Prepare installer for ISO-owned finalization

test/cli

@@ -6,6 +6,7 @@ ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
 CLI="$ROOT/bin/omarchy"
 TMPDIR=""
 PI_TMPDIR=""
+THEME_TMPDIR=""
 
 export PATH="$ROOT/bin:$PATH"
 
@@ -35,6 +36,7 @@ assert_output_contains() {
 cleanup() {
   [[ -n $TMPDIR && -d $TMPDIR ]] && rm -rf "$TMPDIR"
   [[ -n $PI_TMPDIR && -d $PI_TMPDIR ]] && rm -rf "$PI_TMPDIR"
+  [[ -n $THEME_TMPDIR && -d $THEME_TMPDIR ]] && rm -rf "$THEME_TMPDIR"
 }
 trap cleanup EXIT
 
@@ -399,6 +401,14 @@ pass "vscode generated theme clears obsolete extension marker"
 jq -e '.[] | select(.identifier.id == "local.omarchy-theme" and .relativeLocation == "omarchy-theme")' "$PI_TMPDIR/.vscode/extensions/extensions.json" >/dev/null || fail "vscode generated theme registers local extension"
 pass "vscode generated theme registers local extension"
 
+THEME_TMPDIR=$(mktemp -d)
+OMARCHY_PATH="$ROOT" HOME="$THEME_TMPDIR" OMARCHY_THEME_HEADLESS=1 "$ROOT/bin/omarchy-theme-set" "Tokyo Night"
+background_path=$(readlink -f "$THEME_TMPDIR/.config/omarchy/current/background" 2>/dev/null || true)
+expected_background="$THEME_TMPDIR/.config/omarchy/current/theme/backgrounds/0-swirl-buck.jpg"
+[[ $background_path == "$expected_background" ]] || fail "headless theme set creates current background symlink"
+[[ -f $background_path ]] || fail "headless theme background target exists"
+pass "headless theme set creates current background symlink"
+
 for binary in \
   omarchy-update \
   omarchy-theme-set \

test/shell.d/bluetooth-test.sh

@@ -4,6 +4,10 @@ set -euo pipefail
 
 source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
 
+grep -q '^ConditionPathIsDirectory=/sys/class/bluetooth$' "$ROOT/config/systemd/user/bt-agent.service" || \
+  fail "bt-agent is skipped on machines without Bluetooth hardware"
+pass "bt-agent is skipped on machines without Bluetooth hardware"
+
 run_node_test <<'JS'
 const bluetooth = requireFromRoot('shell/plugins/panels/bluetooth/Model.js')
 

test/shell.d/firewall-config-test.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(dirname -- "${BASH_SOURCE[0]}")/base-test.sh"
+
+stub_dir=$(mktemp -d)
+trap 'rm -rf "$stub_dir"' EXIT
+
+cat >"$stub_dir/ufw" <<'STUB'
+#!/bin/bash
+printf 'ufw %s\n' "$*" >>"$TEST_LOG"
+if [[ ${1:-} == status ]]; then
+  echo 'Status: inactive'
+fi
+STUB
+
+cat >"$stub_dir/ufw-docker" <<'STUB'
+#!/bin/bash
+set -euo pipefail
+PATH="/bin:/usr/bin:/sbin:/usr/sbin:/snap/bin/"
+printf 'ufw-docker %s\n' "$*" >>"$TEST_LOG"
+if ! ufw status 2>/dev/null | grep -Fq 'Status: active'; then
+  echo 'inactive' >&2
+  exit 1
+fi
+STUB
+
+cat >"$stub_dir/sed" <<'STUB'
+#!/bin/bash
+printf 'sed %s\n' "$*" >>"$TEST_LOG"
+if [[ ${1:-} == 0,/^PATH=* ]]; then
+  exec /usr/bin/sed "$@"
+fi
+exit 0
+STUB
+
+cat >"$stub_dir/systemctl" <<'STUB'
+#!/bin/bash
+printf 'systemctl %s\n' "$*" >>"$TEST_LOG"
+STUB
+
+chmod +x "$stub_dir"/*
+
+export TEST_LOG="$stub_dir/firewall.log"
+PATH="$stub_dir:$PATH" bash -eE -c 'source "$1"' bash "$ROOT/install/config/firewall.sh"
+
+grep -q '^ufw-docker install$' "$TEST_LOG" || fail "ufw-docker rules are installed"
+grep -q '^systemctl enable ufw$' "$TEST_LOG" || fail "ufw is enabled for next boot"
+
+pass "firewall config installs ufw-docker rules without activating live UFW"

test/shell.d/logging-test.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(dirname -- "${BASH_SOURCE[0]}")/base-test.sh"
+
+work_dir=$(mktemp -d)
+trap 'rm -rf "$work_dir"' EXIT
+
+failing_script="$work_dir/fail.sh"
+log_file="$work_dir/install.log"
+cat >"$failing_script" <<'SCRIPT'
+echo "about to fail"
+false
+SCRIPT
+
+set +e
+(
+  set -euo pipefail
+  export OMARCHY_INSTALL_LOG_FILE="$log_file"
+  source "$ROOT/install/helpers/logging.sh"
+  run_logged "$failing_script"
+  echo "unreachable"
+)
+status=$?
+set -e
+
+(( status != 0 )) || fail "run_logged returns failing script status"
+grep -q "Starting: $failing_script" "$log_file" || fail "run_logged logs script start"
+grep -q "about to fail" "$log_file" || fail "run_logged captures script output"
+grep -q "Failed: $failing_script (exit code: 1)" "$log_file" || fail "run_logged logs failed script before errexit exits"
+
+stdout_log="$work_dir/stdout.log"
+set +e
+(
+  set -euo pipefail
+  export OMARCHY_INSTALL_LOG_FILE="$work_dir/iso-owned.log"
+  export OMARCHY_LOG_TO_STDOUT=1
+  source "$ROOT/install/helpers/logging.sh"
+  run_logged "$failing_script"
+) >"$stdout_log" 2>&1
+stdout_status=$?
+set -e
+
+(( stdout_status != 0 )) || fail "stdout run_logged returns failing script status"
+[[ ! -e $work_dir/iso-owned.log ]] || fail "stdout logging mode does not write directly to install log"
+grep -q "Starting: $failing_script" "$stdout_log" || fail "stdout logging mode emits script start"
+grep -q "about to fail" "$stdout_log" || fail "stdout logging mode emits script output"
+grep -q "Failed: $failing_script (exit code: 1)" "$stdout_log" || fail "stdout logging mode emits failure marker"
+
+pass "run_logged records failures under errexit"