Merge branch 'quattro' into unified-input-method-setup

migrations/1786391100.sh

@@ -1,5 +1,12 @@
 echo "Run the WPA handshake in software on Macs with Broadcom Wi-Fi"
 
+# This quirk targets Intel Macs. Apple Silicon uses brcmfmac too and reports
+# "Apple Inc." with a listed part (BCM4387 is 14e4:4433), but disabling its
+# firmware supplicant makes firmware commands time out and breaks scanning
+# entirely. A fresh install marks this done only for its first user, so an
+# account added later still runs it.
+omarchy-hw-aarch64-apple && exit 0
+
 # The install-time quirk only reaches machines set up after it shipped, and it
 # never covered Macs without a T2 at all, so an existing install on one still
 # cannot join a WPA2/WPA3 transition-mode network. See

migrations/1786605598.sh

@@ -11,6 +11,7 @@ echo "Rebuild the initramfs so NVIDIA-only systems shed nouveau's unused GSP fir
 # update as a .pacnew) keeps kms and correctly skips the rebuild.
 
 hooks_conf="${OMARCHY_MKINITCPIO_HOOKS_CONF:-/etc/mkinitcpio.conf.d/omarchy_hooks.conf}"
+baseline_conf="${hooks_conf%/*}/00-omarchy-hooks.conf"
 nvidia_conf="${OMARCHY_MKINITCPIO_NVIDIA_CONF:-/etc/mkinitcpio.conf.d/nvidia.conf}"
 rebuild_marker="${OMARCHY_KMS_REBUILD_MARKER:-/var/lib/omarchy/migrations/1786605598}"
 
@@ -22,9 +23,9 @@ omarchy-cmd-present limine-mkinitcpio || exit 0
 # marker still retries an interrupted rebuild.
 [[ ! -e $rebuild_marker ]] || exit 0
 
-# Source the drop-ins in mkinitcpio's order (nvidia.conf sorts first) and read
-# the HOOKS they produce. Skip conservatively if evaluation fails.
-hooks=$(bash -c 'source "$1" && source "$2" && echo " ${HOOKS[*]} "' -- "$nvidia_conf" "$hooks_conf") || exit 0
+# Include the baseline when installed, then the hardware and filter drop-ins.
+# Skip conservatively if evaluation fails.
+hooks=$(bash -c 'if [[ -f $1 ]]; then source "$1" || exit 1; fi; source "$2" && source "$3" && echo " ${HOOKS[*]} "' -- "$baseline_conf" "$nvidia_conf" "$hooks_conf") || exit 0
 
 [[ $hooks != *" kms "* ]] || exit 0
 

migrations/1789433473.sh

@@ -0,0 +1,3 @@
+echo "Enable approval for newly connected USB devices"
+
+omarchy-setup-security-usb-authorization --yes

migrations/1790344599.sh

@@ -0,0 +1,2 @@
+echo "Require approval for new Thunderbolt accessories"
+omarchy-setup-security-thunderbolt-authorization --quiet

migrations/1790608617.sh

@@ -0,0 +1,7 @@
+echo "Repair USB approval prompts and enable portable device approvals"
+
+# Preserve an explicit opt-out. Existing users with an active/enabled daemon
+# need a working watcher even if their old checkout link has become dangling.
+if systemctl is-enabled --quiet usbguard.service || systemctl is-active --quiet usbguard.service; then
+  omarchy-setup-security-usb-authorization --yes
+fi

migrations/1791470456.sh

@@ -0,0 +1,64 @@
+echo "Repair background selections after bundled images moved to WebP"
+
+theme_webp_source() {
+  local theme="$1"
+  local background="$2"
+  local original_name=${background##*/}
+  local replacement_name="${original_name%.*}.webp"
+  local user_theme_backgrounds="$HOME/.config/omarchy/themes/$theme/backgrounds"
+  local bundled_theme_backgrounds="$OMARCHY_PATH/themes/$theme/backgrounds"
+
+  if [[ -f $user_theme_backgrounds/$original_name || -f $bundled_theme_backgrounds/$original_name ]]; then
+    return 1
+  elif [[ -f $user_theme_backgrounds/$replacement_name ]]; then
+    printf '%s\n' "$user_theme_backgrounds/$replacement_name"
+  elif [[ -f $bundled_theme_backgrounds/$replacement_name ]]; then
+    printf '%s\n' "$bundled_theme_backgrounds/$replacement_name"
+  else
+    return 1
+  fi
+}
+
+replacement_webp() {
+  local background="$1"
+  local theme="${2:-}"
+  local replacement
+
+  case ${background,,} in
+  *.jpg | *.jpeg | *.png) replacement="${background%.*}.webp" ;;
+  *) return 1 ;;
+  esac
+
+  if [[ -n $theme && ${background%/*} == "$HOME/.local/state/omarchy/current/theme/backgrounds" ]]; then
+    theme_webp_source "$theme" "$background" >/dev/null || return 1
+    printf '%s\n' "$replacement"
+    return 0
+  fi
+
+  [[ ! -e $background && -f $replacement ]] || return 1
+  printf '%s\n' "$replacement"
+}
+
+current_dir="$HOME/.local/state/omarchy/current"
+current_background="$current_dir/background"
+if [[ -L $current_background ]]; then
+  active_theme=$(cat "$current_dir/theme.name" 2>/dev/null || true)
+  background=$(readlink "$current_background")
+  if replacement=$(replacement_webp "$background" "$active_theme"); then
+    if [[ ! -f $replacement ]]; then
+      source=$(theme_webp_source "$active_theme" "$background")
+      cp "$source" "$replacement"
+    fi
+    ln -sfn "$replacement" "$current_background"
+    omarchy-shell -q background set "$replacement"
+  fi
+fi
+
+for state_file in "$HOME/.local/state/omarchy/theme-backgrounds/"*; do
+  [[ -f $state_file ]] || continue
+
+  background=$(<"$state_file")
+  if replacement=$(replacement_webp "$background" "${state_file##*/}"); then
+    printf '%s\n' "$replacement" >"$state_file"
+  fi
+done

migrations/1791542175.sh

@@ -0,0 +1,6 @@
+echo "Install Gliff, the Hyprland remote desktop over SSH"
+
+# Gliff has no aarch64 build (install/omarchy-x86_64-only.packages).
+if omarchy-hw-x86; then
+  omarchy-pkg-add gliff
+fi

migrations/1791581004.sh

@@ -0,0 +1,54 @@
+echo "Stop the boot from waiting on a black screen for the console to answer"
+
+# systemd asks the console for its size when PID 1 starts and waits for the
+# reply. With Plymouth holding the screen the reply sometimes never comes, and
+# about 1 boot in 10 sits on a black screen until a key is pressed.
+# omarchy-defaults.conf now carries systemd.tty.term.console=dumb, which makes
+# systemd skip the query. The package has already written that file by the
+# time this runs; the boot image still holds the old command line until it is
+# rebuilt.
+
+defaults_conf="${OMARCHY_LIMINE_DEFAULTS_CONF:-/etc/limine-entry-tool.d/omarchy-defaults.conf}"
+running_cmdline="${OMARCHY_RUNNING_CMDLINE:-/proc/cmdline}"
+rebuild_marker="${OMARCHY_LIMINE_REBUILD_MARKER:-/var/lib/omarchy/migrations/1791581004}"
+param="systemd.tty.term.console=dumb"
+
+omarchy-cmd-present limine-mkinitcpio || exit 0
+[[ -f $defaults_conf && -r $running_cmdline ]] || exit 0
+
+# The running kernel keeps its old command line until reboot, so a marker
+# records the machine-wide rebuild: another user's migration must not repeat
+# it before then, while a missing marker still retries an interrupted rebuild.
+[[ ! -e $rebuild_marker ]] || exit 0
+
+# A machine that boots with it already, or whose defaults were edited to leave
+# it out, has nothing to rebuild.
+[[ " $(<"$running_cmdline") " != *" $param "* ]] || exit 0
+grep -Eq "^KERNEL_CMDLINE\[default\]\+=\".*${param//./\\.}.*\"" "$defaults_conf" || exit 0
+
+echo "The booted kernel is missing $param; rebuilding the boot image"
+sudo limine-mkinitcpio
+
+# The boot menu is on the ESP, which /etc/default/limine names; /boot when it
+# does not, or is not there.
+limine_conf="${OMARCHY_LIMINE_CONF:-}"
+if [[ -z $limine_conf ]]; then
+  esp=""
+  if [[ -r /etc/default/limine ]]; then
+    esp=$(sed -n 's/^ESP_PATH=["'\'']\?\([^"'\'']*\).*/\1/p' /etc/default/limine | tail -n 1)
+  fi
+  limine_conf="${esp:-/boot}/limine.conf"
+fi
+
+# limine-mkinitcpio carries on past a kernel it could not build, a full boot
+# partition for one, and still exits 0. Done means a boot entry has the
+# parameter: without that the migration stays pending and the next update
+# tries again. A menu with no command lines in it (they are inside the boot
+# images then) has nothing to look at, and is taken at its word.
+if sudo grep -Eq '^[[:space:]]*cmdline:' "$limine_conf" 2>/dev/null &&
+  ! sudo grep -Eq "^[[:space:]]*cmdline:.*[[:space:]]${param//./\\.}([[:space:]]|\$)" "$limine_conf"; then
+  echo "The boot menu still has no entry with $param after the rebuild" >&2
+  exit 1
+fi
+
+sudo install -Dm644 /dev/null "$rebuild_marker"