgress(refreshCmd, progressChan, PhaseSystemPackages, 0.25, 0.27); err != nil {
 			return fmt.Errorf("failed to refresh repositories: %w", err)
 		}
@@ -508,27 +517,146 @@ func (o *OpenSUSEDistribution) enableOBSRepos(ctx context.Context, obsPkgs []Pac
 	return nil
 }
 
-func (o *OpenSUSEDistribution) installZypperPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+func isOpenSUSEInstallMediaURI(uri string) bool {
+	normalizedURI := strings.ToLower(strings.TrimSpace(uri))
+
+	return strings.HasPrefix(normalizedURI, "cd:/") ||
+		strings.HasPrefix(normalizedURI, "dvd:/") ||
+		strings.HasPrefix(normalizedURI, "hd:/") ||
+		strings.HasPrefix(normalizedURI, "iso:/")
+}
+
+func parseZypperInstallMediaAliases(output string) []string {
+	var aliases []string
+
+	for _, line := range strings.Split(output, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || !strings.Contains(line, "|") {
+			continue
+		}
+
+		parts := strings.Split(line, "|")
+		if len(parts) < 7 {
+			continue
+		}
+
+		for i := range parts {
+			parts[i] = strings.TrimSpace(parts[i])
+		}
+
+		alias := parts[1]
+		enabled := strings.ToLower(parts[3])
+		uri := parts[len(parts)-1]
+
+		if alias == "" || strings.EqualFold(alias, "alias") {
+			continue
+		}
+		if enabled != "" && enabled != "yes" {
+			continue
+		}
+		if !isOpenSUSEInstallMediaURI(uri) {
+			continue
+		}
+
+		aliases = append(aliases, alias)
+	}
+
+	return aliases
+}
+
+func (o *OpenSUSEDistribution) disableInstallMediaRepos(ctx context.Context, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
+	listCmd := exec.CommandContext(ctx, "zypper", "repos", "-u")
+	output, err := listCmd.CombinedOutput()
+	if err != nil {
+		o.log(fmt.Sprintf("Warning: failed to list zypper repositories: %s", strings.TrimSpace(string(output))))
+		return fmt.Errorf("failed to list zypper repositories: %w", err)
+	}
+
+	aliases := parseZypperInstallMediaAliases(string(output))
+	if len(aliases) == 0 {
+		return nil
+	}
+
+	o.log(fmt.Sprintf("Disabling install media repositories: %s", strings.Join(aliases, ", ")))
+	progressChan <- InstallProgressMsg{
+		Phase:       PhasePrerequisites,
+		Progress:    0.055,
+		Step:        "Disabling install media repositories...",
+		IsComplete:  false,
+		NeedsSudo:   true,
+		CommandInfo: fmt.Sprintf("sudo zypper modifyrepo -d %s", strings.Join(aliases, " ")),
+		LogOutput:   fmt.Sprintf("Disabling install media repositories: %s", strings.Join(aliases, ", ")),
+	}
+
+	for _, alias := range aliases {
+		cmd := privesc.ExecCommand(ctx, sudoPassword, fmt.Sprintf("zypper modifyrepo -d '%s'", privesc.EscapeSingleQuotes(alias)))
+		repoOutput, err := cmd.CombinedOutput()
+		if err != nil {
+			o.log(fmt.Sprintf("Failed to disable install media repo %s: %s", alias, strings.TrimSpace(string(repoOutput))))
+			return fmt.Errorf("failed to disable install media repo %s: %w", alias, err)
+		}
+		o.log(fmt.Sprintf("Disabled install media repo %s: %s", alias, strings.TrimSpace(string(repoOutput))))
+	}
+
+	return nil
+}
+
+func (o *OpenSUSEDistribution) zypperInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"zypper", "install", "-y"}
+	if minimal {
+		args = append(args, "--no-recommends")
+	}
+	return append(args, packages...)
+}
+
+func (o *OpenSUSEDistribution) installZypperPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg, phase InstallPhase, step string, startProgress float64, endProgress float64) error {
 	if len(packages) == 0 {
 		return nil
 	}
 
 	o.log(fmt.Sprintf("Installing zypper packages: %s", strings.Join(packages, ", ")))
 
-	args := []string{"zypper", "install", "-y"}
-	args = append(args, packages...)
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
 
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		groupStart := startProgress
+		groupEnd := endProgress
+		if totalGroups > 1 {
+			midpoint := startProgress + ((endProgress - startProgress) / 2)
+			if groupIndex == 1 {
+				groupEnd = midpoint
+			} else {
+				groupStart = midpoint
+			}
+		}
+
+		args := o.zypperInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       phase,
+			Progress:    groupStart,
+			Step:        step,
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return o.runWithProgress(cmd, progressChan, phase, groupStart, groupEnd)
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return o.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func (o *OpenSUSEDistribution) installQuickshell(ctx context.Context, variant deps.PackageVariant, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -647,7 +775,7 @@ func (o *OpenSUSEDistribution) installQuickshell(ctx context.Context, variant de
 		CommandInfo: "sudo cmake --install build",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "cmake --install build")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "cmake --install build")
 	installCmd.Dir = tmpDir
 	if err := installCmd.Run(); err != nil {
 		return fmt.Errorf("failed to install quickshell: %w", err)
@@ -671,7 +799,7 @@ func (o *OpenSUSEDistribution) installRust(ctx context.Context, sudoPassword str
 		CommandInfo: "sudo zypper install rustup",
 	}
 
-	rustupInstallCmd := ExecSudoCommand(ctx, sudoPassword, "zypper install -y rustup")
+	rustupInstallCmd := privesc.ExecCommand(ctx, sudoPassword, "zypper install -y rustup")
 	if err := o.runWithProgress(rustupInstallCmd, progressChan, PhaseSystemPackages, 0.82, 0.83); err != nil {
 		return fmt.Errorf("failed to install rustup: %w", err)
 	}

core/internal/distros/ubuntu.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
 )
 
 func init() {
@@ -63,6 +64,7 @@ func (u *UbuntuDistribution) DetectDependenciesWithTerminal(ctx context.Context,
 	dependencies = append(dependencies, u.detectGit())
 	dependencies = append(dependencies, u.detectWindowManager(wm))
 	dependencies = append(dependencies, u.detectQuickshell())
+	dependencies = append(dependencies, u.detectDMSGreeter())
 	dependencies = append(dependencies, u.detectXDGPortal())
 	dependencies = append(dependencies, u.detectAccountsService())
 
@@ -94,10 +96,12 @@ func (u *UbuntuDistribution) detectAccountsService() deps.Dependency {
 	return u.detectPackage("accountsservice", "D-Bus interface for user account query and manipulation", u.packageInstalled("accountsservice"))
 }
 
+func (u *UbuntuDistribution) detectDMSGreeter() deps.Dependency {
+	return u.detectOptionalPackage("dms-greeter", "DankMaterialShell greetd greeter", u.packageInstalled("dms-greeter"))
+}
+
 func (u *UbuntuDistribution) packageInstalled(pkg string) bool {
-	cmd := exec.Command("dpkg", "-l", pkg)
-	err := cmd.Run()
-	return err == nil
+	return debianPackageInstalledPrecisely(pkg)
 }
 
 func (u *UbuntuDistribution) GetPackageMapping(wm deps.WindowManager) map[string]PackageMapping {
@@ -116,6 +120,7 @@ func (u *UbuntuDistribution) GetPackageMappingWithVariants(wm deps.WindowManager
 		// DMS packages from PPAs
 		"dms (DankMaterialShell)": u.getDmsMapping(variants["dms (DankMaterialShell)"]),
 		"quickshell":              u.getQuickshellMapping(variants["quickshell"]),
+		"dms-greeter":             {Name: "dms-greeter", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"matugen":                 {Name: "matugen", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"dgop":                    {Name: "dgop", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
 		"ghostty":                 {Name: "ghostty", Repository: RepoTypePPA, RepoURL: "ppa:avengemedia/danklinux"},
@@ -173,7 +178,7 @@ func (u *UbuntuDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		LogOutput:  "Updating APT package lists",
 	}
 
-	updateCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get update")
+	updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
 	if err := u.runWithProgress(updateCmd, progressChan, PhasePrerequisites, 0.06, 0.07); err != nil {
 		return fmt.Errorf("failed to update package lists: %w", err)
 	}
@@ -191,7 +196,7 @@ func (u *UbuntuDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 	checkCmd := exec.CommandContext(ctx, "dpkg", "-l", "build-essential")
 	if err := checkCmd.Run(); err != nil {
 		// Not installed, install it
-		cmd := ExecSudoCommand(ctx, sudoPassword, "apt-get install -y build-essential")
+		cmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get install -y build-essential")
 		if err := u.runWithProgress(cmd, progressChan, PhasePrerequisites, 0.08, 0.09); err != nil {
 			return fmt.Errorf("failed to install build-essential: %w", err)
 		}
@@ -207,7 +212,7 @@ func (u *UbuntuDistribution) InstallPrerequisites(ctx context.Context, sudoPassw
 		LogOutput:   "Installing additional development tools",
 	}
 
-	devToolsCmd := ExecSudoCommand(ctx, sudoPassword,
+	devToolsCmd := privesc.ExecCommand(ctx, sudoPassword,
 		"apt-get install -y curl wget git cmake ninja-build pkg-config libglib2.0-dev libpolkit-agent-1-dev")
 	if err := u.runWithProgress(devToolsCmd, progressChan, PhasePrerequisites, 0.10, 0.12); err != nil {
 		return fmt.Errorf("failed to install development tools: %w", err)
@@ -394,7 +399,7 @@ func (u *UbuntuDistribution) extractPackageNames(packages []PackageMapping) []st
 func (u *UbuntuDistribution) enablePPARepos(ctx context.Context, ppaPkgs []PackageMapping, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
 	enabledRepos := make(map[string]bool)
 
-	installPPACmd := ExecSudoCommand(ctx, sudoPassword,
+	installPPACmd := privesc.ExecCommand(ctx, sudoPassword,
 		"apt-get install -y software-properties-common")
 	if err := u.runWithProgress(installPPACmd, progressChan, PhaseSystemPackages, 0.15, 0.17); err != nil {
 		return fmt.Errorf("failed to install software-properties-common: %w", err)
@@ -412,7 +417,7 @@ func (u *UbuntuDistribution) enablePPARepos(ctx context.Context, ppaPkgs []Packa
 				CommandInfo: fmt.Sprintf("sudo add-apt-repository -y %s", pkg.RepoURL),
 			}
 
-			cmd := ExecSudoCommand(ctx, sudoPassword,
+			cmd := privesc.ExecCommand(ctx, sudoPassword,
 				fmt.Sprintf("add-apt-repository -y %s", pkg.RepoURL))
 			if err := u.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.20, 0.22); err != nil {
 				u.logError(fmt.Sprintf("failed to enable PPA repo %s", pkg.RepoURL), err)
@@ -433,7 +438,7 @@ func (u *UbuntuDistribution) enablePPARepos(ctx context.Context, ppaPkgs []Packa
 			CommandInfo: "sudo apt-get update",
 		}
 
-		updateCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get update")
+		updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
 		if err := u.runWithProgress(updateCmd, progressChan, PhaseSystemPackages, 0.25, 0.27); err != nil {
 			return fmt.Errorf("failed to update package lists after adding PPAs: %w", err)
 		}
@@ -448,21 +453,7 @@ func (u *UbuntuDistribution) installAPTPackages(ctx context.Context, packages []
 	}
 
 	u.log(fmt.Sprintf("Installing APT packages: %s", strings.Join(packages, ", ")))
-
-	args := []string{"apt-get", "install", "-y"}
-	args = append(args, packages...)
-
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseSystemPackages,
-		Progress:    0.40,
-		Step:        "Installing system packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
-	}
-
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return u.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.40, 0.60)
+	return u.installAPTGroups(ctx, packages, sudoPassword, progressChan, PhaseSystemPackages, "Installing system packages...", 0.40, 0.60)
 }
 
 func (u *UbuntuDistribution) installPPAPackages(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -471,21 +462,59 @@ func (u *UbuntuDistribution) installPPAPackages(ctx context.Context, packages []
 	}
 
 	u.log(fmt.Sprintf("Installing PPA packages: %s", strings.Join(packages, ", ")))
+	return u.installAPTGroups(ctx, packages, sudoPassword, progressChan, PhaseAURPackages, "Installing PPA packages...", 0.70, 0.85)
+}
 
-	args := []string{"apt-get", "install", "-y"}
-	args = append(args, packages...)
+func (u *UbuntuDistribution) aptInstallArgs(packages []string, minimal bool) []string {
+	args := []string{"DEBIAN_FRONTEND=noninteractive", "apt-get", "install", "-y"}
+	if minimal {
+		args = append(args, "--no-install-recommends")
+	}
+	return append(args, packages...)
+}
 
-	progressChan <- InstallProgressMsg{
-		Phase:       PhaseAURPackages,
-		Progress:    0.70,
-		Step:        "Installing PPA packages...",
-		IsComplete:  false,
-		NeedsSudo:   true,
-		CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+func (u *UbuntuDistribution) installAPTGroups(ctx context.Context, packages []string, sudoPassword string, progressChan chan<- InstallProgressMsg, phase InstallPhase, step string, startProgress float64, endProgress float64) error {
+	groups := orderedMinimalInstallGroups(packages)
+	totalGroups := len(groups)
+
+	groupIndex := 0
+	installGroup := func(groupPackages []string, minimal bool) error {
+		if len(groupPackages) == 0 {
+			return nil
+		}
+
+		groupIndex++
+		groupStart := startProgress
+		groupEnd := endProgress
+		if totalGroups > 1 {
+			midpoint := startProgress + ((endProgress - startProgress) / 2)
+			if groupIndex == 1 {
+				groupEnd = midpoint
+			} else {
+				groupStart = midpoint
+			}
+		}
+
+		args := u.aptInstallArgs(groupPackages, minimal)
+		progressChan <- InstallProgressMsg{
+			Phase:       phase,
+			Progress:    groupStart,
+			Step:        step,
+			IsComplete:  false,
+			NeedsSudo:   true,
+			CommandInfo: fmt.Sprintf("sudo %s", strings.Join(args, " ")),
+		}
+
+		cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
+		return u.runWithProgress(cmd, progressChan, phase, groupStart, groupEnd)
 	}
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
-	return u.runWithProgress(cmd, progressChan, PhaseAURPackages, 0.70, 0.85)
+	for _, group := range groups {
+		if err := installGroup(group.packages, group.minimal); err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 func (u *UbuntuDistribution) installBuildDependencies(ctx context.Context, manualPkgs []string, sudoPassword string, progressChan chan<- InstallProgressMsg) error {
@@ -563,7 +592,7 @@ func (u *UbuntuDistribution) installBuildDependencies(ctx context.Context, manua
 	args := []string{"apt-get", "install", "-y"}
 	args = append(args, depList...)
 
-	cmd := ExecSudoCommand(ctx, sudoPassword, strings.Join(args, " "))
+	cmd := privesc.ExecCommand(ctx, sudoPassword, strings.Join(args, " "))
 	return u.runWithProgress(cmd, progressChan, PhaseSystemPackages, 0.80, 0.82)
 }
 
@@ -581,7 +610,7 @@ func (u *UbuntuDistribution) installRust(ctx context.Context, sudoPassword strin
 		CommandInfo: "sudo apt-get install rustup",
 	}
 
-	rustupInstallCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get install -y rustup")
+	rustupInstallCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get install -y rustup")
 	if err := u.runWithProgress(rustupInstallCmd, progressChan, PhaseSystemPackages, 0.82, 0.83); err != nil {
 		return fmt.Errorf("failed to install rustup: %w", err)
 	}
@@ -621,7 +650,7 @@ func (u *UbuntuDistribution) installGo(ctx context.Context, sudoPassword string,
 		CommandInfo: "sudo add-apt-repository ppa:longsleep/golang-backports",
 	}
 
-	addPPACmd := ExecSudoCommand(ctx, sudoPassword,
+	addPPACmd := privesc.ExecCommand(ctx, sudoPassword,
 		"add-apt-repository -y ppa:longsleep/golang-backports")
 	if err := u.runWithProgress(addPPACmd, progressChan, PhaseSystemPackages, 0.87, 0.88); err != nil {
 		return fmt.Errorf("failed to add Go PPA: %w", err)
@@ -636,7 +665,7 @@ func (u *UbuntuDistribution) installGo(ctx context.Context, sudoPassword string,
 		CommandInfo: "sudo apt-get update",
 	}
 
-	updateCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get update")
+	updateCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get update")
 	if err := u.runWithProgress(updateCmd, progressChan, PhaseSystemPackages, 0.88, 0.89); err != nil {
 		return fmt.Errorf("failed to update package lists after adding Go PPA: %w", err)
 	}
@@ -650,7 +679,7 @@ func (u *UbuntuDistribution) installGo(ctx context.Context, sudoPassword string,
 		CommandInfo: "sudo apt-get install golang-go",
 	}
 
-	installCmd := ExecSudoCommand(ctx, sudoPassword, "apt-get install -y golang-go")
+	installCmd := privesc.ExecCommand(ctx, sudoPassword, "apt-get install -y golang-go")
 	return u.runWithProgress(installCmd, progressChan, PhaseSystemPackages, 0.89, 0.90)
 }
 

core/internal/geolocation/client.go

@@ -0,0 +1,42 @@
+package geolocation
+
+import "github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+
+func NewClient() Client {
+	geoclueClient, err := newGeoClueClient()
+	if err != nil {
+		log.Warnf("GeoClue2 unavailable: %v", err)
+		return newSeededIpClient()
+	}
+
+	loc, _ := geoclueClient.GetLocation()
+	if loc.Latitude != 0 || loc.Longitude != 0 {
+		log.Info("Using GeoClue2 location")
+		return geoclueClient
+	}
+
+	log.Info("GeoClue2 has no fix yet, seeding with IP location")
+	ipLoc, err := fetchIPLocation()
+	if err != nil {
+		log.Warnf("IP location seed failed: %v", err)
+		return geoclueClient
+	}
+
+	log.Info("Seeded GeoClue2 with IP location")
+	geoclueClient.SeedLocation(Location{Latitude: ipLoc.Latitude, Longitude: ipLoc.Longitude})
+	return geoclueClient
+}
+
+func newSeededIpClient() *IpClient {
+	client := newIpClient()
+	ipLoc, err := fetchIPLocation()
+	if err != nil {
+		log.Warnf("IP location also failed: %v", err)
+		return client
+	}
+
+	log.Info("Using IP location")
+	client.currLocation.Latitude = ipLoc.Latitude
+	client.currLocation.Longitude = ipLoc.Longitude
+	return client
+}

core/internal/geolocation/client_geoclue.go

@@ -0,0 +1,243 @@
+package geolocation
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/dbusutil"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/syncmap"
+	"github.com/godbus/dbus/v5"
+)
+
+const (
+	dbusGeoClueService   = "org.freedesktop.GeoClue2"
+	dbusGeoCluePath      = "/org/freedesktop/GeoClue2"
+	dbusGeoClueInterface = dbusGeoClueService
+
+	dbusGeoClueManagerPath      = dbusGeoCluePath + "/Manager"
+	dbusGeoClueManagerInterface = dbusGeoClueInterface + ".Manager"
+	dbusGeoClueManagerGetClient = dbusGeoClueManagerInterface + ".GetClient"
+
+	dbusGeoClueClientInterface       = dbusGeoClueInterface + ".Client"
+	dbusGeoClueClientDesktopId       = dbusGeoClueClientInterface + ".DesktopId"
+	dbusGeoClueClientTimeThreshold   = dbusGeoClueClientInterface + ".TimeThreshold"
+	dbusGeoClueClientTimeStart       = dbusGeoClueClientInterface + ".Start"
+	dbusGeoClueClientTimeStop        = dbusGeoClueClientInterface + ".Stop"
+	dbusGeoClueClientLocationUpdated = dbusGeoClueClientInterface + ".LocationUpdated"
+
+	dbusGeoClueLocationInterface = dbusGeoClueInterface + ".Location"
+	dbusGeoClueLocationLatitude  = dbusGeoClueLocationInterface + ".Latitude"
+	dbusGeoClueLocationLongitude = dbusGeoClueLocationInterface + ".Longitude"
+)
+
+type GeoClueClient struct {
+	currLocation  *Location
+	locationMutex sync.RWMutex
+
+	dbusConn   *dbus.Conn
+	clientPath dbus.ObjectPath
+	signals    chan *dbus.Signal
+
+	stopChan chan struct{}
+	sigWG    sync.WaitGroup
+
+	subscribers syncmap.Map[string, chan Location]
+}
+
+func newGeoClueClient() (*GeoClueClient, error) {
+	dbusConn, err := dbus.ConnectSystemBus()
+	if err != nil {
+		return nil, fmt.Errorf("system bus connection failed: %w", err)
+	}
+
+	c := &GeoClueClient{
+		dbusConn: dbusConn,
+		stopChan: make(chan struct{}),
+		signals:  make(chan *dbus.Signal, 256),
+
+		currLocation: &Location{
+			Latitude:  0.0,
+			Longitude: 0.0,
+		},
+	}
+
+	if err := c.setupClient(); err != nil {
+		dbusConn.Close()
+		return nil, err
+	}
+
+	if err := c.startSignalPump(); err != nil {
+		return nil, err
+	}
+
+	return c, nil
+}
+
+func (c *GeoClueClient) Close() {
+	close(c.stopChan)
+
+	c.sigWG.Wait()
+
+	if c.signals != nil {
+		c.dbusConn.RemoveSignal(c.signals)
+		close(c.signals)
+	}
+
+	c.subscribers.Range(func(key string, ch chan Location) bool {
+		close(ch)
+		c.subscribers.Delete(key)
+		return true
+	})
+
+	if c.dbusConn != nil {
+		c.dbusConn.Close()
+	}
+}
+
+func (c *GeoClueClient) Subscribe(id string) chan Location {
+	ch := make(chan Location, 64)
+	c.subscribers.Store(id, ch)
+	return ch
+}
+
+func (c *GeoClueClient) Unsubscribe(id string) {
+	if ch, ok := c.subscribers.LoadAndDelete(id); ok {
+		close(ch)
+	}
+}
+
+func (c *GeoClueClient) setupClient() error {
+	managerObj := c.dbusConn.Object(dbusGeoClueService, dbusGeoClueManagerPath)
+
+	if err := managerObj.Call(dbusGeoClueManagerGetClient, 0).Store(&c.clientPath); err != nil {
+		return fmt.Errorf("failed to create GeoClue2 client: %w", err)
+	}
+
+	clientObj := c.dbusConn.Object(dbusGeoClueService, c.clientPath)
+	if err := clientObj.SetProperty(dbusGeoClueClientDesktopId, "dms"); err != nil {
+		return fmt.Errorf("failed to set desktop ID: %w", err)
+	}
+
+	if err := clientObj.SetProperty(dbusGeoClueClientTimeThreshold, uint(10)); err != nil {
+		return fmt.Errorf("failed to set time threshold: %w", err)
+	}
+
+	return nil
+}
+
+func (c *GeoClueClient) startSignalPump() error {
+	c.dbusConn.Signal(c.signals)
+
+	if err := c.dbusConn.AddMatchSignal(
+		dbus.WithMatchObjectPath(c.clientPath),
+		dbus.WithMatchInterface(dbusGeoClueClientInterface),
+		dbus.WithMatchSender(dbusGeoClueClientLocationUpdated),
+	); err != nil {
+		return err
+	}
+
+	c.sigWG.Add(1)
+	go func() {
+		defer c.sigWG.Done()
+
+		clientObj := c.dbusConn.Object(dbusGeoClueService, c.clientPath)
+		clientObj.Call(dbusGeoClueClientTimeStart, 0)
+		defer clientObj.Call(dbusGeoClueClientTimeStop, 0)
+
+		for {
+			select {
+			case <-c.stopChan:
+				return
+			case sig, ok := <-c.signals:
+				if !ok {
+					return
+				}
+				if sig == nil {
+					continue
+				}
+
+				c.handleSignal(sig)
+			}
+		}
+	}()
+
+	return nil
+}
+
+func (c *GeoClueClient) handleSignal(sig *dbus.Signal) {
+	switch sig.Name {
+	case dbusGeoClueClientLocationUpdated:
+		if len(sig.Body) != 2 {
+			return
+		}
+
+		newLocationPath, ok := sig.Body[1].(dbus.ObjectPath)
+		if !ok {
+			return
+		}
+
+		if err := c.handleLocationUpdated(newLocationPath); err != nil {
+			log.Warn("GeoClue: Failed to handle location update: %v", err)
+			return
+		}
+	}
+}
+
+func (c *GeoClueClient) handleLocationUpdated(path dbus.ObjectPath) error {
+	locationObj := c.dbusConn.Object(dbusGeoClueService, path)
+
+	lat, err := locationObj.GetProperty(dbusGeoClueLocationLatitude)
+	if err != nil {
+		return err
+	}
+
+	long, err := locationObj.GetProperty(dbusGeoClueLocationLongitude)
+	if err != nil {
+		return err
+	}
+
+	c.locationMutex.Lock()
+	c.currLocation.Latitude = dbusutil.AsOr(lat, 0.0)
+	c.currLocation.Longitude = dbusutil.AsOr(long, 0.0)
+	c.locationMutex.Unlock()
+
+	c.notifySubscribers()
+	return nil
+}
+
+func (c *GeoClueClient) notifySubscribers() {
+	currentLocation, err := c.GetLocation()
+	if err != nil {
+		return
+	}
+
+	c.subscribers.Range(func(key string, ch chan Location) bool {
+		select {
+		case ch <- currentLocation:
+		default:
+			log.Warn("GeoClue: subscriber channel full, dropping update")
+		}
+		return true
+	})
+}
+
+func (c *GeoClueClient) SeedLocation(loc Location) {
+	c.locationMutex.Lock()
+	defer c.locationMutex.Unlock()
+	c.currLocation.Latitude = loc.Latitude
+	c.currLocation.Longitude = loc.Longitude
+}
+
+func (c *GeoClueClient) GetLocation() (Location, error) {
+	c.locationMutex.RLock()
+	defer c.locationMutex.RUnlock()
+	if c.currLocation == nil {
+		return Location{
+			Latitude:  0.0,
+			Longitude: 0.0,
+		}, nil
+	}
+	stateCopy := *c.currLocation
+	return stateCopy, nil
+}

core/internal/geolocation/client_ip.go

@@ -0,0 +1,91 @@
+package geolocation
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+)
+
+type IpClient struct {
+	currLocation *Location
+}
+
+type ipLocationResult struct {
+	Location
+	City string
+}
+
+type ipAPIResponse struct {
+	Status string  `json:"status"`
+	Lat    float64 `json:"lat"`
+	Lon    float64 `json:"lon"`
+	City   string  `json:"city"`
+}
+
+func newIpClient() *IpClient {
+	return &IpClient{
+		currLocation: &Location{},
+	}
+}
+
+func (c *IpClient) Subscribe(id string) chan Location {
+	ch := make(chan Location, 1)
+	if location, err := c.GetLocation(); err == nil {
+		ch <- location
+	}
+	return ch
+}
+
+func (c *IpClient) Unsubscribe(id string) {}
+
+func (c *IpClient) Close() {}
+
+func (c *IpClient) GetLocation() (Location, error) {
+	if c.currLocation.Latitude != 0 || c.currLocation.Longitude != 0 {
+		return *c.currLocation, nil
+	}
+
+	result, err := fetchIPLocation()
+	if err != nil {
+		return Location{}, err
+	}
+
+	c.currLocation.Latitude = result.Latitude
+	c.currLocation.Longitude = result.Longitude
+	return *c.currLocation, nil
+}
+
+func fetchIPLocation() (ipLocationResult, error) {
+	client := &http.Client{Timeout: 10 * time.Second}
+
+	resp, err := client.Get("http://ip-api.com/json/")
+	if err != nil {
+		return ipLocationResult{}, fmt.Errorf("failed to fetch IP location: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return ipLocationResult{}, fmt.Errorf("ip-api.com returned status %d", resp.StatusCode)
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return ipLocationResult{}, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var data ipAPIResponse
+	if err := json.Unmarshal(body, &data); err != nil {
+		return ipLocationResult{}, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	if data.Status == "fail" || (data.Lat == 0 && data.Lon == 0) {
+		return ipLocationResult{}, fmt.Errorf("ip-api.com returned no location data")
+	}
+
+	return ipLocationResult{
+		Location: Location{Latitude: data.Lat, Longitude: data.Lon},
+		City:     data.City,
+	}, nil
+}

core/internal/geolocation/types.go

@@ -0,0 +1,15 @@
+package geolocation
+
+type Location struct {
+	Latitude  float64
+	Longitude float64
+}
+
+type Client interface {
+	GetLocation() (Location, error)
+
+	Subscribe(id string) chan Location
+	Unsubscribe(id string)
+
+	Close()
+}

core/internal/greeter/assets/apparmor/usr.bin.dms-greeter

@@ -0,0 +1,91 @@
+# AppArmor profile for dms-greeter
+#
+# Managed by DMS — regenerated on every `dms greeter install` / `dms greeter sync`.
+# Manual edits will be overwritten on next sync.
+#
+# Mode: complain  (denials are logged, nothing is blocked)
+# To switch to enforce after validating with `aa-logprof`:
+#   sudo aa-enforce /etc/apparmor.d/usr.bin.dms-greeter
+#
+#include <tunables/global>
+
+profile dms-greeter /usr/bin/dms-greeter flags=(complain) {
+  #include <abstractions/base>
+  #include <abstractions/bash>
+
+  # The launcher script itself
+  /usr/bin/dms-greeter r,
+
+  # Cache directory — created by dms greeter sync/enable with greeter:greeter ownership
+  /var/cache/dms-greeter/     rw,
+  /var/cache/dms-greeter/**   rwlk,
+
+  # DMS config — packaged path
+  /usr/share/quickshell/dms-greeter/    r,
+  /usr/share/quickshell/dms-greeter/**  r,
+  /usr/share/quickshell/               r,
+  /usr/share/quickshell/**             r,
+
+  # DMS config — system and user overrides
+  /etc/dms/    r,
+  /etc/dms/**  r,
+  /usr/share/dms/    r,
+  /usr/share/dms/**  r,
+  /home/*/.config/quickshell/    r,
+  /home/*/.config/quickshell/**  r,
+  /root/.config/quickshell/     r,
+  /root/.config/quickshell/**   r,
+
+  # greetd / PAM — read-only for session setup
+  /etc/greetd/    r,
+  /etc/greetd/**  r,
+  /etc/pam.d/     r,
+  /etc/pam.d/**   r,
+  /usr/lib/pam.d/ r,
+  /usr/lib/pam.d/** r,
+
+  # Compositor binaries — run unconfined so each compositor uses its own profile
+  /usr/bin/niri        Ux,
+  /usr/bin/hyprland    Ux,
+  /usr/bin/Hyprland    Ux,
+  /usr/bin/sway        Ux,
+  /usr/bin/labwc       Ux,
+  /usr/bin/scroll      Ux,
+  /usr/bin/miracle-wm  Ux,
+  /usr/bin/mango       Ux,
+
+  # Quickshell — run unconfined (has its own compositor profile on some distros)
+  /usr/bin/qs          Ux,
+  /usr/bin/quickshell  Ux,
+
+  # Wayland / XDG runtime (pipewire, wireplumber, wayland socket)
+  /run/user/[0-9]*/               rw,
+  /run/user/[0-9]*/**             rw,
+
+  # DRM / GPU devices (required for Wayland compositor startup)
+  /dev/dri/      r,
+  /dev/dri/*     rw,
+  /dev/udmabuf   rw,
+
+  # Input devices
+  /dev/input/    r,
+  /dev/input/*   r,
+
+  # Systemd journal / logging
+  /run/systemd/journal/socket  rw,
+  /dev/log                     rw,
+
+  # Shell helper binaries invoked by the launcher script
+  /usr/bin/env      ix,
+  /usr/bin/mkdir    ix,
+  /usr/bin/cat      ix,
+  /usr/bin/grep     ix,
+  /usr/bin/dirname  ix,
+  /usr/bin/basename ix,
+  /usr/bin/command  ix,
+  /bin/env          ix,
+  /bin/mkdir        ix,
+
+  # Signal management (compositor lifecycle)
+  signal (send, receive) set=("term", "int", "hup", "kill"),
+}

core/internal/greeter/installer_test.go

@@ -0,0 +1,98 @@
+package greeter
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeTestFile(t *testing.T, path string, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("failed to create parent dir for %s: %v", path, err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("failed to write %s: %v", path, err)
+	}
+}
+
+func TestResolveGreeterThemeSyncState(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name                    string
+		settingsJSON            string
+		sessionJSON             string
+		wantSourcePath          string
+		wantResolvedWallpaper   string
+		wantDynamicOverrideUsed bool
+	}{
+		{
+			name: "dynamic theme with greeter wallpaper override uses generated greeter colors",
+			settingsJSON: `{
+  "currentThemeName": "dynamic",
+  "greeterWallpaperPath": "Pictures/blue.jpg",
+  "matugenScheme": "scheme-tonal-spot",
+  "iconTheme": "Papirus"
+}`,
+			sessionJSON:             `{"isLightMode":true}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "greeter-colors", "dms-colors.json"),
+			wantResolvedWallpaper:   filepath.Join("Pictures", "blue.jpg"),
+			wantDynamicOverrideUsed: true,
+		},
+		{
+			name: "dynamic theme without override uses desktop colors",
+			settingsJSON: `{
+  "currentThemeName": "dynamic",
+  "greeterWallpaperPath": ""
+}`,
+			sessionJSON:             `{"isLightMode":false}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "dms-colors.json"),
+			wantResolvedWallpaper:   "",
+			wantDynamicOverrideUsed: false,
+		},
+		{
+			name: "non-dynamic theme keeps desktop colors even with override wallpaper",
+			settingsJSON: `{
+  "currentThemeName": "purple",
+  "greeterWallpaperPath": "/tmp/blue.jpg"
+}`,
+			sessionJSON:             `{"isLightMode":false}`,
+			wantSourcePath:          filepath.Join(".cache", "DankMaterialShell", "dms-colors.json"),
+			wantResolvedWallpaper:   "/tmp/blue.jpg",
+			wantDynamicOverrideUsed: false,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			homeDir := t.TempDir()
+			writeTestFile(t, filepath.Join(homeDir, ".config", "DankMaterialShell", "settings.json"), tt.settingsJSON)
+			writeTestFile(t, filepath.Join(homeDir, ".local", "state", "DankMaterialShell", "session.json"), tt.sessionJSON)
+
+			state, err := resolveGreeterThemeSyncState(homeDir)
+			if err != nil {
+				t.Fatalf("resolveGreeterThemeSyncState returned error: %v", err)
+			}
+
+			if got := state.effectiveColorsSource(homeDir); got != filepath.Join(homeDir, tt.wantSourcePath) {
+				t.Fatalf("effectiveColorsSource = %q, want %q", got, filepath.Join(homeDir, tt.wantSourcePath))
+			}
+
+			wantResolvedWallpaper := tt.wantResolvedWallpaper
+			if wantResolvedWallpaper != "" && !filepath.IsAbs(wantResolvedWallpaper) {
+				wantResolvedWallpaper = filepath.Join(homeDir, wantResolvedWallpaper)
+			}
+			if state.ResolvedGreeterWallpaperPath != wantResolvedWallpaper {
+				t.Fatalf("ResolvedGreeterWallpaperPath = %q, want %q", state.ResolvedGreeterWallpaperPath, wantResolvedWallpaper)
+			}
+
+			if state.UsesDynamicWallpaperOverride != tt.wantDynamicOverrideUsed {
+				t.Fatalf("UsesDynamicWallpaperOverride = %v, want %v", state.UsesDynamicWallpaperOverride, tt.wantDynamicOverrideUsed)
+			}
+		})
+	}
+}

core/internal/headless/runner.go

@@ -0,0 +1,439 @@
+package headless
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/config"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/greeter"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
+)
+
+// ErrConfirmationRequired is returned when --yes is not set and the user
+// must explicitly confirm the operation.
+var ErrConfirmationRequired = fmt.Errorf("confirmation required: pass --yes to proceed")
+
+// validConfigNames maps lowercase CLI input to the deployer key used in
+// replaceConfigs. Keep in sync with the config types checked by
+// shouldReplaceConfig in deployer.go.
+var validConfigNames = map[string]string{
+	"niri":      "Niri",
+	"hyprland":  "Hyprland",
+	"ghostty":   "Ghostty",
+	"kitty":     "Kitty",
+	"alacritty": "Alacritty",
+}
+
+// orderedConfigNames defines the canonical order for config names in output.
+// Must be kept in sync with validConfigNames.
+var orderedConfigNames = []string{"niri", "hyprland", "ghostty", "kitty", "alacritty"}
+
+// Config holds all CLI parameters for unattended installation.
+type Config struct {
+	Compositor        string // "niri" or "hyprland"
+	Terminal          string // "ghostty", "kitty", or "alacritty"
+	IncludeDeps       []string
+	ExcludeDeps       []string
+	ReplaceConfigs    []string // specific configs to deploy (e.g. "niri", "ghostty")
+	ReplaceConfigsAll bool     // deploy/replace all configurations
+	Yes               bool
+}
+
+// Runner orchestrates unattended (headless) installation.
+type Runner struct {
+	cfg     Config
+	logChan chan string
+}
+
+// NewRunner creates a new headless runner.
+func NewRunner(cfg Config) *Runner {
+	return &Runner{
+		cfg:     cfg,
+		logChan: make(chan string, 1000),
+	}
+}
+
+// GetLogChan returns the log channel for file logging.
+func (r *Runner) GetLogChan() <-chan string {
+	return r.logChan
+}
+
+// Run executes the full unattended installation flow.
+func (r *Runner) Run() error {
+	r.log("Starting headless installation")
+
+	// 1. Parse compositor and terminal selections
+	wm, err := r.parseWindowManager()
+	if err != nil {
+		return err
+	}
+
+	terminal, err := r.parseTerminal()
+	if err != nil {
+		return err
+	}
+
+	// 2. Build replace-configs map
+	replaceConfigs, err := r.buildReplaceConfigs()
+	if err != nil {
+		return err
+	}
+
+	// 3. Detect OS
+	r.log("Detecting operating system...")
+	osInfo, err := distros.GetOSInfo()
+	if err != nil {
+		return fmt.Errorf("OS detection failed: %w", err)
+	}
+
+	if distros.IsUnsupportedDistro(osInfo.Distribution.ID, osInfo.VersionID) {
+		return fmt.Errorf("unsupported distribution: %s %s", osInfo.PrettyName, osInfo.VersionID)
+	}
+
+	fmt.Fprintf(os.Stdout, "Detected: %s (%s)\n", osInfo.PrettyName, osInfo.Architecture)
+
+	// 4. Create distribution instance
+	distro, err := distros.NewDistribution(osInfo.Distribution.ID, r.logChan)
+	if err != nil {
+		return fmt.Errorf("failed to initialize distribution: %w", err)
+	}
+
+	// 5. Detect dependencies
+	r.log("Detecting dependencies...")
+	fmt.Fprintln(os.Stdout, "Detecting dependencies...")
+	dependencies, err := distro.DetectDependenciesWithTerminal(context.Background(), wm, terminal)
+	if err != nil {
+		return fmt.Errorf("dependency detection failed: %w", err)
+	}
+
+	// 5. Apply include/exclude filters and build the disabled-items map.
+	// Headless mode does not currently collect any explicit reinstall selections,
+	// so keep reinstallItems nil instead of constructing an always-empty map.
+	disabledItems, err := r.buildDisabledItems(dependencies)
+	if err != nil {
+		return err
+	}
+	var reinstallItems map[string]bool
+
+	// Print dependency summary
+	fmt.Fprintln(os.Stdout, "\nDependencies:")
+	for _, dep := range dependencies {
+		marker := "  "
+		status := ""
+		if disabledItems[dep.Name] {
+			marker = "  SKIP "
+			status = "(disabled)"
+		} else {
+			switch dep.Status {
+			case deps.StatusInstalled:
+				marker = "  OK   "
+				status = "(installed)"
+			case deps.StatusMissing:
+				marker = "  NEW  "
+				status = "(will install)"
+			case deps.StatusNeedsUpdate:
+				marker = "  UPD  "
+				status = "(will update)"
+			case deps.StatusNeedsReinstall:
+				marker = "  RE   "
+				status = "(will reinstall)"
+			}
+		}
+		fmt.Fprintf(os.Stdout, "%s%-30s %s\n", marker, dep.Name, status)
+	}
+	fmt.Fprintln(os.Stdout)
+
+	// 6b. Require explicit confirmation unless --yes is set
+	if !r.cfg.Yes {
+		if replaceConfigs == nil {
+			// --replace-configs-all
+			fmt.Fprintln(os.Stdout, "Packages will be installed and all configurations will be replaced.")
+			fmt.Fprintln(os.Stdout, "Existing config files will be backed up before replacement.")
+		} else if r.anyConfigEnabled(replaceConfigs) {
+			var names []string
+			for _, cliName := range orderedConfigNames {
+				deployerKey := validConfigNames[cliName]
+				if replaceConfigs[deployerKey] {
+					names = append(names, deployerKey)
+				}
+			}
+			fmt.Fprintf(os.Stdout, "Packages will be installed. The following configurations will be replaced (with backups): %s\n", strings.Join(names, ", "))
+		} else {
+			fmt.Fprintln(os.Stdout, "Packages will be installed. No configurations will be deployed.")
+		}
+		fmt.Fprintln(os.Stdout, "Re-run with --yes (-y) to proceed.")
+		r.log("Aborted: --yes not set")
+		return ErrConfirmationRequired
+	}
+
+	// 7. Authenticate sudo
+	sudoPassword, err := r.resolveSudoPassword()
+	if err != nil {
+		return err
+	}
+
+	// 8. Install packages
+	fmt.Fprintln(os.Stdout, "Installing packages...")
+	r.log("Starting package installation")
+
+	progressChan := make(chan distros.InstallProgressMsg, 100)
+
+	installErr := make(chan error, 1)
+	go func() {
+		defer close(progressChan)
+		installErr <- distro.InstallPackages(
+			context.Background(),
+			dependencies,
+			wm,
+			sudoPassword,
+			reinstallItems,
+			disabledItems,
+			false, // skipGlobalUseFlags
+			progressChan,
+		)
+	}()
+
+	// Consume progress messages and print them
+	for msg := range progressChan {
+		if msg.Error != nil {
+			fmt.Fprintf(os.Stderr, "Error: %v\n", msg.Error)
+		} else if msg.Step != "" {
+			fmt.Fprintf(os.Stdout, "  [%3.0f%%] %s\n", msg.Progress*100, msg.Step)
+		}
+		if msg.LogOutput != "" {
+			r.log(msg.LogOutput)
+			fmt.Fprintf(os.Stdout, "    %s\n", msg.LogOutput)
+		}
+	}
+
+	if err := <-installErr; err != nil {
+		return fmt.Errorf("package installation failed: %w", err)
+	}
+
+	// 9. Greeter setup (if dms-greeter was included)
+	if !disabledItems["dms-greeter"] && r.depExists(dependencies, "dms-greeter") {
+		compositorName := "niri"
+		if wm == deps.WindowManagerHyprland {
+			compositorName = "Hyprland"
+		}
+		fmt.Fprintln(os.Stdout, "Configuring DMS greeter...")
+		logFunc := func(line string) {
+			r.log(line)
+			fmt.Fprintf(os.Stdout, "  greeter: %s\n", line)
+		}
+		if err := greeter.AutoSetupGreeter(compositorName, sudoPassword, logFunc); err != nil {
+			// Non-fatal, matching TUI behavior
+			fmt.Fprintf(os.Stderr, "Warning: greeter setup issue (non-fatal): %v\n", err)
+		}
+	}
+
+	// 10. Deploy configurations
+	fmt.Fprintln(os.Stdout, "Deploying configurations...")
+	r.log("Starting configuration deployment")
+
+	deployer := config.NewConfigDeployer(r.logChan)
+	results, err := deployer.DeployConfigurationsSelectiveWithReinstalls(
+		context.Background(),
+		wm,
+		terminal,
+		dependencies,
+		replaceConfigs,
+		reinstallItems,
+	)
+	if err != nil {
+		return fmt.Errorf("configuration deployment failed: %w", err)
+	}
+
+	for _, result := range results {
+		if result.Deployed {
+			msg := fmt.Sprintf("  Deployed: %s", result.ConfigType)
+			if result.BackupPath != "" {
+				msg += fmt.Sprintf(" (backup: %s)", result.BackupPath)
+			}
+			fmt.Fprintln(os.Stdout, msg)
+		}
+		if result.Error != nil {
+			fmt.Fprintf(os.Stderr, "  Error deploying %s: %v\n", result.ConfigType, result.Error)
+		}
+	}
+
+	fmt.Fprintln(os.Stdout, "\nInstallation complete!")
+	r.log("Headless installation completed successfully")
+	return nil
+}
+
+// buildDisabledItems computes the set of dependencies that should be skipped
+// during installation, applying the --include-deps and --exclude-deps filters.
+// dms-greeter is disabled by default (opt-in), matching TUI behavior.
+func (r *Runner) buildDisabledItems(dependencies []deps.Dependency) (map[string]bool, error) {
+	disabledItems := make(map[string]bool)
+
+	// dms-greeter is opt-in (disabled by default), matching TUI behavior
+	for i := range dependencies {
+		if dependencies[i].Name == "dms-greeter" {
+			disabledItems["dms-greeter"] = true
+			break
+		}
+	}
+
+	// Process --include-deps (enable items that are disabled by default)
+	for _, name := range r.cfg.IncludeDeps {
+		name = strings.TrimSpace(name)
+		if name == "" {
+			continue
+		}
+		if !r.depExists(dependencies, name) {
+			return nil, fmt.Errorf("--include-deps: unknown dependency %q", name)
+		}
+		delete(disabledItems, name)
+	}
+
+	// Process --exclude-deps (disable items)
+	for _, name := range r.cfg.ExcludeDeps {
+		name = strings.TrimSpace(name)
+		if name == "" {
+			continue
+		}
+		if !r.depExists(dependencies, name) {
+			return nil, fmt.Errorf("--exclude-deps: unknown dependency %q", name)
+		}
+		// Don't allow excluding DMS itself
+		if name == "dms (DankMaterialShell)" {
+			return nil, fmt.Errorf("--exclude-deps: cannot exclude required package %q", name)
+		}
+		disabledItems[name] = true
+	}
+
+	return disabledItems, nil
+}
+
+// buildReplaceConfigs converts the --replace-configs / --replace-configs-all
+// flags into the map[string]bool consumed by the config deployer.
+//
+// Returns:
+//   - nil when --replace-configs-all is set (deployer treats nil as "replace all")
+//   - a map with all known configs set to false when neither flag is set (deploy only if config file is missing on disk)
+//   - a map with requested configs true, all others false for --replace-configs
+//   - an error when both flags are set or an invalid config name is given
+func (r *Runner) buildReplaceConfigs() (map[string]bool, error) {
+	hasSpecific := len(r.cfg.ReplaceConfigs) > 0
+	if hasSpecific && r.cfg.ReplaceConfigsAll {
+		return nil, fmt.Errorf("--replace-configs and --replace-configs-all are mutually exclusive")
+	}
+
+	if r.cfg.ReplaceConfigsAll {
+		return nil, nil
+	}
+
+	// Build a map with all known configs explicitly set to false
+	result := make(map[string]bool, len(validConfigNames))
+	for _, cliName := range orderedConfigNames {
+		result[validConfigNames[cliName]] = false
+	}
+
+	// Enable only the requested configs
+	for _, name := range r.cfg.ReplaceConfigs {
+		name = strings.TrimSpace(name)
+		if name == "" {
+			continue
+		}
+		deployerKey, ok := validConfigNames[strings.ToLower(name)]
+		if !ok {
+			return nil, fmt.Errorf("--replace-configs: unknown config %q; valid values: niri, hyprland, ghostty, kitty, alacritty", name)
+		}
+		result[deployerKey] = true
+	}
+
+	return result, nil
+}
+
+func (r *Runner) log(message string) {
+	select {
+	case r.logChan <- message:
+	default:
+	}
+}
+
+func (r *Runner) parseWindowManager() (deps.WindowManager, error) {
+	switch strings.ToLower(r.cfg.Compositor) {
+	case "niri":
+		return deps.WindowManagerNiri, nil
+	case "hyprland":
+		return deps.WindowManagerHyprland, nil
+	default:
+		return 0, fmt.Errorf("invalid --compositor value %q: must be 'niri' or 'hyprland'", r.cfg.Compositor)
+	}
+}
+
+func (r *Runner) parseTerminal() (deps.Terminal, error) {
+	switch strings.ToLower(r.cfg.Terminal) {
+	case "ghostty":
+		return deps.TerminalGhostty, nil
+	case "kitty":
+		return deps.TerminalKitty, nil
+	case "alacritty":
+		return deps.TerminalAlacritty, nil
+	default:
+		return 0, fmt.Errorf("invalid --term value %q: must be 'ghostty', 'kitty', or 'alacritty'", r.cfg.Terminal)
+	}
+}
+
+func (r *Runner) resolveSudoPassword() (string, error) {
+	tool, err := privesc.Detect()
+	if err != nil {
+		return "", err
+	}
+
+	if err := privesc.CheckCached(context.Background()); err == nil {
+		r.log(fmt.Sprintf("%s cache is valid, no password needed", tool.Name()))
+		fmt.Fprintf(os.Stdout, "%s: using cached credentials\n", tool.Name())
+		return "", nil
+	}
+
+	switch tool {
+	case privesc.ToolSudo:
+		return "", fmt.Errorf(
+			"sudo authentication required but no cached credentials found\n" +
+				"Options:\n" +
+				"  1. Run 'sudo -v' before dankinstall to cache credentials\n" +
+				"  2. Configure passwordless sudo for your user",
+		)
+	case privesc.ToolDoas:
+		return "", fmt.Errorf(
+			"doas authentication required but no cached credentials found\n" +
+				"Options:\n" +
+				"  1. Run 'doas true' before dankinstall to cache credentials (requires 'persist' in /etc/doas.conf)\n" +
+				"  2. Configure a 'nopass' rule in /etc/doas.conf for your user",
+		)
+	case privesc.ToolRun0:
+		return "", fmt.Errorf(
+			"run0 authentication required but no cached credentials found\n" +
+				"Configure a polkit rule granting your user passwordless privilege\n" +
+				"(see `man polkit` for details on rules in /etc/polkit-1/rules.d/)",
+		)
+	default:
+		return "", fmt.Errorf("unsupported privilege tool: %s", tool)
+	}
+}
+
+func (r *Runner) anyConfigEnabled(m map[string]bool) bool {
+	for _, v := range m {
+		if v {
+			return true
+		}
+	}
+	return false
+}
+
+func (r *Runner) depExists(dependencies []deps.Dependency, name string) bool {
+	for _, dep := range dependencies {
+		if dep.Name == name {
+			return true
+		}
+	}
+	return false
+}

core/internal/headless/runner_test.go

@@ -0,0 +1,459 @@
+package headless
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/deps"
+)
+
+func TestParseWindowManager(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    deps.WindowManager
+		wantErr bool
+	}{
+		{"niri lowercase", "niri", deps.WindowManagerNiri, false},
+		{"niri mixed case", "Niri", deps.WindowManagerNiri, false},
+		{"hyprland lowercase", "hyprland", deps.WindowManagerHyprland, false},
+		{"hyprland mixed case", "Hyprland", deps.WindowManagerHyprland, false},
+		{"invalid", "sway", 0, true},
+		{"empty", "", 0, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := NewRunner(Config{Compositor: tt.input})
+			got, err := r.parseWindowManager()
+			if (err != nil) != tt.wantErr {
+				t.Errorf("parseWindowManager() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !tt.wantErr && got != tt.want {
+				t.Errorf("parseWindowManager() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestParseTerminal(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    deps.Terminal
+		wantErr bool
+	}{
+		{"ghostty lowercase", "ghostty", deps.TerminalGhostty, false},
+		{"ghostty mixed case", "Ghostty", deps.TerminalGhostty, false},
+		{"kitty lowercase", "kitty", deps.TerminalKitty, false},
+		{"alacritty lowercase", "alacritty", deps.TerminalAlacritty, false},
+		{"alacritty uppercase", "ALACRITTY", deps.TerminalAlacritty, false},
+		{"invalid", "wezterm", 0, true},
+		{"empty", "", 0, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := NewRunner(Config{Terminal: tt.input})
+			got, err := r.parseTerminal()
+			if (err != nil) != tt.wantErr {
+				t.Errorf("parseTerminal() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !tt.wantErr && got != tt.want {
+				t.Errorf("parseTerminal() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestDepExists(t *testing.T) {
+	dependencies := []deps.Dependency{
+		{Name: "niri", Status: deps.StatusInstalled},
+		{Name: "ghostty", Status: deps.StatusMissing},
+		{Name: "dms (DankMaterialShell)", Status: deps.StatusInstalled},
+		{Name: "dms-greeter", Status: deps.StatusMissing},
+	}
+
+	tests := []struct {
+		name string
+		dep  string
+		want bool
+	}{
+		{"existing dep", "niri", true},
+		{"existing dep with special chars", "dms (DankMaterialShell)", true},
+		{"existing optional dep", "dms-greeter", true},
+		{"non-existing dep", "firefox", false},
+		{"empty name", "", false},
+	}
+
+	r := NewRunner(Config{})
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := r.depExists(dependencies, tt.dep); got != tt.want {
+				t.Errorf("depExists(%q) = %v, want %v", tt.dep, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestNewRunner(t *testing.T) {
+	cfg := Config{
+		Compositor:  "niri",
+		Terminal:    "ghostty",
+		IncludeDeps: []string{"dms-greeter"},
+		ExcludeDeps: []string{"some-pkg"},
+		Yes:         true,
+	}
+	r := NewRunner(cfg)
+
+	if r == nil {
+		t.Fatal("NewRunner returned nil")
+	}
+	if r.cfg.Compositor != "niri" {
+		t.Errorf("cfg.Compositor = %q, want %q", r.cfg.Compositor, "niri")
+	}
+	if r.cfg.Terminal != "ghostty" {
+		t.Errorf("cfg.Terminal = %q, want %q", r.cfg.Terminal, "ghostty")
+	}
+	if !r.cfg.Yes {
+		t.Error("cfg.Yes = false, want true")
+	}
+	if r.logChan == nil {
+		t.Error("logChan is nil")
+	}
+}
+
+func TestGetLogChan(t *testing.T) {
+	r := NewRunner(Config{})
+	ch := r.GetLogChan()
+	if ch == nil {
+		t.Fatal("GetLogChan returned nil")
+	}
+
+	// Verify the channel is readable by sending a message
+	go func() {
+		r.logChan <- "test message"
+	}()
+	msg := <-ch
+	if msg != "test message" {
+		t.Errorf("received %q, want %q", msg, "test message")
+	}
+}
+
+func TestLog(t *testing.T) {
+	r := NewRunner(Config{})
+
+	// log should not block even if channel is full
+	for i := 0; i < 1100; i++ {
+		r.log("message")
+	}
+	// If we reach here without hanging, the non-blocking send works
+}
+
+func TestRunRequiresYes(t *testing.T) {
+	// Verify that ErrConfirmationRequired is a distinct sentinel error
+	if ErrConfirmationRequired == nil {
+		t.Fatal("ErrConfirmationRequired should not be nil")
+	}
+	expected := "confirmation required: pass --yes to proceed"
+	if ErrConfirmationRequired.Error() != expected {
+		t.Errorf("ErrConfirmationRequired = %q, want %q", ErrConfirmationRequired.Error(), expected)
+	}
+}
+
+func TestConfigYesStoredCorrectly(t *testing.T) {
+	// Yes=false (default) should be stored
+	rNo := NewRunner(Config{Compositor: "niri", Terminal: "ghostty", Yes: false})
+	if rNo.cfg.Yes {
+		t.Error("cfg.Yes = true, want false")
+	}
+
+	// Yes=true should be stored
+	rYes := NewRunner(Config{Compositor: "niri", Terminal: "ghostty", Yes: true})
+	if !rYes.cfg.Yes {
+		t.Error("cfg.Yes = false, want true")
+	}
+}
+
+func TestValidConfigNamesCompleteness(t *testing.T) {
+	// orderedConfigNames and validConfigNames must stay in sync.
+	if len(orderedConfigNames) != len(validConfigNames) {
+		t.Fatalf("orderedConfigNames has %d entries but validConfigNames has %d",
+			len(orderedConfigNames), len(validConfigNames))
+	}
+
+	// Every entry in orderedConfigNames must exist in validConfigNames.
+	for _, name := range orderedConfigNames {
+		if _, ok := validConfigNames[name]; !ok {
+			t.Errorf("orderedConfigNames contains %q which is missing from validConfigNames", name)
+		}
+	}
+
+	// validConfigNames must have no extra keys not in orderedConfigNames.
+	ordered := make(map[string]bool, len(orderedConfigNames))
+	for _, name := range orderedConfigNames {
+		ordered[name] = true
+	}
+	for key := range validConfigNames {
+		if !ordered[key] {
+			t.Errorf("validConfigNames contains %q which is missing from orderedConfigNames", key)
+		}
+	}
+}
+
+func TestBuildReplaceConfigs(t *testing.T) {
+	allDeployerKeys := []string{"Niri", "Hyprland", "Ghostty", "Kitty", "Alacritty"}
+
+	tests := []struct {
+		name           string
+		replaceConfigs []string
+		replaceAll     bool
+		wantNil        bool     // expect nil (replace all)
+		wantEnabled    []string // deployer keys that should be true
+		wantErr        bool
+	}{
+		{
+			name:        "neither flag set",
+			wantNil:     false,
+			wantEnabled: nil, // all should be false
+		},
+		{
+			name:       "replace-configs-all",
+			replaceAll: true,
+			wantNil:    true,
+		},
+		{
+			name:           "specific configs",
+			replaceConfigs: []string{"niri", "ghostty"},
+			wantNil:        false,
+			wantEnabled:    []string{"Niri", "Ghostty"},
+		},
+		{
+			name:           "both flags set",
+			replaceConfigs: []string{"niri"},
+			replaceAll:     true,
+			wantErr:        true,
+		},
+		{
+			name:           "invalid config name",
+			replaceConfigs: []string{"foo"},
+			wantErr:        true,
+		},
+		{
+			name:           "case insensitive",
+			replaceConfigs: []string{"NIRI", "Ghostty"},
+			wantNil:        false,
+			wantEnabled:    []string{"Niri", "Ghostty"},
+		},
+		{
+			name:           "single config",
+			replaceConfigs: []string{"kitty"},
+			wantNil:        false,
+			wantEnabled:    []string{"Kitty"},
+		},
+		{
+			name:           "whitespace entry",
+			replaceConfigs: []string{"  ", "niri"},
+			wantNil:        false,
+			wantEnabled:    []string{"Niri"},
+		},
+		{
+			name:           "duplicate entry",
+			replaceConfigs: []string{"niri", "niri"},
+			wantNil:        false,
+			wantEnabled:    []string{"Niri"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := NewRunner(Config{
+				ReplaceConfigs:    tt.replaceConfigs,
+				ReplaceConfigsAll: tt.replaceAll,
+			})
+			got, err := r.buildReplaceConfigs()
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("buildReplaceConfigs() error = %v, wantErr %v", err, tt.wantErr)
+			}
+			if tt.wantErr {
+				return
+			}
+			if tt.wantNil {
+				if got != nil {
+					t.Fatalf("buildReplaceConfigs() = %v, want nil", got)
+				}
+				return
+			}
+			if got == nil {
+				t.Fatal("buildReplaceConfigs() = nil, want non-nil map")
+			}
+
+			// All known deployer keys must be present
+			for _, key := range allDeployerKeys {
+				if _, exists := got[key]; !exists {
+					t.Errorf("missing deployer key %q in result map", key)
+				}
+			}
+
+			// Build enabled set for easy lookup
+			enabledSet := make(map[string]bool)
+			for _, k := range tt.wantEnabled {
+				enabledSet[k] = true
+			}
+
+			for _, key := range allDeployerKeys {
+				want := enabledSet[key]
+				if got[key] != want {
+					t.Errorf("replaceConfigs[%q] = %v, want %v", key, got[key], want)
+				}
+			}
+		})
+	}
+}
+
+func TestConfigReplaceConfigsStoredCorrectly(t *testing.T) {
+	r := NewRunner(Config{
+		Compositor:        "niri",
+		Terminal:          "ghostty",
+		ReplaceConfigs:    []string{"niri", "ghostty"},
+		ReplaceConfigsAll: false,
+	})
+	if len(r.cfg.ReplaceConfigs) != 2 {
+		t.Errorf("len(ReplaceConfigs) = %d, want 2", len(r.cfg.ReplaceConfigs))
+	}
+	if r.cfg.ReplaceConfigsAll {
+		t.Error("ReplaceConfigsAll = true, want false")
+	}
+
+	r2 := NewRunner(Config{
+		Compositor:        "niri",
+		Terminal:          "ghostty",
+		ReplaceConfigsAll: true,
+	})
+	if !r2.cfg.ReplaceConfigsAll {
+		t.Error("ReplaceConfigsAll = false, want true")
+	}
+	if len(r2.cfg.ReplaceConfigs) != 0 {
+		t.Errorf("len(ReplaceConfigs) = %d, want 0", len(r2.cfg.ReplaceConfigs))
+	}
+}
+
+func TestBuildDisabledItems(t *testing.T) {
+	dependencies := []deps.Dependency{
+		{Name: "niri", Status: deps.StatusInstalled},
+		{Name: "ghostty", Status: deps.StatusMissing},
+		{Name: "dms (DankMaterialShell)", Status: deps.StatusInstalled},
+		{Name: "dms-greeter", Status: deps.StatusMissing},
+		{Name: "waybar", Status: deps.StatusMissing},
+	}
+
+	tests := []struct {
+		name         string
+		includeDeps  []string
+		excludeDeps  []string
+		deps         []deps.Dependency // nil means use the shared fixture
+		wantErr      bool
+		errContains  string   // substring expected in error message
+		wantDisabled []string // dep names that should be in disabledItems
+		wantEnabled  []string // dep names that should NOT be in disabledItems (extra check)
+	}{
+		{
+			name:         "no flags set, dms-greeter disabled by default",
+			wantDisabled: []string{"dms-greeter"},
+			wantEnabled:  []string{"niri", "ghostty", "waybar"},
+		},
+		{
+			name:        "include dms-greeter enables it",
+			includeDeps: []string{"dms-greeter"},
+			wantEnabled: []string{"dms-greeter"},
+		},
+		{
+			name:         "exclude a regular dep",
+			excludeDeps:  []string{"waybar"},
+			wantDisabled: []string{"dms-greeter", "waybar"},
+		},
+		{
+			name:        "include unknown dep returns error",
+			includeDeps: []string{"nonexistent"},
+			wantErr:     true,
+			errContains: "--include-deps",
+		},
+		{
+			name:        "exclude unknown dep returns error",
+			excludeDeps: []string{"nonexistent"},
+			wantErr:     true,
+			errContains: "--exclude-deps",
+		},
+		{
+			name:        "exclude DMS itself is forbidden",
+			excludeDeps: []string{"dms (DankMaterialShell)"},
+			wantErr:     true,
+			errContains: "cannot exclude required package",
+		},
+		{
+			name:         "include and exclude same dep",
+			includeDeps:  []string{"dms-greeter"},
+			excludeDeps:  []string{"dms-greeter"},
+			wantDisabled: []string{"dms-greeter"},
+		},
+		{
+			name:        "whitespace entries are skipped",
+			includeDeps: []string{"  ", "dms-greeter"},
+			wantEnabled: []string{"dms-greeter"},
+		},
+		{
+			name: "no dms-greeter in deps, nothing disabled by default",
+			deps: []deps.Dependency{
+				{Name: "niri", Status: deps.StatusInstalled},
+			},
+			wantEnabled: []string{"niri"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := NewRunner(Config{
+				IncludeDeps: tt.includeDeps,
+				ExcludeDeps: tt.excludeDeps,
+			})
+			d := tt.deps
+			if d == nil {
+				d = dependencies
+			}
+			got, err := r.buildDisabledItems(d)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("buildDisabledItems() error = %v, wantErr %v", err, tt.wantErr)
+			}
+			if tt.wantErr {
+				if tt.errContains != "" && !strings.Contains(err.Error(), tt.errContains) {
+					t.Errorf("error %q does not contain %q", err.Error(), tt.errContains)
+				}
+				return
+			}
+			if got == nil {
+				t.Fatal("buildDisabledItems() returned nil map, want non-nil")
+			}
+
+			// Check expected disabled items
+			for _, name := range tt.wantDisabled {
+				if !got[name] {
+					t.Errorf("expected %q to be disabled, but it is not", name)
+				}
+			}
+
+			// Check expected enabled items (should not be in the map or be false)
+			for _, name := range tt.wantEnabled {
+				if got[name] {
+					t.Errorf("expected %q to NOT be disabled, but it is", name)
+				}
+			}
+
+			// If wantDisabled is empty, the map should have length 0
+			if len(tt.wantDisabled) == 0 && len(got) != 0 {
+				t.Errorf("expected empty disabledItems map, got %v", got)
+			}
+		})
+	}
+}

core/internal/keybinds/providers/niri.go

@@ -10,7 +10,6 @@ import (
 	"strings"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/keybinds"
-	"github.com/sblinch/kdl-go"
 	"github.com/sblinch/kdl-go/document"
 )
 
@@ -292,7 +291,7 @@ func (n *NiriProvider) loadOverrideBinds() (map[string]*overrideBind, error) {
 	parser := NewNiriParser(filepath.Dir(overridePath))
 	parser.currentSource = overridePath
 
-	doc, err := kdl.Parse(strings.NewReader(string(data)))
+	doc, err := parseKDL(data)
 	if err != nil {
 		return nil, err
 	}
@@ -341,6 +340,8 @@ func (n *NiriProvider) buildActionFromNode(bindNode *document.Node) string {
 		val := arg.ValueString()
 		if val == "" {
 			parts = append(parts, `""`)
+		} else if strings.ContainsAny(val, " \t") {
+			parts = append(parts, `"`+strings.ReplaceAll(val, `"`, `\"`)+`"`)
 		} else {
 			parts = append(parts, val)
 		}

core/internal/keybinds/providers/niri_parser.go

@@ -50,6 +50,103 @@ type NiriParser struct {
 	conflictingConfigs map[string]*NiriKeyBinding
 }
 
+func parseKDL(data []byte) (*document.Document, error) {
+	return kdl.Parse(strings.NewReader(normalizeKDLBraces(string(data))))
+}
+
+func normalizeKDLBraces(input string) string {
+	var sb strings.Builder
+	sb.Grow(len(input))
+
+	var prev byte
+	n := len(input)
+	for i := 0; i < n; {
+		c := input[i]
+
+		switch {
+		case c == '"':
+			end := findStringEnd(input, i)
+			sb.WriteString(input[i:end])
+			prev = '"'
+			i = end
+		case c == '/' && i+1 < n && input[i+1] == '/':
+			end := findLineCommentEnd(input, i)
+			sb.WriteString(input[i:end])
+			prev = '\n'
+			i = end
+		case c == '/' && i+1 < n && input[i+1] == '*':
+			end := findBlockCommentEnd(input, i)
+			sb.WriteString(input[i:end])
+			prev = '/'
+			i = end
+		case c == '{' && prev != 0 && !isBraceAdjacentSpace(prev):
+			sb.WriteByte(' ')
+			sb.WriteByte(c)
+			prev = c
+			i++
+		default:
+			sb.WriteByte(c)
+			prev = c
+			i++
+		}
+	}
+
+	return sb.String()
+}
+
+func findStringEnd(s string, start int) int {
+	n := len(s)
+	for i := start + 1; i < n; {
+		switch s[i] {
+		case '\\':
+			i += 2
+		case '"':
+			return i + 1
+		default:
+			i++
+		}
+	}
+	return n
+}
+
+func findLineCommentEnd(s string, start int) int {
+	for i := start + 2; i < len(s); i++ {
+		if s[i] == '\n' {
+			return i
+		}
+	}
+	return len(s)
+}
+
+func findBlockCommentEnd(s string, start int) int {
+	n := len(s)
+	depth := 1
+	for i := start + 2; i < n && depth > 0; {
+		switch {
+		case i+1 < n && s[i] == '/' && s[i+1] == '*':
+			depth++
+			i += 2
+		case i+1 < n && s[i] == '*' && s[i+1] == '/':
+			depth--
+			i += 2
+			if depth == 0 {
+				return i
+			}
+		default:
+			i++
+		}
+	}
+	return n
+}
+
+func isBraceAdjacentSpace(b byte) bool {
+	switch b {
+	case ' ', '\t', '\n', '\r', '{':
+		return true
+	}
+	return false
+}
+
 func NewNiriParser(configDir string) *NiriParser {
 	return &NiriParser{
 		configDir:          configDir,
@@ -91,7 +188,7 @@ func (p *NiriParser) parseDMSBindsDirectly(dmsBindsPath string, section *NiriSec
 		return
 	}
 
-	doc, err := kdl.Parse(strings.NewReader(string(data)))
+	doc, err := parseKDL(data)
 	if err != nil {
 		return
 	}
@@ -159,7 +256,7 @@ func (p *NiriParser) parseFile(filePath, sectionName string) (*NiriSection, erro
 		return nil, fmt.Errorf("failed to read %s: %w", absPath, err)
 	}
 
-	doc, err := kdl.Parse(strings.NewReader(string(data)))
+	doc, err := parseKDL(data)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse KDL in %s: %w", absPath, err)
 	}

core/internal/keybinds/providers/niri_parser_test.go

@@ -3,9 +3,74 @@ package providers
 import (
 	"os"
 	"path/filepath"
+	"slices"
 	"testing"
 )
 
+func TestNiriParse_NoSpaceBeforeBrace(t *testing.T) {
+	config := `recent-windows {
+    binds {
+        Alt+Tab         { next-window scope="output"; }
+        Alt+Shift+Tab   { previous-window scope="output"; }
+        Alt+grave       { next-window filter="app-id"; }
+        Alt+Shift+grave { previous-window filter="app-id"; }
+        Alt+Escape      { next-window scope="all"; }
+        Alt+Shift+Escape{ previous-window scope="all"; }
+    }
+}
+`
+	tmpDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(tmpDir, "config.kdl"), []byte(config), 0o644); err != nil {
+		t.Fatalf("Failed to write test config: %v", err)
+	}
+
+	result, err := ParseNiriKeys(tmpDir)
+	if err != nil {
+		t.Fatalf("ParseNiriKeys failed on valid niri config: %v", err)
+	}
+
+	var found *NiriKeyBinding
+	for i := range result.Section.Keybinds {
+		kb := &result.Section.Keybinds[i]
+		if kb.Key == "Escape" && slices.Contains(kb.Mods, "Alt") && slices.Contains(kb.Mods, "Shift") {
+			found = kb
+			break
+		}
+	}
+	if found == nil {
+		t.Fatal("Alt+Shift+Escape bind missing — '{' without preceding space was not handled")
+	}
+	if found.Action != "previous-window" {
+		t.Errorf("Action = %q, want %q", found.Action, "previous-window")
+	}
+}
+
+func TestNormalizeKDLBraces(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		out  string
+	}{
+		{"already spaced", "node { child }\n", "node { child }\n"},
+		{"missing space", "node{ child }\n", "node { child }\n"},
+		{"niri keybind", "Alt+Shift+Escape{ previous-window; }", "Alt+Shift+Escape { previous-window; }"},
+		{"brace inside string", `node "a{b" { child }`, `node "a{b" { child }`},
+		{"brace in line comment", "// foo{bar\nnode { }", "// foo{bar\nnode { }"},
+		{"brace in block comment", "/* foo{bar */ node{ }", "/* foo{bar */ node { }"},
+		{"escaped quote in string", `node "a\"b{c" { }`, `node "a\"b{c" { }`},
+		{"leading brace", "{ child }", "{ child }"},
+		{"nested missing space", "a{b{ c }}", "a {b { c }}"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := normalizeKDLBraces(tc.in)
+			if got != tc.out {
+				t.Errorf("normalizeKDLBraces(%q) = %q, want %q", tc.in, got, tc.out)
+			}
+		})
+	}
+}
+
 func TestNiriParseKeyCombo(t *testing.T) {
 	tests := []struct {
 		combo        string

core/internal/log/filelogger.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"fmt"
 	"os"
+	"path/filepath"
 	"regexp"
 	"sync"
 	"time"
@@ -21,7 +22,16 @@ type FileLogger struct {
 
 func NewFileLogger() (*FileLogger, error) {
 	timestamp := time.Now().Unix()
-	logPath := fmt.Sprintf("/tmp/dankinstall-%d.log", timestamp)
+
+	// Use DANKINSTALL_LOG_DIR if set, otherwise fall back to /tmp.
+	logDir := os.Getenv("DANKINSTALL_LOG_DIR")
+	if logDir == "" {
+		logDir = "/tmp"
+	}
+	if err := os.MkdirAll(logDir, 0o755); err != nil {
+		return nil, fmt.Errorf("failed to create log directory: %w", err)
+	}
+	logPath := filepath.Join(logDir, fmt.Sprintf("dankinstall-%d.log", timestamp))
 
 	file, err := os.Create(logPath)
 	if err != nil {

core/internal/matugen/matugen.go

@@ -1,7 +1,9 @@
 package matugen
 
 import (
+	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"math"
 	"os"
@@ -19,6 +21,8 @@ import (
 	"github.com/lucasb-eyer/go-colorful"
 )
 
+var ErrNoChanges = errors.New("no color changes")
+
 type ColorMode string
 
 const (
@@ -33,6 +37,7 @@ const (
 	TemplateKindTerminal
 	TemplateKindGTK
 	TemplateKindVSCode
+	TemplateKindEmacs
 )
 
 type TemplateDef struct {
@@ -53,7 +58,7 @@ var templateRegistry = []TemplateDef{
 	{ID: "qt6ct", Commands: []string{"qt6ct"}, ConfigFile: "qt6ct.toml"},
 	{ID: "firefox", Commands: []string{"firefox"}, ConfigFile: "firefox.toml"},
 	{ID: "pywalfox", Commands: []string{"pywalfox"}, ConfigFile: "pywalfox.toml"},
-	{ID: "zenbrowser", Commands: []string{"zen", "zen-browser"}, Flatpaks: []string{"app.zen_browser.zen"}, ConfigFile: "zenbrowser.toml"},
+	{ID: "zenbrowser", Commands: []string{"zen", "zen-browser", "zen-beta", "zen-twilight"}, Flatpaks: []string{"app.zen_browser.zen"}, ConfigFile: "zenbrowser.toml"},
 	{ID: "vesktop", Commands: []string{"vesktop"}, Flatpaks: []string{"dev.vencord.Vesktop"}, ConfigFile: "vesktop.toml"},
 	{ID: "equibop", Commands: []string{"equibop"}, ConfigFile: "equibop.toml"},
 	{ID: "ghostty", Commands: []string{"ghostty"}, ConfigFile: "ghostty.toml", Kind: TemplateKindTerminal},
@@ -65,7 +70,8 @@ var templateRegistry = []TemplateDef{
 	{ID: "dgop", Commands: []string{"dgop"}, ConfigFile: "dgop.toml"},
 	{ID: "kcolorscheme", ConfigFile: "kcolorscheme.toml", RunUnconditionally: true},
 	{ID: "vscode", Kind: TemplateKindVSCode},
-	{ID: "emacs", Commands: []string{"emacs"}, ConfigFile: "emacs.toml"},
+	{ID: "emacs", Commands: []string{"emacs"}, ConfigFile: "emacs.toml", Kind: TemplateKindEmacs},
+	{ID: "zed", Commands: []string{"zed", "zeditor", "zedit"}, ConfigFile: "zed.toml"},
 }
 
 func (c *ColorMode) GTKTheme() string {
@@ -78,7 +84,8 @@ func (c *ColorMode) GTKTheme() string {
 }
 
 var (
-	matugenVersionOnce sync.Once
+	matugenVersionMu   sync.Mutex
+	matugenVersionOK   bool
 	matugenSupportsCOE bool
 	matugenIsV4        bool
 )
@@ -92,7 +99,9 @@ type Options struct {
 	Mode                ColorMode
 	IconTheme           string
 	MatugenType         string
+	Contrast            float64
 	RunUserTemplates    bool
+	ColorsOnly          bool
 	StockColors         string
 	SyncModeWithPortal  bool
 	TerminalsAlwaysDark bool
@@ -158,8 +167,14 @@ func Run(opts Options) error {
 
 	log.Infof("Building theme: %s %s (%s)", opts.Kind, opts.Value, opts.Mode)
 
-	if err := buildOnce(&opts); err != nil {
-		return err
+	changed, buildErr := buildOnce(&opts)
+	if buildErr != nil {
+		return buildErr
+	}
+
+	if !changed {
+		log.Info("No color changes detected, skipping refresh")
+		return ErrNoChanges
 	}
 
 	if opts.SyncModeWithPortal {
@@ -170,25 +185,27 @@ func Run(opts Options) error {
 	return nil
 }
 
-func buildOnce(opts *Options) error {
+func buildOnce(opts *Options) (bool, error) {
 	cfgFile, err := os.CreateTemp("", "matugen-config-*.toml")
 	if err != nil {
-		return fmt.Errorf("failed to create temp config: %w", err)
+		return false, fmt.Errorf("failed to create temp config: %w", err)
 	}
 	defer os.Remove(cfgFile.Name())
 	defer cfgFile.Close()
 
 	tmpDir, err := os.MkdirTemp("", "matugen-templates-*")
 	if err != nil {
-		return fmt.Errorf("failed to create temp dir: %w", err)
+		return false, fmt.Errorf("failed to create temp dir: %w", err)
 	}
 	defer os.RemoveAll(tmpDir)
 
 	if err := buildMergedConfig(opts, cfgFile, tmpDir); err != nil {
-		return fmt.Errorf("failed to build config: %w", err)
+		return false, fmt.Errorf("failed to build config: %w", err)
 	}
 	cfgFile.Close()
 
+	oldColors, _ := os.ReadFile(opts.ColorsOutput())
+
 	var primaryDark, primaryLight, surface string
 	var dank16JSON string
 	var importArgs []string
@@ -200,7 +217,7 @@ func buildOnce(opts *Options) error {
 		surface = extractNestedColor(opts.StockColors, "surface", "dark")
 
 		if primaryDark == "" {
-			return fmt.Errorf("failed to extract primary dark from stock colors")
+			return false, fmt.Errorf("failed to extract primary dark from stock colors")
 		}
 		if primaryLight == "" {
 			primaryLight = primaryDark
@@ -212,16 +229,17 @@ func buildOnce(opts *Options) error {
 
 		log.Info("Running matugen color hex with stock color overrides")
 		args := []string{"color", "hex", primaryDark, "-m", string(opts.Mode), "-t", opts.MatugenType, "-c", cfgFile.Name()}
+		args = appendContrastArg(args, opts.Contrast)
 		args = append(args, importArgs...)
 		if err := runMatugen(args); err != nil {
-			return err
+			return false, err
 		}
 	} else {
 		log.Infof("Using dynamic theme from %s: %s", opts.Kind, opts.Value)
 
 		matJSON, err := runMatugenDryRun(opts)
 		if err != nil {
-			return fmt.Errorf("matugen dry-run failed: %w", err)
+			return false, fmt.Errorf("matugen dry-run failed: %w", err)
 		}
 
 		primaryDark = extractMatugenColor(matJSON, "primary", "dark")
@@ -229,7 +247,7 @@ func buildOnce(opts *Options) error {
 		surface = extractMatugenColor(matJSON, "surface", "dark")
 
 		if primaryDark == "" {
-			return fmt.Errorf("failed to extract primary color")
+			return false, fmt.Errorf("failed to extract primary color")
 		}
 		if primaryLight == "" {
 			primaryLight = primaryDark
@@ -248,12 +266,22 @@ func buildOnce(opts *Options) error {
 			args = []string{opts.Kind, opts.Value}
 		}
 		args = append(args, "-m", string(opts.Mode), "-t", opts.MatugenType, "-c", cfgFile.Name())
+		args = appendContrastArg(args, opts.Contrast)
 		args = append(args, importArgs...)
 		if err := runMatugen(args); err != nil {
-			return err
+			return false, err
 		}
 	}
 
+	newColors, _ := os.ReadFile(opts.ColorsOutput())
+	if bytes.Equal(oldColors, newColors) && len(oldColors) > 0 {
+		return false, nil
+	}
+
+	if opts.ColorsOnly {
+		return true, nil
+	}
+
 	if isDMSGTKActive(opts.ConfigDir) {
 		switch opts.Mode {
 		case ColorModeLight:
@@ -271,7 +299,14 @@ func buildOnce(opts *Options) error {
 
 	signalTerminals(opts)
 
-	return nil
+	return true, nil
+}
+
+func appendContrastArg(args []string, contrast float64) []string {
+	if contrast == 0 {
+		return args
+	}
+	return append(args, "--contrast", strconv.FormatFloat(contrast, 'f', -1, 64))
 }
 
 func buildMergedConfig(opts *Options, cfgFile *os.File, tmpDir string) error {
@@ -311,6 +346,10 @@ output_path = '%s'
 
 `, opts.ShellDir, opts.ColorsOutput())
 
+	if opts.ColorsOnly {
+		return nil
+	}
+
 	homeDir, _ := os.UserHomeDir()
 	for _, tmpl := range templateRegistry {
 		if opts.ShouldSkipTemplate(tmpl.ID) {
@@ -334,6 +373,10 @@ output_path = '%s'
 			appendVSCodeConfig(cfgFile, "cursor", filepath.Join(homeDir, ".cursor/extensions"), opts.ShellDir)
 			appendVSCodeConfig(cfgFile, "windsurf", filepath.Join(homeDir, ".windsurf/extensions"), opts.ShellDir)
 			appendVSCodeConfig(cfgFile, "vscode-insiders", filepath.Join(homeDir, ".vscode-insiders/extensions"), opts.ShellDir)
+		case TemplateKindEmacs:
+			if utils.EmacsConfigDir() != "" {
+				appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
+			}
 		default:
 			appendConfig(opts, cfgFile, tmpl.Commands, tmpl.Flatpaks, tmpl.ConfigFile)
 		}
@@ -491,6 +534,9 @@ func substituteVars(content, shellDir string) string {
 	result = strings.ReplaceAll(result, "'CONFIG_DIR/", "'"+utils.XDGConfigHome()+"/")
 	result = strings.ReplaceAll(result, "'DATA_DIR/", "'"+utils.XDGDataHome()+"/")
 	result = strings.ReplaceAll(result, "'CACHE_DIR/", "'"+utils.XDGCacheHome()+"/")
+	if emacsDir := utils.EmacsConfigDir(); emacsDir != "" {
+		result = strings.ReplaceAll(result, "'EMACS_DIR/", "'"+emacsDir+"/")
+	}
 	return result
 }
 
@@ -511,79 +557,161 @@ func extractTOMLSection(content, startMarker, endMarker string) string {
 	return content[startIdx : startIdx+endIdx]
 }
 
-func checkMatugenVersion() {
-	matugenVersionOnce.Do(func() {
-		cmd := exec.Command("matugen", "--version")
-		output, err := cmd.Output()
-		if err != nil {
-			return
-		}
-
-		versionStr := strings.TrimSpace(string(output))
-		versionStr = strings.TrimPrefix(versionStr, "matugen ")
-
-		parts := strings.Split(versionStr, ".")
-		if len(parts) < 2 {
-			return
-		}
-
-		major, err := strconv.Atoi(parts[0])
-		if err != nil {
-			return
-		}
-
-		minor, err := strconv.Atoi(parts[1])
-		if err != nil {
-			return
-		}
-
-		matugenSupportsCOE = major > 3 || (major == 3 && minor >= 1)
-		matugenIsV4 = major >= 4
-		if matugenSupportsCOE {
-			log.Infof("Matugen %s supports --continue-on-error", versionStr)
-		}
-		if matugenIsV4 {
-			log.Infof("Matugen %s: using v4 flags", versionStr)
-		}
-	})
+type matugenFlags struct {
+	supportsCOE bool
+	isV4        bool
 }
 
-func runMatugen(args []string) error {
-	checkMatugenVersion()
+func detectMatugenVersion() (matugenFlags, error) {
+	matugenVersionMu.Lock()
+	defer matugenVersionMu.Unlock()
+
+	if matugenVersionOK {
+		return matugenFlags{matugenSupportsCOE, matugenIsV4}, nil
+	}
+
+	return detectMatugenVersionLocked()
+}
+
+func redetectMatugenVersion(old matugenFlags) (matugenFlags, bool) {
+	matugenVersionMu.Lock()
+	defer matugenVersionMu.Unlock()
+
+	matugenVersionOK = false
+	flags, err := detectMatugenVersionLocked()
+	if err != nil {
+		return old, false
+	}
+	changed := flags.supportsCOE != old.supportsCOE || flags.isV4 != old.isV4
+	return flags, changed
+}
+
+func detectMatugenVersionLocked() (matugenFlags, error) {
+	cmd := exec.Command("matugen", "--version")
+	output, err := cmd.Output()
+	if err != nil {
+		return matugenFlags{}, fmt.Errorf("failed to get matugen version: %w", err)
+	}
+
+	versionStr := strings.TrimSpace(string(output))
+	versionStr = strings.TrimPrefix(versionStr, "matugen ")
+
+	parts := strings.Split(versionStr, ".")
+	if len(parts) < 2 {
+		return matugenFlags{}, fmt.Errorf("unexpected matugen version format: %q", versionStr)
+	}
+
+	major, err := strconv.Atoi(parts[0])
+	if err != nil {
+		return matugenFlags{}, fmt.Errorf("failed to parse matugen major version %q: %w", parts[0], err)
+	}
+
+	minor, err := strconv.Atoi(parts[1])
+	if err != nil {
+		return matugenFlags{}, fmt.Errorf("failed to parse matugen minor version %q: %w", parts[1], err)
+	}
+
+	matugenSupportsCOE = major > 3 || (major == 3 && minor >= 1)
+	matugenIsV4 = major >= 4
+	matugenVersionOK = true
 
 	if matugenSupportsCOE {
-		args = append([]string{"--continue-on-error"}, args...)
+		log.Debugf("Matugen %s detected: continue-on-error support enabled", versionStr)
 	}
 	if matugenIsV4 {
+		log.Debugf("Matugen %s detected: using v4 compatibility flags", versionStr)
+	}
+	return matugenFlags{matugenSupportsCOE, matugenIsV4}, nil
+}
+
+func buildMatugenArgs(baseArgs []string, flags matugenFlags) []string {
+	args := make([]string, 0, len(baseArgs)+4)
+	if flags.supportsCOE {
+		args = append(args, "--continue-on-error")
+	}
+	args = append(args, baseArgs...)
+	if flags.isV4 {
 		args = append(args, "--source-color-index", "0")
 	}
+	return args
+}
 
+func runMatugen(baseArgs []string) error {
+	flags, err := detectMatugenVersion()
+	if err != nil {
+		return err
+	}
+
+	args := buildMatugenArgs(baseArgs, flags)
 	cmd := exec.Command("matugen", args...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
-	return cmd.Run()
+	runErr := cmd.Run()
+	if runErr == nil {
+		return nil
+	}
+
+	log.Warnf("Matugen failed (v4=%v): %v", flags.isV4, runErr)
+
+	newFlags, changed := redetectMatugenVersion(flags)
+	if !changed {
+		return runErr
+	}
+
+	log.Warnf("Matugen version changed (v4: %v -> %v), retrying", flags.isV4, newFlags.isV4)
+	args = buildMatugenArgs(baseArgs, newFlags)
+	retryCmd := exec.Command("matugen", args...)
+	retryCmd.Stdout = os.Stdout
+	retryCmd.Stderr = os.Stderr
+	return retryCmd.Run()
 }
 
 func runMatugenDryRun(opts *Options) (string, error) {
-	checkMatugenVersion()
-
-	var args []string
-	switch opts.Kind {
-	case "hex":
-		args = []string{"color", "hex", opts.Value}
-	default:
-		args = []string{opts.Kind, opts.Value}
-	}
-	args = append(args, "-m", "dark", "-t", opts.MatugenType, "--json", "hex", "--dry-run")
-	if matugenIsV4 {
-		args = append(args, "--source-color-index", "0", "--old-json-output")
-	}
-
-	cmd := exec.Command("matugen", args...)
-	output, err := cmd.Output()
+	flags, err := detectMatugenVersion()
 	if err != nil {
 		return "", err
 	}
+
+	output, dryErr := execDryRun(opts, flags)
+	if dryErr == nil {
+		return output, nil
+	}
+
+	log.Warnf("Matugen dry-run failed (v4=%v): %v", flags.isV4, dryErr)
+
+	newFlags, changed := redetectMatugenVersion(flags)
+	if !changed {
+		return "", dryErr
+	}
+
+	log.Warnf("Matugen version changed (v4: %v -> %v), retrying dry-run", flags.isV4, newFlags.isV4)
+	return execDryRun(opts, newFlags)
+}
+
+func execDryRun(opts *Options, flags matugenFlags) (string, error) {
+	var baseArgs []string
+	switch opts.Kind {
+	case "hex":
+		baseArgs = []string{"color", "hex", opts.Value}
+	default:
+		baseArgs = []string{opts.Kind, opts.Value}
+	}
+	baseArgs = append(baseArgs, "-m", "dark", "-t", opts.MatugenType, "--json", "hex", "--dry-run")
+	baseArgs = appendContrastArg(baseArgs, opts.Contrast)
+	if flags.isV4 {
+		baseArgs = append(baseArgs, "--source-color-index", "0", "--old-json-output")
+	}
+
+	cmd := exec.Command("matugen", baseArgs...)
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	output, err := cmd.Output()
+	if err != nil {
+		if stderr.Len() > 0 {
+			return "", fmt.Errorf("matugen %v failed (v4=%v): %s", baseArgs, flags.isV4, strings.TrimSpace(stderr.String()))
+		}
+		return "", fmt.Errorf("matugen %v failed (v4=%v): %w", baseArgs, flags.isV4, err)
+	}
 	return strings.ReplaceAll(string(output), "\n", ""), nil
 }
 
@@ -819,6 +947,8 @@ func CheckTemplates(checker utils.AppChecker) []TemplateCheck {
 			detected = true
 		case tmpl.Kind == TemplateKindVSCode:
 			detected = checkVSCodeExtension(homeDir)
+		case tmpl.Kind == TemplateKindEmacs:
+			detected = appExists(checker, tmpl.Commands, tmpl.Flatpaks) && utils.EmacsConfigDir() != ""
 		default:
 			detected = appExists(checker, tmpl.Commands, tmpl.Flatpaks)
 		}

core/internal/matugen/matugen_test.go

@@ -3,6 +3,7 @@ package matugen
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	mocks_utils "github.com/AvengeMedia/DankMaterialShell/core/internal/mocks/utils"
@@ -392,3 +393,51 @@ func TestSubstituteVars(t *testing.T) {
 		})
 	}
 }
+
+func TestBuildMergedConfigColorsOnly(t *testing.T) {
+	tempDir := t.TempDir()
+
+	shellDir := filepath.Join(tempDir, "shell")
+	configsDir := filepath.Join(shellDir, "matugen", "configs")
+	if err := os.MkdirAll(configsDir, 0o755); err != nil {
+		t.Fatalf("failed to create configs dir: %v", err)
+	}
+
+	baseConfig := "[config]\ncustom_keywords = []\n"
+	if err := os.WriteFile(filepath.Join(configsDir, "base.toml"), []byte(baseConfig), 0o644); err != nil {
+		t.Fatalf("failed to write base config: %v", err)
+	}
+
+	cfgFile, err := os.CreateTemp(tempDir, "merged-*.toml")
+	if err != nil {
+		t.Fatalf("failed to create temp config: %v", err)
+	}
+	defer os.Remove(cfgFile.Name())
+	defer cfgFile.Close()
+
+	opts := &Options{
+		ShellDir:   shellDir,
+		ConfigDir:  filepath.Join(tempDir, "config"),
+		StateDir:   filepath.Join(tempDir, "state"),
+		ColorsOnly: true,
+	}
+
+	if err := buildMergedConfig(opts, cfgFile, filepath.Join(tempDir, "templates")); err != nil {
+		t.Fatalf("buildMergedConfig failed: %v", err)
+	}
+
+	if err := cfgFile.Close(); err != nil {
+		t.Fatalf("failed to close merged config: %v", err)
+	}
+
+	output, err := os.ReadFile(cfgFile.Name())
+	if err != nil {
+		t.Fatalf("failed to read merged config: %v", err)
+	}
+
+	content := string(output)
+	assert.Contains(t, content, "[templates.dank]")
+	assert.Contains(t, content, "output_path = '"+filepath.Join(opts.StateDir, "dms-colors.json")+"'")
+	assert.NotContains(t, content, "[templates.gtk]")
+	assert.False(t, strings.Contains(content, "output_path = 'CONFIG_DIR/"), "colors-only config should not emit app template outputs")
+}

core/internal/matugen/queue.go

@@ -2,6 +2,7 @@ package matugen
 
 import (
 	"context"
+	"errors"
 	"sync"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
@@ -93,10 +94,13 @@ func (q *Queue) runWorker() {
 		err := Run(job.Options)
 
 		var result Result
-		if err != nil {
-			result = Result{Success: false, Error: err}
-		} else {
+		switch {
+		case err == nil:
 			result = Result{Success: true}
+		case errors.Is(err, ErrNoChanges):
+			result = Result{Success: true}
+		default:
+			result = Result{Success: false, Error: err}
 		}
 
 		q.finishJob(result)

core/internal/mocks/geolocation/mock_Client.go

@@ -0,0 +1,203 @@
+// Code generated by mockery v2.53.5. DO NOT EDIT.
+
+package mocks_geolocation
+
+import (
+	geolocation "github.com/AvengeMedia/DankMaterialShell/core/internal/geolocation"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// MockClient is an autogenerated mock type for the Client type
+type MockClient struct {
+	mock.Mock
+}
+
+type MockClient_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockClient) EXPECT() *MockClient_Expecter {
+	return &MockClient_Expecter{mock: &_m.Mock}
+}
+
+// Close provides a mock function with no fields
+func (_m *MockClient) Close() {
+	_m.Called()
+}
+
+// MockClient_Close_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Close'
+type MockClient_Close_Call struct {
+	*mock.Call
+}
+
+// Close is a helper method to define mock.On call
+func (_e *MockClient_Expecter) Close() *MockClient_Close_Call {
+	return &MockClient_Close_Call{Call: _e.mock.On("Close")}
+}
+
+func (_c *MockClient_Close_Call) Run(run func()) *MockClient_Close_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockClient_Close_Call) Return() *MockClient_Close_Call {
+	_c.Call.Return()
+	return _c
+}
+
+func (_c *MockClient_Close_Call) RunAndReturn(run func()) *MockClient_Close_Call {
+	_c.Run(run)
+	return _c
+}
+
+// GetLocation provides a mock function with no fields
+func (_m *MockClient) GetLocation() (geolocation.Location, error) {
+	ret := _m.Called()
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetLocation")
+	}
+
+	var r0 geolocation.Location
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (geolocation.Location, error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() geolocation.Location); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(geolocation.Location)
+	}
+
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockClient_GetLocation_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetLocation'
+type MockClient_GetLocation_Call struct {
+	*mock.Call
+}
+
+// GetLocation is a helper method to define mock.On call
+func (_e *MockClient_Expecter) GetLocation() *MockClient_GetLocation_Call {
+	return &MockClient_GetLocation_Call{Call: _e.mock.On("GetLocation")}
+}
+
+func (_c *MockClient_GetLocation_Call) Run(run func()) *MockClient_GetLocation_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *MockClient_GetLocation_Call) Return(_a0 geolocation.Location, _a1 error) *MockClient_GetLocation_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockClient_GetLocation_Call) RunAndReturn(run func() (geolocation.Location, error)) *MockClient_GetLocation_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Subscribe provides a mock function with given fields: id
+func (_m *MockClient) Subscribe(id string) chan geolocation.Location {
+	ret := _m.Called(id)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Subscribe")
+	}
+
+	var r0 chan geolocation.Location
+	if rf, ok := ret.Get(0).(func(string) chan geolocation.Location); ok {
+		r0 = rf(id)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(chan geolocation.Location)
+		}
+	}
+
+	return r0
+}
+
+// MockClient_Subscribe_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Subscribe'
+type MockClient_Subscribe_Call struct {
+	*mock.Call
+}
+
+// Subscribe is a helper method to define mock.On call
+//   - id string
+func (_e *MockClient_Expecter) Subscribe(id interface{}) *MockClient_Subscribe_Call {
+	return &MockClient_Subscribe_Call{Call: _e.mock.On("Subscribe", id)}
+}
+
+func (_c *MockClient_Subscribe_Call) Run(run func(id string)) *MockClient_Subscribe_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(string))
+	})
+	return _c
+}
+
+func (_c *MockClient_Subscribe_Call) Return(_a0 chan geolocation.Location) *MockClient_Subscribe_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *MockClient_Subscribe_Call) RunAndReturn(run func(string) chan geolocation.Location) *MockClient_Subscribe_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// Unsubscribe provides a mock function with given fields: id
+func (_m *MockClient) Unsubscribe(id string) {
+	_m.Called(id)
+}
+
+// MockClient_Unsubscribe_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Unsubscribe'
+type MockClient_Unsubscribe_Call struct {
+	*mock.Call
+}
+
+// Unsubscribe is a helper method to define mock.On call
+//   - id string
+func (_e *MockClient_Expecter) Unsubscribe(id interface{}) *MockClient_Unsubscribe_Call {
+	return &MockClient_Unsubscribe_Call{Call: _e.mock.On("Unsubscribe", id)}
+}
+
+func (_c *MockClient_Unsubscribe_Call) Run(run func(id string)) *MockClient_Unsubscribe_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(string))
+	})
+	return _c
+}
+
+func (_c *MockClient_Unsubscribe_Call) Return() *MockClient_Unsubscribe_Call {
+	_c.Call.Return()
+	return _c
+}
+
+func (_c *MockClient_Unsubscribe_Call) RunAndReturn(run func(string)) *MockClient_Unsubscribe_Call {
+	_c.Run(run)
+	return _c
+}
+
+// NewMockClient creates a new instance of MockClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockClient(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockClient {
+	mock := &MockClient{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

core/internal/mocks/network/mock_Backend.go

@@ -1062,6 +1062,62 @@ func (_c *MockBackend_GetWiFiNetworkDetails_Call) RunAndReturn(run func(string)
 	return _c
 }
 
+// GetWiFiQRCodeContent provides a mock function with given fields: ssid
+func (_m *MockBackend) GetWiFiQRCodeContent(ssid string) (string, error) {
+	ret := _m.Called(ssid)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetWiFiQRCodeContent")
+	}
+
+	var r0 string
+	var r1 error
+	if rf, ok := ret.Get(0).(func(string) (string, error)); ok {
+		return rf(ssid)
+	}
+	if rf, ok := ret.Get(0).(func(string) string); ok {
+		r0 = rf(ssid)
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	if rf, ok := ret.Get(1).(func(string) error); ok {
+		r1 = rf(ssid)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// MockBackend_GetWiFiQRCodeContent_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetWiFiQRCodeContent'
+type MockBackend_GetWiFiQRCodeContent_Call struct {
+	*mock.Call
+}
+
+// GetWiFiQRCodeContent is a helper method to define mock.On call
+//   - ssid string
+func (_e *MockBackend_Expecter) GetWiFiQRCodeContent(ssid interface{}) *MockBackend_GetWiFiQRCodeContent_Call {
+	return &MockBackend_GetWiFiQRCodeContent_Call{Call: _e.mock.On("GetWiFiQRCodeContent", ssid)}
+}
+
+func (_c *MockBackend_GetWiFiQRCodeContent_Call) Run(run func(ssid string)) *MockBackend_GetWiFiQRCodeContent_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(string))
+	})
+	return _c
+}
+
+func (_c *MockBackend_GetWiFiQRCodeContent_Call) Return(_a0 string, _a1 error) *MockBackend_GetWiFiQRCodeContent_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *MockBackend_GetWiFiQRCodeContent_Call) RunAndReturn(run func(string) (string, error)) *MockBackend_GetWiFiQRCodeContent_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // GetWiredConnections provides a mock function with no fields
 func (_m *MockBackend) GetWiredConnections() ([]network.WiredConnection, error) {
 	ret := _m.Called()

core/internal/notify/notify.go

@@ -6,6 +6,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"syscall"
 
 	"github.com/godbus/dbus/v5"
@@ -59,7 +60,11 @@ func Send(n Notification) error {
 
 	hints := map[string]dbus.Variant{}
 	if n.FilePath != "" {
-		hints["image_path"] = dbus.MakeVariant(n.FilePath)
+		imgPath := n.FilePath
+		if !strings.HasPrefix(imgPath, "file://") {
+			imgPath = "file://" + imgPath
+		}
+		hints["image_path"] = dbus.MakeVariant(imgPath)
 	}
 
 	obj := conn.Object(notifyDest, notifyPath)

core/internal/pam/pam.go

@@ -0,0 +1,874 @@
+package pam
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/distros"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/privesc"
+)
+
+const (
+	GreeterPamManagedBlockStart = "# BEGIN DMS GREETER AUTH (managed by dms greeter sync)"
+	GreeterPamManagedBlockEnd   = "# END DMS GREETER AUTH"
+
+	LockscreenPamManagedBlockStart = "# BEGIN DMS LOCKSCREEN AUTH (managed by dms greeter sync)"
+	LockscreenPamManagedBlockEnd   = "# END DMS LOCKSCREEN AUTH"
+
+	LockscreenU2FPamManagedBlockStart = "# BEGIN DMS LOCKSCREEN U2F AUTH (managed by dms auth sync)"
+	LockscreenU2FPamManagedBlockEnd   = "# END DMS LOCKSCREEN U2F AUTH"
+
+	legacyGreeterPamFprintComment = "# DMS greeter fingerprint"
+	legacyGreeterPamU2FComment    = "# DMS greeter U2F"
+
+	GreetdPamPath       = "/etc/pam.d/greetd"
+	DankshellPamPath    = "/etc/pam.d/dankshell"
+	DankshellU2FPamPath = "/etc/pam.d/dankshell-u2f"
+)
+
+var includedPamAuthFiles = []string{
+	"system-auth",
+	"common-auth",
+	"password-auth",
+	"system-login",
+	"system-local-login",
+	"common-auth-pc",
+	"login",
+}
+
+type AuthSettings struct {
+	EnableFprint        bool `json:"enableFprint"`
+	EnableU2f           bool `json:"enableU2f"`
+	GreeterEnableFprint bool `json:"greeterEnableFprint"`
+	GreeterEnableU2f    bool `json:"greeterEnableU2f"`
+}
+
+type SyncAuthOptions struct {
+	HomeDir          string
+	ForceGreeterAuth bool
+}
+
+type syncDeps struct {
+	pamDir                             string
+	greetdPath                         string
+	dankshellPath                      string
+	dankshellU2fPath                   string
+	isNixOS                            func() bool
+	readFile                           func(string) ([]byte, error)
+	stat                               func(string) (os.FileInfo, error)
+	createTemp                         func(string, string) (*os.File, error)
+	removeFile                         func(string) error
+	runSudoCmd                         func(string, string, ...string) error
+	pamModuleExists                    func(string) bool
+	fingerprintAvailableForCurrentUser func() bool
+}
+
+type lockscreenPamIncludeDirective struct {
+	target     string
+	filterType string
+}
+
+type lockscreenPamResolver struct {
+	pamDir   string
+	readFile func(string) ([]byte, error)
+}
+
+func defaultSyncDeps() syncDeps {
+	return syncDeps{
+		pamDir:           "/etc/pam.d",
+		greetdPath:       GreetdPamPath,
+		dankshellPath:    DankshellPamPath,
+		dankshellU2fPath: DankshellU2FPamPath,
+		isNixOS:          IsNixOS,
+		readFile:         os.ReadFile,
+		stat:             os.Stat,
+		createTemp:       os.CreateTemp,
+		removeFile:       os.Remove,
+		runSudoCmd: func(password, command string, args ...string) error {
+			return privesc.Run(context.Background(), password, append([]string{command}, args...)...)
+		},
+		pamModuleExists:                    pamModuleExists,
+		fingerprintAvailableForCurrentUser: FingerprintAuthAvailableForCurrentUser,
+	}
+}
+
+func IsNixOS() bool {
+	_, err := os.Stat("/etc/NIXOS")
+	return err == nil
+}
+
+func ReadAuthSettings(homeDir string) (AuthSettings, error) {
+	settingsPath := filepath.Join(homeDir, ".config", "DankMaterialShell", "settings.json")
+	data, err := os.ReadFile(settingsPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return AuthSettings{}, nil
+		}
+		return AuthSettings{}, fmt.Errorf("failed to read settings at %s: %w", settingsPath, err)
+	}
+	if strings.TrimSpace(string(data)) == "" {
+		return AuthSettings{}, nil
+	}
+
+	var settings AuthSettings
+	if err := json.Unmarshal(data, &settings); err != nil {
+		return AuthSettings{}, fmt.Errorf("failed to parse settings at %s: %w", settingsPath, err)
+	}
+	return settings, nil
+}
+
+func ReadGreeterAuthToggles(homeDir string) (enableFprint bool, enableU2f bool, err error) {
+	settings, err := ReadAuthSettings(homeDir)
+	if err != nil {
+		return false, false, err
+	}
+	return settings.GreeterEnableFprint, settings.GreeterEnableU2f, nil
+}
+
+func SyncAuthConfig(logFunc func(string), sudoPassword string, options SyncAuthOptions) error {
+	return syncAuthConfigWithDeps(logFunc, sudoPassword, options, defaultSyncDeps())
+}
+
+func RemoveManagedGreeterPamBlock(logFunc func(string), sudoPassword string) error {
+	return removeManagedGreeterPamBlockWithDeps(logFunc, sudoPassword, defaultSyncDeps())
+}
+
+func syncAuthConfigWithDeps(logFunc func(string), sudoPassword string, options SyncAuthOptions, deps syncDeps) error {
+	homeDir := strings.TrimSpace(options.HomeDir)
+	if homeDir == "" {
+		var err error
+		homeDir, err = os.UserHomeDir()
+		if err != nil {
+			return fmt.Errorf("failed to get user home directory: %w", err)
+		}
+	}
+
+	settings, err := ReadAuthSettings(homeDir)
+	if err != nil {
+		return err
+	}
+
+	if err := syncLockscreenPamConfigWithDeps(logFunc, sudoPassword, deps); err != nil {
+		return err
+	}
+	if err := syncLockscreenU2FPamConfigWithDeps(logFunc, sudoPassword, settings.EnableU2f, deps); err != nil {
+		return err
+	}
+
+	if _, err := deps.stat(deps.greetdPath); err != nil {
+		if os.IsNotExist(err) {
+			logFunc("ℹ /etc/pam.d/greetd not found. Skipping greeter PAM sync.")
+			return nil
+		}
+		return fmt.Errorf("failed to inspect %s: %w", deps.greetdPath, err)
+	}
+
+	if err := syncGreeterPamConfigWithDeps(logFunc, sudoPassword, settings, options.ForceGreeterAuth, deps); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func removeManagedGreeterPamBlockWithDeps(logFunc func(string), sudoPassword string, deps syncDeps) error {
+	if deps.isNixOS() {
+		return nil
+	}
+
+	data, err := deps.readFile(deps.greetdPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return fmt.Errorf("failed to read %s: %w", deps.greetdPath, err)
+	}
+
+	originalContent := string(data)
+	stripped, removed := stripManagedGreeterPamBlock(originalContent)
+	strippedAgain, removedLegacy := stripLegacyGreeterPamLines(stripped)
+	if !removed && !removedLegacy {
+		return nil
+	}
+
+	if err := writeManagedPamFile(strippedAgain, deps.greetdPath, sudoPassword, deps); err != nil {
+		return fmt.Errorf("failed to write %s: %w", deps.greetdPath, err)
+	}
+
+	logFunc("✓ Removed DMS managed PAM block from " + deps.greetdPath)
+	return nil
+}
+
+func ParseManagedGreeterPamAuth(pamText string) (managed bool, fingerprint bool, u2f bool, legacy bool) {
+	if pamText == "" {
+		return false, false, false, false
+	}
+
+	lines := strings.Split(pamText, "\n")
+	inManaged := false
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		switch trimmed {
+		case GreeterPamManagedBlockStart:
+			managed = true
+			inManaged = true
+			continue
+		case GreeterPamManagedBlockEnd:
+			inManaged = false
+			continue
+		}
+
+		if strings.HasPrefix(trimmed, legacyGreeterPamFprintComment) || strings.HasPrefix(trimmed, legacyGreeterPamU2FComment) {
+			legacy = true
+		}
+		if !inManaged {
+			continue
+		}
+		if strings.Contains(trimmed, "pam_fprintd") {
+			fingerprint = true
+		}
+		if strings.Contains(trimmed, "pam_u2f") {
+			u2f = true
+		}
+	}
+
+	return managed, fingerprint, u2f, legacy
+}
+
+func StripManagedGreeterPamContent(pamText string) (string, bool) {
+	stripped, removed := stripManagedGreeterPamBlock(pamText)
+	stripped, removedLegacy := stripLegacyGreeterPamLines(stripped)
+	return stripped, removed || removedLegacy
+}
+
+func PamTextIncludesFile(pamText, filename string) bool {
+	lines := strings.Split(pamText, "\n")
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+			continue
+		}
+		if strings.Contains(trimmed, filename) &&
+			(strings.Contains(trimmed, "include") || strings.Contains(trimmed, "substack") || strings.HasPrefix(trimmed, "@include")) {
+			return true
+		}
+	}
+	return false
+}
+
+func PamFileHasModule(pamFilePath, module string) bool {
+	data, err := os.ReadFile(pamFilePath)
+	if err != nil {
+		return false
+	}
+	return pamContentHasModule(string(data), module)
+}
+
+func DetectIncludedPamModule(pamText, module string) string {
+	return detectIncludedPamModule(pamText, module, defaultSyncDeps())
+}
+
+func detectIncludedPamModule(pamText, module string, deps syncDeps) string {
+	for _, includedFile := range includedPamAuthFiles {
+		if !PamTextIncludesFile(pamText, includedFile) {
+			continue
+		}
+		path := filepath.Join(deps.pamDir, includedFile)
+		data, err := deps.readFile(path)
+		if err != nil {
+			continue
+		}
+		if pamContentHasModule(string(data), module) {
+			return includedFile
+		}
+	}
+	return ""
+}
+
+func pamContentHasModule(content, module string) bool {
+	lines := strings.Split(content, "\n")
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" || strings.HasPrefix(trimmed, "#") {
+			continue
+		}
+		if strings.Contains(trimmed, module) {
+			return true
+		}
+	}
+	return false
+}
+
+func hasManagedLockscreenPamFile(content string) bool {
+	return strings.Contains(content, LockscreenPamManagedBlockStart) &&
+		strings.Contains(content, LockscreenPamManagedBlockEnd)
+}
+
+func hasManagedLockscreenU2FPamFile(content string) bool {
+	return strings.Contains(content, LockscreenU2FPamManagedBlockStart) &&
+		strings.Contains(content, LockscreenU2FPamManagedBlockEnd)
+}
+
+func pamDirectiveType(line string) string {
+	fields := strings.Fields(line)
+	if len(fields) == 0 {
+		return ""
+	}
+
+	directiveType := strings.TrimPrefix(fields[0], "-")
+	switch directiveType {
+	case "auth", "account", "password", "session":
+		return directiveType
+	default:
+		return ""
+	}
+}
+
+func isExcludedLockscreenPamLine(line string) bool {
+	for _, field := range strings.Fields(line) {
+		if strings.HasPrefix(field, "#") {
+			break
+		}
+		if strings.Contains(field, "pam_u2f") || strings.Contains(field, "pam_fprintd") {
+			return true
+		}
+	}
+	return false
+}
+
+func parseLockscreenPamIncludeDirective(trimmed string, inheritedFilter string) (lockscreenPamIncludeDirective, bool) {
+	fields := strings.Fields(trimmed)
+	if len(fields) >= 2 && fields[0] == "@include" {
+		return lockscreenPamIncludeDirective{
+			target:     fields[1],
+			filterType: inheritedFilter,
+		}, true
+	}
+
+	if len(fields) >= 3 && (fields[1] == "include" || fields[1] == "substack") {
+		lineType := pamDirectiveType(trimmed)
+		if lineType == "" {
+			return lockscreenPamIncludeDirective{}, false
+		}
+		return lockscreenPamIncludeDirective{
+			target:     fields[2],
+			filterType: lineType,
+		}, true
+	}
+
+	if len(fields) >= 3 && fields[1] == "@include" {
+		lineType := pamDirectiveType(trimmed)
+		if lineType == "" {
+			return lockscreenPamIncludeDirective{}, false
+		}
+		return lockscreenPamIncludeDirective{
+			target:     fields[2],
+			filterType: lineType,
+		}, true
+	}
+
+	return lockscreenPamIncludeDirective{}, false
+}
+
+func resolveLockscreenPamIncludePath(pamDir, target string) (string, error) {
+	if strings.TrimSpace(target) == "" {
+		return "", fmt.Errorf("empty PAM include target")
+	}
+
+	cleanPamDir := filepath.Clean(pamDir)
+	if filepath.IsAbs(target) {
+		cleanTarget := filepath.Clean(target)
+		if filepath.Dir(cleanTarget) != cleanPamDir {
+			return "", fmt.Errorf("unsupported PAM include outside %s: %s", cleanPamDir, target)
+		}
+		return cleanTarget, nil
+	}
+
+	cleanTarget := filepath.Clean(target)
+	if cleanTarget == "." || cleanTarget == ".." || strings.HasPrefix(cleanTarget, ".."+string(os.PathSeparator)) {
+		return "", fmt.Errorf("invalid PAM include target: %s", target)
+	}
+
+	return filepath.Join(cleanPamDir, cleanTarget), nil
+}
+
+func (r lockscreenPamResolver) resolveService(serviceName string, filterType string, stack []string) ([]string, error) {
+	path, err := resolveLockscreenPamIncludePath(r.pamDir, serviceName)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, seen := range stack {
+		if seen == path {
+			chain := append(append([]string{}, stack...), path)
+			display := make([]string, 0, len(chain))
+			for _, item := range chain {
+				display = append(display, filepath.Base(item))
+			}
+			return nil, fmt.Errorf("cyclic PAM include detected: %s", strings.Join(display, " -> "))
+		}
+	}
+
+	data, err := r.readFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read PAM file %s: %w", path, err)
+	}
+
+	var resolved []string
+	for _, rawLine := range strings.Split(strings.ReplaceAll(string(data), "\r\n", "\n"), "\n") {
+		rawLine = strings.TrimRight(rawLine, "\r")
+		trimmed := strings.TrimSpace(rawLine)
+		if trimmed == "" || strings.HasPrefix(trimmed, "#") || trimmed == "#%PAM-1.0" {
+			continue
+		}
+
+		if include, ok := parseLockscreenPamIncludeDirective(trimmed, filterType); ok {
+			lineType := pamDirectiveType(trimmed)
+			if filterType != "" && lineType != "" && lineType != filterType {
+				continue
+			}
+
+			nested, err := r.resolveService(include.target, include.filterType, append(stack, path))
+			if err != nil {
+				return nil, err
+			}
+			resolved = append(resolved, nested...)
+			continue
+		}
+
+		lineType := pamDirectiveType(trimmed)
+		if lineType == "" {
+			return nil, fmt.Errorf("unsupported PAM directive in %s: %s", filepath.Base(path), trimmed)
+		}
+		if filterType != "" && lineType != filterType {
+			continue
+		}
+		if isExcludedLockscreenPamLine(trimmed) {
+			continue
+		}
+
+		resolved = append(resolved, rawLine)
+	}
+
+	return resolved, nil
+}
+
+func buildManagedLockscreenPamContent(pamDir string, readFile func(string) ([]byte, error)) (string, error) {
+	resolver := lockscreenPamResolver{
+		pamDir:   pamDir,
+		readFile: readFile,
+	}
+
+	resolvedLines, err := resolver.resolveService("login", "", nil)
+	if err != nil {
+		return "", err
+	}
+	if len(resolvedLines) == 0 {
+		return "", fmt.Errorf("no auth directives remained after filtering %s", filepath.Join(pamDir, "login"))
+	}
+
+	hasAuth := false
+	for _, line := range resolvedLines {
+		if pamDirectiveType(strings.TrimSpace(line)) == "auth" {
+			hasAuth = true
+			break
+		}
+	}
+	if !hasAuth {
+		return "", fmt.Errorf("no auth directives remained after filtering %s", filepath.Join(pamDir, "login"))
+	}
+
+	var b strings.Builder
+	b.WriteString("#%PAM-1.0\n")
+	b.WriteString(LockscreenPamManagedBlockStart + "\n")
+	for _, line := range resolvedLines {
+		b.WriteString(line)
+		b.WriteByte('\n')
+	}
+	b.WriteString(LockscreenPamManagedBlockEnd + "\n")
+	return b.String(), nil
+}
+
+func buildManagedLockscreenU2FPamContent() string {
+	var b strings.Builder
+	b.WriteString("#%PAM-1.0\n")
+	b.WriteString(LockscreenU2FPamManagedBlockStart + "\n")
+	b.WriteString("auth    required    pam_u2f.so  cue nouserok timeout=10\n")
+	b.WriteString(LockscreenU2FPamManagedBlockEnd + "\n")
+	return b.String()
+}
+
+func syncLockscreenPamConfigWithDeps(logFunc func(string), sudoPassword string, deps syncDeps) error {
+	if deps.isNixOS() {
+		logFunc("ℹ NixOS detected. DMS continues to use /etc/pam.d/login for lock screen password auth on NixOS unless you declare security.pam.services.dankshell yourself. U2F and fingerprint are handled separately and should not be included in dankshell.")
+		return nil
+	}
+
+	existingData, err := deps.readFile(deps.dankshellPath)
+	if err == nil {
+		if !hasManagedLockscreenPamFile(string(existingData)) {
+			logFunc("ℹ Custom /etc/pam.d/dankshell found (no DMS block). Skipping.")
+			return nil
+		}
+	} else if !os.IsNotExist(err) {
+		return fmt.Errorf("failed to read %s: %w", deps.dankshellPath, err)
+	}
+
+	content, err := buildManagedLockscreenPamContent(deps.pamDir, deps.readFile)
+	if err != nil {
+		return fmt.Errorf("failed to build %s from %s: %w", deps.dankshellPath, filepath.Join(deps.pamDir, "login"), err)
+	}
+
+	if err := writeManagedPamFile(content, deps.dankshellPath, sudoPassword, deps); err != nil {
+		return fmt.Errorf("failed to write %s: %w", deps.dankshellPath, err)
+	}
+
+	logFunc("✓ Created or updated /etc/pam.d/dankshell for lock screen authentication")
+	return nil
+}
+
+func syncLockscreenU2FPamConfigWithDeps(logFunc func(string), sudoPassword string, enabled bool, deps syncDeps) error {
+	if deps.isNixOS() {
+		logFunc("ℹ NixOS detected. DMS does not manage /etc/pam.d/dankshell-u2f on NixOS. Keep using the bundled U2F helper or configure a custom PAM service yourself.")
+		return nil
+	}
+
+	existingData, err := deps.readFile(deps.dankshellU2fPath)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("failed to read %s: %w", deps.dankshellU2fPath, err)
+	}
+
+	if enabled {
+		if err == nil && !hasManagedLockscreenU2FPamFile(string(existingData)) {
+			logFunc("ℹ Custom /etc/pam.d/dankshell-u2f found (no DMS block). Skipping.")
+			return nil
+		}
+		if err := writeManagedPamFile(buildManagedLockscreenU2FPamContent(), deps.dankshellU2fPath, sudoPassword, deps); err != nil {
+			return fmt.Errorf("failed to write %s: %w", deps.dankshellU2fPath, err)
+		}
+		logFunc("✓ Created or updated /etc/pam.d/dankshell-u2f for lock screen security-key authentication")
+		return nil
+	}
+
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err == nil && !hasManagedLockscreenU2FPamFile(string(existingData)) {
+		logFunc("ℹ Custom /etc/pam.d/dankshell-u2f found (no DMS block). Leaving it untouched.")
+		return nil
+	}
+
+	if err := deps.runSudoCmd(sudoPassword, "rm", "-f", deps.dankshellU2fPath); err != nil {
+		return fmt.Errorf("failed to remove %s: %w", deps.dankshellU2fPath, err)
+	}
+	logFunc("✓ Removed DMS-managed /etc/pam.d/dankshell-u2f")
+	return nil
+}
+
+func stripManagedGreeterPamBlock(content string) (string, bool) {
+	lines := strings.Split(content, "\n")
+	filtered := make([]string, 0, len(lines))
+	inManagedBlock := false
+	removed := false
+
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == GreeterPamManagedBlockStart {
+			inManagedBlock = true
+			removed = true
+			continue
+		}
+		if trimmed == GreeterPamManagedBlockEnd {
+			inManagedBlock = false
+			removed = true
+			continue
+		}
+		if inManagedBlock {
+			removed = true
+			continue
+		}
+		filtered = append(filtered, line)
+	}
+
+	return strings.Join(filtered, "\n"), removed
+}
+
+func stripLegacyGreeterPamLines(content string) (string, bool) {
+	lines := strings.Split(content, "\n")
+	filtered := make([]string, 0, len(lines))
+	removed := false
+
+	for i := 0; i < len(lines); i++ {
+		trimmed := strings.TrimSpace(lines[i])
+		if strings.HasPrefix(trimmed, legacyGreeterPamFprintComment) || strings.HasPrefix(trimmed, legacyGreeterPamU2FComment) {
+			removed = true
+			if i+1 < len(lines) {
+				nextLine := strings.TrimSpace(lines[i+1])
+				if strings.HasPrefix(nextLine, "auth") &&
+					(strings.Contains(nextLine, "pam_fprintd") || strings.Contains(nextLine, "pam_u2f")) {
+					i++
+				}
+			}
+			continue
+		}
+		filtered = append(filtered, lines[i])
+	}
+
+	return strings.Join(filtered, "\n"), removed
+}
+
+func insertManagedGreeterPamBlock(content string, blockLines []string, greetdPamPath string) (string, error) {
+	lines := strings.Split(content, "\n")
+	for i, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed != "" && !strings.HasPrefix(trimmed, "#") && strings.HasPrefix(trimmed, "auth") {
+			block := strings.Join(blockLines, "\n")
+			prefix := strings.Join(lines[:i], "\n")
+			suffix := strings.Join(lines[i:], "\n")
+			switch {
+			case prefix == "":
+				return block + "\n" + suffix, nil
+			case suffix == "":
+				return prefix + "\n" + block, nil
+			default:
+				return prefix + "\n" + block + "\n" + suffix, nil
+			}
+		}
+	}
+	return "", fmt.Errorf("no auth directive found in %s", greetdPamPath)
+}
+
+func syncGreeterPamConfigWithDeps(logFunc func(string), sudoPassword string, settings AuthSettings, forceAuth bool, deps syncDeps) error {
+	var wantFprint, wantU2f bool
+	fprintToggleEnabled := forceAuth
+	u2fToggleEnabled := forceAuth
+	if forceAuth {
+		wantFprint = deps.pamModuleExists("pam_fprintd.so")
+		wantU2f = deps.pamModuleExists("pam_u2f.so")
+	} else {
+		fprintToggleEnabled = settings.GreeterEnableFprint
+		u2fToggleEnabled = settings.GreeterEnableU2f
+		fprintModule := deps.pamModuleExists("pam_fprintd.so")
+		u2fModule := deps.pamModuleExists("pam_u2f.so")
+		wantFprint = settings.GreeterEnableFprint && fprintModule
+		wantU2f = settings.GreeterEnableU2f && u2fModule
+		if settings.GreeterEnableFprint && !fprintModule {
+			logFunc("⚠ Warning: greeter fingerprint toggle is enabled, but pam_fprintd.so was not found.")
+		}
+		if settings.GreeterEnableU2f && !u2fModule {
+			logFunc("⚠ Warning: greeter security key toggle is enabled, but pam_u2f.so was not found.")
+		}
+	}
+
+	if deps.isNixOS() {
+		logFunc("ℹ NixOS detected: PAM config is managed by NixOS modules. Skipping DMS PAM block write.")
+		logFunc("  Configure fingerprint/U2F auth via your greetd NixOS module options (e.g. security.pam.services.greetd).")
+		return nil
+	}
+
+	pamData, err := deps.readFile(deps.greetdPath)
+	if err != nil {
+		return fmt.Errorf("failed to read %s: %w", deps.greetdPath, err)
+	}
+	originalContent := string(pamData)
+	content, _ := stripManagedGreeterPamBlock(originalContent)
+	content, _ = stripLegacyGreeterPamLines(content)
+
+	includedFprintFile := detectIncludedPamModule(content, "pam_fprintd.so", deps)
+	includedU2fFile := detectIncludedPamModule(content, "pam_u2f.so", deps)
+	fprintAvailableForCurrentUser := deps.fingerprintAvailableForCurrentUser()
+	if wantFprint && includedFprintFile != "" {
+		logFunc("⚠ pam_fprintd already present in included " + includedFprintFile + " (managed by authselect/pam-auth-update). Skipping DMS fprint block to avoid double-fingerprint auth.")
+		wantFprint = false
+	}
+	if wantU2f && includedU2fFile != "" {
+		logFunc("⚠ pam_u2f already present in included " + includedU2fFile + " (managed by authselect/pam-auth-update). Skipping DMS U2F block to avoid double security-key auth.")
+		wantU2f = false
+	}
+	if !wantFprint && includedFprintFile != "" {
+		if fprintToggleEnabled {
+			logFunc("ℹ Fingerprint auth is still enabled via included " + includedFprintFile + ".")
+			if fprintAvailableForCurrentUser {
+				logFunc("  DMS toggle is enabled, and effective auth is provided by the included PAM stack.")
+			} else {
+				logFunc("  No enrolled fingerprints detected for the current user; password auth remains the effective path.")
+			}
+		} else {
+			if fprintAvailableForCurrentUser {
+				logFunc("ℹ Fingerprint auth is active via included " + includedFprintFile + " while DMS fingerprint toggle is off.")
+				logFunc("  Password login will work but may be delayed while the fingerprint module runs first.")
+				logFunc("  To eliminate the delay, " + pamManagerHintForCurrentDistro())
+			} else {
+				logFunc("ℹ pam_fprintd is present via included " + includedFprintFile + ", but no enrolled fingerprints were detected for the current user.")
+				logFunc("  Password auth remains the effective login path.")
+			}
+		}
+	}
+	if !wantU2f && includedU2fFile != "" {
+		if u2fToggleEnabled {
+			logFunc("ℹ Security-key auth is still enabled via included " + includedU2fFile + ".")
+			logFunc("  DMS toggle is enabled, but effective auth is provided by the included PAM stack.")
+		} else {
+			logFunc("⚠ Security-key auth is active via included " + includedU2fFile + " while DMS security-key toggle is off.")
+			logFunc("  " + pamManagerHintForCurrentDistro())
+		}
+	}
+
+	if wantFprint || wantU2f {
+		blockLines := []string{GreeterPamManagedBlockStart}
+		if wantFprint {
+			blockLines = append(blockLines, "auth sufficient pam_fprintd.so max-tries=1 timeout=5")
+		}
+		if wantU2f {
+			blockLines = append(blockLines, "auth sufficient pam_u2f.so cue nouserok timeout=10")
+		}
+		blockLines = append(blockLines, GreeterPamManagedBlockEnd)
+
+		content, err = insertManagedGreeterPamBlock(content, blockLines, deps.greetdPath)
+		if err != nil {
+			return err
+		}
+	}
+
+	if content == originalContent {
+		return nil
+	}
+
+	if err := writeManagedPamFile(content, deps.greetdPath, sudoPassword, deps); err != nil {
+		return fmt.Errorf("failed to install updated PAM config at %s: %w", deps.greetdPath, err)
+	}
+	if wantFprint || wantU2f {
+		logFunc("✓ Configured greetd PAM for fingerprint/U2F")
+	} else {
+		logFunc("✓ Cleared DMS-managed greeter PAM auth block")
+	}
+	return nil
+}
+
+func writeManagedPamFile(content string, destPath string, sudoPassword string, deps syncDeps) error {
+	tmpFile, err := deps.createTemp("", "dms-pam-*.conf")
+	if err != nil {
+		return err
+	}
+	tmpPath := tmpFile.Name()
+	defer func() {
+		_ = deps.removeFile(tmpPath)
+	}()
+
+	if _, err := tmpFile.WriteString(content); err != nil {
+		tmpFile.Close()
+		return err
+	}
+	if err := tmpFile.Close(); err != nil {
+		return err
+	}
+	if err := deps.runSudoCmd(sudoPassword, "cp", tmpPath, destPath); err != nil {
+		return err
+	}
+	if err := deps.runSudoCmd(sudoPassword, "chmod", "644", destPath); err != nil {
+		return fmt.Errorf("failed to set permissions on %s: %w", destPath, err)
+	}
+	return nil
+}
+
+func pamManagerHintForCurrentDistro() string {
+	osInfo, err := distros.GetOSInfo()
+	if err != nil {
+		return "Disable it in your PAM manager (authselect/pam-auth-update) or in the included PAM stack to force password-only greeter login."
+	}
+	config, exists := distros.Registry[osInfo.Distribution.ID]
+	if !exists {
+		return "Disable it in your PAM manager (authselect/pam-auth-update) or in the included PAM stack to force password-only greeter login."
+	}
+
+	switch config.Family {
+	case distros.FamilyFedora:
+		return "Disable it in authselect to force password-only greeter login."
+	case distros.FamilyDebian, distros.FamilyUbuntu:
+		return "Disable it in pam-auth-update to force password-only greeter login."
+	default:
+		return "Disable it in your distro PAM manager (authselect/pam-auth-update) or in the included PAM stack to force password-only greeter login."
+	}
+}
+
+func pamModuleExists(module string) bool {
+	for _, libDir := range []string{
+		"/usr/lib64/security",
+		"/usr/lib/security",
+		"/lib64/security",
+		"/lib/security",
+		"/lib/x86_64-linux-gnu/security",
+		"/usr/lib/x86_64-linux-gnu/security",
+		"/lib/aarch64-linux-gnu/security",
+		"/usr/lib/aarch64-linux-gnu/security",
+		"/run/current-system/sw/lib64/security",
+		"/run/current-system/sw/lib/security",
+	} {
+		if _, err := os.Stat(filepath.Join(libDir, module)); err == nil {
+			return true
+		}
+	}
+	return false
+}
+
+func hasEnrolledFingerprintOutput(output string) bool {
+	lower := strings.ToLower(output)
+	if strings.Contains(lower, "no fingers enrolled") ||
+		strings.Contains(lower, "no fingerprints enrolled") ||
+		strings.Contains(lower, "no prints enrolled") {
+		return false
+	}
+	if strings.Contains(lower, "has fingers enrolled") ||
+		strings.Contains(lower, "has fingerprints enrolled") {
+		return true
+	}
+	for _, line := range strings.Split(lower, "\n") {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "finger:") {
+			return true
+		}
+		if strings.HasPrefix(trimmed, "- ") && strings.Contains(trimmed, "finger") {
+			return true
+		}
+	}
+	return false
+}
+
+func FingerprintAuthAvailableForCurrentUser() bool {
+	username := strings.TrimSpace(os.Getenv("SUDO_USER"))
+	if username == "" {
+		username = strings.TrimSpace(os.Getenv("USER"))
+	}
+	if username == "" {
+		out, err := exec.Command("id", "-un").Output()
+		if err == nil {
+			username = strings.TrimSpace(string(out))
+		}
+	}
+	return fingerprintAuthAvailableForUser(username)
+}
+
+func fingerprintAuthAvailableForUser(username string) bool {
+	username = strings.TrimSpace(username)
+	if username == "" {
+		return false
+	}
+	if !pamModuleExists("pam_fprintd.so") {
+		return false
+	}
+	if _, err := exec.LookPath("fprintd-list"); err != nil {
+		return false
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, "fprintd-list", username).CombinedOutput()
+	if err != nil {
+		return false
+	}
+	return hasEnrolledFingerprintOutput(string(out))
+}

core/internal/pam/pam_test.go

@@ -0,0 +1,671 @@
+package pam
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func writeTestFile(t *testing.T, path string, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("failed to create parent dir for %s: %v", path, err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("failed to write %s: %v", path, err)
+	}
+}
+
+type pamTestEnv struct {
+	pamDir               string
+	greetdPath           string
+	dankshellPath        string
+	dankshellU2fPath     string
+	tmpDir               string
+	homeDir              string
+	availableModules     map[string]bool
+	fingerprintAvailable bool
+}
+
+func newPamTestEnv(t *testing.T) *pamTestEnv {
+	t.Helper()
+
+	root := t.TempDir()
+	pamDir := filepath.Join(root, "pam.d")
+	tmpDir := filepath.Join(root, "tmp")
+	homeDir := filepath.Join(root, "home")
+
+	for _, dir := range []string{pamDir, tmpDir, homeDir} {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatalf("failed to create %s: %v", dir, err)
+		}
+	}
+
+	return &pamTestEnv{
+		pamDir:           pamDir,
+		greetdPath:       filepath.Join(pamDir, "greetd"),
+		dankshellPath:    filepath.Join(pamDir, "dankshell"),
+		dankshellU2fPath: filepath.Join(pamDir, "dankshell-u2f"),
+		tmpDir:           tmpDir,
+		homeDir:          homeDir,
+		availableModules: map[string]bool{},
+	}
+}
+
+func (e *pamTestEnv) writePamFile(t *testing.T, name string, content string) {
+	t.Helper()
+	writeTestFile(t, filepath.Join(e.pamDir, name), content)
+}
+
+func (e *pamTestEnv) writeSettings(t *testing.T, content string) {
+	t.Helper()
+	writeTestFile(t, filepath.Join(e.homeDir, ".config", "DankMaterialShell", "settings.json"), content)
+}
+
+func (e *pamTestEnv) deps(isNixOS bool) syncDeps {
+	return syncDeps{
+		pamDir:           e.pamDir,
+		greetdPath:       e.greetdPath,
+		dankshellPath:    e.dankshellPath,
+		dankshellU2fPath: e.dankshellU2fPath,
+		isNixOS:          func() bool { return isNixOS },
+		readFile:         os.ReadFile,
+		stat:             os.Stat,
+		createTemp: func(_ string, pattern string) (*os.File, error) {
+			return os.CreateTemp(e.tmpDir, pattern)
+		},
+		removeFile: os.Remove,
+		runSudoCmd: func(_ string, command string, args ...string) error {
+			switch command {
+			case "cp":
+				if len(args) != 2 {
+					return fmt.Errorf("unexpected cp args: %v", args)
+				}
+				data, err := os.ReadFile(args[0])
+				if err != nil {
+					return err
+				}
+				if err := os.MkdirAll(filepath.Dir(args[1]), 0o755); err != nil {
+					return err
+				}
+				return os.WriteFile(args[1], data, 0o644)
+			case "chmod":
+				if len(args) != 2 {
+					return fmt.Errorf("unexpected chmod args: %v", args)
+				}
+				return nil
+			case "rm":
+				if len(args) != 2 || args[0] != "-f" {
+					return fmt.Errorf("unexpected rm args: %v", args)
+				}
+				if err := os.Remove(args[1]); err != nil && !os.IsNotExist(err) {
+					return err
+				}
+				return nil
+			default:
+				return fmt.Errorf("unexpected sudo command: %s %v", command, args)
+			}
+		},
+		pamModuleExists: func(module string) bool {
+			return e.availableModules[module]
+		},
+		fingerprintAvailableForCurrentUser: func() bool {
+			return e.fingerprintAvailable
+		},
+	}
+}
+
+func readFileString(t *testing.T, path string) string {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("failed to read %s: %v", path, err)
+	}
+	return string(data)
+}
+
+func TestHasManagedLockscreenPamFile(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		content string
+		want    bool
+	}{
+		{
+			name: "both markers present",
+			content: "#%PAM-1.0\n" +
+				LockscreenPamManagedBlockStart + "\n" +
+				"auth sufficient pam_unix.so\n" +
+				LockscreenPamManagedBlockEnd + "\n",
+			want: true,
+		},
+		{
+			name: "missing end marker is not managed",
+			content: "#%PAM-1.0\n" +
+				LockscreenPamManagedBlockStart + "\n" +
+				"auth sufficient pam_unix.so\n",
+			want: false,
+		},
+		{
+			name:    "custom file is not managed",
+			content: "#%PAM-1.0\nauth sufficient pam_unix.so\n",
+			want:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := hasManagedLockscreenPamFile(tt.content); got != tt.want {
+				t.Fatalf("hasManagedLockscreenPamFile() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestBuildManagedLockscreenPamContent(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name            string
+		files           map[string]string
+		wantContains    []string
+		wantNotContains []string
+		wantCounts      map[string]int
+		wantErr         string
+	}{
+		{
+			name: "preserves custom modules and strips direct u2f and fprint directives",
+			files: map[string]string{
+				"login": "#%PAM-1.0\n" +
+					"auth include system-auth\n" +
+					"account include system-auth\n" +
+					"session include system-auth\n",
+				"system-auth": "auth requisite pam_nologin.so\n" +
+					"auth sufficient pam_unix.so try_first_pass nullok\n" +
+					"auth sufficient pam_u2f.so cue\n" +
+					"auth sufficient pam_fprintd.so max-tries=1\n" +
+					"auth required pam_radius_auth.so conf=/etc/raddb/server\n" +
+					"account required pam_access.so\n" +
+					"session optional pam_lastlog.so silent\n",
+			},
+			wantContains: []string{
+				"#%PAM-1.0",
+				LockscreenPamManagedBlockStart,
+				LockscreenPamManagedBlockEnd,
+				"auth requisite pam_nologin.so",
+				"auth sufficient pam_unix.so try_first_pass nullok",
+				"auth required pam_radius_auth.so conf=/etc/raddb/server",
+				"account required pam_access.so",
+				"session optional pam_lastlog.so silent",
+			},
+			wantNotContains: []string{
+				"pam_u2f",
+				"pam_fprintd",
+			},
+			wantCounts: map[string]int{
+				"auth required pam_radius_auth.so conf=/etc/raddb/server": 1,
+				"account required pam_access.so":                          1,
+			},
+		},
+		{
+			name: "resolves nested include substack and @include transitively",
+			files: map[string]string{
+				"login": "#%PAM-1.0\n" +
+					"auth include system-auth\n" +
+					"account include system-auth\n" +
+					"password include system-auth\n" +
+					"session include system-auth\n",
+				"system-auth": "auth substack custom-auth\n" +
+					"account include custom-auth\n" +
+					"password include custom-auth\n" +
+					"session @include common-session\n",
+				"custom-auth": "auth required pam_custom.so one=two\n" +
+					"account required pam_custom_account.so\n" +
+					"password required pam_custom_password.so\n",
+				"common-session": "session optional pam_fprintd.so max-tries=1\n" +
+					"session optional pam_lastlog.so silent\n",
+			},
+			wantContains: []string{
+				"auth required pam_custom.so one=two",
+				"account required pam_custom_account.so",
+				"password required pam_custom_password.so",
+				"session optional pam_lastlog.so silent",
+			},
+			wantNotContains: []string{
+				"pam_fprintd",
+			},
+			wantCounts: map[string]int{
+				"auth required pam_custom.so one=two":      1,
+				"account required pam_custom_account.so":   1,
+				"password required pam_custom_password.so": 1,
+				"session optional pam_lastlog.so silent":   1,
+			},
+		},
+		{
+			name: "missing include fails",
+			files: map[string]string{
+				"login": "#%PAM-1.0\nauth include missing-auth\n",
+			},
+			wantErr: "failed to read PAM file",
+		},
+		{
+			name: "cyclic include fails",
+			files: map[string]string{
+				"login":       "#%PAM-1.0\nauth include system-auth\n",
+				"system-auth": "auth include login\n",
+			},
+			wantErr: "cyclic PAM include detected",
+		},
+		{
+			name: "no auth directives remain after filtering fails",
+			files: map[string]string{
+				"login":       "#%PAM-1.0\nauth include system-auth\n",
+				"system-auth": "auth sufficient pam_u2f.so cue\n",
+			},
+			wantErr: "no auth directives remained after filtering",
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := newPamTestEnv(t)
+			for name, content := range tt.files {
+				env.writePamFile(t, name, content)
+			}
+
+			content, err := buildManagedLockscreenPamContent(env.pamDir, os.ReadFile)
+			if tt.wantErr != "" {
+				if err == nil {
+					t.Fatalf("expected error containing %q, got nil", tt.wantErr)
+				}
+				if !strings.Contains(err.Error(), tt.wantErr) {
+					t.Fatalf("error = %q, want substring %q", err.Error(), tt.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("buildManagedLockscreenPamContent returned error: %v", err)
+			}
+
+			for _, want := range tt.wantContains {
+				if !strings.Contains(content, want) {
+					t.Errorf("missing expected string %q in output:\n%s", want, content)
+				}
+			}
+			for _, notWant := range tt.wantNotContains {
+				if strings.Contains(content, notWant) {
+					t.Errorf("unexpected string %q found in output:\n%s", notWant, content)
+				}
+			}
+			for want, wantCount := range tt.wantCounts {
+				if gotCount := strings.Count(content, want); gotCount != wantCount {
+					t.Errorf("count for %q = %d, want %d\noutput:\n%s", want, gotCount, wantCount, content)
+				}
+			}
+		})
+	}
+}
+
+func TestSyncLockscreenPamConfigWithDeps(t *testing.T) {
+	t.Parallel()
+
+	t.Run("custom dankshell file is skipped untouched", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		customContent := "#%PAM-1.0\nauth required pam_unix.so\n"
+		env.writePamFile(t, "dankshell", customContent)
+
+		var logs []string
+		err := syncLockscreenPamConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", env.deps(false))
+		if err != nil {
+			t.Fatalf("syncLockscreenPamConfigWithDeps returned error: %v", err)
+		}
+
+		if got := readFileString(t, env.dankshellPath); got != customContent {
+			t.Fatalf("custom dankshell content changed\ngot:\n%s\nwant:\n%s", got, customContent)
+		}
+		if len(logs) == 0 || !strings.Contains(logs[0], "Custom /etc/pam.d/dankshell found") {
+			t.Fatalf("expected custom-file skip log, got %v", logs)
+		}
+	})
+
+	t.Run("managed dankshell file is rewritten from resolved login stack", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so try_first_pass nullok\nauth sufficient pam_u2f.so cue\naccount required pam_access.so\n")
+		env.writePamFile(t, "dankshell", "#%PAM-1.0\n"+LockscreenPamManagedBlockStart+"\nauth required pam_env.so\n"+LockscreenPamManagedBlockEnd+"\n")
+
+		var logs []string
+		err := syncLockscreenPamConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", env.deps(false))
+		if err != nil {
+			t.Fatalf("syncLockscreenPamConfigWithDeps returned error: %v", err)
+		}
+
+		output := readFileString(t, env.dankshellPath)
+		for _, want := range []string{
+			LockscreenPamManagedBlockStart,
+			"auth sufficient pam_unix.so try_first_pass nullok",
+			"account required pam_access.so",
+			LockscreenPamManagedBlockEnd,
+		} {
+			if !strings.Contains(output, want) {
+				t.Errorf("missing expected string %q in rewritten dankshell:\n%s", want, output)
+			}
+		}
+		if strings.Contains(output, "pam_u2f") {
+			t.Errorf("rewritten dankshell still contains pam_u2f:\n%s", output)
+		}
+		if len(logs) == 0 || !strings.Contains(logs[len(logs)-1], "Created or updated /etc/pam.d/dankshell") {
+			t.Fatalf("expected success log, got %v", logs)
+		}
+	})
+
+	t.Run("mutable systems fail when login stack cannot be converted safely", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		err := syncLockscreenPamConfigWithDeps(func(string) {}, "", env.deps(false))
+		if err == nil {
+			t.Fatal("expected error when login PAM file is missing, got nil")
+		}
+		if !strings.Contains(err.Error(), "failed to build") {
+			t.Fatalf("error = %q, want substring %q", err.Error(), "failed to build")
+		}
+	})
+
+	t.Run("NixOS remains informational and does not write dankshell", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		var logs []string
+
+		err := syncLockscreenPamConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", env.deps(true))
+		if err != nil {
+			t.Fatalf("syncLockscreenPamConfigWithDeps returned error on NixOS path: %v", err)
+		}
+		if len(logs) == 0 || !strings.Contains(logs[0], "NixOS detected") || !strings.Contains(logs[0], "/etc/pam.d/login") {
+			t.Fatalf("expected NixOS informational log mentioning /etc/pam.d/login, got %v", logs)
+		}
+		if _, err := os.Stat(env.dankshellPath); !os.IsNotExist(err) {
+			t.Fatalf("expected no dankshell file to be written on NixOS path, stat err = %v", err)
+		}
+	})
+}
+
+func TestSyncLockscreenU2FPamConfigWithDeps(t *testing.T) {
+	t.Parallel()
+
+	t.Run("enabled creates managed file", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		var logs []string
+
+		err := syncLockscreenU2FPamConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", true, env.deps(false))
+		if err != nil {
+			t.Fatalf("syncLockscreenU2FPamConfigWithDeps returned error: %v", err)
+		}
+
+		got := readFileString(t, env.dankshellU2fPath)
+		if got != buildManagedLockscreenU2FPamContent() {
+			t.Fatalf("unexpected managed dankshell-u2f content:\n%s", got)
+		}
+		if len(logs) == 0 || !strings.Contains(logs[len(logs)-1], "Created or updated /etc/pam.d/dankshell-u2f") {
+			t.Fatalf("expected create log, got %v", logs)
+		}
+	})
+
+	t.Run("enabled rewrites existing managed file", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.writePamFile(t, "dankshell-u2f", "#%PAM-1.0\n"+LockscreenU2FPamManagedBlockStart+"\nauth required pam_u2f.so old\n"+LockscreenU2FPamManagedBlockEnd+"\n")
+
+		if err := syncLockscreenU2FPamConfigWithDeps(func(string) {}, "", true, env.deps(false)); err != nil {
+			t.Fatalf("syncLockscreenU2FPamConfigWithDeps returned error: %v", err)
+		}
+		if got := readFileString(t, env.dankshellU2fPath); got != buildManagedLockscreenU2FPamContent() {
+			t.Fatalf("managed dankshell-u2f was not rewritten:\n%s", got)
+		}
+	})
+
+	t.Run("disabled removes DMS-managed file", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.writePamFile(t, "dankshell-u2f", buildManagedLockscreenU2FPamContent())
+
+		var logs []string
+		err := syncLockscreenU2FPamConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", false, env.deps(false))
+		if err != nil {
+			t.Fatalf("syncLockscreenU2FPamConfigWithDeps returned error: %v", err)
+		}
+		if _, err := os.Stat(env.dankshellU2fPath); !os.IsNotExist(err) {
+			t.Fatalf("expected managed dankshell-u2f to be removed, stat err = %v", err)
+		}
+		if len(logs) == 0 || !strings.Contains(logs[len(logs)-1], "Removed DMS-managed /etc/pam.d/dankshell-u2f") {
+			t.Fatalf("expected removal log, got %v", logs)
+		}
+	})
+
+	t.Run("disabled preserves custom file", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		customContent := "#%PAM-1.0\nauth required pam_u2f.so cue\n"
+		env.writePamFile(t, "dankshell-u2f", customContent)
+
+		var logs []string
+		err := syncLockscreenU2FPamConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", false, env.deps(false))
+		if err != nil {
+			t.Fatalf("syncLockscreenU2FPamConfigWithDeps returned error: %v", err)
+		}
+		if got := readFileString(t, env.dankshellU2fPath); got != customContent {
+			t.Fatalf("custom dankshell-u2f content changed\ngot:\n%s\nwant:\n%s", got, customContent)
+		}
+		if len(logs) == 0 || !strings.Contains(logs[0], "Custom /etc/pam.d/dankshell-u2f found") {
+			t.Fatalf("expected custom-file log, got %v", logs)
+		}
+	})
+}
+
+func TestSyncGreeterPamConfigWithDeps(t *testing.T) {
+	t.Parallel()
+
+	t.Run("adds managed block for enabled auth modules", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.availableModules["pam_u2f.so"] = true
+		env.writePamFile(t, "greetd", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so\naccount required pam_unix.so\n")
+
+		settings := AuthSettings{GreeterEnableFprint: true, GreeterEnableU2f: true}
+		if err := syncGreeterPamConfigWithDeps(func(string) {}, "", settings, false, env.deps(false)); err != nil {
+			t.Fatalf("syncGreeterPamConfigWithDeps returned error: %v", err)
+		}
+
+		got := readFileString(t, env.greetdPath)
+		for _, want := range []string{
+			GreeterPamManagedBlockStart,
+			"auth sufficient pam_fprintd.so max-tries=1 timeout=5",
+			"auth sufficient pam_u2f.so cue nouserok timeout=10",
+			GreeterPamManagedBlockEnd,
+		} {
+			if !strings.Contains(got, want) {
+				t.Errorf("missing expected string %q in greetd PAM:\n%s", want, got)
+			}
+		}
+		if strings.Index(got, GreeterPamManagedBlockStart) > strings.Index(got, "auth include system-auth") {
+			t.Fatalf("managed block was not inserted before first auth line:\n%s", got)
+		}
+	})
+
+	t.Run("avoids duplicate fingerprint when included stack already provides it", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.fingerprintAvailable = true
+		original := "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n"
+		env.writePamFile(t, "greetd", original)
+		env.writePamFile(t, "system-auth", "auth sufficient pam_fprintd.so max-tries=1\nauth sufficient pam_unix.so\n")
+
+		settings := AuthSettings{GreeterEnableFprint: true}
+		if err := syncGreeterPamConfigWithDeps(func(string) {}, "", settings, false, env.deps(false)); err != nil {
+			t.Fatalf("syncGreeterPamConfigWithDeps returned error: %v", err)
+		}
+
+		got := readFileString(t, env.greetdPath)
+		if got != original {
+			t.Fatalf("greetd PAM changed despite included pam_fprintd stack\ngot:\n%s\nwant:\n%s", got, original)
+		}
+		if strings.Contains(got, GreeterPamManagedBlockStart) {
+			t.Fatalf("managed block should not be inserted when included stack already has pam_fprintd:\n%s", got)
+		}
+	})
+}
+
+func TestRemoveManagedGreeterPamBlockWithDeps(t *testing.T) {
+	t.Parallel()
+
+	env := newPamTestEnv(t)
+	env.writePamFile(t, "greetd", "#%PAM-1.0\n"+
+		legacyGreeterPamFprintComment+"\n"+
+		"auth sufficient pam_fprintd.so max-tries=1\n"+
+		GreeterPamManagedBlockStart+"\n"+
+		"auth sufficient pam_u2f.so cue nouserok timeout=10\n"+
+		GreeterPamManagedBlockEnd+"\n"+
+		"auth include system-auth\n")
+
+	if err := removeManagedGreeterPamBlockWithDeps(func(string) {}, "", env.deps(false)); err != nil {
+		t.Fatalf("removeManagedGreeterPamBlockWithDeps returned error: %v", err)
+	}
+
+	got := readFileString(t, env.greetdPath)
+	if strings.Contains(got, GreeterPamManagedBlockStart) || strings.Contains(got, legacyGreeterPamFprintComment) {
+		t.Fatalf("managed or legacy DMS auth lines remained in greetd PAM:\n%s", got)
+	}
+	if !strings.Contains(got, "auth include system-auth") {
+		t.Fatalf("expected non-DMS greetd auth lines to remain:\n%s", got)
+	}
+}
+
+func TestSyncAuthConfigWithDeps(t *testing.T) {
+	t.Parallel()
+
+	t.Run("creates lockscreen targets and skips greetd when greeter is not installed", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.writeSettings(t, `{"enableU2f":true}`)
+		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so try_first_pass nullok\naccount required pam_access.so\n")
+
+		var logs []string
+		err := syncAuthConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(false))
+		if err != nil {
+			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
+		}
+
+		if _, err := os.Stat(env.dankshellPath); err != nil {
+			t.Fatalf("expected dankshell to be created: %v", err)
+		}
+		if got := readFileString(t, env.dankshellU2fPath); got != buildManagedLockscreenU2FPamContent() {
+			t.Fatalf("unexpected dankshell-u2f content:\n%s", got)
+		}
+		if len(logs) == 0 || !strings.Contains(logs[len(logs)-1], "greetd not found") {
+			t.Fatalf("expected greetd skip log, got %v", logs)
+		}
+	})
+
+	t.Run("separate greeter and lockscreen toggles are respected", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.writeSettings(t, `{"enableU2f":false,"greeterEnableFprint":true,"greeterEnableU2f":false}`)
+		env.writePamFile(t, "login", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+		env.writePamFile(t, "system-auth", "auth sufficient pam_unix.so try_first_pass nullok\naccount required pam_access.so\n")
+		env.writePamFile(t, "greetd", "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n")
+
+		err := syncAuthConfigWithDeps(func(string) {}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(false))
+		if err != nil {
+			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
+		}
+
+		dankshell := readFileString(t, env.dankshellPath)
+		if strings.Contains(dankshell, "pam_fprintd") || strings.Contains(dankshell, "pam_u2f") {
+			t.Fatalf("lockscreen PAM should strip fingerprint and U2F modules:\n%s", dankshell)
+		}
+		if _, err := os.Stat(env.dankshellU2fPath); !os.IsNotExist(err) {
+			t.Fatalf("expected dankshell-u2f to remain absent when enableU2f is false, stat err = %v", err)
+		}
+
+		greetd := readFileString(t, env.greetdPath)
+		if !strings.Contains(greetd, "auth sufficient pam_fprintd.so max-tries=1 timeout=5") {
+			t.Fatalf("expected greetd PAM to receive fingerprint auth block:\n%s", greetd)
+		}
+		if strings.Contains(greetd, "auth sufficient pam_u2f.so cue nouserok timeout=10") {
+			t.Fatalf("did not expect greetd PAM to receive U2F auth block:\n%s", greetd)
+		}
+	})
+
+	t.Run("NixOS remains informational and non-mutating", func(t *testing.T) {
+		t.Parallel()
+
+		env := newPamTestEnv(t)
+		env.availableModules["pam_fprintd.so"] = true
+		env.availableModules["pam_u2f.so"] = true
+		env.writeSettings(t, `{"enableU2f":true,"greeterEnableFprint":true,"greeterEnableU2f":true}`)
+		originalGreetd := "#%PAM-1.0\nauth include system-auth\naccount include system-auth\n"
+		env.writePamFile(t, "greetd", originalGreetd)
+
+		var logs []string
+		err := syncAuthConfigWithDeps(func(msg string) {
+			logs = append(logs, msg)
+		}, "", SyncAuthOptions{HomeDir: env.homeDir}, env.deps(true))
+		if err != nil {
+			t.Fatalf("syncAuthConfigWithDeps returned error: %v", err)
+		}
+
+		if _, err := os.Stat(env.dankshellPath); !os.IsNotExist(err) {
+			t.Fatalf("expected dankshell to remain absent on NixOS path, stat err = %v", err)
+		}
+		if _, err := os.Stat(env.dankshellU2fPath); !os.IsNotExist(err) {
+			t.Fatalf("expected dankshell-u2f to remain absent on NixOS path, stat err = %v", err)
+		}
+		if got := readFileString(t, env.greetdPath); got != originalGreetd {
+			t.Fatalf("expected greetd PAM to remain unchanged on NixOS path\ngot:\n%s\nwant:\n%s", got, originalGreetd)
+		}
+		if len(logs) < 2 || !strings.Contains(strings.Join(logs, "\n"), "NixOS detected") {
+			t.Fatalf("expected informational NixOS logs, got %v", logs)
+		}
+	})
+}

core/internal/privesc/privesc.go

@@ -0,0 +1,385 @@
+package privesc
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+// Tool identifies a privilege-escalation binary.
+type Tool string
+
+const (
+	ToolSudo Tool = "sudo"
+	ToolDoas Tool = "doas"
+	ToolRun0 Tool = "run0"
+)
+
+// EnvVar selects a specific tool when set to one of: sudo, doas, run0.
+const EnvVar = "DMS_PRIVESC"
+
+var detectionOrder = []Tool{ToolSudo, ToolDoas, ToolRun0}
+
+var (
+	detectOnce   sync.Once
+	detected     Tool
+	detectErr    error
+	userSelected bool
+)
+
+// Detect returns the tool that should be used for privilege escalation.
+// The result is cached after the first call.
+func Detect() (Tool, error) {
+	detectOnce.Do(func() {
+		detected, detectErr = detectTool()
+	})
+	return detected, detectErr
+}
+
+// ResetForTesting clears cached detection state.
+func ResetForTesting() {
+	detectOnce = sync.Once{}
+	detected = ""
+	detectErr = nil
+	userSelected = false
+}
+
+// AvailableTools returns the set of supported tools that are installed on
+// PATH, in detection-precedence order.
+func AvailableTools() []Tool {
+	var out []Tool
+	for _, t := range detectionOrder {
+		if t.Available() {
+			out = append(out, t)
+		}
+	}
+	return out
+}
+
+// EnvOverride returns the tool selected by the $DMS_PRIVESC env var (if any)
+// along with ok=true when the variable is set. An empty or unset variable
+// returns ok=false.
+func EnvOverride() (Tool, bool) {
+	v := strings.ToLower(strings.TrimSpace(os.Getenv(EnvVar)))
+	if v == "" {
+		return "", false
+	}
+	return Tool(v), true
+}
+
+// SetTool forces the detected tool to t, bypassing autodetection. Intended
+// for use after the caller has prompted the user for a selection.
+func SetTool(t Tool) error {
+	if !t.Available() {
+		return fmt.Errorf("%q is not installed", t.Name())
+	}
+	detectOnce = sync.Once{}
+	detectOnce.Do(func() {
+		detected = t
+		detectErr = nil
+	})
+	userSelected = true
+	return nil
+}
+
+func detectTool() (Tool, error) {
+	switch override := strings.ToLower(strings.TrimSpace(os.Getenv(EnvVar))); override {
+	case "":
+		// fall through to autodetect
+	case string(ToolSudo), string(ToolDoas), string(ToolRun0):
+		t := Tool(override)
+		if !t.Available() {
+			return "", fmt.Errorf("%s=%s but %q is not installed", EnvVar, override, t.Name())
+		}
+		return t, nil
+	default:
+		return "", fmt.Errorf("invalid %s=%q: must be one of sudo, doas, run0", EnvVar, override)
+	}
+
+	for _, t := range detectionOrder {
+		if t.Available() {
+			return t, nil
+		}
+	}
+	return "", fmt.Errorf("no supported privilege escalation tool found (tried: sudo, doas, run0)")
+}
+
+// Name returns the binary name.
+func (t Tool) Name() string { return string(t) }
+
+// Available reports whether this tool's binary is on PATH.
+func (t Tool) Available() bool {
+	if t == "" {
+		return false
+	}
+	_, err := exec.LookPath(string(t))
+	return err == nil
+}
+
+// SupportsStdinPassword reports whether the tool can accept a password via
+// stdin. Only sudo (-S) supports this.
+func (t Tool) SupportsStdinPassword() bool {
+	return t == ToolSudo
+}
+
+// EscapeSingleQuotes escapes single quotes for safe inclusion inside a
+// bash single-quoted string.
+func EscapeSingleQuotes(s string) string {
+	return strings.ReplaceAll(s, "'", "'\\''")
+}
+
+// MakeCommand returns a bash command string that runs `command` with the
+// detected tool. When the tool supports stdin passwords and password is
+// non-empty, the password is piped in. Otherwise the tool is invoked with
+// no non-interactive flag so that an interactive TTY prompt is still
+// possible for CLI callers.
+//
+// If detection fails, the returned shell string exits 1 with an error
+// message so callers that treat the *exec.Cmd as infallible still fail
+// deterministically.
+func MakeCommand(password, command string) string {
+	t, err := Detect()
+	if err != nil {
+		return failingShell(err)
+	}
+
+	switch t {
+	case ToolSudo:
+		if password != "" {
+			return fmt.Sprintf("echo '%s' | sudo -S %s", EscapeSingleQuotes(password), command)
+		}
+		return fmt.Sprintf("sudo %s", command)
+	case ToolDoas:
+		return fmt.Sprintf("doas sh -c '%s'", EscapeSingleQuotes(command))
+	case ToolRun0:
+		return fmt.Sprintf("run0 sh -c '%s'", EscapeSingleQuotes(command))
+	default:
+		return failingShell(fmt.Errorf("unsupported privilege tool: %q", t))
+	}
+}
+
+// ExecCommand builds an exec.Cmd that runs `command` as root via the
+// detected tool. Detection errors surface at Run() time as a failing
+// command writing a clear error to stderr.
+func ExecCommand(ctx context.Context, password, command string) *exec.Cmd {
+	return exec.CommandContext(ctx, "bash", "-c", MakeCommand(password, command))
+}
+
+// ExecArgv builds an exec.Cmd that runs argv as root via the detected tool.
+// No stdin password is supplied; callers relying on non-interactive success
+// should ensure cached credentials are present (see CheckCached).
+func ExecArgv(ctx context.Context, argv ...string) *exec.Cmd {
+	if len(argv) == 0 {
+		return exec.CommandContext(ctx, "bash", "-c", failingShell(fmt.Errorf("privesc.ExecArgv: argv must not be empty")))
+	}
+	t, err := Detect()
+	if err != nil {
+		return exec.CommandContext(ctx, "bash", "-c", failingShell(err))
+	}
+
+	switch t {
+	case ToolSudo, ToolDoas:
+		return exec.CommandContext(ctx, string(t), argv...)
+	case ToolRun0:
+		return exec.CommandContext(ctx, "run0", argv...)
+	default:
+		return exec.CommandContext(ctx, "bash", "-c", failingShell(fmt.Errorf("unsupported privilege tool: %q", t)))
+	}
+}
+
+func failingShell(err error) string {
+	return fmt.Sprintf("printf 'privesc: %%s\\n' '%s' >&2; exit 1", EscapeSingleQuotes(err.Error()))
+}
+
+// CheckCached runs a non-interactive credential probe. Returns nil if the
+// tool will run commands without prompting (cached credentials, nopass, or
+// polkit rule).
+func CheckCached(ctx context.Context) error {
+	t, err := Detect()
+	if err != nil {
+		return err
+	}
+
+	var cmd *exec.Cmd
+	switch t {
+	case ToolSudo:
+		cmd = exec.CommandContext(ctx, "sudo", "-n", "true")
+	case ToolDoas:
+		cmd = exec.CommandContext(ctx, "doas", "-n", "true")
+	case ToolRun0:
+		cmd = exec.CommandContext(ctx, "run0", "--no-ask-password", "true")
+	default:
+		return fmt.Errorf("unsupported privilege tool: %q", t)
+	}
+	return cmd.Run()
+}
+
+// ClearCache invalidates any cached credentials. No-op for tools that do
+// not expose a cache-clear operation.
+func ClearCache(ctx context.Context) error {
+	t, err := Detect()
+	if err != nil {
+		return err
+	}
+	switch t {
+	case ToolSudo:
+		return exec.CommandContext(ctx, "sudo", "-k").Run()
+	default:
+		return nil
+	}
+}
+
+// ValidateWithAskpass validates cached credentials using an askpass helper
+// script. Only sudo supports this mechanism; the TUI uses it to trigger
+// fingerprint authentication via PAM.
+func ValidateWithAskpass(ctx context.Context, askpassScript string) error {
+	t, err := Detect()
+	if err != nil {
+		return err
+	}
+	if t != ToolSudo {
+		return fmt.Errorf("askpass validation requires sudo (detected: %s)", t)
+	}
+	cmd := exec.CommandContext(ctx, "sudo", "-A", "-v")
+	cmd.Env = append(os.Environ(), fmt.Sprintf("SUDO_ASKPASS=%s", askpassScript))
+	return cmd.Run()
+}
+
+// ValidatePassword validates the given password. Only sudo supports this
+// (via `sudo -S -v`); for other tools the caller should fall back to
+// CheckCached.
+func ValidatePassword(ctx context.Context, password string) error {
+	t, err := Detect()
+	if err != nil {
+		return err
+	}
+	if t != ToolSudo {
+		return fmt.Errorf("password validation requires sudo (detected: %s)", t)
+	}
+
+	cmd := exec.CommandContext(ctx, "sudo", "-S", "-v")
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return err
+	}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	if _, err := fmt.Fprintf(stdin, "%s\n", password); err != nil {
+		stdin.Close()
+		_ = cmd.Wait()
+		return err
+	}
+	stdin.Close()
+	return cmd.Wait()
+}
+
+// QuoteArgsForShell wraps each argv element in single quotes so the result
+// can be safely passed to bash -c.
+func QuoteArgsForShell(argv []string) string {
+	parts := make([]string, len(argv))
+	for i, a := range argv {
+		parts[i] = "'" + EscapeSingleQuotes(a) + "'"
+	}
+	return strings.Join(parts, " ")
+}
+
+// Run invokes argv with privilege escalation. When the tool supports stdin
+// passwords and password is non-empty, the password is piped in. Otherwise
+// argv is invoked directly, which may prompt on a TTY.
+// Stdout and Stderr are inherited from the current process.
+func Run(ctx context.Context, password string, argv ...string) error {
+	if len(argv) == 0 {
+		return fmt.Errorf("privesc.Run: argv must not be empty")
+	}
+	t, err := Detect()
+	if err != nil {
+		return err
+	}
+
+	var cmd *exec.Cmd
+	switch {
+	case t == ToolSudo && password != "":
+		cmd = ExecCommand(ctx, password, QuoteArgsForShell(argv))
+	default:
+		cmd = ExecArgv(ctx, argv...)
+	}
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+
+// stdinIsTTY reports whether stdin is a character device (interactive
+// terminal) rather than a pipe or file.
+func stdinIsTTY() bool {
+	fi, err := os.Stdin.Stat()
+	if err != nil {
+		return false
+	}
+	return (fi.Mode() & os.ModeCharDevice) != 0
+}
+
+// PromptCLI interactively prompts the user to pick a privilege tool when more
+// than one is installed and $DMS_PRIVESC is not set. If stdin is not a TTY,
+// or only one tool is available, or the env var is set, the detected tool is
+// returned without any prompt.
+//
+// The prompt is written to out (typically os.Stdout/os.Stderr) and input is
+// read from in. EOF or empty input selects the first option.
+func PromptCLI(out io.Writer, in io.Reader) (Tool, error) {
+	if userSelected {
+		return Detect()
+	}
+	if _, envSet := EnvOverride(); envSet {
+		return Detect()
+	}
+
+	tools := AvailableTools()
+	switch len(tools) {
+	case 0:
+		return "", fmt.Errorf("no supported privilege tool (sudo/doas/run0) found on PATH")
+	case 1:
+		if err := SetTool(tools[0]); err != nil {
+			return "", err
+		}
+		return tools[0], nil
+	}
+
+	if !stdinIsTTY() {
+		return Detect()
+	}
+
+	fmt.Fprintln(out, "Multiple privilege escalation tools detected:")
+	for i, t := range tools {
+		fmt.Fprintf(out, "  [%d] %s\n", i+1, t.Name())
+	}
+	fmt.Fprintf(out, "Choose one [1-%d] (default 1, or set %s=<tool> to skip): ", len(tools), EnvVar)
+
+	reader := bufio.NewReader(in)
+	line, err := reader.ReadString('\n')
+	if err != nil && err != io.EOF {
+		return "", fmt.Errorf("failed to read selection: %w", err)
+	}
+	line = strings.TrimSpace(line)
+
+	idx := 1
+	if line != "" {
+		n, convErr := strconv.Atoi(line)
+		if convErr != nil || n < 1 || n > len(tools) {
+			return "", fmt.Errorf("invalid selection %q", line)
+		}
+		idx = n
+	}
+
+	chosen := tools[idx-1]
+	if err := SetTool(chosen); err != nil {
+		return "", err
+	}
+	return chosen, nil
+}

core/internal/proto/ext_workspace/workspace.go

@@ -258,7 +258,7 @@ func (i *ExtWorkspaceManagerV1) Dispatch(opcode uint32, fd int, data []byte) {
 		l := 0
 		objectID := client.Uint32(data[l : l+4])
 		proxy := i.Context().GetProxy(objectID)
-		if proxy != nil {
+		if proxy != nil && !proxy.IsZombie() {
 			e.WorkspaceGroup = proxy.(*ExtWorkspaceGroupHandleV1)
 		} else {
 			groupHandle := &ExtWorkspaceGroupHandleV1{}
@@ -278,7 +278,7 @@ func (i *ExtWorkspaceManagerV1) Dispatch(opcode uint32, fd int, data []byte) {
 		l := 0
 		objectID := client.Uint32(data[l : l+4])
 		proxy := i.Context().GetProxy(objectID)
-		if proxy != nil {
+		if proxy != nil && !proxy.IsZombie() {
 			e.Workspace = proxy.(*ExtWorkspaceHandleV1)
 		} else {
 			wsHandle := &ExtWorkspaceHandleV1{}

core/internal/screenshot/compositor.go

@@ -444,20 +444,21 @@ func GetFocusedMonitor() string {
 
 type outputInfo struct {
 	x, y      int32
+	scale     float64
 	transform int32
 }
 
-func getOutputInfo(outputName string) (*outputInfo, bool) {
+func getAllOutputInfos() map[string]*outputInfo {
 	display, err := client.Connect("")
 	if err != nil {
-		return nil, false
+		return nil
 	}
 	ctx := display.Context()
 	defer ctx.Close()
 
 	registry, err := display.GetRegistry()
 	if err != nil {
-		return nil, false
+		return nil
 	}
 
 	var outputManager *wlr_output_management.ZwlrOutputManagerV1
@@ -476,16 +477,17 @@ func getOutputInfo(outputName string) (*outputInfo, bool) {
 	})
 
 	if err := wlhelpers.Roundtrip(display, ctx); err != nil {
-		return nil, false
+		return nil
 	}
 
 	if outputManager == nil {
-		return nil, false
+		return nil
 	}
 
 	type headState struct {
 		name      string
 		x, y      int32
+		scale     float64
 		transform int32
 	}
 	heads := make(map[*wlr_output_management.ZwlrOutputHeadV1]*headState)
@@ -501,6 +503,9 @@ func getOutputInfo(outputName string) (*outputInfo, bool) {
 			state.x = pe.X
 			state.y = pe.Y
 		})
+		e.Head.SetScaleHandler(func(se wlr_output_management.ZwlrOutputHeadV1ScaleEvent) {
+			state.scale = se.Scale
+		})
 		e.Head.SetTransformHandler(func(te wlr_output_management.ZwlrOutputHeadV1TransformEvent) {
 			state.transform = te.Transform
 		})
@@ -511,21 +516,32 @@ func getOutputInfo(outputName string) (*outputInfo, bool) {
 
 	for !done {
 		if err := ctx.Dispatch(); err != nil {
-			return nil, false
+			return nil
 		}
 	}
 
+	result := make(map[string]*outputInfo, len(heads))
 	for _, state := range heads {
-		if state.name == outputName {
-			return &outputInfo{
-				x:         state.x,
-				y:         state.y,
-				transform: state.transform,
-			}, true
+		if state.name == "" {
+			continue
+		}
+		result[state.name] = &outputInfo{
+			x:         state.x,
+			y:         state.y,
+			scale:     state.scale,
+			transform: state.transform,
 		}
 	}
+	return result
+}
 
-	return nil, false
+func getOutputInfo(outputName string) (*outputInfo, bool) {
+	infos := getAllOutputInfos()
+	if infos == nil {
+		return nil, false
+	}
+	info, ok := infos[outputName]
+	return info, ok
 }
 
 func getDWLActiveWindow() (*WindowGeometry, error) {

core/internal/screenshot/region.go

@@ -108,12 +108,16 @@ func NewRegionSelector(s *Screenshoter) *RegionSelector {
 		screenshoter:       s,
 		outputs:            make(map[uint32]*WaylandOutput),
 		preCapture:         make(map[*WaylandOutput]*PreCapture),
-		showCapturedCursor: true,
+		showCapturedCursor: s.config.Cursor == CursorOn,
 	}
 }
 
 func (r *RegionSelector) Run() (*CaptureResult, bool, error) {
-	r.preSelect = GetLastRegion()
+	if r.screenshoter != nil && r.screenshoter.config.Reset {
+		r.preSelect = Region{}
+	} else {
+		r.preSelect = GetLastRegion()
+	}
 
 	if err := r.connect(); err != nil {
 		return nil, false, fmt.Errorf("wayland connect: %w", err)

core/internal/screenshot/region_input.go

@@ -114,6 +114,9 @@ func (r *RegionSelector) setupPointerHandlers() {
 				for _, os := range r.surfaces {
 					r.redrawSurface(os)
 				}
+				if r.screenshoter != nil && r.screenshoter.config.NoConfirm && r.selection.hasSelection {
+					r.finishSelection()
+				}
 			}
 		default:
 			r.cancelled = true

core/internal/screenshot/region_render.go

@@ -138,9 +138,13 @@ func (r *RegionSelector) drawHUD(data []byte, stride, bufW, bufH int, format uin
 	if !r.showCapturedCursor {
 		cursorLabel = "show"
 	}
+	captureKey := "Space/Enter"
+	if r.screenshoter != nil && r.screenshoter.config.NoConfirm {
+		captureKey = "Drag+Release"
+	}
 
 	items := []struct{ key, desc string }{
-		{"Space/Enter", "capture"},
+		{captureKey, "capture"},
 		{"P", cursorLabel + " cursor"},
 		{"Esc", "cancel"},
 	}

core/internal/screenshot/screenshot.go

@@ -2,6 +2,7 @@ package screenshot
 
 import (
 	"fmt"
+	"math"
 	"sync"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
@@ -106,6 +107,12 @@ func (s *Screenshoter) captureLastRegion() (*CaptureResult, error) {
 }
 
 func (s *Screenshoter) captureRegion() (*CaptureResult, error) {
+	if s.config.Reset {
+		if err := SaveLastRegion(Region{}); err != nil {
+			log.Debug("failed to reset last region", "err", err)
+		}
+	}
+
 	selector := NewRegionSelector(s)
 	result, cancelled, err := selector.Run()
 	if err != nil {
@@ -298,22 +305,20 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 	if len(outputs) == 0 {
 		return nil, fmt.Errorf("no outputs available")
 	}
-
 	if len(outputs) == 1 {
 		return s.captureWholeOutput(outputs[0])
 	}
 
-	// Capture all outputs first to get actual buffer sizes
-	type capturedOutput struct {
-		output *WaylandOutput
-		result *CaptureResult
-		physX  int
-		physY  int
-	}
-	captured := make([]capturedOutput, 0, len(outputs))
+	wlrInfos := getAllOutputInfos()
 
-	var minX, minY, maxX, maxY int
-	first := true
+	type pendingOutput struct {
+		result *CaptureResult
+		logX   float64
+		logY   float64
+		scale  float64
+	}
+	var pending []pendingOutput
+	maxScale := 1.0
 
 	for _, output := range outputs {
 		result, err := s.captureWholeOutput(output)
@@ -322,50 +327,74 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 			continue
 		}
 
-		outX, outY := output.x, output.y
+		logX, logY := float64(output.x), float64(output.y)
 		scale := float64(output.scale)
+
 		switch DetectCompositor() {
 		case CompositorHyprland:
 			if hx, hy, _, _, ok := GetHyprlandMonitorGeometry(output.name); ok {
-				outX, outY = hx, hy
+				logX, logY = float64(hx), float64(hy)
 			}
-			if s := GetHyprlandMonitorScale(output.name); s > 0 {
-				scale = s
+			if hs := GetHyprlandMonitorScale(output.name); hs > 0 {
+				scale = hs
 			}
-		case CompositorDWL:
-			if info, ok := getOutputInfo(output.name); ok {
-				outX, outY = info.x, info.y
+		default:
+			if wlrInfos != nil {
+				if info, ok := wlrInfos[output.name]; ok {
+					logX, logY = float64(info.x), float64(info.y)
+					if info.scale > 0 {
+						scale = info.scale
+					}
+				}
 			}
 		}
+
 		if scale <= 0 {
 			scale = 1.0
 		}
 
-		physX := int(float64(outX) * scale)
-		physY := int(float64(outY) * scale)
+		pending = append(pending, pendingOutput{result: result, logX: logX, logY: logY, scale: scale})
+		if scale > maxScale {
+			maxScale = scale
+		}
+	}
 
-		captured = append(captured, capturedOutput{
-			output: output,
-			result: result,
-			physX:  physX,
-			physY:  physY,
-		})
+	if len(pending) == 0 {
+		return nil, fmt.Errorf("failed to capture any outputs")
+	}
+	if len(pending) == 1 {
+		return pending[0].result, nil
+	}
 
-		right := physX + result.Buffer.Width
-		bottom := physY + result.Buffer.Height
+	type layoutEntry struct {
+		result  *CaptureResult
+		canvasX int
+		canvasY int
+		canvasW int
+		canvasH int
+	}
+	entries := make([]layoutEntry, len(pending))
+	var minX, minY, maxX, maxY int
 
-		if first {
-			minX, minY = physX, physY
-			maxX, maxY = right, bottom
-			first = false
+	for i, p := range pending {
+		cx := int(math.Round(p.logX * maxScale))
+		cy := int(math.Round(p.logY * maxScale))
+		cw := int(math.Round(float64(p.result.Buffer.Width) * maxScale / p.scale))
+		ch := int(math.Round(float64(p.result.Buffer.Height) * maxScale / p.scale))
+
+		entries[i] = layoutEntry{result: p.result, canvasX: cx, canvasY: cy, canvasW: cw, canvasH: ch}
+
+		right := cx + cw
+		bottom := cy + ch
+		if i == 0 {
+			minX, minY, maxX, maxY = cx, cy, right, bottom
 			continue
 		}
-
-		if physX < minX {
-			minX = physX
+		if cx < minX {
+			minX = cx
 		}
-		if physY < minY {
-			minY = physY
+		if cy < minY {
+			minY = cy
 		}
 		if right > maxX {
 			maxX = right
@@ -375,35 +404,26 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 		}
 	}
 
-	if len(captured) == 0 {
-		return nil, fmt.Errorf("failed to capture any outputs")
-	}
-
-	if len(captured) == 1 {
-		return captured[0].result, nil
-	}
-
 	totalW := maxX - minX
 	totalH := maxY - minY
-
-	compositeStride := totalW * 4
-	composite, err := CreateShmBuffer(totalW, totalH, compositeStride)
+	composite, err := CreateShmBuffer(totalW, totalH, totalW*4)
 	if err != nil {
-		for _, c := range captured {
-			c.result.Buffer.Close()
+		for _, e := range entries {
+			e.result.Buffer.Close()
 		}
 		return nil, fmt.Errorf("create composite buffer: %w", err)
 	}
-
 	composite.Clear()
 
 	var format uint32
-	for _, c := range captured {
+	for _, e := range entries {
 		if format == 0 {
-			format = c.result.Format
+			format = e.result.Format
 		}
-		s.blitBuffer(composite, c.result.Buffer, c.physX-minX, c.physY-minY, c.result.YInverted)
-		c.result.Buffer.Close()
+		s.blitBufferScaled(composite, e.result.Buffer,
+			e.canvasX-minX, e.canvasY-minY, e.canvasW, e.canvasH,
+			e.result.YInverted)
+		e.result.Buffer.Close()
 	}
 
 	return &CaptureResult{
@@ -413,32 +433,44 @@ func (s *Screenshoter) captureAllScreens() (*CaptureResult, error) {
 	}, nil
 }
 
-func (s *Screenshoter) blitBuffer(dst, src *ShmBuffer, dstX, dstY int, yInverted bool) {
+func (s *Screenshoter) blitBufferScaled(dst, src *ShmBuffer, dstX, dstY, dstW, dstH int, yInverted bool) {
+	if dstW <= 0 || dstH <= 0 {
+		return
+	}
+
 	srcData := src.Data()
 	dstData := dst.Data()
 
-	for srcY := 0; srcY < src.Height; srcY++ {
-		actualSrcY := srcY
-		if yInverted {
-			actualSrcY = src.Height - 1 - srcY
-		}
-
-		dy := dstY + srcY
-		if dy < 0 || dy >= dst.Height {
+	for dy := 0; dy < dstH; dy++ {
+		canvasY := dstY + dy
+		if canvasY < 0 || canvasY >= dst.Height {
 			continue
 		}
 
-		srcRowOff := actualSrcY * src.Stride
-		dstRowOff := dy * dst.Stride
+		srcY := dy * src.Height / dstH
+		if yInverted {
+			srcY = src.Height - 1 - srcY
+		}
+		if srcY < 0 || srcY >= src.Height {
+			continue
+		}
 
-		for srcX := 0; srcX < src.Width; srcX++ {
-			dx := dstX + srcX
-			if dx < 0 || dx >= dst.Width {
+		srcRowOff := srcY * src.Stride
+		dstRowOff := canvasY * dst.Stride
+
+		for dx := 0; dx < dstW; dx++ {
+			canvasX := dstX + dx
+			if canvasX < 0 || canvasX >= dst.Width {
+				continue
+			}
+
+			srcX := dx * src.Width / dstW
+			if srcX >= src.Width {
 				continue
 			}
 
 			si := srcRowOff + srcX*4
-			di := dstRowOff + dx*4
+			di := dstRowOff + canvasX*4
 
 			if si+3 >= len(srcData) || di+3 >= len(dstData) {
 				continue
@@ -453,10 +485,7 @@ func (s *Screenshoter) blitBuffer(dst, src *ShmBuffer, dstX, dstY int, yInverted
 }
 
 func (s *Screenshoter) captureWholeOutput(output *WaylandOutput) (*CaptureResult, error) {
-	cursor := int32(0)
-	if s.config.IncludeCursor {
-		cursor = 1
-	}
+	cursor := int32(s.config.Cursor)
 
 	frame, err := s.screencopy.CaptureOutput(cursor, output.wlOutput)
 	if err != nil {
@@ -624,10 +653,7 @@ func (s *Screenshoter) captureRegionOnOutput(output *WaylandOutput, region Regio
 		}
 	}
 
-	cursor := int32(0)
-	if s.config.IncludeCursor {
-		cursor = 1
-	}
+	cursor := int32(s.config.Cursor)
 
 	frame, err := s.screencopy.CaptureOutputRegion(cursor, output.wlOutput, localX, localY, w, h)
 	if err != nil {

core/internal/screenshot/types.go

@@ -19,6 +19,13 @@ const (
 	FormatPPM
 )
 
+type CursorMode int
+
+const (
+	CursorOff CursorMode = iota
+	CursorOn
+)
+
 type Region struct {
 	X      int32  `json:"x"`
 	Y      int32  `json:"y"`
@@ -42,29 +49,33 @@ type Output struct {
 }
 
 type Config struct {
-	Mode          Mode
-	OutputName    string
-	IncludeCursor bool
-	Format        Format
-	Quality       int
-	OutputDir     string
-	Filename      string
-	Clipboard     bool
-	SaveFile      bool
-	Notify        bool
-	Stdout        bool
+	Mode       Mode
+	OutputName string
+	Cursor     CursorMode
+	NoConfirm  bool
+	Reset      bool
+	Format     Format
+	Quality    int
+	OutputDir  string
+	Filename   string
+	Clipboard  bool
+	SaveFile   bool
+	Notify     bool
+	Stdout     bool
 }
 
 func DefaultConfig() Config {
 	return Config{
-		Mode:          ModeRegion,
-		IncludeCursor: false,
-		Format:        FormatPNG,
-		Quality:       90,
-		OutputDir:     "",
-		Filename:      "",
-		Clipboard:     true,
-		SaveFile:      true,
-		Notify:        true,
+		Mode:      ModeRegion,
+		Cursor:    CursorOff,
+		NoConfirm: false,
+		Reset:     false,
+		Format:    FormatPNG,
+		Quality:   90,
+		OutputDir: "",
+		Filename:  "",
+		Clipboard: true,
+		SaveFile:  true,
+		Notify:    true,
 	}
 }

core/internal/server/bluez/manager.go

@@ -311,6 +311,10 @@ func (m *Manager) handleDevicePropertiesChanged(path dbus.ObjectPath, changed ma
 				select {
 				case m.eventQueue <- func() {
 					time.Sleep(300 * time.Millisecond)
+					log.Infof("[Bluetooth] Auto-trusting newly paired device: %s", devicePath)
+					if err := m.TrustDevice(devicePath, true); err != nil {
+						log.Warnf("[Bluetooth] Auto-trust failed: %v", err)
+					}
 					log.Infof("[Bluetooth] Auto-connecting newly paired device: %s", devicePath)
 					if err := m.ConnectDevice(devicePath); err != nil {
 						log.Warnf("[Bluetooth] Auto-connect failed: %v", err)

core/internal/server/brightness/ddc.go

@@ -215,31 +215,34 @@ func (b *DDCBackend) SetBrightnessWithExponent(id string, value int, exponential
 		callback: callback,
 	}
 
-	if timer, exists := b.debounceTimers[id]; exists {
-		timer.Reset(200 * time.Millisecond)
-	} else {
-		b.debounceTimers[id] = time.AfterFunc(200*time.Millisecond, func() {
-			b.debounceMutex.Lock()
-			pending, exists := b.debouncePending[id]
-			if exists {
-				delete(b.debouncePending, id)
-			}
-			b.debounceMutex.Unlock()
-
-			if !exists {
-				return
-			}
-
-			err := b.setBrightnessImmediateWithExponent(id, pending.percent)
-			if err != nil {
-				log.Debugf("Failed to set brightness for %s: %v", id, err)
-			}
-
-			if pending.callback != nil {
-				pending.callback()
-			}
-		})
+	if existing, exists := b.debounceTimers[id]; exists {
+		if existing.Stop() {
+			b.debounceWg.Done()
+		}
 	}
+
+	b.debounceWg.Add(1)
+	b.debounceTimers[id] = time.AfterFunc(200*time.Millisecond, func() {
+		defer b.debounceWg.Done()
+
+		b.debounceMutex.Lock()
+		pending, hasPending := b.debouncePending[id]
+		delete(b.debouncePending, id)
+		delete(b.debounceTimers, id)
+		b.debounceMutex.Unlock()
+
+		if !hasPending {
+			return
+		}
+
+		if err := b.setBrightnessImmediateWithExponent(id, pending.percent); err != nil {
+			log.Debugf("Failed to set brightness for %s: %v", id, err)
+		}
+
+		if pending.callback != nil {
+			pending.callback()
+		}
+	})
 	b.debounceMutex.Unlock()
 
 	return nil
@@ -490,5 +493,19 @@ func (b *DDCBackend) valueToPercent(value int, max int, exponential bool) int {
 	return percent
 }
 
+func (b *DDCBackend) WaitPending() {
+	done := make(chan struct{})
+	go func() {
+		b.debounceWg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		log.Debug("WaitPending timed out waiting for DDC writes")
+	}
+}
+
 func (b *DDCBackend) Close() {
 }

core/internal/server/brightness/types.go

@@ -84,6 +84,7 @@ type DDCBackend struct {
 	debounceMutex   sync.Mutex
 	debounceTimers  map[string]*time.Timer
 	debouncePending map[string]ddcPendingSet
+	debounceWg      sync.WaitGroup
 }
 
 type ddcPendingSet struct {

core/internal/server/brightness/udev.go

@@ -6,12 +6,20 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"syscall"
 	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/pilebones/go-udev/netlink"
 )
 
+const (
+	udevRecvBufSize = 8 * 1024 * 1024
+	udevMaxRetries  = 5
+	udevBaseDelay   = 2 * time.Second
+	udevMaxDelay    = 60 * time.Second
+)
+
 type UdevMonitor struct {
 	stop          chan struct{}
 	rescanMutex   sync.Mutex
@@ -29,13 +37,6 @@ func NewUdevMonitor(manager *Manager) *UdevMonitor {
 }
 
 func (m *UdevMonitor) run(manager *Manager) {
-	conn := &netlink.UEventConn{}
-	if err := conn.Connect(netlink.UdevEvent); err != nil {
-		log.Errorf("Failed to connect to udev netlink: %v", err)
-		return
-	}
-	defer conn.Close()
-
 	matcher := &netlink.RuleDefinitions{
 		Rules: []netlink.RuleDefinition{
 			{Env: map[string]string{"SUBSYSTEM": "backlight"}},
@@ -48,6 +49,46 @@ func (m *UdevMonitor) run(manager *Manager) {
 		return
 	}
 
+	failures := 0
+	for {
+		if err := m.monitorLoop(manager, matcher); err != nil {
+			log.Errorf("Udev monitor error: %v", err)
+		}
+
+		select {
+		case <-m.stop:
+			return
+		default:
+		}
+
+		failures++
+		if failures > udevMaxRetries {
+			log.Errorf("Udev monitor exceeded %d retries, giving up", udevMaxRetries)
+			return
+		}
+
+		delay := min(udevBaseDelay*time.Duration(1<<(failures-1)), udevMaxDelay)
+		log.Infof("Udev monitor reconnecting in %v (attempt %d/%d)", delay, failures, udevMaxRetries)
+
+		select {
+		case <-m.stop:
+			return
+		case <-time.After(delay):
+		}
+	}
+}
+
+func (m *UdevMonitor) monitorLoop(manager *Manager, matcher *netlink.RuleDefinitions) error {
+	conn := &netlink.UEventConn{}
+	if err := conn.Connect(netlink.UdevEvent); err != nil {
+		return err
+	}
+	defer conn.Close()
+
+	if err := syscall.SetsockoptInt(conn.Fd, syscall.SOL_SOCKET, syscall.SO_RCVBUF, udevRecvBufSize); err != nil {
+		log.Warnf("Failed to set udev socket receive buffer: %v", err)
+	}
+
 	events := make(chan netlink.UEvent)
 	errs := make(chan error)
 	conn.Monitor(events, errs, matcher)
@@ -57,10 +98,9 @@ func (m *UdevMonitor) run(manager *Manager) {
 	for {
 		select {
 		case <-m.stop:
-			return
+			return nil
 		case err := <-errs:
-			log.Errorf("Udev monitor error: %v", err)
-			return
+			return err
 		case event := <-events:
 			m.handleEvent(manager, event)
 		}