add(systemd): dms-tray-watcher service & commands for early tray registration

related #2577

.github/workflows/run-obs.yml

@@ -24,6 +24,7 @@ jobs:
   check-updates:
     name: Check for updates
     runs-on: ubuntu-latest
+    if: github.repository == 'AvengeMedia/DankMaterialShell'
 
     outputs:
       has_updates: ${{ steps.check.outputs.has_updates }}

.github/workflows/run-ppa.yml

@@ -24,6 +24,7 @@ jobs:
   check-updates:
     name: Check package/series updates
     runs-on: ubuntu-latest
+    if: github.repository == 'AvengeMedia/DankMaterialShell'
 
     outputs:
       has_updates: ${{ steps.check.outputs.has_updates }}

.github/workflows/run-xbps.yml

@@ -0,0 +1,268 @@
+name: Void Linux XBPS Repository
+
+on:
+  schedule:
+    - cron: "0 2,5,14,17,20,23 * * *" # 9am, 12pm, 3pm, 6pm, 9pm, 12am EST (UTC times shown)
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      force_rebuild:
+        description: 'Force rebuilding packages even if they already exist in the repository'
+        type: boolean
+        required: false
+        default: false
+      build_git:
+        description: 'Build dms-git package'
+        type: boolean
+        required: false
+        default: true
+      build_dms:
+        description: 'Build stable dms package'
+        type: boolean
+        required: false
+        default: true
+      build_greeter:
+        description: 'Build stable dms-greeter package'
+        type: boolean
+        required: false
+        default: true
+
+permissions:
+  contents: write
+
+jobs:
+  build-and-deploy:
+    name: Build & Deploy XBPS packages
+    runs-on: ubuntu-latest
+    if: github.repository == 'AvengeMedia/DankMaterialShell'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Checkout gh-pages branch
+        run: |
+          git clone --branch gh-pages https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git gh-pages-repo || {
+            echo "⚠️ gh-pages branch not found or empty, initializing a new one..."
+            mkdir gh-pages-repo
+            cd gh-pages-repo
+            git init
+            git checkout -b gh-pages
+            git remote add origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git
+            cd ..
+          }
+
+      - name: Install XBPS Static Utilities
+        run: |
+          mkdir -p ${{ github.workspace }}/xbps
+          curl -s -L https://repo-default.voidlinux.org/static/xbps-static-latest.x86_64-musl.tar.xz | tar -xJ -C ${{ github.workspace }}/xbps
+          echo "${{ github.workspace }}/xbps/usr/bin" >> $GITHUB_PATH
+
+      - name: Clone void-packages
+        run: |
+          git clone --depth=1 https://github.com/void-linux/void-packages.git
+
+      - name: Inject templates
+        run: |
+          cp -R distro/void/srcpkgs/dms void-packages/srcpkgs/
+          cp -R distro/void/srcpkgs/dms-greeter void-packages/srcpkgs/
+          cp -R distro/void/srcpkgs/dms-git void-packages/srcpkgs/
+
+      - name: Enable unprivileged user namespaces (Ubuntu 24.04)
+        run: |
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+
+      - name: Bootstrap xbps-src
+        run: |
+          cd void-packages
+          ./xbps-src binary-bootstrap
+
+      - name: Configure signing keys and trust
+        run: |
+          # Write private key; extract and register the public key
+          echo "${{ secrets.XBPS_PRIVATE_KEY }}" > /tmp/xbps_privkey.pem
+          chmod 600 /tmp/xbps_privkey.pem
+
+          # Extract public key in PEM format
+          openssl rsa -in /tmp/xbps_privkey.pem -pubout -out /tmp/dms-key.pub
+          rm -f /tmp/xbps_privkey.pem
+
+          # Compute MD5 fingerprint in colon-separated hex format
+          FINGERPRINT=$(openssl rsa -pubin -in /tmp/dms-key.pub -outform DER 2>/dev/null | openssl dgst -md5 -c | tr '[:upper:]' '[:lower:]' | awk '{print $NF}')
+
+          # Format key in XML property list (plist) format as expected by xbps
+          mkdir -p /tmp/keys
+          cat <<EOF > "/tmp/keys/${FINGERPRINT}.plist"
+          <?xml version="1.0" encoding="UTF-8"?>
+          <plist version="1.0">
+          <dict>
+          	<key>public-key</key>
+          	<data>$(base64 -w0 /tmp/dms-key.pub)</data>
+          	<key>public-key-size</key>
+          	<integer>4096</integer>
+          	<key>signature-by</key>
+          	<string>AvengeMedia</string>
+          </dict>
+          </plist>
+          EOF
+
+          # Copy keys to all host and chroot trust stores
+          sudo mkdir -p /var/db/xbps/keys
+          sudo cp "/tmp/keys/${FINGERPRINT}.plist" "/var/db/xbps/keys/${FINGERPRINT}.plist"
+
+          mkdir -p void-packages/masterdir/var/db/xbps/keys
+          cp "/tmp/keys/${FINGERPRINT}.plist" "void-packages/masterdir/var/db/xbps/keys/${FINGERPRINT}.plist"
+
+          mkdir -p void-packages/etc/xbps.d/keys
+          cp "/tmp/keys/${FINGERPRINT}.plist" "void-packages/etc/xbps.d/keys/${FINGERPRINT}.plist"
+
+          mkdir -p void-packages/common/repo-keys
+          cp "/tmp/keys/${FINGERPRINT}.plist" "void-packages/common/repo-keys/${FINGERPRINT}.plist"
+
+          rm -rf /tmp/keys /tmp/dms-key.pub
+
+      - name: Configure repositories
+        run: |
+          # Append the repository to repos-remote templates so xbps-src translates it automatically
+          echo "repository=https://avengemedia.github.io/DankLinux/current" >> void-packages/etc/xbps.d/repos-remote.conf
+          echo "repository=https://avengemedia.github.io/DankLinux/current" >> void-packages/etc/xbps.d/repos-remote-x86_64-multilib.conf
+
+          # Add any existing compiled packages to the build cache directory to avoid rebuilds
+          if [ -d "gh-pages-repo/current" ]; then
+            mkdir -p void-packages/hostdir/binpkgs
+            cp -L gh-pages-repo/current/*.xbps void-packages/hostdir/binpkgs/ 2>/dev/null || true
+            xbps-rindex -a void-packages/hostdir/binpkgs/*.xbps 2>/dev/null || true
+          fi
+
+      - name: Build packages
+        run: |
+          mkdir -p gh-pages-repo/current
+
+          BUILD_DMS="${{ github.event.inputs.build_dms || 'true' }}"
+          BUILD_GREETER="${{ github.event.inputs.build_greeter || 'true' }}"
+          BUILD_GIT="${{ github.event.inputs.build_git || 'true' }}"
+          FORCE_REBUILD="${{ github.event.inputs.force_rebuild || 'false' }}"
+
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            BUILD_DMS="false"
+            BUILD_GREETER="false"
+            BUILD_GIT="true"
+          fi
+
+          if [ "${{ github.event_name }}" = "release" ]; then
+            BUILD_DMS="true"
+            BUILD_GREETER="true"
+            BUILD_GIT="false"
+          fi
+
+          echo "=== Starting Builds ==="
+          echo "DMS stable build enabled:     $BUILD_DMS"
+          echo "Greeter stable build enabled: $BUILD_GREETER"
+          echo "Git build enabled:            $BUILD_GIT"
+          echo "Force rebuild:                $FORCE_REBUILD"
+
+          cd void-packages
+
+          # 1. Build dms-git (development package)
+          if [ "$BUILD_GIT" = "true" ]; then
+            # Calculate dynamic git version (tag.commits.hash)
+            GIT_VER=$(git -C .. describe --tags --always | sed 's/^v//; s/-/./g')
+            echo "🔨 Preparing dms-git version $GIT_VER"
+
+            # Stage source tarball in the xbps-src source cache.
+            # --transform adds a top-level directory so xbps-src can extract
+            # into $wrksrc (create_wrksrc=yes handles the rest).
+            SRC_CACHE="hostdir/sources/dms-git-${GIT_VER}"
+            mkdir -p "$SRC_CACHE"
+            tar -czf "${SRC_CACHE}/dms-git-${GIT_VER}.tar.gz" \
+              --exclude=void-packages \
+              --exclude=gh-pages-repo \
+              --exclude=.git \
+              --exclude=danklinux \
+              -C .. .
+
+            CHECKSUM=$(sha256sum "${SRC_CACHE}/dms-git-${GIT_VER}.tar.gz" | cut -d' ' -f1)
+
+            # Dynamically patch template version, checksum, and distfiles
+            sed -i "s/^version=.*/version=${GIT_VER}/" srcpkgs/dms-git/template
+            sed -i "s/^checksum=.*/checksum=${CHECKSUM}/" srcpkgs/dms-git/template
+            sed -i "s|^distfiles=.*|distfiles=\"dms-git-${GIT_VER}.tar.gz\"|" srcpkgs/dms-git/template
+
+            EXPECTED_GIT_FILE="dms-git-${GIT_VER}_1.x86_64.xbps"
+
+            if [ -f "../gh-pages-repo/current/$EXPECTED_GIT_FILE" ] && [ "$FORCE_REBUILD" != "true" ]; then
+              echo "✅ $EXPECTED_GIT_FILE already exists, skipping build."
+            else
+              echo "🔨 Compiling dms-git..."
+              ./xbps-src pkg dms-git
+              rm -f "../gh-pages-repo/current/${EXPECTED_GIT_FILE}"
+              cp -L hostdir/binpkgs/dms-git-*.xbps ../gh-pages-repo/current/
+            fi
+          fi
+
+          # 2. Build stable dms package
+          if [ "$BUILD_DMS" = "true" ]; then
+            STABLE_VER=$(grep -E '^version=' srcpkgs/dms/template | cut -d= -f2 | tr -d '"')
+            STABLE_REV=$(grep -E '^revision=' srcpkgs/dms/template | cut -d= -f2 | tr -d '"')
+
+            EXPECTED_DMS_FILE="dms-${STABLE_VER}_${STABLE_REV}.x86_64.xbps"
+            if [ -f "../gh-pages-repo/current/$EXPECTED_DMS_FILE" ] && [ "$FORCE_REBUILD" != "true" ]; then
+              echo "✅ $EXPECTED_DMS_FILE already exists, skipping build."
+            else
+              echo "🔨 Compiling dms ($STABLE_VER)..."
+              ./xbps-src pkg dms
+              rm -f "../gh-pages-repo/current/${EXPECTED_DMS_FILE}"
+              cp -L hostdir/binpkgs/dms-${STABLE_VER}_${STABLE_REV}.x86_64.xbps ../gh-pages-repo/current/
+            fi
+          fi
+
+          # 3. Build stable dms-greeter package
+          if [ "$BUILD_GREETER" = "true" ]; then
+            GREETER_VER=$(grep -E '^version=' srcpkgs/dms-greeter/template | cut -d= -f2 | tr -d '"')
+            GREETER_REV=$(grep -E '^revision=' srcpkgs/dms-greeter/template | cut -d= -f2 | tr -d '"')
+
+            EXPECTED_GREETER_FILE="dms-greeter-${GREETER_VER}_${GREETER_REV}.x86_64.xbps"
+            if [ -f "../gh-pages-repo/current/$EXPECTED_GREETER_FILE" ] && [ "$FORCE_REBUILD" != "true" ]; then
+              echo "✅ $EXPECTED_GREETER_FILE already exists, skipping build."
+            else
+              echo "🔨 Compiling dms-greeter ($GREETER_VER)..."
+              ./xbps-src pkg dms-greeter
+              rm -f "../gh-pages-repo/current/${EXPECTED_GREETER_FILE}"
+              cp -L hostdir/binpkgs/dms-greeter-${GREETER_VER}_${GREETER_REV}.x86_64.xbps ../gh-pages-repo/current/
+            fi
+          fi
+
+      - name: Index and sign repository
+        run: |
+          cd gh-pages-repo/current
+
+          # Clean up any stale or dangling signature files to prevent O_CREAT ENOENT errors
+          rm -f *.sig2 *.sig
+
+          # Guard: nothing to index if no .xbps files exist
+          if ! ls *.xbps 1>/dev/null 2>&1; then
+            echo "⚠️ No .xbps files found to index, skipping."
+            exit 0
+          fi
+
+          # Regenerate repo index
+          xbps-rindex -a $(pwd)/*.xbps
+
+          # Sign repository
+          echo "${{ secrets.XBPS_PRIVATE_KEY }}" > /tmp/xbps_privkey.pem
+          chmod 600 /tmp/xbps_privkey.pem
+
+          xbps-rindex --sign --signedby "AvengeMedia <AvengeMedia.US@gmail.com>" --privkey /tmp/xbps_privkey.pem $(pwd)
+          xbps-rindex --sign-pkg --privkey /tmp/xbps_privkey.pem $(pwd)/*.xbps
+
+          rm -f /tmp/xbps_privkey.pem
+
+      - name: Deploy to gh-pages branch
+        run: |
+          cd gh-pages-repo
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add current/
+          git diff --quiet && git diff --staged --quiet || (git commit -m "Update XBPS packages [skip ci]" && git push origin gh-pages)

.gitignore

@@ -110,6 +110,9 @@ bin/
 # Core dumps
 core.*
 
+# prek-installed local git hooks (generated from .pre-commit-config.yaml)
+.githooks/
+
 # direnv
 .envrc
 .direnv/

.pre-commit-config.yaml

@@ -28,6 +28,14 @@ repos:
         language: system
         files: ^quickshell/(Modules/Settings/.*\.qml|Modals/Settings/SettingsSidebar\.qml|translations/extract_settings_index\.py)$
         pass_filenames: false
+  - repo: local
+    hooks:
+      - id: i18n-term-freeze
+        name: i18n term freeze (no new I18n.tr/qsTr terms)
+        entry: python3 quickshell/translations/check_term_freeze.py
+        language: system
+        files: ^quickshell/(.*\.qml|translations/(term_freeze\.json|check_term_freeze\.py|extract_translations\.py))$
+        pass_filenames: false
   - repo: local
     hooks:
       - id: no-console-in-qml

Makefile

@@ -77,6 +77,7 @@ install-desktop:
 	@echo "Installing desktop entries..."
 	@install -D -m 644 $(ASSETS_DIR)/dms-open.desktop $(APPLICATIONS_DIR)/dms-open.desktop
 	@install -D -m 644 $(ASSETS_DIR)/com.danklinux.dms.desktop $(APPLICATIONS_DIR)/com.danklinux.dms.desktop
+	@install -D -m 644 $(ASSETS_DIR)/com.danklinux.dms.notepad.desktop $(APPLICATIONS_DIR)/com.danklinux.dms.notepad.desktop
 	@update-desktop-database -q $(APPLICATIONS_DIR) 2>/dev/null || true
 	@echo "Desktop entries installed"
 
@@ -120,6 +121,7 @@ uninstall-desktop:
 	@echo "Removing desktop entries..."
 	@rm -f $(APPLICATIONS_DIR)/dms-open.desktop
 	@rm -f $(APPLICATIONS_DIR)/com.danklinux.dms.desktop
+	@rm -f $(APPLICATIONS_DIR)/com.danklinux.dms.notepad.desktop
 	@update-desktop-database -q $(APPLICATIONS_DIR) 2>/dev/null || true
 	@echo "Desktop entries removed"
 

assets/com.danklinux.dms.notepad.desktop

@@ -0,0 +1,12 @@
+[Desktop Entry]
+Type=Application
+Name=DMS Notepad
+GenericName=Text Editor
+Comment=Quick notes and text files in the dank desktop shell
+Exec=dms ipc call notepad openFile %f
+Icon=danklogo
+Terminal=false
+NoDisplay=true
+Categories=Utility;TextEditor;
+MimeType=text/plain;text/markdown;
+StartupNotify=false

assets/systemd/dms-tray-watcher.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=DMS Status Notifier Watcher (early tray)
+# The tray watcher starts in parallel with the compositor and owns org.kde.StatusNotifierWatcher before
+# graphical-session.target, i.e. before any XDG autostart app launches.
+PartOf=graphical-session.target
+Before=graphical-session.target
+
+[Service]
+Type=dbus
+BusName=org.kde.StatusNotifierWatcher
+ExecStart=/usr/bin/dms tray-watcher
+Restart=on-failure
+RestartSec=1
+Slice=session.slice
+
+[Install]
+WantedBy=graphical-session.target

core/.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/golangci/golangci-lint
-    rev: v2.10.1
+    rev: v2.12.2
     hooks:
       - id: golangci-lint-fmt
         require_serial: true

core/cmd/dms/commands_clipboard.go

@@ -63,6 +63,15 @@ var clipPasteCmd = &cobra.Command{
 	Run:   runClipPaste,
 }
 
+var clipSendPasteCmd = &cobra.Command{
+	Use:   "send-paste",
+	Short: "Send a paste keystroke to the focused window",
+	Long:  "Emulate ctrl+v (or ctrl+shift+v with --shift) via a virtual keyboard. Works without server.",
+	Run:   runClipSendPaste,
+}
+
+var clipSendPasteShift bool
+
 var clipWatchCmd = &cobra.Command{
 	Use:   "watch [command]",
 	Short: "Watch clipboard for changes",
@@ -216,8 +225,10 @@ func init() {
 
 	clipMigrateCmd.Flags().BoolVar(&clipMigrateDelete, "delete", false, "Delete cliphist db after successful migration")
 
+	clipSendPasteCmd.Flags().BoolVarP(&clipSendPasteShift, "shift", "s", false, "Send ctrl+shift+v (terminal paste)")
+
 	clipConfigCmd.AddCommand(clipConfigGetCmd, clipConfigSetCmd)
-	clipboardCmd.AddCommand(clipCopyCmd, clipPasteCmd, clipWatchCmd, clipHistoryCmd, clipGetCmd, clipDeleteCmd, clipClearCmd, clipSearchCmd, clipConfigCmd, clipExportCmd, clipImportCmd, clipMigrateCmd)
+	clipboardCmd.AddCommand(clipCopyCmd, clipPasteCmd, clipSendPasteCmd, clipWatchCmd, clipHistoryCmd, clipGetCmd, clipDeleteCmd, clipClearCmd, clipSearchCmd, clipConfigCmd, clipExportCmd, clipImportCmd, clipMigrateCmd)
 }
 
 func runClipCopy(cmd *cobra.Command, args []string) {
@@ -314,6 +325,12 @@ func runClipPaste(cmd *cobra.Command, args []string) {
 	os.Stdout.Write(data)
 }
 
+func runClipSendPaste(cmd *cobra.Command, args []string) {
+	if err := clipboard.SendPasteKeystroke(clipSendPasteShift); err != nil {
+		log.Fatalf("send-paste: %v", err)
+	}
+}
+
 func runClipWatch(cmd *cobra.Command, args []string) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()

core/cmd/dms/commands_common.go

@@ -106,6 +106,8 @@ func init() {
 	ipcCmd.SetHelpFunc(func(cmd *cobra.Command, args []string) {
 		printIPCHelp()
 	})
+	pluginsUpdateCmd.Flags().BoolP("all", "a", false, "Update all installed plugins")
+	pluginsUpdateCmd.Flags().Bool("check", false, "Check for available updates without applying them")
 }
 
 var debugSrvCmd = &cobra.Command{
@@ -184,10 +186,22 @@ var pluginsUninstallCmd = &cobra.Command{
 }
 
 var pluginsUpdateCmd = &cobra.Command{
-	Use:   "update <plugin-id>",
-	Short: "Update a plugin by ID",
-	Long:  "Update an installed DMS plugin using its ID (e.g., 'myPlugin'). Plugin names are also supported.",
-	Args:  cobra.ExactArgs(1),
+	Use:   "update [plugin-id]",
+	Short: "Update a plugin by ID, or all plugins",
+	Long:  "Update an installed DMS plugin using its ID (e.g., 'myPlugin'). If --all or -a is specified, all installed plugins will be updated.",
+	Args: func(cmd *cobra.Command, args []string) error {
+		updateAll, _ := cmd.Flags().GetBool("all")
+		if updateAll {
+			if len(args) > 0 {
+				return fmt.Errorf("cannot specify plugin ID when using --all/-a")
+			}
+			return nil
+		}
+		if len(args) != 1 {
+			return fmt.Errorf("requires exactly 1 arg (plugin ID) or use --all/-a")
+		}
+		return nil
+	},
 	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		if len(args) != 0 {
 			return nil, cobra.ShellCompDirectiveNoFileComp
@@ -195,6 +209,26 @@ var pluginsUpdateCmd = &cobra.Command{
 		return getInstalledPluginIDs(), cobra.ShellCompDirectiveNoFileComp
 	},
 	Run: func(cmd *cobra.Command, args []string) {
+		checkOnly, _ := cmd.Flags().GetBool("check")
+		updateAll, _ := cmd.Flags().GetBool("all")
+		if checkOnly {
+			if updateAll {
+				if err := checkAllPluginsCLI(); err != nil {
+					log.Fatalf("Error checking updates: %v", err)
+				}
+				return
+			}
+			if err := checkPluginCLI(args[0]); err != nil {
+				log.Fatalf("Error checking update: %v", err)
+			}
+			return
+		}
+		if updateAll {
+			if err := updateAllPluginsCLI(); err != nil {
+				log.Fatalf("Error updating plugins: %v", err)
+			}
+			return
+		}
 		if err := updatePluginCLI(args[0]); err != nil {
 			log.Fatalf("Error updating plugin: %v", err)
 		}
@@ -370,7 +404,11 @@ func listInstalledPlugins() error {
 	fmt.Printf("\nInstalled Plugins (%d):\n\n", len(installedNames))
 	for _, id := range installedNames {
 		if plugin, ok := pluginMap[id]; ok {
-			fmt.Printf("  %s\n", plugin.Name)
+			hasUpdateStr := ""
+			if hasUpdates, _, err := manager.HasUpdates(id, plugin); err == nil && hasUpdates {
+				hasUpdateStr = " (update available)"
+			}
+			fmt.Printf("  %s%s\n", plugin.Name, hasUpdateStr)
 			fmt.Printf("    ID: %s\n", plugin.ID)
 			fmt.Printf("    Category: %s\n", plugin.Category)
 			fmt.Printf("    Author: %s\n", plugin.Author)
@@ -550,6 +588,160 @@ func updatePluginCLI(idOrName string) error {
 	return nil
 }
 
+func updateAllPluginsCLI() error {
+	manager, err := plugins.NewManager()
+	if err != nil {
+		return fmt.Errorf("failed to create manager: %w", err)
+	}
+
+	registry, err := plugins.NewRegistry()
+	if err != nil {
+		return fmt.Errorf("failed to create registry: %w", err)
+	}
+
+	installed, err := manager.ListInstalled()
+	if err != nil {
+		return fmt.Errorf("failed to list installed plugins: %w", err)
+	}
+
+	pluginList, _ := registry.List()
+
+	var errs []error
+	for _, pluginID := range installed {
+		plugin := plugins.FindByIDOrName(pluginID, pluginList)
+		if plugin != nil {
+			fmt.Printf("Updating plugin: %s (ID: %s)\n", plugin.Name, plugin.ID)
+			if err := manager.Update(*plugin); err != nil {
+				if strings.Contains(err.Error(), "cannot update system plugin") {
+					fmt.Printf("Skipping system plugin: %s\n", plugin.Name)
+				} else {
+					errs = append(errs, fmt.Errorf("failed to update %s: %w", plugin.Name, err))
+				}
+			} else {
+				fmt.Printf("Plugin updated successfully: %s\n", plugin.Name)
+			}
+		} else {
+			fmt.Printf("Updating plugin: %s\n", pluginID)
+			if err := manager.UpdateByIDOrName(pluginID); err != nil {
+				if strings.Contains(err.Error(), "cannot update system plugin") {
+					fmt.Printf("Skipping system plugin: %s\n", pluginID)
+				} else {
+					errs = append(errs, fmt.Errorf("failed to update %s: %w", pluginID, err))
+				}
+			} else {
+				fmt.Printf("Plugin updated successfully: %s\n", pluginID)
+			}
+		}
+	}
+
+	if len(errs) > 0 {
+		for _, err := range errs {
+			fmt.Fprintf(os.Stderr, "%v\n", err)
+		}
+		return fmt.Errorf("failed to update some plugins")
+	}
+
+	return nil
+}
+
+func checkPluginCLI(idOrName string) error {
+	manager, err := plugins.NewManager()
+	if err != nil {
+		return fmt.Errorf("failed to create manager: %w", err)
+	}
+
+	registry, err := plugins.NewRegistry()
+	if err != nil {
+		return fmt.Errorf("failed to create registry: %w", err)
+	}
+
+	pluginList, _ := registry.List()
+	plugin := plugins.FindByIDOrName(idOrName, pluginList)
+
+	if plugin != nil {
+		installed, err := manager.IsInstalled(*plugin)
+		if err != nil {
+			return fmt.Errorf("failed to check install status: %w", err)
+		}
+		if !installed {
+			return fmt.Errorf("plugin not installed: %s", plugin.Name)
+		}
+
+		hasUpdates, _, err := manager.HasUpdates(plugin.ID, *plugin)
+		if err != nil {
+			return fmt.Errorf("failed to check updates: %w", err)
+		}
+
+		if hasUpdates {
+			fmt.Printf("Update available for plugin: %s (ID: %s)\n", plugin.Name, plugin.ID)
+		} else {
+			fmt.Printf("Plugin is up to date: %s\n", plugin.Name)
+		}
+		return nil
+	}
+
+	dummyPlugin := plugins.Plugin{ID: idOrName}
+	hasUpdates, _, err := manager.HasUpdates(idOrName, dummyPlugin)
+	if err != nil {
+		return fmt.Errorf("failed to check updates: %w", err)
+	}
+
+	if hasUpdates {
+		fmt.Printf("Update available for plugin: %s\n", idOrName)
+	} else {
+		fmt.Printf("Plugin is up to date: %s\n", idOrName)
+	}
+	return nil
+}
+
+func checkAllPluginsCLI() error {
+	manager, err := plugins.NewManager()
+	if err != nil {
+		return fmt.Errorf("failed to create manager: %w", err)
+	}
+
+	registry, err := plugins.NewRegistry()
+	if err != nil {
+		return fmt.Errorf("failed to create registry: %w", err)
+	}
+
+	installed, err := manager.ListInstalled()
+	if err != nil {
+		return fmt.Errorf("failed to list installed plugins: %w", err)
+	}
+
+	pluginList, _ := registry.List()
+
+	var count int
+	for _, pluginID := range installed {
+		plugin := plugins.FindByIDOrName(pluginID, pluginList)
+		var hasUpdates bool
+		var name string
+
+		if plugin != nil {
+			name = plugin.Name
+			hasUpdates, _, _ = manager.HasUpdates(pluginID, *plugin)
+		} else {
+			name = pluginID
+			dummyPlugin := plugins.Plugin{ID: pluginID}
+			hasUpdates, _, _ = manager.HasUpdates(pluginID, dummyPlugin)
+		}
+
+		if hasUpdates {
+			fmt.Printf("Update available for plugin: %s (ID: %s)\n", name, pluginID)
+			count++
+		}
+	}
+
+	if count > 0 {
+		fmt.Printf("\nFound %d plugin(s) with available updates.\n", count)
+	} else {
+		fmt.Println("All plugins are up to date.")
+	}
+
+	return nil
+}
+
 func getCommonCommands() []*cobra.Command {
 	return []*cobra.Command{
 		versionCmd,
@@ -582,5 +774,6 @@ func getCommonCommands() []*cobra.Command {
 		trashCmd,
 		systemCmd,
 		switchUserCmd,
+		trayWatcherCmd,
 	}
 }

core/cmd/dms/commands_config.go

@@ -37,9 +37,11 @@ var resolveIncludeCmd = &cobra.Command{
 				"cursor.lua",
 				"windowrules.lua",
 				"cursor.kdl",
+				"layout.kdl",
 				"outputs.kdl",
 				"binds.kdl",
 				"cursor.conf",
+				"layout.conf",
 				"outputs.conf",
 				"binds.conf",
 			}, cobra.ShellCompDirectiveNoFileComp

core/cmd/dms/commands_greeter.go

@@ -32,13 +32,14 @@ var greeterCmd = &cobra.Command{
 var (
 	greeterConfigSyncFn = greeter.SyncDMSConfigs
 	sharedAuthSyncFn    = sharedpam.SyncAuthConfig
+	greeterIsNixOSFn    = greeter.IsNixOS
 )
 
 var greeterInstallCmd = &cobra.Command{
 	Use:     "install",
 	Short:   "Install and configure DMS greeter",
 	Long:    "Install greetd and configure it to use DMS as the greeter interface",
-	PreRunE: preRunPrivileged,
+	PreRunE: preRunGreeterMutation,
 	Run: func(cmd *cobra.Command, args []string) {
 		yes, _ := cmd.Flags().GetBool("yes")
 		term, _ := cmd.Flags().GetBool("terminal")
@@ -64,6 +65,9 @@ var greeterSyncCmd = &cobra.Command{
 	Short: "Sync DMS theme and settings with greeter",
 	Long:  "Synchronize your current user's DMS theme, settings, and wallpaper configuration with the login greeter screen. Also updates a per-user cache slot at users/<username>/ for multi-account greeter theme preview.\n\nUse --profile on secondary accounts to sync only your own users/<username>/ slot without sudo or greetd changes.",
 	PreRunE: func(cmd *cobra.Command, args []string) error {
+		if err := rejectNixOSGreeterMutation(cmd); err != nil {
+			return err
+		}
 		profile, _ := cmd.Flags().GetBool("profile")
 		if profile {
 			return nil
@@ -140,7 +144,7 @@ var greeterEnableCmd = &cobra.Command{
 	Use:     "enable",
 	Short:   "Enable DMS greeter in greetd config",
 	Long:    "Configure greetd to use DMS as the greeter",
-	PreRunE: preRunPrivileged,
+	PreRunE: preRunGreeterMutation,
 	Run: func(cmd *cobra.Command, args []string) {
 		yes, _ := cmd.Flags().GetBool("yes")
 		term, _ := cmd.Flags().GetBool("terminal")
@@ -176,7 +180,7 @@ var greeterUninstallCmd = &cobra.Command{
 	Use:     "uninstall",
 	Short:   "Remove DMS greeter configuration and restore previous display manager",
 	Long:    "Disable greetd, remove DMS managed configs, and restore the system to its pre-DMS-greeter state",
-	PreRunE: preRunPrivileged,
+	PreRunE: preRunGreeterMutation,
 	Run: func(cmd *cobra.Command, args []string) {
 		yes, _ := cmd.Flags().GetBool("yes")
 		term, _ := cmd.Flags().GetBool("terminal")
@@ -206,6 +210,21 @@ func init() {
 	greeterUninstallCmd.Flags().BoolP("terminal", "t", false, "Run in a new terminal (for entering sudo password)")
 }
 
+func rejectNixOSGreeterMutation(cmd *cobra.Command) error {
+	if !greeterIsNixOSFn() {
+		return nil
+	}
+
+	return fmt.Errorf("dms %s is disabled on NixOS because the greeter is managed declaratively\nConfigure the DMS greeter in your NixOS module, then apply the change with your normal nixos-rebuild workflow", normalizeCommandSpec(cmd.CommandPath()))
+}
+
+func preRunGreeterMutation(cmd *cobra.Command, args []string) error {
+	if err := rejectNixOSGreeterMutation(cmd); err != nil {
+		return err
+	}
+	return preRunPrivileged(cmd, args)
+}
+
 func syncGreeterConfigsAndAuth(dmsPath, compositor string, logFunc func(string), options sharedpam.SyncAuthOptions, beforeAuth func()) error {
 	if err := greeterConfigSyncFn(dmsPath, compositor, logFunc, ""); err != nil {
 		return err
@@ -1415,24 +1434,36 @@ func readDefaultSessionCommand(configPath string) string {
 	return ""
 }
 
-func extractGreeterCacheDirFromCommand(command string) string {
-	if command == "" {
-		return greeter.GreeterCacheDir
-	}
+func explicitGreeterCacheDirFromCommand(command string) (string, bool) {
 	tokens := strings.Fields(command)
 	for i := 0; i < len(tokens); i++ {
 		token := strings.Trim(tokens[i], "\"")
 		if token == "--cache-dir" && i+1 < len(tokens) {
-			return strings.Trim(tokens[i+1], "\"")
+			value := strings.Trim(tokens[i+1], "\"")
+			if value != "" {
+				return value, true
+			}
 		}
 		if strings.HasPrefix(token, "--cache-dir=") {
 			value := strings.TrimPrefix(token, "--cache-dir=")
 			value = strings.Trim(value, "\"")
 			if value != "" {
-				return value
+				return value, true
 			}
 		}
 	}
+	return "", false
+}
+
+const nixOSGreeterStateDir = "/var/lib/dms-greeter"
+
+func greeterStatusStateDir(command string, isNixOS bool) string {
+	if cacheDir, ok := explicitGreeterCacheDirFromCommand(command); ok {
+		return cacheDir
+	}
+	if isNixOS {
+		return nixOSGreeterStateDir
+	}
 	return greeter.GreeterCacheDir
 }
 
@@ -1569,6 +1600,10 @@ func checkGreeterStatus() error {
 	fmt.Println("=== DMS Greeter Status ===")
 	fmt.Println()
 
+	if greeterIsNixOSFn() {
+		return checkNixOSGreeterStatus()
+	}
+
 	homeDir, err := os.UserHomeDir()
 	if err != nil {
 		return fmt.Errorf("failed to get user home directory: %w", err)
@@ -1632,7 +1667,7 @@ func checkGreeterStatus() error {
 		fmt.Println("    Run 'dms greeter sync' to set up group membership and permissions")
 	}
 
-	cacheDir := extractGreeterCacheDirFromCommand(configuredCommand)
+	cacheDir := greeterStatusStateDir(configuredCommand, false)
 	fmt.Println("\nGreeter Cache Directory:")
 	fmt.Printf("  Effective cache dir: %s\n", cacheDir)
 	if cacheDir != greeter.GreeterCacheDir {
@@ -1895,6 +1930,85 @@ func checkGreeterStatus() error {
 	return nil
 }
 
+func checkNixOSGreeterStatus() error {
+	const configPath = "/etc/greetd/config.toml"
+
+	configuredCommand := readDefaultSessionCommand(configPath)
+	allGood := true
+
+	fmt.Println("Greeter Configuration:")
+	switch {
+	case strings.Contains(configuredCommand, "dms-greeter"):
+		fmt.Println("  ✓ DMS greeter command found")
+		if wrapper := extractGreeterWrapperFromCommand(configuredCommand); wrapper != "" {
+			fmt.Printf("  Wrapper: %s\n", wrapper)
+		}
+	case configuredCommand != "":
+		fmt.Println("  ⚠ greetd default session does not reference dms-greeter")
+		allGood = false
+	default:
+		fmt.Printf("  ℹ No readable DMS command found in %s\n", configPath)
+	}
+	fmt.Println("  ℹ NixOS manages greeter configuration declaratively; apply changes through your NixOS module.")
+
+	stateDir := greeterStatusStateDir(configuredCommand, true)
+	fmt.Println("\nGreeter State Directory:")
+	fmt.Printf("  Effective state dir: %s\n", stateDir)
+	if stateDir == nixOSGreeterStateDir {
+		fmt.Println("  ✓ Using the NixOS module state path")
+	}
+	if stat, err := os.Stat(stateDir); err == nil && stat.IsDir() {
+		fmt.Printf("  ✓ %s exists\n", stateDir)
+	} else if os.IsNotExist(err) {
+		fmt.Printf("  ✗ %s not found\n", stateDir)
+		fmt.Println("    Rebuild your NixOS configuration after enabling the DMS greeter module.")
+		allGood = false
+	} else if err != nil {
+		fmt.Printf("  ✗ Could not inspect %s: %v\n", stateDir, err)
+		allGood = false
+	} else {
+		fmt.Printf("  ✗ %s is not a directory\n", stateDir)
+		allGood = false
+	}
+
+	fmt.Println("\nDeclarative Configuration Files:")
+	configFiles := []struct {
+		name string
+		path string
+	}{
+		{name: "Settings", path: filepath.Join(stateDir, "settings.json")},
+		{name: "Session state", path: filepath.Join(stateDir, "session.json")},
+		{name: "Color theme", path: filepath.Join(stateDir, "colors.json")},
+	}
+	for _, configFile := range configFiles {
+		if stat, err := os.Stat(configFile.path); err == nil && !stat.IsDir() {
+			fmt.Printf("  ✓ %s: %s\n", configFile.name, configFile.path)
+		} else if os.IsNotExist(err) {
+			fmt.Printf("  ℹ %s not present (optional; configure configHome/configFiles in the NixOS module)\n", configFile.name)
+		} else if err != nil {
+			fmt.Printf("  ⚠ %s could not be inspected: %v\n", configFile.name, err)
+		} else {
+			fmt.Printf("  ⚠ %s path is not a regular file: %s\n", configFile.name, configFile.path)
+		}
+	}
+
+	fmt.Println("\nGroup Membership:")
+	fmt.Println("  ℹ User group membership is managed by NixOS and is not required for declarative theme copies.")
+
+	fmt.Println("\nGreeter PAM Authentication:")
+	fmt.Println("  ℹ PAM is managed by NixOS modules.")
+	fmt.Println("    Configure fingerprint/U2F through security.pam.services.greetd.")
+
+	fmt.Println()
+	if allGood {
+		fmt.Println("✓ NixOS greeter state looks healthy and is managed declaratively.")
+	} else {
+		fmt.Println("⚠ Some issues detected. Update the DMS greeter module and rebuild NixOS; do not run 'dms greeter sync'.")
+	}
+
+	return nil
+}
+
 func recentAppArmorGreeterDenials(sampleLimit int) (int, []string, error) {
 	if sampleLimit <= 0 {
 		sampleLimit = 3

core/cmd/dms/commands_greeter_test.go

@@ -3,9 +3,11 @@ package main
 import (
 	"errors"
 	"reflect"
+	"strings"
 	"testing"
 
 	sharedpam "github.com/AvengeMedia/DankMaterialShell/core/internal/pam"
+	"github.com/spf13/cobra"
 )
 
 func TestSyncGreeterConfigsAndAuthDelegatesSharedAuth(t *testing.T) {
@@ -85,3 +87,57 @@ func TestSyncGreeterConfigsAndAuthStopsOnConfigError(t *testing.T) {
 		t.Fatal("expected auth sync not to run after config sync failure")
 	}
 }
+
+func TestGreeterStatusStateDirUsesNixOSDefault(t *testing.T) {
+	if got := greeterStatusStateDir("", true); got != nixOSGreeterStateDir {
+		t.Fatalf("greeterStatusStateDir() = %q, want %q", got, nixOSGreeterStateDir)
+	}
+}
+
+func TestGreeterStatusStateDirHonorsExplicitOverrideOnNixOS(t *testing.T) {
+	command := "dms-greeter --cache-dir /srv/dms-greeter --command niri"
+	if got := greeterStatusStateDir(command, true); got != "/srv/dms-greeter" {
+		t.Fatalf("greeterStatusStateDir() = %q, want %q", got, "/srv/dms-greeter")
+	}
+}
+
+func TestRejectNixOSGreeterMutationBlocksImperativeCommands(t *testing.T) {
+	origGreeterIsNixOSFn := greeterIsNixOSFn
+	greeterIsNixOSFn = func() bool { return true }
+	t.Cleanup(func() {
+		greeterIsNixOSFn = origGreeterIsNixOSFn
+	})
+
+	for _, commandName := range []string{"install", "enable", "sync", "uninstall"} {
+		t.Run(commandName, func(t *testing.T) {
+			root := &cobra.Command{Use: "dms"}
+			greeterCommand := &cobra.Command{Use: "greeter"}
+			mutationCommand := &cobra.Command{Use: commandName}
+			root.AddCommand(greeterCommand)
+			greeterCommand.AddCommand(mutationCommand)
+
+			err := rejectNixOSGreeterMutation(mutationCommand)
+			if err == nil {
+				t.Fatalf("expected NixOS greeter %s to be rejected", commandName)
+			}
+			if !strings.Contains(err.Error(), "dms greeter "+commandName+" is disabled on NixOS") {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if strings.Contains(err.Error(), "/var/cache/dms-greeter") {
+				t.Fatalf("NixOS remediation should not recommend the non-NixOS cache path: %v", err)
+			}
+		})
+	}
+}
+
+func TestRejectNixOSGreeterMutationAllowsOtherDistros(t *testing.T) {
+	origGreeterIsNixOSFn := greeterIsNixOSFn
+	greeterIsNixOSFn = func() bool { return false }
+	t.Cleanup(func() {
+		greeterIsNixOSFn = origGreeterIsNixOSFn
+	})
+
+	if err := rejectNixOSGreeterMutation(&cobra.Command{Use: "sync"}); err != nil {
+		t.Fatalf("expected non-NixOS greeter command to be allowed, got %v", err)
+	}
+}

core/cmd/dms/commands_matugen.go

@@ -38,10 +38,17 @@ var matugenCheckCmd = &cobra.Command{
 	Run:   runMatugenCheck,
 }
 
+var matugenPreviewCmd = &cobra.Command{
+	Use:   "preview",
+	Short: "Preview Matugen scheme colors without applying them",
+	Run:   runMatugenPreview,
+}
+
 func init() {
 	matugenCmd.AddCommand(matugenGenerateCmd)
 	matugenCmd.AddCommand(matugenQueueCmd)
 	matugenCmd.AddCommand(matugenCheckCmd)
+	matugenCmd.AddCommand(matugenPreviewCmd)
 
 	for _, cmd := range []*cobra.Command{matugenGenerateCmd, matugenQueueCmd} {
 		cmd.Flags().String("state-dir", "", "State directory for cache files")
@@ -62,6 +69,8 @@ func init() {
 
 	matugenQueueCmd.Flags().Bool("wait", true, "Wait for completion")
 	matugenQueueCmd.Flags().Duration("timeout", 90*time.Second, "Timeout for waiting")
+	matugenPreviewCmd.Flags().String("source-color", "", "Source color used to generate previews")
+	matugenPreviewCmd.Flags().Float64("contrast", 0, "Contrast value from -1 to 1 (0 = standard)")
 }
 
 func buildMatugenOptions(cmd *cobra.Command) matugen.Options {
@@ -200,3 +209,17 @@ func runMatugenCheck(cmd *cobra.Command, args []string) {
 	}
 	fmt.Println(string(data))
 }
+
+func runMatugenPreview(cmd *cobra.Command, args []string) {
+	sourceColor, _ := cmd.Flags().GetString("source-color")
+	contrast, _ := cmd.Flags().GetFloat64("contrast")
+	previews, err := matugen.PreviewSchemes(sourceColor, contrast)
+	if err != nil {
+		log.Fatalf("Failed to generate Matugen previews: %v", err)
+	}
+	data, err := json.Marshal(previews)
+	if err != nil {
+		log.Fatalf("Failed to marshal Matugen previews: %v", err)
+	}
+	fmt.Println(string(data))
+}

core/cmd/dms/commands_traywatcher.go

@@ -0,0 +1,24 @@
+package main
+
+import (
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/traywatcher"
+	"github.com/spf13/cobra"
+)
+
+var trayWatcherCmd = &cobra.Command{
+	Use:   "tray-watcher",
+	Short: "Run a minimal StatusNotifierWatcher for early tray registration",
+	Long: `Run a minimal org.kde.StatusNotifierWatcher daemon.
+
+Started early in the session (Before=graphical-session.target via
+dms-tray-watcher.service), it lets tray apps launched by XDG autostart
+register their items before the shell finishes loading, and keeps them
+registered across shell restarts. The shell's tray host picks items up from
+this watcher; if it is not running, the shell's built-in watcher takes over.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		if err := traywatcher.Run(); err != nil {
+			log.Fatalf("%v", err)
+		}
+	},
+}

core/cmd/dms/immutable_policy_test.go

@@ -0,0 +1,24 @@
+package main
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestDefaultImmutablePolicyAllowsSyncButBlocksEnable(t *testing.T) {
+	var policyFile cliPolicyFile
+	if err := json.Unmarshal(defaultCLIPolicyJSON, &policyFile); err != nil {
+		t.Fatalf("failed to parse embedded CLI policy: %v", err)
+	}
+	if policyFile.BlockedCommands == nil {
+		t.Fatal("embedded CLI policy has no blocked_commands")
+	}
+
+	blocked := normalizeBlockedCommands(*policyFile.BlockedCommands)
+	if !commandBlockedByPolicy("greeter enable", blocked) {
+		t.Fatal("expected greeter enable to remain blocked on immutable/image-based systems")
+	}
+	if commandBlockedByPolicy("greeter sync", blocked) {
+		t.Fatal("expected greeter sync to remain available on immutable/image-based systems")
+	}
+}

core/cmd/dms/shell.go

@@ -582,7 +582,11 @@ func runShellDaemon(session bool) {
 }
 
 var qsHasAnyDisplay = sync.OnceValue(func() bool {
-	out, err := exec.Command("qs", "ipc", "--help").Output()
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "qs", "ipc", "--help")
+	cmd.WaitDelay = 500 * time.Millisecond
+	out, err := cmd.Output()
 	if err != nil {
 		return false
 	}
@@ -642,7 +646,10 @@ func getShellIPCCompletions(args []string, _ string) []string {
 		return nil
 	}
 	cmdArgs := append(baseArgs, "show")
-	cmd := exec.Command("qs", cmdArgs...)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "qs", cmdArgs...)
+	cmd.WaitDelay = 500 * time.Millisecond
 	var targets ipcTargets
 
 	if output, err := cmd.Output(); err == nil {

core/go.mod

@@ -22,7 +22,6 @@ require (
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	go.etcd.io/bbolt v1.4.3
 	go4.org/mem v0.0.0-20240501181205-ae6ca9944745
-	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
 	golang.org/x/image v0.39.0
 	tailscale.com v1.96.5
 )
@@ -64,6 +63,7 @@ require (
 	github.com/yeqown/reedsolomon v1.0.0 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
 	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.zx2c4.com/wireguard/windows v1.0.1 // indirect

core/internal/clipboard/clipboard.go

@@ -9,7 +9,6 @@ import (
 	"syscall"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/ext_data_control"
-	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
 
 const envServe = "_DMS_CLIPBOARD_SERVE"
@@ -17,6 +16,37 @@ const envMime = "_DMS_CLIPBOARD_MIME"
 const envPasteOnce = "_DMS_CLIPBOARD_PASTE_ONCE"
 const envCacheFile = "_DMS_CLIPBOARD_CACHE"
 
+type Offer struct {
+	MimeType string
+	Data     []byte
+}
+
+// textMimeAliases are offered alongside plain-text content so legacy X11
+// clients bridged through XWayland find a target they can convert.
+var textMimeAliases = []string{
+	"text/plain",
+	"text/plain;charset=utf-8",
+	"UTF8_STRING",
+	"STRING",
+	"TEXT",
+}
+
+// ExpandOffers turns raw clipboard data into the full offer list to serve,
+// adding the standard alias set for text content.
+func ExpandOffers(data []byte, mimeType string) []Offer {
+	offers := []Offer{{MimeType: mimeType, Data: data}}
+	if mimeType != "text/plain" && mimeType != "text/plain;charset=utf-8" {
+		return offers
+	}
+	for _, alias := range textMimeAliases {
+		if alias == mimeType {
+			continue
+		}
+		offers = append(offers, Offer{MimeType: alias, Data: data})
+	}
+	return offers
+}
+
 // MaybeServeAndExit intercepts before cobra when re-exec'd as a clipboard
 // child. Reads source data into memory, deletes any cache file, then serves.
 func MaybeServeAndExit() {
@@ -44,7 +74,7 @@ func MaybeServeAndExit() {
 		os.Exit(1)
 	}
 
-	if err := serveClipboard(data, mimeType, pasteOnce); err != nil {
+	if err := serveOffers(ExpandOffers(data, mimeType), pasteOnce); err != nil {
 		fmt.Fprintf(os.Stderr, "clipboard: serve: %v\n", err)
 		os.Exit(1)
 	}
@@ -55,22 +85,33 @@ func Copy(data []byte, mimeType string) error {
 	return copyForkCached(data, mimeType, false)
 }
 
+func CopyText(text string) error {
+	return Copy([]byte(text), "text/plain;charset=utf-8")
+}
+
 func CopyOpts(data []byte, mimeType string, foreground, pasteOnce bool) error {
 	if foreground {
-		return serveClipboard(data, mimeType, pasteOnce)
+		return serveOffers(ExpandOffers(data, mimeType), pasteOnce)
 	}
 	return copyForkCached(data, mimeType, pasteOnce)
 }
 
 func CopyReader(data io.Reader, mimeType string, foreground, pasteOnce bool) error {
-	if foreground {
-		buf, err := io.ReadAll(data)
-		if err != nil {
-			return fmt.Errorf("read source: %w", err)
-		}
-		return serveClipboard(buf, mimeType, pasteOnce)
+	if !foreground {
+		return copyFork(data, mimeType, pasteOnce)
 	}
-	return copyFork(data, mimeType, pasteOnce)
+	buf, err := io.ReadAll(data)
+	if err != nil {
+		return fmt.Errorf("read source: %w", err)
+	}
+	return serveOffers(ExpandOffers(buf, mimeType), pasteOnce)
+}
+
+func CopyMulti(offers []Offer, foreground, pasteOnce bool) error {
+	if foreground {
+		return serveOffers(offers, pasteOnce)
+	}
+	return copyMultiFork(offers, pasteOnce)
 }
 
 func newForkCmd(mimeType string, pasteOnce bool, extra ...string) *exec.Cmd {
@@ -132,39 +173,70 @@ func copyForkCached(data []byte, mimeType string, pasteOnce bool) error {
 func copyFork(data io.Reader, mimeType string, pasteOnce bool) error {
 	cmd := newForkCmd(mimeType, pasteOnce)
 
-	switch src := data.(type) {
-	case *os.File:
+	if src, ok := data.(*os.File); ok {
 		cmd.Stdin = src
 		return waitReady(cmd)
-
-	default:
-		stdin, err := cmd.StdinPipe()
-		if err != nil {
-			return fmt.Errorf("stdin pipe: %w", err)
-		}
-
-		stdout, err := cmd.StdoutPipe()
-		if err != nil {
-			return fmt.Errorf("stdout pipe: %w", err)
-		}
-
-		if err := cmd.Start(); err != nil {
-			return fmt.Errorf("start: %w", err)
-		}
-		if _, err := io.Copy(stdin, data); err != nil {
-			stdin.Close()
-			return fmt.Errorf("write stdin: %w", err)
-		}
-		if err := stdin.Close(); err != nil {
-			return fmt.Errorf("close stdin: %w", err)
-		}
-
-		var buf [1]byte
-		if _, err := stdout.Read(buf[:]); err != nil {
-			return fmt.Errorf("waiting for clipboard ready: %w", err)
-		}
-		return nil
 	}
+
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return fmt.Errorf("stdin pipe: %w", err)
+	}
+
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return fmt.Errorf("stdout pipe: %w", err)
+	}
+
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("start: %w", err)
+	}
+	if _, err := io.Copy(stdin, data); err != nil {
+		stdin.Close()
+		return fmt.Errorf("write stdin: %w", err)
+	}
+	if err := stdin.Close(); err != nil {
+		return fmt.Errorf("close stdin: %w", err)
+	}
+
+	var buf [1]byte
+	if _, err := stdout.Read(buf[:]); err != nil {
+		return fmt.Errorf("waiting for clipboard ready: %w", err)
+	}
+	return nil
+}
+
+func copyMultiFork(offers []Offer, pasteOnce bool) error {
+	args := []string{os.Args[0], "cl", "copy", "--foreground", "--type", "__multi__"}
+	if pasteOnce {
+		args = append(args, "--paste-once")
+	}
+
+	cmd := exec.Command(args[0], args[1:]...)
+	cmd.Stdin = nil
+	cmd.Stdout = nil
+	cmd.Stderr = nil
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return fmt.Errorf("stdin pipe: %w", err)
+	}
+
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("start: %w", err)
+	}
+
+	for _, offer := range offers {
+		fmt.Fprintf(stdin, "%s\x00%d\x00", offer.MimeType, len(offer.Data))
+		if _, err := stdin.Write(offer.Data); err != nil {
+			stdin.Close()
+			return fmt.Errorf("write offer data: %w", err)
+		}
+	}
+	stdin.Close()
+
+	return nil
 }
 
 func signalReady() {
@@ -194,57 +266,25 @@ func createClipboardCacheFile() (*os.File, error) {
 	return os.CreateTemp("", "dms-clipboard-*")
 }
 
-func serveClipboard(data []byte, mimeType string, pasteOnce bool) error {
-	display, err := wlclient.Connect("")
+// serveOffers owns the Wayland selection until cancelled (or first paste when
+// pasteOnce is set), answering every offered mime type with its data.
+func serveOffers(offers []Offer, pasteOnce bool) error {
+	if len(offers) == 0 {
+		return fmt.Errorf("no offers to serve")
+	}
+
+	s, err := connectSession()
 	if err != nil {
-		return fmt.Errorf("wayland connect: %w", err)
+		return err
 	}
-	defer display.Destroy()
+	defer s.Close()
 
-	ctx := display.Context()
-	registry, err := display.GetRegistry()
+	dataControlMgr, err := s.requireDataControl()
 	if err != nil {
-		return fmt.Errorf("get registry: %w", err)
-	}
-	defer registry.Destroy()
-
-	var dataControlMgr *ext_data_control.ExtDataControlManagerV1
-	var seat *wlclient.Seat
-	var bindErr error
-
-	registry.SetGlobalHandler(func(e wlclient.RegistryGlobalEvent) {
-		switch e.Interface {
-		case "ext_data_control_manager_v1":
-			dataControlMgr = ext_data_control.NewExtDataControlManagerV1(ctx)
-			if err := registry.Bind(e.Name, e.Interface, e.Version, dataControlMgr); err != nil {
-				bindErr = err
-			}
-		case "wl_seat":
-			if seat != nil {
-				return
-			}
-			seat = wlclient.NewSeat(ctx)
-			if err := registry.Bind(e.Name, e.Interface, e.Version, seat); err != nil {
-				bindErr = err
-			}
-		}
-	})
-
-	display.Roundtrip()
-	display.Roundtrip()
-
-	if bindErr != nil {
-		return fmt.Errorf("registry bind: %w", bindErr)
-	}
-	if dataControlMgr == nil {
-		return fmt.Errorf("compositor does not support ext_data_control_manager_v1")
-	}
-	defer dataControlMgr.Destroy()
-	if seat == nil {
-		return fmt.Errorf("no seat available")
+		return err
 	}
 
-	device, err := dataControlMgr.GetDataDevice(seat)
+	device, err := dataControlMgr.GetDataDevice(s.seat)
 	if err != nil {
 		return fmt.Errorf("get data device: %w", err)
 	}
@@ -255,25 +295,12 @@ func serveClipboard(data []byte, mimeType string, pasteOnce bool) error {
 		return fmt.Errorf("create data source: %w", err)
 	}
 
-	if err := source.Offer(mimeType); err != nil {
-		return fmt.Errorf("offer mime type: %w", err)
-	}
-	if mimeType == "text/plain;charset=utf-8" || mimeType == "text/plain" {
-		if err := source.Offer("text/plain"); err != nil {
-			return fmt.Errorf("offer text/plain: %w", err)
-		}
-		if err := source.Offer("text/plain;charset=utf-8"); err != nil {
-			return fmt.Errorf("offer text/plain;charset=utf-8: %w", err)
-		}
-		if err := source.Offer("UTF8_STRING"); err != nil {
-			return fmt.Errorf("offer UTF8_STRING: %w", err)
-		}
-		if err := source.Offer("STRING"); err != nil {
-			return fmt.Errorf("offer STRING: %w", err)
-		}
-		if err := source.Offer("TEXT"); err != nil {
-			return fmt.Errorf("offer TEXT: %w", err)
+	offerData := make(map[string][]byte, len(offers))
+	for _, offer := range offers {
+		if err := source.Offer(offer.MimeType); err != nil {
+			return fmt.Errorf("offer %s: %w", offer.MimeType, err)
 		}
+		offerData[offer.MimeType] = offer.Data
 	}
 
 	cancelled := make(chan struct{})
@@ -283,7 +310,11 @@ func serveClipboard(data []byte, mimeType string, pasteOnce bool) error {
 		_ = syscall.SetNonblock(e.Fd, false)
 		file := os.NewFile(uintptr(e.Fd), "pipe")
 		defer file.Close()
-		_, _ = file.Write(data)
+
+		if data, ok := offerData[e.MimeType]; ok {
+			_, _ = file.Write(data)
+		}
+
 		select {
 		case pasted <- struct{}{}:
 		default:
@@ -298,7 +329,7 @@ func serveClipboard(data []byte, mimeType string, pasteOnce bool) error {
 		return fmt.Errorf("set selection: %w", err)
 	}
 
-	display.Roundtrip()
+	s.display.Roundtrip()
 	signalReady()
 
 	for {
@@ -310,70 +341,26 @@ func serveClipboard(data []byte, mimeType string, pasteOnce bool) error {
 				return nil
 			}
 		default:
-			if err := ctx.Dispatch(); err != nil {
+			if err := s.ctx.Dispatch(); err != nil {
 				return nil
 			}
 		}
 	}
 }
 
-func CopyText(text string) error {
-	return Copy([]byte(text), "text/plain;charset=utf-8")
-}
-
 func Paste() ([]byte, string, error) {
-	display, err := wlclient.Connect("")
+	s, err := connectSession()
 	if err != nil {
-		return nil, "", fmt.Errorf("wayland connect: %w", err)
+		return nil, "", err
 	}
-	defer display.Destroy()
+	defer s.Close()
 
-	ctx := display.Context()
-	registry, err := display.GetRegistry()
+	dataControlMgr, err := s.requireDataControl()
 	if err != nil {
-		return nil, "", fmt.Errorf("get registry: %w", err)
-	}
-	defer registry.Destroy()
-
-	var dataControlMgr *ext_data_control.ExtDataControlManagerV1
-	var seat *wlclient.Seat
-	var bindErr error
-
-	registry.SetGlobalHandler(func(e wlclient.RegistryGlobalEvent) {
-		switch e.Interface {
-		case "ext_data_control_manager_v1":
-			dataControlMgr = ext_data_control.NewExtDataControlManagerV1(ctx)
-			if err := registry.Bind(e.Name, e.Interface, e.Version, dataControlMgr); err != nil {
-				bindErr = err
-			}
-		case "wl_seat":
-			if seat != nil {
-				return
-			}
-			seat = wlclient.NewSeat(ctx)
-			if err := registry.Bind(e.Name, e.Interface, e.Version, seat); err != nil {
-				bindErr = err
-			}
-		}
-	})
-
-	display.Roundtrip()
-	display.Roundtrip()
-
-	if bindErr != nil {
-		return nil, "", fmt.Errorf("registry bind: %w", bindErr)
+		return nil, "", err
 	}
 
-	if dataControlMgr == nil {
-		return nil, "", fmt.Errorf("compositor does not support ext_data_control_manager_v1")
-	}
-	defer dataControlMgr.Destroy()
-
-	if seat == nil {
-		return nil, "", fmt.Errorf("no seat available")
-	}
-
-	device, err := dataControlMgr.GetDataDevice(seat)
+	device, err := dataControlMgr.GetDataDevice(s.seat)
 	if err != nil {
 		return nil, "", fmt.Errorf("get data device: %w", err)
 	}
@@ -399,15 +386,14 @@ func Paste() ([]byte, string, error) {
 		gotSelection = true
 	})
 
-	display.Roundtrip()
-	display.Roundtrip()
+	s.display.Roundtrip()
+	s.display.Roundtrip()
 
 	if !gotSelection || selectionOffer == nil {
 		return nil, "", fmt.Errorf("no clipboard data")
 	}
 
-	mimeTypes := offerMimeTypes[selectionOffer]
-	selectedMime := selectPreferredMimeType(mimeTypes)
+	selectedMime := selectPreferredMimeType(offerMimeTypes[selectionOffer])
 	if selectedMime == "" {
 		return nil, "", fmt.Errorf("no supported mime type")
 	}
@@ -424,7 +410,7 @@ func Paste() ([]byte, string, error) {
 	}
 	w.Close()
 
-	display.Roundtrip()
+	s.display.Roundtrip()
 
 	data, err := io.ReadAll(r)
 	if err != nil {
@@ -470,161 +456,3 @@ func selectPreferredMimeType(mimes []string) string {
 func IsImageMimeType(mime string) bool {
 	return len(mime) > 6 && mime[:6] == "image/"
 }
-
-type Offer struct {
-	MimeType string
-	Data     []byte
-}
-
-func CopyMulti(offers []Offer, foreground, pasteOnce bool) error {
-	if !foreground {
-		return copyMultiFork(offers, pasteOnce)
-	}
-	return copyMultiServe(offers, pasteOnce)
-}
-
-func copyMultiFork(offers []Offer, pasteOnce bool) error {
-	args := []string{os.Args[0], "cl", "copy", "--foreground", "--type", "__multi__"}
-	if pasteOnce {
-		args = append(args, "--paste-once")
-	}
-
-	cmd := exec.Command(args[0], args[1:]...)
-	cmd.Stdin = nil
-	cmd.Stdout = nil
-	cmd.Stderr = nil
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
-
-	stdin, err := cmd.StdinPipe()
-	if err != nil {
-		return fmt.Errorf("stdin pipe: %w", err)
-	}
-
-	if err := cmd.Start(); err != nil {
-		return fmt.Errorf("start: %w", err)
-	}
-
-	for _, offer := range offers {
-		fmt.Fprintf(stdin, "%s\x00%d\x00", offer.MimeType, len(offer.Data))
-		if _, err := stdin.Write(offer.Data); err != nil {
-			stdin.Close()
-			return fmt.Errorf("write offer data: %w", err)
-		}
-	}
-	stdin.Close()
-
-	return nil
-}
-
-func copyMultiServe(offers []Offer, pasteOnce bool) error {
-	display, err := wlclient.Connect("")
-	if err != nil {
-		return fmt.Errorf("wayland connect: %w", err)
-	}
-	defer display.Destroy()
-
-	ctx := display.Context()
-	registry, err := display.GetRegistry()
-	if err != nil {
-		return fmt.Errorf("get registry: %w", err)
-	}
-	defer registry.Destroy()
-
-	var dataControlMgr *ext_data_control.ExtDataControlManagerV1
-	var seat *wlclient.Seat
-	var bindErr error
-
-	registry.SetGlobalHandler(func(e wlclient.RegistryGlobalEvent) {
-		switch e.Interface {
-		case "ext_data_control_manager_v1":
-			dataControlMgr = ext_data_control.NewExtDataControlManagerV1(ctx)
-			if err := registry.Bind(e.Name, e.Interface, e.Version, dataControlMgr); err != nil {
-				bindErr = err
-			}
-		case "wl_seat":
-			if seat != nil {
-				return
-			}
-			seat = wlclient.NewSeat(ctx)
-			if err := registry.Bind(e.Name, e.Interface, e.Version, seat); err != nil {
-				bindErr = err
-			}
-		}
-	})
-
-	display.Roundtrip()
-	display.Roundtrip()
-
-	if bindErr != nil {
-		return fmt.Errorf("registry bind: %w", bindErr)
-	}
-	if dataControlMgr == nil {
-		return fmt.Errorf("compositor does not support ext_data_control_manager_v1")
-	}
-	defer dataControlMgr.Destroy()
-	if seat == nil {
-		return fmt.Errorf("no seat available")
-	}
-
-	device, err := dataControlMgr.GetDataDevice(seat)
-	if err != nil {
-		return fmt.Errorf("get data device: %w", err)
-	}
-	defer device.Destroy()
-
-	source, err := dataControlMgr.CreateDataSource()
-	if err != nil {
-		return fmt.Errorf("create data source: %w", err)
-	}
-
-	offerMap := make(map[string][]byte)
-	for _, offer := range offers {
-		if err := source.Offer(offer.MimeType); err != nil {
-			return fmt.Errorf("offer %s: %w", offer.MimeType, err)
-		}
-		offerMap[offer.MimeType] = offer.Data
-	}
-
-	cancelled := make(chan struct{})
-	pasted := make(chan struct{}, 1)
-
-	source.SetSendHandler(func(e ext_data_control.ExtDataControlSourceV1SendEvent) {
-		_ = syscall.SetNonblock(e.Fd, false)
-		file := os.NewFile(uintptr(e.Fd), "pipe")
-		defer file.Close()
-
-		if data, ok := offerMap[e.MimeType]; ok {
-			_, _ = file.Write(data)
-		}
-
-		select {
-		case pasted <- struct{}{}:
-		default:
-		}
-	})
-
-	source.SetCancelledHandler(func(e ext_data_control.ExtDataControlSourceV1CancelledEvent) {
-		close(cancelled)
-	})
-
-	if err := device.SetSelection(source); err != nil {
-		return fmt.Errorf("set selection: %w", err)
-	}
-
-	display.Roundtrip()
-
-	for {
-		select {
-		case <-cancelled:
-			return nil
-		case <-pasted:
-			if pasteOnce {
-				return nil
-			}
-		default:
-			if err := ctx.Dispatch(); err != nil {
-				return nil
-			}
-		}
-	}
-}

core/internal/clipboard/pastekey.go

@@ -0,0 +1,206 @@
+package clipboard
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
+	"golang.org/x/sys/unix"
+)
+
+const (
+	xkbKeymapFormatV1 = 1
+
+	keyStateReleased = 0
+	keyStatePressed  = 1
+
+	// xkb real modifier bit positions are fixed: Shift=0, Lock=1, Control=2
+	shiftModMask = 1 << 0
+	ctrlModMask  = 1 << 2
+
+	// evdev fallbacks for a standard pc105 map
+	fallbackCtrlKey  = 29 // KEY_LEFTCTRL
+	fallbackShiftKey = 42 // KEY_LEFTSHIFT
+	fallbackVKey     = 47 // KEY_V
+)
+
+// SendPasteKeystroke emulates a paste shortcut via zwp_virtual_keyboard_v1
+// using the seat's own keymap, so keycodes stay valid for XWayland clients
+// (a synthetic wtype-style keymap breaks X11 apps like Steam). withShift
+// selects ctrl+shift+v for terminal targets.
+func SendPasteKeystroke(withShift bool) error {
+	s, err := connectSession()
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	if s.virtualKeyboardMgr == nil {
+		return fmt.Errorf("compositor does not support zwp_virtual_keyboard_manager_v1")
+	}
+	if s.seat == nil {
+		return fmt.Errorf("no seat available")
+	}
+
+	keyboard, err := s.seat.GetKeyboard()
+	if err != nil {
+		return fmt.Errorf("get keyboard: %w", err)
+	}
+	defer keyboard.Release()
+
+	var keymap *wlclient.KeyboardKeymapEvent
+	keyboard.SetKeymapHandler(func(e wlclient.KeyboardKeymapEvent) {
+		if keymap == nil {
+			keymap = &e
+		}
+	})
+
+	s.display.Roundtrip()
+
+	if keymap == nil || keymap.Format != xkbKeymapFormatV1 {
+		return fmt.Errorf("no xkb keymap from seat")
+	}
+	defer unix.Close(keymap.Fd)
+
+	keymapText, err := readKeymap(keymap.Fd, keymap.Size)
+	if err != nil {
+		return fmt.Errorf("read keymap: %w", err)
+	}
+	keys := resolveKeycodes(keymapText)
+
+	vk, err := s.virtualKeyboardMgr.CreateVirtualKeyboard(s.seat)
+	if err != nil {
+		return fmt.Errorf("create virtual keyboard: %w", err)
+	}
+	defer vk.Destroy()
+
+	if err := vk.Keymap(xkbKeymapFormatV1, keymap.Fd, keymap.Size); err != nil {
+		return fmt.Errorf("set keymap: %w", err)
+	}
+
+	mods := uint32(ctrlModMask)
+	held := []uint32{keys.ctrl}
+	if withShift {
+		mods |= shiftModMask
+		held = append(held, keys.shift)
+	}
+
+	t := uint32(0)
+	press := func(key, state uint32) error {
+		t++
+		return vk.Key(t, key, state)
+	}
+
+	for _, key := range held {
+		if err := press(key, keyStatePressed); err != nil {
+			return fmt.Errorf("key press: %w", err)
+		}
+	}
+	if err := vk.Modifiers(mods, 0, 0, 0); err != nil {
+		return fmt.Errorf("set modifiers: %w", err)
+	}
+	if err := press(keys.v, keyStatePressed); err != nil {
+		return fmt.Errorf("key press: %w", err)
+	}
+	if err := press(keys.v, keyStateReleased); err != nil {
+		return fmt.Errorf("key release: %w", err)
+	}
+	for i := len(held) - 1; i >= 0; i-- {
+		if err := press(held[i], keyStateReleased); err != nil {
+			return fmt.Errorf("key release: %w", err)
+		}
+	}
+	if err := vk.Modifiers(0, 0, 0, 0); err != nil {
+		return fmt.Errorf("clear modifiers: %w", err)
+	}
+
+	s.display.Roundtrip()
+	return nil
+}
+
+func readKeymap(fd int, size uint32) (string, error) {
+	data, err := unix.Mmap(fd, 0, int(size), unix.PROT_READ, unix.MAP_PRIVATE)
+	if err != nil {
+		return "", err
+	}
+	text := strings.TrimRight(string(data), "\x00")
+	return text, unix.Munmap(data)
+}
+
+type pasteKeycodes struct {
+	ctrl  uint32
+	shift uint32
+	v     uint32
+}
+
+var (
+	keycodeDefRe = regexp.MustCompile(`<([A-Za-z0-9+_-]+)>\s*=\s*(\d+)`)
+	keySymbolsRe = regexp.MustCompile(`key\s*<([A-Za-z0-9+_-]+)>\s*\{([^}]*)\}`)
+	groupIndexRe = regexp.MustCompile(`\w+\[\d+\]\s*=`)
+	symbolListRe = regexp.MustCompile(`\[([^\]]*)\]`)
+)
+
+// xkbcommon may serialize keysyms as hex escapes instead of names
+// (e.g. "0x76" for v, "0xffe3" for Control_L).
+var keysymNames = map[uint32]string{
+	0x76:   "v",
+	0xffe3: "Control_L",
+	0xffe1: "Shift_L",
+}
+
+func canonicalKeysym(sym string) string {
+	if !strings.HasPrefix(sym, "0x") && !strings.HasPrefix(sym, "0X") {
+		return sym
+	}
+	value, err := strconv.ParseUint(sym[2:], 16, 32)
+	if err != nil {
+		return sym
+	}
+	if name, ok := keysymNames[uint32(value)]; ok {
+		return name
+	}
+	return sym
+}
+
+// resolveKeycodes finds the evdev keycodes producing the keysyms we need in
+// the seat keymap's first group, falling back to pc105 positions.
+func resolveKeycodes(keymap string) pasteKeycodes {
+	codes := map[string]uint32{}
+	for _, m := range keycodeDefRe.FindAllStringSubmatch(keymap, -1) {
+		if code, err := strconv.Atoi(m[2]); err == nil {
+			codes[m[1]] = uint32(code)
+		}
+	}
+
+	keys := pasteKeycodes{ctrl: fallbackCtrlKey, shift: fallbackShiftKey, v: fallbackVKey}
+	want := map[string]*uint32{
+		"Control_L": &keys.ctrl,
+		"Shift_L":   &keys.shift,
+		"v":         &keys.v,
+	}
+
+	for _, m := range keySymbolsRe.FindAllStringSubmatch(keymap, -1) {
+		group := symbolListRe.FindStringSubmatch(groupIndexRe.ReplaceAllString(m[2], ""))
+		if group == nil {
+			continue
+		}
+		xkbCode, ok := codes[m[1]]
+		if !ok || xkbCode < 8 {
+			continue
+		}
+		level1 := canonicalKeysym(strings.TrimSpace(strings.Split(group[1], ",")[0]))
+		target, wanted := want[level1]
+		if !wanted {
+			continue
+		}
+		*target = xkbCode - 8
+		delete(want, level1)
+		if len(want) == 0 {
+			break
+		}
+	}
+
+	return keys
+}

core/internal/clipboard/pastekey_live_test.go

@@ -0,0 +1,65 @@
+package clipboard
+
+import (
+	"os"
+	"testing"
+
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
+	"golang.org/x/sys/unix"
+)
+
+func TestLiveSeatKeymapResolution(t *testing.T) {
+	if os.Getenv("DMS_LIVE_TEST") == "" {
+		t.Skip("set DMS_LIVE_TEST=1 to run against the live compositor")
+	}
+
+	s, err := connectSession()
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer s.Close()
+
+	if s.virtualKeyboardMgr == nil {
+		t.Fatal("compositor does not advertise zwp_virtual_keyboard_manager_v1")
+	}
+	if s.seat == nil {
+		t.Fatal("no seat")
+	}
+
+	keyboard, err := s.seat.GetKeyboard()
+	if err != nil {
+		t.Fatalf("get keyboard: %v", err)
+	}
+	defer keyboard.Release()
+
+	var keymap *wlclient.KeyboardKeymapEvent
+	keyboard.SetKeymapHandler(func(e wlclient.KeyboardKeymapEvent) {
+		if keymap == nil {
+			keymap = &e
+		}
+	})
+	s.display.Roundtrip()
+
+	if keymap == nil {
+		t.Fatal("no keymap event")
+	}
+	defer unix.Close(keymap.Fd)
+
+	text, err := readKeymap(keymap.Fd, keymap.Size)
+	if err != nil {
+		t.Fatalf("read keymap: %v", err)
+	}
+
+	if dump := os.Getenv("DMS_LIVE_DUMP"); dump != "" {
+		if err := os.WriteFile(dump, []byte(text), 0o644); err != nil {
+			t.Fatalf("dump keymap: %v", err)
+		}
+	}
+
+	keys := resolveKeycodes(text)
+	t.Logf("keymap size=%d resolved ctrl=%d shift=%d v=%d", keymap.Size, keys.ctrl, keys.shift, keys.v)
+
+	if keys.ctrl == fallbackCtrlKey && keys.shift == fallbackShiftKey && keys.v == fallbackVKey {
+		t.Log("all keycodes are fallbacks - parsing may not have matched the live keymap")
+	}
+}

core/internal/clipboard/pastekey_test.go

@@ -0,0 +1,105 @@
+package clipboard
+
+import "testing"
+
+const qwertyKeymap = `xkb_keymap {
+xkb_keycodes "(unnamed)" {
+	minimum = 8;
+	maximum = 708;
+	<ESC>  = 9;
+	<AB04> = 55;
+	<LCTL> = 37;
+	<LFSH> = 50;
+	alias <AL01> = <AC01>;
+	indicator 1 = "Caps Lock";
+};
+xkb_types "(unnamed)" {
+	type "ALPHABETIC" {
+		modifiers = Shift+Lock;
+		map[Shift] = Level2;
+		level_name[Level1] = "Base";
+	};
+};
+xkb_symbols "(unnamed)" {
+	key <ESC>  { [ Escape ] };
+	key <AB04> { type= "ALPHABETIC", [ v, V ] };
+	key <LCTL> { [ Control_L ] };
+	key <LFSH> { [ Shift_L ] };
+};
+};`
+
+const hexKeymap = `xkb_keymap {
+xkb_keycodes "(unnamed)" {
+	<AB04> = 56;
+	<LCTL> = 38;
+	<LFSH> = 51;
+};
+xkb_symbols "(unnamed)" {
+	key <LCTL> {	[ 0xffe3 ] };
+	key <LFSH> {
+		type= "PC_ALT_LEVEL2",
+		symbols[1]= [ 0xffe1, 0xfe08 ]
+	};
+	key <AB04> {	[ 0x76, 0x56 ] };
+};
+};`
+
+const dvorakKeymap = `xkb_keymap {
+xkb_keycodes "(unnamed)" {
+	<AB09> = 60;
+	<LCTL> = 37;
+	<LFSH> = 50;
+};
+xkb_symbols "(unnamed)" {
+	key <AB09> { [ v, V ] };
+	key <LCTL> { [ Control_L ] };
+	key <LFSH> { [ Shift_L ] };
+};
+};`
+
+func TestResolveKeycodes(t *testing.T) {
+	tests := []struct {
+		name   string
+		keymap string
+		want   pasteKeycodes
+	}{
+		{"qwerty", qwertyKeymap, pasteKeycodes{ctrl: 29, shift: 42, v: 47}},
+		{"dvorak", dvorakKeymap, pasteKeycodes{ctrl: 29, shift: 42, v: 52}},
+		{"hex keysyms", hexKeymap, pasteKeycodes{ctrl: 30, shift: 43, v: 48}},
+		{"empty falls back", "", pasteKeycodes{ctrl: fallbackCtrlKey, shift: fallbackShiftKey, v: fallbackVKey}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := resolveKeycodes(tt.keymap)
+			if got != tt.want {
+				t.Errorf("resolveKeycodes() = %+v, want %+v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestExpandOffers(t *testing.T) {
+	text := ExpandOffers([]byte("hi"), "text/plain;charset=utf-8")
+	if len(text) != 5 {
+		t.Fatalf("expected 5 text offers, got %d", len(text))
+	}
+	seen := map[string]bool{}
+	for _, o := range text {
+		if string(o.Data) != "hi" {
+			t.Errorf("offer %s has wrong data", o.MimeType)
+		}
+		if seen[o.MimeType] {
+			t.Errorf("duplicate offer %s", o.MimeType)
+		}
+		seen[o.MimeType] = true
+	}
+	if !seen["UTF8_STRING"] || !seen["STRING"] || !seen["TEXT"] || !seen["text/plain"] {
+		t.Errorf("missing X11 alias offers: %v", seen)
+	}
+
+	img := ExpandOffers([]byte{1}, "image/png")
+	if len(img) != 1 || img[0].MimeType != "image/png" {
+		t.Errorf("non-text mime should not expand, got %+v", img)
+	}
+}

core/internal/clipboard/wl.go

@@ -0,0 +1,93 @@
+package clipboard
+
+import (
+	"fmt"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/ext_data_control"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/virtual_keyboard"
+	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
+)
+
+type session struct {
+	display            *wlclient.Display
+	ctx                *wlclient.Context
+	registry           *wlclient.Registry
+	seat               *wlclient.Seat
+	dataControlMgr     *ext_data_control.ExtDataControlManagerV1
+	virtualKeyboardMgr *virtual_keyboard.ZwpVirtualKeyboardManagerV1
+}
+
+// connectSession opens a short-lived Wayland connection and binds the seat
+// plus whichever clipboard-related globals the compositor advertises.
+func connectSession() (*session, error) {
+	display, err := wlclient.Connect("")
+	if err != nil {
+		return nil, fmt.Errorf("wayland connect: %w", err)
+	}
+
+	s := &session{display: display, ctx: display.Context()}
+
+	registry, err := display.GetRegistry()
+	if err != nil {
+		display.Destroy()
+		return nil, fmt.Errorf("get registry: %w", err)
+	}
+	s.registry = registry
+
+	var bindErr error
+	bind := func(name uint32, iface string, version uint32, proxy wlclient.Proxy) {
+		if err := registry.Bind(name, iface, version, proxy); err != nil {
+			bindErr = fmt.Errorf("bind %s: %w", iface, err)
+		}
+	}
+
+	registry.SetGlobalHandler(func(e wlclient.RegistryGlobalEvent) {
+		switch e.Interface {
+		case ext_data_control.ExtDataControlManagerV1InterfaceName:
+			mgr := ext_data_control.NewExtDataControlManagerV1(s.ctx)
+			bind(e.Name, e.Interface, e.Version, mgr)
+			s.dataControlMgr = mgr
+		case virtual_keyboard.ZwpVirtualKeyboardManagerV1InterfaceName:
+			mgr := virtual_keyboard.NewZwpVirtualKeyboardManagerV1(s.ctx)
+			bind(e.Name, e.Interface, e.Version, mgr)
+			s.virtualKeyboardMgr = mgr
+		case "wl_seat":
+			if s.seat != nil {
+				return
+			}
+			seat := wlclient.NewSeat(s.ctx)
+			bind(e.Name, e.Interface, e.Version, seat)
+			s.seat = seat
+		}
+	})
+
+	display.Roundtrip()
+	display.Roundtrip()
+
+	if bindErr != nil {
+		s.Close()
+		return nil, bindErr
+	}
+	return s, nil
+}
+
+func (s *session) requireDataControl() (*ext_data_control.ExtDataControlManagerV1, error) {
+	switch {
+	case s.dataControlMgr == nil:
+		return nil, fmt.Errorf("compositor does not support ext_data_control_manager_v1")
+	case s.seat == nil:
+		return nil, fmt.Errorf("no seat available")
+	default:
+		return s.dataControlMgr, nil
+	}
+}
+
+func (s *session) Close() {
+	if s.dataControlMgr != nil {
+		s.dataControlMgr.Destroy()
+	}
+	if s.registry != nil {
+		s.registry.Destroy()
+	}
+	s.display.Destroy()
+}

core/internal/config/deployer.go

@@ -880,8 +880,9 @@ func (cd *ConfigDeployer) transformNiriConfigForNonSystemd(config, terminalComma
 
 	config = regexp.MustCompile(`environment \{[^}]*\}`).ReplaceAllString(config, envVars)
 
-	spawnDms := `spawn-at-startup "dms" "run"`
-	if !strings.Contains(config, spawnDms) {
+	// Watcher spawns first so it owns the SNI name before dms/tray apps start.
+	spawnDms := "spawn-at-startup \"dms\" \"tray-watcher\"\nspawn-at-startup \"dms\" \"run\""
+	if !strings.Contains(config, `spawn-at-startup "dms" "run"`) {
 		// Insert spawn-at-startup for dms after the environment block
 		envBlockEnd := regexp.MustCompile(`environment \{[^}]*\}`)
 		if loc := envBlockEnd.FindStringIndex(config); loc != nil {

core/internal/config/deployer_test.go

@@ -520,9 +520,21 @@ func TestHyprlandConfigStructure(t *testing.T) {
 	assert.Contains(t, HyprlandLuaConfig, "input =")
 }
 
+// In non-systemd mode dms is launched from the compositor config, so the tray
+// watcher must be launched there too, before dms, to own the SNI name first.
+func TestNonSystemdLaunchesTrayWatcherBeforeShell(t *testing.T) {
+	hypr := transformHyprlandLuaForNonSystemd(HyprlandLuaConfig, "ghostty")
+	assert.Contains(t, hypr, "hl.exec_cmd(\"dms tray-watcher\")\n\thl.exec_cmd(\"dms run\")")
+
+	niri := (&ConfigDeployer{}).transformNiriConfigForNonSystemd(NiriConfig, "ghostty")
+	assert.Contains(t, niri, "spawn-at-startup \"dms\" \"tray-watcher\"\nspawn-at-startup \"dms\" \"run\"")
+}
+
 func TestMangoConfigStructure(t *testing.T) {
 	assert.Contains(t, MangoConfig, "exec-once=dms run")
 	assert.NotContains(t, MangoConfig, "exec_once=dms run")
+	// Tray watcher must start before the shell so it owns the SNI name first.
+	assert.Contains(t, MangoConfig, "exec-once=dms tray-watcher\nexec-once=dms run")
 	assert.Contains(t, MangoConfig, "source=./dms/binds.conf")
 	assert.Contains(t, MangoBindsConfig, "bind=SUPER,H,focusdir,left")
 	assert.Contains(t, MangoBindsConfig, "bind=SUPER,J,focusdir,down")

core/internal/config/embedded/hyprland.lua

@@ -13,6 +13,7 @@ hl.config({
 	input = {
 		kb_layout = "us",
 		numlock_by_default = true,
+		follow_mouse = 0,
 		touchpad = {
 			tap_to_click = true,
 			natural_scroll = true,

core/internal/config/embedded/mango.conf

@@ -7,7 +7,9 @@ env=XDG_SESSION_TYPE,wayland
 
 # exec-once runs only at startup. Do NOT use exec= for the shell: mango re-runs
 # every exec= on each config reload, and DMS reloads the config, which would
-# spawn a new shell on every reload.
+# spawn a new shell on every reload. The tray watcher starts first so it owns
+# the SNI name before dms and the tray apps come up.
+exec-once=dms tray-watcher
 exec-once=dms run
 
 source=./dms/colors.conf

core/internal/config/hyprland_lua.go

@@ -116,6 +116,7 @@ func transformHyprlandLuaForNonSystemd(config, terminalCommand string) string {
 		`hl.env("QT_QPA_PLATFORMTHEME_QT6", "gtk3")` + "\n" +
 		fmt.Sprintf(`hl.env("TERMINAL", %s)`, strconv.Quote(terminalCommand)) + "\n\n" +
 		`hl.on("hyprland.start", function()` + "\n" +
+		`	hl.exec_cmd("dms tray-watcher")` + "\n" +
 		`	hl.exec_cmd("dms run")` + "\n" +
 		`end)` + "\n" +
 		hyprlandStartupEnd

core/internal/distros/base.go

@@ -587,13 +587,15 @@ TERMINAL=%s
 }
 
 func (b *BaseDistribution) EnableDMSService(ctx context.Context, wm deps.WindowManager) error {
+	// Pull in the tray watcher alongside dms; its Before=graphical-session.target
+	// ordering makes it claim the SNI name before autostart apps start.
 	switch wm {
 	case deps.WindowManagerNiri:
-		if err := exec.CommandContext(ctx, "systemctl", "--user", "add-wants", "niri.service", "dms").Run(); err != nil {
+		if err := exec.CommandContext(ctx, "systemctl", "--user", "add-wants", "niri.service", "dms", "dms-tray-watcher").Run(); err != nil {
 			b.log("Warning: failed to add dms as a want for niri.service")
 		}
 	case deps.WindowManagerHyprland:
-		if err := exec.CommandContext(ctx, "systemctl", "--user", "add-wants", "hyprland-session.target", "dms").Run(); err != nil {
+		if err := exec.CommandContext(ctx, "systemctl", "--user", "add-wants", "hyprland-session.target", "dms", "dms-tray-watcher").Run(); err != nil {
 			b.log("Warning: failed to add dms as a want for hyprland-session.target")
 		}
 	}

core/internal/keybinds/providers/hyprland.go

@@ -1154,7 +1154,7 @@ func readLuaOrHyprlangOverride(path string) (map[string]*hyprlandOverrideBind, e
 	if err != nil {
 		return nil, err
 	}
-	lines := strings.Split(string(data), "\n")
+	lines := expandLuaConfigLines(strings.Split(string(data), "\n"))
 	parser := NewHyprlandParser("")
 	pendingUnbinds := make(map[string]string)
 	for _, line := range lines {

core/internal/keybinds/providers/hyprland_lua_expand.go

@@ -0,0 +1,414 @@
+package providers
+
+import (
+	"maps"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// Lua configs can express binds dynamically: variables (mainMod .. " + C"),
+// tostring() calls, and numeric for loops (workspace binds). This resolves such
+// expressions to literal key combos so the static bind parser can read them.
+
+const luaMaxLoopIterations = 1000
+
+var (
+	luaAssignRE     = regexp.MustCompile(`^(?:local\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+)$`)
+	luaForRE        = regexp.MustCompile(`^for\s+([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(-?\d+)\s*,\s*(-?\d+)\s*(?:,\s*(-?\d+)\s*)?do\b(.*)$`)
+	luaTostringRE   = regexp.MustCompile(`to(?:string|number)\s*\(\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*'|-?\d+(?:\.\d+)?)\s*\)`)
+	luaBlockOpenRE  = regexp.MustCompile(`\b(?:function|for|while|if)\b`)
+	luaBlockCloseRE = regexp.MustCompile(`\bend\b`)
+	luaNumberRE     = regexp.MustCompile(`^-?\d+(?:\.\d+)?$`)
+)
+
+type luaVarEnv map[string]string
+
+type luaForHeader struct {
+	varName string
+	start   int
+	stop    int
+	step    int
+	inline  string
+}
+
+func expandLuaConfigLines(lines []string) []string {
+	return expandLuaBlock(lines, luaVarEnv{})
+}
+
+func expandLuaBlock(lines []string, env luaVarEnv) []string {
+	out := make([]string, 0, len(lines))
+	for i := 0; i < len(lines); i++ {
+		code := strings.TrimSpace(luaStripLineComment(lines[i]))
+
+		if name, value, ok := parseLuaStringAssignment(code, env); ok {
+			env[name] = value
+			out = append(out, lines[i])
+			continue
+		}
+
+		header, ok := parseLuaForHeader(code)
+		if !ok {
+			out = append(out, resolveLuaDynamicLine(lines[i], env))
+			continue
+		}
+
+		body, consumed, complete := collectLuaForBody(header, lines, i)
+		if !complete {
+			out = append(out, resolveLuaDynamicLine(lines[i], env))
+			continue
+		}
+		out = append(out, expandLuaForLoop(header, body, env)...)
+		i = consumed
+	}
+	return out
+}
+
+func parseLuaStringAssignment(code string, env luaVarEnv) (name, value string, ok bool) {
+	m := luaAssignRE.FindStringSubmatch(code)
+	if m == nil {
+		return "", "", false
+	}
+	value, ok = evalLuaConcat(m[2], env)
+	if !ok {
+		return "", "", false
+	}
+	return m[1], value, true
+}
+
+func parseLuaForHeader(code string) (luaForHeader, bool) {
+	m := luaForRE.FindStringSubmatch(code)
+	if m == nil {
+		return luaForHeader{}, false
+	}
+	start, _ := strconv.Atoi(m[2])
+	stop, _ := strconv.Atoi(m[3])
+	step := 1
+	if m[4] != "" {
+		step, _ = strconv.Atoi(m[4])
+	}
+	if step == 0 {
+		return luaForHeader{}, false
+	}
+	return luaForHeader{varName: m[1], start: start, stop: stop, step: step, inline: strings.TrimSpace(m[5])}, true
+}
+
+func collectLuaForBody(header luaForHeader, lines []string, headerIdx int) (body []string, consumed int, complete bool) {
+	depth := 1
+	if header.inline != "" {
+		delta := luaBlockDelta(header.inline)
+		if depth+delta <= 0 {
+			if stmt := strings.TrimSpace(strings.TrimSuffix(strings.TrimSpace(header.inline), "end")); stmt != "" {
+				body = append(body, stmt)
+			}
+			return body, headerIdx, true
+		}
+		depth += delta
+		body = append(body, header.inline)
+	}
+	for j := headerIdx + 1; j < len(lines); j++ {
+		delta := luaBlockDelta(lines[j])
+		if depth+delta <= 0 {
+			return body, j, true
+		}
+		depth += delta
+		body = append(body, lines[j])
+	}
+	return nil, headerIdx, false
+}
+
+func expandLuaForLoop(header luaForHeader, body []string, env luaVarEnv) []string {
+	var out []string
+	inRange := func(v int) bool {
+		if header.step > 0 {
+			return v <= header.stop
+		}
+		return v >= header.stop
+	}
+	count := 0
+	for v := header.start; inRange(v); v += header.step {
+		if count++; count > luaMaxLoopIterations {
+			break
+		}
+		value := strconv.Itoa(v)
+		iterLines := make([]string, len(body))
+		for k, bl := range body {
+			iterLines[k] = substituteLuaIdent(bl, header.varName, value)
+		}
+		out = append(out, expandLuaBlock(iterLines, cloneLuaEnv(env))...)
+	}
+	return out
+}
+
+func luaBlockDelta(line string) int {
+	masked := luaMaskStrings(line)
+	return len(luaBlockOpenRE.FindAllString(masked, -1)) - len(luaBlockCloseRE.FindAllString(masked, -1))
+}
+
+func resolveLuaDynamicLine(line string, env luaVarEnv) string {
+	if !strings.Contains(line, "hl.bind") && !strings.Contains(line, "hl.unbind") {
+		return line
+	}
+	line = normalizeLuaToString(line)
+	return rewriteLuaBindKeyArg(line, env)
+}
+
+func normalizeLuaToString(line string) string {
+	return luaTostringRE.ReplaceAllStringFunc(line, func(m string) string {
+		inner := luaTostringRE.FindStringSubmatch(m)[1]
+		if inner[0] == '"' || inner[0] == '\'' {
+			return inner
+		}
+		return strconv.Quote(inner)
+	})
+}
+
+func rewriteLuaBindKeyArg(line string, env luaVarEnv) string {
+	for _, fn := range []string{"hl.bind", "hl.unbind"} {
+		idx := strings.Index(line, fn)
+		if idx < 0 {
+			continue
+		}
+		open := skipLuaWS(line, idx+len(fn))
+		if open >= len(line) || line[open] != '(' {
+			continue
+		}
+		argStart := skipLuaWS(line, open+1)
+		expr, end, ok := parseLuaFirstArgExpr(line, argStart)
+		if !ok || isLuaPlainStringArg(expr) {
+			continue
+		}
+		value, ok := evalLuaConcat(expr, env)
+		if !ok {
+			continue
+		}
+		return line[:argStart] + strconv.Quote(value) + line[end:]
+	}
+	return line
+}
+
+func evalLuaConcat(expr string, env luaVarEnv) (string, bool) {
+	parts := splitLuaConcat(expr)
+	var sb strings.Builder
+	for _, part := range parts {
+		value, ok := evalLuaOperand(part, env)
+		if !ok {
+			return "", false
+		}
+		sb.WriteString(value)
+	}
+	return sb.String(), true
+}
+
+func evalLuaOperand(op string, env luaVarEnv) (string, bool) {
+	op = strings.TrimSpace(op)
+	if op == "" {
+		return "", false
+	}
+	switch op[0] {
+	case '"', '\'':
+		s, next, ok := parseLuaStringLiteral(op, 0)
+		return s, next == len(op) && ok
+	}
+	if luaNumberRE.MatchString(op) {
+		return op, true
+	}
+	if inner, ok := luaUnwrapCall(op, "tostring"); ok {
+		return evalLuaConcat(inner, env)
+	}
+	if inner, ok := luaUnwrapCall(op, "tonumber"); ok {
+		return evalLuaConcat(inner, env)
+	}
+	if value, ok := env[op]; ok {
+		return value, true
+	}
+	return "", false
+}
+
+func splitLuaConcat(expr string) []string {
+	var parts []string
+	parenDepth, braceDepth, bracketDepth := 0, 0, 0
+	inStr := byte(0)
+	esc := false
+	start := 0
+	for i := 0; i < len(expr); i++ {
+		c := expr[i]
+		if inStr != 0 {
+			switch {
+			case esc:
+				esc = false
+			case c == '\\' && inStr == '"':
+				esc = true
+			case c == inStr:
+				inStr = 0
+			}
+			continue
+		}
+		switch c {
+		case '"', '\'':
+			inStr = c
+		case '(':
+			parenDepth++
+		case ')':
+			if parenDepth > 0 {
+				parenDepth--
+			}
+		case '{':
+			braceDepth++
+		case '}':
+			if braceDepth > 0 {
+				braceDepth--
+			}
+		case '[':
+			bracketDepth++
+		case ']':
+			if bracketDepth > 0 {
+				bracketDepth--
+			}
+		case '.':
+			if parenDepth == 0 && braceDepth == 0 && bracketDepth == 0 && i+1 < len(expr) && expr[i+1] == '.' {
+				parts = append(parts, expr[start:i])
+				i++
+				start = i + 1
+			}
+		}
+	}
+	return append(parts, expr[start:])
+}
+
+func substituteLuaIdent(line, name, value string) string {
+	if !strings.Contains(line, name) {
+		return line
+	}
+	var sb strings.Builder
+	inStr := byte(0)
+	esc := false
+	for i := 0; i < len(line); {
+		c := line[i]
+		if inStr != 0 {
+			sb.WriteByte(c)
+			switch {
+			case esc:
+				esc = false
+			case c == '\\' && inStr == '"':
+				esc = true
+			case c == inStr:
+				inStr = 0
+			}
+			i++
+			continue
+		}
+		if c == '"' || c == '\'' {
+			inStr = c
+			sb.WriteByte(c)
+			i++
+			continue
+		}
+		if isLuaIdentStart(c) {
+			j := i + 1
+			for j < len(line) && isLuaIdentByte(line[j]) {
+				j++
+			}
+			word := line[i:j]
+			if word == name && (i == 0 || line[i-1] != '.') {
+				sb.WriteString(value)
+			} else {
+				sb.WriteString(word)
+			}
+			i = j
+			continue
+		}
+		sb.WriteByte(c)
+		i++
+	}
+	return sb.String()
+}
+
+func luaMaskStrings(line string) string {
+	b := []byte(line)
+	inStr := byte(0)
+	esc := false
+	for i := 0; i < len(b); i++ {
+		c := b[i]
+		if inStr != 0 {
+			wasEnd := !esc && c == inStr
+			esc = !esc && c == '\\' && inStr == '"'
+			b[i] = ' '
+			if wasEnd {
+				inStr = 0
+			}
+			continue
+		}
+		switch c {
+		case '"', '\'':
+			inStr = c
+			b[i] = ' '
+		case '-':
+			if i+1 < len(b) && b[i+1] == '-' {
+				for ; i < len(b); i++ {
+					b[i] = ' '
+				}
+			}
+		}
+	}
+	return string(b)
+}
+
+func luaStripLineComment(line string) string {
+	inStr := byte(0)
+	esc := false
+	for i := 0; i+1 < len(line); i++ {
+		c := line[i]
+		if inStr != 0 {
+			switch {
+			case esc:
+				esc = false
+			case c == '\\' && inStr == '"':
+				esc = true
+			case c == inStr:
+				inStr = 0
+			}
+			continue
+		}
+		switch c {
+		case '"', '\'':
+			inStr = c
+		case '-':
+			if line[i+1] == '-' {
+				return line[:i]
+			}
+		}
+	}
+	return line
+}
+
+func luaUnwrapCall(op, fn string) (string, bool) {
+	op = strings.TrimSpace(op)
+	if !strings.HasPrefix(op, fn) {
+		return "", false
+	}
+	rest := strings.TrimSpace(op[len(fn):])
+	if !strings.HasPrefix(rest, "(") || !strings.HasSuffix(rest, ")") {
+		return "", false
+	}
+	return rest[1 : len(rest)-1], true
+}
+
+func isLuaPlainStringArg(expr string) bool {
+	expr = strings.TrimSpace(expr)
+	if expr == "" || (expr[0] != '"' && expr[0] != '\'') {
+		return false
+	}
+	_, next, ok := parseLuaStringLiteral(expr, 0)
+	return ok && next == len(expr)
+}
+
+func isLuaIdentStart(c byte) bool {
+	return c == '_' || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
+}
+
+func cloneLuaEnv(env luaVarEnv) luaVarEnv {
+	clone := make(luaVarEnv, len(env))
+	maps.Copy(clone, env)
+	return clone
+}

core/internal/keybinds/providers/hyprland_lua_expand_test.go

@@ -0,0 +1,134 @@
+package providers
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestExpandLuaConfigLinesVariableConcat(t *testing.T) {
+	lines := []string{
+		`local mainMod = "SUPER"`,
+		`hl.bind(mainMod .. " + C", hl.dsp.window.close())`,
+		`hl.bind(mainMod .. " + H", hl.dsp.focus({direction = "l"}))`,
+		`hl.bind("ALT + TAB", hl.dsp.window.cycle_next({}))`,
+	}
+	got := expandLuaConfigLines(lines)
+
+	want := []string{
+		`hl.bind("SUPER + C",`,
+		`hl.bind("SUPER + H",`,
+		`hl.bind("ALT + TAB",`,
+	}
+	joined := strings.Join(got, "\n")
+	for _, w := range want {
+		if !strings.Contains(joined, w) {
+			t.Errorf("expanded output missing %q\n---\n%s", w, joined)
+		}
+	}
+}
+
+func TestExpandLuaConfigLinesForLoop(t *testing.T) {
+	lines := []string{
+		`local mainMod = "SUPER"`,
+		`for i = 1, 3 do`,
+		`    hl.bind(mainMod .. " + " .. i, hl.dsp.focus({workspace = tostring(i)}))`,
+		`    hl.bind(mainMod .. " SHIFT + " .. i, hl.dsp.window.move({workspace = tostring(i)}))`,
+		`end`,
+	}
+	got := strings.Join(expandLuaConfigLines(lines), "\n")
+
+	for _, w := range []string{
+		`hl.bind("SUPER + 1",`,
+		`hl.bind("SUPER + 2",`,
+		`hl.bind("SUPER + 3",`,
+		`hl.bind("SUPER SHIFT + 3",`,
+		`{workspace = "1"}`,
+	} {
+		if !strings.Contains(got, w) {
+			t.Errorf("expanded loop missing %q\n---\n%s", w, got)
+		}
+	}
+}
+
+func TestParseLuaLinesDynamicBinds(t *testing.T) {
+	content := strings.Join([]string{
+		`local mainMod = "SUPER"`,
+		`hl.bind(mainMod .. " + C", hl.dsp.window.close())`,
+		`hl.bind("ALT + TAB", hl.dsp.window.cycle_next({}))`,
+		`for i = 1, 2 do`,
+		`    hl.bind(mainMod .. " + " .. i, hl.dsp.focus({workspace = tostring(i)}))`,
+		`end`,
+	}, "\n")
+
+	parser := NewHyprlandParser("")
+	section, err := parser.parseLuaLines(content, "", "test.lua", "")
+	if err != nil {
+		t.Fatalf("parseLuaLines: %v", err)
+	}
+
+	keys := map[string]*HyprlandKeyBinding{}
+	for i := range section.Keybinds {
+		kb := &section.Keybinds[i]
+		keys[parser.formatBindKey(kb)] = kb
+	}
+
+	for _, want := range []string{"SUPER+C", "ALT+TAB", "SUPER+1", "SUPER+2"} {
+		if _, ok := keys[want]; !ok {
+			t.Errorf("missing bind %q; got %v", want, keysList(keys))
+		}
+	}
+	if kb := keys["SUPER+C"]; kb != nil && kb.Dispatcher != "killactive" {
+		t.Errorf("SUPER+C dispatcher = %q, want killactive", kb.Dispatcher)
+	}
+	if kb := keys["SUPER+1"]; kb != nil {
+		if kb.Dispatcher != "workspace" || kb.Params != "1" {
+			t.Errorf("SUPER+1 = %q %q, want workspace 1", kb.Dispatcher, kb.Params)
+		}
+	}
+}
+
+func keysList(m map[string]*HyprlandKeyBinding) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	return out
+}
+
+func TestEvalLuaConcat(t *testing.T) {
+	env := luaVarEnv{"mainMod": "SUPER", "i": "5"}
+	tests := []struct {
+		expr string
+		want string
+		ok   bool
+	}{
+		{`mainMod .. " + C"`, "SUPER + C", true},
+		{`mainMod .. " + " .. i`, "SUPER + 5", true},
+		{`mainMod .. " + " .. tostring(i)`, "SUPER + 5", true},
+		{`"ALT + TAB"`, "ALT + TAB", true},
+		{`mainMod .. someFunc()`, "", false},
+		{`unknownVar .. "x"`, "", false},
+	}
+	for _, tt := range tests {
+		got, ok := evalLuaConcat(tt.expr, env)
+		if ok != tt.ok || (ok && got != tt.want) {
+			t.Errorf("evalLuaConcat(%q) = %q,%v want %q,%v", tt.expr, got, ok, tt.want, tt.ok)
+		}
+	}
+}
+
+func TestSubstituteLuaIdent(t *testing.T) {
+	tests := []struct {
+		line, name, value, want string
+	}{
+		{`hl.bind(m .. " + " .. i, x)`, "i", "3", `hl.bind(m .. " + " .. 3, x)`},
+		{`hl.dsp.exec("light -i")`, "i", "3", `hl.dsp.exec("light -i")`},
+		{`foo.i`, "i", "3", `foo.i`},
+		{`tostring(i)`, "i", "3", `tostring(3)`},
+	}
+	for _, tt := range tests {
+		if got := substituteLuaIdent(tt.line, tt.name, tt.value); got != tt.want {
+			t.Errorf("substituteLuaIdent(%q,%q,%q) = %q, want %q", tt.line, tt.name, tt.value, got, tt.want)
+		}
+	}
+}

core/internal/keybinds/providers/hyprland_parser.go

@@ -623,7 +623,7 @@ func (p *HyprlandParser) parseLuaLines(content string, baseDir, absPath, section
 	prevSource := p.currentSource
 	p.currentSource = absPath
 
-	lines := strings.Split(content, "\n")
+	lines := expandLuaConfigLines(strings.Split(content, "\n"))
 	boundInFile := make(map[string]bool)
 	for _, line := range lines {
 		trimmed := strings.TrimSpace(line)

core/internal/keybinds/providers/niri.go

@@ -19,6 +19,20 @@ type NiriProvider struct {
 	parsed           bool
 }
 
+type niriActionPart struct {
+	value  string
+	quoted bool
+}
+
+var niriActionPropertyOrder = []string{"focus", "show-pointer", "write-to-disk", "skip-confirmation", "delay-ms"}
+var niriActionProperties = map[string]struct{}{
+	"focus":             {},
+	"show-pointer":      {},
+	"write-to-disk":     {},
+	"skip-confirmation": {},
+	"delay-ms":          {},
+}
+
 func NewNiriProvider(configDir string) *NiriProvider {
 	if configDir == "" {
 		configDir = defaultNiriConfigDir()
@@ -55,6 +69,7 @@ func (n *NiriProvider) GetCheatSheet() (*keybinds.CheatSheet, error) {
 	sheet := &keybinds.CheatSheet{
 		Title:            "Niri Keybinds",
 		Provider:         n.Name(),
+		ModKey:           result.ModKey,
 		Binds:            categorizedBinds,
 		DMSBindsIncluded: result.DMSBindsIncluded,
 	}
@@ -352,7 +367,7 @@ func (n *NiriProvider) buildActionFromNode(bindNode *document.Node) string {
 	}
 
 	if actionNode.Properties != nil {
-		for _, propName := range []string{"focus", "show-pointer", "write-to-disk", "skip-confirmation", "delay-ms"} {
+		for _, propName := range niriActionPropertyOrder {
 			if val, ok := actionNode.Properties.Get(propName); ok {
 				parts = append(parts, propName+"="+val.String())
 			}
@@ -440,10 +455,10 @@ func (n *NiriProvider) buildActionNode(action string) *document.Node {
 		return node
 	}
 
-	node.SetName(parts[0])
+	node.SetName(parts[0].value)
 	for _, arg := range parts[1:] {
-		if strings.Contains(arg, "=") {
-			kv := strings.SplitN(arg, "=", 2)
+		if n.isNiriActionPropertyToken(arg) {
+			kv := strings.SplitN(arg.value, "=", 2)
 			switch kv[1] {
 			case "true":
 				node.AddProperty(kv[0], true, "")
@@ -454,13 +469,25 @@ func (n *NiriProvider) buildActionNode(action string) *document.Node {
 			}
 			continue
 		}
-		node.AddArgument(arg, "")
+		node.AddArgument(arg.value, "")
 	}
 	return node
 }
 
-func (n *NiriProvider) parseActionParts(action string) []string {
-	var parts []string
+func (n *NiriProvider) isNiriActionPropertyToken(part niriActionPart) bool {
+	if part.quoted || !strings.Contains(part.value, "=") {
+		return false
+	}
+	key, _, ok := strings.Cut(part.value, "=")
+	if !ok {
+		return false
+	}
+	_, ok = niriActionProperties[key]
+	return ok
+}
+
+func (n *NiriProvider) parseActionParts(action string) []niriActionPart {
+	var parts []niriActionPart
 	var current strings.Builder
 	var inQuote, escaped, wasQuoted bool
 
@@ -476,7 +503,7 @@ func (n *NiriProvider) parseActionParts(action string) []string {
 			inQuote = !inQuote
 		case r == ' ' && !inQuote:
 			if current.Len() > 0 || wasQuoted {
-				parts = append(parts, current.String())
+				parts = append(parts, niriActionPart{value: current.String(), quoted: wasQuoted})
 				current.Reset()
 				wasQuoted = false
 			}
@@ -485,7 +512,7 @@ func (n *NiriProvider) parseActionParts(action string) []string {
 		}
 	}
 	if current.Len() > 0 || wasQuoted {
-		parts = append(parts, current.String())
+		parts = append(parts, niriActionPart{value: current.String(), quoted: wasQuoted})
 	}
 	return parts
 }

core/internal/keybinds/providers/niri_parser.go

@@ -33,6 +33,7 @@ type NiriSection struct {
 
 type NiriParser struct {
 	configDir          string
+	modKey             string
 	processedFiles     map[string]bool
 	bindMap            map[string]*NiriKeyBinding
 	bindOrder          []string
@@ -237,6 +238,7 @@ func isBraceAdjacentSpace(b byte) bool {
 func NewNiriParser(configDir string) *NiriParser {
 	return &NiriParser{
 		configDir:          configDir,
+		modKey:             "Super",
 		processedFiles:     make(map[string]bool),
 		bindMap:            make(map[string]*NiriKeyBinding),
 		bindOrder:          []string{},
@@ -377,6 +379,8 @@ func (p *NiriParser) processNodes(nodes []*document.Node, section *NiriSection,
 		switch name {
 		case "include":
 			p.handleInclude(node, section, baseDir)
+		case "input":
+			p.handleInput(node)
 		case "binds":
 			p.extractBinds(node, section, "")
 		case "recent-windows":
@@ -385,6 +389,19 @@ func (p *NiriParser) processNodes(nodes []*document.Node, section *NiriSection,
 	}
 }
 
+func (p *NiriParser) handleInput(node *document.Node) {
+	for _, child := range node.Children {
+		if child.Name.String() != "mod-key" || len(child.Arguments) == 0 {
+			continue
+		}
+
+		modKey := strings.Trim(strings.TrimSpace(child.Arguments[0].String()), "\"")
+		if modKey != "" {
+			p.modKey = modKey
+		}
+	}
+}
+
 func (p *NiriParser) handleInclude(node *document.Node, section *NiriSection, baseDir string) {
 	if len(node.Arguments) == 0 {
 		return
@@ -534,6 +551,7 @@ func (p *NiriParser) parseKeyCombo(combo string) ([]string, string) {
 
 type NiriParseResult struct {
 	Section            *NiriSection
+	ModKey             string
 	DMSBindsIncluded   bool
 	DMSStatus          *DMSBindsStatusInfo
 	ConflictingConfigs map[string]*NiriKeyBinding
@@ -586,6 +604,7 @@ func ParseNiriKeys(configDir string) (*NiriParseResult, error) {
 	}
 	return &NiriParseResult{
 		Section:            section,
+		ModKey:             parser.modKey,
 		DMSBindsIncluded:   parser.HasDMSBindsIncluded(),
 		DMSStatus:          parser.buildDMSStatus(),
 		ConflictingConfigs: parser.conflictingConfigs,

core/internal/keybinds/providers/niri_parser_test.go

@@ -7,6 +7,28 @@ import (
 	"testing"
 )
 
+func TestNiriParseModKey(t *testing.T) {
+	config := `input {
+    mod-key "Alt"
+}
+binds {
+    Mod+T { spawn "kitty"; }
+}
+`
+	tmpDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(tmpDir, "config.kdl"), []byte(config), 0o644); err != nil {
+		t.Fatalf("Failed to write test config: %v", err)
+	}
+
+	result, err := ParseNiriKeys(tmpDir)
+	if err != nil {
+		t.Fatalf("ParseNiriKeys failed: %v", err)
+	}
+	if result.ModKey != "Alt" {
+		t.Errorf("ModKey = %q, want %q", result.ModKey, "Alt")
+	}
+}
+
 func TestNiriParse_NoSpaceBeforeBrace(t *testing.T) {
 	config := `recent-windows {
     binds {

core/internal/keybinds/providers/niri_test.go

@@ -17,7 +17,10 @@ func TestNiriProviderGetCheatSheet(t *testing.T) {
 	tmpDir := t.TempDir()
 	configFile := filepath.Join(tmpDir, "config.kdl")
 
-	content := `binds {
+	content := `input {
+    mod-key "Alt"
+}
+binds {
     Mod+Q { close-window; }
     Mod+F { fullscreen-window; }
     Mod+T hotkey-overlay-title="Open Terminal" { spawn "kitty"; }
@@ -45,6 +48,10 @@ func TestNiriProviderGetCheatSheet(t *testing.T) {
 		t.Errorf("Provider = %q, want %q", cheatSheet.Provider, "niri")
 	}
 
+	if cheatSheet.ModKey != "Alt" {
+		t.Errorf("ModKey = %q, want %q", cheatSheet.ModKey, "Alt")
+	}
+
 	windowBinds := cheatSheet.Binds["Window"]
 	if len(windowBinds) < 2 {
 		t.Errorf("Expected at least 2 Window binds, got %d", len(windowBinds))
@@ -227,6 +234,58 @@ func TestNiriGenerateBindsContent(t *testing.T) {
 			expected: `binds {
     Mod+Space hotkey-overlay-title="Application Launcher" { spawn "dms" "ipc" "call" "spotlight" "toggle"; }
 }
+`,
+		},
+		{
+			name: "spawn with equals arg",
+			binds: map[string]*overrideBind{
+				"Mod+B": {
+					Key:    "Mod+B",
+					Action: `spawn /opt/browser --profile-directory=Default`,
+				},
+			},
+			expected: `binds {
+    Mod+B { spawn "/opt/browser" "--profile-directory=Default"; }
+}
+`,
+		},
+		{
+			name: "spawn shell command with quoted equals args",
+			binds: map[string]*overrideBind{
+				"Mod+C": {
+					Key:    "Mod+C",
+					Action: `spawn sh -c "chrome --profile-directory=Default --app=x"`,
+				},
+			},
+			expected: `binds {
+    Mod+C { spawn "sh" "-c" "chrome --profile-directory=Default --app=x"; }
+}
+`,
+		},
+		{
+			name: "spawn env assignment stays arg",
+			binds: map[string]*overrideBind{
+				"Mod+E": {
+					Key:    "Mod+E",
+					Action: `spawn env FOO=bar mycmd`,
+				},
+			},
+			expected: `binds {
+    Mod+E { spawn "env" "FOO=bar" "mycmd"; }
+}
+`,
+		},
+		{
+			name: "niri action property remains property",
+			binds: map[string]*overrideBind{
+				"Print": {
+					Key:    "Print",
+					Action: `screenshot show-pointer=false`,
+				},
+			},
+			expected: `binds {
+    Print { screenshot show-pointer=false; }
+}
 `,
 		},
 		{

core/internal/keybinds/types.go

@@ -32,6 +32,7 @@ type DMSBindsStatus struct {
 type CheatSheet struct {
 	Title            string               `json:"title"`
 	Provider         string               `json:"provider"`
+	ModKey           string               `json:"modKey,omitempty"`
 	Binds            map[string][]Keybind `json:"binds"`
 	DMSBindsIncluded bool                 `json:"dmsBindsIncluded"`
 	DMSStatus        *DMSBindsStatus      `json:"dmsStatus,omitempty"`

core/internal/matugen/matugen.go

@@ -118,6 +118,50 @@ type ColorsOutput struct {
 	} `json:"colors"`
 }
 
+type SchemePreview struct {
+	Dark  string `json:"dark"`
+	Light string `json:"light"`
+}
+
+var previewSchemeTypes = []string{
+	"scheme-tonal-spot",
+	"scheme-vibrant",
+	"scheme-content",
+	"scheme-expressive",
+	"scheme-fidelity",
+	"scheme-fruit-salad",
+	"scheme-monochrome",
+	"scheme-neutral",
+	"scheme-rainbow",
+}
+
+func PreviewSchemes(sourceColor string, contrast float64) (map[string]SchemePreview, error) {
+	if sourceColor == "" {
+		return nil, fmt.Errorf("source color is required")
+	}
+
+	previews := make(map[string]SchemePreview, len(previewSchemeTypes))
+	for _, schemeType := range previewSchemeTypes {
+		output, err := runMatugenDryRun(&Options{
+			Kind:        "hex",
+			Value:       sourceColor,
+			MatugenType: schemeType,
+			Contrast:    contrast,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("preview %s: %w", schemeType, err)
+		}
+
+		dark := extractMatugenColor(output, "primary", "dark")
+		light := extractMatugenColor(output, "primary", "light")
+		if dark == "" || light == "" {
+			return nil, fmt.Errorf("preview %s: primary colors missing from matugen output", schemeType)
+		}
+		previews[schemeType] = SchemePreview{Dark: dark, Light: light}
+	}
+	return previews, nil
+}
+
 func (o *Options) ColorsOutput() string {
 	return filepath.Join(o.StateDir, "dms-colors.json")
 }
@@ -655,6 +699,7 @@ func redetectMatugenVersion(old matugenFlags) (matugenFlags, bool) {
 
 func detectMatugenVersionLocked() (matugenFlags, error) {
 	cmd := exec.Command("matugen", "--version")
+	cmd.Env = utils.EnvWithUserBinPath(nil)
 	output, err := cmd.Output()
 	if err != nil {
 		return matugenFlags{}, fmt.Errorf("failed to get matugen version: %w", err)
@@ -711,6 +756,7 @@ func runMatugen(baseArgs []string) error {
 
 	args := buildMatugenArgs(baseArgs, flags)
 	cmd := exec.Command("matugen", args...)
+	cmd.Env = utils.EnvWithUserBinPath(nil)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	runErr := cmd.Run()
@@ -728,6 +774,7 @@ func runMatugen(baseArgs []string) error {
 	log.Warnf("Matugen version changed (v4: %v -> %v), retrying", flags.isV4, newFlags.isV4)
 	args = buildMatugenArgs(baseArgs, newFlags)
 	retryCmd := exec.Command("matugen", args...)
+	retryCmd.Env = utils.EnvWithUserBinPath(nil)
 	retryCmd.Stdout = os.Stdout
 	retryCmd.Stderr = os.Stderr
 	return retryCmd.Run()
@@ -770,6 +817,7 @@ func execDryRun(opts *Options, flags matugenFlags) (string, error) {
 	}
 
 	cmd := exec.Command("matugen", baseArgs...)
+	cmd.Env = utils.EnvWithUserBinPath(nil)
 	var stderr strings.Builder
 	cmd.Stderr = &stderr
 	output, err := cmd.Output()
@@ -868,7 +916,26 @@ func refreshGTK(mode ColorMode) {
 	}
 }
 
+var colorSchemeEchoHook func(scheme string)
+
+func SetColorSchemeEchoHook(hook func(scheme string)) {
+	colorSchemeEchoHook = hook
+}
+
+func expectColorSchemeEcho(scheme string) {
+	if colorSchemeEchoHook != nil {
+		colorSchemeEchoHook(scheme)
+	}
+}
+
+// The color-scheme round trip is the only mechanism that makes running GTK4
+// apps reload ~/.config/gtk-4.0 CSS (a gtk-theme flip does not). But apps
+// following the portal color-scheme (Chromium) can drop the restore signal
+// mid-repaint and latch the wrong mode, so this is opt-in.
 func refreshGTK4() {
+	if os.Getenv("DMS_ENABLE_GTK4_REFRESH") != "1" {
+		return
+	}
 	output, err := utils.GsettingsGet("org.gnome.desktop.interface", "color-scheme")
 	if err != nil {
 		return
@@ -882,11 +949,13 @@ func refreshGTK4() {
 		toggle = "prefer-dark"
 	}
 
+	expectColorSchemeEcho(toggle)
 	if err := utils.GsettingsSet("org.gnome.desktop.interface", "color-scheme", toggle); err != nil {
 		log.Warnf("Failed to toggle color-scheme for GTK4 refresh: %v", err)
 		return
 	}
-	time.Sleep(50 * time.Millisecond)
+	time.Sleep(400 * time.Millisecond)
+	expectColorSchemeEcho(current)
 	if err := utils.GsettingsSet("org.gnome.desktop.interface", "color-scheme", current); err != nil {
 		log.Warnf("Failed to restore color-scheme for GTK4 refresh: %v", err)
 	}
@@ -987,6 +1056,9 @@ func closestAdwaitaAccent(primaryHex string) string {
 
 func syncAccentColor(primaryHex string) {
 	accent := closestAdwaitaAccent(primaryHex)
+	if cur, err := utils.GsettingsGet("org.gnome.desktop.interface", "accent-color"); err == nil && strings.Trim(cur, "'") == accent {
+		return
+	}
 	log.Infof("Setting GNOME accent color: %s", accent)
 	if err := utils.GsettingsSet("org.gnome.desktop.interface", "accent-color", accent); err != nil {
 		log.Warnf("Failed to set accent-color: %v", err)

core/internal/plugins/manager.go

@@ -554,35 +554,50 @@ func (m *Manager) findInDirByIDOrName(dir, idOrName string) (string, error) {
 	return "", nil
 }
 
-func (m *Manager) HasUpdates(pluginID string, plugin Plugin) (bool, error) {
+func (m *Manager) HasUpdates(pluginID string, plugin Plugin) (hasUpdates bool, diffURL string, err error) {
 	pluginPath, err := m.findInstalledPath(pluginID)
 	if err != nil {
-		return false, fmt.Errorf("failed to find plugin: %w", err)
+		return false, "", fmt.Errorf("failed to find plugin: %w", err)
 	}
 
 	if pluginPath == "" {
-		return false, fmt.Errorf("plugin not installed: %s", pluginID)
+		return false, "", fmt.Errorf("plugin not installed: %s", pluginID)
 	}
 
 	if strings.HasPrefix(pluginPath, "/etc/xdg/quickshell/dms-plugins") {
-		return false, nil
+		return false, "", nil
 	}
 
 	metaPath := pluginPath + ".meta"
 	metaExists, err := afero.Exists(m.fs, metaPath)
 	if err != nil {
-		return false, fmt.Errorf("failed to check metadata: %w", err)
+		return false, "", fmt.Errorf("failed to check metadata: %w", err)
 	}
 
+	var hasUp bool
+	var localHash, remoteHash string
 	if metaExists {
 		// Plugin is from a monorepo, check the repo directory
 		reposDir := filepath.Join(m.pluginsDir, ".repos")
 		repoName := m.getRepoName(plugin.Repo)
 		repoPath := filepath.Join(reposDir, repoName)
 
-		return m.gitClient.HasUpdates(repoPath)
+		hasUp, localHash, remoteHash, err = m.gitClient.HasUpdates(repoPath)
+	} else {
+		// Plugin is a standalone repo
+		hasUp, localHash, remoteHash, err = m.gitClient.HasUpdates(pluginPath)
 	}
 
-	// Plugin is a standalone repo
-	return m.gitClient.HasUpdates(pluginPath)
+	if err != nil {
+		return false, "", err
+	}
+
+	diffURL = plugin.Repo
+	if diffURL != "" {
+		diffURL = strings.TrimSuffix(diffURL, ".git")
+		if hasUp && len(localHash) >= 7 && len(remoteHash) >= 7 {
+			diffURL = fmt.Sprintf("%s/compare/%s...%s", diffURL, localHash[:7], remoteHash[:7])
+		}
+	}
+	return hasUp, diffURL, nil
 }

core/internal/plugins/registry.go

@@ -33,7 +33,7 @@ type Plugin struct {
 type GitClient interface {
 	PlainClone(path string, url string) error
 	Pull(path string) error
-	HasUpdates(path string) (bool, error)
+	HasUpdates(path string) (hasUpdates bool, localHash string, remoteHash string, err error)
 }
 
 type realGitClient struct{}
@@ -65,10 +65,10 @@ func (g *realGitClient) Pull(path string) error {
 	return nil
 }
 
-func (g *realGitClient) HasUpdates(path string) (bool, error) {
+func (g *realGitClient) HasUpdates(path string) (bool, string, string, error) {
 	repo, err := git.PlainOpen(path)
 	if err != nil {
-		return false, err
+		return false, "", "", err
 	}
 
 	// Fetch remote changes
@@ -76,24 +76,24 @@ func (g *realGitClient) HasUpdates(path string) (bool, error) {
 	if err != nil && err.Error() != "already up-to-date" {
 		// If fetch fails, we can't determine if there are updates
 		// Return false and the error
-		return false, err
+		return false, "", "", err
 	}
 
 	// Get the HEAD reference
 	head, err := repo.Head()
 	if err != nil {
-		return false, err
+		return false, "", "", err
 	}
 
 	// Get the remote HEAD reference (typically origin/HEAD or origin/main or origin/master)
 	remote, err := repo.Remote("origin")
 	if err != nil {
-		return false, err
+		return false, "", "", err
 	}
 
 	refs, err := remote.List(&git.ListOptions{})
 	if err != nil {
-		return false, err
+		return false, "", "", err
 	}
 
 	// Find the default branch remote ref
@@ -108,13 +108,14 @@ func (g *realGitClient) HasUpdates(path string) (bool, error) {
 		}
 	}
 
+	localHash := head.Hash().String()
 	// If we couldn't find a remote HEAD, assume no updates
 	if remoteHead == "" {
-		return false, nil
+		return false, localHash, "", nil
 	}
 
 	// Compare local HEAD with remote HEAD
-	return head.Hash().String() != remoteHead, nil
+	return localHash != remoteHead, localHash, remoteHead, nil
 }
 
 type Registry struct {

core/internal/plugins/registry_test.go

@@ -13,7 +13,7 @@ import (
 type mockGitClient struct {
 	cloneFunc      func(path string, url string) error
 	pullFunc       func(path string) error
-	hasUpdatesFunc func(path string) (bool, error)
+	hasUpdatesFunc func(path string) (bool, string, string, error)
 }
 
 func (m *mockGitClient) PlainClone(path string, url string) error {
@@ -30,11 +30,11 @@ func (m *mockGitClient) Pull(path string) error {
 	return nil
 }
 
-func (m *mockGitClient) HasUpdates(path string) (bool, error) {
+func (m *mockGitClient) HasUpdates(path string) (bool, string, string, error) {
 	if m.hasUpdatesFunc != nil {
 		return m.hasUpdatesFunc(path)
 	}
-	return false, nil
+	return false, "", "", nil
 }
 
 func TestNewRegistry(t *testing.T) {

core/internal/proto/virtual_keyboard/virtual_keyboard.go

@@ -0,0 +1,289 @@
+// Generated by go-wayland-scanner
+// https://github.com/yaslama/go-wayland/cmd/go-wayland-scanner
+// XML file : internal/proto/xml/virtual-keyboard-unstable-v1.xml
+//
+// virtual_keyboard_unstable_v1 Protocol Copyright:
+//
+// Copyright © 2008-2011  Kristian Høgsberg
+// Copyright © 2010-2013  Intel Corporation
+// Copyright © 2012-2013  Collabora, Ltd.
+// Copyright © 2018       Purism SPC
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the "Software"),
+// to deal in the Software without restriction, including without limitation
+// the rights to use, copy, modify, merge, publish, distribute, sublicense,
+// and/or sell copies of the Software, and to permit persons to whom the
+// Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice (including the next
+// paragraph) shall be included in all copies or substantial portions of the
+// Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+// THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+
+package virtual_keyboard
+
+import (
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
+	"golang.org/x/sys/unix"
+)
+
+// ZwpVirtualKeyboardV1InterfaceName is the name of the interface as it appears in the [client.Registry].
+// It can be used to match the [client.RegistryGlobalEvent.Interface] in the
+// [Registry.SetGlobalHandler] and can be used in [Registry.Bind] if this applies.
+const ZwpVirtualKeyboardV1InterfaceName = "zwp_virtual_keyboard_v1"
+
+// ZwpVirtualKeyboardV1 : virtual keyboard
+//
+// The virtual keyboard provides an application with requests which emulate
+// the behaviour of a physical keyboard.
+//
+// This interface can be used by clients on its own to provide raw input
+// events, or it can accompany the input method protocol.
+type ZwpVirtualKeyboardV1 struct {
+	client.BaseProxy
+}
+
+// NewZwpVirtualKeyboardV1 : virtual keyboard
+//
+// The virtual keyboard provides an application with requests which emulate
+// the behaviour of a physical keyboard.
+//
+// This interface can be used by clients on its own to provide raw input
+// events, or it can accompany the input method protocol.
+func NewZwpVirtualKeyboardV1(ctx *client.Context) *ZwpVirtualKeyboardV1 {
+	zwpVirtualKeyboardV1 := &ZwpVirtualKeyboardV1{}
+	ctx.Register(zwpVirtualKeyboardV1)
+	return zwpVirtualKeyboardV1
+}
+
+// Keymap : keyboard mapping
+//
+// Provide a file descriptor to the compositor which can be
+// memory-mapped to provide a keyboard mapping description.
+//
+// Format carries a value from the keymap_format enumeration.
+//
+//	format: keymap format
+//	fd: keymap file descriptor
+//	size: keymap size, in bytes
+func (i *ZwpVirtualKeyboardV1) Keymap(format uint32, fd int, size uint32) error {
+	const opcode = 0
+	const _reqBufLen = 8 + 4 + 4
+	var _reqBuf [_reqBufLen]byte
+	l := 0
+	client.PutUint32(_reqBuf[l:4], i.ID())
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(_reqBufLen<<16|opcode&0x0000ffff))
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(format))
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(size))
+	l += 4
+	oob := unix.UnixRights(int(fd))
+	err := i.Context().WriteMsg(_reqBuf[:], oob)
+	return err
+}
+
+// Key : key event
+//
+// A key was pressed or released.
+// The time argument is a timestamp with millisecond granularity, with an
+// undefined base. All requests regarding a single object must share the
+// same clock.
+//
+// Keymap must be set before issuing this request.
+//
+// State carries a value from the key_state enumeration.
+//
+//	time: timestamp with millisecond granularity
+//	key: key that produced the event
+//	state: physical state of the key
+func (i *ZwpVirtualKeyboardV1) Key(time, key, state uint32) error {
+	const opcode = 1
+	const _reqBufLen = 8 + 4 + 4 + 4
+	var _reqBuf [_reqBufLen]byte
+	l := 0
+	client.PutUint32(_reqBuf[l:4], i.ID())
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(_reqBufLen<<16|opcode&0x0000ffff))
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(time))
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(key))
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(state))
+	l += 4
+	err := i.Context().WriteMsg(_reqBuf[:], nil)
+	return err
+}
+
+// Modifiers : modifier and group state
+//
+// Notifies the compositor that the modifier and/or group state has
+// changed, and it should update state.
+//
+// The client should use wl_keyboard.modifiers event to synchronize its
+// internal state with seat state.
+//
+// Keymap must be set before issuing this request.
+//
+//	modsDepressed: depressed modifiers
+//	modsLatched: latched modifiers
+//	modsLocked: locked modifiers
+//	group: keyboard layout
+func (i *ZwpVirtualKeyboardV1) Modifiers(modsDepressed, modsLatched, modsLocked, group uint32) error {
+	const opcode = 2
+	const _reqBufLen = 8 + 4 + 4 + 4 + 4
+	var _reqBuf [_reqBufLen]byte
+	l := 0
+	client.PutUint32(_reqBuf[l:4], i.ID())
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(_reqBufLen<<16|opcode&0x0000ffff))
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(modsDepressed))
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(modsLatched))
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(modsLocked))
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(group))
+	l += 4
+	err := i.Context().WriteMsg(_reqBuf[:], nil)
+	return err
+}
+
+// Destroy : destroy the virtual keyboard keyboard object
+func (i *ZwpVirtualKeyboardV1) Destroy() error {
+	defer i.Context().Unregister(i)
+	const opcode = 3
+	const _reqBufLen = 8
+	var _reqBuf [_reqBufLen]byte
+	l := 0
+	client.PutUint32(_reqBuf[l:4], i.ID())
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(_reqBufLen<<16|opcode&0x0000ffff))
+	l += 4
+	err := i.Context().WriteMsg(_reqBuf[:], nil)
+	return err
+}
+
+type ZwpVirtualKeyboardV1Error uint32
+
+// ZwpVirtualKeyboardV1Error :
+const (
+	// ZwpVirtualKeyboardV1ErrorNoKeymap : No keymap was set
+	ZwpVirtualKeyboardV1ErrorNoKeymap ZwpVirtualKeyboardV1Error = 0
+)
+
+func (e ZwpVirtualKeyboardV1Error) Name() string {
+	switch e {
+	case ZwpVirtualKeyboardV1ErrorNoKeymap:
+		return "no_keymap"
+	default:
+		return ""
+	}
+}
+
+func (e ZwpVirtualKeyboardV1Error) Value() string {
+	switch e {
+	case ZwpVirtualKeyboardV1ErrorNoKeymap:
+		return "0"
+	default:
+		return ""
+	}
+}
+
+func (e ZwpVirtualKeyboardV1Error) String() string {
+	return e.Name() + "=" + e.Value()
+}
+
+// ZwpVirtualKeyboardManagerV1InterfaceName is the name of the interface as it appears in the [client.Registry].
+// It can be used to match the [client.RegistryGlobalEvent.Interface] in the
+// [Registry.SetGlobalHandler] and can be used in [Registry.Bind] if this applies.
+const ZwpVirtualKeyboardManagerV1InterfaceName = "zwp_virtual_keyboard_manager_v1"
+
+// ZwpVirtualKeyboardManagerV1 : virtual keyboard manager
+//
+// A virtual keyboard manager allows an application to provide keyboard
+// input events as if they came from a physical keyboard.
+type ZwpVirtualKeyboardManagerV1 struct {
+	client.BaseProxy
+}
+
+// NewZwpVirtualKeyboardManagerV1 : virtual keyboard manager
+//
+// A virtual keyboard manager allows an application to provide keyboard
+// input events as if they came from a physical keyboard.
+func NewZwpVirtualKeyboardManagerV1(ctx *client.Context) *ZwpVirtualKeyboardManagerV1 {
+	zwpVirtualKeyboardManagerV1 := &ZwpVirtualKeyboardManagerV1{}
+	ctx.Register(zwpVirtualKeyboardManagerV1)
+	return zwpVirtualKeyboardManagerV1
+}
+
+// CreateVirtualKeyboard : Create a new virtual keyboard
+//
+// Creates a new virtual keyboard associated to a seat.
+//
+// If the compositor enables a keyboard to perform arbitrary actions, it
+// should present an error when an untrusted client requests a new
+// keyboard.
+func (i *ZwpVirtualKeyboardManagerV1) CreateVirtualKeyboard(seat *client.Seat) (*ZwpVirtualKeyboardV1, error) {
+	id := NewZwpVirtualKeyboardV1(i.Context())
+	const opcode = 0
+	const _reqBufLen = 8 + 4 + 4
+	var _reqBuf [_reqBufLen]byte
+	l := 0
+	client.PutUint32(_reqBuf[l:4], i.ID())
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], uint32(_reqBufLen<<16|opcode&0x0000ffff))
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], seat.ID())
+	l += 4
+	client.PutUint32(_reqBuf[l:l+4], id.ID())
+	l += 4
+	err := i.Context().WriteMsg(_reqBuf[:], nil)
+	return id, err
+}
+
+func (i *ZwpVirtualKeyboardManagerV1) Destroy() error {
+	i.Context().Unregister(i)
+	return nil
+}
+
+type ZwpVirtualKeyboardManagerV1Error uint32
+
+// ZwpVirtualKeyboardManagerV1Error :
+const (
+	// ZwpVirtualKeyboardManagerV1ErrorUnauthorized : client not authorized to use the interface
+	ZwpVirtualKeyboardManagerV1ErrorUnauthorized ZwpVirtualKeyboardManagerV1Error = 0
+)
+
+func (e ZwpVirtualKeyboardManagerV1Error) Name() string {
+	switch e {
+	case ZwpVirtualKeyboardManagerV1ErrorUnauthorized:
+		return "unauthorized"
+	default:
+		return ""
+	}
+}
+
+func (e ZwpVirtualKeyboardManagerV1Error) Value() string {
+	switch e {
+	case ZwpVirtualKeyboardManagerV1ErrorUnauthorized:
+		return "0"
+	default:
+		return ""
+	}
+}
+
+func (e ZwpVirtualKeyboardManagerV1Error) String() string {
+	return e.Name() + "=" + e.Value()
+}

core/internal/proto/xml/virtual-keyboard-unstable-v1.xml

@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<protocol name="virtual_keyboard_unstable_v1">
+  <copyright>
+    Copyright © 2008-2011  Kristian Høgsberg
+    Copyright © 2010-2013  Intel Corporation
+    Copyright © 2012-2013  Collabora, Ltd.
+    Copyright © 2018       Purism SPC
+
+    Permission is hereby granted, free of charge, to any person obtaining a
+    copy of this software and associated documentation files (the "Software"),
+    to deal in the Software without restriction, including without limitation
+    the rights to use, copy, modify, merge, publish, distribute, sublicense,
+    and/or sell copies of the Software, and to permit persons to whom the
+    Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice (including the next
+    paragraph) shall be included in all copies or substantial portions of the
+    Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+    THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+    DEALINGS IN THE SOFTWARE.
+  </copyright>
+
+  <interface name="zwp_virtual_keyboard_v1" version="1">
+    <description summary="virtual keyboard">
+      The virtual keyboard provides an application with requests which emulate
+      the behaviour of a physical keyboard.
+
+      This interface can be used by clients on its own to provide raw input
+      events, or it can accompany the input method protocol.
+    </description>
+
+    <request name="keymap">
+      <description summary="keyboard mapping">
+        Provide a file descriptor to the compositor which can be
+        memory-mapped to provide a keyboard mapping description.
+
+        Format carries a value from the keymap_format enumeration.
+      </description>
+      <arg name="format" type="uint" summary="keymap format"/>
+      <arg name="fd" type="fd" summary="keymap file descriptor"/>
+      <arg name="size" type="uint" summary="keymap size, in bytes"/>
+    </request>
+
+    <enum name="error">
+      <entry name="no_keymap" value="0" summary="No keymap was set"/>
+    </enum>
+
+    <request name="key">
+      <description summary="key event">
+        A key was pressed or released.
+        The time argument is a timestamp with millisecond granularity, with an
+        undefined base. All requests regarding a single object must share the
+        same clock.
+
+        Keymap must be set before issuing this request.
+
+        State carries a value from the key_state enumeration.
+      </description>
+      <arg name="time" type="uint" summary="timestamp with millisecond granularity"/>
+      <arg name="key" type="uint" summary="key that produced the event"/>
+      <arg name="state" type="uint" summary="physical state of the key"/>
+    </request>
+
+    <request name="modifiers">
+      <description summary="modifier and group state">
+        Notifies the compositor that the modifier and/or group state has
+        changed, and it should update state.
+
+        The client should use wl_keyboard.modifiers event to synchronize its
+        internal state with seat state.
+
+        Keymap must be set before issuing this request.
+      </description>
+      <arg name="mods_depressed" type="uint" summary="depressed modifiers"/>
+      <arg name="mods_latched" type="uint" summary="latched modifiers"/>
+      <arg name="mods_locked" type="uint" summary="locked modifiers"/>
+      <arg name="group" type="uint" summary="keyboard layout"/>
+    </request>
+
+    <request name="destroy" type="destructor" since="1">
+      <description summary="destroy the virtual keyboard keyboard object"/>
+    </request>
+  </interface>
+
+  <interface name="zwp_virtual_keyboard_manager_v1" version="1">
+    <description summary="virtual keyboard manager">
+      A virtual keyboard manager allows an application to provide keyboard
+      input events as if they came from a physical keyboard.
+    </description>
+
+    <enum name="error">
+      <entry name="unauthorized" value="0" summary="client not authorized to use the interface"/>
+    </enum>
+
+    <request name="create_virtual_keyboard">
+      <description summary="Create a new virtual keyboard">
+        Creates a new virtual keyboard associated to a seat.
+
+        If the compositor enables a keyboard to perform arbitrary actions, it
+        should present an error when an untrusted client requests a new
+        keyboard.
+      </description>
+      <arg name="seat" type="object" interface="wl_seat"/>
+      <arg name="id" type="new_id" interface="zwp_virtual_keyboard_v1"/>
+    </request>
+  </interface>
+</protocol>

core/internal/server/brightness/ddc.go

@@ -68,6 +68,12 @@ func (b *DDCBackend) scanI2CDevicesInternal(force bool) error {
 		activeBuses[i] = true
 		id := fmt.Sprintf("ddc:i2c-%d", i)
 
+		// Don't re-probe identified monitors: DDC traffic during a wake
+		// sequence can disturb some monitors' own brightness handling.
+		if _, ok := b.devices.Load(id); ok {
+			continue
+		}
+
 		dev, err := b.probeDDCDevice(i)
 		if err != nil || dev == nil {
 			continue
@@ -107,7 +113,8 @@ func (b *DDCBackend) probeDDCDevice(bus int) (*ddcDevice, error) {
 	dummy := make([]byte, 32)
 	syscall.Read(fd, dummy) //nolint:errcheck
 
-	writebuf := []byte{0x00}
+	writebuf := []byte{DDC_SOURCE_ADDR, 0x80}
+	writebuf = append(writebuf, ddcciChecksum(writebuf))
 	n, err := syscall.Write(fd, writebuf)
 	if err == nil && n == len(writebuf) {
 		name := b.getDDCName(bus)

core/internal/server/clipboard/handlers.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 
+	clipboardstore "github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/models"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/params"
 )
@@ -28,6 +29,10 @@ func HandleRequest(conn net.Conn, req models.Request, m *Manager) {
 		handleCopyEntry(conn, req, m)
 	case "clipboard.paste":
 		handlePaste(conn, req, m)
+	case "clipboard.sendPaste":
+		handleSendPaste(conn, req)
+	case "clipboard.pasteSupported":
+		models.Respond(conn, req.ID, map[string]bool{"supported": m.pasteSupported})
 	case "clipboard.subscribe":
 		handleSubscribe(conn, req, m)
 	case "clipboard.search":
@@ -176,6 +181,17 @@ func handlePaste(conn net.Conn, req models.Request, m *Manager) {
 	models.Respond(conn, req.ID, map[string]string{"text": text})
 }
 
+func handleSendPaste(conn net.Conn, req models.Request) {
+	shift, _ := models.Get[bool](req, "shift")
+
+	if err := clipboardstore.SendPasteKeystroke(shift); err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+
+	models.Respond(conn, req.ID, models.SuccessResult{Success: true, Message: "paste sent"})
+}
+
 func handleSubscribe(conn net.Conn, req models.Request, m *Manager) {
 	clientID := fmt.Sprintf("clipboard-%d", req.ID)
 

core/internal/server/clipboard/manager.go

@@ -31,6 +31,7 @@ import (
 	clipboardstore "github.com/AvengeMedia/DankMaterialShell/core/internal/clipboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/ext_data_control"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/proto/virtual_keyboard"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/wlcontext"
 	wlclient "github.com/AvengeMedia/DankMaterialShell/core/pkg/go-wayland/wayland/client"
 )
@@ -164,6 +165,8 @@ func (m *Manager) setupRegistry() error {
 			m.seat = seat
 			m.seatName = e.Name
 			log.Info("Bound wl_seat")
+		case virtual_keyboard.ZwpVirtualKeyboardManagerV1InterfaceName:
+			m.pasteSupported = true
 		}
 	})
 
@@ -1054,6 +1057,13 @@ func (m *Manager) SetClipboard(data []byte, mimeType string) error {
 	dataCopy := make([]byte, len(data))
 	copy(dataCopy, data)
 
+	m.takeSelection(clipboardstore.ExpandOffers(dataCopy, mimeType))
+	return nil
+}
+
+// takeSelection makes the daemon the selection owner, serving the given
+// offers until another client claims the clipboard.
+func (m *Manager) takeSelection(offers []clipboardstore.Offer) {
 	m.post(func() {
 		if m.dataControlMgr == nil || m.dataDevice == nil {
 			log.Error("Data control manager or device not initialized")
@@ -1068,9 +1078,13 @@ func (m *Manager) SetClipboard(data []byte, mimeType string) error {
 			return
 		}
 
-		if err := source.Offer(mimeType); err != nil {
-			log.Errorf("Failed to offer mime type: %v", err)
-			return
+		offerData := make(map[string][]byte, len(offers))
+		for _, offer := range offers {
+			if err := source.Offer(offer.MimeType); err != nil {
+				log.Errorf("Failed to offer %s: %v", offer.MimeType, err)
+				return
+			}
+			offerData[offer.MimeType] = offer.Data
 		}
 
 		source.SetSendHandler(func(e ext_data_control.ExtDataControlSourceV1SendEvent) {
@@ -1080,7 +1094,11 @@ func (m *Manager) SetClipboard(data []byte, mimeType string) error {
 			file := os.NewFile(uintptr(fd), "clipboard-pipe")
 			defer file.Close()
 
-			if _, err := file.Write(dataCopy); err != nil {
+			data, ok := offerData[e.MimeType]
+			if !ok {
+				return
+			}
+			if _, err := file.Write(data); err != nil {
 				log.Errorf("Failed to write clipboard data: %v", err)
 			}
 		})
@@ -1093,9 +1111,6 @@ func (m *Manager) SetClipboard(data []byte, mimeType string) error {
 
 		m.releaseCurrentSource()
 		m.currentSource = source
-		m.sourceMutex.Lock()
-		m.sourceMimeTypes = []string{mimeType}
-		m.sourceMutex.Unlock()
 
 		m.ownerLock.Lock()
 		m.isOwner = true
@@ -1106,8 +1121,6 @@ func (m *Manager) SetClipboard(data []byte, mimeType string) error {
 			log.Errorf("Failed to set selection: %v", err)
 		}
 	})
-
-	return nil
 }
 
 func (m *Manager) CopyText(text string) error {
@@ -1779,74 +1792,16 @@ func (m *Manager) CopyFile(filePath string) error {
 	m.updateState()
 	m.notifySubscribers()
 
-	_, imgMime, imgErr := image.DecodeConfig(bytes.NewReader(fileData))
-
-	m.post(func() {
-		if m.dataControlMgr == nil || m.dataDevice == nil {
-			log.Error("Data control manager or device not initialized")
-			return
-		}
-
-		dataMgr := m.dataControlMgr.(*ext_data_control.ExtDataControlManagerV1)
-		source, err := dataMgr.CreateDataSource()
-		if err != nil {
-			log.Errorf("Failed to create data source: %v", err)
-			return
-		}
-
-		type offer struct {
-			mime string
-			data []byte
-		}
-		offers := []offer{
-			{"x-special/gnome-copied-files", []byte("copy\n" + fileURI)},
-			{"text/uri-list", []byte(fileURI + "\r\n")},
-			{"text/plain", []byte(filePath)},
-		}
-
-		if imgErr == nil {
-			imgMimeType := "image/" + imgMime
-			offers = append(offers, offer{imgMimeType, fileData})
-		}
-
-		offerData := make(map[string][]byte)
-		for _, o := range offers {
-			if err := source.Offer(o.mime); err != nil {
-				log.Errorf("Failed to offer %s: %v", o.mime, err)
-				return
-			}
-			offerData[o.mime] = o.data
-		}
-
-		source.SetSendHandler(func(e ext_data_control.ExtDataControlSourceV1SendEvent) {
-			fd := e.Fd
-			defer syscall.Close(fd)
-			file := os.NewFile(uintptr(fd), "clipboard-pipe")
-			defer file.Close()
-			if data, ok := offerData[e.MimeType]; ok {
-				file.Write(data)
-			}
-		})
-
-		source.SetCancelledHandler(func(e ext_data_control.ExtDataControlSourceV1CancelledEvent) {
-			m.ownerLock.Lock()
-			m.isOwner = false
-			m.ownerLock.Unlock()
-		})
-
-		m.releaseCurrentSource()
-		m.currentSource = source
-
-		m.ownerLock.Lock()
-		m.isOwner = true
-		m.ownerLock.Unlock()
-
-		device := m.dataDevice.(*ext_data_control.ExtDataControlDeviceV1)
-		if err := device.SetSelection(source); err != nil {
-			log.Errorf("Failed to set selection: %v", err)
-		}
-	})
+	offers := []clipboardstore.Offer{
+		{MimeType: "x-special/gnome-copied-files", Data: []byte("copy\n" + fileURI)},
+		{MimeType: "text/uri-list", Data: []byte(fileURI + "\r\n")},
+		{MimeType: "text/plain", Data: []byte(filePath)},
+	}
+	if _, imgMime, err := image.DecodeConfig(bytes.NewReader(fileData)); err == nil {
+		offers = append(offers, clipboardstore.Offer{MimeType: "image/" + imgMime, Data: fileData})
+	}
 
+	m.takeSelection(offers)
 	return nil
 }
 

core/internal/server/clipboard/manager_test.go

@@ -531,47 +531,6 @@ func TestManager_ConcurrentOfferAccess(t *testing.T) {
 	wg.Wait()
 }
 
-func TestManager_ConcurrentPersistAccess(t *testing.T) {
-	m := &Manager{
-		persistData:      make(map[string][]byte),
-		persistMimeTypes: []string{},
-	}
-
-	var wg sync.WaitGroup
-	const goroutines = 20
-	const iterations = 50
-
-	for i := 0; i < goroutines/2; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for j := 0; j < iterations; j++ {
-				m.persistMutex.RLock()
-				_ = m.persistData
-				_ = m.persistMimeTypes
-				m.persistMutex.RUnlock()
-			}
-		}()
-	}
-
-	for i := 0; i < goroutines/2; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			for j := 0; j < iterations; j++ {
-				m.persistMutex.Lock()
-				m.persistMimeTypes = []string{"text/plain", "text/html"}
-				m.persistData = map[string][]byte{
-					"text/plain": []byte("test"),
-				}
-				m.persistMutex.Unlock()
-			}
-		}(i)
-	}
-
-	wg.Wait()
-}
-
 func TestManager_ConcurrentOwnerAccess(t *testing.T) {
 	m := &Manager{}
 

core/internal/server/clipboard/types.go

@@ -132,15 +132,9 @@ type Manager struct {
 	offerMutex     sync.RWMutex
 	offerRegistry  map[uint32]any
 
-	sourceMimeTypes []string
-	sourceMutex     sync.RWMutex
-
-	persistData      map[string][]byte
-	persistMimeTypes []string
-	persistMutex     sync.RWMutex
-
-	isOwner   bool
-	ownerLock sync.Mutex
+	isOwner        bool
+	ownerLock      sync.Mutex
+	pasteSupported bool
 
 	initialized bool
 

core/internal/server/freedesktop/manager.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"sync"
+	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/AvengeMedia/DankMaterialShell/core/pkg/dbusutil"
@@ -100,6 +101,41 @@ func (m *Manager) initializeSettings() error {
 	return nil
 }
 
+// ExpectColorSchemeEcho registers a self-write so the watcher swallows its SettingChanged echo instead of forwarding it as an external change.
+func (m *Manager) ExpectColorSchemeEcho(scheme string) {
+	var value uint32
+	switch scheme {
+	case "prefer-dark":
+		value = 1
+	case "prefer-light":
+		value = 2
+	}
+	m.selfEchoMu.Lock()
+	m.selfEchoes = append(m.selfEchoes, colorSchemeEcho{value: value, expires: time.Now().Add(10 * time.Second)})
+	m.selfEchoMu.Unlock()
+}
+
+func (m *Manager) consumeSelfEcho(value uint32) bool {
+	m.selfEchoMu.Lock()
+	defer m.selfEchoMu.Unlock()
+
+	now := time.Now()
+	kept := m.selfEchoes[:0]
+	consumed := false
+	for _, echo := range m.selfEchoes {
+		if now.After(echo.expires) {
+			continue
+		}
+		if !consumed && echo.value == value {
+			consumed = true
+			continue
+		}
+		kept = append(kept, echo)
+	}
+	m.selfEchoes = kept
+	return consumed
+}
+
 func (m *Manager) watchSettingsChanges() {
 	conn, err := dbus.ConnectSessionBus()
 	if err != nil {
@@ -142,13 +178,15 @@ func (m *Manager) watchSettingsChanges() {
 			continue
 		}
 
+		selfInflicted := m.consumeSelfEcho(colorScheme)
+
 		m.stateMutex.Lock()
 		changed := m.state.Settings.ColorScheme != colorScheme || !m.state.Settings.Available
 		m.state.Settings.ColorScheme = colorScheme
 		m.state.Settings.Available = true
 		m.stateMutex.Unlock()
 
-		if changed {
+		if changed && !selfInflicted {
 			m.NotifySubscribers()
 		}
 	}

core/internal/server/freedesktop/manager_test.go

@@ -141,3 +141,45 @@ func TestManager_SettingsState_Modification(t *testing.T) {
 	original := manager.GetState()
 	assert.Equal(t, uint32(0), original.Settings.ColorScheme)
 }
+
+func TestManager_SelfEcho_ConsumesRegisteredWrites(t *testing.T) {
+	manager := &Manager{state: &FreedeskState{}}
+
+	manager.ExpectColorSchemeEcho("prefer-dark")
+	manager.ExpectColorSchemeEcho("default")
+
+	assert.True(t, manager.consumeSelfEcho(1))
+	assert.True(t, manager.consumeSelfEcho(0))
+	assert.False(t, manager.consumeSelfEcho(1))
+	assert.False(t, manager.consumeSelfEcho(0))
+}
+
+func TestManager_SelfEcho_ExternalChangePassesThrough(t *testing.T) {
+	manager := &Manager{state: &FreedeskState{}}
+
+	manager.ExpectColorSchemeEcho("prefer-dark")
+
+	assert.False(t, manager.consumeSelfEcho(2))
+	assert.True(t, manager.consumeSelfEcho(1))
+}
+
+func TestManager_SelfEcho_ConsumesOnePerRegistration(t *testing.T) {
+	manager := &Manager{state: &FreedeskState{}}
+
+	manager.ExpectColorSchemeEcho("prefer-dark")
+	manager.ExpectColorSchemeEcho("prefer-dark")
+
+	assert.True(t, manager.consumeSelfEcho(1))
+	assert.True(t, manager.consumeSelfEcho(1))
+	assert.False(t, manager.consumeSelfEcho(1))
+}
+
+func TestManager_SelfEcho_SchemeMapping(t *testing.T) {
+	manager := &Manager{state: &FreedeskState{}}
+
+	manager.ExpectColorSchemeEcho("prefer-light")
+	assert.True(t, manager.consumeSelfEcho(2))
+
+	manager.ExpectColorSchemeEcho("default")
+	assert.True(t, manager.consumeSelfEcho(0))
+}

core/internal/server/freedesktop/types.go

@@ -2,11 +2,17 @@ package freedesktop
 
 import (
 	"sync"
+	"time"
 
 	"github.com/AvengeMedia/DankMaterialShell/core/pkg/syncmap"
 	"github.com/godbus/dbus/v5"
 )
 
+type colorSchemeEcho struct {
+	value   uint32
+	expires time.Time
+}
+
 type AccountsState struct {
 	Available     bool   `json:"available"`
 	UserPath      string `json:"userPath"`
@@ -63,4 +69,6 @@ type Manager struct {
 	screensaverCookieCounter      uint32
 	screensaverFreedesktopClaimed bool
 	screensaverGnomeClaimed       bool
+	selfEchoMu                    sync.Mutex
+	selfEchoes                    []colorSchemeEcho
 }

core/internal/server/loginctl/actions.go

@@ -46,6 +46,19 @@ func (m *Manager) Activate() error {
 	return nil
 }
 
+func (m *Manager) SetLockedHint(locked bool) error {
+	err := m.sessionObj.Call(dbusSessionInterface+".SetLockedHint", 0, locked).Err
+	if err != nil {
+		if refreshErr := m.refreshSessionBinding(); refreshErr == nil {
+			err = m.sessionObj.Call(dbusSessionInterface+".SetLockedHint", 0, locked).Err
+		}
+		if err != nil {
+			return fmt.Errorf("failed to set locked hint: %w", err)
+		}
+	}
+	return nil
+}
+
 func (m *Manager) SetIdleHint(idle bool) error {
 	err := m.sessionObj.Call(dbusSessionInterface+".SetIdleHint", 0, idle).Err
 	if err != nil {

core/internal/server/loginctl/handlers.go

@@ -21,6 +21,8 @@ func HandleRequest(conn net.Conn, req models.Request, manager *Manager) {
 		handleActivate(conn, req, manager)
 	case "loginctl.setIdleHint":
 		handleSetIdleHint(conn, req, manager)
+	case "loginctl.setLockedHint":
+		handleSetLockedHint(conn, req, manager)
 	case "loginctl.setLockBeforeSuspend":
 		handleSetLockBeforeSuspend(conn, req, manager)
 	case "loginctl.setSleepInhibitorEnabled":
@@ -78,6 +80,20 @@ func handleSetIdleHint(conn net.Conn, req models.Request, manager *Manager) {
 	models.Respond(conn, req.ID, models.SuccessResult{Success: true, Message: "idle hint set"})
 }
 
+func handleSetLockedHint(conn net.Conn, req models.Request, manager *Manager) {
+	locked, err := params.Bool(req.Params, "locked")
+	if err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+
+	if err := manager.SetLockedHint(locked); err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+	models.Respond(conn, req.ID, models.SuccessResult{Success: true, Message: "locked hint set"})
+}
+
 func handleSetLockBeforeSuspend(conn net.Conn, req models.Request, manager *Manager) {
 	enabled, err := params.Bool(req.Params, "enabled")
 	if err != nil {

core/internal/server/network/agent_networkmanager.go

@@ -545,12 +545,18 @@ func (a *SecretAgent) GetSecrets(
 		out[settingName] = sec
 	}
 	if settingName == "vpn" && a.backend != nil && !isPKCS11 && (vpnUsername != "" || reply.Save) {
-		pw := reply.Secrets["password"]
+		secrets := make(map[string]string)
+		for k, v := range reply.Secrets {
+			if k != "username" {
+				secrets[k] = v
+			}
+		}
 		a.backend.pendingVPNSaveMu.Lock()
 		a.backend.pendingVPNSave = &pendingVPNCredentials{
 			ConnectionPath: string(path),
 			Username:       vpnUsername,
-			Password:       pw,
+			Password:       reply.Secrets["password"],
+			Secrets:        secrets,
 			SavePassword:   reply.Save,
 		}
 		a.backend.pendingVPNSaveMu.Unlock()
@@ -790,7 +796,23 @@ func inferVPNFields(conn map[string]nmVariantMap, vpnService string) []string {
 			fields = []string{"username", "password"}
 		}
 	case strings.Contains(vpnService, "openvpn"):
-		if connType == "password" || connType == "password-tls" {
+		switch connType {
+		case "tls":
+			// Cert auth wants the private-key passphrase, not a password.
+			if secretFlagsNotRequired(dataMap["cert-pass-flags"]) {
+				return nil
+			}
+			return []string{"cert-pass"}
+		case "password-tls":
+			fields = []string{}
+			if dataMap["username"] == "" {
+				fields = append(fields, "username")
+			}
+			fields = append(fields, "password")
+			if !secretFlagsNotRequired(dataMap["cert-pass-flags"]) {
+				fields = append(fields, "cert-pass")
+			}
+		case "password":
 			if dataMap["username"] == "" {
 				fields = []string{"username", "password"}
 			}
@@ -805,6 +827,19 @@ func inferVPNFields(conn map[string]nmVariantMap, vpnService string) []string {
 	return fields
 }
 
+// NetworkManager secret flags: bit 1 (value 2) marks a secret as not-saved,
+// bit 2 (value 4) as not-required. A not-required secret must not be prompted.
+func secretFlagsNotRequired(flags string) bool {
+	if flags == "" {
+		return false
+	}
+	n, err := strconv.Atoi(flags)
+	if err != nil {
+		return false
+	}
+	return n&0x4 != 0
+}
+
 func needsExternalBrowserAuth(protocol, authType, username string, data map[string]string) bool {
 	if method, ok := data["saml-auth-method"]; ok {
 		if method == "REDIRECT" || method == "POST" {

core/internal/server/network/agent_networkmanager_test.go

@@ -315,6 +315,44 @@ func TestInferVPNFields_GPSaml(t *testing.T) {
 			expectedLen: 1,
 			shouldHave:  []string{"password"},
 		},
+		{
+			name:       "OpenVPN cert auth (tls) - private-key passphrase",
+			vpnService: "org.freedesktop.NetworkManager.openvpn",
+			dataMap: map[string]string{
+				"connection-type": "tls",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"cert-pass"},
+		},
+		{
+			name:       "OpenVPN cert auth (tls) with passphrase-less key",
+			vpnService: "org.freedesktop.NetworkManager.openvpn",
+			dataMap: map[string]string{
+				"connection-type": "tls",
+				"cert-pass-flags": "4",
+			},
+			expectedLen: 0,
+		},
+		{
+			name:       "OpenVPN password-tls no username",
+			vpnService: "org.freedesktop.NetworkManager.openvpn",
+			dataMap: map[string]string{
+				"connection-type": "password-tls",
+			},
+			expectedLen: 3,
+			shouldHave:  []string{"username", "password", "cert-pass"},
+		},
+		{
+			name:       "OpenVPN password-tls with username, passphrase-less key",
+			vpnService: "org.freedesktop.NetworkManager.openvpn",
+			dataMap: map[string]string{
+				"connection-type": "password-tls",
+				"username":        "john",
+				"cert-pass-flags": "4",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"password"},
+		},
 	}
 
 	for _, tt := range tests {

core/internal/server/network/backend_iwd.go

@@ -114,6 +114,14 @@ func (b *IWDBackend) discoverDevices() error {
 		return fmt.Errorf("failed to get managed objects: %w", err)
 	}
 
+	return b.applyManagedObjects(objects)
+}
+
+func (b *IWDBackend) applyManagedObjects(objects map[dbus.ObjectPath]map[string]map[string]dbus.Variant) error {
+	b.stationPath = ""
+	b.devicePath = ""
+	b.adapterPath = ""
+
 	for path, interfaces := range objects {
 		if _, hasStation := interfaces[iwdStationInterface]; hasStation {
 			b.stationPath = path
@@ -129,6 +137,13 @@ func (b *IWDBackend) discoverDevices() error {
 						b.stateMutex.Unlock()
 					}
 				}
+				if poweredVar, ok := devProps["Powered"]; ok {
+					if powered, ok := poweredVar.Value().(bool); ok {
+						b.stateMutex.Lock()
+						b.state.WiFiEnabled = powered
+						b.stateMutex.Unlock()
+					}
+				}
 			}
 		}
 		if _, hasAdapter := interfaces[iwdAdapterInterface]; hasAdapter {
@@ -136,9 +151,18 @@ func (b *IWDBackend) discoverDevices() error {
 		}
 	}
 
-	if b.stationPath == "" || b.devicePath == "" {
+	if b.devicePath == "" {
 		return fmt.Errorf("no WiFi device found")
 	}
+	if b.stationPath == "" {
+		b.stateMutex.Lock()
+		b.state.WiFiEnabled = false
+		b.state.WiFiConnected = false
+		b.state.NetworkStatus = StatusDisconnected
+		b.state.WiFiNetworks = nil
+		b.stateMutex.Unlock()
+		log.Infof("iwd device %s has no station interface; treating WiFi as disabled", b.devicePath)
+	}
 
 	return nil
 }

core/internal/server/network/backend_iwd_signals.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
 	"github.com/godbus/dbus/v5"
 )
 
@@ -35,12 +36,7 @@ func (b *IWDBackend) StartMonitoring(onStateChange func()) error {
 	}
 
 	if b.stationPath != "" {
-		err := b.conn.AddMatchSignal(
-			dbus.WithMatchObjectPath(b.stationPath),
-			dbus.WithMatchInterface(dbusPropertiesInterface),
-			dbus.WithMatchMember("PropertiesChanged"),
-		)
-		if err != nil {
+		if err := b.addStationSignalMatch(b.stationPath); err != nil {
 			return fmt.Errorf("failed to add station signal match: %w", err)
 		}
 	}
@@ -81,6 +77,48 @@ func (b *IWDBackend) refreshWiFiNetworkState() bool {
 	return b.updateSavedWiFiNetworks() == nil
 }
 
+func (b *IWDBackend) addStationSignalMatch(path dbus.ObjectPath) error {
+	return b.conn.AddMatchSignal(
+		dbus.WithMatchObjectPath(path),
+		dbus.WithMatchInterface(dbusPropertiesInterface),
+		dbus.WithMatchMember("PropertiesChanged"),
+	)
+}
+
+func (b *IWDBackend) handleStationAdded(path dbus.ObjectPath) bool {
+	if path == "" || path == b.stationPath {
+		return false
+	}
+
+	b.stationPath = path
+	if err := b.addStationSignalMatch(path); err != nil {
+		log.Warnf("Failed to add iwd station signal match for %s: %v", path, err)
+	}
+
+	if err := b.updateState(); err != nil {
+		log.Warnf("Failed to update iwd state after station appeared: %v", err)
+	}
+	return b.refreshWiFiNetworkState()
+}
+
+func (b *IWDBackend) handleStationRemoved(path dbus.ObjectPath) bool {
+	if path == "" || path != b.stationPath {
+		return false
+	}
+
+	b.stationPath = ""
+	b.stateMutex.Lock()
+	b.state.WiFiEnabled = false
+	b.state.WiFiConnected = false
+	b.state.WiFiSSID = ""
+	b.state.WiFiSignal = 0
+	b.state.NetworkStatus = StatusDisconnected
+	b.state.WiFiNetworks = nil
+	b.stateMutex.Unlock()
+
+	return true
+}
+
 func (b *IWDBackend) signalHandler(sigChan chan *dbus.Signal) {
 	defer b.sigWG.Done()
 
@@ -98,7 +136,13 @@ func (b *IWDBackend) signalHandler(sigChan chan *dbus.Signal) {
 
 			if sig.Name == dbusObjectManager+".InterfacesAdded" {
 				if len(sig.Body) >= 2 {
+					path, _ := sig.Body[0].(dbus.ObjectPath)
 					if interfaces, ok := sig.Body[1].(map[string]map[string]dbus.Variant); ok {
+						if _, ok := interfaces[iwdStationInterface]; ok {
+							if b.handleStationAdded(path) && b.onStateChange != nil {
+								b.onStateChange()
+							}
+						}
 						if _, ok := interfaces[iwdKnownNetworkInterface]; ok {
 							if b.refreshWiFiNetworkState() && b.onStateChange != nil {
 								b.onStateChange()
@@ -111,8 +155,15 @@ func (b *IWDBackend) signalHandler(sigChan chan *dbus.Signal) {
 
 			if sig.Name == dbusObjectManager+".InterfacesRemoved" {
 				if len(sig.Body) >= 2 {
+					path, _ := sig.Body[0].(dbus.ObjectPath)
 					if interfaces, ok := sig.Body[1].([]string); ok {
 						for _, iface := range interfaces {
+							if iface == iwdStationInterface {
+								if b.handleStationRemoved(path) && b.onStateChange != nil {
+									b.onStateChange()
+								}
+								break
+							}
 							if iface == iwdKnownNetworkInterface {
 								if b.refreshWiFiNetworkState() && b.onStateChange != nil {
 									b.onStateChange()

core/internal/server/network/backend_iwd_test.go

@@ -169,6 +169,41 @@ func TestIWDBackend_MapIwdDBusError(t *testing.T) {
 	}
 }
 
+func TestIWDBackend_ApplyManagedObjects_DeviceWithoutStation(t *testing.T) {
+	backend, _ := NewIWDBackend()
+
+	err := backend.applyManagedObjects(map[dbus.ObjectPath]map[string]map[string]dbus.Variant{
+		"/net/connman/iwd/0/1": {
+			iwdDeviceInterface: {
+				"Name":    dbus.MakeVariant("wlan0"),
+				"Powered": dbus.MakeVariant(false),
+			},
+		},
+	})
+
+	assert.NoError(t, err)
+	assert.Equal(t, dbus.ObjectPath("/net/connman/iwd/0/1"), backend.devicePath)
+	assert.Empty(t, backend.stationPath)
+
+	state, err := backend.GetCurrentState()
+	assert.NoError(t, err)
+	assert.Equal(t, "wlan0", state.WiFiDevice)
+	assert.False(t, state.WiFiEnabled)
+	assert.False(t, state.WiFiConnected)
+}
+
+func TestIWDBackend_ApplyManagedObjects_NoDevice(t *testing.T) {
+	backend, _ := NewIWDBackend()
+
+	err := backend.applyManagedObjects(map[dbus.ObjectPath]map[string]map[string]dbus.Variant{
+		"/net/connman/iwd/0": {
+			iwdAdapterInterface: {},
+		},
+	})
+
+	assert.ErrorContains(t, err, "no WiFi device found")
+}
+
 func TestIWDSavedWiFiProfilesFromManagedObjects(t *testing.T) {
 	objects := map[dbus.ObjectPath]map[string]map[string]dbus.Variant{
 		"/net/connman/iwd/known_network/1": {

core/internal/server/network/backend_networkmanager.go

@@ -90,7 +90,10 @@ type pendingVPNCredentials struct {
 	ConnectionPath string
 	Username       string
 	Password       string
-	SavePassword   bool
+	// Secrets holds all VPN secret fields keyed by name (e.g. "cert-pass");
+	// falls back to Password under the "password" key when empty.
+	Secrets      map[string]string
+	SavePassword bool
 }
 
 type cachedVPNCredentials struct {

core/internal/server/network/backend_networkmanager_vpn.go

@@ -863,13 +863,17 @@ func (b *NetworkManagerBackend) saveVPNCredentials(creds *pendingVPNCredentials)
 		log.Infof("[saveVPNCredentials] Saving username")
 	}
 
-	// Save password if requested
+	// Save secrets if requested
 	if creds.SavePassword {
-		data["password-flags"] = "0"
-		secs := make(map[string]string)
-		secs["password"] = creds.Password
+		secs := creds.Secrets
+		if len(secs) == 0 {
+			secs = map[string]string{"password": creds.Password}
+		}
+		for field := range secs {
+			data[field+"-flags"] = "0"
+		}
 		vpn["secrets"] = dbus.MakeVariant(secs)
-		log.Infof("[saveVPNCredentials] Saving password with password-flags=0")
+		log.Infof("[saveVPNCredentials] Saving %d secret field(s) with flags=0", len(secs))
 	}
 
 	vpn["data"] = dbus.MakeVariant(data)

core/internal/server/plugins/list_installed.go

@@ -42,12 +42,15 @@ func HandleListInstalled(conn net.Conn, req models.Request) {
 	for _, id := range installedNames {
 		if plugin, ok := pluginMap[id]; ok {
 			hasUpdate := false
-			if hasUpdates, err := manager.HasUpdates(id, plugin); err == nil {
+			diffURL := plugin.Repo
+			if hasUpdates, dURL, err := manager.HasUpdates(id, plugin); err == nil {
 				hasUpdate = hasUpdates
+				diffURL = dURL
 			}
 
 			info := pluginInfoFromPlugin(plugin)
 			info.HasUpdate = hasUpdate
+			info.DiffURL = diffURL
 			result = append(result, info)
 		} else {
 			result = append(result, PluginInfo{

core/internal/server/plugins/types.go

@@ -18,6 +18,7 @@ type PluginInfo struct {
 	Note         string   `json:"note,omitempty"`
 	HasUpdate    bool     `json:"hasUpdate,omitempty"`
 	RequiresDMS  string   `json:"requires_dms,omitempty"`
+	DiffURL      string   `json:"diffUrl,omitempty"`
 	Upvotes      int      `json:"upvotes,omitempty"`
 	Status       []string `json:"status,omitempty"`
 	IssueURL     string   `json:"issueUrl,omitempty"`

core/internal/server/router.go

@@ -23,6 +23,7 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/tailscale"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/thememode"
 	serverThemes "github.com/AvengeMedia/DankMaterialShell/core/internal/server/themes"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/wallpaper"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/wayland"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/wlroutput"
 )
@@ -56,6 +57,15 @@ func RouteRequest(conn net.Conn, req models.Request) {
 		return
 	}
 
+	if strings.HasPrefix(req.Method, "wallpaper.") {
+		if wallpaperManager == nil {
+			models.RespondError(conn, req.ID, "wallpaper manager not initialized")
+			return
+		}
+		wallpaper.HandleRequest(conn, req, wallpaperManager)
+		return
+	}
+
 	if strings.HasPrefix(req.Method, "loginctl.") {
 		if loginctlManager == nil {
 			models.RespondError(conn, req.ID, "loginctl manager not initialized")

core/internal/server/server.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/geolocation"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/matugen"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/apppicker"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/bluez"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/brightness"
@@ -33,13 +34,14 @@ import (
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/tailscale"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/thememode"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/trayrecovery"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/wallpaper"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/wayland"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/wlcontext"
 	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/wlroutput"
 	"github.com/AvengeMedia/DankMaterialShell/core/pkg/syncmap"
 )
 
-const APIVersion = 26
+const APIVersion = 27
 
 var CLIVersion = "dev"
 
@@ -73,6 +75,7 @@ var clipboardManager *clipboard.Manager
 var dbusManager *serverDbus.Manager
 var wlContext *wlcontext.SharedContext
 var themeModeManager *thememode.Manager
+var wallpaperManager *wallpaper.Manager
 var trayRecoveryManager *trayrecovery.Manager
 var locationManager *location.Manager
 var sysUpdateManager *sysupdate.Manager
@@ -188,6 +191,7 @@ func InitializeFreedeskManager() error {
 	}
 
 	freedesktopManager = manager
+	matugen.SetColorSchemeEchoHook(manager.ExpectColorSchemeEcho)
 
 	log.Info("Freedesktop manager initialized")
 	return nil
@@ -347,6 +351,13 @@ func InitializeThemeModeManager() error {
 	return nil
 }
 
+func InitializeWallpaperManager() error {
+	wallpaperManager = wallpaper.NewManager()
+
+	log.Info("Wallpaper rotation scheduler initialized")
+	return nil
+}
+
 func InitializeTrayRecoveryManager() error {
 	manager, err := trayrecovery.NewManager()
 	if err != nil {
@@ -463,6 +474,10 @@ func getCapabilities() Capabilities {
 		caps = append(caps, "theme.auto")
 	}
 
+	if wallpaperManager != nil {
+		caps = append(caps, "wallpaper")
+	}
+
 	if dbusManager != nil {
 		caps = append(caps, "dbus")
 	}
@@ -529,6 +544,10 @@ func getServerInfo() ServerInfo {
 		caps = append(caps, "theme.auto")
 	}
 
+	if wallpaperManager != nil {
+		caps = append(caps, "wallpaper")
+	}
+
 	if locationManager != nil {
 		caps = append(caps, "location")
 	}
@@ -841,6 +860,38 @@ func handleSubscribe(conn net.Conn, req models.Request) {
 		}()
 	}
 
+	if shouldSubscribe("wallpaper") && wallpaperManager != nil {
+		wg.Add(1)
+		wallpaperChan := wallpaperManager.Subscribe(clientID + "-wallpaper")
+		go func() {
+			defer wg.Done()
+			defer wallpaperManager.Unsubscribe(clientID + "-wallpaper")
+
+			initialState := wallpaperManager.GetState()
+			select {
+			case eventChan <- ServiceEvent{Service: "wallpaper", Data: initialState}:
+			case <-stopChan:
+				return
+			}
+
+			for {
+				select {
+				case state, ok := <-wallpaperChan:
+					if !ok {
+						return
+					}
+					select {
+					case eventChan <- ServiceEvent{Service: "wallpaper", Data: state}:
+					case <-stopChan:
+						return
+					}
+				case <-stopChan:
+					return
+				}
+			}
+		}()
+	}
+
 	if shouldSubscribe("bluetooth") && bluezManager != nil {
 		wg.Add(1)
 		bluezChan := bluezManager.Subscribe(clientID + "-bluetooth")
@@ -1286,6 +1337,9 @@ func cleanupManagers() {
 	if themeModeManager != nil {
 		themeModeManager.Close()
 	}
+	if wallpaperManager != nil {
+		wallpaperManager.Close()
+	}
 	if trayRecoveryManager != nil {
 		trayRecoveryManager.Close()
 	}
@@ -1578,6 +1632,19 @@ func Start(printDocs bool) error {
 		}()
 	}
 
+	if err := InitializeWallpaperManager(); err != nil {
+		log.Warnf("Wallpaper scheduler unavailable: %v", err)
+	} else {
+		notifyCapabilityChange()
+		go func() {
+			<-loginctlReady
+			if loginctlManager == nil {
+				return
+			}
+			wallpaperManager.WatchLoginctl(loginctlManager)
+		}()
+	}
+
 	go func() {
 		<-loginctlReady
 		if loginctlManager == nil {

core/internal/server/wallpaper/handlers.go

@@ -0,0 +1,84 @@
+package wallpaper
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/models"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/params"
+)
+
+func HandleRequest(conn net.Conn, req models.Request, manager *Manager) {
+	if manager == nil {
+		models.RespondError(conn, req.ID, "wallpaper manager not initialized")
+		return
+	}
+
+	switch req.Method {
+	case "wallpaper.getState":
+		handleGetState(conn, req, manager)
+	case "wallpaper.setConfig":
+		handleSetConfig(conn, req, manager)
+	case "wallpaper.trigger":
+		handleTrigger(conn, req, manager)
+	case "wallpaper.subscribe":
+		handleSubscribe(conn, req, manager)
+	default:
+		models.RespondError(conn, req.ID, fmt.Sprintf("unknown method: %s", req.Method))
+	}
+}
+
+func handleGetState(conn net.Conn, req models.Request, manager *Manager) {
+	models.Respond(conn, req.ID, manager.GetState())
+}
+
+func handleSetConfig(conn net.Conn, req models.Request, manager *Manager) {
+	raw, ok := params.Any(req.Params, "config")
+	if !ok {
+		models.RespondError(conn, req.ID, "missing or invalid 'config' parameter")
+		return
+	}
+
+	data, err := json.Marshal(raw)
+	if err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+
+	var config Config
+	if err := json.Unmarshal(data, &config); err != nil {
+		models.RespondError(conn, req.ID, err.Error())
+		return
+	}
+
+	manager.SetConfig(config)
+	models.Respond(conn, req.ID, models.SuccessResult{Success: true, Message: "wallpaper schedule set"})
+}
+
+func handleTrigger(conn net.Conn, req models.Request, manager *Manager) {
+	manager.ResetSchedule(params.StringOpt(req.Params, "target", ""))
+	models.Respond(conn, req.ID, models.SuccessResult{Success: true, Message: "wallpaper schedule reset"})
+}
+
+func handleSubscribe(conn net.Conn, req models.Request, manager *Manager) {
+	clientID := fmt.Sprintf("client-%p", conn)
+	stateChan := manager.Subscribe(clientID)
+	defer manager.Unsubscribe(clientID)
+
+	initialState := manager.GetState()
+	if err := json.NewEncoder(conn).Encode(models.Response[State]{
+		ID:     req.ID,
+		Result: &initialState,
+	}); err != nil {
+		return
+	}
+
+	for state := range stateChan {
+		if err := json.NewEncoder(conn).Encode(models.Response[State]{
+			Result: &state,
+		}); err != nil {
+			return
+		}
+	}
+}

core/internal/server/wallpaper/manager.go

@@ -0,0 +1,374 @@
+package wallpaper
+
+import (
+	"reflect"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/server/loginctl"
+	"github.com/AvengeMedia/DankMaterialShell/core/pkg/syncmap"
+)
+
+type activeSchedule struct {
+	cfg      ScheduleConfig
+	nextFire time.Time
+}
+
+// Grace period before a missed-while-off schedule fires, so a freshly
+// connected frontend has its cycle-seq baseline before the bump arrives.
+var catchUpDelay = 3 * time.Second
+
+type Manager struct {
+	config      Config
+	configMutex sync.RWMutex
+
+	state      *State
+	stateMutex sync.RWMutex
+
+	subscribers syncmap.Map[string, chan State]
+
+	stopChan      chan struct{}
+	updateTrigger chan struct{}
+	resetReq      chan string
+	wg            sync.WaitGroup
+
+	// Owned by schedulerLoop after start; keyed like schedules ("" = global).
+	lastFires    map[string]time.Time
+	persistFires func(map[string]time.Time)
+}
+
+func NewManager() *Manager {
+	return newManager(loadLastFires(), saveLastFires)
+}
+
+func newManager(lastFires map[string]time.Time, persistFires func(map[string]time.Time)) *Manager {
+	if lastFires == nil {
+		lastFires = map[string]time.Time{}
+	}
+	m := &Manager{
+		config: Config{
+			Global:   ScheduleConfig{Mode: "interval", IntervalSec: 300, Time: "06:00"},
+			Monitors: map[string]ScheduleConfig{},
+		},
+		stopChan:      make(chan struct{}),
+		updateTrigger: make(chan struct{}, 1),
+		resetReq:      make(chan string, 8),
+		lastFires:     lastFires,
+		persistFires:  persistFires,
+	}
+	m.state = &State{Config: m.getConfig()}
+
+	m.wg.Add(1)
+	go m.schedulerLoop()
+
+	return m
+}
+
+func (m *Manager) GetState() State {
+	m.stateMutex.RLock()
+	defer m.stateMutex.RUnlock()
+	if m.state == nil {
+		return State{Config: m.getConfig()}
+	}
+	return *m.state
+}
+
+func (m *Manager) Subscribe(id string) chan State {
+	ch := make(chan State, 64)
+	m.subscribers.Store(id, ch)
+	return ch
+}
+
+func (m *Manager) Unsubscribe(id string) {
+	if val, ok := m.subscribers.LoadAndDelete(id); ok {
+		close(val)
+	}
+}
+
+func (m *Manager) SetConfig(config Config) {
+	if config.Monitors == nil {
+		config.Monitors = map[string]ScheduleConfig{}
+	}
+	m.configMutex.Lock()
+	if reflect.DeepEqual(m.config, config) {
+		m.configMutex.Unlock()
+		return
+	}
+	m.config = config
+	m.configMutex.Unlock()
+	m.TriggerUpdate()
+}
+
+func (m *Manager) ResetSchedule(target string) {
+	select {
+	case m.resetReq <- target:
+	default:
+	}
+}
+
+func (m *Manager) TriggerUpdate() {
+	select {
+	case m.updateTrigger <- struct{}{}:
+	default:
+	}
+}
+
+func (m *Manager) Close() {
+	select {
+	case <-m.stopChan:
+		return
+	default:
+		close(m.stopChan)
+	}
+	m.wg.Wait()
+	m.subscribers.Range(func(key string, ch chan State) bool {
+		close(ch)
+		m.subscribers.Delete(key)
+		return true
+	})
+}
+
+func (m *Manager) WatchLoginctl(lm *loginctl.Manager) {
+	ch := lm.Subscribe("wallpaper")
+	m.wg.Go(func() {
+		defer lm.Unsubscribe("wallpaper")
+		for {
+			select {
+			case <-m.stopChan:
+				return
+			case state, ok := <-ch:
+				if !ok {
+					return
+				}
+				if state.PreparingForSleep {
+					continue
+				}
+				m.TriggerUpdate()
+			}
+		}
+	})
+}
+
+func (m *Manager) schedulerLoop() {
+	defer m.wg.Done()
+
+	schedules := map[string]*activeSchedule{}
+	resets := map[string]bool{}
+	var seq uint64
+	var timer *time.Timer
+
+	for {
+		now := time.Now()
+		config := m.getConfig()
+		active := activeSchedules(config)
+
+		for key := range schedules {
+			if _, ok := active[key]; !ok {
+				delete(schedules, key)
+			}
+		}
+		firesDirty := false
+		for key, cfg := range active {
+			s, ok := schedules[key]
+			switch {
+			case !ok:
+				s = &activeSchedule{cfg: cfg, nextFire: computeNext(now, cfg)}
+				schedules[key] = s
+				if cfg.Mode == "time" {
+					last := m.lastFires[key]
+					prev, valid := prevDailyTime(now, cfg.Time)
+					switch {
+					case last.IsZero():
+						// First enable (or no history): seed instead of firing.
+						m.lastFires[key] = now
+						firesDirty = true
+					case valid && last.Before(prev):
+						// Scheduled time passed while dms wasn't running.
+						s.nextFire = now.Add(catchUpDelay)
+					}
+				}
+			case s.cfg != cfg || resets[key]:
+				s.cfg = cfg
+				s.nextFire = computeNext(now, cfg)
+			}
+			delete(resets, key)
+		}
+
+		var dueKeys []string
+		for key, s := range schedules {
+			if !s.nextFire.After(now) {
+				dueKeys = append(dueKeys, key)
+				s.nextFire = computeNext(now, s.cfg)
+				if s.cfg.Mode == "time" {
+					m.lastFires[key] = now
+					firesDirty = true
+				}
+			}
+		}
+
+		if firesDirty {
+			for key := range m.lastFires {
+				if _, ok := schedules[key]; !ok {
+					delete(m.lastFires, key)
+				}
+			}
+			m.persistFires(m.lastFires)
+		}
+
+		next, hasNext := soonest(schedules)
+		if len(dueKeys) == 0 {
+			m.setState(config, next, seq, "")
+		}
+		for _, key := range dueKeys {
+			seq++
+			m.setState(config, next, seq, key)
+		}
+
+		waitDur := 24 * time.Hour
+		if hasNext {
+			waitDur = max(time.Until(next), time.Second)
+		}
+
+		if timer != nil {
+			timer.Stop()
+		}
+		timer = time.NewTimer(waitDur)
+
+		select {
+		case <-m.stopChan:
+			timer.Stop()
+			return
+		case <-m.updateTrigger:
+			timer.Stop()
+		case key := <-m.resetReq:
+			timer.Stop()
+			resets[key] = true
+		case <-timer.C:
+		}
+	}
+}
+
+func (m *Manager) setState(config Config, next time.Time, seq uint64, target string) {
+	newState := State{Config: config, NextRotation: next, CycleSeq: seq, Target: target}
+
+	m.stateMutex.Lock()
+	if m.state != nil && statesEqual(m.state, &newState) {
+		m.stateMutex.Unlock()
+		return
+	}
+	m.state = &newState
+	m.stateMutex.Unlock()
+
+	m.notifySubscribers()
+}
+
+func (m *Manager) notifySubscribers() {
+	state := m.GetState()
+	m.subscribers.Range(func(key string, ch chan State) bool {
+		select {
+		case ch <- state:
+		default:
+		}
+		return true
+	})
+}
+
+func (m *Manager) getConfig() Config {
+	m.configMutex.RLock()
+	defer m.configMutex.RUnlock()
+	return m.config
+}
+
+func activeSchedules(config Config) map[string]ScheduleConfig {
+	out := map[string]ScheduleConfig{}
+	if config.PerMonitor {
+		for name, cfg := range config.Monitors {
+			if cfg.Enabled {
+				out[name] = cfg
+			}
+		}
+		return out
+	}
+	if config.Global.Enabled {
+		out[""] = config.Global
+	}
+	return out
+}
+
+func computeNext(now time.Time, cfg ScheduleConfig) time.Time {
+	switch cfg.Mode {
+	case "time":
+		return nextDailyTime(now, cfg.Time)
+	default:
+		sec := max(cfg.IntervalSec, 1)
+		return now.Add(time.Duration(sec) * time.Second)
+	}
+}
+
+func nextDailyTime(now time.Time, hhmm string) time.Time {
+	hour, minute, ok := parseHHMM(hhmm)
+	if !ok {
+		return now.Add(24 * time.Hour)
+	}
+	next := time.Date(now.Year(), now.Month(), now.Day(), hour, minute, 0, 0, now.Location())
+	if !next.After(now) {
+		next = next.Add(24 * time.Hour)
+	}
+	return next
+}
+
+func prevDailyTime(now time.Time, hhmm string) (time.Time, bool) {
+	hour, minute, ok := parseHHMM(hhmm)
+	if !ok {
+		return time.Time{}, false
+	}
+	prev := time.Date(now.Year(), now.Month(), now.Day(), hour, minute, 0, 0, now.Location())
+	if prev.After(now) {
+		prev = prev.Add(-24 * time.Hour)
+	}
+	return prev, true
+}
+
+func parseHHMM(hhmm string) (int, int, bool) {
+	parts := strings.Split(hhmm, ":")
+	if len(parts) != 2 {
+		return 0, 0, false
+	}
+	hour, err := strconv.Atoi(parts[0])
+	if err != nil || hour < 0 || hour > 23 {
+		return 0, 0, false
+	}
+	minute, err := strconv.Atoi(parts[1])
+	if err != nil || minute < 0 || minute > 59 {
+		return 0, 0, false
+	}
+	return hour, minute, true
+}
+
+func soonest(schedules map[string]*activeSchedule) (time.Time, bool) {
+	var best time.Time
+	found := false
+	for _, s := range schedules {
+		if !found || s.nextFire.Before(best) {
+			best = s.nextFire
+			found = true
+		}
+	}
+	return best, found
+}
+
+func statesEqual(a, b *State) bool {
+	switch {
+	case a == nil || b == nil:
+		return a == b
+	case a.CycleSeq != b.CycleSeq:
+		return false
+	case a.Target != b.Target:
+		return false
+	case !a.NextRotation.Equal(b.NextRotation):
+		return false
+	}
+	return reflect.DeepEqual(a.Config, b.Config)
+}

core/internal/server/wallpaper/manager_test.go

@@ -0,0 +1,179 @@
+package wallpaper
+
+import (
+	"testing"
+	"time"
+)
+
+func TestParseHHMM(t *testing.T) {
+	cases := []struct {
+		in     string
+		hour   int
+		minute int
+		ok     bool
+	}{
+		{"06:00", 6, 0, true},
+		{"23:59", 23, 59, true},
+		{"00:00", 0, 0, true},
+		{"24:00", 0, 0, false},
+		{"6:5", 6, 5, true},
+		{"bad", 0, 0, false},
+		{"12", 0, 0, false},
+		{"12:60", 0, 0, false},
+	}
+	for _, c := range cases {
+		hour, minute, ok := parseHHMM(c.in)
+		if ok != c.ok || (ok && (hour != c.hour || minute != c.minute)) {
+			t.Errorf("parseHHMM(%q) = (%d, %d, %v), want (%d, %d, %v)", c.in, hour, minute, ok, c.hour, c.minute, c.ok)
+		}
+	}
+}
+
+func TestComputeNextInterval(t *testing.T) {
+	now := time.Date(2026, 6, 30, 12, 0, 0, 0, time.UTC)
+	got := computeNext(now, ScheduleConfig{Mode: "interval", IntervalSec: 300})
+	if want := now.Add(300 * time.Second); !got.Equal(want) {
+		t.Errorf("interval next = %v, want %v", got, want)
+	}
+
+	clamped := computeNext(now, ScheduleConfig{Mode: "interval", IntervalSec: 0})
+	if want := now.Add(time.Second); !clamped.Equal(want) {
+		t.Errorf("interval clamp = %v, want %v", clamped, want)
+	}
+}
+
+func TestComputeNextTime(t *testing.T) {
+	now := time.Date(2026, 6, 30, 12, 0, 0, 0, time.UTC)
+
+	later := computeNext(now, ScheduleConfig{Mode: "time", Time: "18:00"})
+	if want := time.Date(2026, 6, 30, 18, 0, 0, 0, time.UTC); !later.Equal(want) {
+		t.Errorf("time next (today) = %v, want %v", later, want)
+	}
+
+	tomorrow := computeNext(now, ScheduleConfig{Mode: "time", Time: "06:00"})
+	if want := time.Date(2026, 7, 1, 6, 0, 0, 0, time.UTC); !tomorrow.Equal(want) {
+		t.Errorf("time next (tomorrow) = %v, want %v", tomorrow, want)
+	}
+}
+
+func TestActiveSchedules(t *testing.T) {
+	global := activeSchedules(Config{
+		Global: ScheduleConfig{Enabled: true, Mode: "interval", IntervalSec: 60},
+	})
+	if len(global) != 1 {
+		t.Fatalf("global active = %d, want 1", len(global))
+	}
+	if _, ok := global[""]; !ok {
+		t.Errorf("global active missing global key")
+	}
+
+	perMonitor := activeSchedules(Config{
+		PerMonitor: true,
+		Global:     ScheduleConfig{Enabled: true},
+		Monitors: map[string]ScheduleConfig{
+			"DP-1": {Enabled: true, Mode: "interval", IntervalSec: 60},
+			"DP-2": {Enabled: false},
+		},
+	})
+	if len(perMonitor) != 1 {
+		t.Fatalf("per-monitor active = %d, want 1", len(perMonitor))
+	}
+	if _, ok := perMonitor["DP-1"]; !ok {
+		t.Errorf("per-monitor active missing DP-1")
+	}
+}
+
+func TestPrevDailyTime(t *testing.T) {
+	now := time.Date(2026, 6, 30, 12, 0, 0, 0, time.UTC)
+
+	earlier, ok := prevDailyTime(now, "06:00")
+	if !ok || !earlier.Equal(time.Date(2026, 6, 30, 6, 0, 0, 0, time.UTC)) {
+		t.Errorf("prev (today) = %v, %v", earlier, ok)
+	}
+
+	later, ok := prevDailyTime(now, "18:00")
+	if !ok || !later.Equal(time.Date(2026, 6, 29, 18, 0, 0, 0, time.UTC)) {
+		t.Errorf("prev (yesterday) = %v, %v", later, ok)
+	}
+
+	if _, ok := prevDailyTime(now, "bad"); ok {
+		t.Error("prev (invalid) should not be ok")
+	}
+}
+
+func TestTimeScheduleCatchUpAfterRestart(t *testing.T) {
+	origDelay := catchUpDelay
+	catchUpDelay = 100 * time.Millisecond
+	defer func() { catchUpDelay = origDelay }()
+
+	now := time.Now()
+	hhmm := now.Add(-2 * time.Hour).Format("15:04")
+	seed := map[string]time.Time{"": now.Add(-26 * time.Hour)}
+
+	m := newManager(seed, func(map[string]time.Time) {})
+	defer m.Close()
+
+	sub := m.Subscribe("test")
+	defer m.Unsubscribe("test")
+
+	m.SetConfig(Config{Global: ScheduleConfig{Enabled: true, Mode: "time", Time: hhmm}})
+
+	deadline := time.After(3 * time.Second)
+	for {
+		select {
+		case state := <-sub:
+			if state.CycleSeq > 0 && state.Target == "" {
+				return
+			}
+		case <-deadline:
+			t.Fatal("missed time schedule did not catch up within 3s")
+		}
+	}
+}
+
+func TestTimeScheduleNoFireOnFirstEnable(t *testing.T) {
+	now := time.Now()
+	hhmm := now.Add(-2 * time.Hour).Format("15:04")
+
+	m := newManager(map[string]time.Time{}, func(map[string]time.Time) {})
+	defer m.Close()
+
+	sub := m.Subscribe("test")
+	defer m.Unsubscribe("test")
+
+	m.SetConfig(Config{Global: ScheduleConfig{Enabled: true, Mode: "time", Time: hhmm}})
+
+	deadline := time.After(1500 * time.Millisecond)
+	for {
+		select {
+		case state := <-sub:
+			if state.CycleSeq > 0 {
+				t.Fatal("first enable must not fire immediately")
+			}
+		case <-deadline:
+			return
+		}
+	}
+}
+
+func TestSchedulerEmitsCycle(t *testing.T) {
+	m := newManager(map[string]time.Time{}, func(map[string]time.Time) {})
+	defer m.Close()
+
+	sub := m.Subscribe("test")
+	defer m.Unsubscribe("test")
+
+	m.SetConfig(Config{Global: ScheduleConfig{Enabled: true, Mode: "interval", IntervalSec: 1}})
+
+	deadline := time.After(3 * time.Second)
+	for {
+		select {
+		case state := <-sub:
+			if state.CycleSeq > 0 && state.Target == "" {
+				return
+			}
+		case <-deadline:
+			t.Fatal("scheduler did not emit a cycle event within 3s")
+		}
+	}
+}

core/internal/server/wallpaper/state.go

@@ -0,0 +1,45 @@
+package wallpaper
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/utils"
+)
+
+type persistentState struct {
+	LastFires map[string]time.Time `json:"lastFires"`
+}
+
+func stateFilePath() string {
+	return filepath.Join(utils.XDGCacheHome(), "dms", "wallpaper-schedule.json")
+}
+
+func loadLastFires() map[string]time.Time {
+	data, err := os.ReadFile(stateFilePath())
+	if err != nil {
+		return map[string]time.Time{}
+	}
+	var state persistentState
+	if err := json.Unmarshal(data, &state); err != nil || state.LastFires == nil {
+		return map[string]time.Time{}
+	}
+	return state.LastFires
+}
+
+func saveLastFires(fires map[string]time.Time) {
+	path := stateFilePath()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		return
+	}
+	data, err := json.Marshal(persistentState{LastFires: fires})
+	if err != nil {
+		return
+	}
+	if err := os.WriteFile(path, data, 0o644); err != nil {
+		log.Warnf("wallpaper: failed to persist schedule state: %v", err)
+	}
+}

core/internal/server/wallpaper/types.go

@@ -0,0 +1,23 @@
+package wallpaper
+
+import "time"
+
+type ScheduleConfig struct {
+	Enabled     bool   `json:"enabled"`
+	Mode        string `json:"mode"`
+	IntervalSec int    `json:"intervalSec"`
+	Time        string `json:"time"`
+}
+
+type Config struct {
+	PerMonitor bool                      `json:"perMonitor"`
+	Global     ScheduleConfig            `json:"global"`
+	Monitors   map[string]ScheduleConfig `json:"monitors"`
+}
+
+type State struct {
+	Config       Config    `json:"config"`
+	NextRotation time.Time `json:"nextRotation"`
+	CycleSeq     uint64    `json:"cycleSeq"`
+	Target       string    `json:"target"`
+}

core/internal/server/wayland/manager.go

@@ -74,6 +74,9 @@ func NewManager(display wlclient.WaylandDisplay, config Config) (*Manager, error
 
 	if config.Enabled {
 		m.post(func() {
+			if m.controlsInitialized {
+				return
+			}
 			log.Info("Gamma control enabled at startup")
 			gammaMgr := m.gammaControl.(*wlr_gamma_control.ZwlrGammaControlManagerV1)
 			m.availOutputsMu.RLock()
@@ -184,13 +187,26 @@ func (m *Manager) setupRegistry() error {
 			enabled := m.config.Enabled
 			m.configMutex.RUnlock()
 
-			if enabled && m.controlsInitialized {
-				m.post(func() {
-					if err := m.addOutputControl(output); err != nil {
-						log.Warnf("Failed to add output control: %v", err)
-					}
-				})
+			if !enabled {
+				return
 			}
+			m.post(func() {
+				if err := m.addOutputControl(output); err != nil {
+					log.Warnf("gamma: failed to add output control: %v", err)
+					return
+				}
+				if m.controlsInitialized {
+					return
+				}
+				// All outputs had been torn down (monitor sleep/disconnect),
+				// clearing controlsInitialized. Mark it ready again so the
+				// gamma_size event that follows control creation drives the
+				// reapply, instead of waiting for a manual toggle. No explicit
+				// apply here: applyGamma's dedup would suppress a no-change
+				// write anyway, and the new control isn't ready until gamma_size.
+				log.Info("gamma: output returned, re-establishing controls")
+				m.controlsInitialized = true
+			})
 		}
 	})
 

core/internal/server/wlcontext/context.go

@@ -108,10 +108,7 @@ func (sc *SharedContext) eventDispatcher() {
 		if r := recover(); r != nil {
 			err := fmt.Errorf("FATAL: Wayland event dispatcher panic: %v", r)
 			log.Error(err)
-			select {
-			case sc.fatalError <- err:
-			default:
-			}
+			sc.signalFatal(err)
 		}
 	}()
 
@@ -141,6 +138,7 @@ func (sc *SharedContext) eventDispatcher() {
 			continue
 		case err != nil:
 			log.Errorf("Poll error: %v", err)
+			sc.signalFatal(fmt.Errorf("wayland poll error: %w", err))
 			return
 		}
 
@@ -161,6 +159,7 @@ func (sc *SharedContext) eventDispatcher() {
 
 			if consecutiveErrors >= maxConsecutiveErrors {
 				log.Errorf("Fatal: Wayland connection unrecoverable after %d attempts. Exiting dispatcher.", maxConsecutiveErrors)
+				sc.signalFatal(fmt.Errorf("wayland connection unrecoverable after %d dispatch failures: %w", maxConsecutiveErrors, err))
 				return
 			}
 
@@ -172,6 +171,13 @@ func (sc *SharedContext) eventDispatcher() {
 	}
 }
 
+func (sc *SharedContext) signalFatal(err error) {
+	select {
+	case sc.fatalError <- err:
+	default:
+	}
+}
+
 func (sc *SharedContext) drainCmdQueue() {
 	for {
 		select {

core/internal/traywatcher/traywatcher.go

@@ -0,0 +1,205 @@
+// Package traywatcher implements a minimal org.kde.StatusNotifierWatcher that
+// claims the SNI name early in the session so autostart tray apps can register
+// before the shell finishes loading. See docs/TRAY_WATCHER.md.
+package traywatcher
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+
+	"github.com/AvengeMedia/DankMaterialShell/core/internal/log"
+	"github.com/godbus/dbus/v5"
+	"github.com/godbus/dbus/v5/introspect"
+	"github.com/godbus/dbus/v5/prop"
+)
+
+const (
+	busName = "org.kde.StatusNotifierWatcher"
+	objPath = dbus.ObjectPath("/StatusNotifierWatcher")
+	iface   = "org.kde.StatusNotifierWatcher"
+)
+
+const introXML = `<node>
+  <interface name="org.kde.StatusNotifierWatcher">
+    <method name="RegisterStatusNotifierItem">
+      <arg type="s" direction="in" name="service"/>
+    </method>
+    <method name="RegisterStatusNotifierHost">
+      <arg type="s" direction="in" name="service"/>
+    </method>
+    <property name="RegisteredStatusNotifierItems" type="as" access="read"/>
+    <property name="IsStatusNotifierHostRegistered" type="b" access="read"/>
+    <property name="ProtocolVersion" type="i" access="read"/>
+    <signal name="StatusNotifierItemRegistered">
+      <arg type="s" name="service"/>
+    </signal>
+    <signal name="StatusNotifierItemUnregistered">
+      <arg type="s" name="service"/>
+    </signal>
+    <signal name="StatusNotifierHostRegistered"/>
+    <signal name="StatusNotifierHostUnregistered"/>
+  </interface>
+` + introspect.IntrospectDataString + prop.IntrospectDataString + `</node>`
+
+type watcher struct {
+	conn  *dbus.Conn
+	props *prop.Properties
+	mu    sync.Mutex
+	items map[string]string // item id ("name/path") -> bus name to watch
+	hosts map[string]bool
+}
+
+func (w *watcher) itemListLocked() []string {
+	list := make([]string, 0, len(w.items))
+	for item := range w.items {
+		list = append(list, item)
+	}
+	sort.Strings(list)
+	return list
+}
+
+func (w *watcher) emit(signal string, args ...any) {
+	if err := w.conn.Emit(objPath, iface+"."+signal, args...); err != nil {
+		log.Warnf("failed to emit %s: %v", signal, err)
+	}
+}
+
+// Clients pass either an object path (item on the caller) or a bus name.
+func (w *watcher) RegisterStatusNotifierItem(sender dbus.Sender, service string) *dbus.Error {
+	var item, watch string
+	if strings.HasPrefix(service, "/") {
+		item, watch = string(sender)+service, string(sender)
+	} else {
+		item, watch = service+"/StatusNotifierItem", service
+	}
+
+	w.mu.Lock()
+	if _, exists := w.items[item]; exists {
+		w.mu.Unlock()
+		return nil
+	}
+	w.items[item] = watch
+	list := w.itemListLocked()
+	w.mu.Unlock()
+
+	log.Infof("item registered: %s", item)
+	w.emit("StatusNotifierItemRegistered", item)
+	w.props.SetMust(iface, "RegisteredStatusNotifierItems", list)
+	return nil
+}
+
+func (w *watcher) RegisterStatusNotifierHost(sender dbus.Sender, service string) *dbus.Error {
+	watch := string(sender)
+	if service != "" && !strings.HasPrefix(service, "/") {
+		watch = service
+	}
+
+	w.mu.Lock()
+	if w.hosts[watch] {
+		w.mu.Unlock()
+		return nil
+	}
+	w.hosts[watch] = true
+	w.mu.Unlock()
+
+	log.Infof("host registered: %s", watch)
+	w.emit("StatusNotifierHostRegistered")
+	return nil
+}
+
+func (w *watcher) pruneOwner(name string) {
+	w.mu.Lock()
+	var removed []string
+	for item, watch := range w.items {
+		if watch == name {
+			delete(w.items, item)
+			removed = append(removed, item)
+		}
+	}
+	list := w.itemListLocked()
+	hostGone := w.hosts[name]
+	delete(w.hosts, name)
+	w.mu.Unlock()
+
+	for _, item := range removed {
+		log.Infof("item gone: %s", item)
+		w.emit("StatusNotifierItemUnregistered", item)
+	}
+	if len(removed) > 0 {
+		w.props.SetMust(iface, "RegisteredStatusNotifierItems", list)
+	}
+	if hostGone {
+		log.Infof("host gone: %s", name)
+		w.emit("StatusNotifierHostUnregistered")
+	}
+}
+
+// Run serves the watcher until the session bus connection closes.
+func Run() error {
+	conn, err := dbus.ConnectSessionBus()
+	if err != nil {
+		return fmt.Errorf("connect to session bus: %w", err)
+	}
+	defer conn.Close()
+
+	w := &watcher{conn: conn, items: map[string]string{}, hosts: map[string]bool{}}
+
+	if err := conn.Export(w, objPath, iface); err != nil {
+		return fmt.Errorf("export watcher: %w", err)
+	}
+	w.props, err = prop.Export(conn, objPath, map[string]map[string]*prop.Prop{
+		iface: {
+			"RegisteredStatusNotifierItems": {Value: []string{}, Emit: prop.EmitTrue},
+			// Always true: libappindicator clients drop the icon if it is false.
+			"IsStatusNotifierHostRegistered": {Value: true, Emit: prop.EmitFalse},
+			"ProtocolVersion":                {Value: int32(0), Emit: prop.EmitFalse},
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("export properties: %w", err)
+	}
+	if err := conn.Export(introspect.Introspectable(introXML), objPath, "org.freedesktop.DBus.Introspectable"); err != nil {
+		return fmt.Errorf("export introspection: %w", err)
+	}
+
+	if err := conn.AddMatchSignal(
+		dbus.WithMatchSender("org.freedesktop.DBus"),
+		dbus.WithMatchInterface("org.freedesktop.DBus"),
+		dbus.WithMatchMember("NameOwnerChanged"),
+		dbus.WithMatchObjectPath("/org/freedesktop/DBus"),
+	); err != nil {
+		return fmt.Errorf("match NameOwnerChanged: %w", err)
+	}
+	sigs := make(chan *dbus.Signal, 128)
+	conn.Signal(sigs)
+
+	// No flags: queue for the name and take it when the current owner exits.
+	reply, err := conn.RequestName(busName, 0)
+	if err != nil {
+		return fmt.Errorf("request %s: %w", busName, err)
+	}
+	if reply == dbus.RequestNameReplyInQueue {
+		log.Infof("name busy, queued for %s", busName)
+	}
+
+	for sig := range sigs {
+		switch sig.Name {
+		case "org.freedesktop.DBus.NameAcquired":
+			if len(sig.Body) == 1 && sig.Body[0] == busName {
+				log.Infof("acquired %s", busName)
+			}
+		case "org.freedesktop.DBus.NameOwnerChanged":
+			if len(sig.Body) != 3 {
+				continue
+			}
+			name, _ := sig.Body[0].(string)
+			newOwner, _ := sig.Body[2].(string)
+			if name != busName && newOwner == "" {
+				w.pruneOwner(name)
+			}
+		}
+	}
+	return fmt.Errorf("session bus connection closed")
+}

core/internal/utils/exec.go

@@ -1,7 +1,10 @@
 package utils
 
 import (
+	"os"
 	"os/exec"
+	"path/filepath"
+	"strings"
 )
 
 type AppChecker interface {
@@ -31,7 +34,20 @@ func (DefaultAppChecker) AnyFlatpakExists(flatpaks ...string) bool {
 
 func CommandExists(cmd string) bool {
 	_, err := exec.LookPath(cmd)
-	return err == nil
+	if err == nil {
+		return true
+	}
+	if strings.ContainsRune(cmd, os.PathSeparator) {
+		return false
+	}
+	for _, dir := range userBinDirs() {
+		path := filepath.Join(dir, cmd)
+		info, statErr := os.Stat(path)
+		if statErr == nil && !info.IsDir() && info.Mode()&0o111 != 0 {
+			return true
+		}
+	}
+	return false
 }
 
 func AnyCommandExists(cmds ...string) bool {
@@ -42,3 +58,58 @@ func AnyCommandExists(cmds ...string) bool {
 	}
 	return false
 }
+
+func EnvWithUserBinPath(env []string) []string {
+	if env == nil {
+		env = os.Environ()
+	}
+
+	out := append([]string(nil), env...)
+	pathIndex := -1
+	pathValue := ""
+	for i, entry := range out {
+		if strings.HasPrefix(entry, "PATH=") {
+			pathIndex = i
+			pathValue = strings.TrimPrefix(entry, "PATH=")
+			break
+		}
+	}
+
+	parts := filepath.SplitList(pathValue)
+	seen := make(map[string]struct{}, len(parts))
+	for _, part := range parts {
+		if part != "" {
+			seen[part] = struct{}{}
+		}
+	}
+
+	prepend := make([]string, 0, 2)
+	for _, dir := range userBinDirs() {
+		if dir == "" {
+			continue
+		}
+		if _, ok := seen[dir]; ok {
+			continue
+		}
+		prepend = append(prepend, dir)
+		seen[dir] = struct{}{}
+	}
+
+	parts = append(prepend, parts...)
+	newPath := "PATH=" + strings.Join(parts, string(os.PathListSeparator))
+	if pathIndex >= 0 {
+		out[pathIndex] = newPath
+	} else {
+		out = append(out, newPath)
+	}
+	return out
+}
+
+func userBinDirs() []string {
+	dirs := []string{}
+	if home, err := os.UserHomeDir(); err == nil && home != "" {
+		dirs = append(dirs, filepath.Join(home, ".local", "bin"))
+	}
+	dirs = append(dirs, "/usr/local/bin")
+	return dirs
+}

core/internal/utils/exec_test.go

@@ -0,0 +1,55 @@
+package utils
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCommandExistsFallsBackToLocalBin(t *testing.T) {
+	home := t.TempDir()
+	binDir := filepath.Join(home, ".local", "bin")
+	require.NoError(t, os.MkdirAll(binDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(binDir, "pywalfox"), []byte("#!/bin/sh\n"), 0o755))
+
+	t.Setenv("HOME", home)
+	t.Setenv("PATH", t.TempDir())
+
+	assert.True(t, CommandExists("pywalfox"))
+}
+
+func TestCommandExistsIgnoresNonExecutableLocalBinFile(t *testing.T) {
+	home := t.TempDir()
+	binDir := filepath.Join(home, ".local", "bin")
+	require.NoError(t, os.MkdirAll(binDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(binDir, "pywalfox"), []byte("not executable"), 0o644))
+
+	t.Setenv("HOME", home)
+	t.Setenv("PATH", t.TempDir())
+
+	assert.False(t, CommandExists("pywalfox"))
+}
+
+func TestEnvWithUserBinPathPrependsLocalBin(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+
+	env := EnvWithUserBinPath([]string{"PATH=/usr/bin", "OTHER=value"})
+	var pathValue string
+	for _, entry := range env {
+		if strings.HasPrefix(entry, "PATH=") {
+			pathValue = strings.TrimPrefix(entry, "PATH=")
+			break
+		}
+	}
+
+	parts := filepath.SplitList(pathValue)
+	require.NotEmpty(t, parts)
+	assert.Equal(t, filepath.Join(home, ".local", "bin"), parts[0])
+	assert.Contains(t, parts, "/usr/local/bin")
+	assert.Contains(t, env, "OTHER=value")
+}

core/internal/utils/math.go

@@ -1,8 +1,8 @@
 package utils
 
-import "golang.org/x/exp/constraints"
+import "cmp"
 
-func Clamp[T constraints.Ordered](val, min, max T) T {
+func Clamp[T cmp.Ordered](val, min, max T) T {
 	if val < min {
 		return min
 	}

distro/debian/dms-git/debian/rules

@@ -72,8 +72,10 @@ override_dh_auto_install:
 	if [ -d quickshell ]; then \
 		cp -r quickshell/* debian/dms-git/usr/share/quickshell/dms/; \
 		install -Dm644 assets/systemd/dms.service debian/dms-git/usr/lib/systemd/user/dms.service; \
+		install -Dm644 assets/systemd/dms-tray-watcher.service debian/dms-git/usr/lib/systemd/user/dms-tray-watcher.service; \
 		install -Dm644 assets/dms-open.desktop debian/dms-git/usr/share/applications/dms-open.desktop; \
 		install -Dm644 assets/com.danklinux.dms.desktop debian/dms-git/usr/share/applications/com.danklinux.dms.desktop; \
+		install -Dm644 assets/com.danklinux.dms.notepad.desktop debian/dms-git/usr/share/applications/com.danklinux.dms.notepad.desktop; \
 		install -Dm644 assets/danklogo.svg debian/dms-git/usr/share/icons/hicolor/scalable/apps/danklogo.svg; \
 	else \
 		echo "ERROR: quickshell directory not found!" && \

distro/debian/dms/debian/rules

@@ -65,8 +65,10 @@ override_dh_auto_install:
 	if [ -d DankMaterialShell-$(UPSTREAM_VERSION) ]; then \
 		cp -r DankMaterialShell-$(UPSTREAM_VERSION)/quickshell/* debian/dms/usr/share/quickshell/dms/; \
 		install -Dm644 DankMaterialShell-$(UPSTREAM_VERSION)/assets/systemd/dms.service debian/dms/usr/lib/systemd/user/dms.service; \
+		install -Dm644 DankMaterialShell-$(UPSTREAM_VERSION)/assets/systemd/dms-tray-watcher.service debian/dms/usr/lib/systemd/user/dms-tray-watcher.service; \
 		install -Dm644 DankMaterialShell-$(UPSTREAM_VERSION)/assets/dms-open.desktop debian/dms/usr/share/applications/dms-open.desktop; \
 		install -Dm644 DankMaterialShell-$(UPSTREAM_VERSION)/assets/com.danklinux.dms.desktop debian/dms/usr/share/applications/com.danklinux.dms.desktop; \
+		install -Dm644 DankMaterialShell-$(UPSTREAM_VERSION)/assets/com.danklinux.dms.notepad.desktop debian/dms/usr/share/applications/com.danklinux.dms.notepad.desktop; \
 		install -Dm644 DankMaterialShell-$(UPSTREAM_VERSION)/assets/danklogo.svg debian/dms/usr/share/icons/hicolor/scalable/apps/danklogo.svg; \
 	else \
 		echo "ERROR: DankMaterialShell-$(UPSTREAM_VERSION) directory not found!" && \

distro/fedora/dms-git.spec

@@ -119,9 +119,11 @@ core/bin/${DMS_BINARY} completion fish > %{buildroot}%{_datadir}/fish/vendor_com
 
 # Install systemd user service
 install -Dm644 assets/systemd/dms.service %{buildroot}%{_userunitdir}/dms.service
+install -Dm644 assets/systemd/dms-tray-watcher.service %{buildroot}%{_userunitdir}/dms-tray-watcher.service
 
 install -Dm644 assets/dms-open.desktop %{buildroot}%{_datadir}/applications/dms-open.desktop
 install -Dm644 assets/com.danklinux.dms.desktop %{buildroot}%{_datadir}/applications/com.danklinux.dms.desktop
+install -Dm644 assets/com.danklinux.dms.notepad.desktop %{buildroot}%{_datadir}/applications/com.danklinux.dms.notepad.desktop
 install -Dm644 assets/danklogo.svg %{buildroot}%{_datadir}/icons/hicolor/scalable/apps/danklogo.svg
 
 # Install shell files to shared data location
@@ -144,8 +146,10 @@ pkill -USR1 -x dms >/dev/null 2>&1 || :
 %doc quickshell/README.md
 %{_datadir}/quickshell/dms/
 %{_userunitdir}/dms.service
+%{_userunitdir}/dms-tray-watcher.service
 %{_datadir}/applications/dms-open.desktop
 %{_datadir}/applications/com.danklinux.dms.desktop
+%{_datadir}/applications/com.danklinux.dms.notepad.desktop
 %{_datadir}/icons/hicolor/scalable/apps/danklogo.svg
 
 %files -n dms-cli

distro/fedora/dms.spec

@@ -87,9 +87,11 @@ install -d %{buildroot}%{_datadir}/fish/vendor_completions.d
 %{_builddir}/dms-cli completion fish > %{buildroot}%{_datadir}/fish/vendor_completions.d/dms.fish || :
 
 install -Dm644 %{_builddir}/dms-qml/assets/systemd/dms.service %{buildroot}%{_userunitdir}/dms.service
+install -Dm644 %{_builddir}/dms-qml/assets/systemd/dms-tray-watcher.service %{buildroot}%{_userunitdir}/dms-tray-watcher.service
 
 install -Dm644 %{_builddir}/dms-qml/assets/dms-open.desktop %{buildroot}%{_datadir}/applications/dms-open.desktop
 install -Dm644 %{_builddir}/dms-qml/assets/com.danklinux.dms.desktop %{buildroot}%{_datadir}/applications/com.danklinux.dms.desktop
+install -Dm644 %{_builddir}/dms-qml/assets/com.danklinux.dms.notepad.desktop %{buildroot}%{_datadir}/applications/com.danklinux.dms.notepad.desktop
 install -Dm644 %{_builddir}/dms-qml/assets/danklogo.svg %{buildroot}%{_datadir}/icons/hicolor/scalable/apps/danklogo.svg
 
 install -dm755 %{buildroot}%{_datadir}/quickshell/dms
@@ -111,8 +113,10 @@ pkill -USR1 -x dms >/dev/null 2>&1 || :
 %doc README.md CONTRIBUTING.md
 %{_datadir}/quickshell/dms/
 %{_userunitdir}/dms.service
+%{_userunitdir}/dms-tray-watcher.service
 %{_datadir}/applications/dms-open.desktop
 %{_datadir}/applications/com.danklinux.dms.desktop
+%{_datadir}/applications/com.danklinux.dms.notepad.desktop
 %{_datadir}/icons/hicolor/scalable/apps/danklogo.svg
 
 %files -n dms-cli

distro/nix/common.nix

@@ -18,8 +18,7 @@ in
   ]
   ++ lib.optional cfg.enableDynamicTheming pkgs.matugen
   ++ lib.optional cfg.enableAudioWavelength pkgs.cava
-  ++ lib.optional cfg.enableCalendarEvents pkgs.khal
-  ++ lib.optional cfg.enableClipboardPaste pkgs.wtype;
+  ++ lib.optional cfg.enableCalendarEvents pkgs.khal;
 
   plugins = lib.mapAttrs (name: plugin: {
     source = plugin.src;

distro/nix/greeter.nix

@@ -10,6 +10,8 @@ let
   inherit (lib) types;
   cfg = config.programs.dank-material-shell.greeter;
   cfgDms = config.programs.dank-material-shell;
+  cfgAutoLogin = config.services.displayManager.autoLogin;
+  sessionData = config.services.displayManager.sessionData;
 
   inherit (config.services.greetd.settings.default_session) user;
 
@@ -26,6 +28,7 @@ let
         cfg.quickshell.package
         compositorPackage
         pkgs.glib # provides gdbus, used by the fprintd hardware probe in GreeterContent.qml
+        pkgs.jq # reads the user's cursor theme from settings.json in dms-greeter
       ]
     }
     ${
@@ -48,6 +51,38 @@ let
     } ${lib.optionalString cfg.logs.save "> ${cfg.logs.path} 2>&1"}
   '';
 
+  autoLoginCommand =
+    pkgs.runCommand "dms-greeter-autologin-command"
+      {
+        nativeBuildInputs = [
+          pkgs.gnugrep
+          pkgs.coreutils
+        ];
+      }
+      ''
+        set -euo pipefail
+
+        session="${sessionData.autologinSession}"
+        desktops="${sessionData.desktops}"
+
+        for sessionFile in \
+          "$desktops/share/wayland-sessions/$session.desktop" \
+          "$desktops/share/xsessions/$session.desktop"
+        do
+          if [ -f "$sessionFile" ]; then
+            command="$(grep -m1 '^Exec=' "$sessionFile" | cut -d= -f2- || true)"
+
+            if [ -n "$command" ]; then
+              printf '%s\n' "$command" > "$out"
+              exit 0
+            fi
+          fi
+        done
+
+        echo "dms-greeter autologin: could not resolve Exec for session '$session'" >&2
+        exit 1
+      '';
+
   jq = lib.getExe pkgs.jq;
 in
 {
@@ -155,6 +190,13 @@ in
           dmsgreeter: user set for greetd default_session ${user} does not exist. Please create it before referencing it.
         '';
       }
+      {
+        assertion = cfgAutoLogin.enable -> sessionData.autologinSession != null;
+        message = ''
+          dms-greeter auto-login requires services.displayManager.defaultSession to be set,
+          or at least one session in services.displayManager.sessionPackages.
+        '';
+      }
     ];
     # DMS currently relies on /etc/pam.d/login for lock screen password auth on NixOS.
     # Declare security.pam.services.dankshell only if you want to override that runtime fallback.
@@ -165,7 +207,13 @@ in
     # };
     services.greetd = {
       enable = lib.mkDefault true;
-      settings.default_session.command = lib.mkDefault (lib.getExe greeterScript);
+      settings = {
+        default_session.command = lib.mkDefault (lib.getExe greeterScript);
+        initial_session = lib.mkIf (cfgAutoLogin.enable && (cfgAutoLogin.user != null)) {
+          inherit (cfgAutoLogin) user;
+          command = ''${lib.getExe pkgs.bash} -lc "${pkgs.systemd}/bin/systemd-cat $(<${autoLoginCommand})"'';
+        };
+      };
     };
     fonts.packages = with pkgs; [
       fira-code

distro/nix/home.nix

@@ -101,6 +101,24 @@ in
       Install.WantedBy = [ cfg.systemd.target ];
     };
 
+    # Early SNI watcher so autostart tray apps register before the shell loads.
+    systemd.user.services.dms-tray-watcher = lib.mkIf cfg.systemd.enable {
+      Unit = {
+        Description = "DMS Status Notifier Watcher (early tray)";
+        PartOf = [ cfg.systemd.target ];
+        Before = [ cfg.systemd.target ];
+      };
+
+      Service = {
+        Type = "dbus";
+        BusName = "org.kde.StatusNotifierWatcher";
+        ExecStart = lib.getExe cfg.package + " tray-watcher";
+        Restart = "on-failure";
+      };
+
+      Install.WantedBy = [ cfg.systemd.target ];
+    };
+
     xdg.stateFile."DankMaterialShell/session.json" = lib.mkIf (cfg.session != { }) {
       source = jsonFormat.generate "session.json" cfg.session;
     };

distro/nix/nixos.nix

@@ -39,6 +39,24 @@ in
       };
     };
 
+    # Early SNI watcher so autostart tray apps register before the shell loads.
+    systemd.user.services.dms-tray-watcher = lib.mkIf cfg.systemd.enable {
+      description = "DMS Status Notifier Watcher (early tray)";
+      path = lib.mkForce [ ];
+
+      partOf = [ cfg.systemd.target ];
+      before = [ cfg.systemd.target ];
+      wantedBy = [ cfg.systemd.target ];
+      restartIfChanged = cfg.systemd.restartIfChanged;
+
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "org.kde.StatusNotifierWatcher";
+        ExecStart = lib.getExe cfg.package + " tray-watcher";
+        Restart = "on-failure";
+      };
+    };
+
     environment.systemPackages = [ cfg.quickshell.package ] ++ common.packages;
 
     environment.etc = lib.mapAttrs' (name: value: {

distro/nix/options.nix

@@ -76,7 +76,7 @@ in
     enableClipboardPaste = lib.mkOption {
       type = types.bool;
       default = true;
-      description = "Adds needed dependencies for directly pasting items from the clipboard history.";
+      description = "Deprecated: paste is built into dms; no extra dependencies needed. Kept as a no-op for compatibility.";
     };
 
     quickshell = {

distro/nix/tests/greeter-niri-module.nix

@@ -16,8 +16,14 @@ pkgs.testers.runNixOSTest {
       isSystemUser = true;
       group = "greeter";
     };
+    users.users.alice.isNormalUser = true;
 
     services.greetd.settings.default_session.user = "greeter";
+    services.displayManager.autoLogin = {
+      enable = true;
+      user = "alice";
+    };
+    services.displayManager.defaultSession = "niri";
 
     programs.niri.enable = true;
 
@@ -46,6 +52,11 @@ pkgs.testers.runNixOSTest {
     greetd_config_path = config_match.group(1)
     greetd_config = machine.succeed(f"cat {greetd_config_path}")
     t.assertIn("dms-greeter", greetd_config)
+    t.assertIn("[initial_session]", greetd_config)
+
+    initial_session = greetd_config.split("[initial_session]", 1)[1]
+    t.assertIn('user = "alice"', initial_session)
+    t.assertIn("systemd-cat", initial_session)
 
     script_match = re.search(r'command\s*=\s*"([^"]+/bin/dms-greeter)"', greetd_config)
     if script_match is None:

distro/opensuse/dms-git.spec

@@ -25,7 +25,7 @@ Recommends:     danksearch
 Recommends:     matugen
 Recommends:     quickshell-git
 Recommends:     NetworkManager
-Recommends:     qt6-qtmultimedia
+Recommends:     qt6-multimedia-imports
 Suggests:       cups-pk-helper
 Suggests:       qt6ct
 
@@ -114,9 +114,11 @@ install -d %{buildroot}%{_datadir}/fish/vendor_completions.d
 ./dms completion fish > %{buildroot}%{_datadir}/fish/vendor_completions.d/dms.fish || :
 
 install -Dm644 assets/systemd/dms.service %{buildroot}%{_userunitdir}/dms.service
+install -Dm644 assets/systemd/dms-tray-watcher.service %{buildroot}%{_userunitdir}/dms-tray-watcher.service
 
 install -Dm644 assets/dms-open.desktop %{buildroot}%{_datadir}/applications/dms-open.desktop
 install -Dm644 assets/com.danklinux.dms.desktop %{buildroot}%{_datadir}/applications/com.danklinux.dms.desktop
+install -Dm644 assets/com.danklinux.dms.notepad.desktop %{buildroot}%{_datadir}/applications/com.danklinux.dms.notepad.desktop
 install -Dm644 assets/danklogo.svg %{buildroot}%{_datadir}/icons/hicolor/scalable/apps/danklogo.svg
 
 install -dm755 %{buildroot}%{_datadir}/quickshell/dms
@@ -151,8 +153,10 @@ pkill -USR1 -x dms >/dev/null 2>&1 || :
 %dir %{_datadir}/quickshell
 %{_datadir}/quickshell/dms/
 %{_userunitdir}/dms.service
+%{_userunitdir}/dms-tray-watcher.service
 %{_datadir}/applications/dms-open.desktop
 %{_datadir}/applications/com.danklinux.dms.desktop
+%{_datadir}/applications/com.danklinux.dms.notepad.desktop
 %dir %{_datadir}/icons/hicolor
 %dir %{_datadir}/icons/hicolor/scalable
 %dir %{_datadir}/icons/hicolor/scalable/apps

distro/opensuse/dms.spec

@@ -26,7 +26,7 @@ Recommends:     cava
 Recommends:     danksearch
 Recommends:     matugen
 Recommends:     NetworkManager
-Recommends:     qt6-qtmultimedia
+Recommends:     qt6-multimedia-imports
 Suggests:       cups-pk-helper
 Suggests:       qt6ct
 
@@ -63,9 +63,11 @@ install -d %{buildroot}%{_datadir}/fish/vendor_completions.d
 ./dms completion fish > %{buildroot}%{_datadir}/fish/vendor_completions.d/dms.fish || :
 
 install -Dm644 assets/systemd/dms.service %{buildroot}%{_userunitdir}/dms.service
+install -Dm644 assets/systemd/dms-tray-watcher.service %{buildroot}%{_userunitdir}/dms-tray-watcher.service
 
 install -Dm644 assets/dms-open.desktop %{buildroot}%{_datadir}/applications/dms-open.desktop
 install -Dm644 assets/com.danklinux.dms.desktop %{buildroot}%{_datadir}/applications/com.danklinux.dms.desktop
+install -Dm644 assets/com.danklinux.dms.notepad.desktop %{buildroot}%{_datadir}/applications/com.danklinux.dms.notepad.desktop
 install -Dm644 assets/danklogo.svg %{buildroot}%{_datadir}/icons/hicolor/scalable/apps/danklogo.svg
 
 install -dm755 %{buildroot}%{_datadir}/quickshell/dms
@@ -98,8 +100,10 @@ pkill -USR1 -x dms >/dev/null 2>&1 || :
 %dir %{_datadir}/quickshell
 %{_datadir}/quickshell/dms/
 %{_userunitdir}/dms.service
+%{_userunitdir}/dms-tray-watcher.service
 %{_datadir}/applications/dms-open.desktop
 %{_datadir}/applications/com.danklinux.dms.desktop
+%{_datadir}/applications/com.danklinux.dms.notepad.desktop
 %dir %{_datadir}/icons/hicolor
 %dir %{_datadir}/icons/hicolor/scalable
 %dir %{_datadir}/icons/hicolor/scalable/apps

distro/ubuntu/dms-git/debian/rules

@@ -69,12 +69,16 @@ override_dh_auto_install:
 	# Install systemd user service
 	install -Dm644 dms-git-repo/assets/systemd/dms.service \
 		debian/dms-git/usr/lib/systemd/user/dms.service
+	install -Dm644 dms-git-repo/assets/systemd/dms-tray-watcher.service \
+		debian/dms-git/usr/lib/systemd/user/dms-tray-watcher.service
 
 	# Install desktop file and icon
 	install -Dm644 dms-git-repo/assets/dms-open.desktop \
 		debian/dms-git/usr/share/applications/dms-open.desktop
 	install -Dm644 dms-git-repo/assets/com.danklinux.dms.desktop \
 		debian/dms-git/usr/share/applications/com.danklinux.dms.desktop
+	install -Dm644 dms-git-repo/assets/com.danklinux.dms.notepad.desktop \
+		debian/dms-git/usr/share/applications/com.danklinux.dms.notepad.desktop
 	install -Dm644 dms-git-repo/assets/danklogo.svg \
 		debian/dms-git/usr/share/icons/hicolor/scalable/apps/danklogo.svg
 

distro/ubuntu/dms/debian/rules

@@ -50,12 +50,16 @@ override_dh_auto_install:
 	# Install systemd user service (before copying everything else)
 	install -Dm644 DankMaterialShell-$(BASE_VERSION)/assets/systemd/dms.service \
 		debian/dms/usr/lib/systemd/user/dms.service
+	install -Dm644 DankMaterialShell-$(BASE_VERSION)/assets/systemd/dms-tray-watcher.service \
+		debian/dms/usr/lib/systemd/user/dms-tray-watcher.service
 
 	# Install desktop file and icon
 	install -Dm644 DankMaterialShell-$(BASE_VERSION)/assets/dms-open.desktop \
 		debian/dms/usr/share/applications/dms-open.desktop
 	install -Dm644 DankMaterialShell-$(BASE_VERSION)/assets/com.danklinux.dms.desktop \
 		debian/dms/usr/share/applications/com.danklinux.dms.desktop
+	install -Dm644 DankMaterialShell-$(BASE_VERSION)/assets/com.danklinux.dms.notepad.desktop \
+		debian/dms/usr/share/applications/com.danklinux.dms.notepad.desktop
 	install -Dm644 DankMaterialShell-$(BASE_VERSION)/assets/danklogo.svg \
 		debian/dms/usr/share/icons/hicolor/scalable/apps/danklogo.svg
 

distro/void/README.md

@@ -13,16 +13,41 @@ All build from source.
 
 ## Distribution
 
-These packages target the official
-[`void-linux/void-packages`](https://github.com/void-linux/void-packages)
-repository, so they install with a plain `xbps-install dms` and no extra setup.
-Most dependencies (`quickshell`, `matugen`, `cava`, `niri`, `greetd`, …) are
-already in Void; `dgop` and `danksearch` are packaged alongside in the
-[danklinux repo](https://github.com/AvengeMedia/danklinux/tree/master/distro/void).
+This is a DMS maintained repo for VoidLinux until these packages are officially merged upstream in the Void Linux repositories, you can install them from our self-hosted custom XBPS repositories served via GitHub Pages.
+
+### Using the Self-Hosted Repositories
+
+We serve both stable release and development packages directly from our repository branches.
+
+#### 1. Add Repository Configurations
+
+Create configuration files in `/etc/xbps.d/` pointing to our repositories (needed for both stable and git/nightly variants):
+
+```sh
+echo "repository=https://avengemedia.github.io/DankMaterialShell/current" | sudo tee /etc/xbps.d/dms.conf
+echo "repository=https://avengemedia.github.io/DankLinux/current" | sudo tee /etc/xbps.d/danklinux.conf
+```
+
+#### 2. Install DMS
+
+Synchronize repositories and install the package:
+
+* For the **stable** variant:
+
+    ```sh
+    sudo xbps-install -S dms
+    ```
+
+* For the **git/nightly** variant (this will conflict with and replace the stable package):
+
+    ```sh
+    sudo xbps-install -S dms-git
+    ```
+
+*Note: On the first sync, `xbps-install` will output our signing key fingerprint and ask you to type `y` to trust and import it. Verify that the key matches our official signing fingerprint.*
 
 The templates here are the source of truth: copy each into a void-packages
-checkout at `srcpkgs/<pkg>/template` to build or submit it. Only tagged releases
-are packaged (no `-git`/nightly variant).
+checkout at `srcpkgs/<pkg>/template` to build or submit it.
 
 ## Dependencies
 
@@ -36,7 +61,6 @@ install whichever features you want:
 | `cava` | audio visualiser widget |
 | `qt6-multimedia` | system sound feedback |
 | `qt6ct` | Qt app theming |
-| `wtype` | virtual keyboard input |
 | `power-profiles-daemon` | power profile control |
 | `cups-pk-helper` | printer management |
 | `NetworkManager` | network control |

distro/void/srcpkgs/dms-git/template

@@ -0,0 +1,60 @@
+# Template file for 'dms-git'
+#
+# DankMaterialShell git development release
+#
+# NOTE: This template is built exclusively by CI. The workflow stages a local
+# source tarball and dynamically patches version, checksum, and distfiles
+# before calling xbps-src.  Do not attempt to build this template manually
+# without first providing the source archive.
+#
+# The binary is built with the `distro_binary` build tag (drops the in-app
+# self-update command).
+pkgname=dms-git
+version=1.4.6.git
+revision=1
+create_wrksrc=yes
+build_style=go
+build_wrksrc="core"
+go_import_path="github.com/AvengeMedia/DankMaterialShell/core"
+go_package="${go_import_path}/cmd/dms"
+go_build_tags="distro_binary"
+go_ldflags="-X main.Version=${version}"
+short_desc="DankMaterialShell — Material 3 desktop shell for Wayland (git variant)"
+maintainer="AvengeMedia <AvengeMedia.US@gmail.com>"
+license="MIT"
+homepage="https://danklinux.com"
+# CI populates distfiles/checksum dynamically; these are placeholders.
+distfiles="https://github.com/AvengeMedia/DankMaterialShell/archive/refs/tags/v${version}.tar.gz"
+checksum=badbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadb
+
+# Conflicts and provides
+conflicts="dms"
+provides="dms-${version}_${revision}"
+
+# Optional feature deps are listed in distro/void/README.md.
+depends="quickshell accountsservice dgop matugen dbus"
+
+post_install() {
+	# QML shell tree (build_style=go already installed the dms binary)
+	vmkdir usr/share/quickshell/dms
+	vcopy "${wrksrc}/quickshell/*" usr/share/quickshell/dms
+	echo "${version}" > "${DESTDIR}/usr/share/quickshell/dms/VERSION"
+
+	# Desktop entry + icon
+	vinstall "${wrksrc}/assets/dms-open.desktop" 644 usr/share/applications
+	vinstall "${wrksrc}/assets/com.danklinux.dms.desktop" 644 usr/share/applications
+	vinstall "${wrksrc}/assets/com.danklinux.dms.notepad.desktop" 644 usr/share/applications
+	vinstall "${wrksrc}/assets/danklogo.svg" 644 usr/share/icons/hicolor/scalable/apps
+
+	# Shell completions (generated by the built binary; skip when cross-building)
+	vmkdir usr/share/bash-completion/completions
+	vmkdir usr/share/zsh/site-functions
+	vmkdir usr/share/fish/vendor_completions.d
+	if [ -z "$CROSS_BUILD" ]; then
+		"${DESTDIR}/usr/bin/dms" completion bash > "${DESTDIR}/usr/share/bash-completion/completions/dms"
+		"${DESTDIR}/usr/bin/dms" completion zsh  > "${DESTDIR}/usr/share/zsh/site-functions/_dms"
+		"${DESTDIR}/usr/bin/dms" completion fish > "${DESTDIR}/usr/share/fish/vendor_completions.d/dms.fish"
+	fi
+
+	vlicense "${wrksrc}/LICENSE"
+}

distro/void/srcpkgs/dms/template

@@ -21,8 +21,8 @@ changelog="https://github.com/AvengeMedia/DankMaterialShell/releases"
 distfiles="https://github.com/AvengeMedia/DankMaterialShell/archive/refs/tags/v${version}.tar.gz"
 checksum=f54601e522c883fa9cce02bec070e4321e47389a1cf453e7ad0bb7379ad91b61
 
-# Optional feature deps (XBPS has no "recommends") are listed in distro/void/README.md.
-depends="quickshell accountsservice dgop matugen"
+# Optional feature deps are listed in distro/void/README.md.
+depends="quickshell accountsservice dgop matugen dbus"
 
 post_install() {
 	# QML shell tree (build_style=go already installed the dms binary)
@@ -33,6 +33,7 @@ post_install() {
 	# Desktop entry + icon
 	vinstall "${wrksrc}/assets/dms-open.desktop" 644 usr/share/applications
 	vinstall "${wrksrc}/assets/com.danklinux.dms.desktop" 644 usr/share/applications
+	vinstall "${wrksrc}/assets/com.danklinux.dms.notepad.desktop" 644 usr/share/applications
 	vinstall "${wrksrc}/assets/danklogo.svg" 644 usr/share/icons/hicolor/scalable/apps
 
 	# Shell completions (generated by the built binary; skip when cross-building)

docs/IPC.md

@@ -684,6 +684,10 @@ Notepad/scratchpad modal control for quick note-taking.
 - `open` - Show notepad modal
 - `close` - Hide notepad modal
 - `toggle` - Toggle notepad modal visibility
+- `openFile <path>` - Show notepad and load a file into a tab, reusing an existing tab if that file is already open
+  - Parameters: `path` - Absolute path to a file. Empty path behaves like `open`.
+  - Returns: Success/failure message
+  - This is what `com.danklinux.dms.notepad.desktop`'s `Exec=dms ipc call notepad openFile %f` uses so Notepad shows up in "Open With" pickers for text files.
 - `expand` - Expand the active notepad width and open it if hidden
 - `collapse` - Collapse the active notepad width without changing visibility
 - `toggleExpand` - Toggle the active notepad width between collapsed and expanded

flake.nix

@@ -133,6 +133,8 @@
                   $out/share/applications/dms-open.desktop
                 install -D ${rootSrc}/assets/com.danklinux.dms.desktop \
                   $out/share/applications/com.danklinux.dms.desktop
+                install -D ${rootSrc}/assets/com.danklinux.dms.notepad.desktop \
+                  $out/share/applications/com.danklinux.dms.notepad.desktop
                 install -D ${rootSrc}/core/assets/danklogo.svg \
                   $out/share/hicolor/scalable/apps/danklogo.svg
 

quickshell/Common/AnimVariants.qml

@@ -55,7 +55,7 @@ Singleton {
 
     readonly property bool isDirectionalEffect: isConnectedEffect || _effect === 1
     readonly property bool isDepthEffect: _effect === 2
-    readonly property bool isConnectedEffect: (typeof SettingsData !== "undefined") && SettingsData.connectedFrameModeActive
+    readonly property bool isConnectedEffect: (typeof FrameTransitionState !== "undefined") && FrameTransitionState.effectiveConnectedFrameModeActive
 
     readonly property real effectScaleCollapsed: _effectScaleCollapsed[_effect] !== undefined ? _effectScaleCollapsed[_effect] : 0.96
     readonly property real effectAnimOffset: _effectAnimOffsets[_effect] !== undefined ? _effectAnimOffsets[_effect] : 16

quickshell/Common/ConfigIncludeResolve.js

@@ -7,6 +7,24 @@ function dirname(path) {
     return idx > 0 ? path.substring(0, idx) : ".";
 }
 
+function sectionHeaderFor(includeLine) {
+    const line = String(includeLine ?? "").trim();
+    if (line.startsWith("require"))
+        return "-- DMS Include Configs";
+    if (line.startsWith("source"))
+        return "# DMS Include Configs";
+    return "// DMS Include Configs";
+}
+
+function managedIncludePatternFor(includeLine) {
+    const line = String(includeLine ?? "").trim();
+    if (line.startsWith("require"))
+        return "require.*dms[.]";
+    if (line.startsWith("source"))
+        return "source.*dms/";
+    return "include.*dms/";
+}
+
 function buildRepairScript(options) {
     const configFile = options.configFile;
     const backupFile = options.backupFile;
@@ -31,7 +49,9 @@ function buildRepairScript(options) {
     for (const include of includes) {
         if (!include.grepPattern || !include.includeLine)
             continue;
-        commands.push(`if ! grep -v '^[[:space:]]*\\(//\\|#\\|--\\)' ${shQuote(configFile)} 2>/dev/null | grep -q ${shQuote(include.grepPattern)}; then echo '' >> ${shQuote(configFile)} && printf '%s\\n' ${shQuote(include.includeLine)} >> ${shQuote(configFile)}; fi`);
+        const sectionHeader = options.sectionHeader || sectionHeaderFor(include.includeLine);
+        const managedIncludePattern = managedIncludePatternFor(include.includeLine);
+        commands.push(`if ! grep -v '^[[:space:]]*\\(//\\|#\\|--\\)' ${shQuote(configFile)} 2>/dev/null | grep -q ${shQuote(include.grepPattern)}; then if grep -Fqx ${shQuote(sectionHeader)} ${shQuote(configFile)} 2>/dev/null || grep -v '^[[:space:]]*\\(//\\|#\\|--\\)' ${shQuote(configFile)} 2>/dev/null | grep -q ${shQuote(managedIncludePattern)}; then printf '%s\\n' ${shQuote(include.includeLine)} >> ${shQuote(configFile)}; elif [ -s ${shQuote(configFile)} ]; then printf '\\n%s\\n%s\\n' ${shQuote(sectionHeader)} ${shQuote(include.includeLine)} >> ${shQuote(configFile)}; else printf '%s\\n%s\\n' ${shQuote(sectionHeader)} ${shQuote(include.includeLine)} >> ${shQuote(configFile)}; fi; fi`);
     }
 
     return commands.join("; ");

quickshell/Common/FrameTransitionState.qml

@@ -0,0 +1,56 @@
+pragma Singleton
+pragma ComponentBehavior: Bound
+
+import QtQuick
+import Quickshell
+
+Singleton {
+    id: root
+
+    property int revision: 0
+    property int appliedRevision: 0
+    readonly property bool ready: appliedRevision >= revision
+
+    // Latched: surfaces render the last compositor-acknowledged state until the atomic flip on ack
+    property bool effectiveFrameEnabled: false
+    property string effectiveFrameMode: "connected"
+    readonly property bool effectiveConnectedFrameModeActive: effectiveFrameEnabled && effectiveFrameMode === "connected"
+
+    signal transitionRequested(int revision)
+
+    function begin() {
+        revision++;
+        transitionRequested(revision);
+        return revision;
+    }
+
+    function acknowledge(requestRevision) {
+        if (requestRevision > appliedRevision)
+            appliedRevision = requestRevision;
+    }
+
+    function syncEffective() {
+        effectiveFrameEnabled = SettingsData.frameEnabled;
+        effectiveFrameMode = SettingsData.frameMode;
+    }
+
+    onReadyChanged: {
+        if (ready)
+            syncEffective();
+    }
+
+    // Tracks settings-load changes; live toggles begin() first (ready false) so the latch holds
+    Connections {
+        target: SettingsData
+        function onFrameEnabledChanged() {
+            if (root.ready)
+                root.syncEffective();
+        }
+        function onFrameModeChanged() {
+            if (root.ready)
+                root.syncEffective();
+        }
+    }
+
+    Component.onCompleted: syncEffective()
+}

quickshell/Common/KeyUtils.js

@@ -68,27 +68,6 @@ const KEY_MAP = {
     16777429: "XF86Explorer",
     16777442: "XF86Launch0",
     16777443: "XF86Launch1",
-    33: "1",
-    64: "2",
-    35: "3",
-    36: "4",
-    37: "5",
-    94: "6",
-    38: "7",
-    42: "8",
-    40: "9",
-    41: "0",
-    60: "Comma",
-    62: "Period",
-    63: "Slash",
-    58: "Semicolon",
-    34: "Apostrophe",
-    123: "BracketLeft",
-    125: "BracketRight",
-    124: "Backslash",
-    95: "Minus",
-    43: "Equal",
-    126: "grave",
     196: "Adiaeresis",
     214: "Odiaeresis",
     220: "Udiaeresis",
@@ -126,6 +105,56 @@ const KEY_MAP = {
     161: "exclamdown"
 };
 
+// Preserve unshifted symbols from the active layout
+const SYMBOL_KEYSYM = {
+    33: "exclam",
+    34: "quotedbl",
+    35: "numbersign",
+    36: "dollar",
+    37: "percent",
+    38: "ampersand",
+    40: "parenleft",
+    41: "parenright",
+    42: "asterisk",
+    43: "plus",
+    58: "colon",
+    60: "less",
+    62: "greater",
+    63: "question",
+    64: "at",
+    94: "asciicircum",
+    95: "underscore",
+    123: "braceleft",
+    124: "bar",
+    125: "braceright",
+    126: "asciitilde"
+};
+
+// Preserve the existing shifted-US physical-key mapping
+const SHIFTED_US_FALLBACK = {
+    33: "1",
+    34: "Apostrophe",
+    35: "3",
+    36: "4",
+    37: "5",
+    38: "7",
+    40: "9",
+    41: "0",
+    42: "8",
+    43: "Equal",
+    58: "Semicolon",
+    60: "Comma",
+    62: "Period",
+    63: "Slash",
+    64: "2",
+    94: "6",
+    95: "Minus",
+    123: "BracketLeft",
+    124: "Backslash",
+    125: "BracketRight",
+    126: "grave"
+};
+
 // Numpad (keypad) keys. Qt reuses the same Qt::Key_* values for the numpad and
 // the main rows/nav cluster; only Qt.KeypadModifier distinguishes them. niri and
 // the other compositors bind against the xkb KP_* keysym names, so we must emit
@@ -153,13 +182,17 @@ const KP_MAP = {
     46: "KP_Decimal"
 };
 
-function xkbKeyFromQtKey(qk, isKeypad) {
+function xkbKeyFromQtKey(qk, isKeypad, hasShift) {
     if (isKeypad) {
         if (qk >= 48 && qk <= 57)
             return "KP_" + (qk - 48);
         if (KP_MAP[qk])
             return KP_MAP[qk];
     }
+    if (!hasShift && SYMBOL_KEYSYM[qk])
+        return SYMBOL_KEYSYM[qk];
+    if (hasShift && SHIFTED_US_FALLBACK[qk])
+        return SHIFTED_US_FALLBACK[qk];
     if (qk >= 65 && qk <= 90)
         return String.fromCharCode(qk);
     if (qk >= 97 && qk <= 122)
@@ -192,23 +225,42 @@ function formatToken(mods, key) {
     return (mods.length ? mods.join("+") + "+" : "") + key;
 }
 
-function normalizeKeyCombo(keyCombo) {
-    if (!keyCombo)
-        return "";
-    return keyCombo.toLowerCase().replace(/\bmod\b/g, "super").replace(/\bsuper\b/g, "super");
+function canonicalModifier(modifier) {
+    var normalized = (modifier || "").toLowerCase();
+    if (normalized === "control")
+        return "ctrl";
+    if (normalized === "win")
+        return "super";
+    return normalized;
 }
 
-function getConflictingBinds(keyCombo, currentAction, allBinds) {
+function withSymbolicMod(mods, modKey) {
+    var configuredMod = canonicalModifier(modKey);
+    if (!configuredMod)
+        return mods;
+    return mods.map(function (modifier) {
+        return canonicalModifier(modifier) === configuredMod ? "Mod" : modifier;
+    });
+}
+
+function normalizeKeyCombo(keyCombo, modKey) {
+    if (!keyCombo)
+        return "";
+    var configuredMod = canonicalModifier(modKey) || "super";
+    return keyCombo.toLowerCase().replace(/\bmod\b/g, configuredMod).replace(/\bcontrol\b/g, "ctrl").replace(/\bwin\b/g, "super");
+}
+
+function getConflictingBinds(keyCombo, currentAction, allBinds, modKey) {
     if (!keyCombo)
         return [];
     var conflicts = [];
-    var normalizedKey = normalizeKeyCombo(keyCombo);
+    var normalizedKey = normalizeKeyCombo(keyCombo, modKey);
     for (var i = 0; i < allBinds.length; i++) {
         var bind = allBinds[i];
         if (bind.action === currentAction)
             continue;
         for (var k = 0; k < bind.keys.length; k++) {
-            if (normalizeKeyCombo(bind.keys[k].key) === normalizedKey) {
+            if (normalizeKeyCombo(bind.keys[k].key, modKey) === normalizedKey) {
                 conflicts.push({
                     action: bind.action,
                     desc: bind.desc || bind.action