Merge remote-tracking branch 'refs/remotes/portfolio/master' into codex/portfolio-263-20260907

2026-09-07 22:18:42 +01:00
commit a0f23f35e5
@@ -1,5 +1,18 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "e323d0d1f8dea6b75bb651ce14acc73904cd0326"
+  "upstream": {
+    "debian": "https://downloads.1password.com/linux/debian/amd64/dists/stable/main/binary-amd64/Packages",
+    "package": "1password",
+    "sources": {
+      "x86_64": [
+        "https://downloads.1password.com/linux/tar/stable/x86_64/1password-{pkgver}.x64.tar.gz",
+        "https://downloads.1password.com/linux/tar/stable/x86_64/1password-{pkgver}.x64.tar.gz.sig"
+      ],
+      "aarch64": [
+        "https://downloads.1password.com/linux/tar/stable/aarch64/1password-{pkgver}.arm64.tar.gz",
+        "https://downloads.1password.com/linux/tar/stable/aarch64/1password-{pkgver}.arm64.tar.gz.sig"
+      ]
+    }
+  }
 }
@@ -1,27 +1,45 @@
 pkgname=1password
-
-_tarver=8.12.34
-_tar="1password-${_tarver}.x64.tar.gz"
-pkgver=${_tarver//-/_}
-pkgrel=34
+pkgver=8.12.34
+pkgrel=36
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url='https://1password.com'
 license=('LicenseRef-1Password-Proprietary')
 options=(!strip)
 install="1password.install"
-source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
-sha256sums=('297784aa66770b645607a7f04c9ba2c4aebed4f46d21202487f521ba572b7b13'
-            'ec085bef60de748895d3c51a8208301ba2ac8fb47db99334539ba4bd1d3260d7'
+source_x86_64=(
+    "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${pkgver}.x64.tar.gz"
+    "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${pkgver}.x64.tar.gz.sig"
+)
+source_aarch64=(
+    "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${pkgver}.arm64.tar.gz"
+    "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${pkgver}.arm64.tar.gz.sig"
+)
+sha256sums_x86_64=('297784aa66770b645607a7f04c9ba2c4aebed4f46d21202487f521ba572b7b13'
+                   'ec085bef60de748895d3c51a8208301ba2ac8fb47db99334539ba4bd1d3260d7'
+)
+sha256sums_aarch64=('ea5102363d6cf3442b96a7abd6743da8c1d261f56a628e1a3c183d84fa65fdcb'
+                    'f44db73fa44c3f68c3ab78a9cce140be9355de1dd9be4ce731c9d6597960c907'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')

 package() {
    depends=('hicolor-icon-theme' 'libgtk-3.so=0' 'nss' 'xdg-utils')

+    # 1Password names its tarballs by a vendor architecture suffix. arch=()
+    # above already limits which architectures makepkg builds, so no fallback
+    # branch is needed here; keeping this inside package() means sourcing the
+    # PKGBUILD without CARCH (as the version check does) still reads the
+    # version correctly.
+    local _tararch
+    case "$CARCH" in
+        x86_64) _tararch=x64 ;;
+        aarch64) _tararch=arm64 ;;
+    esac
+
    # Go to source directory
-    cd "1password-${_tarver}.x64"
+    cd "1password-${pkgver}.${_tararch}"

    # Install icons
    resolutions=(32x32 64x64 256x256 512x512)
@@ -33,6 +51,12 @@ package() {
    # Install desktop file
    install -Dm0644 resources/1password.desktop -t "${pkgdir}"/usr/share/applications/

+    # 1Password reads the display scale itself, the way Electron apps do, and
+    # comes up oversized next to every other window on a scaled monitor. Pin it
+    # and let the compositor do the scaling.
+    sed -i 's|^Exec=.*|Exec=/opt/1Password/1password --force-device-scale-factor=1 %U|' \
+        "${pkgdir}/usr/share/applications/1password.desktop"
+
    # Fill in policy kit file with a list of (the first 10) human users of the system.
    export POLICY_OWNERS
    POLICY_OWNERS="$(cut -d: -f1,3 /etc/passwd | grep -E ':[0-9]{4}$' | cut -d: -f1 | head -n 10 | sed 's/^/unix-user:/' | tr '\n' ' ')"
@@ -49,7 +73,7 @@ EOF" > ./com.1password.1Password.policy
    # Move package contents to /opt/1Password
    cd "${srcdir}"
    install -dm0755 "${pkgdir}"/opt
-    mv "1password-${_tarver}.x64" "${pkgdir}/opt/1Password"
+    mv "1password-${pkgver}.${_tararch}" "${pkgdir}/opt/1Password"

    # Cleanup un-needed files
    rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
@@ -4,7 +4,7 @@ epoch=1
 pkgver=0.6.0
 pkgrel=2
 pkgdesc="Control brightness on Apple Displays connected via USB-C"
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://github.com/omakasui/asdcontrol"
 license=('GPL2')
 options=('!debug')
@@ -1,4 +1,3 @@
 [asusctl]
 source = "git"
-git = "https://gitlab.com/asus-linux/asusctl.git"
-
+git = "https://github.com/OpenGamingCollective/asusctl.git"
@@ -1,4 +1,4 @@
 {
  "source": "aur",
-  "upstream_commit": "ed336f7dbd5e8bee333aeaa6246da89241f1c8e6"
+  "upstream_commit": "b0ec6ca495eb331a684db91b0fe12085a868b632"
 }
@@ -1,18 +0,0 @@
-diff --git a/PKGBUILD b/PKGBUILD
-index 55d0c22..8897aec 100644
--- a/PKGBUILD
-+++ b/PKGBUILD
-@@ -6,7 +6,7 @@ pkgname=(
-   asusctl
-   rog-control-center
- )
-pkgver=6.3.8
-+pkgver=6.4.0
- pkgrel=1
- pkgdesc="A control daemon, tools, and a collection of crates for interacting with ASUS ROG laptops"
- arch=('x86_64')
-@@ -28,2 +28,2 @@
-source=("git+https://gitlab.com/asus-linux/asusctl.git#tag=$pkgver")
-b2sums=('01269bc9fe63c1ce37568f9085c25dbcaaaa5cd9f51339d4c6904600d179ec826dace289d6e4e3501988fce5800da98e9cfa18b21c40da152d91c4f7fe821ffe')
-+source=("git+https://github.com/opengamingcollective/asusctl.git#tag=$pkgver")
-+b2sums=('0cfdc7f792fc6499cde9e4c9c6d82e484605e1b2878bb9f3a0e0696f5910b9ba7898f124fecd5fb3f39a0787f81e5163721606290099d757365dc3d6715a1bcf')
@@ -1,108 +1,59 @@
-# Maintainer: Fabian Bornschein <fabiscafe@archlinux.org>
+# Maintainer: Mahdi Sarikhani <mahdisarikhani@outlook.com>
+# Contributor: Fabian Bornschein <fabiscafe@archlinux.org>
 # Contributor: Static_Rocket

 pkgbase=asusctl
-pkgname=(
-  asusctl
-  rog-control-center
-)
+pkgname=(asusctl rog-control-center)
 pkgver=6.4.0
-pkgrel=1.1
-pkgdesc="A control daemon, tools, and a collection of crates for interacting with ASUS ROG laptops"
+pkgrel=1
+pkgdesc="Daemon and tools to control your ASUS ROG laptop"
 arch=('x86_64')
 url="https://asus-linux.org"
 license=('MPL-2.0')
-makedepends=(
-  clang
-  cmake
-  fontconfig
-  git
-  hicolor-icon-theme
-  libayatana-appindicator
-  libinput
-  libusb
-  rust
-  seatd
-  systemd
-)
-source=("git+https://github.com/opengamingcollective/asusctl.git#tag=$pkgver")
-b2sums=('0cfdc7f792fc6499cde9e4c9c6d82e484605e1b2878bb9f3a0e0696f5910b9ba7898f124fecd5fb3f39a0787f81e5163721606290099d757365dc3d6715a1bcf')
+makedepends=('cargo' 'fontconfig')
+source=("${pkgbase}-${pkgver}.tar.gz::https://github.com/OpenGamingCollective/asusctl/archive/${pkgver}.tar.gz")
+b2sums=('e90074e904f364386ad661784bd9fc2e929e83ea06ac62fd1d34eb03490cefe8aae3bed2722162f1e8ea5d69248138cb5fd9f90c3a18443d1d8c04cf732b928a')

 prepare() {
-  cd "${pkgbase}"
-
-  # Keep rust/cargo build-dependency management inside the build directory
-  export CARGO_HOME="${srcdir}/cargo"
-
-  # Follow Rust package guidelines
-  ## https://wiki.archlinux.org/title/Rust_package_guidelines
-  export RUSTUP_TOOLCHAIN=stable
-  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
+    cd "${pkgbase}-${pkgver}"
+    export RUSTUP_TOOLCHAIN=stable
+    cargo fetch --locked --target host-tuple
 }

 build() {
-  cd "${pkgbase}"
-
-  # Keep rust/cargo build-dependency management inside the build directory
-  export CARGO_HOME="${srcdir}/cargo"
-
-  # Follow Rust package guidelines
-  ## https://wiki.archlinux.org/title/Rust_package_guidelines
-  export RUSTUP_TOOLCHAIN=stable
-  export CARGO_TARGET_DIR=target
-
-  make build
+    cd "${pkgbase}-${pkgver}"
+    export RUSTUP_TOOLCHAIN=stable
+    export CARGO_TARGET_DIR=target
+    make build
 }

 package_asusctl() {
-  pkgdesc="${pkgdesc/tools/CLI tools}"
-  depends=(
-    glibc
-    libgcc
-    libusb
-    systemd
-    systemd-libs
-  )
-  conflicts=(gnome-shell-extension-asusctl-gnome)
-  install=asusctl.install
-  optdepends=(
-    'acpi_call: fan control'
-    'asusctltray: tray profile switcher'
-    'rog-control-center: app to control asusctl'
-    'supergfxctl: hybrid GPU control'
-  )
+    pkgdesc="An utility for Linux to control many aspects of various ASUS laptops"
+    depends=('glibc' 'libgcc' 'libusb' 'systemd-libs')
+    optdepends=(
+        'acpi_call: fan control'
+        'asusctltray: tray profile switcher'
+        'rog-control-center: graphical user interface for asusctl'
+        'supergfxctl: hybrid GPU control'
+    )
+    install=asusctl.install

-  cd "${pkgbase}"
-  export CARGO_HOME="${srcdir}/cargo"
-  make DESTDIR="${pkgdir}" \
-    install-asusctl \
-    install-asusd \
-    install-asusd_user \
-    install-asus-shutdown \
-    install-data-asusd \
-    install-data-asusd_user
+    cd "${pkgbase}-${pkgver}"
+    make DESTDIR="${pkgdir}" \
+        install-asusctl \
+        install-asusd \
+        install-asusd_user \
+        install-asus-shutdown \
+        install-data-asusd \
+        install-data-asusd_user
 }

 package_rog-control-center() {
-  depends=(
-    asusctl
-    fontconfig
-    freetype2
-    glibc
-    hicolor-icon-theme
-    libayatana-appindicator
-    libgcc
-    libinput
-    libxkbcommon
-    mesa
-    seatd
-    systemd-libs
-  )
-  pkgdesc="App to control asusctl"
+    pkgdesc="Graphical user interface for asusctl"
+    depends=('asusctl' 'fontconfig' 'glibc' 'hicolor-icon-theme' 'libgcc' 'systemd-libs')

-  cd "${pkgbase}"
-  export CARGO_HOME="${srcdir}/cargo"
-  make DESTDIR="${pkgdir}" \
-    install-data-rog_gui \
-    install-rog_gui
+    cd "${pkgbase}-${pkgver}"
+    make DESTDIR="${pkgdir}" \
+        install-rog_gui \
+        install-data-rog_gui
 }
@@ -1,19 +1,18 @@
 post_install() {
-  printf ":: asusd provides a service that is activated by an udev rule on\n"
-  printf ":: startup. Please reboot the system or run\n"
-  printf ":: # systemctl start asusd.service\n"
-  printf ":: to make it work.\n"
-  printf ":: See https://gitlab.com/asus-linux/asusctl#kernel-support.\n"
-  printf ":: for latest required kernel patches/versions\n"
+    printf ":: asusd provides a service that is activated by an udev rule on\n"
+    printf ":: startup. Please reboot the system or run\n"
+    printf ":: # systemctl start asusd.service\n"
+    printf ":: to make it work.\n"
+    printf ":: See https://github.com/OpenGamingCollective/asusctl#kernel-requirements\n"
+    printf ":: for latest required kernel patches/versions\n"
 }

 post_upgrade() {
-  if systemctl is-active asusd.service --quiet
-    then
-      printf ":: asusd service will be restarted…\n"
-      systemctl daemon-reload
-      systemctl restart asusd.service
-  fi
-  printf ":: See https://gitlab.com/asus-linux/asusctl#kernel-support.\n"
-  printf ":: for latest required kernel patches/versions\n"
+    if systemctl is-active asusd.service --quiet; then
+        printf ":: asusd service will be restarted…\n"
+        systemctl daemon-reload
+        systemctl restart asusd.service
+    fi
+    printf ":: See https://github.com/OpenGamingCollective/asusctl#kernel-requirements\n"
+    printf ":: for latest required kernel patches/versions\n"
 }
@@ -1,5 +1,5 @@
 {
  "source": "aur",
  "release_ring": "fast",
-  "upstream_commit": "fe2a6345e271f618dc3adf31e48557a717866395"
+  "upstream_commit": "1e7bd48ef192b3d6a2854916e75e14ea43f6f0b7"
 }
@@ -1,6 +1,6 @@
 # Maintainer: Basecamp <support@basecamp.com>
 pkgname=basecamp-cli
-pkgver=0.9.1
+pkgver=0.10.0
 pkgrel=1
 pkgdesc="CLI for Basecamp project management"
 arch=('x86_64' 'aarch64')
@@ -13,10 +13,10 @@ optdepends=(
  'zsh: for zsh shell completions'
  'fish: for fish shell completions'
 )
-source_x86_64=("https://github.com/basecamp/basecamp-cli/releases/download/v0.9.1/basecamp_${pkgver}_linux_amd64.tar.gz")
-source_aarch64=("https://github.com/basecamp/basecamp-cli/releases/download/v0.9.1/basecamp_${pkgver}_linux_arm64.tar.gz")
-sha256sums_x86_64=('bcb1fa3a03e702bbf81a3004ded4bc7808605e41106cbc768ba4006b89e0db2f')
-sha256sums_aarch64=('ff50313024b6ca14e40146e30e1c9c9c00a4e4103fe55615eeee3e7c359d88d1')
+source_x86_64=("https://github.com/basecamp/basecamp-cli/releases/download/v0.10.0/basecamp_${pkgver}_linux_amd64.tar.gz")
+source_aarch64=("https://github.com/basecamp/basecamp-cli/releases/download/v0.10.0/basecamp_${pkgver}_linux_arm64.tar.gz")
+sha256sums_x86_64=('ca8b3a085f90323c8ab1694b83ff624cf10c459618ca6010ce204534f3f01987')
+sha256sums_aarch64=('dd1b5db88b9b309e95ae1ec0d642d23f4955a3abe159bffe00796a0ef6030c1d')

 package() {
  install -Dm755 "basecamp" "${pkgdir}/usr/bin/basecamp"
@@ -1,5 +1,5 @@
 {
  "source": "aur",
  "release_ring": "fast",
-  "upstream_commit": "29ca1941149bbf080d7eb6d2bb53cddc76478a1a"
+  "upstream_commit": "87aa5d5f2771c83dae737fe1bcfbc129110291fb"
 }
@@ -4,7 +4,7 @@
 # Automation repository: https://github.com/fabifont/claude-code-aur

 pkgname=claude-code
-pkgver=2.1.252
+pkgver=2.1.263
 pkgrel=1
 pkgdesc="An agentic coding tool that lives in your terminal"
 arch=('x86_64' 'aarch64')
@@ -29,8 +29,8 @@ source_x86_64=("claude-${pkgver}-x86_64::https://downloads.claude.ai/claude-code
 source_aarch64=("claude-${pkgver}-aarch64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-arm64/claude")

 sha256sums=('SKIP')
-sha256sums_x86_64=('a715a45105e593fc9808d035d77781f88480b9897975a9df41837f0c591bd4b3')
-sha256sums_aarch64=('6c0b32eaa936954a0f4d4ad2595f8416af288d9b3cbaf19e3cdd9a95d7c8853e')
+sha256sums_x86_64=('26d020351e8112f4006790f3cfce43b4c9df0c1bb1d0e542364d64151b81d5ba')
+sha256sums_aarch64=('7d25d7c8ae6c6e009cc7dae4e817f674179fd31fb7761bcd56fee4c2902b4c03')

 package() {
 	install -Dm755 "${srcdir}/claude-${pkgver}-${CARCH}" "${pkgdir}/opt/claude-code/bin/claude"
@@ -1,4 +1,4 @@
 {
  "source": "aur",
-  "upstream_commit": "76b9ce02837a49de0fa50cfa3da5d1c0c692ece5"
+  "upstream_commit": "0e012cbfe1ea6cbbf15e2ada9cf93cca7aaa9ca0"
 }
@@ -1,17 +1,17 @@
 # Maintainer: bjarneo <https://github.com/bjarneo>
 pkgname=cliamp
-pkgver=1.63.2
+pkgver=2.0.1
 pkgrel=1
 pkgdesc='A retro terminal music player inspired by Winamp 2.x'
 arch=('x86_64' 'aarch64')
 url='https://github.com/bjarneo/cliamp'
 license=('MIT')
-depends=('alsa-lib' 'flac' 'libvorbis' 'libogg' 'ffmpeg' 'yt-dlp')
+depends=('alsa-lib' 'flac' 'libvorbis' 'libogg' 'mpg123' 'ffmpeg' 'yt-dlp')
 optdepends=('pipewire-alsa: audio output on PipeWire systems'
  'pulseaudio-alsa: audio output on PulseAudio systems')
 makedepends=('go')
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/bjarneo/cliamp/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('968ff98c1e49bae8a0ce63acf5c77a9621ef70756a048e3df5e79454b82a9eef')
+sha256sums=('2c5885665dba5ed2e8dc156bce64751199a92efed7f63959c65e985759b73732')

 build() {
    cd "${pkgname}-${pkgver}"
@@ -1,5 +1,5 @@
 {
  "source": "aur",
  "release_ring": "fast",
-  "upstream_commit": "00756d82c31b0056800bb98220c83800ebb85e72"
+  "upstream_commit": "c5073d62f60f3973a14340eb1b40fc5b5a4ea9f0"
 }
@@ -1,18 +1,18 @@
 # Maintainer: Gunther Schulz <dev@guntherschulz.de>

 pkgname=cursor-bin
-pkgver=3.18.25
+pkgver=3.19.13
 pkgrel=1
 pkgdesc='AI-first coding environment'
 arch=('x86_64')
 url="https://www.cursor.com"
 license=('LicenseRef-Cursor_EULA')
 # upstream uses Electron newer than internal VSCode
-_electron=electron40
+_electron=electron42
 depends=(xdg-utils ripgrep $_electron nodejs
  'gcc-libs' 'hicolor-icon-theme' 'libxkbfile')
 options=(!strip !debug) # Don't break ext of VSCode
-_commit=280eca2911f1774689696e5f1efa5a4f97a87af3
+_commit=dd066f332fcea7382764400fde902f61920648d5
 source=("https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${pkgver}_amd64.deb"
 "https://gitlab.archlinux.org/archlinux/packaging/packages/code/-/raw/main/code."{sh,mjs}
 rg.sh)
@@ -20,7 +20,7 @@ sha512sums=('SKIP'
  '937299c6cb6be2f8d25f7dbc95cf77423875c5f8353b8bd6cd7cc8e5603cbf8405b14dbf8bd615db2e3b36ed680fc8e1909410815f7f8587b7267a699e00ab37'
  '793f9ff6306e3992ac89802d98110cba288ea1181a901467333293b7d76182ef9792c2a39ff49d9347a18a174b1f42bc58862091dff583f4146c2704eea28033'
  'e79fe7659f59d1ae02fc68816399bfd31587315df6cdb6ccf1d0ca76f7cdc692c2a42b30591c0091147bd97ef14b1c7745dc26bd7cb3ea6bba45698e5044fa2a')
-sha512sums[0]=5f25c9dccf75c764b6266e74136ad5cf6e99330804c7ae3ed22d4210304791b1ac1233efb07b291da490fbfe3d4801cb46680a171ddf6b2815e0267741ec339a
+sha512sums[0]=3c952035fa1809caded7059b7addbb01a9143cd248ecff27cdb3cb3af47d4bc824ed60dfd9757e105a342e53280e075d81f775790295a3272818bab5a994b305
 noextract=(cursor_${pkgver}_amd64.deb) # avoid double tarball
 _app=usr/share/cursor/resources/app
 package() {
@@ -0,0 +1,11 @@
+--- a/PKGBUILD
+++ b/PKGBUILD
+@@ -11,7 +11,7 @@ pkgname=dropbox-cli
+ pkgver=2024.04.17
+ pkgrel=2
+ pkgdesc="Command line interface for Dropbox"
+-arch=("any")
+arch=("x86_64")
+ url="https://www.dropbox.com"
+ license=("GPL-3.0-or-later")
+ makedepends=("gdk-pixbuf2")
@@ -7,9 +7,9 @@

 pkgname=dropbox-cli
 pkgver=2024.04.17
-pkgrel=2
+pkgrel=2.1
 pkgdesc="Command line interface for Dropbox"
-arch=("any")
+arch=("x86_64")
 url="https://www.dropbox.com"
 license=("GPL-3.0-or-later")
 makedepends=("gdk-pixbuf2")
@@ -0,0 +1,5 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "min_release_age": "24h"
+}
@@ -0,0 +1,100 @@
+#!/bin/bash
+# Flea publishes signed source tags but no release artifacts or checksum manifest.
+# Check the small GitHub source tarball only when a newer stable release exists,
+# validate its expected root, then report its hash alongside the fixed hashes of
+# the four upstream security patches carried until a release includes them.
+set -euo pipefail
+
+REPO='thisisgm/flea'
+RELEASES_URL="https://api.github.com/repos/$REPO/releases?per_page=100"
+PATCH_2BD7CC2='c610a9f44294b67341940203943c9c567003b65cc436d6013cd36754379183d8'
+PATCH_27D19CA='e457ef17e26f70057b1184eeb938fccc5906f48a7c77f1df573d55d13a845425'
+PATCH_23290CE='f8381456a3b5f39d341cc6610bf27beb8354892b17a1c8c6d7882db4e40824c3'
+PATCH_B4B7EE4='46bdbe43f135a052c893b1987f8b0928736445616a84b0c65d2181ee74b21b25'
+
+current=$(awk -F= '/^pkgver=/ { print $2; exit }' PKGBUILD)
+releases=$(curl -fsSL "$RELEASES_URL")
+now=$(date +%s)
+min_age=${MIN_RELEASE_AGE_SECONDS:-0}
+
+candidates=0
+best_version=''
+best_tag=''
+best_published_at=''
+
+while IFS=$'\t' read -r tag published_at; do
+  if [[ ! $tag =~ ^v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
+    printf '%s has an unusable stable release tag: %s\n' "$REPO" "${tag:-<empty>}" >&2
+    exit 1
+  fi
+  version=${BASH_REMATCH[1]}
+
+  if [[ -z $published_at ]] || ! published_epoch=$(date --date="$published_at" +%s 2>/dev/null); then
+    printf '%s release %s has an invalid publication time\n' "$REPO" "$tag" >&2
+    exit 1
+  fi
+  candidates=$((candidates + 1))
+
+  if (( now - published_epoch < min_age )) && [[ ${BYPASS_MIN_RELEASE_AGE:-} != 1 ]]; then
+    continue
+  fi
+
+  if [[ -z $best_version ]] || (( $(vercmp "$version" "$best_version") > 0 )); then
+    best_version=$version
+    best_tag=$tag
+    best_published_at=$published_at
+  fi
+done < <(jq -r '.[] | select((.draft or .prerelease) | not) | [.tag_name // "", .published_at // ""] | @tsv' <<<"$releases")
+
+if (( candidates == 0 )); then
+  printf 'No stable releases found for %s\n' "$REPO" >&2
+  exit 1
+fi
+
+if [[ -z $best_version ]] || (( $(vercmp "$best_version" "$current") <= 0 )); then
+  echo '{}'
+  exit 0
+fi
+
+tarball=$(mktemp)
+trap 'rm -f "$tarball"' EXIT
+curl -fsSL -o "$tarball" "https://github.com/$REPO/archive/refs/tags/$best_tag.tar.gz"
+
+expected_root="flea-$best_version"
+served_roots=$(tar -tzf "$tarball" | cut -d/ -f1 | sort -u)
+if [[ $served_roots != "$expected_root" ]]; then
+  printf 'Release %s contains root %s, expected %s\n' "$best_tag" "$served_roots" "$expected_root" >&2
+  exit 1
+fi
+
+archive_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/archive.rs")
+archiveops_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/archiveops.rs")
+run_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/run.rs")
+archivereq_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/archivereq.rs")
+archivework_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/archivework.rs")
+mediaprobe_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/mediaprobe.rs")
+metareq_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/metareq.rs")
+sharelink_qml=$(tar -xOzf "$tarball" "$expected_root/ui/ShareLink.qml")
+copyfile_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/copyfile.rs")
+
+if ! grep -Fq 'a.push("--".to_string());' <<<"$archive_rs" ||
+  ! grep -Fq 'let input = std::fs::canonicalize(input)' <<<"$archiveops_rs" ||
+  ! grep -Fq 'if op != "compress" && op != "extract"' <<<"$run_rs$archivereq_rs" ||
+  ! grep -Fq 'the sandbox is unavailable: bwrap or prlimit is not on PATH' <<<"$archivework_rs" ||
+  ! grep -Fq 'if !sandbox::available()' <<<"$mediaprobe_rs" ||
+  ! grep -Fq 'if !sandbox::available()' <<<"$metareq_rs" ||
+  ! grep -Fq 'copyToClipboard.command = ["wl-copy", url]' <<<"$sharelink_qml" ||
+  ! grep -Fq '.custom_flags(O_NOFOLLOW)' <<<"$copyfile_rs"; then
+  printf 'Release %s does not contain every required upstream security fix\n' "$best_tag" >&2
+  exit 1
+fi
+
+jq -n \
+  --arg pkgver "$best_version" \
+  --arg published_at "$best_published_at" \
+  --arg source "$(sha256sum "$tarball" | cut -d' ' -f1)" \
+  --arg patch_2bd7cc2 "$PATCH_2BD7CC2" \
+  --arg patch_27d19ca "$PATCH_27D19CA" \
+  --arg patch_23290ce "$PATCH_23290CE" \
+  --arg patch_b4b7ee4 "$PATCH_B4B7EE4" \
+  '{pkgver: $pkgver, published_at: $published_at, sha256sums: {any: [$source, $patch_2bd7cc2, $patch_27d19ca, $patch_23290ce, $patch_b4b7ee4]}}'
@@ -0,0 +1,163 @@
+# Maintainer: GM <gianmarcomorales@icloud.com>
+
+pkgname=flea
+pkgver=0.1.3
+pkgrel=1
+pkgdesc='Fast, keyboard-first file manager for Omarchy'
+arch=('x86_64')
+url='https://github.com/thisisgm/flea'
+license=('MIT')
+
+depends=(
+  'bubblewrap'
+  'gcc-libs'
+  'glib2'
+  'glibc'
+  'hicolor-icon-theme'
+  'omarchy'
+  'quickshell'
+  'qt6-multimedia'
+  'qt6-webengine'
+  'shared-mime-info'
+  'util-linux'
+  'xdg-utils'
+)
+makedepends=('cargo')
+optdepends=(
+  '7zip: 7z archive support'
+  'dropbox-cli: Dropbox browsing and share links'
+  'ffmpeg: media metadata previews'
+  'imagemagick: image conversion'
+  'libarchive: archive listing and extraction'
+  'tailscale: Taildrop sharing'
+  'wl-clipboard: copy Dropbox share links to the clipboard'
+)
+conflicts=('flea-git')
+options=('!debug')
+
+_security_patches=(
+  '2bd7cc207c110ae3b3ea61a4d4e42336f1815111'
+  '27d19ca4a38ef4a0a920fb78441ce662a0101327'
+  '23290ce1917b0d7f0392dd09d04bf2a7504ec93a'
+  'b4b7ee47244b52457eec2874e21a8656d8ace647'
+)
+source=(
+  "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
+  "security-2bd7cc2.patch::$url/commit/${_security_patches[0]}.patch"
+  "security-27d19ca.patch::$url/commit/${_security_patches[1]}.patch"
+  "security-23290ce.patch::$url/commit/${_security_patches[2]}.patch"
+  "security-b4b7ee4.patch::$url/commit/${_security_patches[3]}.patch"
+)
+sha256sums=(
+  '3599ab76253c444dea027f1ebe85b32612d9a174e60eb8aca33ee21d9e2d6973'
+  'c610a9f44294b67341940203943c9c567003b65cc436d6013cd36754379183d8'
+  'e457ef17e26f70057b1184eeb938fccc5906f48a7c77f1df573d55d13a845425'
+  'f8381456a3b5f39d341cc6610bf27beb8354892b17a1c8c6d7882db4e40824c3'
+  '46bdbe43f135a052c893b1987f8b0928736445616a84b0c65d2181ee74b21b25'
+)
+
+prepare() {
+  cd "$pkgname-$pkgver"
+
+  security_patch_present() {
+    case "$1" in
+      2bd7cc207c110ae3b3ea61a4d4e42336f1815111)
+        grep -Fq 'a.push("--".to_string());' src/backend/archive.rs &&
+          grep -Fq 'let input = std::fs::canonicalize(input)' src/backend/archiveops.rs &&
+          grep -Fq 'if op != "compress" && op != "extract"' \
+            src/backend/run.rs src/backend/archivereq.rs
+        ;;
+      27d19ca4a38ef4a0a920fb78441ce662a0101327)
+        grep -Fq 'the sandbox is unavailable: bwrap or prlimit is not on PATH' src/backend/archivework.rs &&
+          grep -Fq 'if !sandbox::available()' src/backend/mediaprobe.rs &&
+          grep -Fq 'if !sandbox::available()' src/backend/metareq.rs
+        ;;
+      23290ce1917b0d7f0392dd09d04bf2a7504ec93a)
+        grep -Fq 'copyToClipboard.command = ["wl-copy", url]' ui/ShareLink.qml
+        ;;
+      b4b7ee47244b52457eec2874e21a8656d8ace647)
+        grep -Fq '.custom_flags(O_NOFOLLOW)' src/backend/copyfile.rs
+        ;;
+      *)
+        return 1
+        ;;
+    esac
+  }
+
+  local commit patch_file
+  for commit in "${_security_patches[@]}"; do
+    patch_file="$srcdir/security-${commit:0:7}.patch"
+
+    if patch --batch --forward --dry-run -Np1 -i "$patch_file" >/dev/null 2>&1; then
+      patch --batch --forward -Np1 -i "$patch_file"
+    elif security_patch_present "$commit"; then
+      printf 'Security patch %s is already present upstream\n' "$commit"
+    else
+      printf 'Security patch %s no longer applies and is not present upstream\n' "$commit" >&2
+      return 1
+    fi
+  done
+}
+
+build() {
+  cd "$pkgname-$pkgver"
+
+  export CARGO_TARGET_DIR=target
+  cargo build --frozen --release
+}
+
+check() {
+  cd "$pkgname-$pkgver"
+
+  export CARGO_TARGET_DIR=target
+
+  local -a test_args=()
+  if ! /usr/bin/prlimit --cpu=30 --as=1073741824 \
+    /usr/bin/bwrap --unshare-all --die-with-parent --new-session --clearenv \
+    --ro-bind /usr /usr --ro-bind /etc /etc \
+    --symlink usr/lib /lib --symlink usr/lib /lib64 \
+    --symlink usr/bin /bin --symlink usr/bin /sbin \
+    --proc /proc --dev /dev --tmpfs /tmp /usr/bin/true >/dev/null 2>&1; then
+    printf 'Skipping sandbox integration tests: this builder cannot create an unprivileged namespace\n'
+    test_args+=(
+      --skip backend::archiveops::tests::a_tool_that_exits_zero_writing_nothing_is_caught_by_the_predicate
+      --skip backend::archiveops::tests::an_empty_archive_extracts_to_an_empty_directory_and_that_is_success
+      --skip backend::archiveops::tests::only_the_archive_root_extracts_to_nothing_while_nested_directories_do_not
+      --skip backend::archiveops::tests::the_emptiness_check_reads_the_destination_and_the_index_separately
+      --skip backend::thumbs::tests::a_cancelled_job_never_runs
+      --skip backend::thumbs::tests::a_real_file_round_trips_to_a_stamped_cache_entry
+      --skip backend::thumbs::tests::cancel_all_empties_the_queue
+      --skip backend::thumbs::tests::the_queue_is_bounded_and_drops_the_oldest_rather_than_growing
+    )
+  fi
+
+  if [[ ! -x /usr/bin/evince-thumbnailer ]] ||
+    [[ ! -x /usr/bin/ffmpegthumbnailer ]] ||
+    [[ ! -x /usr/bin/glycin-thumbnailer ]]; then
+    printf 'Skipping thumbnailer fixture tests: this builder lacks their optional host programs\n'
+    test_args+=(
+      --skip backend::thumbspec::tests::a_type_two_files_declare_goes_to_the_first_in_path_order
+      --skip backend::thumbspec::tests::the_heaviest_shipped_field_parses
+    )
+  fi
+
+  cargo test --frozen --release -- "${test_args[@]}"
+  ./tests/js.sh
+  ./tests/keymap-gen.sh
+}
+
+package() {
+  cd "$pkgname-$pkgver"
+
+  install -Dm755 target/release/flea "$pkgdir/usr/bin/flea"
+  install -Dm644 packaging/com.thisisgm.flea.desktop \
+    "$pkgdir/usr/share/applications/com.thisisgm.flea.desktop"
+  install -Dm644 packaging/com.thisisgm.flea.svg \
+    "$pkgdir/usr/share/icons/hicolor/scalable/apps/com.thisisgm.flea.svg"
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+
+  install -Dm644 ui/qmldir ui/*.qml -t "$pkgdir/usr/share/flea/ui"
+  install -Dm644 ui/js/*.js -t "$pkgdir/usr/share/flea/ui/js"
+  ln -s /usr/share/omarchy/shell/Commons "$pkgdir/usr/share/flea/ui/Commons"
+  ln -s /usr/share/omarchy/shell/Ui "$pkgdir/usr/share/flea/ui/Ui"
+}
@@ -1,5 +1,13 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "fc4db00ecaf6c2669422b32c023a16bf6eb4e6c7"
+  "upstream": {
+    "npm": "@github/copilot",
+    "sources": {
+      "any": [
+        "{npm_tarball}",
+        "https://raw.githubusercontent.com/github/copilot-cli/v{pkgver}/changelog.md"
+      ]
+    }
+  }
 }
@@ -6,7 +6,7 @@ _npmmodule=@github/copilot
 pkgname=github-copilot-cli
 _pkgexec=copilot

-pkgver=1.0.82
+pkgver=1.0.83
 pkgrel=1

 pkgdesc="GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal."
@@ -14,7 +14,7 @@ pkgdesc="GitHub Copilot CLI brings the power of Copilot coding agent directly to
 url="https://github.com/github/copilot-cli"
 _urlraw="https://raw.githubusercontent.com/github/copilot-cli/v${pkgver}"

-arch=("x86_64")
+arch=("x86_64" "aarch64")

 license=("LicenseRef-GitHub-Copilot")

@@ -30,8 +30,10 @@ source=("https://registry.npmjs.org/${_npmmodule}/-/copilot-${pkgver}.tgz"
 		"CHANGELOG-${pkgver}.md::${_urlraw}/changelog.md")
 noextract=("copilot-${pkgver}.tgz")

-b2sums=('41c8306b58a142afe162bad9822b150babb0f3903fe7392aa7106fcb0ffce4483c0a2ebda8bb1d2036199deb52dc83d9a0e9408b8e11f7b0bc2a8f57c6841425'
-        '5d2dfc870356f83b9b890d351b21bc9339100b0bfdce405ee77751e934dbeab0f8656f5eee85119a06aa3b01dcf3c91224ce28c24ff318eb1b13fdb6082037cd')
+sha256sums=(
+  '135506fc2b13163ab55dbf76a06e2fbcbad04ecac76b4e9c6659f0ba309e6a86'
+  '0c0064a10effac8adf9ad97338bafaa0d7d7d5bf191cc1c0384e05ff4366d36c'
+)

 # Document: https://wiki.archlinux.org/title/Node.js_package_guidelines
 package() {
@@ -124,4 +126,3 @@ package() {
 	ln -sf "/usr/lib/node_modules/${_npmmodule}/LICENSE.md" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"

 }
-
@@ -1,25 +1,11 @@
 # Maintainer: David Heinemeier Hansson <david@hey.com>

-# Nous builds Hermes Desktop for macOS and Windows only -- their download page
-# offers a .dmg and an .exe and tells Linux users to install from a terminal --
-# so there is no vendor binary to repackage. Their electron-builder config does
-# carry a Linux target, though, and it works; this builds it.
-#
-# The app only runs against a Hermes runtime built from its own commit, so it
-# provisions one itself under ~/.hermes on first launch and the package stays
-# on the newest tag. Pairing it with the mise CLI instead was tried and does
-# not work: PyPI trails the tags, and the version gap fails the readiness probe
-# with a 401. Pinning back to the tag behind PyPI's release does not rescue it
-# either -- v2026.7.20's desktop hangs after "backend is ready" without ever
-# opening a window, against its own matching runtime.
-#
-# The app is only a shell: it runs `hermes serve` against a Hermes CLI it does
-# not ship, and clones its own copy with the upstream install script when it
-# finds none. /usr/bin/hermes-desktop heads that off. See hermes-desktop.sh.
+# Build a prebuilt release; Omarchy seeds it into the user's Hermes checkout
+# so the upstream updater can rebuild and relaunch it in place.

 pkgname=hermes-desktop
-pkgver=2026.8.18
-pkgrel=2
+pkgver=2026.8.31
+pkgrel=3
 pkgdesc='Native desktop shell for Hermes Agent'
 arch=('x86_64')
 url='https://github.com/NousResearch/hermes-agent'
@@ -32,7 +18,7 @@ depends=(
  'dbus'
  'expat'
  'curl'
-  'gcc-libs'
+  'gcc'
  'gdk-pixbuf2'
  'git'
  'glib2'
@@ -52,19 +38,24 @@ depends=(
  'libxfixes'
  'libxkbcommon'
  'libxrandr'
+  'make'
  'mesa'
+  'nodejs'
+  'npm'
  'nspr'
  'nss'
  'pango'
+  'python'
  'systemd-libs'
+  'util-linux'
  'xdg-utils'
 )

-optdepends=('omarchy: installs the Hermes CLI the app needs on first launch')
+optdepends=('omarchy: sets up the user installation for in-app updates')

 # The build runs the repo's own npm workspace install, which fetches Electron
 # and rebuilds node-pty against it.
-makedepends=('git' 'imagemagick' 'nodejs' 'npm' 'python')
+makedepends=('imagemagick')

 # Electron bundles prebuilt binaries that stripping corrupts.
 options=('!strip' '!debug')
@@ -74,23 +65,27 @@ options=('!strip' '!debug')
 # before falling back to `git rev-parse`. That fallback is wrong here: makepkg
 # builds inside this repository, so git ascends out of srcdir and stamps the
 # app with an omarchy-pkgs commit that means nothing upstream.
-_commit=e624e9fde561e1add9388384012b295fde669ade
+_commit=29112bef099274229cadff79cdff7bf7b99c4b77

 _srcdir="hermes-agent-${pkgver}"
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
        'hermes-desktop.sh'
        'hermes-desktop.desktop'
-        'hermes-desktop.png')
-sha256sums=('1e3d39d3638ec15fa9d31af262568a953e9272090deb1c50c44cd401175f5b80'
-            'f5833b969ce451aadee9f08d92db55cce3c7c9213175080590bf37444854d676'
+        'hermes-desktop.png'
+        'runtime.patch'
+        'runtime-test.py')
+sha256sums=('78fb3ff707ec1d17044b875ecac8bef28aa39d44242824f6871ca40afe7bf217'
+            '094d5f3191109a80eea9f23053b78a2e00dbecf90d62d1ca04c8e48866251469'
            '3ef685bfcf366776b025d26c37d32854d8d4aa2023b2bd07c8e08b001ef1e8c4'
-            'd60d164e24fdcf6532133b8ea43c77a201e4b9e9dbc396187b58d51d8590ef52')
+            'd60d164e24fdcf6532133b8ea43c77a201e4b9e9dbc396187b58d51d8590ef52'
+            '03b67e26c234c797a6b1d4c9f34a57502dba37f462540e47ce6c88f6ea79302a'
+            '461e1120e7e6779f531c114d9926479e47fab79113d1b4646efea36bc771b3c5')

 build() {
  cd "${srcdir}/${_srcdir}"

  export GITHUB_SHA="${_commit}"
-  export GITHUB_REF_NAME="v${pkgver}"
+  export GITHUB_REF_NAME="main"

  # The desktop workspace resolves against the repo root, so the install has to
  # happen there rather than in apps/desktop.
@@ -100,6 +95,10 @@ build() {
  npm run pack
 }

+check() {
+  python "${srcdir}/runtime-test.py" "${srcdir}/${_srcdir}" "${srcdir}/runtime.patch" "${srcdir}/hermes-desktop.sh"
+}
+
 package() {
  cd "${srcdir}/${_srcdir}/apps/desktop/release/linux-unpacked"

@@ -108,6 +107,12 @@ package() {

  install -Dm755 "${srcdir}/hermes-desktop.sh" "${pkgdir}/usr/bin/${pkgname}"

+  install -Dm644 "${srcdir}/${_srcdir}/scripts/install.sh" \
+    "${pkgdir}/usr/share/${pkgname}/install.sh"
+  # Let the release's first updater relaunch with the user-namespace sandbox.
+  install -Dm644 "${srcdir}/runtime.patch" "${pkgdir}/usr/share/${pkgname}/runtime.patch"
+
+
  install -Dm644 "${srcdir}/hermes-desktop.desktop" \
    "${pkgdir}/usr/share/applications/${pkgname}.desktop"

@@ -125,11 +130,6 @@ package() {
  install -Dm644 "${pkgdir}/opt/${pkgname}/LICENSE.electron.txt" \
    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"

-  # Chromium's setuid sandbox is only needed where unprivileged user namespaces
-  # are unavailable; where they work, setuid root is the worse of the two.
-  if ! { [[ -L /proc/self/ns/user ]] && unshare --user true; }; then
-    chmod 4755 "${pkgdir}/opt/${pkgname}/chrome-sandbox"
-  else
-    chmod 0755 "${pkgdir}/opt/${pkgname}/chrome-sandbox"
-  fi
+  # The launcher requires the namespace sandbox on the target host.
+  chmod 0755 "${pkgdir}/opt/${pkgname}/chrome-sandbox"
 }
@@ -1,41 +1,74 @@
 #!/bin/bash
 set -euo pipefail

-# Hermes Desktop is a shell around a Hermes runtime, and it only works against
-# one built from its own commit. A CLI from PyPI is always a different release
-# -- PyPI trails the tags -- and the mismatch fails the app's readiness probe
-# with 401 Unauthorized. So keep it away from whatever `hermes` is on PATH,
-# which on Omarchy is the mise CLI installed for the terminal agent, and let
-# the app provision and manage its own runtime under ~/.hermes. That is the
-# arrangement upstream ships, and the only one that starts.
+unset ELECTRON_RUN_AS_NODE PYTHONPATH PYTHONHOME
 export HERMES_DESKTOP_IGNORE_EXISTING=1

-# Chromium cannot reliably infer the Secret Service password-store backend
-# from a Hyprland session, even when GNOME Keyring is already providing it.
-# Keep an explicit user choice (such as KWallet), otherwise select the
-# libsecret backend that this package depends on.
-export HERMES_DESKTOP_PASSWORD_STORE="${HERMES_DESKTOP_PASSWORD_STORE:-gnome-libsecret}"
-
-# Reconcile every launch rather than trusting whatever installed us. A plain
-# `pacman -S hermes-desktop`, or an install interrupted partway, leaves any
-# Hermes the terminal agent had built still sitting there, and by then the
-# menu entry that would have tidied it up is disabled because we are present.
+# Reconcile direct package installs and interrupted Omarchy setup as well.
 if command -v omarchy-install-hermes-cli >/dev/null 2>&1; then
  omarchy-install-hermes-cli >/dev/null 2>&1 || true
 fi

-# Chromium's own Ozone detection falls back to XWayland often enough to matter,
-# and the result is a blurry window on every scaled display. Ask for Wayland
-# directly, unless the user has already picked a platform themselves.
-platform_flags=()
-if [[ -n "${WAYLAND_DISPLAY:-}" || ${XDG_SESSION_TYPE:-} == wayland ]]; then
-  platform_flags=(--ozone-platform=wayland)
-
-  for flag in "$@"; do
-    case "$flag" in
-    --ozone-platform=* | --ozone-platform-hint=*) platform_flags=() ;;
-    esac
-  done
+hermes_home=$(realpath -ms -- "${HERMES_HOME:-$HOME/.hermes}")
+parent=${hermes_home%/*}
+if [[ ${parent##*/} == [Pp][Rr][Oo][Ff][Ii][Ll][Ee][Ss] ]]; then
+  hermes_home=${parent%/*}
+  hermes_home=${hermes_home:-/}
+fi
+export HERMES_HOME="$hermes_home"
+runtime="$hermes_home/hermes-agent"
+native="$runtime/apps/desktop/release/linux-unpacked/Hermes"
+if [[ ! -x $native || ! -x $runtime/venv/bin/hermes ]]; then
+  native=/opt/hermes-desktop/Hermes
 fi

-exec /opt/hermes-desktop/Hermes "${platform_flags[@]}" "$@"
+# Both app locations use namespaces, never a user-writable setuid helper.
+if ! timeout 5 unshare --user --map-root-user true 2>/dev/null; then
+  echo "Hermes Desktop requires working unprivileged user namespaces for its sandbox." >&2
+  exit 1
+fi
+
+python=/usr/bin/python
+if [[ -x $runtime/venv/bin/python && -f $runtime/hermes_cli/main.py ]]; then
+  python="$runtime/venv/bin/python"
+else
+  runtime=""
+fi
+exec "$python" - "$native" "$runtime" "$@" <<'PY'
+import os
+from pathlib import Path
+import sys
+
+native, runtime, *args = sys.argv[1:]
+env = os.environ.copy()
+flags, gpu, store, ozone = [], "auto", "auto", "auto"
+if runtime:
+    sys.path.insert(0, runtime)
+    try:
+        # Upstream moved the helper out of main after the packaged release.
+        if Path(runtime, "hermes_cli/main_desktop.py").is_file():
+            from hermes_cli.main_desktop import _desktop_launch_options
+        else:
+            from hermes_cli.main import _desktop_launch_options
+        from hermes_constants import with_hermes_node_path
+
+        flags, gpu, store, ozone = _desktop_launch_options()
+        env = with_hermes_node_path(env)
+    except ImportError:
+        print("Could not load Hermes desktop settings; using launch defaults.", file=sys.stderr)
+
+env["HERMES_DESKTOP_CWD"] = os.getcwd()
+if gpu != "auto":
+    env.setdefault("HERMES_DESKTOP_DISABLE_GPU", gpu)
+if ozone != "auto":
+    env.setdefault("ELECTRON_OZONE_PLATFORM_HINT", ozone)
+env.setdefault("HERMES_DESKTOP_PASSWORD_STORE", store if store != "auto" else "gnome-libsecret")
+
+# Explicit config, environment and command-line choices override the Wayland default.
+if (env.get("WAYLAND_DISPLAY") or env.get("XDG_SESSION_TYPE") == "wayland") and (
+    "ELECTRON_OZONE_PLATFORM_HINT" not in env
+    and not any(arg.startswith(("--ozone-platform=", "--ozone-platform-hint=")) for arg in flags + args)
+):
+    flags.insert(0, "--ozone-platform=wayland")
+os.execve(native, [native, "--disable-setuid-sandbox", *flags, *args], env)
+PY
@@ -0,0 +1,162 @@
+"""Check launch settings and sandbox gates without running Hermes or sudo."""
+import ast
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+
+source, patch_file, launcher = map(Path, sys.argv[1:])
+with tempfile.TemporaryDirectory(prefix="hermes-runtime-check-") as temporary:
+    root = Path(temporary)
+    destination = root / "scripts/desktop-update/posix.sh"
+    destination.parent.mkdir(parents=True)
+    shutil.copyfile(source / "scripts/desktop-update/posix.sh", destination)
+    subprocess.run(["git", "apply", str(patch_file.resolve())], cwd=root, check=True)
+
+    home = root / "home with spaces"
+    runtime = home / ".hermes/hermes-agent"
+    native = runtime / "apps/desktop/release/linux-unpacked"
+    native.mkdir(parents=True)
+    executable = native / "Hermes"
+    executable.write_text(f"#!{sys.executable}\n" + '''import json, os, sys
+from pathlib import Path
+Path(os.environ["TEST_OUTPUT"]).write_text(json.dumps({
+    "args": sys.argv[1:], "home": os.environ["HERMES_HOME"],
+    "store": os.environ["HERMES_DESKTOP_PASSWORD_STORE"],
+    "gpu": os.environ.get("HERMES_DESKTOP_DISABLE_GPU"),
+    "ozone": os.environ.get("ELECTRON_OZONE_PLATFORM_HINT"),
+    "cwd": os.environ.get("HERMES_DESKTOP_CWD"),
+    "inherited": [name for name in ("ELECTRON_RUN_AS_NODE", "PYTHONPATH", "PYTHONHOME") if name in os.environ],
+}))
+''')
+    executable.chmod(0o755)
+    sandbox = native / "chrome-sandbox"
+    sandbox.write_text("fixture")
+    sandbox.chmod(0o755)
+
+    # Execute the release's real option parser, isolating config I/O and avoiding
+    # unrelated CLI imports, startup hooks and third-party dependencies.
+    module = runtime / "hermes_cli"
+    module.mkdir()
+    (module / "__init__.py").touch()
+    upstream = ast.parse((source / "hermes_cli/main.py").read_text())
+    option_parser = next(node for node in upstream.body
+                        if isinstance(node, ast.FunctionDef) and node.name == "_desktop_launch_options")
+    stores = next(node for node in upstream.body if isinstance(node, ast.Assign)
+                  and any(isinstance(target, ast.Name) and target.id == "_LINUX_PASSWORD_STORES"
+                          for target in node.targets))
+    helper = "import os, shlex\n" + ast.unparse(stores) + "\n" + ast.unparse(option_parser) + "\n"
+    (module / "main.py").write_text(helper)
+    (module / "config.py").write_text('''import json, os
+from pathlib import Path
+def load_config():
+    path = Path(os.environ["HERMES_HOME"], "config.yaml")
+    return json.loads(path.read_text()) if path.exists() else {}
+''')
+    (runtime / "hermes_constants.py").write_text('''import os
+def with_hermes_node_path(env=None):
+    return (os.environ if env is None else env).copy()
+''')
+
+    mock_bin = root / "bin"
+    mock_bin.mkdir()
+    unshare = mock_bin / "unshare"
+    unshare.write_text('#!/bin/bash\nexit "${TEST_NAMESPACE_RESULT:-0}"\n')
+    unshare.chmod(0o755)
+    forbidden = '#!/bin/bash\ntouch "$TEST_FORBIDDEN"\nexit 99\n'
+    cli = runtime / "venv/bin/hermes"
+    cli.parent.mkdir(parents=True)
+    cli.write_text(forbidden)
+    cli.chmod(0o755)
+    (cli.parent / "python").symlink_to(sys.executable)
+    for command in ("sudo", "omarchy-install-hermes-cli"):
+        target = mock_bin / command
+        target.write_text(forbidden if command == "sudo" else '#!/bin/bash\nexit 0\n')
+        target.chmod(0o755)
+
+    output = root / "launch.json"
+    forbidden_output = root / "forbidden"
+    env = {"HOME": str(home), "PATH": f"{mock_bin}:/usr/bin:/bin",
+           "TEST_OUTPUT": str(output), "TEST_FORBIDDEN": str(forbidden_output)}
+    launch = ["bash", str(launcher.resolve())]
+
+    def check_launch(args=(), overrides=None, expected_args=(), store="gnome-libsecret", gpu=None, ozone=None):
+        subprocess.run(launch + list(args), env={**env, **(overrides or {})}, cwd=home, check=True)
+        result = json.loads(output.read_text())
+        assert result == {"args": ["--disable-setuid-sandbox", *expected_args],
+                          "home": str(home / ".hermes"), "store": store, "gpu": gpu,
+                          "ozone": ozone, "cwd": str(home), "inherited": []}, result
+        assert not forbidden_output.exists(), "launcher invoked CLI or sudo"
+        output.unlink()
+
+    wayland = {"WAYLAND_DISPLAY": "wayland-1"}
+    check_launch(overrides=wayland, expected_args=["--ozone-platform=wayland"])
+    url = "hermes://open?text=a%20b"
+    check_launch(["--ozone-platform=x11", url], {**wayland, "HERMES_DESKTOP_PASSWORD_STORE": "kwallet6"},
+                 ["--ozone-platform=x11", url], store="kwallet6")
+    check_launch(overrides={"HERMES_HOME": str(home / ".hermes/profiles/work"),
+                            "HERMES_DESKTOP_DISABLE_GPU": "1"}, gpu="1")
+    check_launch(overrides={"ELECTRON_RUN_AS_NODE": "1", "PYTHONPATH": "/invalid", "PYTHONHOME": "/invalid"})
+
+    config = home / ".hermes/config.yaml"
+    config.write_text(json.dumps({"desktop": {"disable_gpu": True, "password_store": "kwallet5",
+                                              "ozone_platform_hint": "x11",
+                                              "electron_flags": '--force-device-scale-factor=1.5 "--test=a b"'}}))
+    config_flags = ["--force-device-scale-factor=1.5", "--test=a b"]
+    for args in ([], [url]):
+        check_launch(args, wayland, config_flags + args, store="kwallet5", gpu="1", ozone="x11")
+    check_launch(overrides={**wayland, "HERMES_DESKTOP_DISABLE_GPU": "0",
+                            "HERMES_DESKTOP_PASSWORD_STORE": "basic", "ELECTRON_OZONE_PLATFORM_HINT": "wayland"},
+                 expected_args=config_flags, store="basic", gpu="0", ozone="wayland")
+    config.write_text(json.dumps({"desktop": {"electron_flags": ["--ozone-platform=x11"], "disable_gpu": False}}))
+    check_launch(overrides=wayland, expected_args=["--ozone-platform=x11"], gpu="0")
+    # New upstream revisions expose the same helper from main_desktop instead.
+    (module / "main_desktop.py").write_text(helper)
+    (module / "main.py").write_text('raise AssertionError("old helper import after update")\n')
+    check_launch([url], wayland, ["--ozone-platform=x11", url], gpu="0")
+    config.unlink()
+    (module / "main_desktop.py").write_text(helper + '\nimport os\nos.environ.update(' + repr({
+        "ELECTRON_RUN_AS_NODE": "1", "PYTHONPATH": "/invalid", "PYTHONHOME": "/invalid",
+        "HERMES_HOME": "/invalid", "HERMES_DESKTOP_DISABLE_GPU": "1",
+        "HERMES_DESKTOP_PASSWORD_STORE": "basic", "ELECTRON_OZONE_PLATFORM_HINT": "x11",
+    }) + ')\n')
+    check_launch(overrides={**wayland, "HERMES_DESKTOP_DISABLE_GPU": "0"},
+                 expected_args=["--ozone-platform=wayland"], gpu="0")
+    (module / "main_desktop.py").write_text(helper)
+
+    def check_namespace_failure():
+        for code in ("1", "127"):
+            for args in ([], [url]):
+                result = subprocess.run(launch + args, env={**env, "TEST_NAMESPACE_RESULT": code},
+                                        capture_output=True, text=True)
+                assert result.returncode != 0 and "user namespaces" in result.stderr, result
+                assert not output.exists() and not forbidden_output.exists()
+
+    check_namespace_failure()
+    # Exercise the real fallback branch with only its absolute app path redirected.
+    fallback = root / "packaged-Hermes"
+    shutil.copyfile(executable, fallback)
+    fallback.chmod(0o755)
+    fallback_launcher = root / "fallback-launcher"
+    fallback_launcher.write_text(launcher.read_text().replace("/opt/hermes-desktop/Hermes", str(fallback)))
+    launch = ["bash", str(fallback_launcher)]
+    executable.unlink()
+    check_launch([url], wayland, ["--ozone-platform=wayland", url])
+    (module / "main_desktop.py").write_text('raise ImportError("incomplete Python dependencies")\n')
+    check_launch([url], wayland, ["--ozone-platform=wayland", url])
+    shutil.rmtree(runtime / "venv")
+    check_launch(overrides={"ELECTRON_RUN_AS_NODE": "1", "PYTHONPATH": "/invalid", "PYTHONHOME": "/invalid"})
+    check_namespace_failure()
+
+    gate = ["bash", str(destination), "--self-test-gate", "--install-root", str(runtime),
+            "--relaunch-target", str(executable)]
+    executable.touch()
+    executable.chmod(0o755)
+    assert subprocess.check_output(gate, env=env, text=True).strip() == "relaunch"
+    assert subprocess.check_output(gate, env={**env, "TEST_NAMESPACE_RESULT": "1"}, text=True).startswith("manual:")
+    gate[-1] = "/opt/hermes-desktop/Hermes"
+    assert subprocess.check_output(gate, env=env, text=True).startswith("skew:")
+print("PASS: desktop settings, environment, native/fallback namespace sandbox and updater gate")
@@ -0,0 +1,11 @@
+--- a/scripts/desktop-update/posix.sh
+++ b/scripts/desktop-update/posix.sh
+@@ -317,6 +317,8 @@
+   if [ ! -e "$sb" ]; then GATE=relaunch; return; fi
+   if [ -u "$sb" ] && [ "$(stat -c %u "$sb" 2>/dev/null)" = "0" ]; then GATE=relaunch; return; fi
+ 
+  if unshare --user --map-root-user true 2>/dev/null; then GATE=relaunch; return; fi
+
+   case "${ELECTRON_DISABLE_SANDBOX:-}" in 1|true|TRUE|True) GATE=relaunch; return ;; esac
+   [ "$SANDBOX_FALLBACK" -eq 1 ] && { GATE=relaunch; return; }
+   for arg in ${RELAUNCH_ARGS[@]+"${RELAUNCH_ARGS[@]}"}; do
@@ -0,0 +1,21 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "upstream": {
+    "git_tags": "https://github.com/hyprwm/hyprland-guiutils.git",
+    "tag_pattern": "v{pkgver}",
+    "sources": {
+      "any": [
+        "https://github.com/hyprwm/hyprland-guiutils/archive/v{pkgver}/hyprland-guiutils-{pkgver}.tar.gz"
+      ]
+    }
+  },
+  "rebuild_on": [
+    "aquamarine"
+  ],
+  "rebuilt_against": {
+    "aarch64": {
+      "aquamarine": "0.15.0-2"
+    }
+  }
+}
@@ -0,0 +1,40 @@
+# Maintainer: Caleb Maclennan <caleb@alerque.com>
+
+pkgname=hyprland-guiutils
+pkgver=0.2.2
+pkgrel=3
+pkgdesc='Hyprland GUI utilities'
+arch=(aarch64)
+url="https://github.com/hyprwm/$pkgname"
+license=(BSD-3-Clause)
+depends=(
+         libgcc
+         libstdc++
+         glibc # libc.so libm.so
+         hyprlang
+         hyprtoolkit libhyprtoolkit.so
+         hyprutils libhyprutils.so
+         libdrm
+         pixman
+)
+makedepends=(cmake)
+replaces=(hyprland-qtutils)
+_archive="$pkgname-$pkgver"
+source=("$url/archive/v$pkgver/$_archive.tar.gz")
+sha256sums=('16f92a6c5a22ac58e1fc313f6b202c188da45e804e1f21ff57dfd0da5c1a01b7')
+
+build() {
+	cd "$_archive"
+	local cmake_flags=(
+		-D CMAKE_BUILD_TYPE=Release
+		-D CMAKE_INSTALL_PREFIX=/usr
+	)
+	cmake -B build ${cmake_flags[@]}
+	cmake --build build
+}
+
+package() {
+	cd "$_archive"
+	DESTDIR="$pkgdir" cmake --install build
+	install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE
+}
@@ -4,7 +4,7 @@ pkgname="hyprland-preview-share-picker"
 pkgver=0.2.1
 pkgrel=1
 pkgdesc="An alternative share picker for hyprland with window and monitor previews"
-arch=(x86_64)
+arch=(x86_64 aarch64)
 url="https://github.com/WhySoBad/hyprland-preview-share-picker"
 license=(MIT)
 depends=('gtk4' 'gtk4-layer-shell' 'xdg-desktop-portal-hyprland' 'hyprland')
@@ -0,0 +1,21 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "upstream": {
+    "git_tags": "https://github.com/hyprwm/Hyprland.git",
+    "tag_pattern": "v{pkgver}",
+    "sources": {
+      "any": [
+        "https://github.com/hyprwm/Hyprland/releases/download/v{pkgver}/source-v{pkgver}.tar.gz"
+      ]
+    }
+  },
+  "rebuild_on": [
+    "aquamarine"
+  ],
+  "rebuilt_against": {
+    "aarch64": {
+      "aquamarine": "0.15.0-2"
+    }
+  }
+}
@@ -0,0 +1,105 @@
+# Maintainer: Caleb Maclennan <caleb@alerque.com>
+# Contributor: ThatOneCalculator <kainoa@t1c.dev>
+# Contributor: Brenno Lemos <brenno@syndel.is>
+# Contributor: Gabriel Fox <inbox@gabrielfox.dev>
+
+pkgname=(hyprland hyprpm)
+pkgver=0.56.2
+pkgrel=3
+pkgdesc='a highly customizable dynamic tiling Wayland compositor'
+arch=(aarch64)
+url="https://github.com/hyprwm/${pkgname^}"
+license=(BSD-3-Clause)
+depends=(cairo # libcairo.so
+         aquamarine libaquamarine.so
+         libgcc # libgcc_s.so
+         'libstdc++' # libstdc++.so
+         glibc # libc.so libm.so
+         glib2 libgio-2.0.so libgobject-2.0.so
+         glslang # libglslang-default-resource-limits.so libglslang.so
+         hyprcursor libhyprcursor.so
+         hyprgraphics libhyprgraphics.so
+         hyprland-guiutils
+         hyprlang libhyprlang.so
+         hyprutils libhyprutils.so
+         hyprwire libhyprwire.so
+         lcms2 liblcms2.so
+         libdrm # libdrm.so
+         libglvnd libEGL.so libGLESv2.so
+         libinput # libinput.so
+         libx11
+         libxcb # libxcb-dri3.so libxcb-present.so libxcb-render.so libxcb-res.so libxcb-shm.so libxcb.so libxcb-xfixes.so libxcb-xinput.so
+         libxcomposite # libxcb-composite.so
+         libxcursor # libXcursor.so
+         libxfixes
+         libxkbcommon libxkbcommon.so
+         libxrender
+         lua # liblua.so
+         mesa # libgbm.so
+         muparser # libmuparser.so
+         opengl-driver
+         pango libpango-1.0.so libpangocairo-1.0.so
+         pixman libpixman-1.so
+         re2 libre2.so
+         tomlplusplus libtomlplusplus.so
+         util-linux-libs libuuid.so
+         wayland libwayland-server.so
+         wayland-protocols
+         xcb-proto
+         xcb-util
+         xcb-util-errors # libxcb-errors.so
+         xcb-util-image
+         xcb-util-keysyms
+         xcb-util-renderutil # libxcb-render-util.so
+         xcb-util-wm # libxcb-ewmh.so  libxcb-icccm.so
+         xorg-xwayland)
+makedepends=(cmake
+             glaze
+             hyprland-protocols
+             hyprwayland-scanner
+             meson
+             ninja
+             xorgproto)
+optdepends=('hyprpm: build and install plugins'
+            'hyprshutdown: clean logout and shutdown helper'
+            'xdg-desktop-portal-hyprland: xdg-desktop-portal backend for hyprland')
+provides=(wayland-compositor)
+_archive="${pkgname^}-$pkgver"
+source=("$_archive.tar.gz::$url/releases/download/v$pkgver/source-v$pkgver.tar.gz")
+sha256sums=('03ad3f5ef152ff44116ffd56fcf808486211ecabf4f0ba567108ee746ba5cd2e')
+
+prepare() {
+	ln -sf hyprland-source "$_archive"
+	cd "$_archive"
+	sed -i -e '/^release:/{n;s/-D/-DCMAKE_SKIP_RPATH=ON -D/}' Makefile
+	sed -i -e '/find_package.glaze/s/7...<8 //' {.,hyprpm,start}/CMakeLists.txt
+}
+
+build() {
+	cd "$_archive"
+	make release PREFIX=/usr
+}
+
+package_hyprland() {
+	cd "$_archive"
+	make DESTDIR="$pkgdir" install
+	rm -fv "$pkgdir/usr/include/hyprland/src/version.h.in"
+	find $pkgdir -name '*hyprpm*' -delete
+	install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname/" LICENSE
+}
+
+package_hyprpm() {
+	pkgdesc='Plugin manager for Hyprland'
+	depends=(cmake
+	         cpio
+	         glaze
+	         hyprland
+	         hyprland-protocols
+	         hyprwayland-scanner
+	         meson)
+	cd "$_archive"
+	make DESTDIR="$pkgdir" install
+	find $pkgdir -type f,l -not -name '*hyprpm*' -delete
+	find $pkgdir -type d -empty -delete
+	install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname/" LICENSE
+}
@@ -0,0 +1,21 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "upstream": {
+    "git_tags": "https://github.com/hyprwm/hyprtoolkit.git",
+    "tag_pattern": "v{pkgver}",
+    "sources": {
+      "any": [
+        "https://github.com/hyprwm/hyprtoolkit/archive/v{pkgver}/hyprtoolkit-{pkgver}.tar.gz"
+      ]
+    }
+  },
+  "rebuild_on": [
+    "aquamarine"
+  ],
+  "rebuilt_against": {
+    "aarch64": {
+      "aquamarine": "0.15.0-2"
+    }
+  }
+}
@@ -0,0 +1,50 @@
+# Maintainer: Caleb Maclennan <caleb@alerque.com>
+
+pkgname=hyprtoolkit
+pkgver=0.5.4
+pkgrel=5.1
+pkgdesc='A modern C++ Wayland-native GUI toolkit'
+arch=(aarch64)
+url="https://github.com/hyprwm/$pkgname"
+license=(BSD-3-Clause)
+depends=(
+         libgcc
+         libstdc++
+         aquamarine libaquamarine.so
+         cairo libcairo.so
+         glib2 libglib-2.0.so
+         glibc # libc.so libm.so
+         hyprgraphics libhyprgraphics.so
+         hyprlang libhyprlang.so
+         hyprutils libhyprutils.so
+         iniparser libiniparser.so
+         libdrm # libdrm.so
+         libglvnd libEGL.so libOpenGL.so
+         libxkbcommon libxkbcommon.so
+         mesa # libgbm.so
+         pango libpango-1.0.so # libpango.so
+         pixman libpixman-1.so
+         wayland libwayland-client.so
+)
+makedepends=(cmake
+             hyprwayland-scanner)
+provides=(libhyprtoolkit.so)
+_archive="$pkgname-$pkgver"
+source=("$url/archive/v$pkgver/$_archive.tar.gz")
+sha256sums=('2fb59789f231c1c4e9154ceffc1e7524c0cae154807c0d57e6166806255b570f')
+
+build() {
+	cd "$_archive"
+	local cmake_options=(
+		-D CMAKE_BUILD_TYPE=None
+		-D CMAKE_INSTALL_PREFIX=/usr
+	)
+	cmake -B build -W no-dev ${cmake_options[@]}
+	cmake --build build
+}
+
+package() {
+	cd "$_archive"
+	DESTDIR="$pkgdir" cmake --install build
+	install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname/" LICENSE
+}
@@ -1,22 +1,18 @@
 # Maintainer: Mikko Nyman <mikko@nyman.xyz>
 # Based on the Arch libfprint package by Jan Alexander Steffens (heftig).
 #
-# Carried the focaltech_moc driver and the FocalTech FT9349 device ID
-# (USB 2808:a97a, ASUS ExpertBook Ultra B9406CAA) while mainline libfprint
-# releases (1.94.x) lacked them. libfprint 1.94.100 ships both, so Omarchy
-# has moved back to stock libfprint and no longer installs this package.
-#
-# Kept around pinned to the last known good commit as an escape hatch;
-# the fallback patch stays for the conditional in prepare().
+# Omarchy's fingerprint setup installs this in place of stock libfprint, so
+# readers upstream supports ahead of an Arch release reach users by bumping
+# the pin here. Pinned to the commit adding the Synaptics reader USB
+# 06cb:010b, missing from stock libfprint 1.94.100; the FocalTech MOC support
+# carried by the previous pin is retained.

 pkgname=libfprint-git
-pkgver=1.94.10.r12.gd79f157
-pkgrel=1.1
-# The repo already carries an untested 1.94.10.r220.g695663f build that sorts
-# above the pinned pkgver; the epoch makes the pinned build win the version
-# comparison and gives it a fresh filename that can be promoted.
+pkgver=1.94.100.r10.g6f9479c
+pkgrel=1
+# Retain the epoch used to supersede the previously published untested build.
 epoch=1
-pkgdesc="Library for fingerprint readers (libfprint master with FocalTech MOC updates)"
+pkgdesc="Library for fingerprint readers (pinned upstream snapshot with FocalTech and Synaptics 06cb:010b support)"
 url="https://fprint.freedesktop.org/"
 arch=(x86_64)
 license=(LGPL-2.1-or-later)
@@ -47,7 +43,7 @@ provides=(libfprint libfprint-2.so)
 conflicts=(libfprint)
 groups=(fprint)
 source=(
-  "git+https://gitlab.freedesktop.org/libfprint/libfprint.git#commit=d79f157282085738ea8ffbe8c2ae96fb8b3ad831"
+  "git+https://gitlab.freedesktop.org/libfprint/libfprint.git#commit=6f9479c3d55f847c1b3769f28ceb99227f9858cf"
  "focaltech_moc-add-pid-0xA97A.patch"
 )
 b2sums=(
@@ -79,9 +75,6 @@ build() {
  )
  arch-meson libfprint build "${meson_options[@]}"
  meson compile -C build
-  # Regenerate autosuspend.hwdb from the patched id_table[] so the
-  # udev-hwdb test in check() doesn't fail on the new PID 0xA97A.
-  ninja -C build sync-udev-hwdb
 }

 check() {
@@ -0,0 +1,48 @@
+--- a/PKGBUILD
+++ b/PKGBUILD
+@@ -3,6 +3,7 @@
+ pkgname="limine-mkinitcpio-hook"
+ _pkgver=1.38.0
+ _extver=""
+_gradle_version=9.7.1
+ pkgver="${_pkgver}${_extver}"
+ pkgrel=1
+ pkgdesc="Install kernels for the Limine bootloader."
+@@ -10,7 +11,8 @@
+ url="https://gitlab.com/Zesko/limine-entry-tool"
+ source=("${_pkgname}::git+${url}.git#tag=${pkgver}")
+ source_x86_64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_linux-x64_bin.tar.gz")
+-source_aarch64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_linux-aarch64_bin.tar.gz")
+source_aarch64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_linux-aarch64_bin.tar.gz"
+	"https://services.gradle.org/distributions/gradle-${_gradle_version}-bin.zip")
+ license=("GPL3")
+ provides=('limine-entry-tool')
+ options=(!debug !strip)
+@@ -27,12 +29,14 @@
+ 	'sbctl: Signs UEFI boot files for Secure Boot when enabled'
+ 	'journalctl-desktop-notification: Sends desktop notifications when errors occur'
+ )
+-makedepends=('git' 'gradle')
+makedepends=('git')
+makedepends_x86_64=('gradle')
+ backup=(etc/limine-entry-tool.conf)
+ conflicts=('limine-entry-tool')
+ sha256sums=('11dd8211898585f79d8361d97606965bb2ca214dccace5b133dc5121e4bb4d01')
+ sha256sums_x86_64=('3f4a89de8eaa96f2ed677f09957c7e872cd8467aad3537f8b5394c1b8c4b942e')
+-sha256sums_aarch64=('22286f7ecd21b9aedb3226b9bf797469e1bd3eefc491e12ef3dd49b452d230b7')
+sha256sums_aarch64=('22286f7ecd21b9aedb3226b9bf797469e1bd3eefc491e12ef3dd49b452d230b7'
+	'acd53f1edaf02f1a8ff99879f8a34b302661a057d9b063ae9e35b552f804d20a')
+ 
+ prepare() {
+ 	[[ -d "${_graalvm_version}" ]] && rm -rf "${_graalvm_version}"
+@@ -48,7 +52,9 @@
+ 	export GRAALVM_HOME="$srcdir/${_graalvm_version}"
+ 	export JAVA_HOME="${GRAALVM_HOME}"
+ 	export NATIVE_IMAGE_OPTIONS="-march=compatibility --future-defaults=all"
+-	/usr/bin/gradle clean nativeCompile -Dorg.gradle.java.home="${JAVA_HOME}"
+	local gradle=/usr/bin/gradle
+	[[ $CARCH == aarch64 ]] && gradle="$srcdir/gradle-${_gradle_version}/bin/gradle"
+	"$gradle" clean nativeCompile -Dorg.gradle.java.home="${JAVA_HOME}"
+ }
+ 
+ package() {
@@ -3,14 +3,16 @@ _pkgname="limine-entry-tool"
 pkgname="limine-mkinitcpio-hook"
 _pkgver=1.38.0
 _extver=""
+_gradle_version=9.7.1
 pkgver="${_pkgver}${_extver}"
-pkgrel=1
+pkgrel=1.1
 pkgdesc="Install kernels for the Limine bootloader."
 arch=('x86_64' 'aarch64')
 url="https://gitlab.com/Zesko/limine-entry-tool"
 source=("${_pkgname}::git+${url}.git#tag=${pkgver}")
 source_x86_64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_linux-x64_bin.tar.gz")
-source_aarch64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_linux-aarch64_bin.tar.gz")
+source_aarch64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_linux-aarch64_bin.tar.gz"
+	"https://services.gradle.org/distributions/gradle-${_gradle_version}-bin.zip")
 license=("GPL3")
 provides=('limine-entry-tool')
 options=(!debug !strip)
@@ -27,12 +29,14 @@ optdepends=(
 	'sbctl: Signs UEFI boot files for Secure Boot when enabled'
 	'journalctl-desktop-notification: Sends desktop notifications when errors occur'
 )
-makedepends=('git' 'gradle')
+makedepends=('git')
+makedepends_x86_64=('gradle')
 backup=(etc/limine-entry-tool.conf)
 conflicts=('limine-entry-tool')
 sha256sums=('11dd8211898585f79d8361d97606965bb2ca214dccace5b133dc5121e4bb4d01')
 sha256sums_x86_64=('3f4a89de8eaa96f2ed677f09957c7e872cd8467aad3537f8b5394c1b8c4b942e')
-sha256sums_aarch64=('22286f7ecd21b9aedb3226b9bf797469e1bd3eefc491e12ef3dd49b452d230b7')
+sha256sums_aarch64=('22286f7ecd21b9aedb3226b9bf797469e1bd3eefc491e12ef3dd49b452d230b7'
+	'acd53f1edaf02f1a8ff99879f8a34b302661a057d9b063ae9e35b552f804d20a')

 prepare() {
 	[[ -d "${_graalvm_version}" ]] && rm -rf "${_graalvm_version}"
@@ -48,7 +52,9 @@ build() {
 	export GRAALVM_HOME="$srcdir/${_graalvm_version}"
 	export JAVA_HOME="${GRAALVM_HOME}"
 	export NATIVE_IMAGE_OPTIONS="-march=compatibility --future-defaults=all"
-	/usr/bin/gradle clean nativeCompile -Dorg.gradle.java.home="${JAVA_HOME}"
+	local gradle=/usr/bin/gradle
+	[[ $CARCH == aarch64 ]] && gradle="$srcdir/gradle-${_gradle_version}/bin/gradle"
+	"$gradle" clean nativeCompile -Dorg.gradle.java.home="${JAVA_HOME}"
 }

 package() {
@@ -0,0 +1,46 @@
+--- a/PKGBUILD
+++ b/PKGBUILD
+@@ -2,12 +2,14 @@
+ pkgname="limine-snapper-sync"
+ pkgver=1.31.0
+ pkgrel=1
+_gradle_version=9.7.1
+ pkgdesc="Integrates Limine boot entries with Snapper snapshots."
+ arch=('x86_64' 'aarch64')
+ url="https://gitlab.com/Zesko/limine-snapper-sync"
+ source=("${pkgname}::git+${url}.git#tag=${pkgver}")
+ source_x86_64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_linux-x64_bin.tar.gz")
+-source_aarch64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_linux-aarch64_bin.tar.gz")
+source_aarch64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_linux-aarch64_bin.tar.gz"
+	"https://services.gradle.org/distributions/gradle-${_gradle_version}-bin.zip")
+ license=("GPL3")
+ options=(!debug !strip)
+ _graalvm_version=graalvm_ce_jdk25
+@@ -25,12 +27,14 @@
+ 	'b3sum: Fast Blake3 hash function to prevent duplication.'
+ 	'xxhash: Fast hashing utility for deduplication with shorter hashes.'
+ )
+-makedepends=('git' 'gradle')
+makedepends=('git')
+makedepends_x86_64=('gradle')
+ backup=(etc/limine-snapper-sync.conf)
+ conflicts=('limine-snapper-cli' 'limine-snapper-sync-git')
+ sha256sums=('ed236f1bbab966950bf11ba5a7958e97a76e66db7fd647b7737bab4b48c9fc40')
+ sha256sums_x86_64=('e0be791c8fda4d03b6b0a0cb824fef3149736170057b3a515252b44419606af0')
+-sha256sums_aarch64=('b4580d9f223d0a4b3a1757e58b18ff4c1db950e67e105fc5cb741457d2384a71')
+sha256sums_aarch64=('b4580d9f223d0a4b3a1757e58b18ff4c1db950e67e105fc5cb741457d2384a71'
+	'acd53f1edaf02f1a8ff99879f8a34b302661a057d9b063ae9e35b552f804d20a')
+ 
+ prepare() {
+ 	[[ -d "${_graalvm_version}" ]] && rm -rf "${_graalvm_version}"
+@@ -46,7 +50,9 @@
+ 	export GRAALVM_HOME="$srcdir/${_graalvm_version}"
+ 	export JAVA_HOME="${GRAALVM_HOME}"
+ 	export NATIVE_IMAGE_OPTIONS="-march=compatibility"
+-	/usr/bin/gradle clean nativeCompile -Dorg.gradle.java.home="${JAVA_HOME}"
+	local gradle=/usr/bin/gradle
+	[[ $CARCH == aarch64 ]] && gradle="$srcdir/gradle-${_gradle_version}/bin/gradle"
+	"$gradle" clean nativeCompile -Dorg.gradle.java.home="${JAVA_HOME}"
+ }
+ 
+ package() {
@@ -1,13 +1,15 @@
 # Maintainer: Zesko
 pkgname="limine-snapper-sync"
 pkgver=1.31.0
-pkgrel=1
+pkgrel=1.1
+_gradle_version=9.7.1
 pkgdesc="Integrates Limine boot entries with Snapper snapshots."
 arch=('x86_64' 'aarch64')
 url="https://gitlab.com/Zesko/limine-snapper-sync"
 source=("${pkgname}::git+${url}.git#tag=${pkgver}")
 source_x86_64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_linux-x64_bin.tar.gz")
-source_aarch64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_linux-aarch64_bin.tar.gz")
+source_aarch64=("https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_linux-aarch64_bin.tar.gz"
+	"https://services.gradle.org/distributions/gradle-${_gradle_version}-bin.zip")
 license=("GPL3")
 options=(!debug !strip)
 _graalvm_version=graalvm_ce_jdk25
@@ -25,12 +27,14 @@ optdepends=(
 	'b3sum: Fast Blake3 hash function to prevent duplication.'
 	'xxhash: Fast hashing utility for deduplication with shorter hashes.'
 )
-makedepends=('git' 'gradle')
+makedepends=('git')
+makedepends_x86_64=('gradle')
 backup=(etc/limine-snapper-sync.conf)
 conflicts=('limine-snapper-cli' 'limine-snapper-sync-git')
 sha256sums=('ed236f1bbab966950bf11ba5a7958e97a76e66db7fd647b7737bab4b48c9fc40')
 sha256sums_x86_64=('e0be791c8fda4d03b6b0a0cb824fef3149736170057b3a515252b44419606af0')
-sha256sums_aarch64=('b4580d9f223d0a4b3a1757e58b18ff4c1db950e67e105fc5cb741457d2384a71')
+sha256sums_aarch64=('b4580d9f223d0a4b3a1757e58b18ff4c1db950e67e105fc5cb741457d2384a71'
+	'acd53f1edaf02f1a8ff99879f8a34b302661a057d9b063ae9e35b552f804d20a')

 prepare() {
 	[[ -d "${_graalvm_version}" ]] && rm -rf "${_graalvm_version}"
@@ -46,7 +50,9 @@ build() {
 	export GRAALVM_HOME="$srcdir/${_graalvm_version}"
 	export JAVA_HOME="${GRAALVM_HOME}"
 	export NATIVE_IMAGE_OPTIONS="-march=compatibility"
-	/usr/bin/gradle clean nativeCompile -Dorg.gradle.java.home="${JAVA_HOME}"
+	local gradle=/usr/bin/gradle
+	[[ $CARCH == aarch64 ]] && gradle="$srcdir/gradle-${_gradle_version}/bin/gradle"
+	"$gradle" clean nativeCompile -Dorg.gradle.java.home="${JAVA_HOME}"
 }

 package() {
@@ -1,6 +1,6 @@
 # Maintainer: Jake Weaver <jakeweaver at hey dot com>
 pkgname=link-studio
-pkgver=1.0.2
+pkgver=1.0.4
 pkgrel=1
 pkgdesc="Native Linux controller for Insta360 Link webcams"
 arch=('x86_64')
@@ -28,7 +28,7 @@ optdepends=(
  'whisper-cpp: offline meeting transcription'
 )
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/jweaver60/link-studio/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
-sha256sums=('b0fc912d8b7924661b57e427280c9766cbb0f01b7a2b3f3cdb1885969f8cfdc6')
+sha256sums=('f04156d34ecf5e858bd259dca824f970af53ff177185516fafff15766a0880e9')

 build() {
  cd "link_studio-${pkgver}"
@@ -1,6 +1,6 @@
 # Maintainer: Jeff Dickey <releases@mise.jdx.dev>
 pkgname=mise-bin
-pkgver=2026.8.15
+pkgver=2026.9.1
 pkgrel=1
 pkgdesc="dev tools, env vars, task runner"
 arch=('x86_64' 'aarch64')
@@ -14,8 +14,8 @@ provides=('mise')
 conflicts=('mise')
 source_x86_64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-x64.tar.xz")
 source_aarch64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-arm64.tar.xz")
-sha256sums_x86_64=('0ed4ee8bcf229718bead0d0aa83de865803f3fe25cc6c71a41e3a8bd57c40a33')
-sha256sums_aarch64=('d5f9b7e6b36b5cf5aaab0dc4d7e29ee74224281b1a81a228bdc1cd1f3edf9d49')
+sha256sums_x86_64=('bbc21f8fe9b2aa09f74250be15f9bf32e87562e1039d858ad91d7944f057c8e2')
+sha256sums_aarch64=('7d0c28d44bd7e1c5444a7d867146afabe43592c728329bc0ed5ec59ca7106c48')

 package() {
    install -Dm755 "${srcdir}/mise/bin/mise" "${pkgdir}/usr/bin/mise"
@@ -2,7 +2,7 @@
  "source": "local",
  "release_ring": "fast",
  "upstream": {
-    "github": "tsouth89/omakade",
+    "github": "btsouth/omakade",
    "checksums": "SHA256SUMS",
    "assets": {
      "any": "omakade-{pkgver}.tar.gz"
@@ -1,15 +1,17 @@
 pkgname=omakade
-pkgver=1.2.3
+pkgver=1.7.0
 pkgrel=1
 pkgdesc='A beautiful, local-first game library for Omarchy'
-arch=('x86_64')
-url='https://tsouth89.github.io/omakade/'
+arch=('x86_64' 'aarch64')
+url='https://btsouth.github.io/omakade/'
 license=('GPL-3.0-or-later')
-depends=('glib2' 'libsecret' 'qt6-base' 'qt6-declarative' 'qt6-wayland' 'sdl3')
-makedepends=('cmake' 'ninja' 'pkgconf')
+depends=('glib2' 'hicolor-icon-theme' 'libsecret' 'libzip' 'openssl' 'qt6-base' 'qt6-declarative' 'qt6-imageformats' 'qt6-svg' 'qt6-wayland' 'sdl3' 'wayland' 'zstd')
+# wayland-protocols turns the optional idle-inhibit feature on
+# deterministically instead of leaving it to what the chroot happens to carry.
+makedepends=('cmake' 'ninja' 'pkgconf' 'wayland-protocols')
 options=('!debug')
-source=("$pkgname-$pkgver.tar.gz::https://github.com/tsouth89/omakade/releases/download/v$pkgver/$pkgname-$pkgver.tar.gz")
-sha256sums=('dcbb57caf982317ae0fd75a1a97c48b80d2b02f92d65b38030876a172eb25606')
+source=("$pkgname-$pkgver.tar.gz::https://github.com/btsouth/omakade/releases/download/v$pkgver/$pkgname-$pkgver.tar.gz")
+sha256sums=('715cd5e0cb860514276b1af57fe08ced71c1c69a6aeebd93aa51f1ca367eefa8')

 build() {
  cmake -S "$pkgname-$pkgver" -B build -G Ninja \
@@ -5,7 +5,10 @@ pkgrel=1
 _pkgver_base=4.0.0
 _pkgver_base_tag=v3.8.2
 pkgdesc='Beautiful, modern, and opinionated Arch Linux by DHH (quattro branch tip)'
-arch=('any')
+# The payload is architecture-independent, but the dependency set is not: the
+# boot stack differs per architecture (see depends_x86_64 / depends_aarch64),
+# and makepkg only honours arch-suffixed arrays on arch-specific packages.
+arch=('x86_64' 'aarch64')
 url='https://github.com/basecamp/omarchy'
 license=('MIT')
 provides=('omarchy')
@@ -17,18 +20,6 @@ depends=(
  'omarchy-keyring'
  'omarchy-settings-dev'

-  # Bootloader stack. Lives here rather than on omarchy-settings because
-  # omarchy-settings is also installed into the live ISO env (for plymouth
-  # / /etc/skel seeding), where the limine-mkinitcpio-hook would fail with
-  # 'Cannot detect an ESP path' inside the chroot. The omarchy-settings
-  # config drop-ins under /etc/mkinitcpio.conf.d/, /etc/limine-entry-tool.d/,
-  # and /etc/snapper/config-templates/ only do anything when these are
-  # installed alongside.
-  'limine'
-  'limine-mkinitcpio-hook'
-  'limine-snapper-sync'
-  'snapper'
-
  # Wayland / Hyprland core
  'hyprland'
  'quickshell'
@@ -55,6 +46,29 @@ depends=(
  'ttf-jetbrains-mono-nerd-basic'
 )

+# Bootloader stack. Lives here rather than on omarchy-settings because
+# omarchy-settings is also installed into the live ISO env (for plymouth
+# / /etc/skel seeding), where the limine-mkinitcpio-hook would fail with
+# 'Cannot detect an ESP path' inside the chroot. The omarchy-settings
+# config drop-ins under /etc/mkinitcpio.conf.d/, /etc/limine-entry-tool.d/,
+# and /etc/snapper/config-templates/ only do anything when these are
+# installed alongside.
+depends_x86_64=(
+  'limine'
+  'limine-mkinitcpio-hook'
+  'limine-snapper-sync'
+  'snapper'
+)
+
+# Apple Silicon boots through m1n1 + GRUB from the Asahi packages and keeps
+# Arch Linux ARM's kernel and boot layout, so the Limine/Snapper stack does not
+# apply. Wi-Fi on the Broadcom parts only scans reliably through the iwd
+# backend, which install/hardware/network.sh selects on Apple Silicon.
+depends_aarch64=(
+  'iwd'
+  'networkmanager'
+)
+
 makedepends=(
  'git'
 )
@@ -5,7 +5,12 @@ pkgrel=1
 _pkgver_base=4.0.0
 _pkgver_base_tag=v3.8.2
 pkgdesc='Omarchy user defaults, /etc/skel content, fonts, plymouth theme, and support helpers (quattro branch tip)'
-arch=('any')
+# Arch-specific because the shipped /etc tree is not the same on every
+# architecture: the Limine, mkinitcpio, zram and oomd drop-ins belong to the
+# x86_64 boot and memory stack and are left out of the aarch64 package (see
+# package()). makepkg only honours the arch-suffixed arrays below on
+# arch-specific packages.
+arch=('x86_64' 'aarch64')
 url='https://github.com/basecamp/omarchy'
 license=('MIT')
 provides=('omarchy-settings')
@@ -44,15 +49,10 @@ makedepends=(
 # scriptlet WILL clobber user edits on each upgrade (documented limitation).
 backup=(
  'etc/fastfetch/config.jsonc'
-  'etc/mkinitcpio.conf.d/omarchy_hooks.conf'
-  'etc/mkinitcpio.conf.d/thunderbolt_module.conf'
-  'etc/limine-entry-tool.d/omarchy-defaults.conf'
-  'etc/limine-entry-tool.d/omarchy-uki.conf'
  'etc/docker/daemon.json'
  'etc/gnupg/dirmngr.conf'
  'etc/sysctl.d/99-omarchy-sysctl.conf'
  'etc/sysctl.d/90-omarchy-file-watchers.conf'
-  'etc/modprobe.d/omarchy-usb-autosuspend.conf'
  'etc/systemd/logind.conf.d/10-ignore-power-button.conf'
  'etc/systemd/logind.conf.d/20-inhibit-delay.conf'
  'etc/systemd/resolved.conf.d/10-disable-multicast.conf'
@@ -63,18 +63,31 @@ backup=(
  'etc/systemd/system/plocate-updatedb.service.d/ac-only.conf'
  'etc/systemd/system.conf.d/20-omarchy-nofile.conf'
  'etc/systemd/user.conf.d/20-omarchy-nofile.conf'
-  'etc/systemd/oomd.conf.d/10-omarchy.conf'
-  'etc/systemd/zram-generator.conf'
  'etc/sddm.conf.d/10-theme.conf'
  'etc/sddm.conf.d/10-wayland.conf'
  'etc/udev/rules.d/99-omarchy-power-profile.rules'
  'etc/udev/rules.d/99-omarchy-wifi-powersave.rules'
 )
+# backup has no arch-suffixed form, so the x86_64-only drop-ins join it here.
+# Each of these paths is removed from the aarch64 package in package().
+if [[ $CARCH == x86_64 ]]; then
+  backup+=(
+    'etc/mkinitcpio.conf.d/omarchy_hooks.conf'
+    'etc/mkinitcpio.conf.d/thunderbolt_module.conf'
+    'etc/limine-entry-tool.d/omarchy-defaults.conf'
+    'etc/limine-entry-tool.d/omarchy-uki.conf'
+    'etc/modprobe.d/omarchy-usb-autosuspend.conf'
+    'etc/systemd/oomd.conf.d/10-omarchy.conf'
+    'etc/systemd/zram-generator.conf'
+  )
+fi

 optdepends=(
  'omarchy-dev: Full Omarchy desktop (quattro branch tip)'
  'inxi: System information for omarchy-debug'
  'fastfetch: System information for omarchy-upload-log'
+)
+optdepends_x86_64=(
  'limine: Bootloader the shipped /etc/mkinitcpio.conf.d/ and /etc/limine-entry-tool.d/ drop-ins are for'
  'limine-mkinitcpio-hook: Picks up the shipped /etc/mkinitcpio.conf.d/omarchy_hooks.conf'
  'limine-snapper-sync: Boot-entry sync for snapper snapshots'
@@ -147,6 +160,14 @@ package() {
  install -d "$pkgdir/usr/share/omarchy/config"
  cp -a config/. "$pkgdir/usr/share/omarchy/config/"

+  # The Limine/Snapper notifier has nothing to notify about without the x86_64
+  # boot stack; drop it from both seeds so aarch64 users don't autostart a
+  # helper whose backing tool is not installed.
+  if [[ $CARCH == aarch64 ]]; then
+    rm -f "$pkgdir/etc/skel/.config/autostart/limine-snapper-notify.desktop" \
+      "$pkgdir/usr/share/omarchy/config/autostart/limine-snapper-notify.desktop"
+  fi
+
  # Package-owned defaults with real system/XDG locations. User config remains
  # higher priority: ~/.config/uwsm/default, ~/.config/uwsm/env.d,
  # ~/.config/environment.d, ~/.config/fontconfig, ~/.config/xdg-terminals.list,
@@ -174,9 +195,14 @@ package() {
  install -Dm644 default/systemd/user/omarchy-crash-watch.service "$pkgdir/usr/lib/systemd/user/omarchy-crash-watch.service"
  # Marks app.slice (and only app.slice) as a systemd-oomd kill candidate, so
  # memory pressure costs one app scope instead of the compositor session.
-  # Thresholds live in etc/systemd/oomd.conf.d/10-omarchy.conf.
-  install -Dm644 default/systemd/user/app.slice.d/10-oomd.conf "$pkgdir/usr/lib/systemd/user/app.slice.d/10-oomd.conf"
-  install -Dm644 default/systemd/zram-generator.conf.d/90-omarchy.conf "$pkgdir/usr/lib/systemd/zram-generator.conf.d/90-omarchy.conf"
+  # Thresholds live in etc/systemd/oomd.conf.d/10-omarchy.conf. Both this and
+  # the zram vendor drop-in belong to the x86_64 memory stack: the aarch64
+  # install neither enables systemd-oomd nor configures zram swap.
+  if [[ $CARCH == x86_64 ]]; then
+    install -Dm644 default/systemd/user/app.slice.d/10-oomd.conf "$pkgdir/usr/lib/systemd/user/app.slice.d/10-oomd.conf"
+    install -Dm644 default/systemd/zram-generator.conf.d/90-omarchy.conf "$pkgdir/usr/lib/systemd/zram-generator.conf.d/90-omarchy.conf"
+  fi
+  install -Dm644 default/systemd/system/plocate-updatedb.service.d/10-omarchy.conf "$pkgdir/usr/lib/systemd/system/plocate-updatedb.service.d/10-omarchy.conf"

  # Same for applications/** — used by omarchy-refresh-applications,
  # omarchy-install-gaming-*, etc. to copy .desktop files into ~/.local/share.
@@ -190,6 +216,25 @@ package() {
  # stage separately below).
  install -d "$pkgdir/etc"
  cp -a etc/. "$pkgdir/etc/"
+  if [[ $CARCH == aarch64 ]]; then
+    # The x86_64 boot stack's drop-ins must not ship on aarch64: mkinitcpio
+    # reads every file under /etc/mkinitcpio.conf.d/, so omarchy_hooks.conf
+    # would inject the Limine hooks into the Asahi kernel's initramfs, and the
+    # Limine entry-tool config has no consumer without Limine.
+    rm -rf "$pkgdir/etc/limine-entry-tool.d" "$pkgdir/etc/mkinitcpio.conf.d"
+    # Memory stack: no zram device or zswap on the aarch64 install, and
+    # systemd-oomd is not enabled there, so the vm.* reclaim tuning written
+    # for zram would be wrong for it. Keep only the network tuning.
+    rm -rf "$pkgdir/etc/systemd/oomd.conf.d"
+    rm -f "$pkgdir/etc/systemd/zram-generator.conf" "$pkgdir/etc/tmpfiles.d/omarchy-zswap.conf"
+    cat >"$pkgdir/etc/sysctl.d/99-omarchy-sysctl.conf" <<'EOF'
+# Solve common flakiness with SSH (MTU discovery on flaky links).
+net.ipv4.tcp_mtu_probing=1
+EOF
+    # USB autosuspend is left at the kernel default on Apple Silicon.
+    rm -f "$pkgdir/etc/modprobe.d/omarchy-usb-autosuspend.conf"
+    rmdir "$pkgdir/etc/modprobe.d" "$pkgdir/etc/tmpfiles.d" 2>/dev/null || true
+  fi
  # sudoers.d files must be mode 0440 or sudo will refuse them, and the
  # directory must be 0750 to match the Arch sudo package's filesystem
  # convention (otherwise pacman warns about dir-mode drift on every install).
@@ -280,6 +325,10 @@ EOF
  # live root config.
  install -d "$pkgdir/usr/share/omarchy/default"
  cp -a default/. "$pkgdir/usr/share/omarchy/default/"
+  # The Limine template is read by the x86_64 ISO orchestrator only.
+  if [[ $CARCH == aarch64 ]]; then
+    rm -rf "$pkgdir/usr/share/omarchy/default/limine"
+  fi

  # Snapper config template used by the install-time `snapper create-config`.
  install -Dm644 default/snapper/root \
@@ -1,6 +1,31 @@
+_apple_silicon() {
+  [[ $(uname -m) == aarch64 ]] && grep -aq 'apple,' /proc/device-tree/compatible 2>/dev/null
+}
+
 _etc_overrides_apply() {
  echo "Applying Omarchy etc-overrides..."

+  # The hardened CUPS authorization applies on every platform. It waits for the
+  # file the cups package owns: an ISO bootstrap without cups installed is left
+  # alone and picks it up once cups lands.
+  if [[ -f /etc/cups/cups-files.conf && -f /usr/share/omarchy/etc-overrides/cups-cups-files.conf ]]; then
+    systemd-sysusers /etc/sysusers.d/omarchy-cups-browsed.conf
+    install -m 0640 -o root -g cups /usr/share/omarchy/etc-overrides/cups-cups-files.conf /etc/cups/cups-files.conf
+  fi
+
+  # Apple Silicon installs run on Arch Linux ARM's base with the Asahi
+  # packages, and keep that system identity: /etc/os-release stays the
+  # symlink to the distribution's /usr/lib/os-release, and the PAM, NSS,
+  # plymouth and skel overrides below are not applied there.
+  if _apple_silicon; then
+    echo "Preserving Arch Linux ARM system configuration on Apple Silicon..."
+    if [[ -f /usr/lib/os-release ]]; then
+      rm -f /etc/os-release
+      ln -s ../usr/lib/os-release /etc/os-release
+    fi
+    return 0
+  fi
+
  # Ensure parent dirs exist. cups-browsed may not be installed yet during ISO
  # bootstrap; do not create /etc/cups/cups-browsed.conf before the package is
  # installed or pacman will preserve its packaged file as a noisy .pacnew.
@@ -21,10 +46,6 @@ _etc_overrides_apply() {
    install -d /etc/cups
    cp -f /usr/share/omarchy/etc-overrides/cups-cups-browsed.conf /etc/cups/cups-browsed.conf
  fi
-  if [[ -f /etc/cups/cups-files.conf && -f /usr/share/omarchy/etc-overrides/cups-cups-files.conf ]]; then
-    systemd-sysusers /etc/sysusers.d/omarchy-cups-browsed.conf
-    install -m 0640 -o root -g cups /usr/share/omarchy/etc-overrides/cups-cups-files.conf /etc/cups/cups-files.conf
-  fi
  cp -f /usr/share/omarchy/etc-overrides/plymouth-plymouthd.conf /etc/plymouth/plymouthd.conf
  cp -f /usr/share/omarchy/etc-overrides/dot.bashrc              /etc/skel/.bashrc
  chmod 0644 /etc/os-release /etc/security/faillock.conf /etc/nsswitch.conf \
@@ -15,7 +15,12 @@ _commit='346e69e1cec6c4e8924531874af6ba010a1bc99e'
 pkgver=4.0.2
 pkgrel=1
 pkgdesc='Omarchy user defaults, /etc/skel content, fonts, plymouth theme, and support helpers'
-arch=('any')
+# Arch-specific because the shipped /etc tree is not the same on every
+# architecture: the Limine, mkinitcpio, zram and oomd drop-ins belong to the
+# x86_64 boot and memory stack and are left out of the aarch64 package (see
+# package()). makepkg only honours the arch-suffixed arrays below on
+# arch-specific packages.
+arch=('x86_64' 'aarch64')
 url='https://github.com/basecamp/omarchy'
 license=('MIT')
 conflicts=('omarchy-settings-dev')
@@ -53,15 +58,10 @@ makedepends=(
 # scriptlet WILL clobber user edits on each upgrade (documented limitation).
 backup=(
  'etc/fastfetch/config.jsonc'
-  'etc/mkinitcpio.conf.d/omarchy_hooks.conf'
-  'etc/mkinitcpio.conf.d/thunderbolt_module.conf'
-  'etc/limine-entry-tool.d/omarchy-defaults.conf'
-  'etc/limine-entry-tool.d/omarchy-uki.conf'
  'etc/docker/daemon.json'
  'etc/gnupg/dirmngr.conf'
  'etc/sysctl.d/99-omarchy-sysctl.conf'
  'etc/sysctl.d/90-omarchy-file-watchers.conf'
-  'etc/modprobe.d/omarchy-usb-autosuspend.conf'
  'etc/systemd/logind.conf.d/10-ignore-power-button.conf'
  'etc/systemd/logind.conf.d/20-inhibit-delay.conf'
  'etc/systemd/resolved.conf.d/10-disable-multicast.conf'
@@ -72,18 +72,31 @@ backup=(
  'etc/systemd/system/plocate-updatedb.service.d/ac-only.conf'
  'etc/systemd/system.conf.d/20-omarchy-nofile.conf'
  'etc/systemd/user.conf.d/20-omarchy-nofile.conf'
-  'etc/systemd/oomd.conf.d/10-omarchy.conf'
-  'etc/systemd/zram-generator.conf'
  'etc/sddm.conf.d/10-theme.conf'
  'etc/sddm.conf.d/10-wayland.conf'
  'etc/udev/rules.d/99-omarchy-power-profile.rules'
  'etc/udev/rules.d/99-omarchy-wifi-powersave.rules'
 )
+# backup has no arch-suffixed form, so the x86_64-only drop-ins join it here.
+# Each of these paths is removed from the aarch64 package in package().
+if [[ $CARCH == x86_64 ]]; then
+  backup+=(
+    'etc/mkinitcpio.conf.d/omarchy_hooks.conf'
+    'etc/mkinitcpio.conf.d/thunderbolt_module.conf'
+    'etc/limine-entry-tool.d/omarchy-defaults.conf'
+    'etc/limine-entry-tool.d/omarchy-uki.conf'
+    'etc/modprobe.d/omarchy-usb-autosuspend.conf'
+    'etc/systemd/oomd.conf.d/10-omarchy.conf'
+    'etc/systemd/zram-generator.conf'
+  )
+fi

 optdepends=(
  'omarchy: Full Omarchy desktop'
  'inxi: System information for omarchy-debug'
  'fastfetch: System information for omarchy-upload-log'
+)
+optdepends_x86_64=(
  'limine: Bootloader the shipped /etc/mkinitcpio.conf.d/ and /etc/limine-entry-tool.d/ drop-ins are for'
  'limine-mkinitcpio-hook: Picks up the shipped /etc/mkinitcpio.conf.d/omarchy_hooks.conf'
  'limine-snapper-sync: Boot-entry sync for snapper snapshots'
@@ -142,6 +155,14 @@ package() {
  install -d "$pkgdir/usr/share/omarchy/config"
  cp -a config/. "$pkgdir/usr/share/omarchy/config/"

+  # The Limine/Snapper notifier has nothing to notify about without the x86_64
+  # boot stack; drop it from both seeds so aarch64 users don't autostart a
+  # helper whose backing tool is not installed.
+  if [[ $CARCH == aarch64 ]]; then
+    rm -f "$pkgdir/etc/skel/.config/autostart/limine-snapper-notify.desktop" \
+      "$pkgdir/usr/share/omarchy/config/autostart/limine-snapper-notify.desktop"
+  fi
+
  # Package-owned defaults with real system/XDG locations. User config remains
  # higher priority: ~/.config/uwsm/default, ~/.config/uwsm/env.d,
  # ~/.config/environment.d, ~/.config/fontconfig, ~/.config/xdg-terminals.list,
@@ -169,9 +190,17 @@ package() {
  install -Dm644 default/systemd/user/omarchy-crash-watch.service "$pkgdir/usr/lib/systemd/user/omarchy-crash-watch.service"
  # Marks app.slice (and only app.slice) as a systemd-oomd kill candidate, so
  # memory pressure costs one app scope instead of the compositor session.
-  # Thresholds live in etc/systemd/oomd.conf.d/10-omarchy.conf.
-  install -Dm644 default/systemd/user/app.slice.d/10-oomd.conf "$pkgdir/usr/lib/systemd/user/app.slice.d/10-oomd.conf"
-  install -Dm644 default/systemd/zram-generator.conf.d/90-omarchy.conf "$pkgdir/usr/lib/systemd/zram-generator.conf.d/90-omarchy.conf"
+  # Thresholds live in etc/systemd/oomd.conf.d/10-omarchy.conf. Both this and
+  # the zram vendor drop-in belong to the x86_64 memory stack: the aarch64
+  # install neither enables systemd-oomd nor configures zram swap.
+  if [[ $CARCH == x86_64 ]]; then
+    install -Dm644 default/systemd/user/app.slice.d/10-oomd.conf "$pkgdir/usr/lib/systemd/user/app.slice.d/10-oomd.conf"
+    install -Dm644 default/systemd/zram-generator.conf.d/90-omarchy.conf "$pkgdir/usr/lib/systemd/zram-generator.conf.d/90-omarchy.conf"
+  fi
+  # Older release pins still configure locate through install/config/locate.sh.
+  if [[ -f default/systemd/system/plocate-updatedb.service.d/10-omarchy.conf ]]; then
+    install -Dm644 default/systemd/system/plocate-updatedb.service.d/10-omarchy.conf "$pkgdir/usr/lib/systemd/system/plocate-updatedb.service.d/10-omarchy.conf"
+  fi

  # Same for applications/** — used by omarchy-refresh-applications,
  # omarchy-install-gaming-*, etc. to copy .desktop files into ~/.local/share.
@@ -185,6 +214,25 @@ package() {
  # stage separately below).
  install -d "$pkgdir/etc"
  cp -a etc/. "$pkgdir/etc/"
+  if [[ $CARCH == aarch64 ]]; then
+    # The x86_64 boot stack's drop-ins must not ship on aarch64: mkinitcpio
+    # reads every file under /etc/mkinitcpio.conf.d/, so omarchy_hooks.conf
+    # would inject the Limine hooks into the Asahi kernel's initramfs, and the
+    # Limine entry-tool config has no consumer without Limine.
+    rm -rf "$pkgdir/etc/limine-entry-tool.d" "$pkgdir/etc/mkinitcpio.conf.d"
+    # Memory stack: no zram device or zswap on the aarch64 install, and
+    # systemd-oomd is not enabled there, so the vm.* reclaim tuning written
+    # for zram would be wrong for it. Keep only the network tuning.
+    rm -rf "$pkgdir/etc/systemd/oomd.conf.d"
+    rm -f "$pkgdir/etc/systemd/zram-generator.conf" "$pkgdir/etc/tmpfiles.d/omarchy-zswap.conf"
+    cat >"$pkgdir/etc/sysctl.d/99-omarchy-sysctl.conf" <<'EOF'
+# Solve common flakiness with SSH (MTU discovery on flaky links).
+net.ipv4.tcp_mtu_probing=1
+EOF
+    # USB autosuspend is left at the kernel default on Apple Silicon.
+    rm -f "$pkgdir/etc/modprobe.d/omarchy-usb-autosuspend.conf"
+    rmdir "$pkgdir/etc/modprobe.d" "$pkgdir/etc/tmpfiles.d" 2>/dev/null || true
+  fi
  # sudoers.d files must be mode 0440 or sudo will refuse them, and the
  # directory must be 0750 to match the Arch sudo package's filesystem
  # convention (otherwise pacman warns about dir-mode drift on every install).
@@ -275,6 +323,10 @@ EOF
  # live root config.
  install -d "$pkgdir/usr/share/omarchy/default"
  cp -a default/. "$pkgdir/usr/share/omarchy/default/"
+  # The Limine template is read by the x86_64 ISO orchestrator only.
+  if [[ $CARCH == aarch64 ]]; then
+    rm -rf "$pkgdir/usr/share/omarchy/default/limine"
+  fi

  # Snapper config template used by the install-time `snapper create-config`.
  install -Dm644 default/snapper/root \
@@ -1,6 +1,31 @@
+_apple_silicon() {
+  [[ $(uname -m) == aarch64 ]] && grep -aq 'apple,' /proc/device-tree/compatible 2>/dev/null
+}
+
 _etc_overrides_apply() {
  echo "Applying Omarchy etc-overrides..."

+  # The hardened CUPS authorization applies on every platform. It waits for the
+  # file the cups package owns: an ISO bootstrap without cups installed is left
+  # alone and picks it up once cups lands.
+  if [[ -f /etc/cups/cups-files.conf && -f /usr/share/omarchy/etc-overrides/cups-cups-files.conf ]]; then
+    systemd-sysusers /etc/sysusers.d/omarchy-cups-browsed.conf
+    install -m 0640 -o root -g cups /usr/share/omarchy/etc-overrides/cups-cups-files.conf /etc/cups/cups-files.conf
+  fi
+
+  # Apple Silicon installs run on Arch Linux ARM's base with the Asahi
+  # packages, and keep that system identity: /etc/os-release stays the
+  # symlink to the distribution's /usr/lib/os-release, and the PAM, NSS,
+  # plymouth and skel overrides below are not applied there.
+  if _apple_silicon; then
+    echo "Preserving Arch Linux ARM system configuration on Apple Silicon..."
+    if [[ -f /usr/lib/os-release ]]; then
+      rm -f /etc/os-release
+      ln -s ../usr/lib/os-release /etc/os-release
+    fi
+    return 0
+  fi
+
  # Ensure parent dirs exist. cups-browsed may not be installed yet during ISO
  # bootstrap; do not create /etc/cups/cups-browsed.conf before the package is
  # installed or pacman will preserve its packaged file as a noisy .pacnew.
@@ -21,10 +46,6 @@ _etc_overrides_apply() {
    install -d /etc/cups
    cp -f /usr/share/omarchy/etc-overrides/cups-cups-browsed.conf /etc/cups/cups-browsed.conf
  fi
-  if [[ -f /etc/cups/cups-files.conf && -f /usr/share/omarchy/etc-overrides/cups-cups-files.conf ]]; then
-    systemd-sysusers /etc/sysusers.d/omarchy-cups-browsed.conf
-    install -m 0640 -o root -g cups /usr/share/omarchy/etc-overrides/cups-cups-files.conf /etc/cups/cups-files.conf
-  fi
  cp -f /usr/share/omarchy/etc-overrides/plymouth-plymouthd.conf /etc/plymouth/plymouthd.conf
  cp -f /usr/share/omarchy/etc-overrides/dot.bashrc              /etc/skel/.bashrc
  chmod 0644 /etc/os-release /etc/security/faillock.conf /etc/nsswitch.conf \
@@ -15,7 +15,10 @@ _commit='346e69e1cec6c4e8924531874af6ba010a1bc99e'
 pkgver=4.0.2
 pkgrel=1
 pkgdesc='Beautiful, modern, and opinionated Arch Linux by DHH'
-arch=('any')
+# The payload is architecture-independent, but the dependency set is not: the
+# boot stack differs per architecture (see depends_x86_64 / depends_aarch64),
+# and makepkg only honours arch-suffixed arrays on arch-specific packages.
+arch=('x86_64' 'aarch64')
 url='https://github.com/basecamp/omarchy'
 license=('MIT')
 conflicts=('omarchy-dev')
@@ -31,18 +34,6 @@ depends=(
  # from the same _commit, and forces the pair to upgrade together.
  "omarchy-settings=${pkgver}"

-  # Bootloader stack. Lives here rather than on omarchy-settings because
-  # omarchy-settings is also installed into the live ISO env (for plymouth
-  # / /etc/skel seeding), where the limine-mkinitcpio-hook would fail with
-  # 'Cannot detect an ESP path' inside the chroot. The omarchy-settings
-  # config drop-ins under /etc/mkinitcpio.conf.d/, /etc/limine-entry-tool.d/,
-  # and /etc/snapper/config-templates/ only do anything when these are
-  # installed alongside.
-  'limine'
-  'limine-mkinitcpio-hook'
-  'limine-snapper-sync'
-  'snapper'
-
  # Wayland / Hyprland core
  'hyprland'
  'quickshell'
@@ -69,6 +60,29 @@ depends=(
  'ttf-jetbrains-mono-nerd-basic'
 )

+# Bootloader stack. Lives here rather than on omarchy-settings because
+# omarchy-settings is also installed into the live ISO env (for plymouth
+# / /etc/skel seeding), where the limine-mkinitcpio-hook would fail with
+# 'Cannot detect an ESP path' inside the chroot. The omarchy-settings
+# config drop-ins under /etc/mkinitcpio.conf.d/, /etc/limine-entry-tool.d/,
+# and /etc/snapper/config-templates/ only do anything when these are
+# installed alongside.
+depends_x86_64=(
+  'limine'
+  'limine-mkinitcpio-hook'
+  'limine-snapper-sync'
+  'snapper'
+)
+
+# Apple Silicon boots through m1n1 + GRUB from the Asahi packages and keeps
+# Arch Linux ARM's kernel and boot layout, so the Limine/Snapper stack does not
+# apply. Wi-Fi on the Broadcom parts only scans reliably through the iwd
+# backend, which install/hardware/network.sh selects on Apple Silicon.
+depends_aarch64=(
+  'iwd'
+  'networkmanager'
+)
+
 makedepends=(
  'git'
 )
@@ -0,0 +1,6 @@
+{
+  "source": "local",
+  "rebuild_on": [
+    "hyprland"
+  ]
+}
@@ -0,0 +1,61 @@
+# Maintainer: Ryan <ryan@heyoodle.com>
+
+pkgname=omareel
+pkgver=0.1.0
+pkgrel=1
+pkgdesc='Screen recorder and editor for Omarchy with a synthetic cursor, auto zooms, and a camera bubble'
+arch=('x86_64' 'aarch64')
+url='https://github.com/omacom/omareel'
+license=('MIT')
+install='omareel.install'
+options=('!debug')
+depends=(
+  'ffmpeg'
+  'gpu-screen-recorder'
+  'hicolor-icon-theme'
+  'hyprland'
+  'layer-shell-qt'
+  'libevdev'
+  'libjpeg-turbo'
+  'qt6-base'
+  'qt6-declarative'
+  'qt6-multimedia'
+  'qt6-svg'
+  'slurp'
+  'xdg-desktop-portal'
+)
+makedepends=(
+  'cmake'
+  'ninja'
+  'pkgconf'
+  'qt6-shadertools'
+  'wayland'
+)
+optdepends=('gifsicle: optimize exported GIF files')
+conflicts=('omarecord')
+source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
+sha256sums=('330d8e2805135af33bf35378e2e961094fc375075d38120c8270bd42fe04ce5b')
+
+build() {
+  cd "$srcdir/$pkgname-$pkgver"
+  ./bin/build
+}
+
+package() {
+  cd "$srcdir/$pkgname-$pkgver"
+  install -Dm755 build/omareel "$pkgdir/usr/bin/omareel"
+  ln -s omareel "$pkgdir/usr/bin/omarecord"
+  # The capture-exclusion plugin is bound to the Hyprland commit it was built
+  # against; rebuild_on hyprland keeps this package in step with the compositor.
+  install -Dm755 build/plugin/omareel-capture-exclude.so "$pkgdir/usr/lib/omareel/omareel-capture-exclude.so"
+  install -Dm644 build/plugin/omareel-capture-exclude.so.hash "$pkgdir/usr/lib/omareel/omareel-capture-exclude.so.hash"
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 LICENSES/lucide.txt "$pkgdir/usr/share/licenses/$pkgname/lucide.txt"
+  install -Dm644 pkg/omareel.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/omareel.svg"
+  local size
+  for size in 16 32 48 64 128 256 512; do
+    install -Dm644 "pkg/icons/omareel-$size.png" \
+      "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/omareel.png"
+  done
+  install -Dm644 pkg/omareel.desktop "$pkgdir/usr/share/applications/omareel.desktop"
+}
@@ -0,0 +1,13 @@
+post_install() {
+  command -v update-desktop-database >/dev/null 2>&1 && update-desktop-database -q
+  command -v gtk-update-icon-cache >/dev/null 2>&1 && gtk-update-icon-cache -q -t -f usr/share/icons/hicolor
+  return 0
+}
+
+post_upgrade() {
+  post_install
+}
+
+post_remove() {
+  post_install
+}
@@ -4,7 +4,7 @@ pkgname=omasnap
 pkgver=1.20.1
 pkgrel=1
 pkgdesc="Native Wayland screenshot and annotation overlay for Hyprland"
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://github.com/tobi/omasnap"
 license=('MIT' 'OFL-1.1')
 depends=(
@@ -1,4 +1,4 @@
 {
  "source": "aur",
-  "upstream_commit": "e2a85e53e2a73cec9170a5fa631805f62b98bb36"
+  "upstream_commit": "cbc25a60a791ccda07ed5e8300e8acb267d23007"
 }
@@ -1,5 +1,5 @@
 pkgname=omazed
-pkgver=2.1.1
+pkgver=2.1.2
 pkgrel=1
 pkgdesc="Live theme switching for Zed in Omarchy - automatically synchronize your Zed editor theme with your Omarchy system theme"
 arch=('any')
@@ -10,7 +10,7 @@ makedepends=('git')
 backup=()
 install=omazed.install
 source=("$pkgname-$pkgver.tar.gz::https://github.com/aps6/$pkgname/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('083757c5385179f241ac0c6e9dde05ba0c7f465c1fed617779d1ebe2a6dfe036')
+sha256sums=('ca0708c86969547b14958a307ae3df89f63d92ffa68af3b5c6bf79c036b8cab9')

 package() {
    cd "$srcdir/$pkgname-$pkgver"
@@ -17,11 +17,6 @@ post_upgrade() {
    echo ""
    echo "==> Omazed updated to $(pacman -Q omazed | cut -d' ' -f2)"
    echo ""
-    echo "   Complete the update!"
-    echo ""
-    echo "   To complete this update, run:"
-    echo ""
-    echo "   omazed setup"
    echo ""
 }

@@ -1,5 +1,5 @@
 {
  "source": "aur",
  "release_ring": "fast",
-  "upstream_commit": "7298bbbde771f2f33d0942fc429bd27643a9986a"
+  "upstream_commit": "134a0e93624d39306f94dc4384dbd102b8d37bb2"
 }
@@ -2,7 +2,7 @@
 # shellcheck disable=SC2034
 # Maintainer:  Chmouel Boudjnah <chmouel@chmouel.com>
 pkgname=openai-codex-bin
-pkgver=0.152.0
+pkgver=0.153.4
 pkgrel=1
 pkgdesc="Arch Linux package for OpenAI's Codex CLI - Auto Updated"
 arch=('x86_64' 'aarch64')
@@ -21,10 +21,10 @@ source_x86_64=(
  "codex-${pkgver}-x86_64.tar.gz::https://github.com/openai/codex/releases/download/rust-v${pkgver}/codex-x86_64-unknown-linux-musl.tar.gz"
  "codex-code-mode-host-${pkgver}-x86_64.tar.gz::https://github.com/openai/codex/releases/download/rust-v${pkgver}/codex-code-mode-host-x86_64-unknown-linux-musl.tar.gz"
 )
-sha256sums_x86_64=('05f942d3d3c5b5acd9edad56ce2797b6fe72dbb1462b24e5c9bf7dcec9a28a11'
-                   '449cefe35b9f347e3fdbf121e816339b37825eb0bfee7de8298a0a61b6687cba')
-sha256sums_aarch64=('37da6b486503c8a42cc4604d2a3d80d388df896dd251e9225f4f3d49b08c2e8c'
-                    '134183c7f5bb2245ed4bb15cfcf00d1a64950adbdd089d33c003c8bcf13267e9')
+sha256sums_x86_64=('f479424eca092484dc40d87ae28c44f4cc40234a60045d6131e493800d814a30'
+                   'f95830a869590957664bbfc67bccb08773806b693670baf15908176f89b4cd31')
+sha256sums_aarch64=('5cda6182bd94c3a30f2eb63a495489ebf7f691fddb14d70f48c6c1a5071b6cde'
+                    'd8047b8d33370d6090e729d27eb76de60a2686baa1c143c138c9b05dc70d813b')

 source_aarch64=(
  "codex-${pkgver}-aarch64.tar.gz::https://github.com/openai/codex/releases/download/rust-v${pkgver}/codex-aarch64-unknown-linux-musl.tar.gz"
@@ -5,7 +5,7 @@
 # the version and checksums below from that repository's package index.

 pkgname=openai-codex-desktop
-pkgver=26.825.51511
+pkgver=26.901.51231
 pkgrel=1
 pkgdesc="Official ChatGPT desktop app with Codex"
 arch=('x86_64' 'aarch64')
@@ -71,8 +71,8 @@ source_x86_64=("${_deb_x86_64}::${_pool}/${_deb_x86_64}")
 source_aarch64=("${_deb_aarch64}::${_pool}/${_deb_aarch64}")
 noextract=("${_deb_x86_64}" "${_deb_aarch64}")
 sha256sums=('b3a4503b5931f102444bc7015c3cf4e40266cf034e0d682bd2a407dc5b3ee58c')
-sha256sums_x86_64=('3554b0022c6cfb513326f43fd11f718835a77086ac4d7ca2ff3ebbba2d4c7f45')
-sha256sums_aarch64=('125e36522d43c75bd7958477846ba6b1cddf2eb19cefcb57dda80be1742f917f')
+sha256sums_x86_64=('62580188d87c3d3a9369dab7c73b42a8a32518d4df8a2d5bae6466ddeac5c05e')
+sha256sums_aarch64=('02a2f5c6cb69509c62abcbdd13c76b139cdb2ca9edde7537239ddde024077ea0')

 package() {
  cd "${srcdir}"
@@ -0,0 +1,11 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "min_release_age": "24h",
+  "upstream": {
+    "npm": "openclaw",
+    "sources": {
+      "any": ["{npm_tarball}"]
+    }
+  }
+}
@@ -0,0 +1,72 @@
+# Based on the AUR openclaw package:
+# Maintainer: Ralph Torres <mail at ralphptorr dot es>
+# Contributor: Evert Vorster <evorster@gmail.com>
+# Contributor: Emir-Eins <emir-eins@outlook.com>
+# Contributor: Wuxxin <wuxxin@gmail.com>
+# Followed here straight from the npm registry (see .omarchy/package.json), since
+# upstream's release cadence outruns the AUR.
+
+pkgname=openclaw
+pkgver=2026.9.2
+pkgrel=1
+pkgdesc='Multi-channel AI gateway with extensible messaging integrations'
+arch=(x86_64 aarch64)
+url=https://github.com/openclaw/openclaw
+license=(MIT)
+
+depends=('nodejs>=22')
+makedepends=(npm)
+optdepends=(
+    '1password-cli: 1password skill'
+    'curl: weather, openai-whisper-api skills'
+    'ffmpeg: video-frames skill'
+    'github-cli: github, gh-issues skills'
+    'jq: session-logs, trello skills'
+    'python-openai-whisper: openai-whisper skill'
+    'ripgrep: session-logs skill'
+    'tmux: tmux skill'
+    'uv: nano-pdf skill'
+    'go: for installing skill tools not packaged for Arch'
+)
+source=($pkgname-$pkgver.tgz::https://registry.npmjs.org/$pkgname/-/$pkgname-$pkgver.tgz)
+sha256sums=('3431f4cd2d8dbd6b936def2694ac27e19fa0256295cf4ada0f652ecf1c9ee520')
+options=(!debug !strip)
+install=$pkgname.install
+noextract=($pkgname-$pkgver.tgz)
+
+package() {
+    export SHARP_IGNORE_GLOBAL_LIBVIPS=1
+    # npm 12 blocks install-time lifecycle scripts unless the package is
+    # allow-listed, and for a local tarball the allow-list key is the tarball's
+    # own file: spec, not the package name (arborist matches node.resolved).
+    # Upstream's postinstall prunes stale dist files and clears the
+    # .openclaw-lifecycle-pending marker the tarball ships with; without it,
+    # every openclaw invocation tries to finish that lifecycle itself and dies
+    # with EACCES on the root-owned install.
+    # That postinstall also migrates legacy state under whatever home it sees
+    # (pruning plugin-runtime-deps in ~/.openclaw and friends), so it gets a
+    # scratch home: a maintainer's own OpenClaw is not the build's to touch.
+    mkdir -p "$srcdir"/home
+    env -u OPENCLAW_HOME -u OPENCLAW_STATE_DIR -u OPENCLAW_CONFIG_PATH HOME="$srcdir"/home \
+        npm install --silent --global --cache "$srcdir"/npm-cache \
+        --allow-scripts="file:$srcdir/$pkgname-$pkgver.tgz" \
+        --prefix "$pkgdir"/usr "$srcdir"/$pkgname-$pkgver.tgz
+    if [[ -e "$pkgdir"/usr/lib/node_modules/$pkgname/.openclaw-lifecycle-pending ]]; then
+        error "openclaw's postinstall did not run; the package would fail on first use"
+        return 1
+    fi
+
+    cat > $pkgname <<'EOF'
+#!/bin/sh
+export SHARP_IGNORE_GLOBAL_LIBVIPS=1
+exec node /usr/lib/node_modules/openclaw/openclaw.mjs "$@"
+EOF
+    install -Dm755 -t "$pkgdir"/usr/bin $pkgname
+
+    cd "$pkgdir"/usr/lib/node_modules/$pkgname
+    install -Dm644 -t "$pkgdir"/usr/share/licenses/$pkgname LICENSE
+    install -Dm644 -t "$pkgdir"/usr/share/doc/$pkgname README.md CHANGELOG.md
+    for f in docs/*
+    do ln -s /usr/lib/node_modules/$pkgname/"$f" "$pkgdir"/usr/share/doc/$pkgname/
+    done
+}
@@ -0,0 +1,17 @@
+post_install() {
+    printf "%s\n" \
+        "==> Install gateway service: openclaw gateway install --force" \
+        "==> Perform onboarding once: openclaw onboard"
+}
+
+post_upgrade() {
+    # The gateway runs as a systemd user unit (openclaw-gateway.service in
+    # ~/.config/systemd/user), which a root pacman hook has no session bus
+    # to reach, so it cannot be restarted from here and keeps running the
+    # old code until the user restarts it.
+    printf "%s\n" \
+        "==> Restart the gateway to apply updates:" \
+        "    openclaw gateway restart" \
+        "==> Run doctor to migrate configs, check gateway health, etc.:" \
+        "    openclaw doctor"
+}
@@ -0,0 +1,82 @@
+#!/bin/bash
+# Perplexity ships its desktop app from its own Debian repository. The
+# per-architecture package index carries the filename and SHA256 of every deb,
+# so an update costs two small HTTP requests instead of a 175 MB download. The
+# index's Version field drops the build number the pool filename carries, and
+# upstream rebuilds under the same marketing version, so the version of record
+# here is the full string embedded in the filename.
+set -euo pipefail
+
+BASE_URL="https://packages.perplexity.ai/deb"
+declare -A DEB_ARCHES=([x86_64]=amd64 [aarch64]=arm64)
+
+# Print "<version> <sha256>" for the newest stanza in a Packages index, version
+# meaning the full string from the pool filename. Newest is vercmp's opinion,
+# which is the one bin/sync-upstream and pacman both use; sort -V disagrees
+# with it over versions like 1.0a.
+newest_release() {
+  local index="$1"
+  local debarch="$2"
+  local filename sha256 version best_version="" best_sha256=""
+  local prefix="pool/main/p/perplexity/perplexity_"
+  local suffix="_${debarch}.deb"
+
+  while read -r filename sha256; do
+    # The PKGBUILD reconstructs the pool URL from pkgver alone, so a stanza
+    # naming anything else -- a rename, or a new pool layout -- has to stop
+    # the sync rather than pin a checksum to a URL nobody will fetch.
+    if [[ "$filename" != "${prefix}"*"${suffix}" ]]; then
+      echo "Unexpected pool filename in the upstream index: $filename" >&2
+      return 1
+    fi
+    version="${filename#"$prefix"}"
+    version="${version%"$suffix"}"
+
+    if [[ -z "$best_version" ]] || [[ "$(vercmp "$version" "$best_version")" -gt 0 ]]; then
+      best_version="$version"
+      best_sha256="$sha256"
+    fi
+  done < <(awk '
+    { sub(/\r$/, "") }
+    /^Filename:/ { filename = $2 }
+    /^SHA256:/   { sha256 = $2 }
+    /^$/         { if (filename && sha256) print filename, sha256; filename = sha256 = "" }
+    END          { if (filename && sha256) print filename, sha256 }
+  ' <<<"$index")
+
+  [[ -n "$best_version" ]] || return 1
+  echo "$best_version $best_sha256"
+}
+
+versions=()
+declare -A checksums=()
+
+for arch in "${!DEB_ARCHES[@]}"; do
+  index=$(curl -fsSL "$BASE_URL/dists/stable/main/binary-${DEB_ARCHES[$arch]}/Packages")
+
+  read -r version sha256 <<<"$(newest_release "$index" "${DEB_ARCHES[$arch]}")"
+  if [[ -z "${version:-}" || -z "${sha256:-}" ]]; then
+    echo "No usable release found for $arch in the upstream package index" >&2
+    exit 1
+  fi
+
+  versions+=("$version")
+  checksums[$arch]="$sha256"
+done
+
+# A release lands one architecture at a time, and a single pkgver has to cover
+# both -- including the build number, since that is what the download URLs are
+# built from. Report no update until they agree; the next run picks it up.
+for version in "${versions[@]}"; do
+  if [[ "$version" != "${versions[0]}" ]]; then
+    echo "Upstream architectures are mid-release (${versions[*]}); skipping" >&2
+    echo '{}'
+    exit 0
+  fi
+done
+
+jq -n \
+  --arg pkgver "${versions[0]}" \
+  --arg x86_64 "${checksums[x86_64]}" \
+  --arg aarch64 "${checksums[aarch64]}" \
+  '{pkgver: $pkgver, sha256sums: {x86_64: [$x86_64], aarch64: [$aarch64]}}'
@@ -0,0 +1,139 @@
+# Maintainer: Spencer Bull <spencer@omarchy.org>
+
+# Omarchy tracks Perplexity's own Debian repository, the feed the app updates
+# itself from. .omarchy/upstream.sh rewrites the version and checksums below
+# from that repository's package index.
+
+pkgname=perplexity
+pkgver=26.9.1+build61614
+pkgrel=2
+pkgdesc="Official Perplexity desktop app"
+arch=('x86_64' 'aarch64')
+url="https://www.perplexity.ai"
+# Upstream ships no license text with the app; its terms live at
+# https://www.perplexity.ai/hub/legal/terms-of-service
+license=('custom')
+
+depends=(
+  'alsa-lib'
+  'at-spi2-core'
+  'bash'
+  'bubblewrap'
+  'cairo'
+  'dbus'
+  'expat'
+  'gcc-libs'
+  'gdk-pixbuf2'
+  'glib2'
+  'glibc'
+  'gtk3'
+  'hicolor-icon-theme'
+  'libcups'
+  'libdrm'
+  'libglvnd'
+  'libnotify'
+  'libsecret'
+  'libx11'
+  'libxcb'
+  'libxcomposite'
+  'libxdamage'
+  'libxext'
+  'libxfixes'
+  'libxkbcommon'
+  'libxrandr'
+  'libxss'
+  'libxtst'
+  'mesa'
+  'nspr'
+  'nss'
+  'pango'
+  'systemd-libs'
+  'util-linux-libs'
+  'vulkan-icd-loader'
+  'xdg-utils'
+)
+
+optdepends=(
+  'apparmor: confine the app with the bundled user-namespace profile'
+  'libappindicator-gtk3: tray icon support'
+  'docker: containerized local GPU runtime for on-device models'
+  'nvidia-container-toolkit: containerized local GPU runtime for on-device models'
+)
+
+makedepends=('libarchive')
+options=('!debug' '!strip')
+
+# Omarchy: the build image compresses with zstd at its default level. Maximum
+# zstd buys roughly a third off this ~600 MB Electron tree for a few extra
+# minutes of build time -- worth it for a package this large on the fast ring,
+# same reasoning as openai-codex-desktop.
+COMPRESSZST=(zstd -c -z -q --ultra -22 --threads=0 -)
+
+# The pool filename carries a build number the index's Version field drops, and
+# upstream rebuilds under the same marketing version, so pkgver is the full
+# string from the filename. The pool's storage treats a literal '+' in a URL as
+# a space and answers 403, hence the %2B in the download URL only.
+_deb_x86_64="perplexity_${pkgver}_amd64.deb"
+_deb_aarch64="perplexity_${pkgver}_arm64.deb"
+_pool="https://packages.perplexity.ai/deb/pool/main/p/perplexity"
+source=('perplexity-launcher.sh')
+source_x86_64=("${_deb_x86_64}::${_pool}/${_deb_x86_64//+/%2B}")
+source_aarch64=("${_deb_aarch64}::${_pool}/${_deb_aarch64//+/%2B}")
+noextract=("${_deb_x86_64}" "${_deb_aarch64}")
+sha256sums=('b180ca6fbd268712a277a34d4215f176001c0031a4f6360686458623f47fad65')
+sha256sums_x86_64=('2fc95f5500335e661af6901bbad5c95e8805cc9f43d9f0b979787c7249c15c33')
+sha256sums_aarch64=('917562bad5ab319612c22fca49773cdee163b2e7c9f0c3dd5569fc4878f10237')
+
+package() {
+  cd "${srcdir}"
+
+  local deb_var="_deb_${CARCH}"
+  local deb="${!deb_var}"
+
+  bsdtar -xOf "${deb}" data.tar.xz |
+    bsdtar --no-same-owner -xf - -C "${pkgdir}"
+
+  # 26.9.1 started shipping a systemd unit under /lib, and owning /lib -- a
+  # symlink owned by the filesystem package -- makes pacman refuse the whole
+  # transaction. The unit is also a no-op here: its setup script apt-installs
+  # Docker and the NVIDIA Container Toolkit and exits on any distro but Ubuntu
+  # (install those yourself; see optdepends). Delete it, and its parents once
+  # emptied; then anything else left outside opt/ and usr/ -- whatever its
+  # type, an empty bin/ or lib64/ included, since those are filesystem-owned
+  # symlinks too -- stops the build rather than shipping the next conflict.
+  (
+    cd "${pkgdir}"
+    rm -f lib/systemd/system/perplexity-local-runtime-setup.service
+    rmdir -p lib/systemd/system 2>/dev/null || true
+  )
+
+  local unexpected
+  unexpected=$(cd "${pkgdir}" && find . -mindepth 1 \
+    -path ./opt -prune -o -path ./usr -prune -o -print)
+  if [[ -n "${unexpected}" ]]; then
+    echo "Unexpected entries outside opt/ and usr/ in the upstream deb:" >&2
+    echo "${unexpected}" >&2
+    return 1
+  fi
+
+  # pacman never runs the deb's postinst, so the /usr/bin entry it would have
+  # symlinked is a launcher here instead, and the menu entry goes through it so
+  # the flags file applies there too. The scheme handler stays upstream's.
+  install -Dm755 perplexity-launcher.sh "${pkgdir}/usr/bin/perplexity"
+  sed -i 's|^Exec=.*|Exec=perplexity %U|' \
+    "${pkgdir}/usr/share/applications/perplexity.desktop"
+
+  # Arch ships Chromium's and Electron's own sandbox helper setuid, which is
+  # what keeps the sandbox up on a kernel that denies unprivileged user
+  # namespaces -- linux-hardened, mainly -- instead of aborting the app. The
+  # deb leaves this bit to its postinst.
+  chmod 4755 "${pkgdir}/opt/Perplexity/chrome-sandbox"
+
+  # The profile upstream's postinst would install. It names /opt/Perplexity
+  # paths, which this package keeps.
+  install -Dm644 "${pkgdir}/opt/Perplexity/resources/apparmor-profile" \
+    "${pkgdir}/etc/apparmor.d/perplexity"
+
+  # Debian package-policy files are not used on Arch Linux.
+  rm -rf "${pkgdir}/usr/share/doc"
+}
@@ -4,7 +4,7 @@ set -euo pipefail
 user_flags=()
 config_home="${XDG_CONFIG_HOME:-}"
 [[ -n "$config_home" || -z "${HOME:-}" ]] || config_home="$HOME/.config"
-flags_file="${config_home:+$config_home/t3code-flags.conf}"
+flags_file="${config_home:+$config_home/perplexity-flags.conf}"

 if [[ -n "$flags_file" && -f "$flags_file" && -r "$flags_file" ]]; then
  while IFS= read -r line || [[ -n "$line" ]]; do
@@ -16,7 +16,8 @@ if [[ -n "$flags_file" && -f "$flags_file" && -r "$flags_file" ]]; then
 fi

 # Chromium's own Ozone detection falls back to XWayland often enough to matter,
-# and the result is a blurry window on every scaled display.
+# and the result is a blurry window on every scaled display. Ask for Wayland
+# directly, unless the user has already picked a platform themselves.
 platform_flags=()
 if [[ -n "${WAYLAND_DISPLAY:-}" || "${XDG_SESSION_TYPE:-}" == wayland ]]; then
  platform_flags=(--ozone-platform=wayland)
@@ -28,4 +29,4 @@ if [[ -n "${WAYLAND_DISPLAY:-}" || "${XDG_SESSION_TYPE:-}" == wayland ]]; then
  done
 fi

-exec /usr/lib/t3code/t3code "${platform_flags[@]}" "${user_flags[@]}" "$@"
+exec /opt/Perplexity/perplexity "${platform_flags[@]}" "${user_flags[@]}" "$@"
@@ -1,4 +1,10 @@
 {
-  "source": "aur",
-  "upstream_commit": "a850f2d07e825f61cb01b87931d2ae5f1802dde1"
+  "source": "local",
+  "upstream": {
+    "git_tags": "https://github.com/FrameworkComputer/qmk_hid.git",
+    "tag_pattern": "v{pkgver}",
+    "sources": {
+      "any": ["https://github.com/FrameworkComputer/qmk_hid/archive/refs/tags/{tag}.tar.gz"]
+    }
+  }
 }
@@ -2,16 +2,16 @@

 pkgname=qmk-hid
 _srcname=qmk_hid
-pkgver=0.1.11
-pkgrel=3
+pkgver=0.1.13
+pkgrel=1
 pkgdesc="Commandline tool for interacting with QMK devices over HID"
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://github.com/FrameworkComputer/qmk_hid"
 license=('BSD')
 depends=('gcc-libs' 'systemd-libs' 'libcap')
 makedepends=('cargo')
 source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
-b2sums=('e898d27cfe8350f4a8cd2938a3d066935093daf1292f41fc10b8f1937059f2b59e4ac34a987f26c8258a5d3b15a900059024fe3a18ed793f7e3b524939ab4c71')
+sha256sums=('8a058395b8ba56ff54308a681223f11a6032c54df42b4d0223143ccf09d0c858')
 options=('!lto')

 prepare() {
@@ -8,7 +8,7 @@
    "qt6-wayland"
  ],
  "rebuilt_against": {
-    "qt6-base": "6.11.2-2",
+    "qt6-base": "6.11.2-3",
    "qt6-declarative": "6.11.2-1",
    "qt6-wayland": "6.11.2-1"
  }
@@ -3,7 +3,7 @@
 _pkgname=quickshell
 pkgname="$_pkgname-git"
 pkgver=0.3.0.r20.g28771c7
-pkgrel=2
+pkgrel=3
 pkgdesc='Flexible toolkit for making desktop shells with QtQuick'
 arch=(x86_64 aarch64)
 url='https://git.outfoxxed.me/quickshell/quickshell'
@@ -1,4 +1,3 @@
 {
-  "source": "aur",
-  "upstream_commit": "80c65c27a9d5511d2b4ce2ca7ad2396ad528f0da"
+  "source": "local"
 }
@@ -1,7 +1,10 @@
 # Maintainer: Alexandre Bouvier <contact@amb.tf>
 _pkgname=retroarch-joypad-autoconfig
+# Pinned so every architecture packages the same tree and a rebuild of the
+# same pkgver reproduces the same contents; bump both together.
+_commit=033151045d378b64e712a92592467800d7924227
 pkgname=$_pkgname-git
-pkgver=1.22.0.r24.g739cee1
+pkgver=1.22.0.r96.g0331510
 pkgrel=1
 pkgdesc="RetroArch joypad autoconfig files"
 arch=('any')
@@ -12,7 +15,7 @@ makedepends=('git')
 optdepends=('retroarch')
 provides=("$_pkgname")
 conflicts=("$_pkgname")
-source=("$_pkgname::git+$url.git")
+source=("$_pkgname::git+$url.git#commit=$_commit")
 b2sums=('SKIP')

 pkgver() {
@@ -0,0 +1,13 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "min_release_age": "24h",
+  "upstream": {
+    "github": "Infrawrench/schist",
+    "digests": true,
+    "assets": {
+      "x86_64": "schist-{pkgver}-1-x86_64.pkg.tar.zst",
+      "aarch64": "schist-{pkgver}-1-aarch64.pkg.tar.zst"
+    }
+  }
+}
@@ -0,0 +1,44 @@
+# Maintainer: Infrawrench LLC <astrid@infrawrench.com>
+pkgname=schist-bin
+pkgver=0.12.0
+pkgrel=1
+# Upstream's own package release, embedded in the asset name. It is
+# packages.sh's "release=" and only moves when the packaging changes under
+# a version that has already shipped; pkgrel above is this package's own.
+# The asset templates in .omarchy/package.json carry the same number.
+_relver=1
+pkgdesc="Layered image editor with PSD and Affinity support (binary release)"
+arch=(x86_64 aarch64)
+url="https://github.com/Infrawrench/schist"
+license=(MIT)
+# The list the payload's own .PKGINFO carries: fontconfig/wayland/
+# vulkan-icd-loader are dlopen'd, so namcap flags them "may not be needed"
+# — they are.
+depends=(fontconfig freetype2 hicolor-icon-theme libxcb libxkbcommon
+         libxkbcommon-x11 vulkan-icd-loader wayland)
+# A Vulkan ICD is needed to draw, but as a hard dependency makepkg -s would
+# resolve it to nvidia-utils in the build container; Omarchy installs the right
+# driver per machine. libheif is dlopen'd; everything else opens without it.
+optdepends=('vulkan-driver: GPU rendering (any Vulkan ICD, vulkan-swrast in software)'
+            'libheif: HEIC import')
+provides=(schist)
+conflicts=(schist)
+# The released binary ships byte-exact: it is already stripped by the
+# release workflow, and its build id is what Sentry symbolication matches.
+options=(!strip !debug)
+# The release asset is already a pacman-format payload, assembled by
+# packaging/linux/packages.sh from the CI build — this just re-wraps its
+# usr/ tree, so the dependency lists here have to stay in step with that
+# script.
+source_x86_64=("$url/releases/download/v$pkgver/schist-$pkgver-$_relver-x86_64.pkg.tar.zst")
+source_aarch64=("$url/releases/download/v$pkgver/schist-$pkgver-$_relver-aarch64.pkg.tar.zst")
+sha256sums_x86_64=('baff8848274f0121911a6408fd3dd082c5ab023c0ae5c9e5be35968c80beb069')
+sha256sums_aarch64=('a7a4f062289a140ff0aa5c0c9c4b3cc9f386759e3bfe929a0382de2d20c04eda')
+
+package() {
+  # makepkg has already extracted the payload into srcdir; its .PKGINFO
+  # and .MTREE are upstream's and stay behind, only usr/ is packaged.
+  cp -a "$srcdir/usr" "$pkgdir/"
+  # The payload keeps the licence under the upstream pkgname.
+  mv "$pkgdir/usr/share/licenses/schist" "$pkgdir/usr/share/licenses/$pkgname"
+}
@@ -0,0 +1,12 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "min_release_age": "24h",
+  "upstream": {
+    "github": "Onefailatatime/slap-notes",
+    "checksums": "SHA256SUMS",
+    "assets": {
+      "x86_64": "slap-notes-{tag}-linux-x64.tar.zst"
+    }
+  }
+}
@@ -0,0 +1,82 @@
+# Maintainer: FunnelFix <linda@sayhellotolinda.com>
+
+# Slap Notes publishes a plain Electron tree rather than an AppImage, so this
+# repackages the vendor tarball as-is. .omarchy/upstream.sh rewrites the version
+# and checksum below from the release feed the app updates itself from.
+
+pkgname=slap-notes-bin
+_appname=slap-notes
+pkgver=0.2.3
+pkgrel=1
+pkgdesc="Local-first block notes with a wiki-link graph and a built-in AI research agent"
+arch=('x86_64')
+url="https://slapnotes.com"
+license=('LicenseRef-proprietary')
+depends=(
+  'alsa-lib'
+  'at-spi2-core'
+  'cairo'
+  'dbus'
+  'expat'
+  'gcc-libs'
+  'glib2'
+  'glibc'
+  'gtk3'
+  'hicolor-icon-theme'
+  'libcups'
+  'libdrm'
+  # Both are opened by name at runtime rather than linked, so nothing else in
+  # this list pulls them in: libnotify carries desktop notifications and
+  # libsecret backs Electron's encrypted storage.
+  'libnotify'
+  'libsecret'
+  'libx11'
+  'libxcb'
+  'libxcomposite'
+  'libxdamage'
+  'libxext'
+  'libxfixes'
+  'libxkbcommon'
+  'libxrandr'
+  'mesa'
+  'nspr'
+  'nss'
+  'pango'
+  'systemd-libs'
+  'xdg-utils'
+)
+provides=("${_appname}=${pkgver}")
+conflicts=("${_appname}")
+# Electron ships prebuilt binaries: stripping them breaks the bundle.
+options=('!strip' '!debug')
+install="${pkgname}.install"
+_tarball="${_appname}-${pkgver}-linux-x64.tar.zst"
+source=("${_appname}-launcher.sh")
+source_x86_64=("${pkgname}-${pkgver}.tar.zst::https://github.com/Onefailatatime/slap-notes/releases/download/${pkgver}/${_tarball}")
+sha256sums=('9d208c06717906b74c41874bdd3fdba0f0dc5b31d239ae00d19472e6eab2ea29')
+sha256sums_x86_64=('56cb7606f41051ba10d088ed8e1ae85a17b20692f4b45c0c6a6e6cec6669a5e2')
+
+package() {
+  cd "${srcdir}/${_appname}-${pkgver}"
+
+  install -dm755 "${pkgdir}/opt/${_appname}"
+  cp -a app/. "${pkgdir}/opt/${_appname}/"
+  chmod -R a+rX "${pkgdir}/opt/${_appname}"
+
+  install -Dm755 "${srcdir}/${_appname}-launcher.sh" "${pkgdir}/usr/bin/${_appname}"
+
+  # Upstream's entry points straight into /opt, which would step around the
+  # launcher and hand every desktop-started window to XWayland.
+  sed -e "s|^Exec=.*|Exec=${_appname} %U|" "${_appname}.desktop" \
+    > "${srcdir}/${_appname}.desktop.arch"
+  install -Dm644 "${srcdir}/${_appname}.desktop.arch" \
+    "${pkgdir}/usr/share/applications/${_appname}.desktop"
+
+  local size
+  for size in 16 32 48 64 128 256 512 1024; do
+    install -Dm644 "icons/${size}.png" \
+      "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/${_appname}.png"
+  done
+
+  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+}
@@ -0,0 +1,3 @@
+post_install() {
+  echo "Extra Chromium flags go in ~/.config/slap-notes-flags.conf, one per line."
+}
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -euo pipefail
+
+user_flags=()
+config_home="${XDG_CONFIG_HOME:-}"
+[[ -n "$config_home" || -z "${HOME:-}" ]] || config_home="$HOME/.config"
+flags_file="${config_home:+$config_home/slap-notes-flags.conf}"
+
+if [[ -n "$flags_file" && -f "$flags_file" && -r "$flags_file" ]]; then
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    line="${line%%#*}"
+    [[ -n "${line//[[:space:]]/}" ]] || continue
+    read -r -a flags <<<"$line"
+    user_flags+=("${flags[@]}")
+  done <"$flags_file"
+fi
+
+# Chromium's own Ozone detection falls back to XWayland often enough to matter,
+# and the result is a blurry window on every scaled display. Ask for Wayland
+# directly, unless the user has already picked a platform themselves.
+platform_flags=()
+if [[ -n "${WAYLAND_DISPLAY:-}" || "${XDG_SESSION_TYPE:-}" == wayland ]]; then
+  platform_flags=(--ozone-platform=wayland)
+
+  for flag in "${user_flags[@]}" "$@"; do
+    case "$flag" in
+      --ozone-platform=* | --ozone-platform-hint=*) platform_flags=() ;;
+    esac
+  done
+fi
+
+exec /opt/slap-notes/slap-notes "${platform_flags[@]}" "${user_flags[@]}" "$@"
@@ -0,0 +1,5 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "min_release_age": "24h"
+}
@@ -0,0 +1,106 @@
+#!/bin/bash
+# Strata publishes annotated tags and GitHub source archives, but no checksum
+# manifest. Download the small archive only when a newer stable release exists,
+# then verify that its embedded commit matches the release tag before hashing it.
+set -euo pipefail
+
+REPO='lgse/strata'
+API_URL="https://api.github.com/repos/$REPO"
+
+current=$(awk -F= '/^pkgver=/ { print $2; exit }' PKGBUILD)
+releases=$(curl -fsSL "$API_URL/releases?per_page=100")
+now=$(date +%s)
+min_age=${MIN_RELEASE_AGE_SECONDS:-0}
+
+candidates=0
+best_version=''
+best_tag=''
+best_published_at=''
+
+while IFS=$'\t' read -r tag published_at; do
+  if [[ ! $tag =~ ^v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
+    printf '%s has an unusable stable release tag: %s\n' "$REPO" "${tag:-<empty>}" >&2
+    exit 1
+  fi
+  version=${BASH_REMATCH[1]}
+
+  if [[ -z $published_at ]] || ! published_epoch=$(date --date="$published_at" +%s 2>/dev/null); then
+    printf '%s release %s has an invalid publication time\n' "$REPO" "$tag" >&2
+    exit 1
+  fi
+  candidates=$((candidates + 1))
+
+  if ((now - published_epoch < min_age)) && [[ ${BYPASS_MIN_RELEASE_AGE:-} != 1 ]]; then
+    continue
+  fi
+
+  if [[ -z $best_version ]] || (( $(vercmp "$version" "$best_version") > 0 )); then
+    best_version=$version
+    best_tag=$tag
+    best_published_at=$published_at
+  fi
+done < <(jq -r '.[] | select((.draft or .prerelease) | not) | [.tag_name // "", .published_at // ""] | @tsv' <<<"$releases")
+
+if ((candidates == 0)); then
+  printf 'No stable releases found for %s\n' "$REPO" >&2
+  exit 1
+fi
+
+if [[ -z $best_version ]] || (( $(vercmp "$best_version" "$current") <= 0 )); then
+  echo '{}'
+  exit 0
+fi
+
+tag_ref=$(curl -fsSL "$API_URL/git/ref/tags/$best_tag")
+tag_type=$(jq -r '.object.type // empty' <<<"$tag_ref")
+tag_object=$(jq -r '.object.sha // empty' <<<"$tag_ref")
+if [[ ! $tag_object =~ ^[0-9a-f]{40}$ ]]; then
+  printf 'Release %s has an invalid tag object\n' "$best_tag" >&2
+  exit 1
+fi
+
+case "$tag_type" in
+  commit)
+    expected_commit=$tag_object
+    ;;
+  tag)
+    tag_data=$(curl -fsSL "$API_URL/git/tags/$tag_object")
+    if [[ $(jq -r '.object.type // empty' <<<"$tag_data") != commit ]]; then
+      printf 'Release %s does not resolve to a commit\n' "$best_tag" >&2
+      exit 1
+    fi
+    expected_commit=$(jq -r '.object.sha // empty' <<<"$tag_data")
+    ;;
+  *)
+    printf 'Release %s has unsupported tag object type %s\n' "$best_tag" "${tag_type:-<empty>}" >&2
+    exit 1
+    ;;
+esac
+
+if [[ ! $expected_commit =~ ^[0-9a-f]{40}$ ]]; then
+  printf 'Release %s resolves to an invalid commit\n' "$best_tag" >&2
+  exit 1
+fi
+
+tarball=$(mktemp)
+trap 'rm -f "$tarball"' EXIT
+curl -fsSL -o "$tarball" "https://github.com/$REPO/archive/refs/tags/$best_tag.tar.gz"
+
+expected_root="strata-$best_version"
+served_roots=$(tar -tzf "$tarball" | cut -d/ -f1 | sort -u)
+if [[ $served_roots != "$expected_root" ]]; then
+  printf 'Release %s contains root %s, expected %s\n' "$best_tag" "$served_roots" "$expected_root" >&2
+  exit 1
+fi
+
+if ! archive_commit=$(git get-tar-commit-id < <(gzip -dc "$tarball")) ||
+  [[ $archive_commit != "$expected_commit" ]]; then
+  printf 'Release %s archive commit does not match its tag\n' "$best_tag" >&2
+  exit 1
+fi
+
+jq -n \
+  --arg pkgver "$best_version" \
+  --arg published_at "$best_published_at" \
+  --arg source "$(sha256sum "$tarball" | cut -d' ' -f1)" \
+  '{pkgver: $pkgver, published_at: $published_at, sha256sums: {any: [$source]}}'
@@ -0,0 +1,95 @@
+pkgname=strata
+pkgver=0.11.2
+pkgrel=1
+pkgdesc='Fast, keyboard-first file manager for modern Linux desktops'
+arch=('x86_64' 'aarch64')
+url='https://github.com/lgse/strata'
+license=('GPL-3.0-or-later')
+
+depends=(
+  'bash'
+  'bubblewrap'
+  'cairo'
+  'ffmpeg'
+  'ffmpegthumbnailer'
+  'fontconfig'
+  'gcc-libs'
+  'gdk-pixbuf2'
+  'glib2'
+  'glibc'
+  'graphene'
+  'gst-libav'
+  'gst-plugins-good'
+  'gtk4'
+  'gtksourceview5'
+  'hicolor-icon-theme'
+  'pango'
+  'poppler-glib'
+  'util-linux'
+  'xdg-terminal-exec'
+)
+makedepends=('cargo' 'git' 'glib2-devel' 'pkgconf')
+optdepends=(
+  'gvfs-smb: browse SMB network shares'
+  'imagemagick: additional camera RAW preview support'
+  'libraw: additional camera RAW preview support'
+)
+conflicts=('strata-git')
+options=('!debug' '!lto')
+
+source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
+sha256sums=('cfc8b1c3a9a5fde518c5862b58af7722e942b5f394c60fd53822dd642c1f30a0')
+
+prepare() {
+  cd "$pkgname-$pkgver"
+
+  local commit
+  if ! commit=$(git get-tar-commit-id < <(gzip -dc "$srcdir/$pkgname-$pkgver.tar.gz")) ||
+    [[ ! $commit =~ ^[0-9a-f]{40}$ ]]; then
+    printf 'Could not recover the release commit from the source archive\n' >&2
+    return 1
+  fi
+  printf '%s\n' "$commit" >.build-commit
+
+  cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
+}
+
+build() {
+  cd "$pkgname-$pkgver"
+
+  export CARGO_TARGET_DIR=target
+  export STRATA_BUILD_COMMIT
+  STRATA_BUILD_COMMIT=$(<.build-commit)
+  export STRATA_RELEASE_TAG="v$pkgver"
+  export STRATA_BUILD_KIND=stable
+  cargo build --frozen --release
+}
+
+check() {
+  cd "$pkgname-$pkgver"
+
+  export CARGO_TARGET_DIR=target
+  export STRATA_BUILD_COMMIT
+  STRATA_BUILD_COMMIT=$(<.build-commit)
+  export STRATA_RELEASE_TAG="v$pkgver"
+  export STRATA_BUILD_KIND=stable
+  cargo test --frozen --release --all-targets --all-features
+}
+
+package() {
+  cd "$pkgname-$pkgver"
+
+  install -Dm755 target/release/strata "$pkgdir/usr/bin/strata"
+  install -Dm644 data/io.github.lgse.Strata.desktop \
+    "$pkgdir/usr/share/applications/io.github.lgse.Strata.desktop"
+  install -Dm644 data/icons/scalable/apps/io.github.lgse.Strata.svg \
+    "$pkgdir/usr/share/icons/hicolor/scalable/apps/io.github.lgse.Strata.svg"
+  # Payload for the app's per-user FileManager1 opt-in; upstream's own
+  # packaging stages it here, not in /usr/share/dbus-1.
+  install -Dm644 data/io.github.lgse.Strata.FileManager1.service \
+    "$pkgdir/usr/share/strata/io.github.lgse.Strata.FileManager1.service"
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  install -Dm644 THIRD_PARTY_LICENSES.md \
+    "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_LICENSES.md"
+  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
+}
@@ -0,0 +1,57 @@
+--- a/PKGBUILD
+++ b/PKGBUILD
+@@ -36,7 +36,6 @@ depends=(
+   'libcap'
+   'libdrm'
+   'libevdev'
+-  'libmfx'
+   'libnotify'
+   'libpipewire'
+   'libpulse'
+@@ -53,6 +52,10 @@ depends=(
+   'which'
+ )
+ 
+depends_x86_64=(
+  'libmfx'
+)
+
+ makedepends=(
+   'appstream'
+   'appstream-glib'
+@@ -69,6 +72,10 @@ makedepends=(
+   'shaderc'
+ )
+ 
+makedepends_aarch64=(
+  'vulkan-headers'
+)
+
+ checkdepends=(
+   'gcovr'
+ )
+@@ -111,7 +118,12 @@ if [ -n "${optdepends+x}" ]; then
+ 
+ prepare() {
+     cd "$pkgname"
+-    git submodule update --recursive --init
+    if [[ $CARCH == aarch64 ]]; then
+      git submodule update --init
+      git -C third-party/moonlight-common-c submodule update --init enet
+    else
+      git submodule update --recursive --init
+    fi
+ 
+     # Backport https://github.com/LizardByte/Sunshine/commit/060b6b07d376e9ef4c4ce4a5c6d648d08fe0eab9
+     patch -Np1 -i "${srcdir}/2026.516.143833-060b6b07-remove-setuptools-from-glad-dependencies.patch"
+@@ -145,6 +157,10 @@ build() {
+       -D SUNSHINE_PUBLISHER_ISSUE_URL='https://app.lizardbyte.dev/support'
+     )
+ 
+    if [[ $CARCH == aarch64 ]]; then
+      _cmake_options+=(-D SUNSHINE_SYSTEM_VULKAN_HEADERS=ON)
+    fi
+
+     if [[ "${_use_cuda::1}" != "t" ]]; then
+       _cmake_options+=(-DSUNSHINE_ENABLE_CUDA=OFF -DCUDA_FAIL_ON_MISSING=OFF)
+     else
@@ -10,7 +10,7 @@

 pkgname='sunshine'
 pkgver=2026.516.143833
-pkgrel=4
+pkgrel=4.1
 pkgdesc="Self-hosted game stream host for Moonlight"
 arch=('x86_64' 'aarch64')
 url=https://app.lizardbyte.dev/Sunshine
@@ -36,7 +36,6 @@ depends=(
  'libcap'
  'libdrm'
  'libevdev'
-  'libmfx'
  'libnotify'
  'libpipewire'
  'libpulse'
@@ -55,6 +54,10 @@ depends=(
  'which'
 )

+depends_x86_64=(
+  'libmfx'
+)
+
 makedepends=(
  'appstream'
  'appstream-glib'
@@ -69,6 +72,10 @@ makedepends=(
  'shaderc'
 )

+makedepends_aarch64=(
+  'vulkan-headers'
+)
+
 checkdepends=(
  'gcovr'
 )
@@ -123,7 +130,12 @@ fi

 prepare() {
    cd "$pkgname"
-    git submodule update --recursive --init
+    if [[ $CARCH == aarch64 ]]; then
+      git submodule update --init
+      git -C third-party/moonlight-common-c submodule update --init enet
+    else
+      git submodule update --recursive --init
+    fi

    # Backport https://github.com/LizardByte/Sunshine/commit/060b6b07d376e9ef4c4ce4a5c6d648d08fe0eab9
    patch -Np1 -i "${srcdir}/2026.516.143833-060b6b07-remove-setuptools-from-glad-dependencies.patch"
@@ -159,6 +171,10 @@ build() {
      -D SUNSHINE_PUBLISHER_ISSUE_URL='https://app.lizardbyte.dev/support'
    )

+    if [[ $CARCH == aarch64 ]]; then
+      _cmake_options+=(-D SUNSHINE_SYSTEM_VULKAN_HEADERS=ON)
+    fi
+
    if [[ "${_use_cuda::1}" != "t" ]]; then
      _cmake_options+=(-DSUNSHINE_ENABLE_CUDA=OFF -DCUDA_FAIL_ON_MISSING=OFF)
    else
@@ -1,5 +1,11 @@
 {
-  "source": "aur",
+  "source": "local",
  "release_ring": "fast",
-  "upstream_commit": "39667376addf3916b7bed3ecbe3ec6ed2af367e4"
+  "upstream": {
+    "github": "symfony-cli/symfony-cli",
+    "checksums": "checksums.txt",
+    "assets": {
+      "any": "symfony-cli-{pkgver}.tar.gz"
+    }
+  }
 }
@@ -1,23 +1,27 @@
 # Maintainer: Florian Moser <arch@famoser.ch>

 pkgname=symfony-cli
-pkgrel=8
+pkgrel=9
 pkgver=5.20.0
 pkgdesc="The Symfony client helps developers create and manage Symfony applications."
 url="https://symfony.com/"
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 license=('AGPL3')
 depends=('glibc')
-makedepends=('git' 'go')
+makedepends=('go')
 provides=('symfony-cli')
 conflicts=('symfony-cli')
-source=(
-    "git+https://github.com/symfony-cli/symfony-cli#tag=v${pkgver}"
-)
-sha256sums=('SKIP')
+source=("$pkgname-$pkgver.tar.gz::https://github.com/symfony-cli/symfony-cli/releases/download/v${pkgver}/symfony-cli-${pkgver}.tar.gz")
+sha256sums=('11354f7206740dc8b31410bf7fbcb20debccb4a92935da84729fd7d754b2082f')
+noextract=("$pkgname-$pkgver.tar.gz")
+
+prepare() {
+  mkdir "$pkgname-$pkgver"
+  bsdtar -xf "$pkgname-$pkgver.tar.gz" -C "$pkgname-$pkgver"
+}

 build() {
-  cd "symfony-cli"
+  cd "$pkgname-$pkgver"

  DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
  PKGVER=${pkgver}
@@ -26,6 +30,6 @@ build() {
  go build -trimpath -ldflags '-s -w -X main.channel=stable -X main.buildDate='"${DATE}"' -X main.version='"${PKGVER}"''
 }

-package() {    
-    install -D -m 755 "${srcdir}/symfony-cli/symfony-cli" "${pkgdir}/usr/bin/symfony"
+package() {
+    install -D -m 755 "${srcdir}/${pkgname}-${pkgver}/symfony-cli" "${pkgdir}/usr/bin/symfony"
 }
@@ -7,7 +7,7 @@
 # from the release feed the app updates itself from.

 pkgname=t3code-bin
-pkgver=0.0.37
+pkgver=0.0.39
 pkgrel=1
 pkgdesc="Open-source control plane for coding agents"
 arch=('x86_64')
@@ -61,7 +61,7 @@ noextract=("${_appimage}")
 sha256sums=('cb905ff341372ef2ef6e402cf485959f8bd1df8f0efebee4cda1afdd5e6abc0a'
            'c5b3f2a9f0b14b12cfd973b79319f0f018b7ae49a1d43d8ca346100c3f7de28f'
            '935d8f2af0c703f9c39517ee57cc4930b19d02d533be930b63f0e82f93614b43')
-sha256sums_x86_64=('ea88807ccc4b18b2c3f85726ef1235e695b656ab37c8e29c9289f7a28de336c2')
+sha256sums_x86_64=('4f78c9939c0386f9be5a2d8e9baf9644af497344015817a36fea8be84981bda8')

 prepare() {
  chmod +x "${srcdir}/${_appimage}"
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 T3 Tools Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
@@ -1,134 +0,0 @@
-# Maintainer: Ryan Hughes <ryan@heyoodle.com>
-
-# T3 Code built from the environment-theme branch of ryanrhughes/t3code, until
-# upstream ships it: the desktop follows the machine's published themes
-# (Omarchy retints it live) and `t3 theme set` works. Packaging matches
-# t3code-bin exactly, so this installs in its place and the AppImage is
-# unpacked the same way.
-#
-# Shipping a new artifact, every time:
-#   1. The t3code worktree needs a repo-root .env carrying the public T3
-#      Connect config (relay URL, Clerk publishable key, CLI OAuth client id)
-#      or Connect ships broken -- the 0.0.35-2 mistake. The values are public
-#      and recoverable from the published npm `t3` package if lost.
-#   2. Build: `pnpm dist:desktop:linux` with --build-version <upstream pkgver>.
-#   3. Tag the built commit v<pkgver>-omarchy.<n>, create a GitHub release on
-#      the fork with the AppImage as its asset.
-#   4. Update _patchtag and sha256sums_x86_64 here, and bump pkgrel (or, on a
-#      rebase to a new upstream release, bump pkgver and reset pkgrel) -- the
-#      version change is what makes the build server rebuild at all; a new
-#      release asset with an untouched PKGBUILD is invisible to it.
-
-pkgname=t3code-patched-bin
-pkgver=0.0.35
-pkgrel=5
-pkgdesc="Open-source control plane for coding agents, with Omarchy environment-theme patches"
-arch=('x86_64')
-url="https://t3.codes"
-license=('MIT')
-
-depends=(
-  'alsa-lib'
-  'at-spi2-core'
-  'cairo'
-  'dbus'
-  'expat'
-  'gcc-libs'
-  'glib2'
-  'glibc'
-  'gtk3'
-  'hicolor-icon-theme'
-  'libcups'
-  'libnotify'
-  'libx11'
-  'libxcb'
-  'libxcomposite'
-  'libxdamage'
-  'libxext'
-  'libxfixes'
-  'libxkbcommon'
-  'libxrandr'
-  'mesa'
-  'nspr'
-  'nss'
-  'pango'
-  'systemd-libs'
-  'xdg-utils'
-)
-
-optdepends=(
-  'claude-code: drive Claude Code from the app'
-  'cursor-cli: drive Cursor from the app'
-  'github-copilot-cli: drive Copilot from the app'
-  'openai-codex: drive Codex from the app'
-)
-
-provides=("t3code=${pkgver}")
-conflicts=('t3code' 't3code-bin')
-options=('!debug' '!strip')
-
-_patchtag="v${pkgver}-omarchy.5"
-_appimage="T3-Code-${pkgver}-x86_64.AppImage"
-source=('t3code-launcher.sh' 't3-launcher.sh' 'LICENSE')
-source_x86_64=("${_appimage}::https://github.com/ryanrhughes/t3code/releases/download/${_patchtag}/${_appimage}")
-noextract=("${_appimage}")
-sha256sums=('cb905ff341372ef2ef6e402cf485959f8bd1df8f0efebee4cda1afdd5e6abc0a'
-            'c5b3f2a9f0b14b12cfd973b79319f0f018b7ae49a1d43d8ca346100c3f7de28f'
-            '935d8f2af0c703f9c39517ee57cc4930b19d02d533be930b63f0e82f93614b43')
-sha256sums_x86_64=('6f58306d54525ca695c7b902aac610d111f85a1f3ba8a9bf04e6e1950337b1f6')
-
-prepare() {
-  chmod +x "${srcdir}/${_appimage}"
-  rm -rf "${srcdir}/squashfs-root"
-  "${srcdir}/${_appimage}" --appimage-extract >/dev/null
-}
-
-package() {
-  cd "${srcdir}/squashfs-root"
-
-  # The AppImage's usr/ tree is compatibility libraries for distributions that
-  # lack them, and Arch is not one; its icons are the only part worth keeping.
-  # A release that starts shipping something else there stops the build rather
-  # than having it deleted quietly on the way past.
-  local unexpected
-  unexpected=$(find usr \( -type f -o -type l \) | grep -vE \
-    '^usr/share/icons/hicolor/[0-9]+x[0-9]+/apps/t3code\.png$|^usr/lib/lib(Xss\.so\.1|Xtst\.so\.6|appindicator\.so\.1|gconf-2\.so\.4|indicator\.so\.7|notify\.so\.4)$' || true)
-  if [[ -n "${unexpected}" ]]; then
-    echo "Unexpected files in the AppImage's usr/ tree:" >&2
-    echo "${unexpected}" >&2
-    return 1
-  fi
-
-  local icon size
-  for icon in usr/share/icons/hicolor/*/apps/t3code.png; do
-    size="${icon#usr/share/icons/hicolor/}"
-    install -Dm644 "${icon}" "${pkgdir}/usr/share/icons/hicolor/${size%%/*}/apps/t3code.png"
-  done
-
-  # Upstream's own entry rather than a hand-written one: it carries the
-  # t3code:// scheme handlers that make the app's deep links resolve.
-  # The name drops the "(Alpha)" upstream's electron-builder still appends; the
-  # app itself now calls that string legacy and keeps its data under t3code.
-  sed -e 's|^Exec=.*|Exec=t3code %U|' -e 's|^Name=.*|Name=T3 Code|' \
-    -e '/^X-AppImage-Version=/d' t3code.desktop \
-    > "${srcdir}/t3code.desktop.arch"
-  install -Dm644 "${srcdir}/t3code.desktop.arch" \
-    "${pkgdir}/usr/share/applications/t3code.desktop"
-
-  rm -rf AppRun .DirIcon usr t3code.desktop t3code.png
-  install -d "${pkgdir}/usr/lib/t3code"
-  cp -a . "${pkgdir}/usr/lib/t3code/"
-  chmod -R a+rX "${pkgdir}/usr/lib/t3code"
-
-  # Arch ships Chromium's and Electron's own sandbox helper setuid, which is
-  # what keeps the sandbox up on a kernel that denies unprivileged user
-  # namespaces -- linux-hardened, mainly -- instead of aborting the app.
-  chmod 4755 "${pkgdir}/usr/lib/t3code/chrome-sandbox"
-
-  install -Dm755 "${srcdir}/t3code-launcher.sh" "${pkgdir}/usr/bin/t3code"
-  # The server CLI, run through the bundled Electron as Node. Same entrypoint
-  # npm's `t3` package runs, so `t3 serve`, `t3 pair`, and the rest work
-  # without a separate install.
-  install -Dm755 "${srcdir}/t3-launcher.sh" "${pkgdir}/usr/bin/t3"
-  install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
-}
@@ -1,10 +0,0 @@
-#!/bin/bash
-# The T3 Code server CLI (`t3`) ships inside the app bundle; upstream only
-# distributes it separately through npm. The bundled Electron doubles as the
-# Node runtime for it, so the desktop package can put the CLI on PATH without
-# shipping a second runtime. Electron's fs layer reads app.asar transparently
-# in this mode.
-set -euo pipefail
-
-export ELECTRON_RUN_AS_NODE=1
-exec /usr/lib/t3code/t3code /usr/lib/t3code/resources/app.asar/apps/server/dist/bin.mjs "$@"
@@ -1,4 +1,10 @@
 {
-  "source": "aur",
-  "upstream_commit": "c6fe8f2c6dc43a5c2f0c95df5656037b351dacb7"
+  "source": "local",
+  "upstream": {
+    "git_tags": "https://github.com/jondkinney/tensaku.git",
+    "tag_pattern": "v{pkgver}",
+    "sources": {
+      "any": ["https://github.com/jondkinney/tensaku/archive/refs/tags/{tag}.tar.gz"]
+    }
+  }
 }
@@ -6,10 +6,10 @@
 # pushes to the AUR. Edit depends / package() etc. here — never in the
 # AUR repo directly.
 pkgname=tensaku
-pkgver=0.28.0
+pkgver=0.29.0
 pkgrel=1
 pkgdesc='Modern screenshot annotation tool for Wayland'
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url='https://github.com/jondkinney/tensaku'
 license=('MPL-2.0')
 depends=('gtk4' 'gtk4-layer-shell' 'libadwaita' 'libepoxy' 'fontconfig')
@@ -20,7 +20,7 @@ makedepends=('rust')
 optdepends=('hyprland: window snapping and pin placement'
            'sway: window snapping and pin placement')
 source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('08f61dce1a4b629a1229c0b2cead642e165319e4b61a6f605fc3568d9f6183ee')
+sha256sums=('31595a8b4600107a63c1e5889f50f40e1ef832e51cfc038c1a7750b987fd34d0')

 prepare() {
  cd "$pkgname-$pkgver"
@@ -1,3 +1,11 @@
 {
-  "source": "local"
+  "source": "local",
+  "min_release_age": "24h",
+  "upstream": {
+    "github": "ryanoasis/nerd-fonts",
+    "checksums": "SHA-256.txt",
+    "assets": {
+      "any": "JetBrainsMono.zip"
+    }
+  }
 }
@@ -1,7 +1,7 @@
 # Maintainer: Omarchy <hello@omarchy.org>

 pkgname=ttf-jetbrains-mono-nerd-basic
-pkgver=3.5.0
+pkgver=3.5.1
 pkgrel=1
 pkgdesc="Basic JetBrains Mono Nerd Font family"
 arch=("any")
@@ -11,7 +11,7 @@ groups=("nerd-fonts")
 provides=("ttf-font-nerd" "ttf-jetbrains-mono-nerd=$pkgver")
 conflicts=("ttf-jetbrains-mono-nerd" "nerd-fonts-jetbrains-mono")
 source=("JetBrainsMono-${pkgver}.zip::https://github.com/ryanoasis/nerd-fonts/releases/download/v${pkgver}/JetBrainsMono.zip")
-sha256sums=("9577de1ae84ec523df16fc69bac5338b89497a5b4fb91489e2dcb79dc06ac2b5")
+sha256sums=('fab782a66f7d3019da64f6572db9fc5d3a4bcb19f9fa13e2d8a62e3693d6396e')

 package() {
  local font
@@ -1,4 +1,10 @@
 {
-  "source": "aur",
-  "upstream_commit": "1b3c3bdf6289a348da09eed57d653d3f6dce1956"
+  "source": "local",
+  "upstream": {
+    "git_tags": "https://github.com/cdown/tzupdate.git",
+    "tag_pattern": "{pkgver}",
+    "sources": {
+      "any": ["https://github.com/cdown/tzupdate/archive/refs/tags/{tag}.tar.gz"]
+    }
+  }
 }
@@ -5,7 +5,7 @@ pkgver=3.1.0
 pkgrel=1
 pkgdesc='Set the system timezone based on IP geolocation'
 url=https://github.com/cdown/tzupdate
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 options=(!lto)
 license=('MIT')
 makedepends=('cargo')
@@ -1,9 +1,14 @@
 {
-  "source": "aur",
-  "sync": false,
-  "pkgrel": {
-    "suffix": 2,
-    "offset": 1
-  },
-  "upstream_commit": "086fa284d7f5ad562ea6ba79b3cb4fd798e759d3"
+  "source": "local",
+  "upstream": {
+    "git_tags": "https://gitlab.com/vicamo/v4l2-relayd.git",
+    "tag_pattern": "upstream/{pkgver}",
+    "sources": {
+      "any": [
+        "https://gitlab.com/vicamo/v4l2-relayd/-/archive/upstream/{pkgver}/v4l2-relayd-upstream-{pkgver}.tar.gz",
+        "file:0001-reset-output-on-idle.patch",
+        "file:0002-escape-optional-splashsrc-expansion.patch"
+      ]
+    }
+  }
 }
@@ -4,7 +4,7 @@ pkgname=v4l2-relayd
 pkgver=0.2.0
 pkgrel=2.2
 pkgdesc="Plays gstreamer sources into v4l2loopback devices."
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://gitlab.com/vicamo/v4l2-relayd"
 license=('GPL')
 depends=(
@@ -19,8 +19,8 @@ source=("https://gitlab.com/vicamo/v4l2-relayd/-/archive/upstream/${pkgver}/v4l2
        "0001-reset-output-on-idle.patch"
        "0002-escape-optional-splashsrc-expansion.patch")
 sha256sums=('0c063edf18dcc6edcdef46e695128cfc2b2d60964ea8538c7e79a2454310c53d'
-            'SKIP'
-            'SKIP')
+            '07722a8708ced48d2db9575f3eae5b1266868d259d260635e06e9a10baddec78'
+            '3cb89056af276eed7a45dfc96435e8e48558e4e11c96560360d46d631b1c0b6c')

 prepare() {
  cd "$srcdir/${pkgname}-upstream-${pkgver}"
@@ -0,0 +1,4 @@
+{
+  "source": "aur",
+  "upstream_commit": "9aa84b0998874261e94bbbe25e0dcf3de7286b94"
+}
@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.
@@ -0,0 +1,66 @@
+# Maintainer: libele <libele@disroot.org>
+# Contributor: Evangelos Foutras <foutrelis@archlinux.org>
+# Contributor: Eric Bélanger <eric@archlinux.org>
+
+pkgname=vi
+pkgver=070224
+pkgrel=9
+epoch=1
+pkgdesc="The original ex/vi text editor"
+arch=('aarch64' 'arm' 'armv6h' 'armv7h' 'i486' 'i686' 'pentium4' 'x86_64')
+url="https://ex-vi.sourceforge.net/"
+license=('BSD-4-Clause-UC AND Caldera-no-preamble')
+depends=('ncurses')
+optdepends=('s-nail: used by the preserve command for notification')
+provides=('vi')
+conflicts=('ex-vi-compat' 'heirloom-ex-vi')
+source=(https://sources.archlinux.org/other/$pkgname/ex-$pkgver.tar.xz{,.sig}
+        fix-tubesize-short-overflow.patch
+        navkeys.patch
+        format-security.patch
+        linenum.patch
+        preserve-dir.patch)
+sha256sums=('c3e52dd44edd1f6bf0b52207f717c56149dc50aac0d131fff3851d589727f52f'
+            'SKIP'
+            '42167fabebe30a13d594346b1d254db82090ba41742a9f35b8895d37092053f0'
+            '0e9e2d381f1d8cb86daae68462b3849825b003c08007725c0db9939d3d5bf58d'
+            'ec50373ab48a9b327c5d02b10406bc3d04310d692de6c17098a59b1afeb08e03'
+            '4539f46cd839475c168a9c463f041354463e90e810b973a10c499c2727b008e7'
+            'f0ef9ed2ccea98bf47b08dd3faa2abb911b4e6c0579f5294e9d0e8742282ff65')
+validpgpkeys=('86CFFCA918CF3AF47147588051E8B148A9999C34')  # Evangelos Foutras <evangelos@foutras.com>
+
+prepare() {
+  # Extract specific license files.
+  sed -n '1,36p' ex-$pkgver/LICENSE > BSD-4-Clause-UC.txt
+  sed -n '39,69p' ex-$pkgver/LICENSE > Caldera-no-preamble.txt
+
+  cd ex-$pkgver
+
+  patch -Np1 -i ../fix-tubesize-short-overflow.patch
+  patch -Np1 -i ../navkeys.patch
+
+  # https://bugs.archlinux.org/task/76121
+  patch -Np1 -i ../format-security.patch
+
+  # https://bugs.archlinux.org/task/70770
+  patch -Np1 -i ../linenum.patch
+
+  # https://bugs.archlinux.org/task/20653
+  patch -Np1 -i ../preserve-dir.patch
+}
+
+build() {
+  cd ex-$pkgver
+
+  export CFLAGS=-std=gnu90
+  make PREFIX=/usr LIBEXECDIR=/usr/lib/ex PRESERVEDIR=/var/lib/ex \
+    TERMLIB=ncurses FEATURES="-DCHDIR -DFASTTAG -DUCVISUAL -DMB -DBIT8"
+}
+
+package() {
+  cd ex-$pkgver
+
+  make PREFIX=/usr LIBEXECDIR=/usr/lib/ex PRESERVEDIR=/var/lib/ex \
+    INSTALL=/usr/bin/install DESTDIR="$pkgdir" install
+  install -vDm 644 ../*.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
+}