fix(ci): Remove conflicting packages

fix(ci): Fix end4 dependecies
fix(tests): Fix yamlint compliance with whitespace
2026-10-08 21:44:54 +11:00 · 2026-10-08 20:53:54 +11:00 · 2026-10-08 19:01:25 +11:00 · 2026-10-08 18:55:27 +11:00 · 2026-10-08 18:53:51 +11:00 · 2026-10-08 18:46:47 +11:00
249 changed files with 383369 additions and 949 deletions
@@ -0,0 +1,585 @@
+name: Automated Arch ISO Build
+
+on:
+  schedule:
+    - cron: "0 0 1 * *" # Runs monthly on the 1st day of the month
+  workflow_dispatch: # Allows manual triggers (multiple times a month)
+
+concurrency:
+  group: iso-build
+  cancel-in-progress: false # Never kill a build that is mid-flight
+
+jobs:
+  build:
+    runs-on: archlinux
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup local AUR repo
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          mkdir -p /tmp/localrepo
+          cp localrepo/*.pkg.tar.zst localrepo/local-aur.db* localrepo/local-aur.files* /tmp/localrepo/
+          sed -i 's|file:///home/alvin/AlvinArch/localrepo|file:///tmp/localrepo|' pacman.conf
+          # The medium needs its own copy: the ISO's /etc/pacman.conf points
+          # [local-aur] at file:///opt/localrepo, which pacstrap reads at
+          # install time to resolve packages that are not in the official repos
+          # (built during the ISO build and harvested there by
+          # airootfs/root/customize_airootfs.sh).
+          mkdir -p airootfs/opt/localrepo
+          shipped=(localrepo/*.pkg.tar.zst localrepo/local-aur.db* localrepo/local-aur.files*)
+          if (( ${#shipped[@]} > 0 )); then
+            cp -L "${shipped[@]}" airootfs/opt/localrepo/
+          fi
+          echo "airootfs/opt/localrepo: $(ls airootfs/opt/localrepo | wc -l) file(s)"
+
+      - name: Install archiso and dependencies
+        run: |
+          set -euo pipefail
+          # Install with a *private* config instead of /etc/pacman.conf.
+          # The host config is shared mutable state: the tests workflow
+          # rewrites it and jobs overlap on this runner (runs 132 and 133
+          # ran concurrently), so writing it here could corrupt a concurrent
+          # tests run. It also carries [cachyos] and [chaotic-aur] leftovers
+          # from tests.yaml, and syncing those two repos means extra DNS
+          # lookups against a gateway that intermittently drops UDP/53 —
+          # that is what failed run 131 at this very step. The build only
+          # needs archiso/jq from extra; mkarchiso reads the *profile's*
+          # pacman.conf for everything that goes into the ISO.
+          BUILD_CONF=$(mktemp)
+          trap 'rm -f "$BUILD_CONF"' EXIT
+          cat > "$BUILD_CONF" << 'STOCKCONF'
+          [options]
+          DisableSandbox
+          HoldPkg     = pacman glibc
+          Architecture = auto
+          CheckSpace
+          ParallelDownloads = 5
+          SigLevel    = Required DatabaseOptional
+          LocalFileSigLevel = Optional
+
+          [core]
+          Include = /etc/pacman.d/mirrorlist
+
+          [extra]
+          Include = /etc/pacman.d/mirrorlist
+          STOCKCONF
+          sed -i 's/^          //' "$BUILD_CONF"
+
+          # Warm the resolver cache for the mirrors we are about to query.
+          # systemd-resolved serves later lookups from cache, so a gateway
+          # UDP/53 burst cannot hit them again. Failures here are not fatal —
+          # the retry loop below is the real safety net.
+          for host in mirror.aarnet.edu.au gsl-syd.mm.fcix.net au.arch.niranjan.co; do
+            for try in 1 2 3 4 5; do
+              if getent hosts "$host" >/dev/null 2>&1; then
+                break
+              fi
+              echo "  ⏳ DNS for $host failed (try $try/5), retrying in $(( try * 3 ))s..."
+              sleep $(( try * 3 ))
+            done
+          done
+
+          # The gateway drops DNS queries in bursts; one burst must not fail
+          # the whole job, so retry with backoff before giving up.
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman --config "$BUILD_CONF" -Syu --noconfirm --needed archiso jq; then
+              synced=1
+              break
+            fi
+            echo "  ⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi
+
+      - name: Ensure /dev/fd symlinks exist for mkinitcpio and procsub
+        run: |
+          set -euo pipefail
+          # mkinitcpio's preset step pipes through /dev/stdin and bash process
+          # substitution (< <(...)) uses /dev/fd; both break if these symlinks
+          # are missing (they are normally created once at boot by mkinitcpio's
+          # init). Two places need them, so cover both:
+          # 1. the executor's own /dev: mkarchiso reads /dev/stdin on the host
+          #    (machine-id, version, pkglist) and the workflow's own scripts use
+          #    process substitution here. A no-op if the links already exist.
+          ln -sfn /proc/self/fd    /dev/fd
+          ln -sfn /proc/self/fd/0  /dev/stdin
+          ln -sfn /proc/self/fd/1  /dev/stdout
+          ln -sfn /proc/self/fd/2  /dev/stderr
+          # 2. the chroot's /dev: devtmpfs is single-instance, so mounting it
+          #    here yields the same tree that pacstrap/arch-chroot expose as
+          #    <chroot>/dev. When the executor's /dev is itself devtmpfs (1)
+          #    already fixed that tree; this pass is what makes it work when
+          #    the executor's /dev is a plain tmpfs or directory instead.
+          d="$(mktemp -d)"
+          trap 'umount "$d" 2>/dev/null || true; rmdir "$d" 2>/dev/null || true' EXIT
+          mount -t devtmpfs devtmpfs "$d"
+          ln -sfn /proc/self/fd    "$d/fd"
+          ln -sfn /proc/self/fd/0  "$d/stdin"
+          ln -sfn /proc/self/fd/1  "$d/stdout"
+          ln -sfn /proc/self/fd/2  "$d/stderr"
+          ls -l "$d/fd" "$d/stdin" "$d/stdout" "$d/stderr"
+          umount "$d"
+          rmdir "$d"
+          trap - EXIT
+
+      - name: Build Arch ISO
+        run: |
+          set -euo pipefail
+          # Pin one timestamp for the whole job: mkarchiso derives the ISO label,
+          # volume UUID, file mtimes, and ext4 hash seed from SOURCE_DATE_EPOCH.
+          # Exporting it explicitly makes every timestamp-derived value traceable
+          # (and lets later steps log the same value via $GITHUB_ENV).
+          SOURCE_DATE_EPOCH="$(date -u +%s)"
+          export SOURCE_DATE_EPOCH
+          echo "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" >> "$GITHUB_ENV"
+          echo "Building with SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"
+          # Clean up immediately even if this step is interrupted (cancel/exit):
+          # unmount leftovers first, then remove the multi-GB work dir.
+          trap 'umount -R "$PWD/work" 2>/dev/null || true; rm -rf "$PWD/work"' EXIT HUP INT TERM
+          rm -rf "$PWD/work"
+          # Always start from an empty out dir so stale ISOs are never re-uploaded
+          rm -rf "$PWD/out"
+          mkdir -p "$PWD/out"
+          mkarchiso -v -w "$PWD/work" -o "$PWD/out" -- "$PWD"
+
+      - name: Verify ISO search metadata
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          isos=(out/*.iso)
+          if (( ${#isos[@]} != 1 )); then
+            echo "❌ Expected exactly 1 ISO in out/, found ${#isos[@]}" >&2
+            exit 1
+          fi
+          iso=${isos[0]}
+
+          # blkid exits non-zero when a field is missing; keep going so the
+          # explicit guard below can report a useful error.
+          vol_uuid=$(blkid -o value -s UUID "$iso" || true)
+          vol_label=$(blkid -o value -s LABEL "$iso" || true)
+          if [ -z "$vol_uuid" ]; then
+            echo "❌ blkid found no UUID for $iso — volume date chain broken?" >&2
+            exit 1
+          fi
+          echo "Volume UUID:  $vol_uuid"
+          echo "Volume label: ${vol_label:-<none>}"
+          echo "SOURCE_DATE_EPOCH: ${SOURCE_DATE_EPOCH:-<unset>}"
+
+          fail() {
+            echo "❌ $1" >&2
+            echo "   If you changed boot configs (efiboot/, syslinux/, grub/) on purpose," >&2
+            echo "   update this 'Verify ISO search metadata' step to match." >&2
+            exit 1
+          }
+
+          # 1) /boot/<uuid>.uuid (the archisosearchfilename fallback key) must
+          #    exist inside the ISO and its stem must equal the volume UUID.
+          uuid_refs=0
+          while IFS= read -r member; do
+            [ -z "$member" ] && continue
+            member=${member#/}
+            stem=$(basename "$member" .uuid)
+            if [ "$stem" != "$vol_uuid" ]; then
+              fail "$member: stem '$stem' != volume UUID '$vol_uuid'"
+            fi
+            echo "  ✅ $member matches volume UUID"
+            uuid_refs=$((uuid_refs + 1))
+          done < <(bsdtar -tf "$iso" | grep -E '(^|/)boot/[0-9A-Za-z-]+\.uuid$' || true)
+          if (( uuid_refs == 0 )); then
+            fail "no /boot/<uuid>.uuid file found inside the ISO"
+          fi
+
+          # 2) Every archisosearchuuid= in shipped boot configs must equal the
+          #    volume UUID; every %ARCHISO% placeholder must have been substituted.
+          search_refs=0
+          while IFS= read -r member; do
+            [ -z "$member" ] && continue
+            member=${member#/}
+            if ! content=$(bsdtar -xOf "$iso" "$member" 2>/dev/null); then
+              fail "could not extract $member from the ISO"
+            fi
+            if printf '%s\n' "$content" | grep -q '%ARCHISO'; then
+              fail "$member contains an unsubstituted %ARCHISO% placeholder"
+            fi
+            while IFS= read -r val; do
+              [ -z "$val" ] && continue
+              search_refs=$((search_refs + 1))
+              if [ "$val" != "$vol_uuid" ]; then
+                fail "$member: archisosearchuuid=$val != volume UUID '$vol_uuid'"
+              fi
+              echo "  ✅ $member: archisosearchuuid=$val matches volume UUID"
+            done < <(printf '%s\n' "$content" | grep -o 'archisosearchuuid=[^[:space:]]*' | cut -d= -f2- || true)
+          done < <(bsdtar -tf "$iso" | grep -E '(^|/)(loader/entries/.*\.conf|boot/.*\.(cfg|conf))$' || true)
+          if (( search_refs == 0 )); then
+            fail "no archisosearchuuid= references found in shipped boot configs (params removed without updating this check?)"
+          fi
+
+          echo "✅ ISO search metadata consistent: $uuid_refs uuid file(s), $search_refs search reference(s)"
+
+      - name: Generate Unique Dynamic Tag
+        id: tag
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_API: http://192.168.1.168:3000/api/v1
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          test -n "$GITEA_TOKEN"
+
+          # Pre-flight: confirm the internal Gitea API is reachable so failures are clear
+          if ! curl -sfS -o /dev/null "$GITEA_API/version"; then
+            echo "❌ Cannot reach Gitea API at $GITEA_API" >&2
+            exit 1
+          fi
+
+          BASE_DATE=$(date -u +'%Y.%m.%d')
+          REVISION=1
+          TAG_NAME="iso-${BASE_DATE}-r${REVISION}"
+
+          # Check if the tag already exists via Gitea API, increment revision loop if it does
+          while curl -sf -o /dev/null -H "Authorization: token $GITEA_TOKEN" \
+            "$GITEA_API/repos/$REPOSITORY/releases/tags/$TAG_NAME"; do
+            REVISION=$((REVISION + 1))
+            TAG_NAME="iso-${BASE_DATE}-r${REVISION}"
+          done
+
+          echo "tag_name=${TAG_NAME}" >> "$GITHUB_OUTPUT"
+          echo "release_name=Arch Linux ISO (${BASE_DATE} Rev ${REVISION})" >> "$GITHUB_OUTPUT"
+
+      - name: Create Release and Upload ISO
+        id: release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          # Use internal Gitea URL to bypass traefik proxy timeout on large uploads
+          GITEA_API: http://192.168.1.168:3000/api/v1
+          REPOSITORY: ${{ github.repository }}
+          TAG_NAME: ${{ steps.tag.outputs.tag_name }}
+          RELEASE_NAME: ${{ steps.tag.outputs.release_name }}
+        run: |
+          set -eu
+          shopt -s nullglob
+          tmpdir=$(mktemp -d)
+          trap 'rm -rf "$tmpdir"' EXIT
+          if [ -z "$GITEA_TOKEN" ]; then
+            echo "❌ GITEA_TOKEN is empty" >&2
+            exit 1
+          fi
+          if [ -z "$TAG_NAME" ]; then
+            echo "❌ TAG_NAME is empty" >&2
+            exit 1
+          fi
+          if [ -z "$RELEASE_NAME" ]; then
+            echo "❌ RELEASE_NAME is empty" >&2
+            exit 1
+          fi
+
+          # Pre-flight: confirm the internal Gitea API is reachable so failures are clear
+          if ! curl -sfS -o /dev/null "$GITEA_API/version"; then
+            echo "❌ Cannot reach Gitea API at $GITEA_API" >&2
+            exit 1
+          fi
+
+          # Collect the ISOs produced by the build and record SHA-256
+          isos=(out/*.iso)
+          if (( ${#isos[@]} == 0 )); then
+            echo "❌ No ISO found in out/ — nothing to upload, aborting." >&2
+            exit 1
+          fi
+
+          sha256sums=()
+          for iso in "${isos[@]}"; do
+            fname=$(basename "$iso")
+            size=$(stat -c %s "$iso")
+            # Sanity check: a real ISO is multi-GB; anything tiny is the wrong file
+            if (( size < 100000000 )); then
+              echo "❌ '$iso' is only $size bytes — refusing to upload (not an ISO)." >&2
+              exit 1
+            fi
+            sha=$(sha256sum "$iso" | awk '{print $1}')
+            if [ -z "$sha" ]; then
+              echo "❌ Failed to compute SHA-256 for '$iso'" >&2
+              exit 1
+            fi
+            echo "  ✅ $fname: $(( size / 1024 / 1024 )) MiB, sha256=$sha"
+            sha256sums+=("$sha")
+          done
+
+          # Build the release body with SHA-256 checksums
+          printf -v body 'Arch Linux live ISO %s\n\nChecksums (SHA-256):\n' "$RELEASE_NAME"
+          for i in "${!isos[@]}"; do
+            # Release body: markdown backticks are literal (printf format below)
+            # shellcheck disable=SC2016
+            printf -v line -- '- `%s`: sha256 `%s`\n' "$(basename "${isos[$i]}")" "${sha256sums[$i]}"
+            body+="$line"
+          done
+
+          # Create the release (curl result written to a file, checked with if)
+          payload=$(jq -nc --arg tag "$TAG_NAME" --arg name "$RELEASE_NAME" --arg body "$body" \
+            '{tag_name:$tag,name:$name,body:$body}')
+          if ! curl -sf -X POST \
+              -H "Authorization: token $GITEA_TOKEN" \
+              -H "Content-Type: application/json" \
+              "$GITEA_API/repos/$REPOSITORY/releases" \
+              -d "$payload" -o "$tmpdir/release.json"; then
+            echo "❌ Failed to create release $TAG_NAME" >&2
+            exit 1
+          fi
+          if ! RELEASE_ID=$(jq -er '.id' "$tmpdir/release.json"); then
+            echo "❌ Release response contained no id" >&2
+            exit 1
+          fi
+          echo "release_id=${RELEASE_ID}" >> "$GITHUB_OUTPUT"
+          echo "  ✅ Created release $TAG_NAME (ID: $RELEASE_ID)"
+
+          # Upload each ISO as a release asset, up to 3 attempts per file
+          MAX_ATTEMPTS=3
+          for i in "${!isos[@]}"; do
+            iso=${isos[$i]}
+            fname=$(basename "$iso")
+            size=$(stat -c %s "$iso")
+            echo "Uploading $fname ($(( size / 1024 / 1024 )) MiB) to release $TAG_NAME..."
+            uploaded=0
+            attempt=1
+            while [ "$attempt" -le "$MAX_ATTEMPTS" ]; do
+              # Fresh output file each attempt: curl does not truncate -o on
+              # transport failure, so a stale body must not be misreported.
+              rm -f "$tmpdir/upload.json"
+              # A previous attempt may have saved the asset but lost the
+              # response; Gitea rejects duplicate names, so only after the
+              # first attempt check for and remove same-name leftovers
+              if [ "$attempt" -gt 1 ]; then
+                if curl -sf -H "Authorization: token $GITEA_TOKEN" \
+                    "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets" \
+                    -o "$tmpdir/assets.json"; then
+                  asset_ids=$(jq -r --arg name "$fname" \
+                    '.[] | select(.name == $name) | .id' "$tmpdir/assets.json")
+                  while read -r asset_id; do
+                    if [ -n "$asset_id" ]; then
+                      echo "  ↻ Removing leftover asset id=$asset_id from a previous attempt"
+                      if ! curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+                          "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets/$asset_id" \
+                          -o /dev/null; then
+                        echo "  ⚠️ Could not remove leftover asset id=$asset_id (continuing)" >&2
+                      fi
+                    fi
+                  done <<< "$asset_ids"
+                fi
+              fi
+
+              # Capture HTTP status explicitly: `-f` would swallow the Gitea
+              # error body (e.g. attachment size-limit messages) and leave the
+              # failure reason unknown.
+              if http_code=$(curl -sS -X POST --max-time 600 \
+                  -H "Authorization: token $GITEA_TOKEN" \
+                  -F "attachment=@$iso" \
+                  "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets" \
+                  -o "$tmpdir/upload.json" -w '%{http_code}'); then
+                if [ "${http_code:0:1}" = "2" ] \
+                    && download_url=$(jq -er '.browser_download_url' "$tmpdir/upload.json"); then
+                  echo "  ✅ Uploaded $fname (attempt $attempt/$MAX_ATTEMPTS): $download_url"
+                  uploaded=1
+                  break
+                fi
+                echo "  ⚠️ Upload of $fname: HTTP $http_code (attempt $attempt/$MAX_ATTEMPTS)" >&2
+                echo "  Response: $(head -c 2000 "$tmpdir/upload.json" 2>/dev/null)" >&2
+              else
+                rc=$?
+                echo "  ⚠️ Upload of $fname failed (attempt $attempt/$MAX_ATTEMPTS): curl exit $rc, HTTP ${http_code:-000}" >&2
+                if [ -s "$tmpdir/upload.json" ]; then
+                  echo "  Response: $(head -c 2000 "$tmpdir/upload.json")" >&2
+                fi
+              fi
+
+              if [ "$attempt" -lt "$MAX_ATTEMPTS" ]; then
+                sleep $(( attempt * 10 ))
+              fi
+              attempt=$(( attempt + 1 ))
+            done
+
+            if [ "$uploaded" -ne 1 ]; then
+              echo "❌ Failed to upload $fname after $MAX_ATTEMPTS attempts — aborting." >&2
+              exit 1
+            fi
+          done
+
+          echo "✅ All ISOs uploaded to release $TAG_NAME"
+          exit 0
+
+      - name: Verify uploaded ISO checksums
+        if: success()
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          # Internal origin bypasses traefik (and its Anubis bot wall) — the
+          # same host the upload step already uses.
+          GITEA_API: http://192.168.1.168:3000/api/v1
+          GITEA_ORIGIN: http://192.168.1.168:3000
+          REPOSITORY: ${{ github.repository }}
+          TAG_NAME: ${{ steps.tag.outputs.tag_name }}
+          RELEASE_ID: ${{ steps.release.outputs.release_id }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          tmpdir=$(mktemp -d)
+          trap 'rm -rf "$tmpdir"' EXIT
+
+          for var in GITEA_TOKEN TAG_NAME RELEASE_ID; do
+            if [ -z "${!var:-}" ]; then
+              echo "❌ $var is empty" >&2
+              exit 1
+            fi
+          done
+          case "$RELEASE_ID" in
+            ''|*[!0-9]*) echo "❌ RELEASE_ID is not numeric: $RELEASE_ID" >&2; exit 1 ;;
+          esac
+
+          # fail_verify <reason...>: job fails but the release is kept — used
+          # for transport/API errors where the upload itself may be fine.
+          fail_verify() {
+            echo "❌ $1" >&2
+            echo "   Release $TAG_NAME (ID $RELEASE_ID) left in place (not proven corrupt)." >&2
+            exit 1
+          }
+
+          # abort_release <reason...>: the asset is provably wrong — delete the
+          # release so a corrupt asset can never be published, then fail.
+          abort_release() {
+            echo "❌ $1" >&2
+            echo "Deleting release $TAG_NAME (ID $RELEASE_ID) so the bad upload cannot be used..." >&2
+            if ! curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+                "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID" -o /dev/null; then
+              echo "⚠️ Could not delete release $RELEASE_ID — delete it manually!" >&2
+            fi
+            exit 1
+          }
+
+          isos=(out/*.iso)
+          if (( ${#isos[@]} == 0 )); then
+            echo "❌ No ISO in out/ to verify" >&2
+            exit 1
+          fi
+
+          # Recompute local checksums
+          declare -A local_sha local_size
+          for iso in "${isos[@]}"; do
+            fname=$(basename "$iso")
+            local_sha["$fname"]=$(sha256sum "$iso" | awk '{print $1}')
+            local_size["$fname"]=$(stat -c %s "$iso")
+            if [ -z "${local_sha[$fname]}" ]; then
+              echo "❌ Failed to compute SHA-256 for '$iso'" >&2
+              exit 1
+            fi
+          done
+
+          # List the release's assets as uploaded (API error = transient, no delete)
+          if ! curl -sf -H "Authorization: token $GITEA_TOKEN" \
+              "$GITEA_API/repos/$REPOSITORY/releases/$RELEASE_ID/assets" \
+              -o "$tmpdir/assets.json"; then
+            fail_verify "Failed to list assets of release $RELEASE_ID (API/transport error)"
+          fi
+
+          for iso in "${isos[@]}"; do
+            fname=$(basename "$iso")
+            api_size=$(jq -er --arg name "$fname" \
+              '.[] | select(.name == $name) | .size' "$tmpdir/assets.json" 2>/dev/null) \
+              || abort_release "Asset '$fname' missing from release $RELEASE_ID"
+            if [ "$api_size" != "${local_size[$fname]}" ]; then
+              abort_release "Asset '$fname' size mismatch: server=$api_size local=${local_size[$fname]}"
+            fi
+
+            # Download from the internal origin (traefik/Anubis bypassed).
+            # iso_name contains a space ("Alvin archlinux"), so the filename
+            # must be percent-encoded or curl rejects the URL outright.
+            enc_fname=$(jq -rn --arg v "$fname" '$v|@uri')
+            url="$GITEA_ORIGIN/$REPOSITORY/releases/download/$TAG_NAME/$enc_fname"
+            downloaded=0
+            for attempt in 1 2 3; do
+              # Try header auth, then ?token=, then anonymous (public repo).
+              if curl -sfL --max-time 600 -H "Authorization: token $GITEA_TOKEN" \
+                  "$url" -o "$tmpdir/$fname"; then
+                downloaded=1
+              elif curl -sfL --max-time 600 "$url?token=$GITEA_TOKEN" \
+                  -o "$tmpdir/$fname"; then
+                downloaded=1
+              elif curl -sfL --max-time 600 "$url" -o "$tmpdir/$fname"; then
+                downloaded=1
+              fi
+              [ "$downloaded" -eq 1 ] && break
+              echo "  ⚠️ Download of $fname failed (attempt $attempt/3)" >&2
+              [ "$attempt" -lt 3 ] && sleep $(( attempt * 10 ))
+            done
+            if [ "$downloaded" -ne 1 ]; then
+              fail_verify "Could not download asset '$fname' back from release $RELEASE_ID (auth/transport error, not proven corrupt)"
+            fi
+
+            actual=$(sha256sum "$tmpdir/$fname" | awk '{print $1}')
+            expected=${local_sha[$fname]}
+            if [ "$actual" != "$expected" ]; then
+              abort_release "SHA-256 mismatch for '$fname': server=$actual local=$expected"
+            fi
+            echo "  ✅ $fname: size and SHA-256 match"
+            rm -f "$tmpdir/$fname"
+          done
+
+          echo "✅ All uploaded assets verified against local ISO checksums"
+          exit 0
+
+      - name: Keep only latest 2 releases
+        if: success()
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_API: http://192.168.1.168:3000/api/v1
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          test -n "$GITEA_TOKEN"
+
+          echo "Pruning old releases in $REPOSITORY..."
+          readarray -t ids < <(curl -sf -H "Authorization: token $GITEA_TOKEN" \
+            "$GITEA_API/repos/$REPOSITORY/releases" \
+            | jq -er 'sort_by(.created_at) | .[].id')
+
+          to_delete=$(( ${#ids[@]} - 2 ))
+          if (( to_delete > 0 )); then
+            for ((i = 0; i < to_delete; i++)); do
+              id=${ids[$i]}
+              echo "Deleting old release ID: $id"
+              curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+                "$GITEA_API/repos/$REPOSITORY/releases/$id"
+            done
+          fi
+
+      - name: Cleanup mkarchiso mounts and workdirs
+        if: always() # Runs on success, failure, or cancellation
+        run: |
+          set -eu
+          # Steps run as root (pacman is used directly); fall back to sudo if not
+          if [ "$(id -u)" -eq 0 ]; then
+            PRIV=""
+          else
+            PRIV="sudo"
+          fi
+
+          # Unmount any leftover loop devices or bind mounts in the work directory
+          $PRIV umount -R "$PWD/work" 2>/dev/null || true
+
+          # Clean up loop devices if any remain attached to the work dir
+          $PRIV losetup -D || true
+
+          # Remove working directories with proper permissions
+          $PRIV rm -rf "$PWD/work"
+
+      - name: Remove built ISO
+        if: always()
+        run: |
+          set -eu
+          rm -rf "$PWD/out"
@@ -0,0 +1,26 @@
+name: Upstream pin check
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # Mondays 06:00 UTC — catches upstream/Qt drift between ISO builds
+  workflow_dispatch:
+  push:
+    paths:
+      - "localrepo/end4-pkgbuilds/quickshell-git/PKGBUILD"
+      - "localrepo/check-quickshell-pin.sh"
+      - "airootfs/root/customize_airootfs.sh"
+      - ".gitea/workflows/pin-check.yaml"
+
+jobs:
+  quickshell-pin:
+    runs-on: archlinux
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      # Tripwire for the failure mode that broke ISO build run 137:
+      # a quickshell pin (ours or end-4's) that predates a Qt compat fix
+      # or has simply gone stale. Fails the job so the drift is visible
+      # in Actions instead of surfacing as a 3-hour ISO build failure.
+      - name: Check quickshell pins
+        run: ./localrepo/check-quickshell-pin.sh
@@ -0,0 +1,342 @@
+name: Tests
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  tests:
+    runs-on: archlinux
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Reset pacman.conf to stock
+        run: |
+          cat > /etc/pacman.conf << 'STOCKCONF'
+          [options]
+          DisableSandbox
+          HoldPkg     = pacman glibc
+          Architecture = auto
+          CheckSpace
+          ParallelDownloads = 5
+          SigLevel    = Required DatabaseOptional
+          LocalFileSigLevel = Optional
+
+          [core]
+          Include = /etc/pacman.d/mirrorlist
+
+          [extra]
+          Include = /etc/pacman.d/mirrorlist
+          STOCKCONF
+          sed -i 's/^          //' /etc/pacman.conf
+
+          # Remove stale sync databases for custom repos
+          rm -f /var/lib/pacman/sync/cachyos* /var/lib/pacman/sync/chaotic*
+
+      - name: Install prerequisites
+        run: |
+          # The gateway intermittently drops UDP/53 (it failed build run 131
+          # at the equivalent step); retry with backoff instead of dying on
+          # the first bad DNS burst.
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman -Syu --noconfirm --needed shellcheck yamllint; then
+              synced=1
+              break
+            fi
+            echo "⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi
+
+      - name: Set up CachyOS repo
+        run: |
+          pacman-key --recv-keys F3B607488DB35A47 --keyserver keyserver.ubuntu.com
+          pacman-key --lsign-key F3B607488DB35A47
+
+          pacman -U --noconfirm \
+            'https://mirror.cachyos.org/repo/x86_64/cachyos/cachyos-keyring-20240331-1-any.pkg.tar.zst' \
+            'https://mirror.cachyos.org/repo/x86_64/cachyos/cachyos-mirrorlist-27-1-any.pkg.tar.zst'
+
+          # Fix the mirrorlist URL (pacnew has wrong format)
+          printf '%s\n' 'Server = https://mirror.cachyos.org/repo/$arch/$repo' \
+            > /etc/pacman.d/cachyos-mirrorlist
+
+          printf '\n[cachyos]\nInclude = /etc/pacman.d/cachyos-mirrorlist\n' \
+            >> /etc/pacman.conf
+
+          # Retry: gateway drops UDP/53 in bursts (see run 131)
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman -Syu --noconfirm --needed; then
+              synced=1
+              break
+            fi
+            echo "⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi
+
+      - name: Set up chaotic-aur repo
+        run: |
+          pacman -U --noconfirm \
+            'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-keyring.pkg.tar.zst' \
+            'https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-mirrorlist.pkg.tar.zst'
+
+          printf '\n[chaotic-aur]\nInclude = /etc/pacman.d/chaotic-mirrorlist\n' \
+            >> /etc/pacman.conf
+
+          # Retry: gateway drops UDP/53 in bursts (see run 131)
+          synced=0
+          for try in 1 2 3 4 5; do
+            if pacman -Syu --noconfirm --needed; then
+              synced=1
+              break
+            fi
+            echo "⚠️ pacman -Syu failed (attempt $try/5), retrying in $(( try * 15 ))s..." >&2
+            sleep $(( try * 15 ))
+          done
+          if [ "$synced" -ne 1 ]; then
+            echo "❌ pacman -Syu failed after 5 attempts — giving up" >&2
+            exit 1
+          fi
+
+      - name: Lint shell scripts with ShellCheck
+        run: |
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  Running ShellCheck on all .sh files"
+          echo "═══════════════════════════════════════════════════════════════"
+
+          SH_FILES=$(find . -name '*.sh' -not -path './.git/*')
+          if [ -z "$SH_FILES" ]; then
+            echo "No shell scripts found."
+            exit 0
+          fi
+
+          FAILED=0
+          while IFS= read -r f; do
+            echo ""
+            echo "── Checking: $f"
+            if shellcheck -x -s bash "$f"; then
+              echo "  ✅ $f passed"
+            else
+              echo "  ❌ $f failed"
+              FAILED=1
+            fi
+          done <<< "$SH_FILES"
+
+          if [ "$FAILED" -ne 0 ]; then
+            echo ""
+            echo "═══════════════════════════════════════════════════════════════"
+            echo "  ❌ One or more shell scripts have syntax issues"
+            echo "═══════════════════════════════════════════════════════════════"
+            exit 1
+          fi
+
+          echo ""
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  ✅ All shell scripts passed ShellCheck"
+          echo "═══════════════════════════════════════════════════════════════"
+
+      - name: Lint YAML files with yamllint
+        run: |
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  Running yamllint on all YAML files"
+          echo "═══════════════════════════════════════════════════════════════"
+
+          YAML_FILES=$(find . -not -path './.git/*' \( -name '*.yml' -o -name '*.yaml' \))
+          if [ -z "$YAML_FILES" ]; then
+            echo "No YAML files found."
+            exit 0
+          fi
+
+          FAILED=0
+          while IFS= read -r f; do
+            echo ""
+            echo "── Checking: $f"
+            if yamllint -d "{extends: relaxed, rules: {document-start: disable, line-length: disable, new-line-at-end-of-file: disable}}" "$f"; then
+              echo "  ✅ $f passed"
+            else
+              echo "  ❌ $f failed"
+              FAILED=1
+            fi
+          done <<< "$YAML_FILES"
+
+          if [ "$FAILED" -ne 0 ]; then
+            echo ""
+            echo "═══════════════════════════════════════════════════════════════"
+            echo "  ❌ One or more YAML files have syntax issues"
+            echo "═══════════════════════════════════════════════════════════════"
+            exit 1
+          fi
+
+          echo ""
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  ✅ All YAML files passed yamllint"
+          echo "═══════════════════════════════════════════════════════════════"
+
+      - name: Validate packages.x86_64 syntax
+        run: |
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  Validating packages.x86_64 format"
+          echo "═══════════════════════════════════════════════════════════════"
+
+          if [ ! -f packages.x86_64 ]; then
+            echo "packages.x86_64 not found, skipping."
+            exit 0
+          fi
+
+          FAILED=0
+          LINENUM=0
+          while IFS= read -r line; do
+            LINENUM=$((LINENUM + 1))
+            # Skip empty lines and comments
+            [[ -z "$line" || "$line" =~ ^# ]] && continue
+
+            # Check for invalid characters
+            if [[ ! "$line" =~ ^[a-zA-Z0-9._@+\-]+$ ]]; then
+              echo "❌ Line $LINENUM: invalid package name format: '$line'"
+              FAILED=1
+            fi
+
+            # Check for trailing whitespace
+            if [[ "$line" =~ [[:space:]]$ ]]; then
+              echo "⚠️  Line $LINENUM: trailing whitespace: '$line'"
+              FAILED=1
+            fi
+          done < packages.x86_64
+
+          if [ "$FAILED" -ne 0 ]; then
+            echo ""
+            echo "═══════════════════════════════════════════════════════════════"
+            echo "  ❌ packages.x86_64 has syntax issues"
+            echo "═══════════════════════════════════════════════════════════════"
+            exit 1
+          fi
+
+          echo ""
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  ✅ packages.x86_64 syntax is valid"
+          echo "═══════════════════════════════════════════════════════════════"
+
+      - name: Check all packages
+        run: |
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  Checking packages.x86_64 against repos"
+          echo "  Allowed repos: cachyos, extra, multilib, chaotic-aur"
+          echo "  Also accepted: localrepo/ pre-built packages"
+          echo "  Also accepted: packages listed in build-end4-deps.sh"
+          echo "═══════════════════════════════════════════════════════════════"
+
+          ALLOWED_REPOS="^(core|extra|multilib|cachyos|chaotic-aur)$"
+          MISSING=()
+          FOUND=0
+          TOTAL=0
+
+          while IFS= read -r pkg; do
+            # Skip empty lines and comments
+            [[ -z "$pkg" || "$pkg" =~ ^# ]] && continue
+            TOTAL=$((TOTAL + 1))
+
+            # 1) Check allowed repos via pacman
+            repos=$(pacman -Si "$pkg" 2>/dev/null | grep "^Repository" | awk '{print $3}' | tr -d '\r')
+            MATCHED=0
+            for repo in $repos; do
+              if [[ "$repo" =~ $ALLOWED_REPOS ]]; then
+                MATCHED=1
+                FOUND=$((FOUND + 1))
+                break
+              fi
+            done
+
+            # 2) Check localrepo/ for a pre-built .pkg.tar.zst
+            if [[ $MATCHED -eq 0 ]] && compgen -G "localrepo/${pkg}-*.pkg.tar.zst" > /dev/null 2>&1; then
+              MATCHED=1
+              FOUND=$((FOUND + 1))
+              echo "📦 LOCAL: $pkg (pre-built in localrepo/)"
+            fi
+
+            # 3) Check build-end4-deps.sh for the package name
+            if [[ $MATCHED -eq 0 ]] && grep -qxF "${pkg}" localrepo/build-end4-deps.sh 2>/dev/null; then
+              MATCHED=1
+              FOUND=$((FOUND + 1))
+              echo "📦 BUILD: $pkg (listed in build-end4-deps.sh)"
+            fi
+
+            if [[ $MATCHED -eq 0 ]]; then
+              if [[ -z "$repos" ]]; then
+                echo "❌ MISSING: $pkg"
+              else
+                echo "⚠️  WRONG REPO: $pkg (found in: $repos)"
+              fi
+              MISSING+=("$pkg")
+            fi
+          done < packages.x86_64
+
+          echo ""
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  Results: $FOUND / $TOTAL packages found in allowed repos"
+          echo "═══════════════════════════════════════════════════════════════"
+
+          if [[ ${#MISSING[@]} -gt 0 ]]; then
+            echo ""
+            echo "⚠️  ${#MISSING[@]} package(s) NOT in allowed repos:"
+            for p in "${MISSING[@]}"; do
+              echo "  • $p"
+            done
+            echo ""
+            echo "These packages must be in:"
+            echo "  • cachyos, extra, multilib, or chaotic-aur"
+            echo "  • OR pre-built in localrepo/"
+            echo "  • OR added to build-end4-deps.sh"
+            exit 1
+          else
+            echo ""
+            echo "✅ All packages verified successfully!"
+          fi
+
+      - name: Check for conflicting packages
+        run: |
+          echo "═══════════════════════════════════════════════════════════════"
+          echo "  Checking for conflicting packages in packages.x86_64"
+          echo "═══════════════════════════════════════════════════════════════"
+
+          # Sync databases first so pacman knows what exists
+          sudo pacman -Sy --noconfirm
+
+          # Collect only packages that exist in the official repositories
+          PKGS=()
+          while IFS= read -r pkg; do
+            [[ -z "$pkg" || "$pkg" =~ ^# ]] && continue
+
+            # Check if the package exists in official repos
+            if pacman -Si "$pkg" >/dev/null 2>&1; then
+              PKGS+=("$pkg")
+            else
+              echo "⚠️ Skipping AUR/missing package: $pkg"
+            fi
+          done < packages.x86_64
+
+          # Run conflict check only if we have official packages to test
+          if [ ${#PKGS[@]} -eq 0 ]; then
+            echo "✅ No official packages to check."
+          elif CONFLICTS=$(pacman -Sp --needed "${PKGS[@]}" 2>&1); then
+            echo "✅ No package conflicts detected among official packages"
+          else
+            echo "------- Pacman Output -------"
+            echo "$CONFLICTS"
+            echo "-----------------------------"
+            echo ""
+            echo "═══════════════════════════════════════════════════════════════"
+            echo "  ❌ Conflicting packages found — fix packages.x86_64"
+            echo "═══════════════════════════════════════════════════════════════"
+            exit 1
+          fi
@@ -0,0 +1,11 @@
+# Multi-GB mkarchiso output (see AGENTS.md build command)
+work/
+out/
+
+# In-image copy of localrepo/ — populated by localrepo/update.sh and
+# .gitea/workflows/build-iso.yaml, shipped as /opt/localrepo on the ISO
+airootfs/opt/localrepo/
+
+# Build stamp staged by profiledef.sh at ISO build time (see AGENTS.md);
+# consumed by customize_airootfs.sh, never committed
+airootfs/root/.iso-build-stamp
@@ -0,0 +1,115 @@
+# AGENTS.md
+
+Arch Linux ISO profile (archiso). Builds a live ISO with Hyprland desktop, end-4 dots-hyprland, and curated packages. Hosted on Gitea.
+
+## Build & Test Commands
+
+```bash
+# Build the ISO (repo root IS the profile directory)
+sudo mkarchiso -v -w work -o out/ .
+
+# Build AUR deps for end-4 (run locally before ISO build if localrepo/ is stale)
+./localrepo/build-end4-deps.sh          # build all
+./localrepo/build-end4-deps.sh --quick  # skip large AUR pkgs
+
+# Refresh localrepo DB after adding/moving .pkg.tar.zst files
+./localrepo/update.sh                    # re-indexes existing packages
+./localrepo/update.sh pkg1.pkg.tar.zst   # add files, then re-index
+```
+
+`update.sh` also refreshes `airootfs/opt/localrepo/` (the copy that ships on the
+ISO), so run it after touching `localrepo/` before building.
+
+## CI Checks (must pass before merge)
+
+- **ShellCheck**: all `.sh` files checked with `shellcheck -x -s bash`
+- **yamllint**: all `.yml`/`.yaml` files (relaxed config)
+- **packages.x86_64 syntax**: one package per line, no trailing whitespace, `[a-zA-Z0-9._@+\-]+` only
+- **Package repo check**: every package in `packages.x86_64` must be resolvable via `pacman -Si` in allowed repos (`cachyos`, `extra`, `multilib`, `chaotic-aur`), OR have a pre-built `.pkg.tar.zst` in `localrepo/`, OR appear in `localrepo/build-end4-deps.sh`
+
+## Package Management
+
+**Three sources** contribute packages to the ISO:
+
+1. **`packages.x86_64`** — main list, installed by mkarchiso. Must be in an allowed repo.
+2. **`localrepo/*.pkg.tar.zst`** — pre-built AUR packages. The `local-aur` repo is configured in `pacman.conf` and picked up by mkarchiso automatically.
+3. **`build-end4-deps.sh`** — builds end-4 AUR deps at build time.
+
+There is a **fourth source**: `customize_airootfs.sh` runs end-4's own
+`./setup install-deps` inside the image (as a throwaway `ii-builder` account),
+which resolves and compiles everything the dotfiles need (quickshell, MicroTeX,
+theming, fonts, ...). Those packages are installed in the live system, land in
+`pkglist.x86_64.txt`, and are harvested into `/opt/localrepo` so pacstrap can
+install them into the target without the network.
+
+**Important**: `localrepo/update.sh` auto-appends new package names to `packages.x86_64`. If you remove a package from `packages.x86_64` that exists in `localrepo/`, it will be re-added on the next `update.sh` run.
+
+## Key Files
+
+| File | Purpose |
+|------|---------|
+| `packages.x86_64` | Live ISO package list (~402 packages) |
+| `profiledef.sh` | ISO metadata, compression, boot modes, build-stamp staging |
+| `pacman.conf` | Repos: cachyos → core → extra → multilib → chaotic-aur → local-aur |
+| `bootstrap_packages` | Minimal build-time packages (`base`, `arch-install-scripts`) |
+| `airootfs/root/customize_airootfs.sh` | Runs inside chroot during build: keyrings, skel dotfiles (incl. end4-pC), qsConfig patch, end-4 `install-deps`, package harvest, uv/font pre-warm |
+| `airootfs/root/.live-pacman.conf` | `/etc/pacman.conf` of the built image (adds `[local-aur]` = `file:///opt/localrepo`) |
+| `airootfs/usr/local/bin/alvin-install` | Installer: partitions, pacstrap, LUKS (systemd initramfs **or** experimental unl0kr + optional TPM2 unlock), user, git identity + GitHub SSH keys, login manager (none/greetd/sddm/gdm) + autologin, optional sshd (default on), end-4 dotfiles (`--skip-alldeps`), boot |
+| `localrepo/build-end4-deps.sh` | Non-interactive AUR builds for end-4 dependencies |
+| `localrepo/update.sh` | Regenerates localrepo DB, syncs names to packages.x86_64, syncs `airootfs/opt/localrepo/` |
+| `localrepo/check-quickshell-pin.sh` | Tripwire: our quickshell pin and end-4's must include the Qt 6.12 fix and stay <45d old (`QUICKSHELL_PIN_MAX_AGE_DAYS` overrides) |
+| `.gitea/workflows/pin-check.yaml` | Runs the pin check weekly (Mon 06:00), on dispatch, and on pushes touching pins/`customize_airootfs.sh` |
+
+## alvin-install (installer inside the ISO)
+
+Source: `airootfs/usr/local/bin/alvin-install` (~1,880 lines, **no `.sh` extension**).
+The airootfs overlay ships it as `/usr/local/bin/alvin-install` (mode `0755` forced in
+`profiledef.sh` `file_permissions`), and `/etc/motd` advertises it on the live medium.
+
+- **Invoke**: as root from the live session. Hard requirements: `gum` and UEFI —
+  `check_prereqs` exits if `/sys/firmware/efi` is missing. Log: `/var/log/alvin-install.log`
+  (copied into the target at the end; `ERR` trap prints the failing line).
+- **Structure**: `main()` runs 16 `screen_*` TUI functions (collect answers: welcome, keymap,
+  network, disk, luks, unl0kr, filesystem, username, password, hostname, git, timezone,
+  locale, login manager, sshd, summary) then a fixed order of `install_*` steps
+  (partition → LUKS → format/mount → pacstrap → fstab → repos → timezone → locale →
+  hostname → network → sshd → user → git/SSH → end-4 dots → mkinitcpio → bootloader →
+  TPM/unl0kr → login manager → autologin → cleanup). Screens and install steps are
+  independent — edit one without
+  touching the other. An `EXIT` trap unmounts `$TARGET` and closes `cryptroot` on any exit.
+- **Package list**: `install_pacstrap` builds the *installed* system's list from the medium's
+  `/run/archiso/bootmnt/arch/pkglist.x86_64.txt` (i.e. `pacman -Q` of the live ISO), so
+  `packages.x86_64` changes flow into installed systems. It drops `PKGS_EXCLUDE`
+  (`archiso mkinitcpio-archiso mkinitcpio-nfs-utils syslinux memtest86+`) plus names not
+  resolvable in the live repos, then always appends hardcoded essentials
+  (`base linux linux-firmware linux-cachyos networkmanager grub efibootmgr sudo git …`).
+- **CI never lints it**: the shellcheck step globs only `*.sh`. Check manually after edits:
+  `shellcheck -x -s bash airootfs/usr/local/bin/alvin-install`
+- end-4 quirks (`--skip-alldeps`, `yes i`, end4-pC re-copy) are in [Gotchas](#gotchas) below.
+
+## Verify a single change locally (mirrors CI)
+
+```bash
+shellcheck -x -s bash <script>.sh          # plus the alvin-install command above
+yamllint -d "{extends: relaxed, rules: {document-start: disable, line-length: disable, new-line-at-end-of-file: disable}}" <file>.yaml
+```
+
+`packages.x86_64` syntax: one package per line, `[a-zA-Z0-9._@+\-]+` only, no trailing
+whitespace.
+
+## Gotchas
+
+- The profile root is the **repo root** (not a `releng/` subdirectory). CI builds with `mkarchiso -v -w "$PWD/work" -o "$PWD/out" -- "$PWD"` (`.gitea/workflows/build-iso.yaml`), and the local build command above does the same — never pass a `releng` path.
+- `customize_airootfs.sh` clones git repos (oh-my-zsh, lazy.nvim, plugins, end-4 dots) into `/etc/skel` and `/opt` during the ISO build. These require network access at build time but make the live ISO work offline.
+- `customize_airootfs.sh` runs `./setup install-deps -f -s --skip-plasmaintg` as the throwaway user `ii-builder` (end-4's scripts refuse to run as root) and aborts the build if it fails. `--skip-plasmaintg` is deliberate: that optional Firefox widget pulls 410 packages / 526 MiB of KDE.
+- The `[local-aur]` repo path in `pacman.conf` (`file:///home/alvin/alvinarch/localrepo`) is for local builds only. The CI does not use this path.
+- The **image** ships its own `[local-aur]` at `file:///opt/localrepo` (see `.live-pacman.conf`). It holds `localrepo/` (copied by CI/`update.sh`) plus everything `install-deps` built. pacstrap runs without `-P`, so the target keeps the stock `/etc/pacman.conf`; `alvin-install` strips `[local-aur]` from it anyway as a safety net, because `/opt/localrepo` exists only on the medium.
+- `alvin-install` runs end-4 with `--skip-alldeps` — dependencies must come from the ISO. It feeds `yes i` to end-4's failure prompt: inside the installer chroot the medium's `/run` is bind-mounted in, so end-4's `systemctl --machine=…@.host --user enable … --now` lines can never work (and `--now` would start services on the live medium). `install_end4_dots` re-applies the enable-only part (bluetooth, ydotool, i2c module) outside the chroot and reports every step end-4 had to skip. If the end-4 step reports "incomplete", check that `hyprctl`/`quickshell`/the venv were resolvable (harvest) before re-running anything.
+- `/etc/skel/.cache/uv` + `/etc/skel/.local/share/uv/python` are pre-warmed by the build (~460 MB: CPython 3.12 and the pinned wheel cache) so end-4's `uv venv`/`uv pip install` at install time needs no network.
+- **end4-pC** (`pctrade/end4-pC`) is the default quickshell config: cloned into `/etc/skel/.config/quickshell/end4-pC` at build time, selected by patching `hl.env("qsConfig", "ii")` → `"end4-pC"` in the **staged** `/opt/dots-hyprland/dots/.config/hypr/hyprland/variables.lua` (there is no `hypr/hyprland/` in this repo — `./setup install` copies it to the installed system). `alvin-install` re-copies end4-pC into the user's home *after* `./setup install`, because end-4's installer `rsync --delete`s all of `~/.config/quickshell`.
+- `airootfs/etc/skel/.config/illogical-impulse/presets/` carries the user's presets (`Laptop.json`, `Personal-Performance.json`, `Personal-Performance.zip`). They embed `/home/alvin/...` paths, so wallpapers/screenshots need fixing up after install.
+- End-4 metapackages are built from `localrepo/end4-pkgbuilds/` (quickshell-git, bibata-modern-classic-bin, microtex-git).
+- **quickshell pin / Qt 6.12**: end-4 pins quickshell to `41651d7` (Sep 25), which predates upstream fix `5d5d498` (Oct 3, *"use MOC includes instead of opaque pointer definitions — … Qt 6.12 compatibility"*). Arch shipped qt6 6.12.0 on Oct 8 and the old pin died with `Meta Types must be fully defined` in the moc build of quickshell-hyprland-ipc (failed CI run 137). `customize_airootfs.sh` therefore rewrites end-4's `_commit` to `11ca60be` after cloning — but **only** while it still matches `^_commit='41651d7`, so once end-4 bumps their own pin the guard goes inert and theirs wins. `localrepo/check-quickshell-pin.sh` (weekly `pin-check.yaml` job) fails CI if either pin goes stale or loses the fix; it warns instead of failing when end-4's known-stale pin is covered by the override.
+- `packages.x86_64` is sorted alphabetically. Keep it sorted when adding/removing entries.
+- `airootfs/opt/localrepo/` is a build artifact (gitignored) — never commit it.
+- **Build stamp flow**: `profiledef.sh` (sourced by mkarchiso) stages the gitignored `airootfs/root/.iso-build-stamp` when a `.git` dir exists **or** `CI`/`GITEA_ACTIONS` is set — line reads `AlvinArch build <date> | commit <date> | <4-char hash>` (falls back to `commit unknown` if `git -c safe.directory` can't read the repo; without `.git`/CI no file is staged). `customize_airootfs.sh` keeps it as `/etc/alvin-build-stamp` on the live medium **and appends it to the live `/etc/motd`**, so the booted ISO identifies its build. The installed system's motd is never touched by us — `alvin-install` has no motd step (an earlier `install_motd` that copied the banner + stamp into the target was removed on purpose).
@@ -0,0 +1,298 @@
+##
+## Example config file for clamav-milter
+##
+
+# Comment or remove the line below.
+#Example
+
+
+##
+## Main options
+##
+
+# Define the interface through which we communicate with sendmail
+# This option is mandatory! Possible formats are:
+# [[unix|local]:]/path/to/file - to specify a unix domain socket
+# inet:port@[hostname|ip-address] - to specify an ipv4 socket
+# inet6:port@[hostname|ip-address] - to specify an ipv6 socket
+#
+# Default: no default
+#MilterSocket /run/clamav/clamav-milter.sock
+#MilterSocket /tmp/clamav-milter.sock
+#MilterSocket inet:7357
+
+# Define the group ownership for the (unix) milter socket.
+# Default: disabled (the primary group of the user running clamd)
+#MilterSocketGroup virusgroup
+
+# Sets the permissions on the (unix) milter socket to the specified mode.
+# Default: disabled (obey umask)
+#MilterSocketMode 660
+
+# Remove stale socket after unclean shutdown.
+#
+# Default: yes
+#FixStaleSocket yes
+
+# Run as another user (clamav-milter must be started by root for this option
+# to work)
+#
+# Default: unset (don't drop privileges)
+User clamav
+
+# Waiting for data from clamd will timeout after this time (seconds).
+# Value of 0 disables the timeout.
+#
+# Default: 120
+#ReadTimeout 300
+
+# Don't fork into background.
+#
+# Default: no
+#Foreground yes
+
+# Chroot to the specified directory.
+# Chrooting is performed just after reading the config file and before
+# dropping privileges.
+#
+# Default: unset (don't chroot)
+#Chroot /newroot
+
+# This option allows you to save a process identifier of the listening
+# daemon.
+# This file will be owned by root, as long as clamav-milter was started by
+# root.  It is recommended that the directory where this file is stored is
+# also owned by root to keep other users from tampering with it.
+#
+# Default: disabled
+PidFile /run/clamav/clamav-milter.pid
+
+# Optional path to the global temporary directory.
+# Default: system specific (usually /tmp or /var/tmp).
+#
+TemporaryDirectory /tmp
+
+##
+## Clamd options
+##
+
+# Define the clamd socket to connect to for scanning.
+# This option is mandatory! Syntax:
+# ClamdSocket unix:path
+# ClamdSocket tcp:host:port
+# The first syntax specifies a local unix socket (needs an absolute path) e.g.:
+#     ClamdSocket unix:/run/clamav/clamd.sock
+# The second syntax specifies a tcp local or remote tcp socket: the
+# host can be a hostname or an ip address; the ":port" field is only required
+# for IPv6 addresses, otherwise it defaults to 3310, e.g.:
+#     ClamdSocket tcp:192.168.0.1
+#
+# This option can be repeated several times with different sockets or even
+# with the same socket: clamd servers will be selected in a round-robin
+# fashion.
+#
+# Default: no default
+#ClamdSocket tcp:scanner.mydomain:7357
+#ClamdSocket unix:/run/clamav/clamd.sock
+
+
+##
+## Exclusions
+##
+
+# Messages originating from these hosts/networks will not be scanned
+# This option takes a host(name)/mask pair in CIRD notation and can be
+# repeated several times. If "/mask" is omitted, a host is assumed.
+# To specify a locally originated, non-smtp, email use the keyword "local"
+#
+# Default: unset (scan everything regardless of the origin)
+#LocalNet local
+#LocalNet 192.168.0.0/24
+#LocalNet 1111:2222:3333::/48
+
+# This option specifies a file which contains a list of basic POSIX regular
+# expressions. Addresses (sent to or from - see below) matching these regexes
+# will not be scanned.  Optionally each line can start with the string "From:"
+# or "To:" (note: no whitespace after the colon) indicating if it is,
+# respectively, the sender or recipient that is to be allowed.
+# If the field is missing, "To:" is assumed.
+# Lines starting with #, : or ! are ignored.
+#
+# Default unset (no exclusion applied)
+#AllowList /etc/allowed_addresses
+
+# Messages from authenticated SMTP users matching this extended POSIX
+# regular expression (egrep-like) will not be scanned.
+# As an alternative, a file containing a plain (not regex) list of names (one
+# per line) can be specified using the prefix "file:".
+# e.g. SkipAuthenticated file:/etc/good_guys
+#
+# Note: this is the AUTH login name!
+#
+# Default: unset (no allowing based on SMTP auth)
+#SkipAuthenticated ^(tom|dick|henry)$
+
+# Messages larger than this value won't be scanned.
+# Make sure this value is lower or equal than StreamMaxLength in clamd.conf
+#
+# Default: 25M
+#MaxFileSize 10M
+
+
+##
+## Actions
+##
+
+# The following group of options controls the delivery process under
+# different circumstances.
+# The following actions are available:
+# - Accept
+#   The message is accepted for delivery
+# - Reject
+#   Immediately refuse delivery (a 5xx error is returned to the peer)
+# - Defer
+#   Return a temporary failure message (4xx) to the peer
+# - Blackhole (not available for OnFail)
+#   Like Accept but the message is sent to oblivion
+# - Quarantine (not available for OnFail)
+#   Like Accept but message is quarantined instead of being delivered
+#
+# NOTE: In Sendmail the quarantine queue can be examined via mailq -qQ
+# For Postfix this causes the message to be placed on hold
+#
+# Action to be performed on clean messages (mostly useful for testing)
+# Default: Accept
+#OnClean Accept
+
+# Action to be performed on infected messages
+# Default: Quarantine
+#OnInfected Quarantine
+
+# Action to be performed on error conditions (this includes failure to
+# allocate data structures, no scanners available, network timeouts,
+# unknown scanner replies and the like)
+# Default: Defer
+#OnFail Defer
+
+# This option allows to set a specific rejection reason for infected messages
+# and it's therefore only useful together with "OnInfected Reject"
+# The string "%v", if present, will be replaced with the virus name.
+# Default: MTA specific
+#RejectMsg
+
+# If this option is set to "Replace" (or "Yes"), an "X-Virus-Scanned" and an
+# "X-Virus-Status" headers will be attached to each processed message, possibly
+# replacing existing headers.
+# If it is set to Add, the X-Virus headers are added possibly on top of the
+# existing ones.
+# Note that while "Replace" can potentially break DKIM signatures, "Add" may
+# confuse procmail and similar filters.
+# Default: no
+#AddHeader Replace
+
+# When AddHeader is in use, this option allows to arbitrary set the reported
+# hostname. This may be desirable in order to avoid leaking internal names.
+# If unset the real machine name is used.
+# Default: disabled
+#ReportHostname my.mail.server.name
+
+# Execute a command (possibly searching PATH) when an infected message is
+# found.
+# The following parameters are passed to the invoked program in this order:
+# virus name, queue id, sender, destination, subject, message id, message date.
+# Note #1: this requires MTA macroes to be available (see LogInfected below)
+# Note #2: the process is invoked in the context of clamav-milter
+# Note #3: clamav-milter will wait for the process to exit. Be quick or fork to
+# avoid unnecessary delays in email delivery
+# Default: disabled
+#VirusAction /usr/local/bin/my_infected_message_handler
+
+##
+## Logging options
+##
+
+# Uncomment this option to enable logging.
+# LogFile must be writable for the user running daemon.
+# A full path is required.
+#
+# Default: disabled
+LogFile /var/log/clamav/clamav-milter.log
+
+# By default the log file is locked for writing - the lock protects against
+# running clamav-milter multiple times.
+# This option disables log file locking.
+#
+# Default: no
+#LogFileUnlock yes
+
+# Maximum size of the log file.
+# Value of 0 disables the limit.
+# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
+# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
+# in bytes just don't use modifiers. If LogFileMaxSize is enabled, log
+# rotation (the LogRotate option) will always be enabled.
+#
+# Default: 1M
+#LogFileMaxSize 2M
+
+# Log time with each message.
+#
+# Default: no
+LogTime yes
+
+# Use system logger (can work together with LogFile).
+#
+# Default: no
+#LogSyslog yes
+
+# Specify the type of syslog messages - please refer to 'man syslog'
+# for facility names.
+#
+# Default: LOG_LOCAL6
+#LogFacility LOG_MAIL
+
+# Enable verbose logging.
+#
+# Default: no
+#LogVerbose yes
+
+# Enable log rotation. Always enabled when LogFileMaxSize is enabled.
+# Default: no
+#LogRotate yes
+
+# This option allows to tune what is logged when a message is infected.
+# Possible values are Off (the default - nothing is logged),
+# Basic (minimal info logged), Full (verbose info logged)
+# Note:
+# For this to work properly in sendmail, make sure the msg_id, mail_addr,
+# rcpt_addr and i macroes are available in eom. In other words add a line like:
+# Milter.macros.eom={msg_id}, {mail_addr}, {rcpt_addr}, i
+# to your .cf file. Alternatively use the macro:
+# define(`confMILTER_MACROS_EOM', `{msg_id}, {mail_addr}, {rcpt_addr}, i')
+# Postfix should be working fine with the default settings.
+#
+# Default: disabled
+#LogInfected Basic
+
+# This option allows to tune what is logged when no threat is found in
+# a scanned message.
+# See LogInfected for possible values and caveats.
+# Useful in debugging but drastically increases the log size.
+# Default: disabled
+#LogClean Basic
+
+# This option affects the behaviour of LogInfected, LogClean and VirusAction
+# when a message with multiple recipients is scanned:
+# If SupportMultipleRecipients is off (the default)
+# then one single log entry is generated for the message and, in case the
+# message is determined to be malicious, the command indicated by VirusAction
+# is executed just once. In both cases only the last recipient is reported.
+# If SupportMultipleRecipients is on:
+# then one line is logged for each recipient and the command indicated
+# by VirusAction is also executed once for each recipient.
+#
+# Note: although it's probably a good idea to enable this option, the default
+# value
+# is currently set to off for legacy reasons.
+# Default: no
+#SupportMultipleRecipients yes
@@ -0,0 +1,899 @@
+##
+## Example config file for the Clam AV daemon
+## Please read the clamd.conf(5) manual before editing this file.
+##
+
+
+# Comment or remove the line below.
+#Example
+
+# Uncomment this option to enable logging.
+# LogFile must be writable for the user running daemon.
+# A full path is required.
+# Default: disabled
+LogFile /var/log/clamav/clamd.log
+
+# By default the log file is locked for writing - the lock protects against
+# running clamd multiple times (if want to run another clamd, please
+# copy the configuration file, change the LogFile variable, and run
+# the daemon with --config-file option).
+# This option disables log file locking.
+# Default: no
+#LogFileUnlock yes
+
+# Maximum size of the log file.
+# Value of 0 disables the limit.
+# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
+# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
+# in bytes just don't use modifiers. If LogFileMaxSize is enabled, log
+# rotation (the LogRotate option) will always be enabled.
+# Default: 1M
+#LogFileMaxSize 2M
+
+# Log time with each message.
+# Default: no
+LogTime yes
+
+# Also log clean files. Useful in debugging but drastically increases the
+# log size.
+# Default: no
+#LogClean yes
+
+# Use system logger (can work together with LogFile).
+# Default: no
+#LogSyslog yes
+
+# Specify the type of syslog messages - please refer to 'man syslog'
+# for facility names.
+# Default: LOG_LOCAL6
+#LogFacility LOG_MAIL
+
+# Enable verbose logging.
+# Default: no
+#LogVerbose yes
+
+# Enable log rotation. Always enabled when LogFileMaxSize is enabled.
+# Default: no
+#LogRotate yes
+
+# Enable Prelude output.
+# Default: no
+#PreludeEnable yes
+#
+# Set the name of the analyzer used by prelude-admin.
+# Default: ClamAV
+#PreludeAnalyzerName ClamAV
+
+# Log additional information about the infected file, such as its
+# size and hash, together with the virus name.
+#ExtendedDetectionInfo yes
+
+# This option allows you to save a process identifier of the listening
+# daemon.
+# This file will be owned by root, as long as clamd was started by root.
+# It is recommended that the directory where this file is stored is
+# also owned by root to keep other users from tampering with it.
+# Default: disabled
+PidFile /run/clamav/clamd.pid
+
+# Optional path to the global temporary directory.
+# Default: system specific (usually /tmp or /var/tmp).
+TemporaryDirectory /tmp
+
+# Path to the database directory.
+# Default: hardcoded (depends on installation options)
+#DatabaseDirectory /var/lib/clamav
+
+# Path to the ClamAV CA certificates directory for verifying CVD signature
+# archive digital signatures.
+# Default: hardcoded (depends on installation options)
+#CVDCertsDirectory /etc/clamav/certs
+
+# Enforce FIPS-like limits on using hash algorithms for cryptographic purposes.
+# Will disable MD5 & SHA1 FP sigs and will require '.sign' files to verify
+# CVD authenticity.
+# Default: no
+#FIPSCryptoHashLimits yes
+
+# Only load the official signatures published by the ClamAV project.
+# Default: no
+#OfficialDatabaseOnly no
+
+# Return with a nonzero error code if the virus database is older than
+# the specified number of days.
+# Default: -1
+#FailIfCvdOlderThan 7
+
+# The daemon can work in local mode, network mode or both.
+# Due to security reasons we recommend the local mode.
+
+# Path to a local socket file the daemon will listen on.
+# Default: disabled (must be specified by a user)
+LocalSocket /run/clamav/clamd.ctl
+LocalSocket /run/clamav/clamd.ctl
+
+# Sets the group ownership on the unix socket.
+# Default: disabled (the primary group of the user running clamd)
+#LocalSocketGroup virusgroup
+
+# Sets the permissions on the unix socket to the specified mode.
+# Default: disabled (socket is world accessible)
+#LocalSocketMode 660
+
+# Remove stale socket after unclean shutdown.
+# Default: yes
+#FixStaleSocket no
+
+# TCP port address.
+# Default: no
+#TCPSocket 3310
+
+# TCP address.
+# By default we bind to INADDR_ANY, probably not wise.
+# Enable the following to provide some degree of protection
+# from the outside world. This option can be specified multiple
+# times if you want to listen on multiple IPs. IPv6 is now supported.
+# Default: no
+#TCPAddr localhost
+
+# Enable or disable certain commands.
+# Disabling some commands like SHUTDOWN may improve the security of the daemon.
+# When a client sends one of the following commands but it is disabled,
+# clamd responds with COMMAND UNAVAILABLE.
+#
+# Enable the SHUTDOWN command.
+# Setting this to no prevents a client to stop clamd via the protocol.
+# Default: yes
+#EnableShutdownCommand no
+#
+# Enable the RELOAD command
+# Setting this to no prevents a client to reload the database.
+# Default: yes
+#EnableReloadCommand no
+#
+# Enable the STATS command
+# Setting this to no prevents a client from querying statistics.
+# Default: yes
+#EnableStatsCommand no
+#
+# Enable the VERSION command
+# Setting this to no prevents a client from querying version information.
+# Default: yes
+#EnableVersionCommand no
+
+# Maximum length the queue of pending connections may grow to.
+# Default: 200
+#MaxConnectionQueueLength 30
+
+# Clamd uses FTP-like protocol to receive data from remote clients.
+# If you are using clamav-milter to balance load between remote clamd daemons
+# on firewall servers you may need to tune the options below.
+
+# Close the connection when the data size limit is exceeded.
+# The value should match your MTA's limit for a maximum attachment size.
+# Default: 100M
+#StreamMaxLength 25M
+
+# Limit port range.
+# Default: 1024
+#StreamMinPort 30000
+# Default: 2048
+#StreamMaxPort 32000
+
+# Maximum number of threads running at the same time.
+# Default: 10
+#MaxThreads 20
+
+# Waiting for data from a client socket will timeout after this time (seconds).
+# Default: 120
+#ReadTimeout 300
+
+# This option specifies the time (in seconds) after which clamd should
+# timeout if a client doesn't provide any initial command after connecting.
+# Default: 30
+#CommandReadTimeout 30
+
+# This option specifies how long to wait (in milliseconds) if the send buffer
+# is full.
+# Keep this value low to prevent clamd hanging.
+#
+# Default: 500
+#SendBufTimeout 200
+
+# Maximum number of queued items (including those being processed by
+# MaxThreads threads).
+# It is recommended to have this value at least twice MaxThreads if possible.
+# WARNING: you shouldn't increase this too much to avoid running out  of file
+# descriptors, the following condition should hold:
+# MaxThreads*MaxRecursion + (MaxQueue - MaxThreads) + 6< RLIMIT_NOFILE (usual
+# max is 1024).
+#
+# Default: 100
+#MaxQueue 200
+
+# Waiting for a new job will timeout after this time (seconds).
+# Default: 30
+#IdleTimeout 60
+
+# Don't scan files and directories matching regex
+# This directive can be used multiple times
+# Default: scan all
+#ExcludePath ^/proc/
+#ExcludePath ^/sys/
+
+# Maximum depth directories are scanned at.
+# Default: 15
+#MaxDirectoryRecursion 20
+
+# Follow directory symlinks.
+# Default: no
+#FollowDirectorySymlinks yes
+
+# Follow regular file symlinks.
+# Default: no
+#FollowFileSymlinks yes
+
+# Scan files and directories on other filesystems.
+# Default: yes
+#CrossFilesystems no
+
+# Perform a database check.
+# Default: 600 (10 min)
+#SelfCheck 600
+
+# Enable non-blocking (multi-threaded/concurrent) database reloads.
+# This feature will temporarily load a second scanning engine while scanning
+# continues using the first engine. Once loaded, the new engine takes over.
+# The old engine is removed as soon as all scans using the old engine have
+# completed.
+# This feature requires more RAM, so this option is provided in case users are
+# willing to block scans during reload in exchange for lower RAM requirements.
+# Default: yes
+#ConcurrentDatabaseReload no
+
+# Execute a command when virus is found.
+# Use the following environment variables to identify the file and virus names:
+# - $CLAM_VIRUSEVENT_FILENAME
+# - $CLAM_VIRUSEVENT_VIRUSNAME
+# In the command string, '%v' will also be replaced with the virus name.
+# Note: The '%f' filename format character has been disabled and will no longer
+# be replaced with the file name, due to command injection security concerns.
+# Use the 'CLAM_VIRUSEVENT_FILENAME' environment variable instead.
+# For the same reason, you should NOT use the environment variables in the
+# command directly, but should use it carefully from your executed script.
+# Default: no
+#VirusEvent /opt/send_virus_alert_sms.sh
+
+# Run as another user (clamd must be started by root for this option to work)
+# Default: don't drop privileges
+User clamav
+
+# Stop daemon when libclamav reports out of memory condition.
+#ExitOnOOM yes
+
+# Don't fork into background.
+# Default: no
+#Foreground yes
+
+# Enable debug messages in libclamav.
+# Default: no
+#Debug yes
+
+# Do not remove temporary files (for debug purposes).
+# Default: no
+#LeaveTemporaryFiles yes
+
+# Record metadata about the file being scanned.
+# Scan metadata is useful for file analysis purposes and for debugging scan behavior.
+# The JSON metadata will be printed after the scan is complete if Debug is enabled.
+# A metadata.json file will be written to the scan temp directory if LeaveTemporaryFiles is enabled.
+# Default: no
+#GenerateMetadataJson yes
+
+# Store URIs found in html files to the json metadata.
+# URIs will be stored in an array with the tag 'URIs'
+# GenerateMetadataJson is required for this feature.
+# Default: yes (if GenerateMetadataJson is used)
+#JsonStoreHTMLURIs no
+
+# Store URIs found in pdf files to the json metadata.
+# URIs will be stored in an array with the tag 'URIs'
+# GenerateMetadataJson is required for this feature.
+# Default: yes (if GenerateMetadataJson is used)
+#JsonStorePDFURIs no
+
+# Calculate MD5 and SHA1 hashes (in addition to SHA2-256) and store to the json metadata.
+# GenerateMetadataJson is required for this feature.
+# Default: no
+#JsonStoreExtraHashes yes
+
+# Permit use of the ALLMATCHSCAN command. If set to no, clamd will reject
+# any ALLMATCHSCAN command as invalid.
+# Default: yes
+#AllowAllMatchScan no
+
+# Detect Possibly Unwanted Applications.
+# Default: no
+#DetectPUA yes
+
+# Exclude a specific PUA category. This directive can be used multiple times.
+# See https://github.com/vrtadmin/clamav-faq/blob/master/faq/faq-pua.md for
+# the complete list of PUA categories.
+# Default: Load all categories (if DetectPUA is activated)
+#ExcludePUA NetTool
+#ExcludePUA PWTool
+
+# Only include a specific PUA category. This directive can be used multiple
+# times.
+# Default: Load all categories (if DetectPUA is activated)
+#IncludePUA Spy
+#IncludePUA Scanner
+#IncludePUA RAT
+
+# This option causes memory or nested map scans to dump the content to disk.
+# If you turn on this option, more data is written to disk and is available
+# when the LeaveTemporaryFiles option is enabled.
+#ForceToDisk yes
+
+# This option allows you to disable the caching feature of the engine. By
+# default, the engine will store an MD5 in a cache of any files that are
+# not flagged as virus or that hit limits checks. Disabling the cache will
+# have a negative performance impact on large scans.
+# Default: no
+#DisableCache yes
+
+# This option allows you to set the number of entries the cache can store.
+# The value should be a square number or will be rounded up to the nearest
+# square number.
+#CacheSize 65536
+
+# In some cases (eg. complex malware, exploits in graphic files, and others),
+# ClamAV uses special algorithms to detect abnormal patterns and behaviors that
+# may be malicious.  This option enables alerting on such heuristically
+# detected potential threats.
+# Default: yes
+#HeuristicAlerts no
+
+# Allow heuristic alerts to take precedence.
+# When enabled, if a heuristic scan (such as phishingScan) detects
+# a possible virus/phish it will stop scan immediately. Recommended, saves CPU
+# scan-time.
+# When disabled, virus/phish detected by heuristic scans will be reported only
+# at the end of a scan. If an archive contains both a heuristically detected
+# virus/phish, and a real malware, the real malware will be reported
+#
+# Keep this disabled if you intend to handle "Heuristics.*" viruses
+# differently from "real" malware.
+# If a non-heuristically-detected virus (signature-based) is found first,
+# the scan is interrupted immediately, regardless of this config option.
+#
+# Default: no
+#HeuristicScanPrecedence yes
+
+
+##
+## Heuristic Alerts
+##
+
+# With this option clamav will try to detect broken executables (both PE and
+# ELF) and alert on them with the Broken.Executable heuristic signature.
+# Default: no
+#AlertBrokenExecutables yes
+
+# With this option clamav will try to detect broken media file (JPEG,
+# TIFF, PNG, GIF) and alert on them with a Broken.Media heuristic signature.
+# Default: no
+#AlertBrokenMedia yes
+
+# Alert on encrypted archives _and_ documents with heuristic signature
+# (encrypted .zip, .7zip, .rar, .pdf).
+# Default: no
+#AlertEncrypted yes
+
+# Alert on encrypted archives with heuristic signature (encrypted .zip, .7zip,
+# .rar).
+# Default: no
+#AlertEncryptedArchive yes
+
+# Alert on encrypted archives with heuristic signature (encrypted .pdf).
+# Default: no
+#AlertEncryptedDoc yes
+
+# With this option enabled OLE2 files containing VBA macros, which were not
+# detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros".
+# Default: no
+#AlertOLE2Macros yes
+
+# Alert on SSL mismatches in URLs, even if the URL isn't in the database.
+# This can lead to false positives.
+# Default: no
+#AlertPhishingSSLMismatch yes
+
+# Alert on cloaked URLs, even if URL isn't in database.
+# This can lead to false positives.
+# Default: no
+#AlertPhishingCloak yes
+
+# Alert on raw DMG image files containing partition intersections
+# Default: no
+#AlertPartitionIntersection yes
+
+
+##
+## Executable files
+##
+
+# PE stands for Portable Executable - it's an executable file format used
+# in all 32 and 64-bit versions of Windows operating systems. This option
+# allows ClamAV to perform a deeper analysis of executable files and it's also
+# required for decompression of popular executable packers such as UPX, FSG,
+# and Petite. If you turn off this option, the original files will still be
+# scanned, but without additional processing.
+# Default: yes
+#ScanPE no
+
+# Certain PE files contain an authenticode signature. By default, we check
+# the signature chain in the PE file against a database of trusted and
+# revoked certificates if the file being scanned is marked as a virus.
+# If any certificate in the chain validates against any trusted root, but
+# does not match any revoked certificate, the file is marked as trusted.
+# If the file does match a revoked certificate, the file is marked as virus.
+# The following setting completely turns off authenticode verification.
+# Default: no
+#DisableCertCheck yes
+
+# Executable and Linking Format is a standard format for UN*X executables.
+# This option allows you to control the scanning of ELF files.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanELF no
+
+
+##
+## Documents
+##
+
+# This option enables scanning of OLE2 files, such as Microsoft Office
+# documents and .msi files.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanOLE2 no
+
+# This option enables scanning within PDF files.
+# If you turn off this option, the original files will still be scanned, but
+# without decoding and additional processing.
+# Default: yes
+#ScanPDF no
+
+# This option enables scanning within SWF files.
+# If you turn off this option, the original files will still be scanned, but
+# without decoding and additional processing.
+# Default: yes
+#ScanSWF no
+
+# This option enables scanning xml-based document files supported by libclamav.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanXMLDOCS no
+
+# This option enables scanning of HWP3 files.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanHWP3 no
+
+# This option enables scanning of OneNote files.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanOneNote no
+
+
+##
+## Other file types
+##
+
+# This option enables scanning of image (graphics).
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanImage no
+
+# This option enables detection by calculating a fuzzy hash of image (graphics)
+# files.
+# Signatures using image fuzzy hashes typically match files and documents by
+# identifying images embedded or attached to those files.
+# If you turn off this option, then some files may no longer be detected.
+# Default: yes
+#ScanImageFuzzyHash no
+
+
+##
+## Mail files
+##
+
+# Enable internal e-mail scanner.
+# If you turn off this option, the original files will still be scanned, but
+# without parsing individual messages/attachments.
+# Default: yes
+#ScanMail no
+
+# Scan RFC1341 messages split over many emails.
+# You will need to periodically clean up $TemporaryDirectory/clamav-partial
+# directory.
+# WARNING: This option may open your system to a DoS attack.
+#	   Never use it on loaded servers.
+# Default: no
+#ScanPartialMessages yes
+
+# With this option enabled ClamAV will try to detect phishing attempts by using
+# HTML.Phishing and Email.Phishing NDB signatures.
+# Default: yes
+#PhishingSignatures no
+
+# With this option enabled ClamAV will try to detect phishing attempts by
+# analyzing URLs found in emails using WDB and PDB signature databases.
+# Default: yes
+#PhishingScanURLs no
+
+
+##
+## Data Loss Prevention (DLP)
+##
+
+# Enable the DLP module
+# Default: No
+#StructuredDataDetection yes
+
+# This option sets the lowest number of Credit Card numbers found in a file
+# to generate a detect.
+# Default: 3
+#StructuredMinCreditCardCount 5
+
+# With this option enabled the DLP module will search for valid Credit Card
+# numbers only. Debit and Private Label cards will not be searched.
+# Default: no
+#StructuredCCOnly yes
+
+# This option sets the lowest number of Social Security Numbers found
+# in a file to generate a detect.
+# Default: 3
+#StructuredMinSSNCount 5
+
+# With this option enabled the DLP module will search for valid
+# SSNs formatted as xxx-yy-zzzz
+# Default: yes
+#StructuredSSNFormatNormal no
+
+# With this option enabled the DLP module will search for valid
+# SSNs formatted as xxxyyzzzz
+# Default: no
+#StructuredSSNFormatStripped yes
+
+
+##
+## HTML
+##
+
+# Perform HTML normalisation and decryption of MS Script Encoder code.
+# Default: yes
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+#ScanHTML no
+
+
+##
+## Archives
+##
+
+# ClamAV can scan within archives and compressed files.
+# If you turn off this option, the original files will still be scanned, but
+# without unpacking and additional processing.
+# Default: yes
+#ScanArchive no
+
+
+##
+## Limits
+##
+
+# The options below protect your system against Denial of Service attacks
+# using archive bombs.
+
+# This option sets the maximum amount of time to a scan may take.
+# In this version, this field only affects the scan time of ZIP archives.
+# Value of 0 disables the limit.
+# Note: disabling this limit or setting it too high may result allow scanning
+# of certain files to lock up the scanning process/threads resulting in a
+# Denial of Service.
+# Time is in milliseconds.
+# Default: 120000
+#MaxScanTime 300000
+
+# This option sets the maximum amount of data to be scanned for each input
+# file. Archives and other containers are recursively extracted and scanned
+# up to this value.
+# Value of 0 disables the limit
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 400M
+#MaxScanSize 1000M
+
+# Files larger than this limit won't be scanned. Affects the input file itself
+# as well as files contained inside it (when the input file is an archive, a
+# document or some other kind of container).
+# Value of 0 disables the limit.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Technical design limitations prevent ClamAV from scanning files greater than
+# 2 GB at this time.
+# Default: 100M
+#MaxFileSize 400M
+
+# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
+# file, all files within it will also be scanned. This options specifies how
+# deeply the process should be continued.
+# Note: setting this limit too high may result in severe damage to the system.
+# Default: 17
+# Maximum: 100
+#MaxRecursion 10
+
+# Number of files to be scanned within an archive, a document, or any other
+# container file.
+# Value of 0 disables the limit.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 10000
+#MaxFiles 15000
+
+# Maximum size of a file to check for embedded PE. Files larger than this value
+# will skip the additional analysis step.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 40M
+#MaxEmbeddedPE 100M
+
+# Maximum size of a HTML file to normalize. HTML files larger than this value
+# will not be normalized or scanned.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 40M
+#MaxHTMLNormalize 100M
+
+# Maximum size of a normalized HTML file to scan. HTML files larger than this
+# value after normalization will not be scanned.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 8M
+#MaxHTMLNoTags 16M
+
+# Maximum size of a script file to normalize. Script content larger than this
+# value will not be normalized or scanned.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 20M
+#MaxScriptNormalize 50M
+
+# Maximum size of a ZIP file to reanalyze type recognition. ZIP files larger
+# than this value will skip the step to potentially reanalyze as PE.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 1M
+#MaxZipTypeRcg 1M
+
+# This option sets the maximum number of partitions of a raw disk image to be
+# scanned.
+# Raw disk images with more partitions than this value will have up to
+# the value number partitions scanned. Negative values are not allowed.
+# Note: setting this limit too high may result in severe damage or impact
+# performance.
+# Default: 50
+#MaxPartitions 128
+
+# This option sets the maximum number of icons within a PE to be scanned.
+# PE files with more icons than this value will have up to the value number
+# icons scanned.
+# Negative values are not allowed.
+# WARNING: setting this limit too high may result in severe damage or impact
+# performance.
+# Default: 100
+#MaxIconsPE 200
+
+# This option sets the maximum recursive calls for HWP3 parsing during
+# scanning. HWP3 files using more than this limit will be terminated and
+# alert the user.
+# Scans will be unable to scan any HWP3 attachments if the recursive limit
+# is reached.
+# Negative values are not allowed.
+# WARNING: setting this limit too high may result in severe damage or impact
+# performance.
+# Default: 16
+#MaxRecHWP3 16
+
+# This option sets the maximum calls to the PCRE match function during
+# an instance of regex matching.
+# Instances using more than this limit will be terminated and alert the user
+# but the scan will continue.
+# For more information on match_limit, see the PCRE documentation.
+# Negative values are not allowed.
+# WARNING: setting this limit too high may severely impact performance.
+# Default: 100000
+#PCREMatchLimit 20000
+
+# This option sets the maximum recursive calls to the PCRE match function
+# during an instance of regex matching.
+# Instances using more than this limit will be terminated and alert the user
+# but the scan will continue.
+# For more information on match_limit_recursion, see the PCRE documentation.
+# Negative values are not allowed and values > PCREMatchLimit are superfluous.
+# WARNING: setting this limit too high may severely impact performance.
+# Default: 2000
+#PCRERecMatchLimit 10000
+
+# This option sets the maximum filesize for which PCRE subsigs will be
+# executed. Files exceeding this limit will not have PCRE subsigs executed
+# unless a subsig is encompassed to a smaller buffer.
+# Negative values are not allowed.
+# Setting this value to zero disables the limit.
+# WARNING: setting this limit too high or disabling it may severely impact
+# performance.
+# Default: 100M
+#PCREMaxFileSize 400M
+
+# When AlertExceedsMax is set, files exceeding the MaxFileSize, MaxScanSize, or
+# MaxRecursion limit will be flagged with the virus name starting with
+# "Heuristics.Limits.Exceeded".
+# Default: no
+#AlertExceedsMax yes
+
+##
+## On-access Scan Settings
+##
+
+# Don't scan files larger than OnAccessMaxFileSize
+# Value of 0 disables the limit.
+# Default: 5M
+#OnAccessMaxFileSize 10M
+
+# Max number of scanning threads to allocate to the OnAccess thread pool at
+# startup. These threads are the ones responsible for creating a connection
+# with the daemon and kicking off scanning after an event has been processed.
+# To prevent clamonacc from consuming all clamd's resources keep this lower
+# than clamd's max threads.
+# Default: 5
+#OnAccessMaxThreads 10
+
+# Max amount of time (in milliseconds) that the OnAccess client should spend
+# for every connect, send, and receive attempt when communicating with clamd
+# via curl.
+# Default: 5000 (5 seconds)
+# OnAccessCurlTimeout 10000
+
+# Toggles dynamic directory determination. Allows for recursively watching
+# include paths.
+# Default: no
+#OnAccessDisableDDD yes
+
+# Set the include paths (all files inside them will be scanned). You can have
+# multiple OnAccessIncludePath directives but each directory must be added
+# in a separate line.
+# Default: disabled
+OnAccessIncludePath /home
+#OnAccessIncludePath /students
+
+# Set the exclude paths. All subdirectories are also excluded.
+# Default: disabled
+#OnAccessExcludePath /home/user
+
+# Modifies fanotify blocking behaviour when handling permission events.
+# If off, fanotify will only notify if the file scanned is a virus,
+# and not perform any blocking.
+# Default: no
+OnAccessPrevention yes
+
+# When using prevention, if this option is turned on, any errors that occur
+# during scanning will result in the event attempt being denied. This could
+# potentially lead to unwanted system behaviour with certain configurations,
+# so the client defaults this to off and prefers allowing access events in
+# case of scan or connection error.
+# Default: no
+#OnAccessDenyOnError yes
+
+# Toggles extra scanning and notifications when a file or directory is
+# created or moved.
+# Requires the  DDD system to kick-off extra scans.
+# Default: no
+OnAccessExtraScanning yes
+
+# Set the  mount point to be scanned. The mount point specified, or the mount
+# point containing the specified directory will be watched. If any directories
+# are specified, this option will preempt (disable and ignore all options
+# related to) the DDD system. This option will result in verdicts only.
+# Note that prevention is explicitly disallowed to prevent common, fatal
+# misconfigurations. (e.g. watching "/" with prevention on and no exclusions
+# made on vital system directories)
+# It can be used multiple times.
+# Default: disabled
+OnAccessMountPath /
+OnAccessMountPath /mnt
+
+# With this option you can exclude the root UID (0). Processes run under
+# root with be able to access all files without triggering scans or
+# permission denied events.
+# Note that if clamd cannot check the uid of the process that generated an
+# on-access scan event (e.g., because OnAccessPrevention was not enabled, and
+# the process already exited), clamd will perform a scan.  Thus, setting
+# OnAccessExcludeRootUID is not *guaranteed* to prevent every access by the
+# root user from triggering a scan (unless OnAccessPrevention is enabled).
+# Default: no
+OnAccessExcludeRootUID no
+
+# With this option you can exclude specific UIDs. Processes with these UIDs
+# will be able to access all files without triggering scans or permission
+# denied events.
+# This option can be used multiple times (one per line).
+# Using a value of 0 on any line will disable this option entirely.
+# To exclude the root UID (0) please enable the OnAccessExcludeRootUID
+# option.
+# Also note that if clamd cannot check the uid of the process that generated an
+# on-access scan event (e.g., because OnAccessPrevention was not enabled, and
+# the process already exited), clamd will perform a scan.  Thus, setting
+# OnAccessExcludeUID is not *guaranteed* to prevent every access by the
+# specified uid from triggering a scan (unless OnAccessPrevention is enabled).
+# Default: disabled
+#OnAccessExcludeUID -1
+
+# This option allows exclusions via user names when using the on-access
+# scanning client. It can be used multiple times.
+# It has the same potential race condition limitations of the
+# OnAccessExcludeUID option.
+# Default: disabled
+#OnAccessExcludeUname clamav
+
+# Number of times the OnAccess client will retry a failed scan due to
+# connection problems (or other issues).
+# Default: 0
+#OnAccessRetryAttempts 3
+
+##
+## Bytecode
+##
+
+# With this option enabled ClamAV will load bytecode from the database.
+# It is highly recommended you keep this option on, otherwise you'll miss
+# detections for many new viruses.
+# Default: yes
+#Bytecode no
+
+# Set bytecode security level.
+# Possible values:
+#   None -      No security at all, meant for debugging.
+#               DO NOT USE THIS ON PRODUCTION SYSTEMS.
+#               This value is only available if clamav was built
+#               with --enable-debug!
+#   TrustSigned - Trust bytecode loaded from signed .c[lv]d files, insert
+#               runtime safety checks for bytecode loaded from other sources.
+#   Paranoid -  Don't trust any bytecode, insert runtime checks for all.
+# Recommended: TrustSigned, because bytecode in .cvd files already has these
+# checks.
+# Note that by default only signed bytecode is loaded, currently you can only
+# load unsigned bytecode in --enable-debug mode.
+#
+# Default: TrustSigned
+#BytecodeSecurity TrustSigned
+
+# Allow loading bytecode from outside digitally signed .c[lv]d files.
+# **Caution**: You should NEVER run bytecode signatures from untrusted sources.
+# Doing so may result in arbitrary code execution.
+# Default: no
+#BytecodeUnsigned yes
+
+# Set bytecode timeout in milliseconds.
+#
+# Default: 10000
+# BytecodeTimeout 1000
+#
+VirusEvent /etc/clamav/virus-event.bash
@@ -0,0 +1,221 @@
+##
+## Example config file for freshclam
+## Please read the freshclam.conf(5) manual before editing this file.
+##
+
+
+# Comment or remove the line below.
+#Example
+
+# Path to the database directory.
+# WARNING: It must match clamd.conf's directive!
+# WARNING: It must already exist, be an absolute path, be writeable by
+# freshclam, and be readable by clamd/clamscan.
+# Default: hardcoded (depends on installation options)
+#DatabaseDirectory /var/lib/clamav
+
+# Path to the ClamAV CA certificates directory for verifying CVD signature
+# archive digital signatures.
+# WARNING: It must match clamd.conf's directive!
+# WARNING: It must already exist, be an absolute path, be readable by
+# freshclam, clamd, clamscan and sigtool.
+# Default: hardcoded (depends on installation options)
+#CVDCertsDirectory /etc/clamav/certs
+
+# Enforce FIPS-like limits on using hash algorithms for cryptographic purposes.
+# Will disable MD5 & SHA1 FP sigs and will require '.sign' files to verify
+# CVD authenticity.
+# Default: no
+#FIPSCryptoHashLimits yes
+
+# Path to the log file (make sure it has proper permissions)
+# Default: disabled
+UpdateLogFile /var/log/clamav/freshclam.log
+
+# Maximum size of the log file.
+# Value of 0 disables the limit.
+# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
+# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes).
+# in bytes just don't use modifiers. If LogFileMaxSize is enabled,
+# log rotation (the LogRotate option) will always be enabled.
+# Default: 1M
+#LogFileMaxSize 2M
+
+# Log time with each message.
+# Default: no
+#LogTime yes
+
+# Enable verbose logging.
+# Default: no
+#LogVerbose yes
+
+# Use system logger (can work together with UpdateLogFile).
+# Default: no
+#LogSyslog yes
+
+# Specify the type of syslog messages - please refer to 'man syslog'
+# for facility names.
+# Default: LOG_LOCAL6
+#LogFacility LOG_MAIL
+
+# Enable log rotation. Always enabled when LogFileMaxSize is enabled.
+# Default: no
+#LogRotate yes
+
+# Write the daemon's pid to the specified file.
+# You must run freshclam with --daemon (-d) for freshclam to run as a daemon.
+# This file will be owned by root, as long as freshclam was started by root.
+# It is recommended that the directory where this file is stored is
+# also owned by root to keep other users from tampering with it.
+# Default: disabled
+PidFile /run/clamav/freshclam.pid
+
+# By default when started freshclam drops privileges and switches to the
+# "clamav" user. This directive allows you to change the database owner.
+# Default: clamav (may depend on installation options)
+#DatabaseOwner clamav
+
+# Use DNS to verify virus database version. FreshClam uses DNS TXT records
+# to verify database and software versions. With this directive you can change
+# the database verification domain.
+# WARNING: Do not touch it unless you're configuring freshclam to use your
+# own database verification domain.
+# Default: current.cvd.clamav.net
+#DNSDatabaseInfo current.cvd.clamav.net
+
+# database.clamav.net is now the primary domain name to be used world-wide.
+# Now that CloudFlare is being used as our Content Delivery Network (CDN),
+# this one domain name works world-wide to direct freshclam to the closest
+# geographic endpoint.
+# If the old db.XY.clamav.net domains are set, freshclam will automatically
+# use database.clamav.net instead.
+DatabaseMirror database.clamav.net
+
+# How many attempts to make before giving up.
+# Default: 3 (per mirror)
+#MaxAttempts 5
+
+# With this option you can control scripted updates. It's highly recommended
+# to keep it enabled.
+# Default: yes
+#ScriptedUpdates yes
+
+# By default freshclam will keep the local databases (.cld) uncompressed to
+# make their handling faster. With this option you can enable the compression;
+# the change will take effect with the next database update.
+# Default: no
+#CompressLocalDatabase no
+
+# With this option you can provide custom sources for database files.
+# This option can be used multiple times. Support for:
+#   http(s)://, ftp(s)://, or file://
+# Default: no custom URLs
+#DatabaseCustomURL http://myserver.example.com/mysigs.ndb
+#DatabaseCustomURL https://myserver.example.com/mysigs.ndb
+#DatabaseCustomURL https://myserver.example.com:4567/allow_list.wdb
+#DatabaseCustomURL ftp://myserver.example.com/example.ldb
+#DatabaseCustomURL ftps://myserver.example.com:4567/example.ndb
+#DatabaseCustomURL file:///mnt/nfs/local.hdb
+
+# This option allows you to easily point freshclam to private mirrors.
+# If PrivateMirror is set, freshclam does not attempt to use DNS
+# to determine whether its databases are out-of-date, instead it will
+# use the If-Modified-Since request or directly check the headers of the
+# remote database files. For each database, freshclam first attempts
+# to download the CLD file. If that fails, it tries to download the
+# CVD file. This option overrides DatabaseMirror, DNSDatabaseInfo
+# and ScriptedUpdates. It can be used multiple times to provide
+# fall-back mirrors.
+# Default: disabled
+#PrivateMirror mirror1.example.com
+#PrivateMirror mirror2.example.com
+
+# Number of database checks per day.
+# Default: 12 (every two hours)
+#Checks 24
+
+# Proxy settings
+# The HTTPProxyServer may be prefixed with [scheme]:// to specify which kind
+# of proxy is used.
+#   http://     HTTP Proxy. Default when no scheme or proxy type is specified.
+#   https://    HTTPS Proxy. (Added in 7.52.0 for OpenSSL, GnuTLS and NSS)
+#   socks4://   SOCKS4 Proxy.
+#   socks4a://  SOCKS4a Proxy. Proxy resolves URL hostname.
+#   socks5://   SOCKS5 Proxy.
+#   socks5h://  SOCKS5 Proxy. Proxy resolves URL hostname.
+# Default: disabled
+#HTTPProxyServer https://proxy.example.com
+#HTTPProxyPort 1234
+#HTTPProxyUsername myusername
+#HTTPProxyPassword mypass
+
+# If your servers are behind a firewall/proxy which applies User-Agent
+# filtering you can use this option to force the use of a different
+# User-Agent header.
+# As of ClamAV 0.103.3, this setting may not be used when updating from the
+# clamav.net CDN and can only be used when updating from a private mirror.
+# Default: clamav/version_number (OS: ..., ARCH: ..., CPU: ..., UUID: ...)
+#HTTPUserAgent SomeUserAgentIdString
+
+# Use aaa.bbb.ccc.ddd as client address for downloading databases. Useful for
+# multi-homed systems.
+# Default: Use OS'es default outgoing IP address.
+#LocalIPAddress aaa.bbb.ccc.ddd
+
+# Send the RELOAD command to clamd.
+# Default: no
+NotifyClamd /etc/clamav/clamd.conf
+
+# Run command after successful database update.
+# Use EXIT_1 to return 1 after successful database update.
+# Default: disabled
+#OnUpdateExecute command
+
+# Run command when database update process fails.
+# Default: disabled
+#OnErrorExecute command
+
+# Run command when freshclam reports outdated version.
+# In the command string %v will be replaced by the new version number.
+# Default: disabled
+#OnOutdatedExecute command
+
+# Don't fork into background.
+# Default: no
+#Foreground yes
+
+# Enable debug messages in libclamav.
+# Default: no
+#Debug yes
+
+# Timeout in seconds when connecting to database server.
+# Default: 30
+#ConnectTimeout 60
+
+# Timeout in seconds when reading from database server. 0 means no timeout.
+# Default: 60
+#ReceiveTimeout 300
+
+# With this option enabled, freshclam will attempt to load new databases into
+# memory to make sure they are properly handled by libclamav before replacing
+# the old ones.
+# Tip: This feature uses a lot of RAM. If your system has limited RAM and you
+# are actively running ClamD or ClamScan during the update, then you may need
+# to set `TestDatabases no`.
+# Default: yes
+#TestDatabases no
+
+# This option enables downloading of bytecode.cvd, which includes additional
+# detection mechanisms and improvements to the ClamAV engine.
+# Default: yes
+#Bytecode no
+
+# Include an optional signature databases (opt-in).
+# This option can be used multiple times.
+#ExtraDatabase dbname1
+#ExtraDatabase dbname2
+
+# Exclude a standard signature database (opt-out).
+# This option can be used multiple times.
+#ExcludeDatabase dbname1
+#ExcludeDatabase dbname2
@@ -0,0 +1,10 @@
+#!/bin/bash
+PATH=/usr/bin
+ALERT="Signature detected by clamav: $CLAM_VIRUSEVENT_VIRUSNAME in $CLAM_VIRUSEVENT_FILENAME"
+
+# Send an alert to all graphical users.
+for ADDRESS in /run/user/*; do
+    USERID=${ADDRESS#/run/user/}
+    /usr/bin/sudo -u "#$USERID" DBUS_SESSION_BUS_ADDRESS="unix:path=$ADDRESS/bus" PATH=${PATH} \
+        /usr/bin/notify-send -u critical -i dialog-warning "Virus found!" "$ALERT"
+done
@@ -1 +1 @@
-LANG=C.UTF-8
+LANG=en_AU.UTF-8
@@ -0,0 +1,516 @@
+# Configuration file for locale-gen
+#
+# lists of locales that are to be generated by the locale-gen command.
+#
+# Each line is of the form:
+#
+#     <locale> <charset>
+#
+#  where <locale> is one of the locales given in /usr/share/i18n/locales
+#  and <charset> is one of the character sets listed in /usr/share/i18n/charmaps
+#
+#  The locale-gen command will generate all the locales,
+#  placing them in /usr/lib/locale.
+#
+#  A list of supported locales is given in /usr/share/i18n/SUPPORTED
+#  and is included in this file. Uncomment the needed locales below.
+#
+#aa_DJ.UTF-8 UTF-8  
+#aa_DJ ISO-8859-1  
+#aa_ER UTF-8  
+#aa_ET UTF-8  
+#af_ZA.UTF-8 UTF-8  
+#af_ZA ISO-8859-1  
+#agr_PE UTF-8  
+#ak_GH UTF-8  
+#am_ET UTF-8  
+#an_ES.UTF-8 UTF-8  
+#an_ES ISO-8859-15  
+#anp_IN UTF-8  
+#ar_AE.UTF-8 UTF-8  
+#ar_AE ISO-8859-6  
+#ar_BH.UTF-8 UTF-8  
+#ar_BH ISO-8859-6  
+#ar_DZ.UTF-8 UTF-8  
+#ar_DZ ISO-8859-6  
+#ar_EG.UTF-8 UTF-8  
+#ar_EG ISO-8859-6  
+#ar_IN UTF-8  
+#ar_IQ.UTF-8 UTF-8  
+#ar_IQ ISO-8859-6  
+#ar_JO.UTF-8 UTF-8  
+#ar_JO ISO-8859-6  
+#ar_KW.UTF-8 UTF-8  
+#ar_KW ISO-8859-6  
+#ar_LB.UTF-8 UTF-8  
+#ar_LB ISO-8859-6  
+#ar_LY.UTF-8 UTF-8  
+#ar_LY ISO-8859-6  
+#ar_MA.UTF-8 UTF-8  
+#ar_MA ISO-8859-6  
+#ar_OM.UTF-8 UTF-8  
+#ar_OM ISO-8859-6  
+#ar_QA.UTF-8 UTF-8  
+#ar_QA ISO-8859-6  
+#ar_SA.UTF-8 UTF-8  
+#ar_SA ISO-8859-6  
+#ar_SD.UTF-8 UTF-8  
+#ar_SD ISO-8859-6  
+#ar_SS UTF-8  
+#ar_SY.UTF-8 UTF-8  
+#ar_SY ISO-8859-6  
+#ar_TN.UTF-8 UTF-8  
+#ar_TN ISO-8859-6  
+#ar_YE.UTF-8 UTF-8  
+#ar_YE ISO-8859-6  
+#ayc_PE UTF-8  
+#az_AZ UTF-8  
+#az_IR UTF-8  
+#as_IN UTF-8  
+#ast_ES.UTF-8 UTF-8  
+#ast_ES ISO-8859-15  
+#be_BY.UTF-8 UTF-8  
+#be_BY CP1251  
+#be_BY@latin UTF-8  
+#bem_ZM UTF-8  
+#ber_DZ UTF-8  
+#ber_MA UTF-8  
+#bg_BG.UTF-8 UTF-8  
+#bg_BG CP1251  
+#bhb_IN.UTF-8 UTF-8  
+#bho_IN UTF-8  
+#bho_NP UTF-8  
+#bi_VU UTF-8  
+#bn_BD UTF-8  
+#bn_IN UTF-8  
+#bo_CN UTF-8  
+#bo_IN UTF-8  
+#br_FR.UTF-8 UTF-8  
+#br_FR ISO-8859-1  
+#br_FR@euro ISO-8859-15  
+#brx_IN UTF-8  
+#bs_BA.UTF-8 UTF-8  
+#bs_BA ISO-8859-2  
+#byn_ER UTF-8  
+#ca_AD.UTF-8 UTF-8  
+#ca_AD ISO-8859-15  
+#ca_ES.UTF-8 UTF-8  
+#ca_ES ISO-8859-1  
+#ca_ES@euro ISO-8859-15  
+#ca_ES@valencia UTF-8  
+#ca_FR.UTF-8 UTF-8  
+#ca_FR ISO-8859-15  
+#ca_IT.UTF-8 UTF-8  
+#ca_IT ISO-8859-15  
+#ce_RU UTF-8  
+#chr_US UTF-8  
+#ckb_IQ UTF-8  
+#cmn_TW UTF-8  
+#crh_RU UTF-8  
+#crh_UA UTF-8  
+#cs_CZ.UTF-8 UTF-8  
+#cs_CZ ISO-8859-2  
+#csb_PL UTF-8  
+#cv_RU UTF-8  
+#cy_GB.UTF-8 UTF-8  
+#cy_GB ISO-8859-14  
+#da_DK.UTF-8 UTF-8  
+#da_DK ISO-8859-1  
+#de_AT.UTF-8 UTF-8  
+#de_AT ISO-8859-1  
+#de_AT@euro ISO-8859-15  
+#de_BE.UTF-8 UTF-8  
+#de_BE ISO-8859-1  
+#de_BE@euro ISO-8859-15  
+#de_CH.UTF-8 UTF-8  
+#de_CH ISO-8859-1  
+#de_DE.UTF-8 UTF-8  
+#de_DE ISO-8859-1  
+#de_DE@euro ISO-8859-15  
+#de_IT.UTF-8 UTF-8  
+#de_IT ISO-8859-1  
+#de_LI.UTF-8 UTF-8  
+#de_LU.UTF-8 UTF-8  
+#de_LU ISO-8859-1  
+#de_LU@euro ISO-8859-15  
+#doi_IN UTF-8  
+#dsb_DE UTF-8  
+#dv_MV UTF-8  
+#dz_BT UTF-8  
+#el_GR.UTF-8 UTF-8  
+#el_GR ISO-8859-7  
+#el_GR@euro ISO-8859-7  
+#el_CY.UTF-8 UTF-8  
+#el_CY ISO-8859-7  
+#en_AG UTF-8  
+en_AU.UTF-8 UTF-8  
+#en_AU ISO-8859-1  
+#en_BW.UTF-8 UTF-8  
+#en_BW ISO-8859-1  
+#en_CA.UTF-8 UTF-8  
+#en_CA ISO-8859-1  
+#en_DK.UTF-8 UTF-8  
+#en_DK ISO-8859-1  
+#en_GB.UTF-8 UTF-8  
+#en_GB ISO-8859-1  
+#en_HK.UTF-8 UTF-8  
+#en_HK ISO-8859-1  
+#en_IE.UTF-8 UTF-8  
+#en_IE ISO-8859-1  
+#en_IE@euro ISO-8859-15  
+#en_IL UTF-8  
+#en_IN UTF-8  
+#en_NG UTF-8  
+#en_NZ.UTF-8 UTF-8  
+#en_NZ ISO-8859-1  
+#en_PH.UTF-8 UTF-8  
+#en_PH ISO-8859-1  
+#en_SC.UTF-8 UTF-8  
+#en_SG.UTF-8 UTF-8  
+#en_SG ISO-8859-1  
+en_US.UTF-8 UTF-8  
+#en_US ISO-8859-1  
+#en_ZA.UTF-8 UTF-8  
+#en_ZA ISO-8859-1  
+#en_ZM UTF-8  
+#en_ZW.UTF-8 UTF-8  
+#en_ZW ISO-8859-1  
+#eo UTF-8  
+#es_AR.UTF-8 UTF-8  
+#es_AR ISO-8859-1  
+#es_BO.UTF-8 UTF-8  
+#es_BO ISO-8859-1  
+#es_CL.UTF-8 UTF-8  
+#es_CL ISO-8859-1  
+#es_CO.UTF-8 UTF-8  
+#es_CO ISO-8859-1  
+#es_CR.UTF-8 UTF-8  
+#es_CR ISO-8859-1  
+#es_CU UTF-8  
+#es_DO.UTF-8 UTF-8  
+#es_DO ISO-8859-1  
+#es_EC.UTF-8 UTF-8  
+#es_EC ISO-8859-1  
+#es_ES.UTF-8 UTF-8  
+#es_ES ISO-8859-1  
+#es_ES@euro ISO-8859-15  
+#es_GT.UTF-8 UTF-8  
+#es_GT ISO-8859-1  
+#es_HN.UTF-8 UTF-8  
+#es_HN ISO-8859-1  
+#es_MX.UTF-8 UTF-8  
+#es_MX ISO-8859-1  
+#es_NI.UTF-8 UTF-8  
+#es_NI ISO-8859-1  
+#es_PA.UTF-8 UTF-8  
+#es_PA ISO-8859-1  
+#es_PE.UTF-8 UTF-8  
+#es_PE ISO-8859-1  
+#es_PR.UTF-8 UTF-8  
+#es_PR ISO-8859-1  
+#es_PY.UTF-8 UTF-8  
+#es_PY ISO-8859-1  
+#es_SV.UTF-8 UTF-8  
+#es_SV ISO-8859-1  
+#es_US.UTF-8 UTF-8  
+#es_US ISO-8859-1  
+#es_UY.UTF-8 UTF-8  
+#es_UY ISO-8859-1  
+#es_VE.UTF-8 UTF-8  
+#es_VE ISO-8859-1  
+#et_EE.UTF-8 UTF-8  
+#et_EE ISO-8859-1  
+#et_EE.ISO-8859-15 ISO-8859-15  
+#eu_ES.UTF-8 UTF-8  
+#eu_ES ISO-8859-1  
+#eu_ES@euro ISO-8859-15  
+#fa_IR UTF-8  
+#ff_SN UTF-8  
+#fi_FI.UTF-8 UTF-8  
+#fi_FI ISO-8859-1  
+#fi_FI@euro ISO-8859-15  
+#fil_PH UTF-8  
+#fo_FO.UTF-8 UTF-8  
+#fo_FO ISO-8859-1  
+#fr_BE.UTF-8 UTF-8  
+#fr_BE ISO-8859-1  
+#fr_BE@euro ISO-8859-15  
+#fr_CA.UTF-8 UTF-8  
+#fr_CA ISO-8859-1  
+#fr_CH.UTF-8 UTF-8  
+#fr_CH ISO-8859-1  
+#fr_FR.UTF-8 UTF-8  
+#fr_FR ISO-8859-1  
+#fr_FR@euro ISO-8859-15  
+#fr_LU.UTF-8 UTF-8  
+#fr_LU ISO-8859-1  
+#fr_LU@euro ISO-8859-15  
+#fur_IT UTF-8  
+#fy_NL UTF-8  
+#fy_DE UTF-8  
+#ga_IE.UTF-8 UTF-8  
+#ga_IE ISO-8859-1  
+#ga_IE@euro ISO-8859-15  
+#gbm_IN UTF-8  
+#gd_GB.UTF-8 UTF-8  
+#gd_GB ISO-8859-15  
+#gez_ER UTF-8  
+#gez_ER@abegede UTF-8  
+#gez_ET UTF-8  
+#gez_ET@abegede UTF-8  
+#gl_ES.UTF-8 UTF-8  
+#gl_ES ISO-8859-1  
+#gl_ES@euro ISO-8859-15  
+#gu_IN UTF-8  
+#gv_GB.UTF-8 UTF-8  
+#gv_GB ISO-8859-1  
+#ha_NG UTF-8  
+#hak_TW UTF-8  
+#he_IL.UTF-8 UTF-8  
+#he_IL ISO-8859-8  
+#hi_IN UTF-8  
+#hif_FJ UTF-8  
+#hne_IN UTF-8  
+#hr_HR.UTF-8 UTF-8  
+#hr_HR ISO-8859-2  
+#hsb_DE ISO-8859-2  
+#hsb_DE.UTF-8 UTF-8  
+#ht_HT UTF-8  
+#hu_HU.UTF-8 UTF-8  
+#hu_HU ISO-8859-2  
+#hy_AM UTF-8  
+#hy_AM.ARMSCII-8 ARMSCII-8  
+#ia_FR UTF-8  
+#id_ID.UTF-8 UTF-8  
+#id_ID ISO-8859-1  
+#ig_NG UTF-8  
+#ik_CA UTF-8  
+#is_IS.UTF-8 UTF-8  
+#is_IS ISO-8859-1  
+#it_CH.UTF-8 UTF-8  
+#it_CH ISO-8859-1  
+#it_IT.UTF-8 UTF-8  
+#it_IT ISO-8859-1  
+#it_IT@euro ISO-8859-15  
+#iu_CA UTF-8  
+#ja_JP.EUC-JP EUC-JP  
+#ja_JP.UTF-8 UTF-8  
+#ka_GE.UTF-8 UTF-8  
+#ka_GE GEORGIAN-PS  
+#kab_DZ UTF-8  
+#kk_KZ.UTF-8 UTF-8  
+#kk_KZ PT154  
+#kl_GL.UTF-8 UTF-8  
+#kl_GL ISO-8859-1  
+#km_KH UTF-8  
+#kn_IN UTF-8  
+#ko_KR.EUC-KR EUC-KR  
+#ko_KR.UTF-8 UTF-8  
+#kok_IN UTF-8  
+#ks_IN UTF-8  
+#ks_IN@devanagari UTF-8  
+#ku_TR.UTF-8 UTF-8  
+#ku_TR ISO-8859-9  
+#kv_RU UTF-8  
+#kw_GB.UTF-8 UTF-8  
+#kw_GB ISO-8859-1  
+#ky_KG UTF-8  
+#lb_LU UTF-8  
+#lg_UG.UTF-8 UTF-8  
+#lg_UG ISO-8859-10  
+#li_BE UTF-8  
+#li_NL UTF-8  
+#lij_IT UTF-8  
+#ln_CD UTF-8  
+#lo_LA UTF-8  
+#lt_LT.UTF-8 UTF-8  
+#lt_LT ISO-8859-13  
+#ltg_LV.UTF-8 UTF-8  
+#lv_LV.UTF-8 UTF-8  
+#lv_LV ISO-8859-13  
+#lzh_TW UTF-8  
+#mag_IN UTF-8  
+#mai_IN UTF-8  
+#mai_NP UTF-8  
+#mdf_RU UTF-8  
+#mfe_MU UTF-8  
+#mg_MG.UTF-8 UTF-8  
+#mg_MG ISO-8859-15  
+#mhr_RU UTF-8  
+#mi_NZ.UTF-8 UTF-8  
+#mi_NZ ISO-8859-13  
+#miq_NI UTF-8  
+#mjw_IN UTF-8  
+#mk_MK.UTF-8 UTF-8  
+#mk_MK ISO-8859-5  
+#ml_IN UTF-8  
+#mn_MN UTF-8  
+#mni_IN UTF-8  
+#mnw_MM UTF-8  
+#mr_IN UTF-8  
+#ms_MY.UTF-8 UTF-8  
+#ms_MY ISO-8859-1  
+#mt_MT.UTF-8 UTF-8  
+#mt_MT ISO-8859-3  
+#my_MM UTF-8  
+#nan_TW UTF-8  
+#nan_TW@latin UTF-8  
+#nb_NO.UTF-8 UTF-8  
+#nb_NO ISO-8859-1  
+#nds_DE UTF-8  
+#nds_NL UTF-8  
+#ne_NP UTF-8  
+#nhn_MX UTF-8  
+#niu_NU UTF-8  
+#niu_NZ UTF-8  
+#nl_AW UTF-8  
+#nl_BE.UTF-8 UTF-8  
+#nl_BE ISO-8859-1  
+#nl_BE@euro ISO-8859-15  
+#nl_NL.UTF-8 UTF-8  
+#nl_NL ISO-8859-1  
+#nl_NL@euro ISO-8859-15  
+#nn_NO.UTF-8 UTF-8  
+#nn_NO ISO-8859-1  
+#nr_ZA UTF-8  
+#nso_ZA UTF-8  
+#oc_FR.UTF-8 UTF-8  
+#oc_FR ISO-8859-1  
+#om_ET UTF-8  
+#om_KE.UTF-8 UTF-8  
+#om_KE ISO-8859-1  
+#or_IN UTF-8  
+#os_RU UTF-8  
+#pa_IN UTF-8  
+#pa_PK UTF-8  
+#pap_AW UTF-8  
+#pap_CW UTF-8  
+#pl_PL.UTF-8 UTF-8  
+#pl_PL ISO-8859-2  
+#ps_AF UTF-8  
+#pt_BR.UTF-8 UTF-8  
+#pt_BR ISO-8859-1  
+#pt_PT.UTF-8 UTF-8  
+#pt_PT ISO-8859-1  
+#pt_PT@euro ISO-8859-15  
+#quz_PE UTF-8  
+#raj_IN UTF-8  
+#rif_MA UTF-8  
+#ro_RO.UTF-8 UTF-8  
+#ro_RO ISO-8859-2  
+#ru_RU.KOI8-R KOI8-R  
+#ru_RU.UTF-8 UTF-8  
+#ru_RU ISO-8859-5  
+#ru_UA.UTF-8 UTF-8  
+#ru_UA KOI8-U  
+#rw_RW UTF-8  
+#sa_IN UTF-8  
+#sah_RU UTF-8  
+#sat_IN UTF-8  
+#sc_IT UTF-8  
+#scn_IT UTF-8  
+#sd_IN UTF-8  
+#sd_IN@devanagari UTF-8  
+#se_NO UTF-8  
+#sgs_LT UTF-8  
+#shn_MM UTF-8  
+#shs_CA UTF-8  
+#si_LK UTF-8  
+#sid_ET UTF-8  
+#sk_SK.UTF-8 UTF-8  
+#sk_SK ISO-8859-2  
+#sl_SI.UTF-8 UTF-8  
+#sl_SI ISO-8859-2  
+#sm_WS UTF-8  
+#so_DJ.UTF-8 UTF-8  
+#so_DJ ISO-8859-1  
+#so_ET UTF-8  
+#so_KE.UTF-8 UTF-8  
+#so_KE ISO-8859-1  
+#so_SO.UTF-8 UTF-8  
+#so_SO ISO-8859-1  
+#sq_AL.UTF-8 UTF-8  
+#sq_AL ISO-8859-1  
+#sq_MK UTF-8  
+#sr_ME UTF-8  
+#sr_RS UTF-8  
+#sr_RS@latin UTF-8  
+#ss_ZA UTF-8  
+#ssy_ER UTF-8  
+#st_ZA.UTF-8 UTF-8  
+#st_ZA ISO-8859-1  
+#su_ID UTF-8  
+#sv_FI.UTF-8 UTF-8  
+#sv_FI ISO-8859-1  
+#sv_FI@euro ISO-8859-15  
+#sv_SE.UTF-8 UTF-8  
+#sv_SE ISO-8859-1  
+#sw_KE UTF-8  
+#sw_TZ UTF-8  
+#syr UTF-8  
+#szl_PL UTF-8  
+#ta_IN UTF-8  
+#ta_LK UTF-8  
+#tcy_IN.UTF-8 UTF-8  
+#te_IN UTF-8  
+#tg_TJ.UTF-8 UTF-8  
+#tg_TJ KOI8-T  
+#th_TH.UTF-8 UTF-8  
+#th_TH TIS-620  
+#the_NP UTF-8  
+#ti_ER UTF-8  
+#ti_ET UTF-8  
+#tig_ER UTF-8  
+#tk_TM UTF-8  
+#tl_PH.UTF-8 UTF-8  
+#tl_PH ISO-8859-1  
+#tn_ZA UTF-8  
+#to_TO UTF-8  
+#tok UTF-8  
+#tpi_PG UTF-8  
+#tr_CY.UTF-8 UTF-8  
+#tr_CY ISO-8859-9  
+#tr_TR.UTF-8 UTF-8  
+#tr_TR ISO-8859-9  
+#ts_ZA UTF-8  
+#tt_RU UTF-8  
+#tt_RU@iqtelif UTF-8  
+#ug_CN UTF-8  
+#uk_UA.UTF-8 UTF-8  
+#uk_UA KOI8-U  
+#unm_US UTF-8  
+#ur_IN UTF-8  
+#ur_PK UTF-8  
+#uz_UZ.UTF-8 UTF-8  
+#uz_UZ ISO-8859-1  
+#uz_UZ@cyrillic UTF-8  
+#ve_ZA UTF-8  
+#vi_VN UTF-8  
+#wa_BE ISO-8859-1  
+#wa_BE@euro ISO-8859-15  
+#wa_BE.UTF-8 UTF-8  
+#wae_CH UTF-8  
+#wal_ET UTF-8  
+#wo_SN UTF-8  
+#xh_ZA.UTF-8 UTF-8  
+#xh_ZA ISO-8859-1  
+#yi_US.UTF-8 UTF-8  
+#yi_US CP1255  
+#yo_NG UTF-8  
+#yue_HK UTF-8  
+#yuw_PG UTF-8  
+#zgh_MA UTF-8  
+#zh_CN.GB18030 GB18030  
+#zh_CN.GBK GBK  
+#zh_CN.UTF-8 UTF-8  
+#zh_CN GB2312  
+#zh_HK.UTF-8 UTF-8  
+#zh_HK BIG5-HKSCS  
+#zh_SG.UTF-8 UTF-8  
+#zh_SG.GBK GBK  
+#zh_SG GB2312  
+#zh_TW.EUC-TW EUC-TW  
+#zh_TW.UTF-8 UTF-8  
+#zh_TW BIG5  
+#zu_ZA.UTF-8 UTF-8  
+#zu_ZA ISO-8859-1  
@@ -1,7 +1,8 @@
-To install [38;2;23;147;209mArch Linux[0m follow the installation guide:
+To install [38;2;23;147;209mArch Linux[0m, follow the installation guide,
+or run [35malvin-install[0m for an automated setup.
 https://wiki.archlinux.org/title/Installation_guide

-For Wi-Fi, authenticate to the wireless network using the [35miwctl[0m utility.
+For Wi-Fi, run [35mnmtui[0m to configure a wireless network.
 For mobile broadband (WWAN) modems, connect with the [35mmmcli[0m utility.
 Ethernet, WLAN and WWAN interfaces using DHCP should work automatically.

@@ -0,0 +1 @@
+../usr/lib/os-release
@@ -0,0 +1,70 @@
+######################################################
+####                                              ####
+####        CachyOS Repository Mirrorlist         ####
+####                                              ####
+######################################################
+## CDN77 (World Wide Datacenters)
+Server = https://cdn77.cachyos.org/repo/$arch/$repo
+## Rerouted to mirror
+# Server = https://cdn.cachyos.org/repo/$arch/$repo
+## Germany, disabled due Netcup issues:
+## : OpenSSL SSL_read: SSL_ERROR_SYSCALL, errno 0"
+# Server = https://mirror.cachyos.org/repo/$arch/$repo
+## USA Mirror much thanks to corpdecker!
+Server = https://us.cachyos.org/repo/$arch/$repo
+## India Mirror much thanks to https://github.com/albonycal
+## Disabled due issues at installation
+## Server = https://mirror.albony.xyz/cachylinux/repo/$arch/$repo
+## France Mirror much thanks to Antoine Viallon (aviallon)
+Server = https://mirror.lesviallon.fr/cachy/repo/$arch/$repo
+## Russia Mirror # Removed till sync issue is resolved
+# Server = https://mirror.truenetwork.ru/cachy/repo/$arch/$repo
+## Norway Mirror much thanks to QuadFeed
+# Server = https://mirror.fast0ne.com/repo/$arch/$repo
+## Norway,Netherlands,Canada Mirror much thanks to innoix
+Server = https://no.mirror.cx/cachyos/repo/$arch/$repo
+Server = https://nl.mirror.cx/cachyos/repo/$arch/$repo
+Server = https://ca.mirror.cx/cachyos/repo/$arch/$repo
+## Sweden Mirror much thanks to Zyner!
+Server = https://mirror.zyner.org/mirror/cachyos/repo/$arch/$repo
+## South Korea much thanks to Mihate Hiura!
+# Server = https://mirror.funami.tech/cachy/repo/$arch/$repo
+## Austria Mirror much thanks to Soulharsh!
+Server = https://at.cachyos.org/repo/$arch/$repo
+## Germany Mirror much thanks to Soulharsh!
+## Server = https://de-nue.soulharsh007.dev/cachyos/repo/$arch/$repo
+## Germany Mirror much thanks to MergedEyes!
+Server = https://mirror.mergedcloud.de/cachyos/repo/$arch/$repo
+## USA Mirror much thanks to Soulharsh!
+Server = https://us-mnz.soulharsh007.dev/cachyos/repo/$arch/$repo
+## USA Mirror & CDN mirror provided by Lansing 2600 in Lansing, MI, USA
+Server = https://mirrors.lansing2600.org/cachyos/repo/$arch/$repo
+Server = https://cdn.lansing2600.org/cachyos/repo/$arch/$repo
+## China Mirror 10GBs much thanks to eScience Center, Nanjing University!
+Server = https://mirror.nju.edu.cn/cachyos/repo/$arch/$repo
+## China Mirror much thanks to University of Science and Technology of China!
+Server = https://mirrors.ustc.edu.cn/cachyos/repo/$arch/$repo
+## Hong Kong Mirror much thanks to Saren!
+# Server = https://cachy-mirror.wtako.net/repo/$arch/$repo
+## Quebec, Canada Mirror from All Things Linux
+Server = https://mirror.allthingslinux.org/cachyos/repo/$arch/$repo
+## Italy Mirror much thanks to NextWorks!
+Server = https://cachyos.next-works.it/repo/$arch/$repo
+## Italy Mirror much thanks to ironashram!
+Server = https://cachyos-mirror.m1k.cloud/repo/$arch/$repo
+## Bangladesh 10 GBs much thanks to Limda!
+Server = https://mirror.limda.net/cachy/repo/$arch/$repo
+## Finland Mirror much thanks to doridian!
+Server = https://cachyos.doridian.net/repo/$arch/$repo
+## Switzerland Mirror much thanks to Fabian!
+Server = https://mirror.hb9hil.org/cachyos/repo/$arch/$repo
+## Russia Mirror from Yandex
+# Server = https://mirror.yandex.ru/cachyos/repo/$arch/$repo
+## Russia Mirror much thanks to quinowell and haku.host
+Server = https://archlinux.gay/cachy/repo/$arch/$repo
+## Russia Mirror much thanks to jura12
+Server = https://mirror.jura12.ru/repo/$arch/$repo
+## Russia Mirror much thanks to cachy-arch.ru
+Server = https://mirror.cachy-arch.ru/cachyos/repo/$arch/$repo
+## Russia Mirror much thanks to wan666 from metrosg.ru
+Server = https://wan.metrosg.ru/cachyos/repo/$arch/$repo
@@ -0,0 +1,268 @@
+# Mirrorlist for Chaotic-AUR (https://aur.chaotic.cx/)
+
+# This file contains 3 different types of mirrors:
+# 1. Virtual mirrors: These mirrors do not refer to any specific mirror or region of the world
+#   * geo-mirror.chaotic.cx: Automatically routes to the geographically closest up-to-date mirror based on IP address.
+#   * random-mirror.chaotic.cx: Automatically routes to a random (but semi-persistent) up-to-date mirror.
+# 2. Country mirrors: Any requests made to these mirrors will be routed to an up-to-date mirror located in the specific country.
+#   * If your machine is located in the same country as the country mirror in question, the closest mirror in that country will be used.
+#   * If your machine is located in a different country than the country mirror, a random (but semi-persistent) mirror in that country will be used.
+#   * Common format: [country code]-mirror.chaotic.cx
+# 3. Regular mirrors: These refer to specific mirrors and do not automatically route to any other mirror.
+#   * If the mirror is out of date or offline, the mirror will return an appropriate error code. Pacman will skip it automatically.
+#   * Common format: [country code]-[number]-mirror.chaotic.cx (but there are exceptions to this format)
+
+# Most of these mirrors are disabled by default. The topmost mirror will be the default mirror. The rest will be fallbacks.
+# Uncomment+move the mirrors to your desire. By default, geo-mirror, cdn-mirror and a few country mirrors are enabled,
+# to allow for a reasonable number of fallbacks while keeping the defaults short. Have fun!
+
+## Geo mirror (virtual)
+# Automatic routing to the geographically closest mirror (default)
+Server = https://geo-mirror.chaotic.cx/$repo/$arch
+
+## CDN mirror (regular)
+# Global
+# * By: Garuda Linux donators, hosted on Cloudflare R2
+Server = https://cdn-mirror.chaotic.cx/$repo/$arch
+
+
+## --- Country mirrors ---
+
+# Australia (AU)
+#Server = https://au-mirror.chaotic.cx/$repo/$arch
+
+# Brazil (BR)
+Server = https://br-mirror.chaotic.cx/$repo/$arch
+
+# Canada (CA)
+#Server = https://ca-mirror.chaotic.cx/$repo/$arch
+
+# Chile (CL)
+#Server = https://cl-mirror.chaotic.cx/$repo/$arch
+
+# Colombia (CO)
+#Server = https://co-mirror.chaotic.cx/$repo/$arch
+
+# France (FR)
+#Server = https://fr-mirror.chaotic.cx/$repo/$arch
+
+# Germany (DE)
+Server = https://de-mirror.chaotic.cx/$repo/$arch
+
+# Greece (GR)
+#Server = https://gr-mirror.chaotic.cx/$repo/$arch
+
+# India (IN)
+Server = https://in-mirror.chaotic.cx/$repo/$arch
+
+# Israel (IL)
+#Server = https://il-mirror.chaotic.cx/$repo/$arch
+
+# Italy (IT)
+#Server = https://it-mirror.chaotic.cx/$repo/$arch
+
+# Japan (JP)
+#Server = https://jp-mirror.chaotic.cx/$repo/$arch
+
+# Mexico (MX)
+#Server = https://mx-mirror.chaotic.cx/$repo/$arch
+
+# Netherlands (NL)
+#Server = https://nl-mirror.chaotic.cx/$repo/$arch
+
+# Russia (RU)
+#Server = https://ru-mirror.chaotic.cx/$repo/$arch
+
+# Saudi Arabia (SA)
+#Server = https://sa-mirror.chaotic.cx/$repo/$arch
+
+# Singapore (SG)
+#Server = https://sg-mirror.chaotic.cx/$repo/$arch
+
+# South Africa (ZA)
+#Server = https://za-mirror.chaotic.cx/$repo/$arch
+
+# South Korea (KR)
+#Server = https://kr-mirror.chaotic.cx/$repo/$arch
+
+# Spain (ES)
+#Server = https://es-mirror.chaotic.cx/$repo/$arch
+
+# Sweden (SE)
+#Server = https://se-mirror.chaotic.cx/$repo/$arch
+
+# Switzerland (CH)
+#Server = https://ch-mirror.chaotic.cx/$repo/$arch
+
+# United Arab Emirates (AE)
+#Server = https://ae-mirror.chaotic.cx/$repo/$arch
+
+# United Kingdom (GB)
+#Server = https://gb-mirror.chaotic.cx/$repo/$arch
+
+# United States of America (US)
+Server = https://us-mirror.chaotic.cx/$repo/$arch
+
+# Vietnam (VN)
+#Server = https://vn-mirror.chaotic.cx/$repo/$arch
+
+
+## --- Regular mirrors ---
+
+# Australia (AU)
+# * By: a0xz
+#Server = https://au-1-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://au-2-mirror.chaotic.cx/$repo/$arch
+
+# Brazil (BR)
+# * By: Universidade Federal de São Carlos (São Carlos)
+#Server = https://br-1-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://br-2-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://br-3-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://br-4-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://br-5-mirror.chaotic.cx/$repo/$arch
+
+# Canada (CA)
+# * By: a0xz
+#Server = https://ca-3-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://ca-4-mirror.chaotic.cx/$repo/$arch
+
+# Chile (CL)
+# * By: Jonathan Gutiérrez
+#Server = https://cl-1-mirror.chaotic.cx/$repo/$arch
+# * By: Jonathan Gutiérrez
+#Server = https://cl-2-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://cl-3-mirror.chaotic.cx/$repo/$arch
+
+# Colombia (CO)
+# * By: Eduard Tolosa
+#Server = https://co-1-mirror.chaotic.cx/$repo/$arch
+
+# France (FR)
+# * By: a0xz
+#Server = https://fr-1-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://fr-2-mirror.chaotic.cx/$repo/$arch
+
+# Germany (DE)
+# * By: Nico
+#Server = https://de-2-mirror.chaotic.cx/$repo/$arch
+# * By: redgloboli
+#Server = https://de-4-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://de-1-mirror.chaotic.cx/$repo/$arch
+
+# Greece (GR)
+# * By: vmmaniac <github.com/vmmaniac>
+#Server = https://gr-1-mirror.chaotic.cx/$repo/$arch
+
+# India (IN)
+# * By: Albony <https://albony.xyz/>
+#Server = https://in-2-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://in-3-mirror.chaotic.cx/$repo/$arch
+# * By: Albony (Chennai)
+#Server = https://in-4-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://in-5-mirror.chaotic.cx/$repo/$arch
+
+# Israel (IL)
+# * By: a0xz
+#Server = https://il-1-mirror.chaotic.cx/$repo/$arch
+
+# Italy (IT)
+# * By: a0xz
+#Server = https://it-1-mirror.chaotic.cx/$repo/$arch
+
+# Japan (JP)
+# * By: a0xz
+#Server = https://jp-1-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://jp-2-mirror.chaotic.cx/$repo/$arch
+
+# Mexico (MX)
+# * By: a0xz
+#Server = https://mx-1-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://mx-2-mirror.chaotic.cx/$repo/$arch
+
+# Netherlands (NL)
+# * By: a0xz
+#Server = https://nl-1-mirror.chaotic.cx/$repo/$arch
+
+# Russia (RU)
+# * By: Котпро203
+#Server = https://ru-1-mirror.chaotic.cx/$repo/$arch
+
+# Saudi Arabia (SA)
+# * By: a0xz
+#Server = https://sa-1-mirror.chaotic.cx/$repo/$arch
+
+# Singapore (SG)
+# * By: freedif.org (City state)
+#Server = https://sg-1-mirror.chaotic.cx/$repo/$arch
+
+# South Africa (ZA)
+# * By: a0xz
+#Server = https://za-1-mirror.chaotic.cx/$repo/$arch
+
+# South Korea (KR)
+# * By: <t.me/silent_heigou> (Seoul)
+#Server = https://kr-1-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://kr-2-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://kr-3-mirror.chaotic.cx/$repo/$arch
+
+# Spain (ES)
+# * By: JKANetwork
+#Server = https://es-1-mirror.chaotic.cx/$repo/$arch
+# * By: Ícar <t.me/IcarNS>
+#Server = https://es-2-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://es-3-mirror.chaotic.cx/$repo/$arch
+
+# Sweden (SE)
+# * By: Academic Computer Club in Umeå (accum.se)
+#Server = https://se-1-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://se-2-mirror.chaotic.cx/$repo/$arch
+
+# Switzerland (CH)
+# * By: a0xz
+#Server = https://ch-1-mirror.chaotic.cx/$repo/$arch
+
+# United Arab Emirates (AE)
+# * By: a0xz
+#Server = https://ae-1-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://ae-2-mirror.chaotic.cx/$repo/$arch
+
+# United Kingdom (GB)
+# * By: Wilbur <github.com/ThisCatLikesCrypto>
+#Server = https://gb-1-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://gb-2-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://gb-3-mirror.chaotic.cx/$repo/$arch
+
+# United States of America (US)
+# * By: Technetium1 <github.com/Technetium1>
+#Server = https://us-mi-mirror.chaotic.cx/$repo/$arch
+# * By: ash <t.me/the_ashh>
+#Server = https://us-ut-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://us-az-mirror.chaotic.cx/$repo/$arch
+# * By: a0xz
+#Server = https://us-ca-mirror.chaotic.cx/$repo/$arch
+
+# Vietnam (VN)
+# * By: <t.me/meowice>
+#Server = https://vn-1-mirror.chaotic.cx/$repo/$arch
@@ -0,0 +1,10 @@
+[Trigger]
+Type = Package
+Operation = Install
+Operation = Upgrade
+Target = *
+
+[Action]
+Description = Ensuring /dev/stdin exists...
+When = PreTransaction
+Exec = /usr/bin/sh -c "[ -e /dev/stdin ]  || ln -sf /proc/self/fd/0 /dev/stdin; [ -e /dev/stdout ] || ln -sf /proc/self/fd/1 /dev/stdout; [ -e /dev/stderr ] || ln -sf /proc/self/fd/2 /dev/stderr"
@@ -0,0 +1,6 @@
+# Bat configuration
+--theme="Catppuccin Mocha"
+--style="numbers,changes,header"
+--map-syntax="*.conf:INI"
+--map-syntax=".gitconfig:Git Config"
+--map-syntax=" Kitty:kitty"
@@ -0,0 +1,5 @@
+# Auto start Hyprland on tty1
+if test -z "$DISPLAY" ;and test "$XDG_VTNR" -eq 1
+    mkdir -p ~/.cache
+    exec start-hyprland > ~/.cache/hyprland.log 2>&1
+end
@@ -0,0 +1,7 @@
+complete --command fisher --exclusive --long help --description "Print help"
+complete --command fisher --exclusive --long version --description "Print version"
+complete --command fisher --exclusive --condition __fish_use_subcommand --arguments install --description "Install plugins"
+complete --command fisher --exclusive --condition __fish_use_subcommand --arguments update --description "Update installed plugins"
+complete --command fisher --exclusive --condition __fish_use_subcommand --arguments remove --description "Remove installed plugins"
+complete --command fisher --exclusive --condition __fish_use_subcommand --arguments list --description "List installed plugins matching regex"
+complete --command fisher --exclusive --condition "__fish_seen_subcommand_from update remove" --arguments "(fisher list)"
@@ -0,0 +1,21 @@
+complete --command nvm --exclusive
+complete --command nvm --exclusive --long version --description "Print version"
+complete --command nvm --exclusive --long help --description "Print help"
+complete --command nvm --long silent --description "Suppress standard output"
+
+complete --command nvm --exclusive --condition __fish_use_subcommand --arguments install --description "Download and activate the specified Node version"
+complete --command nvm --exclusive --condition __fish_use_subcommand --arguments use --description "Activate the specified Node version in the current shell"
+complete --command nvm --exclusive --condition __fish_use_subcommand --arguments list --description "List installed Node versions"
+complete --command nvm --exclusive --condition __fish_use_subcommand --arguments list-remote --description "List available Node versions to install"
+complete --command nvm --exclusive --condition __fish_use_subcommand --arguments current --description "Print the currently-active Node version"
+complete --command nvm --exclusive --condition "__fish_seen_subcommand_from install" --arguments "(
+    test -e $nvm_data && string split ' ' <$nvm_data/.index
+)"
+complete --command nvm --exclusive --condition "__fish_seen_subcommand_from use" --arguments "(_nvm_list | string split ' ')"
+complete --command nvm --exclusive --condition __fish_use_subcommand --arguments uninstall --description "Uninstall the specified Node version"
+complete --command nvm --exclusive --condition "__fish_seen_subcommand_from uninstall" --arguments "(
+    _nvm_list | string split ' ' | string replace system ''
+)"
+complete --command nvm --exclusive --condition "__fish_seen_subcommand_from use uninstall" --arguments "(
+    set --query nvm_default_version && echo default
+)"
@@ -0,0 +1,14 @@
+# This file was created by fish when upgrading to version 4.3, to migrate
+# the 'fish_key_bindings' variable from its old default scope (universal)
+# to its new default scope (global).  We recommend you delete this file
+# and configure key bindings in ~/.config/fish/config.fish if needed.
+
+# set --global fish_key_bindings fish_default_key_bindings
+
+# Prior to version 4.3, fish shipped an event handler that runs
+# `set --universal fish_key_bindings fish_default_key_bindings`
+# whenever the fish_key_bindings variable is erased.
+# This means that as long as any fish < 4.3 is still running on this system,
+# we cannot complete the migration.
+# As a workaround, erase the universal variable at every shell startup.
+set --erase --universal fish_key_bindings
@@ -0,0 +1,37 @@
+# This file was created by fish when upgrading to version 4.3, to migrate
+# theme variables from universal to global scope.
+# Don't edit this file, as it will be written by the web-config tool (`fish_config`).
+# To customize your theme, delete this file and see
+#     help interactive#syntax-highlighting
+# or
+#     man fish-interactive | less +/^SYNTAX.HIGHLIGHTING
+# for appropriate commands to add to ~/.config/fish/config.fish instead.
+# See also the release notes for fish 4.3.0 (run `help relnotes`).
+
+set --global fish_color_autosuggestion 555 brblack
+set --global fish_color_cancel -r
+set --global fish_color_command blue
+set --global fish_color_comment red
+set --global fish_color_cwd green
+set --global fish_color_cwd_root red
+set --global fish_color_end green
+set --global fish_color_error brred
+set --global fish_color_escape brcyan
+set --global fish_color_history_current --bold
+set --global fish_color_host normal
+set --global fish_color_host_remote yellow
+set --global fish_color_normal normal
+set --global fish_color_operator brcyan
+set --global fish_color_param cyan
+set --global fish_color_quote yellow
+set --global fish_color_redirection cyan --bold
+set --global fish_color_search_match --background=111
+set --global fish_color_selection white --bold --background=brblack
+set --global fish_color_status red
+set --global fish_color_user brgreen
+set --global fish_color_valid_path --underline
+set --global fish_pager_color_completion normal
+set --global fish_pager_color_description B3A06D yellow -i
+set --global fish_pager_color_prefix cyan --bold --underline
+set --global fish_pager_color_progress brwhite --background=cyan
+set --global fish_pager_color_selected_background -r
@@ -0,0 +1,28 @@
+set --query XDG_DATA_HOME || set --local XDG_DATA_HOME ~/.local/share
+set --query nvm_mirror || set --global nvm_mirror https://nodejs.org/dist
+set --query nvm_data || set --global nvm_data $XDG_DATA_HOME/nvm
+
+function _nvm_install --on-event nvm_install
+    test ! -d $nvm_data && command mkdir -p $nvm_data
+    echo "Downloading the Node distribution index..." 2>/dev/null
+    _nvm_index_update
+end
+
+function _nvm_update --on-event nvm_update
+    set --query --universal nvm_data && set --erase --universal nvm_data
+    set --query --universal nvm_mirror && set --erase --universal nvm_mirror
+    set --query nvm_mirror || set --global nvm_mirror https://nodejs.org/dist
+end
+
+function _nvm_uninstall --on-event nvm_uninstall
+    command rm -rf $nvm_data
+
+    set --query nvm_current_version && _nvm_version_deactivate $nvm_current_version
+
+    set --names | string replace --filter --regex -- "^nvm" "set --erase nvm" | source
+    functions --erase (functions --all | string match --entire --regex -- "^_nvm_")
+end
+
+if status is-interactive && set --query nvm_default_version && ! set --query nvm_current_version
+    nvm use --silent $nvm_default_version
+end
@@ -0,0 +1,33 @@
+# Commands to run in interactive sessions can go here
+if status is-interactive
+    # No greeting
+    set fish_greeting
+
+    # Use starship
+    function starship_transient_prompt_func
+        starship module character
+    end
+    if test "$TERM" != "linux"
+        starship init fish | source
+        enable_transience
+    end
+    
+    # Colors
+    if test -f ~/.local/state/quickshell/user/generated/terminal/sequences.txt
+        cat ~/.local/state/quickshell/user/generated/terminal/sequences.txt
+    end
+
+    # Aliases
+    # kitty doesn't clear properly so we need to do this weird printing
+    alias clear "printf '\033[2J\033[3J\033[1;1H'"
+    alias celar "printf '\033[2J\033[3J\033[1;1H'"
+    alias claer "printf '\033[2J\033[3J\033[1;1H'"
+    alias pamcan pacman
+    alias q 'qs -c end4-pC'
+    if test "$TERM" != "linux"
+        alias ls 'eza --icons'
+    end
+    if test "$TERM" = "xterm-kitty"
+        alias ssh 'kitten ssh'
+    end
+end
@@ -0,0 +1,2 @@
+jorgebucaran/fisher
+jorgebucaran/nvm.fish
@@ -0,0 +1,7 @@
+# This file contains fish universal variable definitions.
+# VERSION: 3.0
+SETUVAR __fish_initialized:4300
+SETUVAR _fisher_jorgebucaran_2F_fisher_files:\x7e/\x2econfig/fish/functions/fisher\x2efish\x1e\x7e/\x2econfig/fish/completions/fisher\x2efish
+SETUVAR _fisher_jorgebucaran_2F_nvm_2E_fish_files:\x7e/\x2econfig/fish/functions/_nvm_index_update\x2efish\x1e\x7e/\x2econfig/fish/functions/_nvm_list\x2efish\x1e\x7e/\x2econfig/fish/functions/_nvm_version_activate\x2efish\x1e\x7e/\x2econfig/fish/functions/_nvm_version_deactivate\x2efish\x1e\x7e/\x2econfig/fish/functions/nvm\x2efish\x1e\x7e/\x2econfig/fish/conf\x2ed/nvm\x2efish\x1e\x7e/\x2econfig/fish/completions/nvm\x2efish
+SETUVAR _fisher_plugins:jorgebucaran/fisher\x1ejorgebucaran/nvm\x2efish
+SETUVAR _fisher_upgraded_to_4_4:\x1d
@@ -0,0 +1,20 @@
+function _nvm_index_update
+    test ! -d $nvm_data && command mkdir -p $nvm_data
+
+    set --local index $nvm_data/.index
+
+    if not command curl -q --location --silent $nvm_mirror/index.tab >$index.temp
+        command rm -f $index.temp
+        echo "nvm: Can't update index, host unavailable: \"$nvm_mirror\"" >&2
+        return 1
+    end
+
+    command awk -v OFS=\t '
+        /v0.9.12/ { exit } # Unsupported
+        NR > 1 {
+            print $1 (NR == 2  ? " latest" : $10 != "-" ? " lts/" tolower($10) : "")
+        }
+    ' $index.temp >$index
+
+    command rm -f $index.temp
+end
@@ -0,0 +1,14 @@
+function _nvm_list
+    set --local versions $nvm_data/*
+
+    set --query versions[1] &&
+        string match --entire --regex -- (
+            string replace --all -- $nvm_data/ "" $versions |
+            string match --regex -- "v\d.+" |
+            string escape --style=regex |
+            string join "|"
+        ) <$nvm_data/.index
+
+    command --all node |
+        string match --quiet --invert --regex -- "^$nvm_data" && echo system
+end
@@ -0,0 +1,4 @@
+function _nvm_version_activate --argument-names ver
+    set --global --export nvm_current_version $ver
+    set --prepend PATH $nvm_data/$ver/bin
+end
@@ -0,0 +1,5 @@
+function _nvm_version_deactivate --argument-names ver
+    test "$nvm_current_version" = "$ver" && set --erase nvm_current_version
+    set --local index (contains --index -- $nvm_data/$ver/bin $PATH) &&
+        set --erase PATH[$index]
+end
@@ -0,0 +1,3 @@
+function edit --wraps=nvim --description 'alias edit=nvim'
+    nvim $argv
+end
@@ -0,0 +1,251 @@
+function fisher --argument-names cmd --description "A plugin manager for Fish"
+    set --query fisher_path || set --local fisher_path $__fish_config_dir
+    set --local fisher_version 4.4.8
+    set --local fish_plugins $__fish_config_dir/fish_plugins
+
+    switch "$cmd"
+        case -v --version
+            echo "fisher, version $fisher_version"
+        case "" -h --help
+            echo "Usage: fisher install   <plugins...>  Install plugins"
+            echo "       fisher remove    <plugins...>  Remove installed plugins" 
+            echo "       fisher uninstall <plugins...>  Remove installed plugins (alias)" 
+            echo "       fisher update    <plugins...>  Update installed plugins"
+            echo "       fisher update                  Update all installed plugins"
+            echo "       fisher list    [<regex>]       List installed plugins matching regex"
+            echo "Options:"
+            echo "       -v, --version  Print version"
+            echo "       -h, --help     Print this help message"
+            echo "Variables:"
+            echo "       \$fisher_path  Plugin installation path. Default: $__fish_config_dir" | string replace --regex -- $HOME \~
+        case ls list
+            string match --entire --regex -- "$argv[2]" $_fisher_plugins
+        case install update remove uninstall
+            isatty || read --local --null --array stdin && set --append argv $stdin
+
+            test "$cmd" = uninstall && set cmd remove
+
+            set --local install_plugins
+            set --local update_plugins
+            set --local remove_plugins
+            set --local arg_plugins $argv[2..-1]
+            set --local old_plugins $_fisher_plugins
+            set --local new_plugins
+
+            test -e $fish_plugins && set --local file_plugins (string match --regex -- '^[^\s]+$' <$fish_plugins | string replace -- \~ ~)
+
+            if ! set --query argv[2]
+                if test "$cmd" != update
+                    echo "fisher: Not enough arguments for command: \"$cmd\"" >&2 && return 1
+                else if ! set --query file_plugins
+                    echo "fisher: \"$fish_plugins\" file not found: \"$cmd\"" >&2 && return 1
+                end
+                set arg_plugins $file_plugins
+            else if test "$cmd" = install && ! set --query old_plugins[1] 
+                set --append arg_plugins $file_plugins
+            end
+
+            for plugin in $arg_plugins
+                set plugin (test -e "$plugin" && realpath $plugin || string lower -- $plugin)
+                contains -- "$plugin" $new_plugins || set --append new_plugins $plugin
+            end
+
+            if set --query argv[2]
+                for plugin in $new_plugins
+                    if contains -- "$plugin" $old_plugins
+                        test "$cmd" = remove &&
+                            set --append remove_plugins $plugin ||
+                            set --append update_plugins $plugin
+                    else if test "$cmd" = install
+                        set --append install_plugins $plugin
+                    else
+                        echo "fisher: Plugin not installed: \"$plugin\"" >&2 && return 1
+                    end
+                end
+            else
+                for plugin in $new_plugins
+                    contains -- "$plugin" $old_plugins &&
+                        set --append update_plugins $plugin ||
+                        set --append install_plugins $plugin
+                end
+
+                for plugin in $old_plugins
+                    contains -- "$plugin" $new_plugins || set --append remove_plugins $plugin
+                end
+            end
+
+            set --local pid_list
+            set --local source_plugins
+            set --local fetch_plugins $update_plugins $install_plugins
+            set --local fish_path (status fish-path)
+
+            echo (set_color --bold)fisher $cmd version $fisher_version(set_color normal)
+
+            for plugin in $fetch_plugins
+                set --local source (command mktemp -d)
+                set --append source_plugins $source
+
+                command mkdir -p $source/{completions,conf.d,themes,functions}
+
+                $fish_path --command "
+                    if test -e $plugin
+                        command cp -Rf $plugin/* $source
+                    else
+                        set resp (command mktemp)
+                        set temp (command mktemp -d)
+                        set repo (string split -- \@ $plugin) || set repo[2] HEAD
+
+                        if set path (string replace --regex -- '^(https://)?gitlab.com/' '' \$repo[1])
+                            set name (string split -- / \$path)[-1]
+                            set url https://gitlab.com/\$path/-/archive/\$repo[2]/\$name-\$repo[2].tar.gz
+                        else
+                            set url https://api.github.com/repos/\$repo[1]/tarball/\$repo[2]
+                        end
+
+                        echo Fetching (set_color --underline)\$url(set_color normal)
+
+                        set http (command curl -q --silent -L -o \$resp -w %{http_code} \$url)
+
+                        if test \"\$http\" = 200 && command tar -xzC \$temp -f \$resp 2>/dev/null
+                            command cp -Rf \$temp/*/* $source
+                        else if test \"\$http\" = 403
+                            echo fisher: GitHub API rate limit exceeded \(HTTP 403\) >&2
+                            command rm -rf $source
+                        else
+                            echo fisher: Invalid plugin name or host unavailable: \\\"$plugin\\\" >&2
+                            command rm -rf $source
+                        end
+
+                        command rm -rf \$temp
+                    end
+
+                    set files $source/* && string match --quiet --regex -- .+\.fish\\\$ \$files
+                " &
+
+                set --append pid_list (jobs --last --pid)
+            end
+
+            wait $pid_list 2>/dev/null
+
+            for plugin in $fetch_plugins
+                if set --local source $source_plugins[(contains --index -- "$plugin" $fetch_plugins)] && test ! -e $source
+                    if set --local index (contains --index -- "$plugin" $install_plugins)
+                        set --erase install_plugins[$index]
+                    else
+                        set --erase update_plugins[(contains --index -- "$plugin" $update_plugins)]
+                    end
+                end
+            end
+
+            for plugin in $update_plugins $remove_plugins
+                if set --local index (contains --index -- "$plugin" $_fisher_plugins)
+                    set --local plugin_files_var _fisher_(string escape --style=var -- $plugin)_files
+
+                    if contains -- "$plugin" $remove_plugins
+                        for name in (string replace --filter --regex -- '.+/conf\.d/([^/]+)\.fish$' '$1' $$plugin_files_var)
+                            emit {$name}_uninstall
+                        end
+                        printf "%s\n" Removing\ (set_color red --bold)$plugin(set_color normal) "         "$$plugin_files_var | string replace -- \~ ~
+                        set --erase _fisher_plugins[$index]
+                    end
+
+                    command rm -rf (string replace -- \~ ~ $$plugin_files_var)
+
+                    functions --erase (string replace --filter --regex -- '.+/functions/([^/]+)\.fish$' '$1' $$plugin_files_var)
+
+                    for name in (string replace --filter --regex -- '.+/completions/([^/]+)\.fish$' '$1' $$plugin_files_var)
+                        complete --erase --command $name
+                    end
+
+                    set --erase $plugin_files_var
+                end
+            end
+
+            if set --query update_plugins[1] || set --query install_plugins[1]
+                command mkdir -p $fisher_path/{functions,themes,conf.d,completions}
+            end
+
+            for plugin in $update_plugins $install_plugins
+                set --local source $source_plugins[(contains --index -- "$plugin" $fetch_plugins)]
+                set --local files $source/{functions,themes,conf.d,completions}/*
+
+                if set --local index (contains --index -- $plugin $install_plugins)
+                    set --local user_files $fisher_path/{functions,themes,conf.d,completions}/*
+                    set --local conflict_files
+
+                    for file in (string replace -- $source/ $fisher_path/ $files)
+                        contains -- $file $user_files && set --append conflict_files $file
+                    end
+
+                    if set --query conflict_files[1] && set --erase install_plugins[$index]
+                        echo -s "fisher: Cannot install \"$plugin\": please remove or move conflicting files first:" \n"        "$conflict_files >&2
+                        continue
+                    end
+                end
+
+                for file in (string replace -- $source/ "" $files)
+                    command cp -RLf $source/$file $fisher_path/$file
+                end
+
+                set --local plugin_files_var _fisher_(string escape --style=var -- $plugin)_files
+
+                set --query files[1] && set --universal $plugin_files_var (string replace -- $source $fisher_path $files | string replace -- ~ \~)
+
+                contains -- $plugin $_fisher_plugins || set --universal --append _fisher_plugins $plugin
+                contains -- $plugin $install_plugins && set --local event install || set --local event update
+
+                printf "%s\n" Installing\ (set_color --bold)$plugin(set_color normal) "           "$$plugin_files_var | string replace -- \~ ~
+
+                for file in (string match --regex -- '.+/[^/]+\.fish$' $$plugin_files_var | string replace -- \~ ~)
+                    source $file
+                    if set --local name (string replace --regex -- '.+conf\.d/([^/]+)\.fish$' '$1' $file)
+                        emit {$name}_$event
+                    end
+                end
+            end
+
+            command rm -rf $source_plugins
+
+            if set --query _fisher_plugins[1]
+                set --local commit_plugins
+
+                for plugin in $file_plugins
+                    contains -- (string lower -- $plugin) (string lower -- $_fisher_plugins) && set --append commit_plugins $plugin
+                end
+
+                for plugin in $_fisher_plugins
+                    contains -- (string lower -- $plugin) (string lower -- $commit_plugins) || set --append commit_plugins $plugin
+                end
+
+                string replace --regex -- $HOME \~ $commit_plugins >$fish_plugins
+            else
+                set --erase _fisher_plugins
+                command rm -f $fish_plugins
+            end
+
+            set --local total (count $install_plugins) (count $update_plugins) (count $remove_plugins)
+
+            test "$total" != "0 0 0" && echo (string join ", " (
+                test $total[1] = 0 || echo "Installed $total[1]") (
+                test $total[2] = 0 || echo "Updated $total[2]") (
+                test $total[3] = 0 || echo "Removed $total[3]")
+            ) plugin/s
+        case \*
+            echo "fisher: Unknown command: \"$cmd\"" >&2 && return 1
+    end
+end
+
+if ! set --query _fisher_upgraded_to_4_4
+    set --universal _fisher_upgraded_to_4_4
+    if functions --query _fisher_list
+        set --query XDG_DATA_HOME[1] || set --local XDG_DATA_HOME ~/.local/share
+        command rm -rf $XDG_DATA_HOME/fisher
+        functions --erase _fisher_{list,plugin_parse}
+        fisher update >/dev/null 2>/dev/null
+    else
+        for var in (set --names | string match --entire --regex '^_fisher_.+_files$')
+            set $var (string replace -- ~ \~ $$var)
+        end
+        functions --erase _fisher_fish_postexec
+    end
+end
@@ -0,0 +1,3 @@
+function lzd --wraps=lazydocker --description 'alias lzd=lazydocker'
+    lazydocker $argv
+end
@@ -0,0 +1,237 @@
+function nvm --description "Node version manager"
+    for silent in --silent -s
+        if set --local index (contains --index -- $silent $argv)
+            set --erase argv[$index] && break
+        end
+        set --erase silent
+    end
+
+    set --local cmd $argv[1]
+    set --local ver $argv[2]
+
+    if set --query silent && ! set --query cmd[1]
+        echo "nvm: Version number not specified (see nvm -h for usage)" >&2
+        return 1
+    end
+
+    if ! set --query ver[1] && contains -- "$cmd" install use
+        for file in .nvmrc .node-version
+            set file (_nvm_find_up $PWD $file) && read ver <$file && break
+        end
+
+        if ! set --query ver[1]
+            echo "nvm: Invalid version or missing \".nvmrc\" file" >&2
+            return 1
+        end
+    end
+
+    set --local their_version $ver
+
+    switch "$cmd"
+        case -v --version
+            echo "nvm, version 2.2.18"
+        case "" -h --help
+            echo "Usage: nvm install <version>    Download and activate the specified Node version"
+            echo "       nvm install              Install the version specified in the nearest .nvmrc file"
+            echo "       nvm use <version>        Activate the specified Node version in the current shell"
+            echo "       nvm use                  Activate the version specified in the nearest .nvmrc file"
+            echo "       nvm list                 List installed Node versions"
+            echo "       nvm list-remote          List available Node versions to install"
+            echo "       nvm list-remote <regex>  List Node versions matching a given regex pattern"
+            echo "       nvm current              Print the currently-active Node version"
+            echo "       nvm uninstall <version>  Uninstall the specified Node version"
+            echo "Options:"
+            echo "       -s, --silent             Suppress standard output"
+            echo "       -v, --version            Print the version of nvm"
+            echo "       -h, --help               Print this help message"
+            echo "Variables:"
+            echo "       nvm_arch                 Override architecture, e.g. x64-musl"
+            echo "       nvm_mirror               Use a mirror for downloading Node binaries"
+            echo "       nvm_default_version      Set the default version for new shells"
+            echo "       nvm_default_packages     Install a list of packages every time a Node version is installed"
+            echo "       nvm_data                 Set a custom directory for storing nvm data"
+            echo "Examples:"
+            echo "       nvm install latest       Install the latest version of Node"
+            echo "       nvm use 14.15.1          Use Node version 14.15.1"
+            echo "       nvm use system           Activate the system's Node version"
+
+        case install
+            _nvm_index_update
+
+            string match --entire --regex -- (_nvm_version_match $ver) <$nvm_data/.index | read ver alias
+
+            if ! set --query ver[1]
+                echo "nvm: Invalid version number or alias: \"$their_version\"" >&2
+                return 1
+            end
+
+            if test ! -e $nvm_data/$ver
+                set --local os (command uname -s | string lower)
+                set --local ext tar.gz
+                set --local arch (command uname -m)
+                set --local tarcmd tar
+
+                switch $os
+                    case aix
+                        set arch ppc64
+                    case sunos
+                    case linux
+                    case darwin
+                    case {msys_nt,mingw\*_nt}\*
+                        set os win
+                        set ext zip
+                        set tarcmd bsdtar
+                    case \*
+                        echo "nvm: Unsupported operating system: \"$os\"" >&2
+                        return 1
+                end
+
+                switch $arch
+                    case i\*86
+                        set arch x86
+                    case x86_64
+                        set arch x64
+                    case arm64
+                        string match --regex --quiet "v(?<major>\d+)" $ver
+                        if test "$os" = darwin -a $major -lt 16
+                            set arch x64
+                        end
+                    case armv6 armv6l
+                        set arch armv6l
+                    case armv7 armv7l
+                        set arch armv7l
+                    case armv8 armv8l aarch64
+                        set arch arm64
+                end
+
+                set --query nvm_arch && set arch $nvm_arch
+
+                set --local dir "node-$ver-$os-$arch"
+                set --local url $nvm_mirror/$ver/$dir.$ext
+
+                command mkdir -p $nvm_data/$ver
+
+                if ! set --query silent
+                    echo -e "Installing Node \x1b[1m$ver\x1b[22m $alias"
+                    echo -e "Fetching \x1b[4m$url\x1b[24m\x1b[7m"
+                end
+
+                if ! command curl -q $silent --progress-bar --location $url |
+                        command $tarcmd --extract --gzip --directory $nvm_data/$ver 2>/dev/null
+                    command rm -rf $nvm_data/$ver
+                    echo -e "\033[F\33[2K\x1b[0mnvm: Invalid mirror or host unavailable: \"$url\"" >&2
+                    return 1
+                end
+
+                set --query silent || echo -en "\033[F\33[2K\x1b[0m"
+
+                if test "$os" = win
+                    command mv $nvm_data/$ver/$dir $nvm_data/$ver/bin
+                else
+                    command mv $nvm_data/$ver/$dir/* $nvm_data/$ver
+                    command rm -rf $nvm_data/$ver/$dir
+                end
+            end
+
+            if test $ver != "$nvm_current_version"
+                set --query nvm_current_version && _nvm_version_deactivate $nvm_current_version
+                _nvm_version_activate $ver
+
+                set --query nvm_default_packages[1] && npm install --global $silent $nvm_default_packages
+            end
+
+            set --query silent || printf "Now using Node %s (npm %s) %s\n" (_nvm_node_info)
+        case use
+            test $ver = default && set ver $nvm_default_version
+            _nvm_list | string match --entire --regex -- (_nvm_version_match $ver) | read ver __
+
+            if ! set --query ver[1]
+                echo "nvm: Can't use Node \"$their_version\", version must be installed first" >&2
+                return 1
+            end
+
+            if test $ver != "$nvm_current_version"
+                set --query nvm_current_version && _nvm_version_deactivate $nvm_current_version
+                test $ver != system && _nvm_version_activate $ver
+            end
+
+            set --query silent || printf "Now using Node %s (npm %s) %s\n" (_nvm_node_info)
+        case uninstall
+            if test -z "$ver"
+                echo "nvm: Not enough arguments for command: \"$cmd\"" >&2
+                return 1
+            end
+
+            test $ver = default && test ! -z "$nvm_default_version" && set ver $nvm_default_version
+
+            _nvm_list | string match --entire --regex -- (_nvm_version_match $ver) | read ver __
+
+            if ! set -q ver[1]
+                echo "nvm: Node version not installed or invalid: \"$their_version\"" >&2
+                return 1
+            end
+
+            set --query silent || printf "Uninstalling Node %s %s\n" $ver (string replace ~ \~ "$nvm_data/$ver/bin/node")
+
+            _nvm_version_deactivate $ver
+
+            command rm -rf $nvm_data/$ver
+        case current
+            _nvm_current
+        case ls list
+            _nvm_list | _nvm_list_format (_nvm_current) $argv[2]
+        case lsr {ls,list}-remote
+            _nvm_index_update || return
+            _nvm_list | command awk '
+                FILENAME == "-" && (is_local[$1] = FNR == NR) { next } {
+                    print $0 (is_local[$1] ? " ✓" : "")
+                }
+            ' - $nvm_data/.index | _nvm_list_format (_nvm_current) $argv[2]
+        case \*
+            echo "nvm: Unknown command or option: \"$cmd\" (see nvm -h for usage)" >&2
+            return 1
+    end
+end
+
+function _nvm_find_up --argument-names path file
+    test -e "$path/$file" && echo $path/$file || begin
+        test ! -z "$path" || return
+        _nvm_find_up (string replace --regex -- '/[^/]*$' "" $path) $file
+    end
+end
+
+function _nvm_version_match --argument-names ver
+    string replace --regex -- '^v?(\d+|\d+\.\d+)$' 'v$1.' $ver |
+        string replace --filter --regex -- '^v?(\d+)' 'v$1' |
+        string escape --style=regex || string lower '\b'$ver'(?:/\w+)?$'
+end
+
+function _nvm_list_format --argument-names current regex
+    command awk -v current="$current" -v regex="$regex" '
+        $0 ~ regex {
+            aliases[versions[i++] = $1] = $2 " " $3
+            pad = (n = length($1)) > pad ? n : pad
+        }
+        END {
+            if (!i) exit 1
+            while (i--)
+                printf((current == versions[i] ? " ▶ " : "   ") "%"pad"s %s\n",
+                    versions[i], aliases[versions[i]])
+        }
+    '
+end
+
+function _nvm_current
+    command --search --quiet node || return
+    set --query nvm_current_version && echo $nvm_current_version || echo system
+end
+
+function _nvm_node_info
+    set --local npm_path (string replace bin/npm-cli.js "" (realpath (command --search npm)))
+    test -f $npm_path/package.json || set --local npm_version_default (command npm --version)
+    command node --eval "
+        console.log(process.version)
+        console.log('$npm_version_default' ? '$npm_version_default': require('$npm_path/package.json').version)
+        console.log(process.execPath)
+    " | string replace -- ~ \~
+end
@@ -0,0 +1,3 @@
+function precmd --wraps="print -Pn '\\e]133;D;%?\\a\\e]133;A\\a'" --description "alias precmd=print -Pn '\\e]133;D;%?\\a\\e]133;A\\a'"
+    print -Pn '\e]133;D;%?\a\e]133;A\a' $argv
+end
@@ -0,0 +1,3 @@
+function preexec --wraps="print -Pn '\\e]133;B\\a\\e]133;C\\a'" --description "alias preexec=print -Pn '\\e]133;B\\a\\e]133;C\\a'"
+    print -Pn '\e]133;B\a\e]133;C\a' $argv
+end
@@ -0,0 +1,41 @@
+function update --description 'Automatically finds binarys and uses update commands'
+	if command -v pacman >/dev/null && command -v yay >/dev/null
+		echo "✅ 'pacman' and 'yay' found. Updating."
+		sudo pacman -Syu --noconfirm
+		yay -Syu --sudoloop --save --answerclean None --answerdiff None --noconfirm
+	else if command -v pacman >/dev/null
+		echo "✅ 'pacman' found. Updating."
+		sudo pacman -Syu --noconfirm
+	end
+
+	if command -v paru >/dev/null
+		echo "✅ 'paru' found. Updating."
+		paru -Syu
+	end
+
+	if command -v apt >/dev/null
+		echo "✅ 'apt' found. Updating."
+		sudo apt update && sudo apt full-upgrade -y
+	end
+
+	if command -v hyprpm >/dev/null
+		echo "✅ 'hyprpm' found. Updating."
+		hyprpm reload
+		sleep 2
+		hyprpm update
+	end
+
+	if command -v flatpak >/dev/null
+		echo "✅ 'flatpak' found. Updating."
+		flatpak update -y
+	end
+
+	if command -v npm >/dev/null
+		echo "✅ 'npm' found. Updating."
+		sudo npm install -g npm-check-updates
+	end
+
+	if command -v omz >/dev/null
+		omz update
+	end
+end
@@ -0,0 +1,15 @@
+-- This file will not be overwritten across dots-hyprland updates.
+-- The file name is for the sake of organization and does not matter
+-- See the corresponding files in ~/.config/hypr/hyprland for examples
+--
+
+hl.env("XCURSOR_THEME", "Catppuccin Macchiato Dark")
+hl.env("XCURSOR_SIZE", "24")
+hl.env("HYPRCURSOR_THEME", "Catppuccin Macchiato Dark")
+hl.env("HYPRCURSOR_SIZE", "24")
+hl.env("WEBKIT_DISABLE_DMABUF_RENDERER", "1")
+
+ecosystem = {
+	no_donation_nag = true,
+	no_update_news = false,
+}
@@ -0,0 +1,8 @@
+-- This file will not be overwritten across dots-hyprland updates.
+-- The file name is for the sake of organization and does not matter
+-- See the corresponding files in ~/.config/hypr/hyprland for examples
+
+hl.on("hyprland.start", function()
+	hl.exec_cmd("hyprctl setcursor 'Catppuccin Macchiato Dark' 24")
+	hl.exec_cmd("kdeconnectd &")
+end)
@@ -0,0 +1,9 @@
+-- This file will not be overwritten across dots-hyprland updates.
+-- The file name is for the sake of organization and does not matter
+-- See the corresponding files in ~/.config/hypr/hyprland for examples
+
+hl.config({
+	input = {
+		kb_options = "caps:escape",
+	},
+})
@@ -0,0 +1,79 @@
+-- This file will not be overwritten across dots-hyprland updates.
+-- The file name is for the sake of organization and does not matter
+-- See the corresponding files in ~/.config/hypr/hyprland for examples
+
+--##! Overrides
+--# Unbind upstream binds we want to replace
+hl.unbind("SUPER + B") -- sidebar toggle -> we use this for browser
+hl.unbind("SUPER + T") -- terminal (we don't want this combo)
+hl.unbind("CTRL + ALT + T") -- terminal (we don't want this combo)
+hl.unbind("SUPER + W") -- browser (we use B instead)
+hl.unbind("SUPER + ALT + Page_Up")
+hl.unbind("SUPER + ALT + Page_Down")
+hl.unbind("SUPER + SHIFT + Page_Up")
+hl.unbind("SUPER + SHIFT + Page_Down")
+hl.unbind("SUPER + O")
+hl.unbind("SUPER + X")
+
+--# Unbind workspace focus with named keys (we use code: keys)
+for i = 0, 9 do
+	hl.unbind("SUPER + " .. i)
+end
+
+--# Rebind browser on B (previously sidebar toggle)
+hl.bind("SUPER + B", hl.dsp.exec_cmd(browser), { description = "App: Browser" })
+
+--# Rebind Obsidian
+hl.bind(
+	"SUPER + X",
+	hl.dsp.exec_cmd("/home/alvin/.local/bin/Obsidian.AppImage --password-store=gnome-libsecret"),
+	{ description = "App: Obsidian" }
+)
+
+--##! Workspace
+--# Switching with raw keycodes (layout-independent)
+for i = 1, 10 do
+	local numberkey = { 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 }
+	hl.bind("SUPER + code:" .. numberkey[i], function()
+		hl.dispatch(hl.dsp.focus({ workspace = workspace_in_group(i) }))
+	end)
+end
+--# keypad numbers
+for i = 1, 10 do
+	local numpadkey = { 87, 88, 89, 83, 84, 85, 79, 80, 81, 90 }
+	hl.bind("SUPER + code:" .. numpadkey[i], function()
+		hl.dispatch(hl.dsp.focus({ workspace = workspace_in_group(i) }))
+	end)
+end
+
+--#/# bind = SUPER+CTRL, code:,, -- Send to workspace & switch
+for i = 1, 10 do
+	local numberkey = { 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 }
+	hl.bind("SUPER + CTRL + code:" .. numberkey[i], function()
+		hl.dispatch(hl.dsp.window.move({ workspace = workspace_in_group(i), follow = true }))
+	end)
+end
+--# keypad numbers
+for i = 1, 10 do
+	local numpadkey = { 87, 88, 89, 83, 84, 85, 79, 80, 81, 90 }
+	hl.bind("SUPER + CTRL + code:" .. numpadkey[i], function()
+		hl.dispatch(hl.dsp.window.move({ workspace = workspace_in_group(i), follow = true }))
+	end)
+end
+
+--#/# bind = SUPER+ALT+SHIFT, Page_↑/↓,, -- Send to workspace left/right
+for i = 1, 6 do
+	local key = { "SUPER + ALT + Page_", "SUPER + SHIFT + Page_", "CTRL + SUPER + SHIFT + " }
+	local keycombos =
+		{ key[1] .. "down", key[1] .. "up", key[2] .. "down", key[2] .. "up", key[3] .. "Right", key[3] .. "Left" }
+	local prefix = { "+", "-", "r+", "r-", "r+", "r-" }
+	hl.bind(keycombos[i], hl.dsp.window.move({ workspace = prefix[i] .. "1" })) -- # [hidden]
+end
+
+--##! Utilities
+--#/# bind = SUPER+SHIFT+V, -- Paste as keystrokes
+hl.bind(
+	"SUPER + SHIFT + V",
+	hl.dsp.exec_cmd("/home/alvin/.config/hypr/custom/scripts/paste-as-type.sh"),
+	{ description = "App: Browser Script" }
+)
@@ -0,0 +1,3 @@
+-- This file will not be overwritten across dots-hyprland updates.
+-- The file name is for the sake of organization and does not matter
+-- See the corresponding files in ~/.config/hypr/hyprland for examples
@@ -0,0 +1,2 @@
+#!/bin/bash
+# The content of this script will be generated by switchwall.sh - Don't modify it by yourself.
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+# Grab text content from wayland clipboard
+text=$(wl-paste --no-newline 2>/dev/null)
+
+if [ -n "$text" ]; then
+  # Type out the clipboard string using ydotool
+  ydotool type -- "$text"
+fi
@@ -0,0 +1,8 @@
+-- This file will not be overwritten across dots-hyprland updates.
+-- The file name is for the sake of organization and does not matter
+-- See the corresponding files in ~/.config/hypr/hyprland for examples
+
+terminal = "kitty"
+browser = "zen-browser"
+codeEditor = "nvim"
+textEditor = "obsidian"
@@ -0,0 +1,677 @@
+{
+  "appearance": {
+    "extraBackgroundTint": true,
+    "fakeScreenRounding": 0,
+    "fonts": {
+      "expressive": "Space Grotesk",
+      "iconNerd": "JetBrains Mono NF",
+      "main": "Google Sans Flex",
+      "monospace": "JetBrains Mono NF",
+      "numbers": "Google Sans Flex",
+      "reading": "Readex Pro",
+      "title": "Google Sans Flex"
+    },
+    "palette": {
+      "accentColor": "",
+      "type": "scheme-tonal-spot"
+    },
+    "transparency": {
+      "automatic": true,
+      "backgroundTransparency": 0.11,
+      "contentTransparency": 0.57,
+      "enable": false
+    },
+    "wallpaperTheming": {
+      "enableAppsAndShell": true,
+      "enableQtApps": true,
+      "enableTerminal": true,
+      "terminalGenerationProps": {
+        "forceDarkMode": false,
+        "harmonizeThreshold": 100,
+        "harmony": 0.5,
+        "termFgBoost": 0.35
+      }
+    }
+  },
+  "apps": {
+    "bluetooth": "kcmshell6 kcm_bluetooth",
+    "changePassword": "kitty -1 --hold=yes fish -i -c 'passwd'",
+    "manageUser": "kcmshell6 kcm_users",
+    "network": "kcmshell6 kcm_networkmanagement",
+    "networkEthernet": "kcmshell6 kcm_networkmanagement",
+    "taskManager": "plasma-systemmonitor --page-name Processes",
+    "terminal": "kitty -1",
+    "update": "kitty -1 --hold=yes fish -i -c 'pkexec pacman -Syu'",
+    "volumeMixer": "~/.config/hypr/hyprland/scripts/launch_first_available.sh \"pavucontrol-qt\" \"pavucontrol\""
+  },
+  "background": {
+    "blurRadius": 32,
+    "centeredWallpaper": false,
+    "centeredWallpaperColor": "primaryContainer",
+    "centeredWallpaperOnlyWhenLocked": false,
+    "centeredWallpaperShape": "Cookie7Sided",
+    "centeredWallpaperSize": 400,
+    "enableWallpaperPreview": false,
+    "hideWhenFullscreen": true,
+    "lockWall": "",
+    "parallax": {
+      "autoVertical": false,
+      "enableSidebar": true,
+      "enableWorkspace": true,
+      "vertical": false,
+      "widgetsFactor": 1.2,
+      "workspaceZoom": 1.07
+    },
+    "screenList": [],
+    "showBlur": true,
+    "showGrid": true,
+    "showSnapLines": true,
+    "splitRatio": "25",
+    "splitSide": "right",
+    "thumbnailPath": "",
+    "wallpaperAnimation": "random",
+    "wallpaperPath": "/home/alvin/Pictures/Wallpapers/Dynamic-Wallpapers/Dark/japan-street-Dark.png",
+    "widgets": {
+      "blurRadius": 32,
+      "blurWidgets": false,
+      "calendar": {
+        "enable": true,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "x": 1596,
+        "y": 744,
+        "z": 4
+      },
+      "clock": {
+        "color": "",
+        "cookie": {
+          "aiStyling": false,
+          "constantlyRotate": false,
+          "dateInClock": true,
+          "dateStyle": "bubble",
+          "dialNumberStyle": "full",
+          "hourHandStyle": "hollow",
+          "hourMarks": false,
+          "minuteHandStyle": "medium",
+          "secondHandStyle": "line",
+          "sides": 12,
+          "timeIndicators": true,
+          "useSineCookie": false
+        },
+        "digital": {
+          "adaptiveAlignment": true,
+          "animateChange": true,
+          "font": {
+            "family": "Google Sans Flex",
+            "roundness": 1.1290989771359807,
+            "size": 129.49608904933814,
+            "weight": 595.725165314564,
+            "width": 99.44532190132371
+          },
+          "showDate": true,
+          "vertical": false
+        },
+        "enable": true,
+        "pixel": {
+          "orientation": "vertical"
+        },
+        "placementStrategy": "leastBusy",
+        "quote": {
+          "enable": true,
+          "followClock": false,
+          "text": "Kawaī neko o zenbu tabe chaimasu."
+        },
+        "showOnlyWhenLocked": false,
+        "style": "digital",
+        "styleLocked": "cookie",
+        "x": 1423,
+        "y": 383,
+        "z": 3
+      },
+      "customImage": {
+        "enable": true,
+        "path": "",
+        "placementStrategy": "free",
+        "shape": "Cookie4Sided",
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "customText": {
+        "alignment": "center",
+        "color": "",
+        "content": "Hello world",
+        "enable": true,
+        "fontFamily": "Caveat",
+        "fontSize": 72,
+        "placementStrategy": "free",
+        "shadow": true,
+        "x": 400,
+        "y": 300,
+        "z": 0
+      },
+      "images": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "media": {
+        "backgroundShape": "Cookie4Sided",
+        "enable": true,
+        "placementStrategy": "free",
+        "showControls": true,
+        "showLyrics": false,
+        "showTitles": true,
+        "sizeMode": "1x3",
+        "x": 744,
+        "y": 876,
+        "z": 1
+      },
+      "notes": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "resources": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "shadow": true,
+      "sticker": {
+        "enable": false,
+        "items": [],
+        "outlineColor": "#ffffff",
+        "outlineWidth": 8,
+        "path": "",
+        "placementStrategy": "free",
+        "rotation": 0,
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "timers": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "todo": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "userCard": {
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "1x2",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "visualizer": {
+        "colorSource": "theme",
+        "enable": true,
+        "height": 343,
+        "placementStrategy": "free",
+        "ringSize": 380,
+        "sensitivity": 1.65,
+        "style": "mirror",
+        "x": 0,
+        "y": 0,
+        "z": -1000
+      },
+      "weather": {
+        "enable": false,
+        "expanded": false,
+        "placementStrategy": "mostBusy",
+        "sizeMode": "1x3",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "worldClock": {
+        "clockCount": 4,
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "timezones": [
+          "Australia/Sydney",
+          "Asia/Tokyo",
+          "Europe/London",
+          "America/New_York"
+        ],
+        "x": 400,
+        "y": 100,
+        "z": 0
+      }
+    },
+    "widgetsLocked": false
+  },
+  "bar": {
+    "autoHide": {
+      "enable": false,
+      "hoverRegionWidth": 2,
+      "pushWindows": false,
+      "showWhenPressingSuper": {
+        "delay": 140,
+        "enable": true
+      }
+    },
+    "borderless": "transparent",
+    "bottom": false,
+    "centerOnlyReserveFrame": false,
+    "cornerStyle": 3,
+    "divider": {
+      "spacing": 20,
+      "style": "rect"
+    },
+    "dynamicIsland": {
+      "leftWidget": "clockWidget",
+      "rightWidget": "systemIcons",
+      "showMediaControls": false,
+      "visualizerStyle": "wave"
+    },
+    "floatStyleShadow": true,
+    "followFrameColor": false,
+    "frameColor": "secondaryContainer",
+    "frameThickness": 4,
+    "groupColor": "layer1",
+    "indicators": {
+      "notifications": {
+        "showUnreadCount": true
+      }
+    },
+    "layouts": {
+      "leftLayout": [
+        "leftSidebarButton",
+        "activeWindow",
+        "resources"
+      ],
+      "middleLayout": [
+        "media",
+        "clockWidget",
+        "workspaces",
+        "utilButtons",
+        "weatherBar",
+        "batteryIndicator"
+      ],
+      "rightLayout": [
+        "sysTray",
+        "updatesCount",
+        "bluetooth",
+        "systemIcons"
+      ]
+    },
+    "media": {
+      "alwaysVisible": false,
+      "maxWidth": 280,
+      "minWidth": 100,
+      "onlyTitle": false,
+      "preferredPlayer": "",
+      "showLyrics": false
+    },
+    "resources": {
+      "alwaysShowCpu": true,
+      "alwaysShowCpuTemp": true,
+      "alwaysShowDisk": false,
+      "alwaysShowRam": true,
+      "alwaysShowSwap": false,
+      "cpuWarningThreshold": 90,
+      "memoryWarningThreshold": 95,
+      "showValue": true,
+      "style": "outline",
+      "swapWarningThreshold": 85
+    },
+    "screenList": [],
+    "showBackground": true,
+    "showFrame": false,
+    "tooltips": {
+      "clickToShow": false,
+      "enable": true
+    },
+    "topLeftIcon": "spark",
+    "utilButtons": {
+      "isRecording": false,
+      "showColorPicker": false,
+      "showDarkModeToggle": false,
+      "showKeyboardToggle": true,
+      "showMicToggle": true,
+      "showPerformanceProfileToggle": true,
+      "showScreenRecord": false,
+      "showScreenSnip": false,
+      "showWallpaperToggle": false
+    },
+    "verbose": true,
+    "vertical": false,
+    "workspaces": {
+      "alwaysShowNumbers": true,
+      "indicatorStyle": "dot",
+      "monochromeIcons": true,
+      "numberMap": [],
+      "showAppIcons": true,
+      "showNumberDelay": 200,
+      "shown": 10,
+      "useNerdFont": false
+    }
+  },
+  "calendar": {
+    "locale": "en-GB"
+  },
+  "conflictKiller": {
+    "autoKillNotificationDaemons": true,
+    "autoKillTrays": true
+  },
+  "crosshair": {
+    "code": "0;P;d;1;0l;10;0o;2;1b;0"
+  },
+  "custom": {
+    "colorizeIcon": true,
+    "distroIcon": "google-gemini-symbolic"
+  },
+  "dock": {
+    "enable": true,
+    "height": 60,
+    "hoverRegionHeight": 2,
+    "hoverToReveal": true,
+    "ignoredAppRegexes": [],
+    "monochromeIcons": false,
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "zen"
+    ],
+    "pinnedOnStartup": false,
+    "showAppsButton": true,
+    "showBackground": true,
+    "showMedia": true,
+    "showPinButton": true
+  },
+  "hacks": {
+    "arbitraryRaceConditionDelay": 20
+  },
+  "hyprland": {
+    "animations": {
+      "animation": "normal",
+      "enable": true
+    },
+    "decoration": {
+      "activeOpacity": 1,
+      "blur": {
+        "enabled": false,
+        "passes": 3,
+        "size": 1
+      },
+      "inactiveOpacity": 0.95,
+      "rounding": 22,
+      "shadow": {
+        "enabled": true,
+        "range": 4
+      }
+    },
+    "general": {
+      "borderColor": {
+        "activeOpacity": 0.47,
+        "activeRole": "layer0Border",
+        "enable": false,
+        "inactiveOpacity": 0.2,
+        "inactiveRole": "layer0Border"
+      },
+      "borderSize": 1,
+      "gapsIn": 2,
+      "gapsOut": 5
+    },
+    "idle": {
+      "lock": 300,
+      "screenOff": 600,
+      "suspend": 10800
+    }
+  },
+  "interactions": {
+    "deadPixelWorkaround": {
+      "enable": false
+    },
+    "scrolling": {
+      "fasterTouchpadScroll": false,
+      "mouseScrollDeltaThreshold": 120,
+      "mouseScrollFactor": 120,
+      "touchpadScrollFactor": 450
+    }
+  },
+  "launcher": {
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "kitty",
+      "cmake-gui"
+    ]
+  },
+  "light": {
+    "antiFlashbang": {
+      "enable": false
+    },
+    "night": {
+      "automatic": false,
+      "colorTemperature": 5559,
+      "from": "19:00",
+      "to": "06:30"
+    }
+  },
+  "lock": {
+    "blur": {
+      "enable": false,
+      "extraZoom": 1.1,
+      "radius": 100,
+      "size": 20
+    },
+    "centerClock": true,
+    "launchOnStartup": false,
+    "materialShapeChars": true,
+    "security": {
+      "requirePasswordToPower": true,
+      "unlockKeyring": true
+    },
+    "showLockedText": true,
+    "showMedia": true,
+    "showToolbars": true,
+    "showWidgets": false,
+    "useHyprlock": false
+  },
+  "media": {
+    "filterDuplicatePlayers": true
+  },
+  "notifications": {
+    "position": "top_right",
+    "timeout": 7000
+  },
+  "osd": {
+    "timeout": 3000
+  },
+  "osk": {
+    "layout": "qwerty_full",
+    "pinnedOnStartup": false
+  },
+  "overlay": {
+    "clickthroughOpacity": 0.8,
+    "darkenScreen": false,
+    "floatingImage": {
+      "imageSource": "https://media.tenor.com/H5U5bJzj3oAAAAAi/kukuru.gif",
+      "scale": 0.5
+    },
+    "openingZoomAnimation": true
+  },
+  "overview": {
+    "centerIcons": true,
+    "columns": 5,
+    "enable": true,
+    "orderBottomUp": false,
+    "orderRightLeft": false,
+    "rows": 2,
+    "scale": 0.18,
+    "style": "default"
+  },
+  "panelFamily": "ii",
+  "policies": {
+    "ai": 1,
+    "weeb": 1
+  },
+  "profile": {
+    "avatarPath": "/home/alvin/Sync_Documents/",
+    "avatarPicture": "/home/alvin/Sync_Documents/Alvin logo original.png",
+    "descriptionText": "::uptime::",
+    "displayName": "",
+    "onlinePresets": true
+  },
+  "regionSelector": {
+    "annotation": {
+      "useSatty": false
+    },
+    "circle": {
+      "padding": 10,
+      "strokeWidth": 6
+    },
+    "rect": {
+      "showAimLines": true
+    },
+    "targetRegions": {
+      "content": true,
+      "contentRegionOpacity": 0.8,
+      "layers": true,
+      "opacity": 0.3,
+      "selectionPadding": 5,
+      "showLabel": false,
+      "windows": true
+    }
+  },
+  "resources": {
+    "historyLength": 60,
+    "updateInterval": 3100
+  },
+  "settings": {
+    "borderColor": "layer0Border",
+    "borderSize": 1,
+    "collapsedSections": [],
+    "style": "default"
+  },
+  "sidebar": {
+    "ai": {
+      "textFadeIn": false
+    },
+    "banner": true,
+    "bannerImage": "",
+    "booru": {
+      "allowNsfw": true,
+      "defaultProvider": "yandere",
+      "limit": 20,
+      "zerochan": {
+        "username": "theodorer61"
+      }
+    },
+    "bottomGroup": false,
+    "cornerOpen": {
+      "bottom": true,
+      "bottomLeftAction": "sidebarLeftOpen",
+      "bottomRightAction": "sidebarRightOpen",
+      "clickless": false,
+      "clicklessCornerEnd": true,
+      "clicklessCornerVerticalOffset": 1,
+      "cornerRegionHeight": 5,
+      "cornerRegionWidth": 250,
+      "enable": true,
+      "valueScroll": true,
+      "visualize": false
+    },
+    "keepRightSidebarLoaded": false,
+    "media": {
+      "artColors": false,
+      "artShape": "Oval",
+      "blurredBackground": false,
+      "enable": true,
+      "shapeArt": false,
+      "showLyrics": true
+    },
+    "mediaPlayer": false,
+    "quickSliders": {
+      "enable": true,
+      "showBrightness": true,
+      "showMic": true,
+      "showVolume": true
+    },
+    "quickToggles": {
+      "android": {
+        "columns": 6,
+        "toggles": [
+          {
+            "size": 2,
+            "type": "network"
+          },
+          {
+            "size": 2,
+            "type": "bluetooth"
+          },
+          {
+            "size": 2,
+            "type": "audio"
+          },
+          {
+            "size": 1,
+            "type": "idleInhibitor"
+          },
+          {
+            "size": 2,
+            "type": "mic"
+          },
+          {
+            "size": 1,
+            "type": "nightLight"
+          },
+          {
+            "size": 2,
+            "type": "powerProfile"
+          }
+        ]
+      },
+      "style": "android"
+    },
+    "translator": {
+      "delay": 300,
+      "enable": true
+    }
+  },
+  "tray": {
+    "filterPassive": true,
+    "invertPinnedItems": true,
+    "monochromeIcons": false,
+    "pinnedItems": [
+      "Fcitx"
+    ],
+    "showItemId": false
+  },
+  "wallpaperSelector": {
+    "changeInterval": 0,
+    "closeAfterSelection": true,
+    "columns": 4,
+    "liveWallpapersPath": "",
+    "showBlurBackground": false,
+    "showHomePath": true,
+    "showSearchbar": true,
+    "sortMode": "time",
+    "useSystemFileDialog": false,
+    "userPath": "/home/alvin/Pictures/Wallpapers/"
+  },
+  "windows": {
+    "centerTitle": true,
+    "showTitlebar": true
+  }
+}
@@ -0,0 +1,676 @@
+{
+  "appearance": {
+    "extraBackgroundTint": true,
+    "fakeScreenRounding": 0,
+    "fonts": {
+      "expressive": "Space Grotesk",
+      "iconNerd": "JetBrains Mono NF",
+      "main": "Google Sans Flex",
+      "monospace": "JetBrains Mono NF",
+      "numbers": "Google Sans Flex",
+      "reading": "Readex Pro",
+      "title": "Google Sans Flex"
+    },
+    "palette": {
+      "accentColor": "",
+      "type": "scheme-tonal-spot"
+    },
+    "transparency": {
+      "automatic": true,
+      "backgroundTransparency": 0.11,
+      "contentTransparency": 0.57,
+      "enable": false
+    },
+    "wallpaperTheming": {
+      "enableAppsAndShell": true,
+      "enableQtApps": true,
+      "enableTerminal": true,
+      "terminalGenerationProps": {
+        "forceDarkMode": false,
+        "harmonizeThreshold": 100,
+        "harmony": 0.5,
+        "termFgBoost": 0.35
+      }
+    }
+  },
+  "apps": {
+    "bluetooth": "kcmshell6 kcm_bluetooth",
+    "changePassword": "kitty -1 --hold=yes fish -i -c 'passwd'",
+    "manageUser": "kcmshell6 kcm_users",
+    "network": "kcmshell6 kcm_networkmanagement",
+    "networkEthernet": "kcmshell6 kcm_networkmanagement",
+    "taskManager": "plasma-systemmonitor --page-name Processes",
+    "terminal": "kitty -1",
+    "update": "kitty -1 --hold=yes fish -i -c 'pkexec pacman -Syu'",
+    "volumeMixer": "~/.config/hypr/hyprland/scripts/launch_first_available.sh \"pavucontrol-qt\" \"pavucontrol\""
+  },
+  "background": {
+    "blurRadius": 32,
+    "centeredWallpaper": false,
+    "centeredWallpaperColor": "primaryContainer",
+    "centeredWallpaperOnlyWhenLocked": false,
+    "centeredWallpaperShape": "Cookie7Sided",
+    "centeredWallpaperSize": 400,
+    "enableWallpaperPreview": false,
+    "hideWhenFullscreen": true,
+    "lockWall": "",
+    "parallax": {
+      "autoVertical": false,
+      "enableSidebar": true,
+      "enableWorkspace": true,
+      "vertical": false,
+      "widgetsFactor": 1.2,
+      "workspaceZoom": 1.07
+    },
+    "screenList": [],
+    "showBlur": true,
+    "showGrid": true,
+    "showSnapLines": true,
+    "splitRatio": "25",
+    "splitSide": "right",
+    "thumbnailPath": "",
+    "wallpaperAnimation": "random",
+    "wallpaperPath": "/home/alvin/Pictures/Wallpapers/Dynamic-Wallpapers/Dark/japan-street-Dark.png",
+    "widgets": {
+      "blurRadius": 32,
+      "blurWidgets": false,
+      "calendar": {
+        "enable": true,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "x": 1596,
+        "y": 744,
+        "z": 4
+      },
+      "clock": {
+        "color": "",
+        "cookie": {
+          "aiStyling": false,
+          "constantlyRotate": false,
+          "dateInClock": true,
+          "dateStyle": "bubble",
+          "dialNumberStyle": "full",
+          "hourHandStyle": "hollow",
+          "hourMarks": false,
+          "minuteHandStyle": "medium",
+          "secondHandStyle": "line",
+          "sides": 12,
+          "timeIndicators": true,
+          "useSineCookie": false
+        },
+        "digital": {
+          "adaptiveAlignment": true,
+          "animateChange": true,
+          "font": {
+            "family": "Google Sans Flex",
+            "roundness": 1.1290989771359807,
+            "size": 129.49608904933814,
+            "weight": 350,
+            "width": 99.44532190132371
+          },
+          "showDate": true,
+          "vertical": false
+        },
+        "enable": true,
+        "pixel": {
+          "orientation": "vertical"
+        },
+        "placementStrategy": "leastBusy",
+        "quote": {
+          "enable": true,
+          "followClock": false,
+          "text": "Kawaī neko o zenbu tabe chaimasu."
+        },
+        "showOnlyWhenLocked": false,
+        "style": "digital",
+        "styleLocked": "cookie",
+        "x": 1423,
+        "y": 383,
+        "z": 3
+      },
+      "customImage": {
+        "enable": true,
+        "path": "",
+        "placementStrategy": "free",
+        "shape": "Cookie4Sided",
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "customText": {
+        "alignment": "center",
+        "color": "",
+        "content": "Hello world",
+        "enable": true,
+        "fontFamily": "Caveat",
+        "fontSize": 72,
+        "placementStrategy": "free",
+        "shadow": true,
+        "x": 400,
+        "y": 300,
+        "z": 0
+      },
+      "images": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "media": {
+        "backgroundShape": "Cookie4Sided",
+        "enable": true,
+        "placementStrategy": "free",
+        "showControls": true,
+        "showLyrics": false,
+        "showTitles": true,
+        "sizeMode": "1x3",
+        "x": 744,
+        "y": 876,
+        "z": 1
+      },
+      "notes": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "resources": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "shadow": true,
+      "sticker": {
+        "enable": false,
+        "items": [],
+        "outlineColor": "#ffffff",
+        "outlineWidth": 8,
+        "path": "",
+        "placementStrategy": "free",
+        "rotation": 0,
+        "size": 200,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "timers": {
+        "enable": false,
+        "placementStrategy": "free",
+        "vertical": false,
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "todo": {
+        "enable": false,
+        "placementStrategy": "free",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "userCard": {
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "1x2",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "visualizer": {
+        "colorSource": "theme",
+        "enable": true,
+        "height": 342,
+        "placementStrategy": "free",
+        "ringSize": 380,
+        "sensitivity": 1.65,
+        "style": "mirror",
+        "x": 0,
+        "y": 0,
+        "z": -1000
+      },
+      "weather": {
+        "enable": false,
+        "expanded": false,
+        "placementStrategy": "mostBusy",
+        "sizeMode": "1x3",
+        "x": 400,
+        "y": 100,
+        "z": 0
+      },
+      "worldClock": {
+        "clockCount": 4,
+        "enable": false,
+        "placementStrategy": "free",
+        "sizeMode": "2x2",
+        "timezones": [
+          "Australia/Sydney",
+          "Asia/Tokyo",
+          "Europe/London",
+          "America/New_York"
+        ],
+        "x": 400,
+        "y": 100,
+        "z": 0
+      }
+    },
+    "widgetsLocked": false
+  },
+  "bar": {
+    "autoHide": {
+      "enable": false,
+      "hoverRegionWidth": 2,
+      "pushWindows": false,
+      "showWhenPressingSuper": {
+        "delay": 140,
+        "enable": true
+      }
+    },
+    "borderless": "transparent",
+    "bottom": false,
+    "centerOnlyReserveFrame": false,
+    "cornerStyle": 3,
+    "divider": {
+      "spacing": 20,
+      "style": "rect"
+    },
+    "dynamicIsland": {
+      "leftWidget": "clockWidget",
+      "rightWidget": "systemIcons",
+      "showMediaControls": false,
+      "visualizerStyle": "wave"
+    },
+    "floatStyleShadow": true,
+    "followFrameColor": false,
+    "frameColor": "secondaryContainer",
+    "frameThickness": 4,
+    "groupColor": "layer1",
+    "indicators": {
+      "notifications": {
+        "showUnreadCount": true
+      }
+    },
+    "layouts": {
+      "leftLayout": [
+        "leftSidebarButton",
+        "activeWindow",
+        "resources"
+      ],
+      "middleLayout": [
+        "media",
+        "clockWidget",
+        "workspaces",
+        "utilButtons",
+        "weatherBar"
+      ],
+      "rightLayout": [
+        "sysTray",
+        "updatesCount",
+        "bluetooth",
+        "systemIcons"
+      ]
+    },
+    "media": {
+      "alwaysVisible": false,
+      "maxWidth": 280,
+      "minWidth": 100,
+      "onlyTitle": false,
+      "preferredPlayer": "",
+      "showLyrics": false
+    },
+    "resources": {
+      "alwaysShowCpu": true,
+      "alwaysShowCpuTemp": true,
+      "alwaysShowDisk": false,
+      "alwaysShowRam": true,
+      "alwaysShowSwap": false,
+      "cpuWarningThreshold": 90,
+      "memoryWarningThreshold": 95,
+      "showValue": true,
+      "style": "outline",
+      "swapWarningThreshold": 85
+    },
+    "screenList": [],
+    "showBackground": true,
+    "showFrame": false,
+    "tooltips": {
+      "clickToShow": false,
+      "enable": true
+    },
+    "topLeftIcon": "spark",
+    "utilButtons": {
+      "isRecording": false,
+      "showColorPicker": false,
+      "showDarkModeToggle": false,
+      "showKeyboardToggle": false,
+      "showMicToggle": true,
+      "showPerformanceProfileToggle": true,
+      "showScreenRecord": false,
+      "showScreenSnip": false,
+      "showWallpaperToggle": false
+    },
+    "verbose": true,
+    "vertical": false,
+    "workspaces": {
+      "alwaysShowNumbers": true,
+      "indicatorStyle": "dot",
+      "monochromeIcons": true,
+      "numberMap": [],
+      "showAppIcons": true,
+      "showNumberDelay": 200,
+      "shown": 10,
+      "useNerdFont": false
+    }
+  },
+  "calendar": {
+    "locale": "en-GB"
+  },
+  "conflictKiller": {
+    "autoKillNotificationDaemons": true,
+    "autoKillTrays": true
+  },
+  "crosshair": {
+    "code": "0;P;d;1;0l;10;0o;2;1b;0"
+  },
+  "custom": {
+    "colorizeIcon": true,
+    "distroIcon": "google-gemini-symbolic"
+  },
+  "dock": {
+    "enable": true,
+    "height": 60,
+    "hoverRegionHeight": 2,
+    "hoverToReveal": true,
+    "ignoredAppRegexes": [],
+    "monochromeIcons": false,
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "zen"
+    ],
+    "pinnedOnStartup": false,
+    "showAppsButton": true,
+    "showBackground": true,
+    "showMedia": true,
+    "showPinButton": true
+  },
+  "hacks": {
+    "arbitraryRaceConditionDelay": 20
+  },
+  "hyprland": {
+    "animations": {
+      "animation": "normal",
+      "enable": true
+    },
+    "decoration": {
+      "activeOpacity": 1,
+      "blur": {
+        "enabled": false,
+        "passes": 3,
+        "size": 1
+      },
+      "inactiveOpacity": 0.95,
+      "rounding": 22,
+      "shadow": {
+        "enabled": true,
+        "range": 4
+      }
+    },
+    "general": {
+      "borderColor": {
+        "activeOpacity": 0.47,
+        "activeRole": "layer0Border",
+        "enable": false,
+        "inactiveOpacity": 0.2,
+        "inactiveRole": "layer0Border"
+      },
+      "borderSize": 1,
+      "gapsIn": 2,
+      "gapsOut": 5
+    },
+    "idle": {
+      "lock": 300,
+      "screenOff": 600,
+      "suspend": 10800
+    }
+  },
+  "interactions": {
+    "deadPixelWorkaround": {
+      "enable": false
+    },
+    "scrolling": {
+      "fasterTouchpadScroll": false,
+      "mouseScrollDeltaThreshold": 120,
+      "mouseScrollFactor": 120,
+      "touchpadScrollFactor": 450
+    }
+  },
+  "launcher": {
+    "pinnedApps": [
+      "org.kde.dolphin",
+      "kitty",
+      "cmake-gui"
+    ]
+  },
+  "light": {
+    "antiFlashbang": {
+      "enable": false
+    },
+    "night": {
+      "automatic": false,
+      "colorTemperature": 5559,
+      "from": "19:00",
+      "to": "06:30"
+    }
+  },
+  "lock": {
+    "blur": {
+      "enable": false,
+      "extraZoom": 1.1,
+      "radius": 100,
+      "size": 20
+    },
+    "centerClock": true,
+    "launchOnStartup": false,
+    "materialShapeChars": true,
+    "security": {
+      "requirePasswordToPower": true,
+      "unlockKeyring": true
+    },
+    "showLockedText": true,
+    "showMedia": true,
+    "showToolbars": true,
+    "showWidgets": false,
+    "useHyprlock": false
+  },
+  "media": {
+    "filterDuplicatePlayers": true
+  },
+  "notifications": {
+    "position": "top_right",
+    "timeout": 7000
+  },
+  "osd": {
+    "timeout": 3000
+  },
+  "osk": {
+    "layout": "qwerty_full",
+    "pinnedOnStartup": false
+  },
+  "overlay": {
+    "clickthroughOpacity": 0.8,
+    "darkenScreen": false,
+    "floatingImage": {
+      "imageSource": "https://media.tenor.com/H5U5bJzj3oAAAAAi/kukuru.gif",
+      "scale": 0.5
+    },
+    "openingZoomAnimation": true
+  },
+  "overview": {
+    "centerIcons": true,
+    "columns": 5,
+    "enable": true,
+    "orderBottomUp": false,
+    "orderRightLeft": false,
+    "rows": 2,
+    "scale": 0.18,
+    "style": "default"
+  },
+  "panelFamily": "ii",
+  "policies": {
+    "ai": 1,
+    "weeb": 1
+  },
+  "profile": {
+    "avatarPath": "",
+    "avatarPicture": "",
+    "descriptionText": "::uptime::",
+    "displayName": "",
+    "onlinePresets": false
+  },
+  "regionSelector": {
+    "annotation": {
+      "useSatty": false
+    },
+    "circle": {
+      "padding": 10,
+      "strokeWidth": 6
+    },
+    "rect": {
+      "showAimLines": true
+    },
+    "targetRegions": {
+      "content": true,
+      "contentRegionOpacity": 0.8,
+      "layers": true,
+      "opacity": 0.3,
+      "selectionPadding": 5,
+      "showLabel": false,
+      "windows": true
+    }
+  },
+  "resources": {
+    "historyLength": 60,
+    "updateInterval": 3100
+  },
+  "settings": {
+    "borderColor": "layer0Border",
+    "borderSize": 1,
+    "collapsedSections": [],
+    "style": "default"
+  },
+  "sidebar": {
+    "ai": {
+      "textFadeIn": false
+    },
+    "banner": true,
+    "bannerImage": "",
+    "booru": {
+      "allowNsfw": true,
+      "defaultProvider": "yandere",
+      "limit": 20,
+      "zerochan": {
+        "username": "theodorer61"
+      }
+    },
+    "bottomGroup": false,
+    "cornerOpen": {
+      "bottom": true,
+      "bottomLeftAction": "sidebarLeftOpen",
+      "bottomRightAction": "sidebarRightOpen",
+      "clickless": false,
+      "clicklessCornerEnd": true,
+      "clicklessCornerVerticalOffset": 1,
+      "cornerRegionHeight": 5,
+      "cornerRegionWidth": 250,
+      "enable": true,
+      "valueScroll": true,
+      "visualize": false
+    },
+    "keepRightSidebarLoaded": false,
+    "media": {
+      "artColors": false,
+      "artShape": "Oval",
+      "blurredBackground": false,
+      "enable": true,
+      "shapeArt": false,
+      "showLyrics": true
+    },
+    "mediaPlayer": false,
+    "quickSliders": {
+      "enable": true,
+      "showBrightness": true,
+      "showMic": true,
+      "showVolume": true
+    },
+    "quickToggles": {
+      "android": {
+        "columns": 6,
+        "toggles": [
+          {
+            "size": 2,
+            "type": "network"
+          },
+          {
+            "size": 2,
+            "type": "bluetooth"
+          },
+          {
+            "size": 2,
+            "type": "audio"
+          },
+          {
+            "size": 1,
+            "type": "idleInhibitor"
+          },
+          {
+            "size": 2,
+            "type": "mic"
+          },
+          {
+            "size": 1,
+            "type": "nightLight"
+          },
+          {
+            "size": 2,
+            "type": "powerProfile"
+          }
+        ]
+      },
+      "style": "android"
+    },
+    "translator": {
+      "delay": 300,
+      "enable": true
+    }
+  },
+  "tray": {
+    "filterPassive": true,
+    "invertPinnedItems": true,
+    "monochromeIcons": false,
+    "pinnedItems": [
+      "Fcitx"
+    ],
+    "showItemId": false
+  },
+  "wallpaperSelector": {
+    "changeInterval": 0,
+    "closeAfterSelection": true,
+    "columns": 4,
+    "liveWallpapersPath": "",
+    "showBlurBackground": false,
+    "showHomePath": true,
+    "showSearchbar": true,
+    "sortMode": "time",
+    "useSystemFileDialog": false,
+    "userPath": "/home/alvin/Pictures/Wallpapers/"
+  },
+  "windows": {
+    "centerTitle": true,
+    "showTitlebar": true
+  }
+}
@@ -0,0 +1,9 @@
+tt.*
+.tests
+doc/tags
+debug
+.repro
+foo.*
+*.log
+data
+.stfolder/
@@ -0,0 +1,15 @@
+{
+  "neodev": {
+    "library": {
+      "enabled": true,
+      "plugins": true
+    }
+  },
+  "neoconf": {
+    "plugins": {
+      "lua_ls": {
+        "enabled": true
+      }
+    }
+  }
+}
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
@@ -0,0 +1,4 @@
+# 💤 LazyVim
+
+A starter template for [LazyVim](https://github.com/LazyVim/LazyVim).
+Refer to the [documentation](https://lazyvim.github.io/installation) to get started.
@@ -0,0 +1,2 @@
+-- bootstrap lazy.nvim, LazyVim and your plugins
+require("config.lazy")
@@ -0,0 +1,54 @@
+{
+  "Arduino-Nvim": { "branch": "main", "commit": "c9983b5ead3b2ce574d9bcb9708febad0f8ddbd7" },
+  "CopilotChat.nvim": { "branch": "main", "commit": "f0c2a23ab79dc295f5e0eef0d8b587a39020c852" },
+  "LazyVim": { "branch": "main", "commit": "c10948c50b18fae7f256433afdef09e432410480" },
+  "SchemaStore.nvim": { "branch": "main", "commit": "1f8835ba58a2ad341c9c1515316a3183596dbb60" },
+  "blink-copilot": { "branch": "main", "commit": "7ad8209b2f880a2840c94cdcd80ab4dc511d4f39" },
+  "blink.cmp": { "branch": "main", "commit": "78336bc89ee5365633bcf754d93df01678b5c08f" },
+  "blink.compat": { "branch": "main", "commit": "2ed6d9a28b07fa6f3bface818470605f8896408c" },
+  "bufferline.nvim": { "branch": "main", "commit": "655133c3b4c3e5e05ec549b9f8cc2894ac6f51b3" },
+  "catppuccin": { "branch": "main", "commit": "058e83dc009e4dd62f30807054de9cc849699e27" },
+  "codeium.nvim": { "branch": "main", "commit": "821b570b526dbb05b57aa4ded578b709a704a38a" },
+  "conform.nvim": { "branch": "master", "commit": "619363c30309d29ffa631e67c8183f2a72caa373" },
+  "copilot.lua": { "branch": "master", "commit": "2a849bc7bec4d175524c332c20d48ca9ece735df" },
+  "dial.nvim": { "branch": "master", "commit": "f2634758455cfa52a8acea6f142dcd6271a1bf57" },
+  "flash.nvim": { "branch": "main", "commit": "b6346946d10d07998efee029fb0f7a593806d0cd" },
+  "friendly-snippets": { "branch": "main", "commit": "6cd7280adead7f586db6fccbd15d2cac7e2188b9" },
+  "gitsigns.nvim": { "branch": "main", "commit": "31d6fb2d618bca1482b9f274751ead5f03461408" },
+  "grug-far.nvim": { "branch": "main", "commit": "1cc080f55706b38aabfa97d40acb6adf59ac4a5a" },
+  "inc-rename.nvim": { "branch": "main", "commit": "0074b551a17338ccdcd299bd86687cc651bcb33d" },
+  "lazy.nvim": { "branch": "main", "commit": "85c7ff3711b730b4030d03144f6db6375044ae82" },
+  "lazydev.nvim": { "branch": "main", "commit": "ff2cbcba459b637ec3fd165a2be59b7bbaeedf0d" },
+  "lualine.nvim": { "branch": "master", "commit": "221ce6b2d999187044529f49da6554a92f740a96" },
+  "markdown-preview.nvim": { "branch": "master", "commit": "a923f5fc5ba36a3b17e289dc35dc17f66d0548ee" },
+  "mason-lspconfig.nvim": { "branch": "main", "commit": "7adc933dabcc7c86ae6b07aff7ee68eac398491f" },
+  "mason.nvim": { "branch": "main", "commit": "2a6940af80375532e5e9e7c1f2fc6319a1b7a69d" },
+  "mini.ai": { "branch": "main", "commit": "25248c6aa002391936a6200f12d1466015987133" },
+  "mini.hipatterns": { "branch": "main", "commit": "7c840c71d6a91f53d734cab2b6fe2290d285ec3b" },
+  "mini.icons": { "branch": "main", "commit": "98faae31e9be1cc054ae63485e58ceb185efcad0" },
+  "mini.pairs": { "branch": "main", "commit": "b1fd9df3bb4a41c8f45778a3859ee80ef6b367e3" },
+  "neotest": { "branch": "master", "commit": "4e2cd42c4252ee9d2435571d9adcdbc1d47931fe" },
+  "neotest-dart": { "branch": "main", "commit": "f10fc22a17559b3a7abb400e266db0a1201979e7" },
+  "neotest-golang": { "branch": "main", "commit": "61726ad54b6b94c73d130b65c33575d13a61fc11" },
+  "noice.nvim": { "branch": "main", "commit": "7bfd942445fb63089b59f97ca487d605e715f155" },
+  "nui.nvim": { "branch": "main", "commit": "de740991c12411b663994b2860f1a4fd0937c130" },
+  "nvim-ansible": { "branch": "main", "commit": "c7f595d568b588942d4d0c37b5cd6cae3764a148" },
+  "nvim-lint": { "branch": "master", "commit": "a219b2c9e5b4765e5c845aba119dad55806fcaf1" },
+  "nvim-lspconfig": { "branch": "master", "commit": "e7ca2c95ba316a8b846d3f3546d407908c5c4ccb" },
+  "nvim-nio": { "branch": "master", "commit": "edcc181a875301dd21840189aa2f2f9ad69fc172" },
+  "nvim-treesitter": { "branch": "main", "commit": "7248feaca45e4d944591497964bc19afa89ad1c6" },
+  "nvim-treesitter-textobjects": { "branch": "main", "commit": "898ee307df58f854d11cd7edd06472574d48014e" },
+  "nvim-ts-autotag": { "branch": "main", "commit": "88c1453db4ba7dd24131086fe51fdf74e587d275" },
+  "obsidian.nvim": { "branch": "main", "commit": "ae1f76a75c7ce36866e1d9342a8f6f5b9c2caf9b" },
+  "persistence.nvim": { "branch": "main", "commit": "b20b2a7887bd39c1a356980b45e03250f3dce49c" },
+  "plenary.nvim": { "branch": "master", "commit": "74b06c6c75e4eeb3108ec01852001636d85a932b" },
+  "render-markdown.nvim": { "branch": "main", "commit": "f422cb5c6855f150e2ddcfaf44e7157b98b34f6a" },
+  "snacks.nvim": { "branch": "main", "commit": "882c996cf28183f4d63640de0b4c02ec886d01f2" },
+  "telescope.nvim": { "branch": "master", "commit": "427b576c16792edad01a92b89721d923c19ad60f" },
+  "todo-comments.nvim": { "branch": "main", "commit": "31e3c38ce9b29781e4422fc0322eb0a21f4e8668" },
+  "tokyonight.nvim": { "branch": "main", "commit": "cdc07ac78467a233fd62c493de29a17e0cf2b2b6" },
+  "trouble.nvim": { "branch": "main", "commit": "bd67efe408d4816e25e8491cc5ad4088e708a69a" },
+  "ts-comments.nvim": { "branch": "main", "commit": "a59d6092213447450191122c9346f309161504cb" },
+  "which-key.nvim": { "branch": "main", "commit": "3aab2147e74890957785941f0c1ad87d0a44c15a" },
+  "yanky.nvim": { "branch": "main", "commit": "020c22d0cfa60358569e49d1d7b91630f175aef0" }
+}
@@ -0,0 +1,29 @@
+{
+  "extras": [
+    "lazyvim.plugins.extras.ai.codeium",
+    "lazyvim.plugins.extras.ai.copilot",
+    "lazyvim.plugins.extras.ai.copilot-chat",
+    "lazyvim.plugins.extras.coding.yanky",
+    "lazyvim.plugins.extras.editor.dial",
+    "lazyvim.plugins.extras.editor.inc-rename",
+    "lazyvim.plugins.extras.lang.ansible",
+    "lazyvim.plugins.extras.lang.dart",
+    "lazyvim.plugins.extras.lang.docker",
+    "lazyvim.plugins.extras.lang.git",
+    "lazyvim.plugins.extras.lang.go",
+    "lazyvim.plugins.extras.lang.json",
+    "lazyvim.plugins.extras.lang.markdown",
+    "lazyvim.plugins.extras.lang.toml",
+    "lazyvim.plugins.extras.lang.typescript",
+    "lazyvim.plugins.extras.lang.typescript.vtsls",
+    "lazyvim.plugins.extras.lang.yaml",
+    "lazyvim.plugins.extras.test.core",
+    "lazyvim.plugins.extras.util.dot",
+    "lazyvim.plugins.extras.util.mini-hipatterns"
+  ],
+  "install_version": 8,
+  "news": {
+    "NEWS.md": "11866"
+  },
+  "version": 8
+}
@@ -0,0 +1,8 @@
+-- Autocmds are automatically loaded on the VeryLazy event
+-- Default autocmds that are always set: https://github.com/LazyVim/LazyVim/blob/main/lua/lazyvim/config/autocmds.lua
+--
+-- Add any additional autocmds here
+-- with `vim.api.nvim_create_autocmd`
+--
+-- Or remove existing autocmds by their group name (which is prefixed with `lazyvim_` for the defaults)
+-- e.g. vim.api.nvim_del_augroup_by_name("lazyvim_wrap_spell")
@@ -0,0 +1,3 @@
+-- Keymaps are automatically loaded on the VeryLazy event
+-- Default keymaps that are always set: https://github.com/LazyVim/LazyVim/blob/main/lua/lazyvim/config/keymaps.lua
+-- Add any additional keymaps here
@@ -0,0 +1,53 @@
+local lazypath = vim.fn.stdpath("data") .. "/lazy/lazy.nvim"
+if not (vim.uv or vim.loop).fs_stat(lazypath) then
+  local lazyrepo = "https://github.com/folke/lazy.nvim.git"
+  local out = vim.fn.system({ "git", "clone", "--filter=blob:none", "--branch=stable", lazyrepo, lazypath })
+  if vim.v.shell_error ~= 0 then
+    vim.api.nvim_echo({
+      { "Failed to clone lazy.nvim:\n", "ErrorMsg" },
+      { out, "WarningMsg" },
+      { "\nPress any key to exit..." },
+    }, true, {})
+    vim.fn.getchar()
+    os.exit(1)
+  end
+end
+vim.opt.rtp:prepend(lazypath)
+
+require("lazy").setup({
+  spec = {
+    -- add LazyVim and import its plugins
+    { "LazyVim/LazyVim", import = "lazyvim.plugins" },
+    -- import/override with your plugins
+    { import = "plugins" },
+  },
+  defaults = {
+    -- By default, only LazyVim plugins will be lazy-loaded. Your custom plugins will load during startup.
+    -- If you know what you're doing, you can set this to `true` to have all your custom plugins lazy-loaded by default.
+    lazy = false,
+    -- It's recommended to leave version=false for now, since a lot the plugin that support versioning,
+    -- have outdated releases, which may break your Neovim install.
+    version = false, -- always use the latest git commit
+    -- version = "*", -- try installing the latest stable version for plugins that support semver
+  },
+  install = { colorscheme = { "tokyonight", "habamax" } },
+  checker = {
+    enabled = true, -- check for plugin updates periodically
+    notify = false, -- notify on update
+  }, -- automatically check for plugin updates
+  performance = {
+    rtp = {
+      -- disable some rtp plugins
+      disabled_plugins = {
+        "gzip",
+        -- "matchit",
+        -- "matchparen",
+        -- "netrwPlugin",
+        "tarPlugin",
+        "tohtml",
+        "tutor",
+        "zipPlugin",
+      },
+    },
+  },
+})
@@ -0,0 +1,27 @@
+-- Options are automatically loaded before lazy.nvim startup
+-- Default options that are always set: https://github.com/LazyVim/LazyVim/blob/main/lua/lazyvim/config/options.lua
+-- Add any additional options here
+
+-- SpellCheck
+-- Filter diagnostics to hide warnings but keep errors, info, and hints
+local function filter_warnings(diagnostic)
+  return diagnostic.severity ~= vim.diagnostic.severity.WARN
+end
+
+vim.diagnostic.config({
+  virtual_text = {
+    format = function(diagnostic)
+      if diagnostic.severity == vim.diagnostic.severity.WARN then
+        return ""
+      end
+      return diagnostic.message
+    end,
+  },
+  signs = {
+    filter = filter_warnings,
+  },
+  underline = {
+    filter = filter_warnings,
+  },
+})
+
@@ -0,0 +1,23 @@
+return {
+  "yuukiflow/Arduino-Nvim",
+  ft = "arduino",
+  opts = {
+    use_default_keymaps = false,
+    keymaps = {
+      { mode = "n", key = "<Leader>mc", func = ":InoCheck<CR>" },
+      { mode = "n", key = "<Leader>mu", func = ":InoUpload<CR>" },
+      { mode = "n", key = "<Leader>ms", func = ":InoStatus<CR>" },
+      { mode = "n", key = "<Leader>mg", func = ":InoGUI<CR>" },
+      { mode = "n", key = "<Leader>mm", func = ":InoMonitor<CR>" },
+      { mode = "n", key = "<Leader>ml", func = ":InoLib<CR>" },
+      { mode = "n", key = "<Leader>mb", func = ":InoSelectBoard<CR>" },
+      { mode = "n", key = "<Leader>mp", func = ":InoSelectPort<CR>" },
+      { mode = "n", key = "<Leader>mr", func = ":InoUploadReset<CR>" },
+    },
+  },
+  dependencies = {
+    "nvim-telescope/telescope.nvim",
+    -- optional: remove if you use Neovim's built-in LSP (>= 0.11)
+    "neovim/nvim-lspconfig",
+  },
+}
@@ -0,0 +1,197 @@
+-- since this is just an example spec, don't actually load anything here and return an empty spec
+-- stylua: ignore
+if true then return {} end
+
+-- every spec file under the "plugins" directory will be loaded automatically by lazy.nvim
+--
+-- In your plugin files, you can:
+-- * add extra plugins
+-- * disable/enabled LazyVim plugins
+-- * override the configuration of LazyVim plugins
+return {
+  -- add gruvbox
+  { "ellisonleao/gruvbox.nvim" },
+
+  -- Configure LazyVim to load gruvbox
+  {
+    "LazyVim/LazyVim",
+    opts = {
+      colorscheme = "gruvbox",
+    },
+  },
+
+  -- change trouble config
+  {
+    "folke/trouble.nvim",
+    -- opts will be merged with the parent spec
+    opts = { use_diagnostic_signs = true },
+  },
+
+  -- disable trouble
+  { "folke/trouble.nvim", enabled = false },
+
+  -- override nvim-cmp and add cmp-emoji
+  {
+    "hrsh7th/nvim-cmp",
+    dependencies = { "hrsh7th/cmp-emoji" },
+    ---@param opts cmp.ConfigSchema
+    opts = function(_, opts)
+      table.insert(opts.sources, { name = "emoji" })
+    end,
+  },
+
+  -- change some telescope options and a keymap to browse plugin files
+  {
+    "nvim-telescope/telescope.nvim",
+    keys = {
+      -- add a keymap to browse plugin files
+      -- stylua: ignore
+      {
+        "<leader>fp",
+        function() require("telescope.builtin").find_files({ cwd = require("lazy.core.config").options.root }) end,
+        desc = "Find Plugin File",
+      },
+    },
+    -- change some options
+    opts = {
+      defaults = {
+        layout_strategy = "horizontal",
+        layout_config = { prompt_position = "top" },
+        sorting_strategy = "ascending",
+        winblend = 0,
+      },
+    },
+  },
+
+  -- add pyright to lspconfig
+  {
+    "neovim/nvim-lspconfig",
+    ---@class PluginLspOpts
+    opts = {
+      ---@type lspconfig.options
+      servers = {
+        -- pyright will be automatically installed with mason and loaded with lspconfig
+        pyright = {},
+      },
+    },
+  },
+
+  -- add tsserver and setup with typescript.nvim instead of lspconfig
+  {
+    "neovim/nvim-lspconfig",
+    dependencies = {
+      "jose-elias-alvarez/typescript.nvim",
+      init = function()
+        require("lazyvim.util").lsp.on_attach(function(_, buffer)
+          -- stylua: ignore
+          vim.keymap.set( "n", "<leader>co", "TypescriptOrganizeImports", { buffer = buffer, desc = "Organize Imports" })
+          vim.keymap.set("n", "<leader>cR", "TypescriptRenameFile", { desc = "Rename File", buffer = buffer })
+        end)
+      end,
+    },
+    ---@class PluginLspOpts
+    opts = {
+      ---@type lspconfig.options
+      servers = {
+        -- tsserver will be automatically installed with mason and loaded with lspconfig
+        tsserver = {},
+      },
+      -- you can do any additional lsp server setup here
+      -- return true if you don't want this server to be setup with lspconfig
+      ---@type table<string, fun(server:string, opts:_.lspconfig.options):boolean?>
+      setup = {
+        -- example to setup with typescript.nvim
+        tsserver = function(_, opts)
+          require("typescript").setup({ server = opts })
+          return true
+        end,
+        -- Specify * to use this function as a fallback for any server
+        -- ["*"] = function(server, opts) end,
+      },
+    },
+  },
+
+  -- for typescript, LazyVim also includes extra specs to properly setup lspconfig,
+  -- treesitter, mason and typescript.nvim. So instead of the above, you can use:
+  { import = "lazyvim.plugins.extras.lang.typescript" },
+
+  -- add more treesitter parsers
+  {
+    "nvim-treesitter/nvim-treesitter",
+    opts = {
+      ensure_installed = {
+        "bash",
+        "html",
+        "javascript",
+        "json",
+        "lua",
+        "markdown",
+        "markdown_inline",
+        "python",
+        "query",
+        "regex",
+        "tsx",
+        "typescript",
+        "vim",
+        "yaml",
+      },
+    },
+  },
+
+  -- since `vim.tbl_deep_extend`, can only merge tables and not lists, the code above
+  -- would overwrite `ensure_installed` with the new value.
+  -- If you'd rather extend the default config, use the code below instead:
+  {
+    "nvim-treesitter/nvim-treesitter",
+    opts = function(_, opts)
+      -- add tsx and treesitter
+      vim.list_extend(opts.ensure_installed, {
+        "tsx",
+        "typescript",
+      })
+    end,
+  },
+
+  -- the opts function can also be used to change the default opts:
+  {
+    "nvim-lualine/lualine.nvim",
+    event = "VeryLazy",
+    opts = function(_, opts)
+      table.insert(opts.sections.lualine_x, {
+        function()
+          return "😄"
+        end,
+      })
+    end,
+  },
+
+  -- or you can return new options to override all the defaults
+  {
+    "nvim-lualine/lualine.nvim",
+    event = "VeryLazy",
+    opts = function()
+      return {
+        --[[add your custom lualine config here]]
+      }
+    end,
+  },
+
+  -- use mini.starter instead of alpha
+  { import = "lazyvim.plugins.extras.ui.mini-starter" },
+
+  -- add jsonls and schemastore packages, and setup treesitter for json, json5 and jsonc
+  { import = "lazyvim.plugins.extras.lang.json" },
+
+  -- add any tools you want to have installed below
+  {
+    "williamboman/mason.nvim",
+    opts = {
+      ensure_installed = {
+        "stylua",
+        "shellcheck",
+        "shfmt",
+        "flake8",
+      },
+    },
+  },
+}
@@ -0,0 +1,44 @@
+return {
+  "neovim/nvim-lspconfig",
+  opts = {
+    servers = {
+      harper_ls = {
+        settings = {
+          ["harper-ls"] = {
+            userDictPath = {
+              "~/.config/obsidian/Custom Dictionary.txt",
+              -- "/usr/share/dict/words",
+              -- "$HOME/.local/share/harper-ls/file_dictionaries",
+            },
+            workspaceDictPath = "",
+            fileDictPath = "",
+            linters = {
+              SpellCheck = true,
+              SpelledNumbers = false,
+              AnA = true,
+              SentenceCapitalization = true,
+              UnclosedQuotes = true,
+              WrongApostrophe = false,
+              LongSentences = true,
+              RepeatedWords = true,
+              Spaces = true,
+              CorrectNumberSuffix = true,
+            },
+            codeActions = {
+              ForceStable = false,
+            },
+            markdown = {
+              IgnoreLinkTitle = false,
+            },
+            diagnosticSeverity = "hint",
+            isolateEnglish = false,
+            dialect = "Australian",
+            maxFileLength = 120000,
+            ignoredLintsPath = "",
+            excludePatterns = {},
+          },
+        },
+      },
+    },
+  },
+}
@@ -0,0 +1,53 @@
+return {
+  "epwalsh/obsidian.nvim",
+  version = "*",
+  lazy = true,
+  ft = "markdown",
+  dependencies = {
+    "nvim-lua/plenary.nvim",
+    "hrsh7th/nvim-cmp",
+    "nvim-telescope/telescope.nvim",
+    "nvim-treesitter/nvim-treesitter",
+  },
+  opts = {
+    workspaces = {
+      {
+        name = "Personal",
+        path = "~/Obsidian/Personal/",
+      },
+      {
+        name = "School-Obsidian",
+        path = "~/Obsidian/School-Obsidian/",
+      },
+    },
+    log_level = vim.log.levels.INFO,
+    daily_notes = {
+      folder = "notes/dailies",
+      date_format = "%Y-%m-%d",
+      alias_format = "%B %-d, %Y",
+      default_tags = { "daily-notes" },
+      template = nil,
+    },
+    new_notes_location = "1Projects",
+    completion = {
+      nvim_cmp = true,
+      min_chars = 2,
+    },
+    mappings = {
+      -- Toggle check-boxes
+      ["<leader>ch"] = {
+        action = function()
+          return require("obsidian").util.toggle_checkbox()
+        end,
+        opts = { buffer = true },
+      },
+      -- Smart action (smart enter)
+      ["<cr>"] = {
+        action = function()
+          return require("obsidian").util.smart_action()
+        end,
+        opts = { buffer = true, expr = true },
+      },
+    },
+  },
+}
@@ -0,0 +1,3 @@
+indent_type = "Spaces"
+indent_width = 2
+column_width = 120
@@ -0,0 +1,103 @@
+# Don't print a new line at the start of the prompt
+add_newline = false
+# Pipes ╰─ ╭─
+# Powerline symbols                                     
+# Wedges 🭧🭒 🭣🭧🭓
+# Random noise 🬖🬥🬔🬗
+# Cool stuff 󰜥   
+
+# format = """
+# $directory $fill $git_branch $cmd_duration
+#  $character"""
+format = """
+$cmd_duration $directory$git_branch
+  $character"""
+
+[fill]
+symbol = '-'
+style = 'fg:245'
+
+# Replace the "❯" symbol in the prompt with "➜"
+[character]                            # The name of the module we are configuring is "character"
+success_symbol = "[ ](bold fg:243)"
+error_symbol = "[ ](bold fg:244)"
+
+# Disable the package module, hiding it from the prompt completely
+[package]
+disabled = true
+
+[git_branch]
+style = "bg: 252"
+symbol = "󰘬"
+truncation_length = 12
+truncation_symbol = ""
+format = " 󰜥 [](bold fg:252)[$symbol $branch(:$remote_branch)](fg:235 bg:252)[ ](bold fg:252)"
+
+[git_commit]
+commit_hash_length = 4
+tag_symbol = " "
+
+[git_state]
+format = '[\($state( $progress_current of $progress_total)\)]($style) '
+cherry_pick = "[🍒 PICKING](bold red)"
+
+[git_status]
+conflicted = " 🏳 "
+ahead = " 🏎💨 "
+behind = " 😰 "
+diverged = " 😵 "
+untracked = " 🤷 ‍"
+stashed = " 📦 "
+modified = " 📝 "
+staged = '[++\($count\)](green)'
+renamed = " ✍️ "
+deleted = " 🗑 "
+
+[hostname]
+ssh_only = false
+format =  "[•$hostname](bg:252 bold fg:235)[](bold fg:252)"
+trim_at = ".companyname.com"
+disabled = false
+
+[line_break]
+disabled = false
+
+[memory_usage]
+disabled = true
+threshold = -1
+symbol = " "
+style = "bold dimmed green"
+
+[time]
+disabled = true
+format = '🕙[\[ $time \]]($style) '
+time_format = "%T"
+
+[username]
+style_user = "bold bg:252 fg:235"
+style_root = "red bold"
+format = "[](bold fg:252)[$user]($style)"
+disabled = false
+show_always = true
+
+[directory]
+home_symbol = " "
+read_only = "  "
+style = "bg:255 fg:240"
+truncation_length = 2
+truncation_symbol = ".../"
+format = '[](bold fg:255)[󰉋 → $path]($style)[](bold fg:255)'
+
+
+[directory.substitutions]
+"Desktop" = "  "
+"Documents" = "  "
+"Downloads" = "  "
+"Music" = " 󰎈 "
+"Pictures" = "  "
+"Videos" = "  "
+"GitHub" = " 󰊤 "
+
+[cmd_duration]
+min_time = 0
+format = '[](bold fg:252)[󰪢 $duration](bold bg:252 fg:235)[](bold fg:252)'
@@ -0,0 +1,36 @@
+# Setup fzf
+# ---------
+if [[ ! "$PATH" == *${FZF_PATH}/bin* ]]; then
+  export PATH="$PATH:${FZF_PATH}/bin"
+fi
+
+function _fzf_settings_has() {
+  which "$@" > /dev/null 2>&1
+}
+
+if _fzf_settings_has brew; then
+  # If fzf was installed via brew, use the brew paths
+  if [[ -x "$(brew --prefix)/bin/fzf" ]]; then
+    if [[ -f "$(brew --prefix fzf)/shell/completion.zsh" ]]; then
+      source "$(brew --prefix fzf)/shell/completion.zsh" 2> /dev/null
+    fi
+    if [[ -f "$(brew --prefix fzf)/shell/key-bindings.zsh" ]]; then
+      source "$(brew --prefix fzf)/shell/key-bindings.zsh"
+    fi
+  fi
+fi
+
+# Auto-completion
+# ---------------
+if [[ -f "${FZF_PATH}/shell/completion.zsh" ]]; then
+  [[ $- == *i* ]] && source "${FZF_PATH}/shell/completion.zsh" 2> /dev/null
+fi
+
+# Key bindings
+# ------------
+if [[ -f "${FZF_PATH}/shell/key-bindings.zsh" ]]; then
+  source "${FZF_PATH}/shell/key-bindings.zsh"
+fi
+
+# Cleanup internal functions
+unset -f _fzf_settings_has
@@ -1,22 +0,0 @@
-[Match]
-Type=ether
-# Exclude virtual Ethernet interfaces
-Kind=!*
-
-[Link]
-RequiredForOnline=routable
-
-[Network]
-DHCP=yes
-MulticastDNS=yes
-
-# systemd-networkd does not set per-interface-type default route metrics
-# https://github.com/systemd/systemd/issues/17698
-# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
-# Use values from NetworkManager. From nm_device_get_route_metric_default in
-# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
-[DHCPv4]
-RouteMetric=100
-
-[IPv6AcceptRA]
-RouteMetric=100
@@ -1,20 +0,0 @@
-[Match]
-Type=wlan
-
-[Link]
-RequiredForOnline=routable
-
-[Network]
-DHCP=yes
-MulticastDNS=yes
-
-# systemd-networkd does not set per-interface-type default route metrics
-# https://github.com/systemd/systemd/issues/17698
-# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
-# Use values from NetworkManager. From nm_device_get_route_metric_default in
-# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
-[DHCPv4]
-RouteMetric=600
-
-[IPv6AcceptRA]
-RouteMetric=600
@@ -1,19 +0,0 @@
-[Match]
-Type=wwan
-
-[Link]
-RequiredForOnline=routable
-
-[Network]
-DHCP=yes
-
-# systemd-networkd does not set per-interface-type default route metrics
-# https://github.com/systemd/systemd/issues/17698
-# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
-# Use values from NetworkManager. From nm_device_get_route_metric_default in
-# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
-[DHCPv4]
-RouteMetric=700
-
-[IPv6AcceptRA]
-RouteMetric=700
@@ -0,0 +1 @@
+/usr/lib/systemd/system/NetworkManager.service
@@ -1 +0,0 @@
-/usr/lib/systemd/system/systemd-networkd.service
@@ -1 +0,0 @@
-/usr/lib/systemd/system/systemd-resolved.service
@@ -0,0 +1,60 @@
+#
+# /etc/pacman.conf
+#
+# Live ISO configuration for the built system.
+# Repositories are hard-enabled; signature checking stays strict because
+# pacman-init.service populates all keyrings (archlinux, cachyos, chaotic)
+# at every live boot.
+#
+# See the pacman.conf(5) manpage for option and repository directives
+
+[options]
+Architecture = auto
+
+HoldPkg     = pacman glibc
+
+ParallelDownloads = 5
+
+# By default, pacman accepts packages signed by keys that its local keyring
+# trusts (see pacman-key and its man page), as well as unsigned packages.
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+#RemoteFileSigLevel = Required
+
+# NOTE: You must run `pacman-key --init` before first using pacman; the local
+# keyring can then be populated with the keys of all official Arch Linux
+# packagers with `pacman-key --populate archlinux`.
+
+#
+# REPOSITORIES
+#   - repositories listed first will take precedence when packages
+#     have identical names, regardless of version number
+#   - URLs will have $repo replaced by the name of the current repo
+#   - URLs will have $arch replaced by the name of the architecture
+#
+
+[core]
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Include = /etc/pacman.d/mirrorlist
+
+[cachyos]
+SigLevel = Required DatabaseOptional
+Include = /etc/pacman.d/cachyos-mirrorlist
+
+[chaotic-aur]
+SigLevel = Required DatabaseOptional
+Include = /etc/pacman.d/chaotic-mirrorlist
+
+[local-aur]
+# Ships on the medium only: packages built at ISO build time (end-4
+# dependencies, plus localrepo/). Keeps pacstrap from needing the network for
+# anything that is not in the official repos. alvin-install strips this whole
+# section from the target system's pacman.conf, because /opt/localrepo exists
+# only on the live medium.
+SigLevel = Optional TrustAll
+Server = file:///opt/localrepo
@@ -0,0 +1,371 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# The chroot's /dev is the kernel's single shared devtmpfs, which only gets the
+# fd/stdin/stdout/stderr symlinks at boot (from mkinitcpio's init). If the
+# runner environment lacks them, process substitution (< <(...)) and upstream
+# tools (pacman-key) fail with "… /dev/fd/63: No such file or directory".
+# Self-heal here; the CI build-iso workflow does the same before pacstrap so
+# that mkinitcpio's hook (which pipes through /dev/stdin) works too.
+for _link in "fd:/proc/self/fd" "stdin:/proc/self/fd/0" \
+  "stdout:/proc/self/fd/1" "stderr:/proc/self/fd/2"; do
+  [[ -e "/dev/${_link%%:*}" || -L "/dev/${_link%%:*}" ]] ||
+    ln -sfn "${_link#*:}" "/dev/${_link%%:*}"
+done
+unset _link
+
+# Populate the keyring in the built root from the keyring bundles
+# (/usr/share/pacman/keyrings, incl. the copied cachyos keyring).
+# This mirrors the guide; it runs inside the image you are making.
+# pacman-key --populate needs no network.
+pacman-key --init
+pacman-key --populate archlinux cachyos chaotic
+
+# Restore the strict live /etc/pacman.conf after pacstrap installs the
+# 'pacman' package, which ships a stock /etc/pacman.conf and would otherwise
+# overwrite this directory's configured version.
+install -m 0644 /root/.live-pacman.conf /etc/pacman.conf
+rm -f /root/.live-pacman.conf
+
+# Build stamp staged by profiledef.sh (absent for non-git, non-CI builds):
+# keep the stamp file itself as a reference, drop the staging copy, and
+# stamp the live medium's motd so the booted ISO identifies its build (the
+# installed system keeps the stock package motd - alvin-install never
+# writes /etc/motd).
+if [[ -f /root/.iso-build-stamp ]]; then
+  install -m 0644 /root/.iso-build-stamp /etc/alvin-build-stamp
+  cat /etc/alvin-build-stamp >> /etc/motd
+  rm -f /root/.iso-build-stamp
+fi
+
+# ============================================================================
+# Pre-install dotfile dependencies into /etc/skel so new users get them
+# instantly on first login (no network required).
+# ============================================================================
+
+SKEL="/etc/skel"
+
+# ── Oh-My-Zsh ────────────────────────────────────────────────────────────────
+if [[ ! -d "${SKEL}/.oh-my-zsh" ]]; then
+  echo "[customize] Cloning Oh-My-Zsh into skel..."
+  git clone --depth=1 https://github.com/ohmyzsh/ohmyzsh.git "${SKEL}/.oh-my-zsh"
+fi
+
+# Oh-My-Zsh custom plugins
+ZSH_CUSTOM="${SKEL}/.oh-my-zsh/custom"
+mkdir -p "${ZSH_CUSTOM}/plugins"
+
+declare -A OMZ_PLUGINS=(
+  [zsh-history-substring-search]="https://github.com/zsh-users/zsh-history-substring-search.git"
+  [zsh-autosuggestions]="https://github.com/zsh-users/zsh-autosuggestions.git"
+  [zsh-eza]="https://github.com/z-shell/zsh-eza.git"
+  [fzf-zsh-plugin]="https://github.com/unixorn/fzf-zsh-plugin.git"
+  [zsh-syntax-highlighting]="https://github.com/zsh-users/zsh-syntax-highlighting.git"
+  [zsh-autocomplete]="https://github.com/marlonrichert/zsh-autocomplete.git"
+)
+
+for plugin in "${!OMZ_PLUGINS[@]}"; do
+  target="${ZSH_CUSTOM}/plugins/${plugin}"
+  if [[ ! -d "${target}" ]]; then
+    echo "[customize] Cloning OMZ plugin: ${plugin}"
+    git clone --depth=1 "${OMZ_PLUGINS[${plugin}]}" "${target}"
+  fi
+done
+
+# ── LazyVim (lazy.nvim bootstraps on first launch, but pre-clone the plugin) ─
+NVIM_DATA="${SKEL}/.local/share/nvim"
+mkdir -p "${NVIM_DATA}"
+if [[ ! -d "${NVIM_DATA}/lazy/lazy.nvim" ]]; then
+  echo "[customize] Pre-cloning lazy.nvim for LazyVim..."
+  git clone --filter=blob:none --branch=stable \
+    https://github.com/folke/lazy.nvim.git "${NVIM_DATA}/lazy/lazy.nvim"
+fi
+
+# ── end-4 dots-hyprland, staged for alvin-install (avoids a clone at install) ─
+DOTS_REPO="/opt/dots-hyprland"
+if [[ ! -d "${DOTS_REPO}/.git" ]]; then
+  echo "[customize] Cloning end-4 dots-hyprland..."
+  git clone --depth=1 https://github.com/end-4/dots-hyprland.git "${DOTS_REPO}"
+  git -C "${DOTS_REPO}" submodule update --init --depth=1
+fi
+
+# end-4 pins quickshell to 41651d7 (Sep 25), which predates quickshell's
+# Qt 6.12 fix (5d5d498, Oct 3: "use MOC includes instead of opaque pointer
+# definitions - Fixes linking issues and Qt 6.12 compatibility"). Arch
+# shipped qt6 6.12.0 into extra on Oct 8; with the old pin qmetatype.h's
+# "Meta Types must be fully defined" static_assert kills the moc build of
+# quickshell-hyprland-ipc (failed CI run 137) and the whole ISO build with
+# it. Force the fixed commit, but ONLY while end-4 still carries the old
+# pin - once they bump it themselves the guard stops matching and their
+# pin wins untouched. localrepo/check-quickshell-pin.sh (weekly CI)
+# verifies both this pin and end-4's stay Qt 6.12-compatible.
+QS_PKG="${DOTS_REPO}/sdata/dist-arch/illogical-impulse-quickshell-git/PKGBUILD"
+if [[ -f "${QS_PKG}" ]] && grep -q "^_commit='41651d7" "${QS_PKG}"; then
+  echo "[customize] Bumping end-4 quickshell pin to 11ca60be (Qt 6.12 fix)..."
+  sed -i "s|^_commit='41651d7[^']*'|_commit='11ca60be22b063478ed9586ca1d7f92f0f261caf'|" "${QS_PKG}"
+fi
+
+# ── end4-pC: the default quickshell config, shipped in skel ──────────────────
+# pctrade/end4-pC is a fork of the ii shell config. It lives next to ii in
+# ~/.config/quickshell and does not modify it; which one runs is decided by
+# qsConfig (patched just below). The repo has no submodules.
+if [[ ! -d "${SKEL}/.config/quickshell/end4-pC" ]]; then
+  echo "[customize] Cloning end4-pC quickshell config into skel..."
+  git clone --depth=1 https://github.com/pctrade/end4-pC.git \
+    "${SKEL}/.config/quickshell/end4-pC"
+fi
+
+# ── Default quickshell config: ii -> end4-pC ─────────────────────────────────
+# alvin-install copies this staged repo onto the target and runs `./setup
+# install`, whose rsync writes hypr/hyprland/variables.lua into the user's
+# home - so patching the staged copy is what sets qsConfig on the installed
+# system. Re-running is a no-op; anything other than ii/end4-pC aborts.
+VARIABLES_LUA="${DOTS_REPO}/dots/.config/hypr/hyprland/variables.lua"
+if grep -Fq 'hl.env("qsConfig", "ii")' "${VARIABLES_LUA}"; then
+  echo "[customize] Setting qsConfig to end4-pC..."
+  sed -i 's|hl\.env("qsConfig", "ii")|hl.env("qsConfig", "end4-pC")|' "${VARIABLES_LUA}"
+fi
+if ! grep -Fq 'hl.env("qsConfig", "end4-pC")' "${VARIABLES_LUA}"; then
+  echo "[customize] qsConfig is neither ii nor end4-pC in ${VARIABLES_LUA}" >&2
+  exit 1
+fi
+
+# ============================================================================
+# Pre-install end-4 dependencies into the image (network heavy, once per ISO)
+# ============================================================================
+# ./setup install-deps resolves and *builds* every AUR/source dependency the
+# dotfiles need (quickshell, MicroTeX, theming, fonts, ...). Doing it here lets
+# alvin-install run its end-4 step with --skip-alldeps, so an install only
+# copies files - no AUR clones, no makepkg, no dependency resolution.
+#
+# The script refuses to run as root, hence the throwaway builder account.
+# ============================================================================
+BUILD_USER="ii-builder"
+
+if ! id -u "${BUILD_USER}" &>/dev/null; then
+  useradd -m -u 1500 "${BUILD_USER}"
+fi
+echo "${BUILD_USER} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/99-ii-builder
+chmod 440 /etc/sudoers.d/99-ii-builder
+
+# makepkg writes src/, pkg/ and *.pkg.tar.zst into the PKGBUILD directories,
+# so the tree must be owned by the account that runs it.
+chown -R "${BUILD_USER}:${BUILD_USER}" "${DOTS_REPO}"
+
+# -f: never prompt (ask=false); -s: skip "pacman -Syu";
+# --skip-plasmaintg: optional Firefox widget that pulls 410 pkgs / 526 MiB of
+#                    KDE packages onto a non-KDE system;
+# stdin: answer end-4's x() failure prompt with "e", so a failed command
+#        aborts the build instead of blocking forever without a TTY.
+# shellcheck disable=SC2024  # the redirect is meant for the child, not sudo
+if ! sudo -u "${BUILD_USER}" env HOME="/home/${BUILD_USER}" \
+    GIT_TERMINAL_PROMPT=0 \
+    bash -c "cd ${DOTS_REPO} && ./setup install-deps -f -s --skip-plasmaintg" \
+    < <(yes e); then
+  echo "[customize] end-4 ./setup install-deps failed" >&2
+  exit 1
+fi
+
+# ── Harvest the packages install-deps just built into the in-image local repo ─
+# The live /etc/pacman.conf points [local-aur] at /opt/localrepo; without the
+# harvested copies pacstrap cannot resolve these packages at install time and
+# would silently drop them from the target system.
+mkdir -p /opt/localrepo
+shopt -s nullglob
+
+# <name> <version> from a package's embedded .PKGINFO (update.sh does the same)
+pkg_meta() {
+  tar -xOf "$1" .PKGINFO 2>/dev/null |
+    awk -F' = ' '/^pkgname = /{n=$2} /^pkgver = /{v=$2} END{print n, v}'
+}
+
+mapfile -d '' -t built_pkgs < <(
+  find "${DOTS_REPO}" "/home/${BUILD_USER}/.cache/yay" \
+    -name '*.pkg.tar.zst' -print0 2>/dev/null
+)
+
+declare -A built_file=() built_ver=()
+for p in "${built_pkgs[@]}"; do
+  read -r n v < <(pkg_meta "$p")
+  [[ -n "${n:-}" && -n "${v:-}" ]] || continue
+  built_file["$n"]="$p"
+  built_ver["$n"]="$v"
+done
+
+# One entry per package name, and the entry must be the version the image
+# actually installed - a stale copy with the same name but another version
+# would let pacstrap install something else than what was tested.
+for existing in /opt/localrepo/*.pkg.tar.zst; do
+  [[ -e "$existing" ]] || continue
+  read -r n v < <(pkg_meta "$existing")
+  [[ -n "${n:-}" ]] || continue
+  if [[ -n "${built_ver[$n]:-}" ]]; then
+    echo "[customize] Replacing localrepo ${n} ${v} with built ${built_ver[$n]}"
+    rm -f "$existing"
+  fi
+done
+
+if ((${#built_file[@]} > 0)); then
+  echo "[customize] Harvesting ${#built_file[@]} package(s) into /opt/localrepo"
+  cp -f -- "${built_file[@]}" /opt/localrepo/
+  # makepkg -Afsi leaves its archives next to the PKGBUILD. They are already
+  # harvested (and installed in this image); keeping them in the dots tree
+  # would ship a second copy inside /opt/dots-hyprland, which alvin-install
+  # copies to ~/.dots-hyprland on every installed system.
+  find "${DOTS_REPO}" -type f -name '*.pkg.tar.zst' -delete
+fi
+
+# Rebuild the repo database (CI/update.sh ship a pre-built one alongside the
+# packages) and refresh the live system's copy of it. No network needed: the
+# remote repos were synced during pacstrap.
+local_pkgs=(/opt/localrepo/*.pkg.tar.zst)
+if ((${#local_pkgs[@]} > 0)); then
+  echo "[customize] Rebuilding local-aur db (${#local_pkgs[@]} packages)..."
+  repo-add -R /opt/localrepo/local-aur.db.tar.gz "${local_pkgs[@]}"
+  mkdir -p /var/lib/pacman/sync
+  cp -fL /opt/localrepo/local-aur.db /var/lib/pacman/sync/local-aur.db
+  if [[ -f /opt/localrepo/local-aur.files ]]; then
+    cp -fL /opt/localrepo/local-aur.files /var/lib/pacman/sync/local-aur.files
+  fi
+fi
+
+# ── makepkg leftovers + throwaway account do not belong in the ISO ──────────
+if [[ -d "${DOTS_REPO}/sdata/dist-arch" ]]; then
+  find "${DOTS_REPO}/sdata/dist-arch" -mindepth 2 -maxdepth 2 -type d \
+    \( -name src -o -name pkg \) -prune -exec rm -rf {} +
+fi
+rm -f /etc/sudoers.d/99-ii-builder
+
+# Processes still running as BUILD_USER make userdel exit 8 and abort the
+# build. end-4's ./setup is the usual source: sudo_init_keepalive forks
+# `(sleep 60; sudo true) &` and its EXIT trap kills only the subshell,
+# orphaning the sleep child for up to a minute. Mirrors shadow's
+# user_busy_processes(): match real/effective/saved uid AND require the
+# process to live inside this build chroot - the runner shares our PID
+# namespace, and a host process could carry the same uid.
+#
+# mkarchiso runs this script via arch-chroot, which mounts proc *before*
+# `unshare --fork --pid`: /proc entry numbers belong to the outer pid
+# namespace, while kill(2) resolves pids in our (nested) namespace. Use the
+# last NSpid field - the pid in our own namespace - for signalling; keep the
+# /proc entry number for logging, since that is what userdel reports.
+nspid_fields() {
+  awk -F'\t' '/^NSpid:/{ $1=""; sub(/^ +/, ""); print; exit }' "$1"
+}
+
+builder_procs() {
+  local uid broot st p key real eff saved kpid cmd
+  local -a nsf self_nsf=()
+  uid=$(id -u "${BUILD_USER}") || return 0
+  broot=$(stat -Lc '%d:%i' /)
+  read -r -a self_nsf < <(nspid_fields /proc/self/status)
+  for st in /proc/[0-9]*/status; do
+    [[ -r "$st" ]] || continue
+    real=""; eff=""; saved=""
+    while read -r key real eff saved _; do
+      [[ $key == "Uid:" ]] && break
+    done < "$st" || continue
+    [[ $real == "$uid" || $eff == "$uid" || $saved == "$uid" ]] || continue
+    p=${st#/proc/}; p=${p%/status}
+    # Stat of /proc/<pid>/root needs CAP_SYS_PTRACE (or same-uid): exactly
+    # what shadow's userdel uses, so a process we cannot see here is one
+    # userdel cannot flag either. Compare by device+inode; skip on failure.
+    [[ $(stat -Lc '%d:%i' "/proc/$p/root" 2>/dev/null) == "$broot" ]] || continue
+    # NSpid chain length must equal ours, i.e. the process must live in our
+    # pid namespace - only then is its last field killable from here.
+    nsf=()
+    read -r -a nsf < <(nspid_fields "/proc/$p/status") || continue
+    if ((${#nsf[@]} > 0 && ${#nsf[@]} == ${#self_nsf[@]})); then
+      kpid=${nsf[${#nsf[@]} - 1]}
+    else
+      kpid="-"
+    fi
+    cmd=$(tr '\0' ' ' < "/proc/$p/cmdline" 2>/dev/null)
+    printf '%s\t%s\t%s\n' "$p" "$kpid" "$cmd"
+  done
+  return 0
+}
+
+sweep_builder_procs() {
+  local sig=$1 p kpid cmd kerr
+  local -a pids=()
+  while IFS=$'\t' read -r p kpid cmd; do
+    [[ -n $p ]] || continue
+    if [[ -z $kpid || $kpid == "-" ]]; then
+      echo "[customize] ${BUILD_USER} process outside our pid namespace (cannot signal): pid $p: $cmd"
+      continue
+    fi
+    echo "[customize] ${BUILD_USER} process ($sig): pid $p: $cmd"
+    pids+=("$kpid")
+  done < <(builder_procs)
+  if ((${#pids[@]} > 0)); then
+    # Surface signal failures (they used to be swallowed, hiding a
+    # pid-namespace mismatch as a silent no-op sweep).
+    if ! kerr=$(kill -"$sig" "${pids[@]}" 2>&1); then
+      [[ -n $kerr ]] && printf '[customize] kill -%s: %s\n' "$sig" "$kerr"
+    fi
+  fi
+  return 0
+}
+
+sweep_builder_procs TERM
+sleep 2
+sweep_builder_procs KILL
+sleep 1
+
+if ! userdel -r "${BUILD_USER}"; then
+  rm -rf "/home/${BUILD_USER:?}"
+  if ! userdel "${BUILD_USER}"; then
+    echo "[customize] FATAL: cannot remove user ${BUILD_USER}; leftover processes:" >&2
+    builder_procs >&2 || true
+    exit 1
+  fi
+fi
+chown -R root:root "${DOTS_REPO}"
+
+# ── Google Sans Flex into skel: install_google_sans_flex() early-returns once
+#    fc-list sees the font, so the install step needs no network ──────────────
+FONT_DIR="${SKEL}/.local/share/fonts/illogical-impulse-google-sans-flex"
+if [[ ! -f "${FONT_DIR}/.git/HEAD" ]]; then
+  echo "[customize] Pre-installing Google Sans Flex into skel..."
+  rm -rf "${FONT_DIR}"
+  git clone --depth=1 --recurse-submodules --shallow-submodules \
+    https://github.com/end-4/google-sans-flex "${FONT_DIR}"
+fi
+
+# ── uv into skel: CPython 3.12 + the end-4 requirements wheel cache ──────────
+# install-python-packages() runs `uv venv -p 3.12` and `uv pip install -r ...`
+# during setup. Arch has no python312 package (uv would download one) and the
+# pinned requirements are ~250 MiB of wheels, so warm both into skel: the venv
+# is then created and filled straight from the image.
+if command -v uv &>/dev/null; then
+  echo "[customize] Pre-warming uv (CPython 3.12 + requirements cache)..."
+  warm_venv="/tmp/uv-warm-venv"
+  rm -rf "${warm_venv}"
+  UV_CACHE_DIR="${SKEL}/.cache/uv" \
+    UV_PYTHON_INSTALL_DIR="${SKEL}/.local/share/uv/python" \
+    uv venv -p 3.12 "${warm_venv}"
+  UV_CACHE_DIR="${SKEL}/.cache/uv" \
+    UV_PYTHON_INSTALL_DIR="${SKEL}/.local/share/uv/python" \
+    uv pip install --python "${warm_venv}/bin/python" \
+    -r "${DOTS_REPO}/sdata/uv/requirements.txt"
+  rm -rf "${warm_venv}"
+else
+  echo "[customize] uv not found - skipping python/wheel pre-warm."
+fi
+
+# ── Fish: ensure default shell is set for the live user ──────────────────────
+# The live user (usually 'archlinux' or 'root') gets fish as default shell
+if command -v fish &>/dev/null; then
+  echo "[customize] Setting fish as default shell for skel..."
+  chsh -s /usr/bin/fish root 2>/dev/null || true
+fi
+
+# ── Ensure skel directories have correct permissions ─────────────────────────
+chmod 700 "${SKEL}/.config" 2>/dev/null || true
+find "${SKEL}/.config" -type f -exec chmod 644 {} \; 2>/dev/null || true
+find "${SKEL}/.config" -type d -exec chmod 755 {} \; 2>/dev/null || true
+find "${SKEL}/.config" -name '*.sh' -exec chmod 755 {} \; 2>/dev/null || true
+find "${SKEL}/.local" -type d -exec chmod 755 {} \; 2>/dev/null || true
+
+echo "[customize] Dotfile pre-installation complete."
@@ -1,5 +1,5 @@
 title    Arch Linux install medium (%ARCH%, UEFI)
 sort-key 01
-linux    /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux
-initrd   /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+linux    /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos
+initrd   /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 options  archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID%
@@ -1,5 +1,5 @@
 title    Arch Linux install medium (%ARCH%, UEFI) with speech
 sort-key 02
-linux    /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux
-initrd   /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+linux    /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos
+initrd   /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 options  archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
@@ -46,14 +46,14 @@ timeout_style=menu

 menuentry "Arch Linux install medium (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
    set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID%
-    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID%
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 }

 menuentry "Arch Linux install medium with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
    set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
-    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos archisobasedir=%INSTALL_DIR% archisosearchuuid=%ARCHISO_UUID% accessibility=on
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 }


@@ -23,14 +23,14 @@ timeout_style=menu

 menuentry "Arch Linux install medium (%ARCH%, ${archiso_platform})" --class arch --class gnu-linux --class gnu --class os --id 'archlinux' {
    set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}"
-    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}"
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 }

 menuentry "Arch Linux install medium with speakup screen reader (%ARCH%, ${archiso_platform})" --hotkey s --class arch --class gnu-linux --class gnu --class os --id 'archlinux-accessibility' {
    set gfxpayload=keep
-    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" accessibility=on
-    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux.img
+    linux /%INSTALL_DIR%/boot/%ARCH%/vmlinuz-linux-cachyos archisobasedir=%INSTALL_DIR% img_dev=UUID=${archiso_img_dev_uuid} img_loop="${iso_path}" accessibility=on
+    initrd /%INSTALL_DIR%/boot/%ARCH%/initramfs-linux-cachyos.img
 }


@@ -0,0 +1,201 @@
+#!/usr/bin/env bash
+# ============================================================================
+# build-end4-deps.sh — Build ALL end-4 (illogical-impulse) AUR dependencies
+#
+# This script builds every AUR package required by the end-4 dots-hyprland
+# dotfiles that is NOT in the official Arch repos or chaotic-aur.
+#
+# It uses --noconfirm throughout so the entire run is non-interactive.
+#
+# Usage:
+#   ./localrepo/build-end4-deps.sh            # build all
+#   ./localrepo/build-end4-deps.sh --quick    # skip large AUR pkgs (use existing)
+#
+# After building, run ./localrepo/update.sh to refresh the repo database.
+# ============================================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_DIR="${SCRIPT_DIR}"
+WORK_DIR=$(mktemp -d /tmp/end4-build.XXXXXX)
+SKIP_LARGE=false
+
+for arg in "$@"; do
+  case "$arg" in
+    --quick) SKIP_LARGE=true ;;
+  esac
+done
+
+# ── colours ──────────────────────────────────────────────────────────────────
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; NC='\033[0m'
+info()  { echo -e "${CYAN}[INFO]${NC}  $*"; }
+ok()    { echo -e "${GREEN}[OK]${NC}    $*"; }
+warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
+fail()  { echo -e "${RED}[FAIL]${NC}  $*"; }
+
+# ── helper: build a single AUR package ───────────────────────────────────────
+build_aur_pkg() {
+  local pkg="$1"
+  local src_url="https://aur.archlinux.org/cgit/aur.git/snapshot/${pkg}.tar.gz"
+  local pkg_dir="${WORK_DIR}/${pkg}"
+
+  info "Building AUR package: ${pkg}"
+  mkdir -p "${pkg_dir}"
+  if ! curl -fsSL "${src_url}" | tar xz -C "${WORK_DIR}"; then
+    fail "Failed to download ${pkg}"; return 1
+  fi
+  if ! (cd "${pkg_dir}" && makepkg -sfi --noconfirm --cleanbuild); then
+    fail "Failed to build ${pkg}"; return 1
+  fi
+  # Move built packages to localrepo
+  find "${pkg_dir}" -maxdepth 1 -name '*.pkg.tar.zst' -exec mv -f {} "${REPO_DIR}/" \;
+  ok "Built: ${pkg}"
+  return 0
+}
+
+# ── helper: build from a local PKGBUILD directory ────────────────────────────
+build_local_pkgbuild() {
+  local pkg_dir="$1"
+  local pkg_name
+  pkg_name=$(basename "${pkg_dir}")
+
+  if ls "${REPO_DIR}"/illogical-impulse-"${pkg_name}"-*.pkg.tar.zst 1>/dev/null 2>&1; then
+    info "Package already exists in localrepo, skipping: ${pkg_name}"
+    return 0
+  fi
+
+  info "Building local PKGBUILD: ${pkg_name}"
+  if ! (cd "${pkg_dir}" && makepkg -sfi --noconfirm --cleanbuild); then
+    fail "Failed to build ${pkg_name}"; return 1
+  fi
+  find "${pkg_dir}" -maxdepth 1 -name '*.pkg.tar.zst' -exec mv -f {} "${REPO_DIR}/" \;
+  ok "Built: ${pkg_name}"
+  return 0
+}
+
+# ============================================================================
+# 1. Build end-4 metapackages from local PKGBUILDs
+# ============================================================================
+info "═══ Step 1: Building end-4 metapackages ═══"
+for pkg_dir in "${SCRIPT_DIR}"/end4-pkgbuilds/*/; do
+  build_local_pkgbuild "${pkg_dir}" || true
+done
+
+# ============================================================================
+# 2. Build AUR dependencies required by end-4
+# ============================================================================
+info "═══ Step 2: Building AUR dependencies ═══"
+
+# ── Theming & appearance ─────────────────────────────────────────────────────
+# Entries in these lists must start at column 0: CI's package check accepts
+# repo-less packages via `grep -qxF <pkg>` against this file (exact whole-line
+# match), which silently never matched while the names were indented.
+AUR_THEMING=(
+adw-gtk-theme-git
+darkly-bin
+ttf-material-symbols-variable-git
+ttf-readex-pro
+ttf-rubik-vf
+ttf-twemoji
+otf-space-grotesk
+kde-material-you-colors-git
+)
+
+# ── end-4 specific / build-from-source packages ──────────────────────────────
+# matugen — material you color generation tool
+# speech-dispatcher — may need AUR build on some setups
+AUR_TOOLS=(
+matugen
+python-rpypostprocess
+tts
+)
+
+# ── Packages not in any standard repo ────────────────────────────────────────
+AUR_MISSING=(
+asciinema-agg
+davs2
+varia
+woeusb-ng
+ttf-ms-fonts
+)
+
+# ── Large / complex builds (skipped with --quick) ────────────────────────────
+AUR_LARGE=(
+  # quickshell is already built from end4-pkgbuilds above
+)
+
+# ── Run builds ───────────────────────────────────────────────────────────────
+FAILED=()
+
+for pkg in "${AUR_THEMING[@]}" "${AUR_TOOLS[@]}" "${AUR_MISSING[@]}"; do
+  build_aur_pkg "${pkg}" || FAILED+=("${pkg}")
+done
+
+if [[ "${SKIP_LARGE}" == false ]]; then
+  for pkg in "${AUR_LARGE[@]}"; do
+    build_aur_pkg "${pkg}" || FAILED+=("${pkg}")
+  done
+fi
+
+# ============================================================================
+# 3. Build end-4 setup script dependencies (from dots-hyprland/setup)
+# ============================================================================
+info "═══ Step 3: Building end-4 setup helper packages ═══"
+
+DOTS_DIR="${HOME}/dots-hyprland"
+if [[ -d "${DOTS_DIR}" ]]; then
+  # Build any remaining metapackages from the dist-arch directory
+  for pkg_dir in "${DOTS_DIR}"/sdata/dist-arch/illogical-impulse-*/; do
+    pkg_name=$(basename "${pkg_dir}")
+    # Skip the ones we already built above
+    if ls "${REPO_DIR}"/illogical-impulse-"${pkg_name#illogical-impulse-}"-*.pkg.tar.zst 1>/dev/null 2>&1; then
+      info "Already built, skipping: ${pkg_name}"
+      continue
+    fi
+    # Only build packages that have a PKGBUILD (metapackages with depends=())
+    if [[ -f "${pkg_dir}/PKGBUILD" ]]; then
+      info "Building from dots-hyprland: ${pkg_name}"
+      (cd "${pkg_dir}" && makepkg -sfi --noconfirm --cleanbuild) || {
+        warn "Failed to build ${pkg_name} from dots-hyprland, skipping"
+        continue
+      }
+      find "${pkg_dir}" -maxdepth 1 -name '*.pkg.tar.zst' -exec mv -f {} "${REPO_DIR}/" \;
+      ok "Built: ${pkg_name}"
+    fi
+  done
+else
+  warn "dots-hyprland not found at ${DOTS_DIR}, skipping dist-arch builds"
+fi
+
+# ============================================================================
+# 4. Refresh local repository database
+# ============================================================================
+info "═══ Step 4: Refreshing local repository database ═══"
+
+bash "${SCRIPT_DIR}/update.sh"
+
+# ============================================================================
+# 5. Cleanup & summary
+# ============================================================================
+rm -rf "${WORK_DIR}"
+
+echo ""
+echo "═══════════════════════════════════════════════════════════════"
+if [[ ${#FAILED[@]} -gt 0 ]]; then
+  warn "Build completed with ${#FAILED[@]} failures:"
+  for f in "${FAILED[@]}"; do
+    echo "  ✗ ${f}"
+  done
+  echo ""
+  echo "The following packages were built successfully into localrepo:"
+else
+  ok "All builds completed successfully!"
+fi
+
+echo ""
+echo "Packages in localrepo:"
+for p in "${REPO_DIR}"/*.pkg.tar.zst; do
+  [[ -e "${p}" ]] || continue
+  echo "  ✓ $(basename "${p}")"
+done
+echo "═══════════════════════════════════════════════════════════════"
@@ -0,0 +1,184 @@
+#!/usr/bin/env bash
+# Verify that every quickshell pin we build against is current enough to
+# survive the next Arch Qt update.
+#
+# Why this exists: CI run 137 (2026-10-08) failed because end-4 pinned
+# quickshell to 41651d7 (Sep 25), which predates quickshell's Qt 6.12 fix
+# (5d5d498, Oct 3: "use MOC includes instead of opaque pointer definitions
+# - Fixes linking issues and Qt 6.12 compatibility"). Arch shipped
+# qt6 6.12.0 the next day and the pinned commit stopped compiling
+# ("Meta Types must be fully defined"). customize_airootfs.sh papers over
+# end-4's stale pin at build time; this script is the tripwire that tells
+# us when pins - ours OR end-4's - fall behind again BEFORE a build does.
+#
+# Checked pins:
+#   1. localrepo/end4-pkgbuilds/quickshell-git/PKGBUILD  (our own pin)
+#   2. end-4/dots-hyprland sdata/dist-arch PKGBUILD      (live from GitHub)
+#
+# Checks per pin:
+#   - commit exists upstream
+#   - includes the Qt 6.12 fix (5d5d498)
+#   - not older than QUICKSHELL_PIN_MAX_AGE_DAYS (default 45)
+#
+# Exit 1 on any failure so CI (pin-check.yaml) goes red.
+#
+# Usage: ./localrepo/check-quickshell-pin.sh
+set -euo pipefail
+
+QT612_FIX='5d5d49873fe8cf1f99ddfd5006ceb2057c5c9b13'
+QS_REPO='https://git.outfoxxed.me/quickshell/quickshell.git'
+END4_STALE_PIN='41651d7'   # the pin customize_airootfs.sh overrides
+END4_PKGBUILD_URL='https://raw.githubusercontent.com/end-4/dots-hyprland/main/sdata/dist-arch/illogical-impulse-quickshell-git/PKGBUILD'
+MAX_AGE_DAYS="${QUICKSHELL_PIN_MAX_AGE_DAYS:-45}"
+
+profile_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+LOCAL_PKGBUILD="${profile_dir}/localrepo/end4-pkgbuilds/quickshell-git/PKGBUILD"
+
+FAILED=0
+
+fail() {
+  echo "❌ $1" >&2
+  FAILED=1
+}
+
+# ── collect pins ────────────────────────────────────────────────────────────
+
+pin_of() { # <file-contents-stdin> -> first _commit='...' value
+  sed -n "s/^_commit='\([0-9a-f]\{7,40\}\)'.*/\1/p" | head -n1
+}
+
+if [[ ! -f "$LOCAL_PKGBUILD" ]]; then
+  echo "❌ missing ${LOCAL_PKGBUILD}" >&2
+  exit 1
+fi
+local_pin=$(pin_of < "$LOCAL_PKGBUILD")
+if [[ -z "$local_pin" ]]; then
+  echo "❌ no _commit= found in ${LOCAL_PKGBUILD}" >&2
+  exit 1
+fi
+
+end4_pin=''
+end4_pkgbuild=''
+for try in 1 2 3 4 5; do
+  if end4_pkgbuild=$(curl -fsSL --max-time 30 "$END4_PKGBUILD_URL"); then
+    end4_pin=$(printf '%s\n' "$end4_pkgbuild" | pin_of)
+    break
+  fi
+  echo "  ⏳ fetch of end-4 PKGBUILD failed (try $try/5), retrying in $(( try * 3 ))s..." >&2
+  sleep $(( try * 3 ))
+done
+if [[ -z "$end4_pin" ]]; then
+  fail "could not fetch end-4's quickshell PKGBUILD from GitHub — network or path change?"
+  echo ""
+  echo "Result: FAILED"
+  exit 1
+fi
+
+# ── clone quickshell (blobless: commits+trees only, fast) ───────────────────
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+cloned=0
+for try in 1 2 3; do
+  if git clone --filter=blob:none --quiet "$QS_REPO" "$tmp/qs" 2>/dev/null; then
+    cloned=1
+    break
+  fi
+  rm -rf "$tmp/qs"
+  echo "  ⏳ clone of quickshell failed (try $try/3), retrying in $(( try * 5 ))s..." >&2
+  sleep $(( try * 5 ))
+done
+if [[ "$cloned" -ne 1 ]]; then
+  fail "could not clone ${QS_REPO} — network or repo moved?"
+  echo ""
+  echo "Result: FAILED"
+  exit 1
+fi
+QS="$tmp/qs"
+qs_head=$(git -C "$QS" rev-parse HEAD)
+qs_head_date=$(git -C "$QS" show -s --format=%cs HEAD)
+echo "quickshell upstream master: ${qs_head:0:12} (${qs_head_date})"
+echo ""
+
+now=$(date +%s)
+
+# <label> <pin> <mode>: mode "hard" fails on any problem; mode "soft" only
+# warns, for pins we don't control (end-4's) — UNLESS the problem is one the
+# customize_airootfs.sh override does not cover, which always fails hard
+# because it would break the next ISO build.
+check_pin() {
+  local label=$1 pin=$2 mode=$3
+  local ts age behind bad=0
+
+  if ! git -C "$QS" cat-file -e "${pin}^{commit}" 2>/dev/null; then
+    fail "$label: pin '$pin' does not exist in quickshell upstream"
+    return
+  fi
+
+  local has_fix=0
+  if git -C "$QS" merge-base --is-ancestor "$QT612_FIX" "$pin"; then
+    has_fix=1
+  fi
+
+  ts=$(git -C "$QS" show -s --format=%ct "$pin")
+  age=$(( (now - ts) / 86400 ))
+  behind=$(git -C "$QS" rev-list --count "$pin..HEAD")
+
+  if [[ "$mode" == "hard" ]]; then
+    if [[ "$has_fix" -eq 0 ]]; then
+      fail "$label: pin '$pin' PREDATES the Qt 6.12 fix (${QT612_FIX:0:12}) — will not compile against Qt >= 6.12"
+      bad=1
+    fi
+    if (( age > MAX_AGE_DAYS )); then
+      fail "$label: pin is $age days old (> ${MAX_AGE_DAYS}d), $behind commit(s) behind upstream master — bump it"
+      bad=1
+    fi
+    if [[ "$bad" -eq 0 ]]; then
+      echo "  ✅ $label: pin ${pin:0:12} includes the Qt 6.12 fix, age ${age}d (${behind} commit(s) behind master)"
+    fi
+    return
+  fi
+
+  # soft mode: our build-time override compensates for this pin, so drift is
+  # a heads-up — it cannot break the ISO build on its own.
+  if [[ "$has_fix" -eq 0 ]]; then
+    echo "  ⚠️  $label: pin ${pin:0:12} predates the Qt 6.12 fix — covered by the customize_airootfs.sh override, but end-4 should bump it"
+  else
+    echo "  ✅ $label: pin ${pin:0:12} includes the Qt 6.12 fix"
+  fi
+  if (( age > MAX_AGE_DAYS )); then
+    echo "  ⚠️  $label: pin is $age days old (> ${MAX_AGE_DAYS}d), $behind commit(s) behind master — consider bumping (not enforced, we don't own this pin)"
+  else
+    echo "  ✅ $label: pin age ${age}d (${behind} commit(s) behind master), limit ${MAX_AGE_DAYS}d"
+  fi
+}
+
+# ── our pin ─────────────────────────────────────────────────────────────────
+
+echo "our pin (localrepo/end4-pkgbuilds):"
+check_pin "ours" "$local_pin" hard
+
+# ── end-4's pin ─────────────────────────────────────────────────────────────
+
+echo ""
+echo "end-4's pin (dots-hyprland sdata/dist-arch):"
+# end-4's pin is only safe if OUR override covers it: customize_airootfs.sh
+# rewrites exactly the 41651d7 pin. Any other Qt-unsafe end-4 pin sails
+# straight into the ISO build unpatched → hard failure.
+if [[ "$end4_pin" == "$END4_STALE_PIN"* ]]; then
+  echo "  ℹ️  end-4 still pins ${end4_pin:0:12} — customize_airootfs.sh override is active"
+  check_pin "end-4" "$end4_pin" soft
+else
+  check_pin "end-4" "$end4_pin" hard
+  echo "  ℹ️  end-4 has moved off ${END4_STALE_PIN} to ${end4_pin:0:12}"
+  echo "     → if it now passes, consider retiring the override guard in"
+  echo "       customize_airootfs.sh and syncing our own pin to match."
+fi
+
+echo ""
+if [[ "$FAILED" -ne 0 ]]; then
+  echo "Result: FAILED"
+  exit 1
+fi
+echo "Result: OK — all quickshell pins are Qt 6.12-safe and within ${MAX_AGE_DAYS}d of upstream"
@@ -0,0 +1,18 @@
+groups=(illogical-impulse)
+pkgname=illogical-impulse-bibata-modern-classic-bin
+pkgver=2.0.6
+pkgrel=2
+pkgdesc="Material Based Cursor Theme, installed for illogical-impulse dotfiles"
+arch=('any')
+url="https://github.com/ful1e5/Bibata_Cursor"
+license=('GPL-3.0-or-later')
+conflicts=("bibata-cursor-theme" "bibata-cursor-theme-bin")
+options=('!strip')
+_variant=Bibata-Modern-Classic
+source=("${pkgname%-bin}-$pkgver.tar.xz::$url/releases/download/v$pkgver/$_variant.tar.xz")
+sha256sums=('SKIP')
+
+package() {
+  install -dm755 "$pkgdir/usr/share/icons"
+  cp -dr --no-preserve=mode $_variant "$pkgdir/usr/share/icons"
+}
@@ -0,0 +1 @@
+ref: refs/heads/master
@@ -0,0 +1,9 @@
+[core]
+	repositoryformatversion = 0
+	filemode = true
+	bare = true
+[remote "origin"]
+	url = https://github.com/end-4/MicroTeX.git
+	tagOpt = --no-tags
+	fetch = +refs/*:refs/*
+	mirror = true
@@ -0,0 +1 @@
+Unnamed repository; edit this file 'description' to name the repository.
@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# An example hook script to check the commit log message taken by
+# applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.  The hook is
+# allowed to edit the commit message file.
+#
+# To enable this hook, rename this file to "applypatch-msg".
+
+. git-sh-setup
+commitmsg="$(git rev-parse --git-path hooks/commit-msg)"
+test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"}
+:
@@ -0,0 +1,74 @@
+#!/bin/sh
+#
+# An example hook script to check the commit log message.
+# Called by "git commit" with one argument, the name of the file
+# that has the commit message.  The hook should exit with non-zero
+# status after issuing an appropriate message if it wants to stop the
+# commit.  The hook is allowed to edit the commit message file.
+#
+# To enable this hook, rename this file to "commit-msg".
+
+# Uncomment the below to add a Signed-off-by line to the message.
+# Doing this in a hook is a bad idea in general, but the prepare-commit-msg
+# hook is more suited to it.
+#
+# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p')
+# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1"
+
+# This example catches duplicate Signed-off-by lines and messages that
+# would confuse 'git am'.
+
+ret=0
+
+test "" = "$(grep '^Signed-off-by: ' "$1" |
+	 sort | uniq -c | sed -e '/^[ 	]*1[ 	]/d')" || {
+	echo >&2 Duplicate Signed-off-by lines.
+	ret=1
+}
+
+comment_re="$(
+	{
+		git config --get-regexp "^core\.comment(char|string)\$" ||
+			echo '#'
+	} | sed -n -e '
+		${
+			s/^[^ ]* //
+			s|[][*./\]|\\&|g
+			s/^auto$/[#;@!$%^&|:]/
+			p
+		}'
+)"
+scissors_line="^${comment_re} -\{8,\} >8 -\{8,\}\$"
+comment_line="^${comment_re}.*"
+blank_line='^[ 	]*$'
+# Disallow lines starting with "diff -" or "Index: " in the body of the
+# message. Stop looking if we see a scissors line.
+line="$(sed -n -e "
+	# Skip comments and blank lines at the start of the file.
+	/${scissors_line}/q
+	/${comment_line}/d
+	/${blank_line}/d
+	# The first paragraph will become the subject header so
+	# does not need to be checked.
+	: subject
+	n
+	/${scissors_line}/q
+	/${blank_line}/!b subject
+	# Check the body of the message for problematic
+	# prefixes.
+	: body
+	n
+	/${scissors_line}/q
+	/${comment_line}/b body
+	/^diff -/{p;q;}
+	/^Index: /{p;q;}
+	b body
+	" "$1")"
+if test -n "$line"
+then
+	echo >&2 "Message contains a diff that will confuse 'git am'."
+	echo >&2 "To fix this indent the diff."
+	ret=1
+fi
+
+exit $ret
@@ -0,0 +1,168 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+use IPC::Open2;
+
+# An example hook script to integrate Watchman
+# (https://facebook.github.io/watchman/) with git to speed up detecting
+# new and modified files.
+#
+# The hook is passed a version (currently 2) and last update token
+# formatted as a string and outputs to stdout a new update token and
+# all files that have been modified since the update token. Paths must
+# be relative to the root of the working tree and separated by a single NUL.
+#
+# To enable this hook, rename this file to "query-watchman" and set
+# 'git config core.fsmonitor .git/hooks/query-watchman'
+#
+my ($version, $last_update_token) = @ARGV;
+
+# Uncomment for debugging
+# print STDERR "$0 $version $last_update_token\n";
+
+# Check the hook interface version
+if ($version ne 2) {
+	die "Unsupported query-fsmonitor hook version '$version'.\n" .
+	    "Falling back to scanning...\n";
+}
+
+my $git_work_tree = get_working_dir();
+
+my $json_pkg;
+eval {
+	require JSON::XS;
+	$json_pkg = "JSON::XS";
+	1;
+} or do {
+	require JSON::PP;
+	$json_pkg = "JSON::PP";
+};
+
+launch_watchman();
+
+sub launch_watchman {
+	my $o = watchman_query();
+	if (is_work_tree_watched($o)) {
+		output_result($o->{clock}, @{$o->{files}});
+	}
+}
+
+sub output_result {
+	my ($clockid, @files) = @_;
+
+	# Uncomment for debugging watchman output
+	# open (my $fh, ">", ".git/watchman-output.out");
+	# binmode $fh, ":utf8";
+	# print $fh "$clockid\n@files\n";
+	# close $fh;
+
+	binmode STDOUT, ":utf8";
+	print $clockid;
+	print "\0";
+	local $, = "\0";
+	print @files;
+}
+
+sub watchman_clock {
+	my $response = qx/watchman clock "$git_work_tree"/;
+	die "Failed to get clock id on '$git_work_tree'.\n" .
+		"Falling back to scanning...\n" if $? != 0;
+
+	return $json_pkg->new->utf8->decode($response);
+}
+
+sub watchman_query {
+	my $pid = open2(\*CHLD_OUT, \*CHLD_IN, 'watchman -j --no-pretty')
+	or die "open2() failed: $!\n" .
+	"Falling back to scanning...\n";
+
+	# In the query expression below we're asking for names of files that
+	# changed since $last_update_token but not from the .git folder.
+	#
+	# To accomplish this, we're using the "since" generator to use the
+	# recency index to select candidate nodes and "fields" to limit the
+	# output to file names only. Then we're using the "expression" term to
+	# further constrain the results.
+	my $last_update_line = "";
+	if (substr($last_update_token, 0, 1) eq "c") {
+		$last_update_token = "\"$last_update_token\"";
+		$last_update_line = qq[\n"since": $last_update_token,];
+	}
+	my $query = <<"	END";
+		["query", "$git_work_tree", {$last_update_line
+			"fields": ["name"],
+			"expression": ["not", ["dirname", ".git"]]
+		}]
+	END
+
+	# Uncomment for debugging the watchman query
+	# open (my $fh, ">", ".git/watchman-query.json");
+	# print $fh $query;
+	# close $fh;
+
+	print CHLD_IN $query;
+	close CHLD_IN;
+	my $response = do {local $/; <CHLD_OUT>};
+
+	# Uncomment for debugging the watch response
+	# open ($fh, ">", ".git/watchman-response.json");
+	# print $fh $response;
+	# close $fh;
+
+	die "Watchman: command returned no output.\n" .
+	"Falling back to scanning...\n" if $response eq "";
+	die "Watchman: command returned invalid output: $response\n" .
+	"Falling back to scanning...\n" unless $response =~ /^\{/;
+
+	return $json_pkg->new->utf8->decode($response);
+}
+
+sub is_work_tree_watched {
+	my ($output) = @_;
+	my $error = $output->{error};
+	if ($error and $error =~ m/unable to resolve root .* directory (.*) is not watched/) {
+		my $response = qx/watchman watch "$git_work_tree"/;
+		die "Failed to make watchman watch '$git_work_tree'.\n" .
+		    "Falling back to scanning...\n" if $? != 0;
+		$output = $json_pkg->new->utf8->decode($response);
+		$error = $output->{error};
+		die "Watchman: $error.\n" .
+		"Falling back to scanning...\n" if $error;
+
+		# Uncomment for debugging watchman output
+		# open (my $fh, ">", ".git/watchman-output.out");
+		# close $fh;
+
+		# Watchman will always return all files on the first query so
+		# return the fast "everything is dirty" flag to git and do the
+		# Watchman query just to get it over with now so we won't pay
+		# the cost in git to look up each individual file.
+		my $o = watchman_clock();
+		$error = $o->{error};
+
+		die "Watchman: $error.\n" .
+		"Falling back to scanning...\n" if $error;
+
+		output_result($o->{clock}, ("/"));
+		return 0;
+	}
+
+	die "Watchman: $error.\n" .
+	"Falling back to scanning...\n" if $error;
+
+	return 1;
+}
+
+sub get_working_dir {
+	my $working_dir;
+	if ($^O =~ 'msys' || $^O =~ 'cygwin') {
+		$working_dir = Win32::GetCwd();
+		$working_dir =~ tr/\\/\//;
+	} else {
+		require Cwd;
+		$working_dir = Cwd::cwd();
+	}
+
+	return $working_dir;
+}
@@ -0,0 +1,8 @@
+#!/bin/sh
+#
+# An example hook script to prepare a packed repository for use over
+# dumb transports.
+#
+# To enable this hook, rename this file to "post-update".
+
+exec git update-server-info
@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed
+# by applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.
+#
+# To enable this hook, rename this file to "pre-applypatch".
+
+. git-sh-setup
+precommit="$(git rev-parse --git-path hooks/pre-commit)"
+test -x "$precommit" && exec "$precommit" ${1+"$@"}
+:
@@ -0,0 +1,49 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed.
+# Called by "git commit" with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message if
+# it wants to stop the commit.
+#
+# To enable this hook, rename this file to "pre-commit".
+
+if git rev-parse --verify HEAD >/dev/null 2>&1
+then
+	against=HEAD
+else
+	# Initial commit: diff against an empty tree object
+	against=$(git hash-object -t tree /dev/null)
+fi
+
+# If you want to allow non-ASCII filenames set this variable to true.
+allownonascii=$(git config --type=bool hooks.allownonascii)
+
+# Redirect output to stderr.
+exec 1>&2
+
+# Cross platform projects tend to avoid non-ASCII filenames; prevent
+# them from being added to the repository. We exploit the fact that the
+# printable range starts at the space character and ends with tilde.
+if [ "$allownonascii" != "true" ] &&
+	# Note that the use of brackets around a tr range is ok here, (it's
+	# even required, for portability to Solaris 10's /usr/bin/tr), since
+	# the square bracket bytes happen to fall in the designated range.
+	test $(git diff-index --cached --name-only --diff-filter=A -z $against |
+	  LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0
+then
+	cat <<\EOF
+Error: Attempt to add a non-ASCII file name.
+
+This can cause problems if you want to work with people on other platforms.
+
+To be portable it is advisable to rename the file.
+
+If you know what you are doing you can disable this check using:
+
+  git config hooks.allownonascii true
+EOF
+	exit 1
+fi
+
+# If there are whitespace errors, print the offending file names and fail.
+exec git diff-index --check --cached $against --
@@ -0,0 +1,13 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed.
+# Called by "git merge" with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message to
+# stderr if it wants to stop the merge commit.
+#
+# To enable this hook, rename this file to "pre-merge-commit".
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/pre-commit" &&
+        exec "$GIT_DIR/hooks/pre-commit"
+:
@@ -0,0 +1,53 @@
+#!/bin/sh
+
+# An example hook script to verify what is about to be pushed.  Called by "git
+# push" after it has checked the remote status, but before anything has been
+# pushed.  If this script exits with a non-zero status nothing will be pushed.
+#
+# This hook is called with the following parameters:
+#
+# $1 -- Name of the remote to which the push is being done
+# $2 -- URL to which the push is being done
+#
+# If pushing without using a named remote those arguments will be equal.
+#
+# Information about the commits which are being pushed is supplied as lines to
+# the standard input in the form:
+#
+#   <local ref> <local oid> <remote ref> <remote oid>
+#
+# This sample shows how to prevent push of commits where the log message starts
+# with "WIP" (work in progress).
+
+remote="$1"
+url="$2"
+
+zero=$(git hash-object --stdin </dev/null | tr '[0-9a-f]' '0')
+
+while read local_ref local_oid remote_ref remote_oid
+do
+	if test "$local_oid" = "$zero"
+	then
+		# Handle delete
+		:
+	else
+		if test "$remote_oid" = "$zero"
+		then
+			# New branch, examine all commits
+			range="$local_oid"
+		else
+			# Update to existing branch, examine new commits
+			range="$remote_oid..$local_oid"
+		fi
+
+		# Check for WIP commit
+		commit=$(git rev-list -n 1 --grep '^WIP' "$range")
+		if test -n "$commit"
+		then
+			echo >&2 "Found WIP commit in $local_ref, not pushing"
+			exit 1
+		fi
+	fi
+done
+
+exit 0
@@ -0,0 +1,169 @@
+#!/bin/sh
+#
+# Copyright (c) 2006, 2008 Junio C Hamano
+#
+# The "pre-rebase" hook is run just before "git rebase" starts doing
+# its job, and can prevent the command from running by exiting with
+# non-zero status.
+#
+# The hook is called with the following parameters:
+#
+# $1 -- the upstream the series was forked from.
+# $2 -- the branch being rebased (or empty when rebasing the current branch).
+#
+# This sample shows how to prevent topic branches that are already
+# merged to 'next' branch from getting rebased, because allowing it
+# would result in rebasing already published history.
+
+publish=next
+basebranch="$1"
+if test "$#" = 2
+then
+	topic="refs/heads/$2"
+else
+	topic=`git symbolic-ref HEAD` ||
+	exit 0 ;# we do not interrupt rebasing detached HEAD
+fi
+
+case "$topic" in
+refs/heads/??/*)
+	;;
+*)
+	exit 0 ;# we do not interrupt others.
+	;;
+esac
+
+# Now we are dealing with a topic branch being rebased
+# on top of master.  Is it OK to rebase it?
+
+# Does the topic really exist?
+git show-ref -q "$topic" || {
+	echo >&2 "No such branch $topic"
+	exit 1
+}
+
+# Is topic fully merged to master?
+not_in_master=`git rev-list --pretty=oneline ^master "$topic"`
+if test -z "$not_in_master"
+then
+	echo >&2 "$topic is fully merged to master; better remove it."
+	exit 1 ;# we could allow it, but there is no point.
+fi
+
+# Is topic ever merged to next?  If so you should not be rebasing it.
+only_next_1=`git rev-list ^master "^$topic" ${publish} | sort`
+only_next_2=`git rev-list ^master           ${publish} | sort`
+if test "$only_next_1" = "$only_next_2"
+then
+	not_in_topic=`git rev-list "^$topic" master`
+	if test -z "$not_in_topic"
+	then
+		echo >&2 "$topic is already up to date with master"
+		exit 1 ;# we could allow it, but there is no point.
+	else
+		exit 0
+	fi
+else
+	not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"`
+	/usr/bin/perl -e '
+		my $topic = $ARGV[0];
+		my $msg = "* $topic has commits already merged to public branch:\n";
+		my (%not_in_next) = map {
+			/^([0-9a-f]+) /;
+			($1 => 1);
+		} split(/\n/, $ARGV[1]);
+		for my $elem (map {
+				/^([0-9a-f]+) (.*)$/;
+				[$1 => $2];
+			} split(/\n/, $ARGV[2])) {
+			if (!exists $not_in_next{$elem->[0]}) {
+				if ($msg) {
+					print STDERR $msg;
+					undef $msg;
+				}
+				print STDERR " $elem->[1]\n";
+			}
+		}
+	' "$topic" "$not_in_next" "$not_in_master"
+	exit 1
+fi
+
+<<\DOC_END
+
+This sample hook safeguards topic branches that have been
+published from being rewound.
+
+The workflow assumed here is:
+
+ * Once a topic branch forks from "master", "master" is never
+   merged into it again (either directly or indirectly).
+
+ * Once a topic branch is fully cooked and merged into "master",
+   it is deleted.  If you need to build on top of it to correct
+   earlier mistakes, a new topic branch is created by forking at
+   the tip of the "master".  This is not strictly necessary, but
+   it makes it easier to keep your history simple.
+
+ * Whenever you need to test or publish your changes to topic
+   branches, merge them into "next" branch.
+
+The script, being an example, hardcodes the publish branch name
+to be "next", but it is trivial to make it configurable via
+$GIT_DIR/config mechanism.
+
+With this workflow, you would want to know:
+
+(1) ... if a topic branch has ever been merged to "next".  Young
+    topic branches can have stupid mistakes you would rather
+    clean up before publishing, and things that have not been
+    merged into other branches can be easily rebased without
+    affecting other people.  But once it is published, you would
+    not want to rewind it.
+
+(2) ... if a topic branch has been fully merged to "master".
+    Then you can delete it.  More importantly, you should not
+    build on top of it -- other people may already want to
+    change things related to the topic as patches against your
+    "master", so if you need further changes, it is better to
+    fork the topic (perhaps with the same name) afresh from the
+    tip of "master".
+
+Let's look at this example:
+
+		   o---o---o---o---o---o---o---o---o---o "next"
+		  /       /           /           /
+		 /   a---a---b A     /           /
+		/   /               /           /
+	       /   /   c---c---c---c B         /
+	      /   /   /             \         /
+	     /   /   /   b---b C     \       /
+	    /   /   /   /             \     /
+    ---o---o---o---o---o---o---o---o---o---o---o "master"
+
+
+A, B and C are topic branches.
+
+ * A has one fix since it was merged up to "next".
+
+ * B has finished.  It has been fully merged up to "master" and "next",
+   and is ready to be deleted.
+
+ * C has not merged to "next" at all.
+
+We would want to allow C to be rebased, refuse A, and encourage
+B to be deleted.
+
+To compute (1):
+
+	git rev-list ^master ^topic next
+	git rev-list ^master        next
+
+	if these match, topic has not merged in next at all.
+
+To compute (2):
+
+	git rev-list master..topic
+
+	if this is empty, it is fully merged to "master".
+
+DOC_END
@@ -0,0 +1,24 @@
+#!/bin/sh
+#
+# An example hook script to make use of push options.
+# The example simply echoes all push options that start with 'echoback='
+# and rejects all pushes when the "reject" push option is used.
+#
+# To enable this hook, rename this file to "pre-receive".
+
+if test -n "$GIT_PUSH_OPTION_COUNT"
+then
+	i=0
+	while test "$i" -lt "$GIT_PUSH_OPTION_COUNT"
+	do
+		eval "value=\$GIT_PUSH_OPTION_$i"
+		case "$value" in
+		echoback=*)
+			echo "echo from the pre-receive-hook: ${value#*=}" >&2
+			;;
+		reject)
+			exit 1
+		esac
+		i=$((i + 1))
+	done
+fi
@@ -0,0 +1,42 @@
+#!/bin/sh
+#
+# An example hook script to prepare the commit log message.
+# Called by "git commit" with the name of the file that has the
+# commit message, followed by the description of the commit
+# message's source.  The hook's purpose is to edit the commit
+# message file.  If the hook fails with a non-zero status,
+# the commit is aborted.
+#
+# To enable this hook, rename this file to "prepare-commit-msg".
+
+# This hook includes three examples. The first one removes the
+# "# Please enter the commit message..." help message.
+#
+# The second includes the output of "git diff --name-status -r"
+# into the message, just before the "git status" output.  It is
+# commented because it doesn't cope with --amend or with squashed
+# commits.
+#
+# The third example adds a Signed-off-by line to the message, that can
+# still be edited.  This is rarely a good idea.
+
+COMMIT_MSG_FILE=$1
+COMMIT_SOURCE=$2
+SHA1=$3
+
+/usr/bin/perl -i.bak -ne 'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE"
+
+# case "$COMMIT_SOURCE,$SHA1" in
+#  ,|template,)
+#    /usr/bin/perl -i.bak -pe '
+#       print "\n" . `git diff --cached --name-status -r`
+# 	 if /^#/ && $first++ == 0' "$COMMIT_MSG_FILE" ;;
+#  *) ;;
+# esac
+
+# SOB=$(git var GIT_COMMITTER_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p')
+# git interpret-trailers --in-place --trailer "$SOB" "$COMMIT_MSG_FILE"
+# if test -z "$COMMIT_SOURCE"
+# then
+#   /usr/bin/perl -i.bak -pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE"
+# fi
@@ -0,0 +1,78 @@
+#!/bin/sh
+
+# An example hook script to update a checked-out tree on a git push.
+#
+# This hook is invoked by git-receive-pack(1) when it reacts to git
+# push and updates reference(s) in its repository, and when the push
+# tries to update the branch that is currently checked out and the
+# receive.denyCurrentBranch configuration variable is set to
+# updateInstead.
+#
+# By default, such a push is refused if the working tree and the index
+# of the remote repository has any difference from the currently
+# checked out commit; when both the working tree and the index match
+# the current commit, they are updated to match the newly pushed tip
+# of the branch. This hook is to be used to override the default
+# behaviour; however the code below reimplements the default behaviour
+# as a starting point for convenient modification.
+#
+# The hook receives the commit with which the tip of the current
+# branch is going to be updated:
+commit=$1
+
+# It can exit with a non-zero status to refuse the push (when it does
+# so, it must not modify the index or the working tree).
+die () {
+	echo >&2 "$*"
+	exit 1
+}
+
+# Or it can make any necessary changes to the working tree and to the
+# index to bring them to the desired state when the tip of the current
+# branch is updated to the new commit, and exit with a zero status.
+#
+# For example, the hook can simply run git read-tree -u -m HEAD "$1"
+# in order to emulate git fetch that is run in the reverse direction
+# with git push, as the two-tree form of git read-tree -u -m is
+# essentially the same as git switch or git checkout that switches
+# branches while keeping the local changes in the working tree that do
+# not interfere with the difference between the branches.
+
+# The below is a more-or-less exact translation to shell of the C code
+# for the default behaviour for git's push-to-checkout hook defined in
+# the push_to_deploy() function in builtin/receive-pack.c.
+#
+# Note that the hook will be executed from the repository directory,
+# not from the working tree, so if you want to perform operations on
+# the working tree, you will have to adapt your code accordingly, e.g.
+# by adding "cd .." or using relative paths.
+
+if ! git update-index -q --ignore-submodules --refresh
+then
+	die "Up-to-date check failed"
+fi
+
+if ! git diff-files --quiet --ignore-submodules --
+then
+	die "Working directory has unstaged changes"
+fi
+
+# This is a rough translation of:
+#
+#   head_has_history() ? "HEAD" : EMPTY_TREE_SHA1_HEX
+if git cat-file -e HEAD 2>/dev/null
+then
+	head=HEAD
+else
+	head=$(git hash-object -t tree --stdin </dev/null)
+fi
+
+if ! git diff-index --quiet --cached --ignore-submodules $head --
+then
+	die "Working directory has staged changes"
+fi
+
+if ! git read-tree -u -m "$commit"
+then
+	die "Could not update working tree to new HEAD"
+fi
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`/usr/lib/systemd/system/NetworkManager.service`
				`@@ -1 +0,0 @@`
				`/usr/lib/systemd/system/systemd-networkd.service`
				`@@ -1 +0,0 @@`
				`/usr/lib/systemd/system/systemd-resolved.service`
				`@@ -0,0 +1 @@`
				`Unnamed repository; edit this file 'description' to name the repository.`