Feature: Make home UniFi VPN row a collapsible card

Put the Replace config option behind an expand chevron, like Mullvad's
options, and frame the card while it's expanded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -39,13 +39,26 @@ mkdir Projects
 git clone ssh://git@gitea.thomasleewilliams.co.uk:2222/thomas/dotfiles.git
 ```
 
-Once that is complete, run this command:
+On a fresh install, run the bootstrap script. It installs drivers (auto-detected),
+every package in `system/packages.txt`, yay, flatpaks, then links the dotfiles and
+system config below:
+```console
+~/Projects/dotfiles/bootstrap.sh            # asks about the optional SVT-AV1 + ffmpeg rebuild
+~/Projects/dotfiles/bootstrap.sh --svt-av1  # or --no-svt-av1 to skip the question
+```
+
+To only link the dotfiles, run this command:
 ```console
 stow -d ~/Projects/dotfiles/ -t ~/ dotfiles
 ```
 
 This will sync wallpapers/config files to where they are usually located
 
+System-level config (e.g. pacman options) lives in `system/` and is installed with sudo:
+```console
+~/Projects/dotfiles/system/install.sh
+```
+
 ## 📦 Programs
 
 List of programs and tools I use.

bootstrap.sh

@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+# Sets up a fresh Arch install: drivers, packages, dotfiles and system config.
+# Safe to re-run; anything already installed is skipped.
+#
+# Usage: ./bootstrap.sh [--svt-av1 | --no-svt-av1]
+#   --svt-av1     also install svt-av1-essential-git and rebuild ffmpeg against it
+#   --no-svt-av1  skip that without asking
+#   (neither)     ask
+set -euo pipefail
+
+repo="$(cd "$(dirname "$0")" && pwd)"
+list="$repo/system/packages.txt"
+
+svt_av1=ask
+for arg in "$@"; do
+    case "$arg" in
+        --svt-av1) svt_av1=yes ;;
+        --no-svt-av1) svt_av1=no ;;
+        *) echo "Unknown option: $arg" >&2; exit 1 ;;
+    esac
+done
+
+if (( EUID == 0 )); then
+    echo "Run this as your normal user, not root (it uses sudo where needed)." >&2
+    exit 1
+fi
+
+step() { printf '\n\033[1;34m==> %s\033[0m\n' "$*"; }
+
+# Prints the packages under a [section] of packages.txt, skipping comments
+packages() {
+    awk -v want="[$1]" '
+        /^\[/ { section = $1; next }
+        section == want { sub(/#.*/, ""); if (NF) print $1 }
+    ' "$list"
+}
+
+# --- System config -----------------------------------------------------------
+
+step "System config (pacman options)"
+"$repo/system/install.sh"
+
+step "Enabling multilib (needed for Steam and 32-bit drivers)"
+if ! grep -q '^\[multilib\]' /etc/pacman.conf; then
+    sudo sed -i '/^#\[multilib\]/,/^#Include/ s/^#//' /etc/pacman.conf
+fi
+sudo pacman -Syu --needed --noconfirm pciutils git base-devel
+
+# --- Hardware ----------------------------------------------------------------
+
+step "Detecting CPU and GPU"
+hw=()
+
+case "$(grep -m1 '^vendor_id' /proc/cpuinfo | awk '{print $3}')" in
+    AuthenticAMD) hw+=(amd-ucode); echo "CPU: AMD" ;;
+    GenuineIntel) hw+=(intel-ucode); echo "CPU: Intel" ;;
+    *) echo "CPU: unknown vendor, skipping microcode" ;;
+esac
+
+# Vendor column of every display controller, e.g. "NVIDIA Corporation"
+gpus="$(lspci -mm | awk -F'"' '$2 ~ /VGA|3D|Display/ { print $4 }')"
+if grep -q NVIDIA <<<"$gpus"; then
+    echo "GPU: NVIDIA"
+    # nvidia-open only ships modules for the stock `linux` kernel; any other
+    # kernel needs the DKMS build. Supports Turing (GTX 16xx / RTX 20xx) and newer.
+    if pacman -Qq linux-lts linux-zen linux-hardened >/dev/null 2>&1; then
+        hw+=(nvidia-open-dkms linux-headers)
+    else
+        hw+=(nvidia-open)
+    fi
+    hw+=(nvidia-utils lib32-nvidia-utils libva-nvidia-driver)
+fi
+if grep -q 'Advanced Micro Devices' <<<"$gpus"; then
+    echo "GPU: AMD"
+    hw+=(mesa lib32-mesa vulkan-radeon lib32-vulkan-radeon)
+fi
+if grep -q 'Intel Corporation' <<<"$gpus"; then
+    echo "GPU: Intel"
+    hw+=(mesa lib32-mesa vulkan-intel lib32-vulkan-intel intel-media-driver)
+fi
+
+# Installed before the main list so Steam's 32-bit Vulkan dependency is
+# already satisfied by the right driver
+if (( ${#hw[@]} )); then
+    sudo pacman -S --needed --noconfirm "${hw[@]}"
+fi
+
+# --- Packages ----------------------------------------------------------------
+
+step "Official repo packages"
+mapfile -t pkgs < <(packages pacman)
+sudo pacman -S --needed --noconfirm "${pkgs[@]}"
+
+step "yay (AUR helper)"
+if ! command -v yay >/dev/null; then
+    build="$(mktemp -d)"
+    git clone https://aur.archlinux.org/yay-bin.git "$build/yay-bin"
+    (cd "$build/yay-bin" && makepkg -si --noconfirm)
+    rm -rf "$build"
+else
+    echo "already installed"
+fi
+
+step "AUR packages"
+mapfile -t pkgs < <(packages aur)
+yay -S --needed --noconfirm "${pkgs[@]}"
+
+step "Flatpak apps"
+sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
+mapfile -t pkgs < <(packages flatpak)
+sudo flatpak install -y --noninteractive flathub "${pkgs[@]}"
+
+step "Apps from official install scripts"
+mkdir -p "$HOME/.local/bin"
+for app in $(packages installer); do
+    if command -v "$app" >/dev/null || [[ -x "$HOME/.local/bin/$app" ]]; then
+        echo "$app: already installed"
+        continue
+    fi
+    case "$app" in
+        claude) curl -fsSL https://claude.ai/install.sh | bash ;;
+        oh-my-posh) curl -fsSL https://ohmyposh.dev/install.sh | bash -s -- -d "$HOME/.local/bin" ;;
+        *) echo "$app: no install recipe in bootstrap.sh, skipping" >&2 ;;
+    esac
+done
+
+# --- Optional: SVT-AV1 essential + ffmpeg rebuild ----------------------------
+
+if [[ $svt_av1 == ask ]]; then
+    read -rp $'\nInstall svt-av1-essential-git and rebuild ffmpeg against it? (slow) [y/N] ' reply
+    [[ $reply == [yY]* ]] && svt_av1=yes || svt_av1=no
+fi
+if [[ $svt_av1 == yes ]]; then
+    step "svt-av1-essential-git"
+    # Interactive on purpose: pacman asks to replace the conflicting svt-av1,
+    # and --noconfirm would answer no
+    yay -S --needed svt-av1-essential-git
+    step "Rebuilding ffmpeg against svt-av1-essential-git"
+    "$repo/system/rebuild-ffmpeg.sh"
+fi
+
+# --- Services ----------------------------------------------------------------
+
+step "Enabling services"
+# Not started now: sddm would take over the screen mid-script. They come up on reboot.
+mapfile -t units < <(packages services)
+sudo systemctl enable "${units[@]}"
+
+# --- Dotfiles ----------------------------------------------------------------
+
+step "Linking dotfiles with stow"
+# Create real parent dirs first, otherwise stow symlinks the whole directory
+# (e.g. ~/.config) into the repo and every app's files end up in git
+mkdir -p "$HOME/.config" "$HOME/.local/bin" "$HOME/.local/share" "$HOME/Pictures"
+# Sunshine keeps credentials and logs beside its config; those must stay out of git
+mkdir -p "$HOME/.config/sunshine"
+mkdir -p -m 700 "$HOME/.ssh"
+if ! stow -d "$repo" -t "$HOME" --restow dotfiles; then
+    echo "stow hit conflicts (listed above). Move those files aside, then run:" >&2
+    echo "  stow -d \"$repo\" -t \"\$HOME\" dotfiles" >&2
+fi
+
+if [[ "$(getent passwd "$USER" | cut -d: -f7)" != */zsh ]]; then
+    step "Setting zsh as login shell"
+    chsh -s /usr/bin/zsh
+fi
+
+step "Done — reboot to load drivers and start Hyprland"

dotfiles/.config/environment.d/ssh-agent.conf

@@ -0,0 +1 @@
+SSH_AUTH_SOCK=${HOME}/.bitwarden-ssh-agent.sock

dotfiles/.config/foot/foot.ini

@@ -47,3 +47,11 @@ regular4=53BDFA  # blue
 regular5=FAE994  # magenta
 regular6=99faf2  # cyan
 regular7=C7C7C7  # white
+
+[key-bindings]
+clipboard-copy=Control+c XF86Copy
+clipboard-paste=Control+Shift+v XF86Paste
+
+[text-bindings]
+# Ctrl+C now copies, so send the interrupt signal (^C) from Ctrl+Shift+C instead
+\x03=Control+Shift+c

dotfiles/.config/gtk-3.0/bookmarks

@@ -3,5 +3,6 @@ file:///home/thomas/Documents
 file:///home/thomas/Downloads
 file:///home/thomas/Pictures
 file:///home/thomas/Music
+file:///home/thomas/Videos
 smb://192.168.1.84/media/
 smb://192.168.1.85/music/

dotfiles/.config/hypr/UserConfigs/ENVariables.conf

@@ -51,10 +51,10 @@ env = ELECTRON_OZONE_PLATFORM_HINT,auto # auto selects Wayland if possible, X11
 # This is from Hyprland Wiki. Below will be activated nvidia gpu detected
 # See hyprland wiki https://wiki.hyprland.org/Nvidia/#environment-variables
 
-#env = LIBVA_DRIVER_NAME,nvidia
+env = LIBVA_DRIVER_NAME,nvidia
-#env = __GLX_VENDOR_LIBRARY_NAME,nvidia
+env = __GLX_VENDOR_LIBRARY_NAME,nvidia
-#env = NVD_BACKEND,direct
+env = NVD_BACKEND,direct
-#env = GSK_RENDERER,ngl
+env = GSK_RENDERER,ngl
 
 # additional ENV's for nvidia. Caution, activate with care
 #env = GBM_BACKEND,nvidia-drm
@@ -87,3 +87,6 @@ env = ELECTRON_OZONE_PLATFORM_HINT,auto # auto selects Wayland if possible, X11
 # env = HYPRLAND_NO_RT,1 # Disables realtime priority setting by Hyprland.
 # env = HYPRLAND_NO_SD_NOTIFY,1 # If systemd, disables the 'sd_notify' calls.
 # env = HYPRLAND_NO_SD_VARS,1 # Disables management of variables in systemd and dbus activation environments.
+
+# Bitwarden SSH agent (so GUI apps like VS Code see it, not just shells)
+env = SSH_AUTH_SOCK,/home/thomas/.bitwarden-ssh-agent.sock

dotfiles/.config/hypr/UserConfigs/UserDecorations.conf

@@ -21,7 +21,7 @@ decoration {
   rounding = 10
          
   active_opacity = 1.0
-  inactive_opacity = 0.9
+  inactive_opacity = 1.0
   fullscreen_opacity = 1.0
 
   dim_inactive = true

dotfiles/.config/hypr/UserConfigs/monitors.conf

@@ -8,5 +8,5 @@
 # <<<<< TUI AUTO START
 monitor=desc:LG Electronics LG ULTRAWIDE 0x0002E68A,2560x1080@60.00000,1920x-740,1.00000000,transform,3,vrr,0
 monitor=desc:HP Inc. HP 524pf VNG447017D,1920x1080@100.00000,-1920x0,1.00000000,transform,0,vrr,0
-monitor=desc:Acer Technologies VG240Y S 0x126191DE,1920x1080@165.00301,0x0,1.00000000,transform,0,vrr,1,bitdepth,10,cm,wide
+monitor=desc:Acer Technologies VG240Y S 0x126191DE,1920x1080@165.00301,0x0,1.00000000,transform,0,vrr,0,bitdepth,10,cm,wide
 # <<<<< TUI AUTO END

dotfiles/.config/hypr/appearance/decorations.lua

@@ -24,7 +24,7 @@ hl.config({
         rounding = 10,
 
         active_opacity     = 1.0,
-        inactive_opacity    = 0.9,
+        inactive_opacity    = 1.0,
         fullscreen_opacity  = 1.0,
 
         dim_inactive = true,

dotfiles/.config/hypr/core/env.lua

@@ -49,10 +49,10 @@ hl.env("ELECTRON_OZONE_PLATFORM_HINT", "auto") -- auto selects Wayland if possib
 -- This is from the Hyprland wiki. Uncomment below if an nvidia GPU is detected.
 -- See hyprland wiki https://wiki.hyprland.org/Nvidia/#environment-variables
 
--- hl.env("LIBVA_DRIVER_NAME", "nvidia")
+hl.env("LIBVA_DRIVER_NAME", "nvidia")
--- hl.env("__GLX_VENDOR_LIBRARY_NAME", "nvidia")
+hl.env("__GLX_VENDOR_LIBRARY_NAME", "nvidia")
--- hl.env("NVD_BACKEND", "direct")
+hl.env("NVD_BACKEND", "direct")
--- hl.env("GSK_RENDERER", "ngl")
+hl.env("GSK_RENDERER", "ngl")
 
 -- additional ENV's for nvidia. Caution, activate with care
 -- hl.env("GBM_BACKEND", "nvidia-drm")
@@ -85,3 +85,6 @@ hl.env("ELECTRON_OZONE_PLATFORM_HINT", "auto") -- auto selects Wayland if possib
 -- hl.env("HYPRLAND_NO_RT", "1") -- Disables realtime priority setting by Hyprland.
 -- hl.env("HYPRLAND_NO_SD_NOTIFY", "1") -- If systemd, disables the 'sd_notify' calls.
 -- hl.env("HYPRLAND_NO_SD_VARS", "1") -- Disables management of variables in systemd and dbus activation environments.
+
+-- Bitwarden SSH agent (so GUI apps like VS Code see it, not just shells)
+hl.env("SSH_AUTH_SOCK", os.getenv("HOME") .. "/.bitwarden-ssh-agent.sock")

dotfiles/.config/hypr/core/hyprmod.lua

@@ -5,6 +5,11 @@
 -- whatever it last wrote. If you reinstall HyprMod, prefer letting its own "Migrate to Lua…"
 -- wizard take over managing this file instead of hand-editing it going forward.
 
+-- vrr forced off globally: the per-monitor vrr = 0 flag below does NOT override this when
+-- misc.vrr is 1 (tested live on Hyprland 0.56.2 — DP-2 stayed vrr:true until this global
+-- was changed). DP-2 (Acer VG240Y S) flickers under VRR when idle in fullscreen (mouse
+-- stationary -> no repaint damage -> frame delivery stalls near the panel's VRR floor).
+-- The other two monitors don't negotiate VRR at all, so this has no effect on them.
 hl.config({
     general = {
         allow_tearing = true,
@@ -13,17 +18,19 @@ hl.config({
         },
     },
     misc = {
-        vrr = 1,
+        vrr = 0,
     },
 })
 
 -- Monitors
-hl.monitor({ output = "DP-2", mode = "1920x1080@165.00Hz", position = "0x0", scale = 1, bitdepth = 10, cm = "wide" })
+hl.monitor({ output = "DP-2", mode = "1920x1080@165.00Hz", position = "0x0", scale = 1, bitdepth = 10, cm = "wide", vrr = 0 })
 
 -- Keybinds
 -- (unbind = SUPER SHIFT, Print / unbind = SUPER, up from the source .conf have no Lua equivalent needed —
 -- we just don't define a conflicting bind elsewhere; SUPER + up -> movefocus u below is otherwise identical
 -- to the one already in keybinds.lua, kept here too for parity with the original file)
-hl.bind("SUPER + Print", hl.dsp.exec_cmd("hyprshot -o " .. os.getenv("HOME") .. "/Pictures/Screenshots-Linux -m region"))
+hl.bind("SUPER + Print", hl.dsp.exec_cmd([[sh -c 'if command -v hyprshot >/dev/null; then hyprshot -o "$HOME/Pictures/Screenshots-Linux" -m region; else grim -g "$(slurp)" "$HOME/Pictures/Screenshots-Linux/$(date +%Y-%m-%d_%H-%M-%S).png" && notify-send "Screenshot saved"; fi']])) -- drag an area (hyprshot if installed, else grim/slurp)
+hl.bind("SUPER + SHIFT + S", hl.dsp.exec_cmd([[sh -c 'grim -g "$(slurp)" "$HOME/Pictures/Screenshots-Linux/$(date +%Y-%m-%d_%H-%M-%S).png" && notify-send "Screenshot saved"']])) -- region; Surface keyboard has no Print key
+hl.bind("SUPER + F6", hl.dsp.exec_cmd([[sh -c 'grim "$HOME/Pictures/Screenshots-Linux/$(date +%Y-%m-%d_%H-%M-%S).png" && notify-send "Screenshot saved"']])) -- full screen
 hl.bind("SUPER + up", hl.dsp.focus({ direction = "u" }))
-hl.bind("SUPER + SHIFT + Print", hl.dsp.exec_cmd("hyprshot -o " .. os.getenv("HOME") .. "/Pictures/Screenshots-Linux -m window"))
+hl.bind("SUPER + SHIFT + Print", hl.dsp.exec_cmd([[sh -c 'if command -v hyprshot >/dev/null; then hyprshot -o "$HOME/Pictures/Screenshots-Linux" -m window; else grim "$HOME/Pictures/Screenshots-Linux/$(date +%Y-%m-%d_%H-%M-%S).png" && notify-send "Screenshot saved"; fi']])) -- window (hyprshot) or full screen (fallback)

dotfiles/.config/hypr/core/startup.lua

@@ -13,6 +13,11 @@ hl.on("hyprland.start", function()
     -- Startup
     hl.exec_cmd("dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP")
     hl.exec_cmd("systemctl --user import-environment WAYLAND_DISPLAY XDG_CURRENT_DESKTOP")
+    -- restart portals once the env is imported, otherwise screen sharing breaks
+    hl.exec_cmd("sleep 1 && systemctl --user restart xdg-desktop-portal-hyprland && systemctl --user restart xdg-desktop-portal")
+
+    -- Sunshine (virtual monitor only on desktop; skipped on laptops, detected by a system battery)
+    hl.exec_cmd("sleep 1 && ! ls -d /sys/class/power_supply/BAT* >/dev/null 2>&1 && hyprctl output create headless")
 
     -- Polkit (Polkit Gnome / KDE)
     hl.exec_cmd(scriptsDir .. "/Polkit.sh")
@@ -23,7 +28,7 @@ hl.on("hyprland.start", function()
     -- hl.exec_cmd("ags")
     -- hl.exec_cmd("blueman-applet")
     -- hl.exec_cmd("rog-control-center")
-    hl.exec_cmd("waybar")
+    -- hl.exec_cmd("waybar")
     hl.exec_cmd("qs") -- quickshell AGS Desktop Overview alternative
 
     -- clipboard manager
@@ -31,8 +36,12 @@ hl.on("hyprland.start", function()
     hl.exec_cmd("wl-paste --type image --watch cliphist store")
 
     -- Starting hypridle to start hyprlock
+    -- Sunshine streams hold an idle inhibitor (scripts/SunshineIdle.sh) so this never locks mid-stream
     hl.exec_cmd("hypridle")
 
+    -- Sunshine for streaming media
+    hl.exec_cmd("sunshine")
+
     -- Float + center the Bitwarden extension pop-out (window rules can't catch it — see the script)
     hl.exec_cmd(scriptsDir .. "/FloatBitwardenPopup.sh")
 
@@ -43,6 +52,7 @@ hl.on("hyprland.start", function()
     hl.exec_cmd("sleep 3 && vesktop")
     hl.dispatch(hl.dsp.focus({ workspace = 1 }))
     hl.exec_cmd("bitwarden-desktop --ozone-platform-hint=auto --silent")
+    hl.exec_cmd("seafile-applet")
 
     -- Here are a list of features available but disabled by default
     -- hl.exec_cmd("awww-daemon --format xrgb && awww img " .. os.getenv("HOME") .. "/Pictures/wallpapers/mecha-nostalgia.png") -- persistent wallpaper

dotfiles/.config/hypr/hyprland-gui.conf

@@ -2,10 +2,15 @@
 
 general:allow_tearing = 1
 general:snap:enabled = 0
-misc:vrr = 1
+# vrr forced off globally: the per-monitor vrr,0 flag below does NOT override this when
+# misc:vrr is 1 (tested live on Hyprland 0.56.2 — DP-2 stayed vrr:true until this global
+# was changed). DP-2 (Acer VG240Y S) flickers under VRR when idle in fullscreen (mouse
+# stationary -> no repaint damage -> frame delivery stalls near the panel's VRR floor).
+# The other two monitors don't negotiate VRR at all, so this has no effect on them.
+misc:vrr = 0
 
 # Monitors
-monitor = DP-2, 1920x1080@165.00Hz, 0x0, 1, bitdepth, 10, cm, wide
+monitor = DP-2, 1920x1080@165.00Hz, 0x0, 1, bitdepth, 10, cm, wide, vrr, 0
 
 # Keybinds
 unbind = SUPER SHIFT, Print

dotfiles/.config/hypr/input/keybinds.lua

@@ -116,23 +116,22 @@ hl.bind(mainMod .. " + SHIFT + tab", hl.dsp.focus({ workspace = "m-1" }))
 hl.bind(mainMod .. " + U",         hl.dsp.workspace.toggle_special("nyx"))
 hl.bind(mainMod .. " + SHIFT + U", hl.dsp.window.move({ workspace = "special:nyx" }))
 
--- The following mappings use key codes to better support various keyboard layouts
+-- Number-row keys (the Lua bind parser does not accept the code:NN keycode syntax)
--- 1 is code:10, 2 is code:11, etc
 -- Switch workspaces with mainMod + [0-9]
-for i, code in ipairs({ 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 }) do
+for i, key in ipairs({ "1", "2", "3", "4", "5", "6", "7", "8", "9", "0" }) do
-    hl.bind(mainMod .. " + code:" .. code, hl.dsp.focus({ workspace = i })) -- code:10 = key 1 ... code:19 = key 0
+    hl.bind(mainMod .. " + " .. key, hl.dsp.focus({ workspace = i }))
 end
 
 -- Move active window and follow to workspace mainMod + SHIFT + [0-9]
-for i, code in ipairs({ 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 }) do
+for i, key in ipairs({ "1", "2", "3", "4", "5", "6", "7", "8", "9", "0" }) do
-    hl.bind(mainMod .. " + SHIFT + code:" .. code, hl.dsp.window.move({ workspace = i, follow = true }))
+    hl.bind(mainMod .. " + SHIFT + " .. key, hl.dsp.window.move({ workspace = i, follow = true }))
 end
 hl.bind(mainMod .. " + SHIFT + bracketleft",  hl.dsp.window.move({ workspace = -1, follow = true })) -- brackets [
 hl.bind(mainMod .. " + SHIFT + bracketright", hl.dsp.window.move({ workspace = 1,  follow = true })) -- brackets ]
 
 -- Move active window to a workspace silently mainMod + CTRL + [0-9]
-for i, code in ipairs({ 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 }) do
+for i, key in ipairs({ "1", "2", "3", "4", "5", "6", "7", "8", "9", "0" }) do
-    hl.bind(mainMod .. " + CTRL + code:" .. code, hl.dsp.window.move({ workspace = i, follow = false }))
+    hl.bind(mainMod .. " + CTRL + " .. key, hl.dsp.window.move({ workspace = i, follow = false }))
 end
 hl.bind(mainMod .. " + CTRL + bracketleft",  hl.dsp.window.move({ workspace = -1, follow = false })) -- brackets [
 hl.bind(mainMod .. " + CTRL + bracketright", hl.dsp.window.move({ workspace = 1,  follow = false })) -- brackets ]

dotfiles/.config/hypr/layout/monitors.lua

@@ -10,5 +10,6 @@
 -- <<<<< TUI AUTO START
 hl.monitor({ output = "desc:LG Electronics LG ULTRAWIDE 0x0002E68A", mode = "2560x1080@60.00000", position = "1920x-740", scale = 1.00000000, transform = 3, vrr = 0 })
 hl.monitor({ output = "desc:HP Inc. HP 524pf VNG447017D",           mode = "1920x1080@100.00000", position = "-1920x0",   scale = 1.00000000, transform = 0, vrr = 0 })
-hl.monitor({ output = "desc:Acer Technologies VG240Y S 0x126191DE", mode = "1920x1080@165.00301", position = "0x0",       scale = 1.00000000, transform = 0, vrr = 1, bitdepth = 10, cm = "wide" })
+hl.monitor({ output = "desc:Acer Technologies VG240Y S 0x126191DE", mode = "1920x1080@165.00301", position = "0x0",       scale = 1.00000000, transform = 0, vrr = 0, bitdepth = 10, cm = "wide" })
+hl.monitor({ output = "HEADLESS-1", mode = "1728x1080@60.00000", position = "4480x0", scale = 1.00000000, transform = 0, vrr = 0 })
 -- <<<<< TUI AUTO END

dotfiles/.config/hypr/layout/windowrules.lua

@@ -137,8 +137,8 @@ hl.window_rule({ workspace = "3", match = { class = "^([Vv]esktop|[Dd]iscord|[Ss
 hl.window_rule({ size = "20% 20%", match = { class = "^([Pp]lexamp)" } })
 
 -- FLOAT
-hl.window_rule({ name = "windowrule-75", float = true, opacity = "0.9 0.7", size = "monitor_w*0.7 monitor_h*0.7", match = { tag = "wallpaper*" } })
+hl.window_rule({ name = "windowrule-75", float = true, opacity = "0.9 0.9", size = "monitor_w*0.7 monitor_h*0.7", match = { tag = "wallpaper*" } })
-hl.window_rule({ name = "windowrule-76", float = true, opacity = "0.8 0.7", size = "monitor_w*0.7 monitor_h*0.7", match = { tag = "settings*" } })
+hl.window_rule({ name = "windowrule-76", float = true, opacity = "0.8 0.8", size = "monitor_w*0.7 monitor_h*0.7", match = { tag = "settings*" } })
 hl.window_rule({ name = "windowrule-77", float = true, match = { tag = "viewer*" } })
 hl.window_rule({ name = "windowrule-78", float = true, match = { class = "([Zz]oom|onedriver|onedriver-launcher)$" } })
 hl.window_rule({ name = "windowrule-79", float = true, match = { class = "(org.gnome.Calculator)", title = "(Calculator)" } })
@@ -162,17 +162,17 @@ hl.window_rule({ name = "windowrule-92", float = true, center = true, size = "mo
 -- END of float popups and dialogue #######
 
 -- OPACITY
--- hl.window_rule({ opacity = "0.9 0.7", match = { tag = "browser*" } })
+-- hl.window_rule({ opacity = "0.9 0.9", match = { tag = "browser*" } })
--- hl.window_rule({ opacity = "0.9 0.8", match = { tag = "projects*" } })
+-- hl.window_rule({ opacity = "0.9 0.9", match = { tag = "projects*" } })
--- hl.window_rule({ opacity = "0.94 0.86", match = { tag = "im*" } })
+-- hl.window_rule({ opacity = "0.94 0.94", match = { tag = "im*" } })
--- hl.window_rule({ opacity = "0.94 0.86", match = { tag = "multimedia*" } })
+-- hl.window_rule({ opacity = "0.94 0.94", match = { tag = "multimedia*" } })
--- hl.window_rule({ opacity = "0.9 0.8", match = { tag = "file-manager*" } })
+-- hl.window_rule({ opacity = "0.9 0.9", match = { tag = "file-manager*" } })
-hl.window_rule({ name = "windowrule-93", opacity = "0.8 0.7", match = { tag = "terminal*" } })
+hl.window_rule({ name = "windowrule-93", opacity = "0.8 0.8", match = { tag = "terminal*" } })
--- hl.window_rule({ opacity = "0.82 0.75", match = { tag = "viewer*" } })
+-- hl.window_rule({ opacity = "0.82 0.82", match = { tag = "viewer*" } })
-hl.window_rule({ name = "windowrule-94", opacity = "0.8 0.7", match = { class = "^(gedit|org.gnome.TextEditor|mousepad)$" } })
+hl.window_rule({ name = "windowrule-94", opacity = "0.8 0.8", match = { class = "^(gedit|org.gnome.TextEditor|mousepad)$" } })
-hl.window_rule({ name = "windowrule-95", opacity = "0.9 0.8", match = { class = "^(deluge)$" } })
+hl.window_rule({ name = "windowrule-95", opacity = "0.9 0.9", match = { class = "^(deluge)$" } })
-hl.window_rule({ name = "windowrule-96", opacity = "0.9 0.8", match = { class = "^(seahorse)$" } }) -- gnome-keyring gui
+hl.window_rule({ name = "windowrule-96", opacity = "0.9 0.9", match = { class = "^(seahorse)$" } }) -- gnome-keyring gui
--- hl.window_rule({ opacity = "0.95 0.75", match = { title = "^(Picture-in-Picture)$" } })
+-- hl.window_rule({ opacity = "0.95 0.95", match = { title = "^(Picture-in-Picture)$" } })
 
 -- SIZE
 -- hl.window_rule({ size = "25% 25%", match = { title = "^(Firefox)$" } })

dotfiles/.config/hypr/layout/workspaces.lua

@@ -13,6 +13,7 @@
 hl.workspace_rule({ workspace = 1, monitor = "DP-2",     default = true })
 hl.workspace_rule({ workspace = 2, monitor = "DP-1",     default = true })
 hl.workspace_rule({ workspace = 3, monitor = "HDMI-A-1", default = true })
+hl.workspace_rule({ workspace = 9, monitor = "HEADLESS-1", default = true })
 -- hl.workspace_rule({ workspace = 4, monitor = "eDP-1" })
 -- hl.workspace_rule({ workspace = 5, monitor = "DP-2" })
 -- hl.workspace_rule({ workspace = 6, monitor = "DP-2" })

dotfiles/.config/hypr/scripts/MediaCtrl.sh

@@ -4,6 +4,11 @@
 
 music_icon="$HOME/.config/swaync/icons/music.png"
 
+# Use the app's own icon for known players
+case "$(playerctl metadata --format '{{playerName}}' 2>/dev/null)" in
+    Plexamp) music_icon="com.plexamp.Plexamp" ;;
+esac
+
 # Play the next track
 play_next() {
     playerctl next

dotfiles/.config/hypr/scripts/SunshineIdle.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Keeps hypridle from locking the screen while Sunshine is streaming.
+# Hooked up as Sunshine's global_prep_cmd, so it runs for every app:
+#   start -> hold a systemd idle inhibitor (hypridle respects these) and
+#            unlock hyprlock if the session was already locked
+#   stop  -> release the inhibitor so normal idle locking resumes
+
+pidfile="${XDG_RUNTIME_DIR:-/tmp}/sunshine-idle-inhibit.pid"
+
+case "$1" in
+    start)
+        if ! { [ -f "$pidfile" ] && kill -0 "$(cat "$pidfile")" 2>/dev/null; }; then
+            setsid systemd-inhibit --what=idle --who=Sunshine --why="Streaming" \
+                sleep infinity >/dev/null 2>&1 &
+            echo $! > "$pidfile"
+        fi
+        # SIGUSR1 tells hyprlock to unlock
+        pkill -USR1 -x hyprlock
+        ;;
+    stop)
+        [ -f "$pidfile" ] && kill "$(cat "$pidfile")" 2>/dev/null
+        rm -f "$pidfile"
+        ;;
+    *)
+        echo "Usage: $0 start|stop" >&2
+        exit 1
+        ;;
+esac
+exit 0

dotfiles/.config/hypr/scripts/Volume.sh

@@ -1,143 +1,37 @@
 #!/bin/bash
-# HyprFlux — https://github.com/ahmad9059/HyprFlux
+# Volume controls for audio and mic via wpctl (PipeWire).
-# Scripts for volume controls for audio and mic 
+# Quickshell's VolumeOsd watches PipeWire directly, so no notifications here.
 
-iDIR="$HOME/.config/swaync/icons"
+SINK="@DEFAULT_AUDIO_SINK@"
-sDIR="$HOME/.config/hypr/scripts"
+SOURCE="@DEFAULT_AUDIO_SOURCE@"
+STEP="5%"
 
-# Get Volume
+# Print volume as an integer percent, or "Muted"
 get_volume() {
-    volume=$(pamixer --get-volume)
+    local out
-    if [[ "$volume" -eq "0" ]]; then
+    out=$(wpctl get-volume "$1")
+    if [[ "$out" == *MUTED* ]]; then
         echo "Muted"
     else
-        echo "$volume %"
+        awk '{ printf "%d %%\n", $2 * 100 + 0.5 }' <<< "$out"
     fi
 }
 
-# Get icons
+is_muted() {
-get_icon() {
+    [[ "$(wpctl get-volume "$1")" == *MUTED* ]]
-    current=$(get_volume)
-    if [[ "$current" == "Muted" ]]; then
-        echo "$iDIR/volume-mute.png"
-    elif [[ "${current%\%}" -le 30 ]]; then
-        echo "$iDIR/volume-low.png"
-    elif [[ "${current%\%}" -le 60 ]]; then
-        echo "$iDIR/volume-mid.png"
-    else
-        echo "$iDIR/volume-high.png"
-    fi
 }
 
-# Notify
+# Raising/lowering while muted unmutes first, matching the old behaviour
-notify_user() {
+inc() { is_muted "$1" && wpctl set-mute "$1" 0 || wpctl set-volume -l 1.0 "$1" "$STEP+"; }
-    if [[ "$(get_volume)" == "Muted" ]]; then
+dec() { is_muted "$1" && wpctl set-mute "$1" 0 || wpctl set-volume "$1" "$STEP-"; }
-        notify-send -e -h string:x-canonical-private-synchronous:volume_notif -h boolean:SWAYNC_BYPASS_DND:true -u low -i "$(get_icon)" " Volume:" " Muted"
-    else
-        notify-send -e -h int:value:"$(get_volume | sed 's/%//')" -h string:x-canonical-private-synchronous:volume_notif -h boolean:SWAYNC_BYPASS_DND:true -u low -i "$(get_icon)" " Volume Level:" " $(get_volume)" &&
-        "$sDIR/Sounds.sh" --volume
-    fi
-}
 
-# Increase Volume
+case "$1" in
-inc_volume() {
+    --inc)        inc "$SINK" ;;
-    if [ "$(pamixer --get-mute)" == "true" ]; then
+    --dec)        dec "$SINK" ;;
-        toggle_mute
+    --toggle)     wpctl set-mute "$SINK" toggle ;;
-    else
+    --toggle-mic) wpctl set-mute "$SOURCE" toggle ;;
-        pamixer -i 5 --allow-boost --set-limit 150 && notify_user
+    --mic-inc)    inc "$SOURCE" ;;
-    fi
+    --mic-dec)    dec "$SOURCE" ;;
-}
+    --get-mic)    get_volume "$SOURCE" ;;
-
+    *)            get_volume "$SINK" ;;
-# Decrease Volume
+esac
-dec_volume() {
-    if [ "$(pamixer --get-mute)" == "true" ]; then
-        toggle_mute
-    else
-        pamixer -d 5 && notify_user
-    fi
-}
-
-# Toggle Mute
-toggle_mute() {
-	if [ "$(pamixer --get-mute)" == "false" ]; then
-		pamixer -m && notify-send -e -u low -h boolean:SWAYNC_BYPASS_DND:true -i "$iDIR/volume-mute.png" " Mute"
-	elif [ "$(pamixer --get-mute)" == "true" ]; then
-		pamixer -u && notify-send -e -u low -h boolean:SWAYNC_BYPASS_DND:true -i "$(get_icon)" " Volume:" " Switched ON"
-	fi
-}
-
-# Toggle Mic
-toggle_mic() {
-	if [ "$(pamixer --default-source --get-mute)" == "false" ]; then
-		pamixer --default-source -m && notify-send -e -u low -h boolean:SWAYNC_BYPASS_DND:true -i "$iDIR/microphone-mute.png" " Microphone:" " Switched OFF"
-	elif [ "$(pamixer --default-source --get-mute)" == "true" ]; then
-		pamixer -u --default-source u && notify-send -e -u low -h boolean:SWAYNC_BYPASS_DND:true -i "$iDIR/microphone.png" " Microphone:" " Switched ON"
-	fi
-}
-# Get Mic Icon
-get_mic_icon() {
-    current=$(pamixer --default-source --get-volume)
-    if [[ "$current" -eq "0" ]]; then
-        echo "$iDIR/microphone-mute.png"
-    else
-        echo "$iDIR/microphone.png"
-    fi
-}
-
-# Get Microphone Volume
-get_mic_volume() {
-    volume=$(pamixer --default-source --get-volume)
-    if [[ "$volume" -eq "0" ]]; then
-        echo "Muted"
-    else
-        echo "$volume %"
-    fi
-}
-
-# Notify for Microphone
-notify_mic_user() {
-    volume=$(get_mic_volume)
-    icon=$(get_mic_icon)
-    notify-send -e -h int:value:"$volume" -h "string:x-canonical-private-synchronous:volume_notif" -h boolean:SWAYNC_BYPASS_DND:true -u low -i "$icon"  " Mic Level:" " $volume"
-}
-
-# Increase MIC Volume
-inc_mic_volume() {
-    if [ "$(pamixer --default-source --get-mute)" == "true" ]; then
-        toggle_mic
-    else
-        pamixer --default-source -i 5 && notify_mic_user
-    fi
-}
-
-# Decrease MIC Volume
-dec_mic_volume() {
-    if [ "$(pamixer --default-source --get-mute)" == "true" ]; then
-        toggle-mic
-    else
-        pamixer --default-source -d 5 && notify_mic_user
-    fi
-}
-
-# Execute accordingly
-if [[ "$1" == "--get" ]]; then
-	get_volume
-elif [[ "$1" == "--inc" ]]; then
-	inc_volume
-elif [[ "$1" == "--dec" ]]; then
-	dec_volume
-elif [[ "$1" == "--toggle" ]]; then
-	toggle_mute
-elif [[ "$1" == "--toggle-mic" ]]; then
-	toggle_mic
-elif [[ "$1" == "--get-icon" ]]; then
-	get_icon
-elif [[ "$1" == "--get-mic-icon" ]]; then
-	get_mic_icon
-elif [[ "$1" == "--mic-inc" ]]; then
-	inc_mic_volume
-elif [[ "$1" == "--mic-dec" ]]; then
-	dec_mic_volume
-else
-	get_volume
-fi

dotfiles/.config/orbit/theme.toml

@@ -1,5 +0,0 @@
-accent_primary = "#007acc"
-accent_secondary = "#06b6d4"
-background = "#1e1e1e"
-foreground = "#d4d4d8"
-opacity = 0.91

dotfiles/.config/quickshell/assets/sunshine.svg

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Sunshine_Logo" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px"
+	 y="0px" width="256px" height="256px" viewBox="10 6 236 245" style="enable-background:new 0 0 256 256;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:#FDD107;}
+	.st1{fill:#F89A1C;}
+	.st2{fill:#EF3E23;}
+	.st3{fill:#F26222;}
+</style>
+<path class="st0" d="M118.7688675,20.7120476c0,0-63.8333359,26-74.3333359,83.8333282s37.1666718,91.5,86.3333282,75.3333282
+	s70.3333435-51,81.8333435-86.9999924c0,0-9.3333435,100.4999924-96.1666718,115.4999924s-118.1666641-50-82.1666641-119.8333282
+	C44.2688675,67.0453796,80.5188675,29.6287155,118.7688675,20.7120476z"/>
+<path class="st1" d="M118.7688675,20.7120476c0,0-41.125,3.6666679-83.25,61.0416679s-28.125,139.125,34.25,149.375
+	s115.8749924-44.875,133.5-82.375s15.1666718-61.4583282,9.75-77.8749924c0,0,0.6666718,36.4166641-13.3333282,59.6666641
+	s-29.75,46.3333282-65.0833282,62.1666718s-74.1666718,13.75-95.4166718-19.25s-5.9166641-76.0833359-0.2916641-85.3333359
+	S72.3938675,33.7953796,118.7688675,20.7120476z"/>
+<path class="st2" d="M73.0188675,39.6287155c0,0,38.125-28.125,76.8749924-28.125s63,28.25,68.5,52.25s6,54.125-11.5,87.6249924
+	s-37.375,56-79.1249924,76.125s-84.625,2.75-84.625,2.75s25.9769745,25.8750153,71.0509872,16.5
+	c45.0740051-9.375,82.2406769-40.875,98.4073486-69.5s28.7916565-57.3749924,27.6666565-92.2499924s-23.75-54.5-31.25-60.25
+	s-23.1875-17.8125-58.1875-16.5625S86.4563675,29.8162155,73.0188675,39.6287155z"/>
+<path class="st3" d="M73.0188675,39.6287155c0,0,35-32.8125,82.4374924-32.8125s69.1875,24.8125,78.875,44.6875
+	s21.8125,70-12.1875,122.9999924s-74.625,67.375-93.625,71.625s-42.4311447,4.269165-59.1114044-1.2299957
+	c0,0,35.1947479,8.3966675,66.7780762-7.4366608s51.6666718-32.1666718,74.0833282-68.8333435
+	s25.9166718-72.7499924,22.1666718-93.9166565s-12.1666718-42.4166718-36.5-56.3333359s-56.7291718-10.531251-74.4791641-4.531251
+	S91.9876175,26.4099655,73.0188675,39.6287155z"/>
+</svg>

dotfiles/.config/quickshell/config/Appearance.qml

@@ -4,6 +4,10 @@ import QtQuick
 QtObject {
     readonly property string fontFamily: "CaskaydiaCove Nerd Font Mono"
     readonly property string iconFontFamily: "Material Symbols Outlined"
+    // Same glyph set, softer/rounded terminals — used where a module wants
+    // a visually distinct icon style from the rest of the bar (currently
+    // just BluetoothIndicator.qml) without switching every icon over.
+    readonly property string iconFontFamilyRounded: "Material Symbols Rounded"
     // Material Symbols is a variable font. Left unset, glyphs fall back to the
     // font's default optical size (24px), which is tuned for larger rendering
     // and makes some icons (e.g. "lock") look heavier/bigger than others when

dotfiles/.config/quickshell/config/SystemUpdates.qml

@@ -0,0 +1,72 @@
+pragma Singleton
+import QtQuick
+import Quickshell.Io
+
+// Shared state for SystemUpdate.qml, the bar's package-update indicator.
+// Bar.qml is instantiated once per screen (see shell.qml's Variants), so
+// without this being a singleton, plugging in extra monitors would mean
+// running `checkupdates` that many times in parallel on every poll — which
+// isn't just wasteful, it's actively unreliable: concurrent invocations
+// race over checkupdates' own sync directory and can intermittently report
+// 0 pending updates. One shared Process here means exactly one `checkupdates`
+// run at a time, and every bar's icon reflects the same result.
+QtObject {
+    id: root
+
+    // checkupdates syncs a throwaway copy of the pacman db, so it's not
+    // free to run often — matches the old waybar custom/updater module's
+    // ~21.7 minute poll interval (see .config/waybar/config).
+    readonly property int refreshIntervalMs: 1300 * 1000
+
+    property int updateCount: 0
+    property bool checking: false
+    property bool updating: false
+
+    function refresh() {
+        if (_checkProc.running) return
+        root.checking = true
+        _checkProc.running = true
+    }
+
+    // scriptPath: absolute path to update-system.sh (resolved by the caller
+    // via Quickshell.shellPath, which isn't available as a plain import
+    // here without pulling in the whole Quickshell singleton for one call).
+    function runUpdate(scriptPath) {
+        if (_updateProc.running) return
+        root.updating = true
+        _updateProc.command = [scriptPath]
+        _updateProc.running = true
+    }
+
+    // QtObject has no default property, so these are attached via property
+    // assignment rather than as plain child elements (same as Colors.qml's
+    // FileView).
+    readonly property Process _checkProc: Process {
+        command: ["sh", "-c", "checkupdates 2>/dev/null | wc -l"]
+        stdout: StdioCollector {
+            id: checkCollector
+            onStreamFinished: {
+                root.updateCount = parseInt(checkCollector.text.trim(), 10) || 0
+                root.checking = false
+            }
+        }
+    }
+
+    // Runs update-system.sh, which opens its own terminal and blocks until
+    // that terminal is closed — so this only exits once the user's actually
+    // done updating, which is exactly when a re-check matters.
+    readonly property Process _updateProc: Process {
+        onExited: {
+            root.updating = false
+            root.refresh()
+        }
+    }
+
+    readonly property Timer _timer: Timer {
+        interval: root.refreshIntervalMs
+        running: true
+        repeat: true
+        triggeredOnStart: true
+        onTriggered: root.refresh()
+    }
+}

dotfiles/.config/quickshell/config/VpnExclusivity.qml

@@ -1,16 +1,17 @@
 pragma Singleton
 import QtQuick
 
-// Tailscale, Mullvad, and ProtonVPN all fight over the default route/DNS if
+// Tailscale, Mullvad, ProtonVPN, and the home UniFi WireGuard tunnel all
-// more than one is active at once (see VpnIndicator.qml's header comment) —
+// fight over the default route/DNS if more than one is active at once (see
-// only one of the three should ever actually be connected. This singleton
+// VpnIndicator.qml's header comment) — only one should ever actually be
-// is the shared signal between the two widget files: VpnIndicator.qml
+// connected. This singleton is the shared signal between the two widget
-// writes Mullvad/ProtonVPN's live connection state here as it polls them;
+// files: VpnIndicator.qml writes each tunnel's live connection state here
-// TailscaleIndicator.qml reads it to back off (`tailscale down`) rather
+// as it polls them; TailscaleIndicator.qml reads it to back off (`tailscale
-// than stay up alongside either one, and to refuse turning Tailscale back
+// down`) rather than stay up alongside one, and to refuse turning Tailscale
-// on while one is still connected.
+// back on while one is still connected.
 QtObject {
     property bool mullvadConnected: false
     property bool protonConnected: false
-    readonly property bool commercialVpnActive: mullvadConnected || protonConnected
+    property bool homeWgConnected: false
+    readonly property bool commercialVpnActive: mullvadConnected || protonConnected || homeWgConnected
 }

dotfiles/.config/quickshell/config/WeatherData.qml

@@ -0,0 +1,242 @@
+pragma Singleton
+import QtQuick
+import Quickshell
+import Quickshell.Io
+
+// Live weather for the bar's Weather.qml icon. A singleton for the same
+// reason as SystemUpdates.qml: Bar.qml is instantiated once per monitor
+// (shell.qml's Variants), so without this being shared, every extra screen
+// would mean another set of network requests running in parallel.
+//
+// Location is auto-detected from the public IP (via ipwho.is, no API key)
+// and cached to disk (~/.cache/quickshell/weather-location.json) so it's
+// only ever looked up once, not on every quickshell restart — IP-geolocation
+// free tiers rate-limit fast, and a desktop's location barely ever changes
+// anyway. Only the weather itself re-polls on a timer. Conditions come from
+// Open-Meteo (api.open-meteo.com) — also free and keyless, and it does its
+// own °C/km-h conversion server-side via query params.
+//
+// Loosely modeled on omarchy's weather panel
+// (github.com/omacom/omarchy, quattro branch,
+// shell/plugins/panels/weather/Model.js) for the WMO weather-code
+// grouping, but the icons are this bar's own Material Symbols glyphs
+// rather than pulling in a separate icon font just for this.
+QtObject {
+    id: root
+
+    // Location barely ever changes for a desktop machine, so it's fetched
+    // once (and cached); the weather itself is worth re-checking
+    // periodically.
+    readonly property int refreshIntervalMs: 15 * 60 * 1000
+
+    property bool locating: true
+    property bool loading: false
+    property bool hasLocation: false
+    property string locationName: ""
+
+    property real latitude: 0
+    property real longitude: 0
+
+    function saveLocation() {
+        _locationCache.setText(JSON.stringify({
+            latitude: root.latitude,
+            longitude: root.longitude,
+            name: root.locationName
+        }))
+    }
+
+    // Called from Weather.qml's search box once you pick a result — always
+    // wins over whatever IP-based guess was cached before, and persists so
+    // it sticks across restarts.
+    function selectLocation(name, lat, lon) {
+        root.latitude = lat
+        root.longitude = lon
+        root.locationName = name
+        root.hasLocation = true
+        root.locating = false
+        root.saveLocation()
+        root.refresh()
+    }
+
+    property bool searching: false
+    property var searchResults: []
+
+    function search(query) {
+        const q = String(query || "").trim()
+        if (q.length < 2) {
+            root.searchResults = []
+            return
+        }
+        root.searching = true
+        _searchProc.command = ["curl", "-s", "--max-time", "6",
+            "https://geocoding-api.open-meteo.com/v1/search?count=5&language=en&format=json&name=" + encodeURIComponent(q)]
+        _searchProc.running = true
+    }
+
+    property real tempC: 0
+    property real feelsLikeC: 0
+    property int humidity: 0
+    property real windKmh: 0
+    property int weatherCode: 0
+    property bool isDay: true
+
+    // [{date, code, maxC, minC}] — tomorrow onward; today is already
+    // covered by the current-conditions fields above.
+    property var forecast: []
+
+    function locate() {
+        if (_locateProc.running) return
+        root.locating = true
+        _locateProc.running = true
+    }
+
+    function refresh() {
+        if (!root.hasLocation || _weatherProc.running) return
+        root.loading = true
+        _weatherProc.command = ["curl", "-s", "--max-time", "8",
+            "https://api.open-meteo.com/v1/forecast?latitude=" + root.latitude
+            + "&longitude=" + root.longitude
+            + "&current=temperature_2m,apparent_temperature,relative_humidity_2m,weather_code,is_day,wind_speed_10m"
+            + "&daily=weather_code,temperature_2m_max,temperature_2m_min"
+            + "&temperature_unit=celsius&wind_speed_unit=kmh&timezone=auto&forecast_days=4"]
+        _weatherProc.running = true
+    }
+
+    // Material Symbols Rounded glyph for a WMO weather code (see
+    // https://open-meteo.com/en/docs#weathervariables), grouped the same
+    // way omarchy's Model.js groups them into its own icon set.
+    function iconFor(code, day) {
+        if (code === 0) return day ? "sunny" : "clear_night"
+        if (code === 1 || code === 2) return day ? "partly_cloudy_day" : "partly_cloudy_night"
+        if (code === 3) return "cloud"
+        if (code === 45 || code === 48) return "foggy"
+        if ([51, 53, 55, 56, 57, 61, 63, 65, 66, 67, 80, 81, 82].indexOf(code) !== -1) return "rainy"
+        if ([71, 73, 75, 77, 85, 86].indexOf(code) !== -1) return "weather_snowy"
+        if (code === 95 || code === 96 || code === 99) return "thunderstorm"
+        return "cloud"
+    }
+
+    // QtObject has no default property, so these are attached via property
+    // assignment rather than as plain child elements (same as Colors.qml's
+    // FileView and SystemUpdates.qml's Process/Timer).
+
+    // Read once at startup; onLoaded/onLoadFailed (below) decide whether a
+    // network lookup is still needed.
+    readonly property FileView _locationCache: FileView {
+        path: Quickshell.env("HOME") + "/.cache/quickshell/weather-location.json"
+        onLoaded: {
+            try {
+                const data = JSON.parse(text())
+                const lat = parseFloat(data.latitude)
+                const lon = parseFloat(data.longitude)
+                if (!isNaN(lat) && !isNaN(lon)) {
+                    root.latitude = lat
+                    root.longitude = lon
+                    root.locationName = data.name || ""
+                    root.hasLocation = true
+                    root.locating = false
+                    root.refresh()
+                    return
+                }
+            } catch (e) {
+                // fall through to a fresh lookup below
+            }
+            root.locate()
+        }
+        onLoadFailed: root.locate()
+    }
+
+    readonly property Process _locateProc: Process {
+        command: ["curl", "-s", "--max-time", "6", "https://ipwho.is/"]
+        stdout: StdioCollector {
+            id: locateCollector
+            onStreamFinished: {
+                try {
+                    const data = JSON.parse(locateCollector.text)
+                    const lat = parseFloat(data.latitude)
+                    const lon = parseFloat(data.longitude)
+                    root.hasLocation = data.success !== false && !isNaN(lat) && !isNaN(lon)
+                    if (root.hasLocation) {
+                        root.latitude = lat
+                        root.longitude = lon
+                        root.locationName = data.city || data.region || data.country || ""
+                        root.saveLocation()
+                    }
+                } catch (e) {
+                    console.warn("Weather: locate parse failed:", e)
+                    root.hasLocation = false
+                }
+                root.locating = false
+                if (root.hasLocation) root.refresh()
+            }
+        }
+    }
+
+    readonly property Process _weatherProc: Process {
+        stdout: StdioCollector {
+            id: weatherCollector
+            onStreamFinished: {
+                try {
+                    const data = JSON.parse(weatherCollector.text)
+                    const current = data.current || {}
+                    root.tempC = current.temperature_2m
+                    root.feelsLikeC = current.apparent_temperature
+                    root.humidity = current.relative_humidity_2m
+                    root.windKmh = current.wind_speed_10m
+                    root.weatherCode = current.weather_code
+                    root.isDay = current.is_day === 1
+
+                    const daily = data.daily || {}
+                    const times = daily.time || []
+                    const days = []
+                    // Start at 1 — index 0 is today, already shown as the
+                    // current conditions above; this is "what's coming".
+                    for (let i = 1; i < times.length && days.length < 3; i++) {
+                        days.push({
+                            date: times[i],
+                            code: (daily.weather_code || [])[i],
+                            maxC: (daily.temperature_2m_max || [])[i],
+                            minC: (daily.temperature_2m_min || [])[i]
+                        })
+                    }
+                    root.forecast = days
+                } catch (e) {
+                    console.warn("Weather: failed to parse Open-Meteo response:", e)
+                }
+                root.loading = false
+            }
+        }
+    }
+
+    readonly property Process _searchProc: Process {
+        stdout: StdioCollector {
+            id: searchCollector
+            onStreamFinished: {
+                try {
+                    const data = JSON.parse(searchCollector.text)
+                    const results = data.results || []
+                    root.searchResults = results.filter(function(r) {
+                        return r && r.name && r.latitude !== undefined && r.longitude !== undefined
+                    }).map(function(r) {
+                        return {
+                            name: r.name,
+                            description: [r.admin1, r.country].filter(function(p) { return !!p }).join(", "),
+                            latitude: r.latitude,
+                            longitude: r.longitude
+                        }
+                    })
+                } catch (e) {
+                    root.searchResults = []
+                }
+                root.searching = false
+            }
+        }
+    }
+
+    readonly property Timer _timer: Timer {
+        interval: root.refreshIntervalMs
+        running: true
+        repeat: true
+        onTriggered: root.refresh()
+    }
+}

dotfiles/.config/quickshell/config/qmldir

@@ -2,3 +2,5 @@ module config
 singleton Colors 1.0 Colors.qml
 singleton Appearance 1.0 Appearance.qml
 singleton VpnExclusivity 1.0 VpnExclusivity.qml
+singleton SystemUpdates 1.0 SystemUpdates.qml
+singleton WeatherData 1.0 WeatherData.qml

dotfiles/.config/quickshell/modules/bar/Bar.qml

@@ -35,8 +35,12 @@ PanelWindow {
         ActiveWindow {}
     }
 
-    Clock {
+    RowLayout {
         anchors.centerIn: parent
+        spacing: Appearance.spacing
+        Weather { barWindow: bar }
+        Clock {}
+        SystemUpdate { barWindow: bar }
     }
 
     RowLayout {
@@ -46,12 +50,13 @@ PanelWindow {
             rightMargin: Appearance.spacing
         }
         spacing: Appearance.spacing
-        //Tray {}
+        PinnedTray {}
         TailscaleIndicator { barWindow: bar }
         VpnIndicator { barWindow: bar }
         NetworkIndicator { barWindow: bar }
         BluetoothIndicator { barWindow: bar }
         Volume { barWindow: bar }
+        BatteryIndicator { barWindow: bar }
         PowerButton { barWindow: bar }
     }
 }

dotfiles/.config/quickshell/modules/bar/BatteryIndicator.qml

@@ -0,0 +1,605 @@
+import QtQuick
+import QtQuick.Layouts
+import Quickshell
+import Quickshell.Hyprland
+import Quickshell.Io
+import Quickshell.Services.UPower
+import "../../config"
+
+// Battery + power-profile panel, ported from omarchy's power panel
+// (github.com/basecamp/omarchy shell/plugins/panels/power/{Model.js,Panel.qml})
+// onto this project's own conventions: Quickshell's native UPower/PowerProfiles
+// bindings instead of omarchy's `omarchy-battery-status` /
+// `omarchy-powerprofiles-list` / `omarchy-powerprofiles-set` helper scripts
+// (which don't exist outside omarchy), and Material Symbols glyphs instead of
+// Nerd Font ones. The charge-threshold ("Holding"/limited-charge) concept from
+// the original is hardware-specific (vendor charge-limit sysfs knobs) and has
+// no equivalent in Quickshell's UPower binding, so it's dropped rather than
+// guessed at; "Battery health" (computed from sysfs energy_full/design) is shown in its
+// place, using data UPower actually reports.
+Item {
+    id: root
+
+    readonly property var device: UPower.displayDevice
+    // isLaptopBattery (type === Battery && powerSupply === true) is the
+    // Quickshell-recommended check for "is this actually a battery" — more
+    // precise than isPresent, which the docs note is only meaningful once
+    // you already know the device is of Battery type.
+    readonly property bool batteryPresent: !!(root.device && root.device.ready && root.device.isLaptopBattery)
+
+    // Hidden entirely on a desktop with no battery — RowLayout skips
+    // invisible children for both sizing and spacing, so this just vanishes
+    // from the bar rather than leaving a gap.
+    visible: root.batteryPresent
+    implicitWidth: root.batteryPresent ? label.implicitWidth : 0
+    implicitHeight: Appearance.barHeight
+
+    // The bar's own PanelWindow — passed in from Bar.qml so this popup can
+    // anchor to the bar itself rather than to this icon, keeping it a fixed
+    // distance from the bar and the screen edge regardless of where this
+    // icon sits in the row.
+    required property var barWindow
+
+    readonly property bool onBattery: UPower.onBattery
+    // Named deviceState, not "state" — Item already has a built-in `state`
+    // property (the property-based state-machine one) that this would
+    // otherwise collide with.
+    readonly property int deviceState: root.batteryPresent ? root.device.state : UPowerDeviceState.Unknown
+    readonly property bool fullyCharged: root.deviceState === UPowerDeviceState.FullyCharged
+    readonly property bool charging: root.batteryPresent && !root.onBattery && !root.fullyCharged
+    // device.percentage is a 0..1 fraction despite the name (same convention
+    // Volume.qml relies on for Pipewire's audio.volume).
+    readonly property real fraction: root.batteryPresent ? Math.max(0, Math.min(1, root.device.percentage)) : 0
+    readonly property bool low: root.batteryPresent && root.fraction <= 0.15 && !root.charging
+
+    // Quickshell's UPower binding has no charge-cycle property (see the
+    // file-header comment on why the old charge-until threshold was
+    // dropped) — it comes straight from sysfs instead.
+    //
+    // device.nativePath turned out to be empty on real hardware (tested
+    // live), so rather than build a path from it, a shell glob finds
+    // whichever BAT* directory actually exists — same shell-out-to-a-CLI
+    // convention TailscaleIndicator.qml uses for its own live stats.
+    // This barely changes during a session, so one read at startup is
+    // enough; no polling timer.
+    property int cycleCount: -1
+
+    Process {
+        id: cycleCountProc
+        command: ["sh", "-c", "cat \"$(ls -d /sys/class/power_supply/BAT* 2>/dev/null | head -n1)/cycle_count\" 2>/dev/null"]
+        running: root.batteryPresent
+        stdout: StdioCollector {
+            id: cycleCountCollector
+            onStreamFinished: {
+                const n = parseInt(cycleCountCollector.text.trim(), 10)
+                root.cycleCount = (isNaN(n) || n <= 0) ? -1 : n
+            }
+        }
+    }
+
+    // device.healthPercentage/healthSupported come from upowerd over D-Bus,
+    // and upowerd has been observed reporting energy-full as a flat 0 (a
+    // live daemon glitch, `upower -i` shows it too) while sysfs still has
+    // the real numbers underneath — same class of unreliability that put
+    // cycle_count on sysfs above instead of trusting upowerd's own
+    // charge-cycles field. Health is computed the same way UPower computes
+    // it (current full-charge capacity over the battery's original design
+    // capacity), just read directly so a daemon hiccup doesn't blank it.
+    property real energyFullWh: -1
+    property real energyFullDesignWh: -1
+    readonly property real healthPercent: (root.energyFullWh > 0 && root.energyFullDesignWh > 0)
+        ? Math.min(100, (root.energyFullWh / root.energyFullDesignWh) * 100) : -1
+
+    Process {
+        id: energyFullProc
+        command: ["sh", "-c", "cat \"$(ls -d /sys/class/power_supply/BAT* 2>/dev/null | head -n1)/energy_full\" 2>/dev/null"]
+        running: root.batteryPresent
+        stdout: StdioCollector {
+            id: energyFullCollector
+            onStreamFinished: {
+                const n = parseFloat(energyFullCollector.text.trim())
+                root.energyFullWh = (isNaN(n) || n <= 0) ? -1 : (n / 1000000)
+            }
+        }
+    }
+
+    Process {
+        id: energyFullDesignProc
+        command: ["sh", "-c", "cat \"$(ls -d /sys/class/power_supply/BAT* 2>/dev/null | head -n1)/energy_full_design\" 2>/dev/null"]
+        running: root.batteryPresent
+        stdout: StdioCollector {
+            id: energyFullDesignCollector
+            onStreamFinished: {
+                const n = parseFloat(energyFullDesignCollector.text.trim())
+                root.energyFullDesignWh = (isNaN(n) || n <= 0) ? -1 : (n / 1000000)
+            }
+        }
+    }
+
+    // device.timeToFull/timeToEmpty are computed by Quickshell from
+    // energy/energyCapacity/changeRate — when upowerd's EnergyFull glitches
+    // to 0 (the same daemon flake HEALTH routes around above), that formula
+    // divides by a bogus capacity and comes out negative rather than a
+    // real estimate (confirmed live: timeToFull sat at -3751 while `upower
+    // -i` itself still reported a normal 26.7 minutes). This recomputes
+    // the same estimate straight from sysfs as a fallback, only used when
+    // Quickshell's own value isn't positive. Unlike cycle_count/design
+    // capacity above, energy_now and power_now change continuously while
+    // (dis)charging, so this polls on a timer instead of reading once.
+    property real sysfsEnergyNowWh: -1
+    property real sysfsPowerNowW: -1
+
+    readonly property real fallbackTimeToFullSeconds: (root.sysfsPowerNowW > 0 && root.energyFullWh > 0 && root.sysfsEnergyNowWh >= 0)
+        ? Math.max(0, (root.energyFullWh - root.sysfsEnergyNowWh) / root.sysfsPowerNowW * 3600) : -1
+    readonly property real fallbackTimeToEmptySeconds: (root.sysfsPowerNowW > 0 && root.sysfsEnergyNowWh > 0)
+        ? (root.sysfsEnergyNowWh / root.sysfsPowerNowW * 3600) : -1
+
+    // Prefers upowerd's own live estimate when it's sane; only falls back
+    // to the sysfs-computed one when upowerd's has gone zero/negative.
+    readonly property real timeRemainingSeconds: {
+        const primary = root.onBattery ? root.device.timeToEmpty : root.device.timeToFull
+        if (primary > 0) return primary
+        return root.onBattery ? root.fallbackTimeToEmptySeconds : root.fallbackTimeToFullSeconds
+    }
+
+    Timer {
+        id: sysfsRateTimer
+        interval: 15000
+        repeat: true
+        running: root.batteryPresent
+        triggeredOnStart: true
+        onTriggered: {
+            if (!sysfsEnergyNowProc.running) sysfsEnergyNowProc.running = true
+            if (!sysfsPowerNowProc.running) sysfsPowerNowProc.running = true
+        }
+    }
+
+    Process {
+        id: sysfsEnergyNowProc
+        command: ["sh", "-c", "cat \"$(ls -d /sys/class/power_supply/BAT* 2>/dev/null | head -n1)/energy_now\" 2>/dev/null"]
+        stdout: StdioCollector {
+            id: sysfsEnergyNowCollector
+            onStreamFinished: {
+                const n = parseFloat(sysfsEnergyNowCollector.text.trim())
+                root.sysfsEnergyNowWh = (isNaN(n) || n < 0) ? -1 : (n / 1000000)
+            }
+        }
+    }
+
+    Process {
+        id: sysfsPowerNowProc
+        command: ["sh", "-c", "cat \"$(ls -d /sys/class/power_supply/BAT* 2>/dev/null | head -n1)/power_now\" 2>/dev/null"]
+        stdout: StdioCollector {
+            id: sysfsPowerNowCollector
+            onStreamFinished: {
+                const n = parseFloat(sysfsPowerNowCollector.text.trim())
+                root.sysfsPowerNowW = (isNaN(n) || n <= 0) ? -1 : (n / 1000000)
+            }
+        }
+    }
+
+    // Raw UPower state string (Charging/Discharging/PendingCharge/…) — more
+    // granular than modeLabel below, which collapses those down to the
+    // three phrases the hero text and STATE row show.
+    readonly property string rawStateLabel: root.batteryPresent
+        ? UPowerDeviceState.toString(root.deviceState) : "—"
+
+    // Material Symbols' charging glyphs aren't an evenly-spaced "_bar"
+    // scale like the non-charging ones below — they're fixed at these
+    // seven breakpoints (confirmed against the installed font's ligature
+    // table), so this picks the highest one at or below the current
+    // percentage rather than rounding to an index.
+    function chargingIcon(fraction) {
+        const percent = fraction * 100
+        const thresholds = [20, 30, 50, 60, 80, 90, 100]
+        const icons = [
+            "battery_charging_20", "battery_charging_30", "battery_charging_50", "battery_charging_60",
+            "battery_charging_80", "battery_charging_90", "battery_charging_full"
+        ]
+        for (let i = thresholds.length - 1; i >= 0; i--) {
+            if (percent >= thresholds[i]) return icons[i]
+        }
+        // Below 20% there's no lower charging glyph — it's still the
+        // truthful floor of what's available while current is flowing in.
+        return icons[0]
+    }
+
+    function batteryIcon() {
+        if (!root.batteryPresent) return "battery_unknown"
+        if (root.fullyCharged) return "battery_full"
+        if (root.charging) return root.chargingIcon(root.fraction)
+        if (root.fraction <= 0.1) return "battery_alert"
+        const bars = ["battery_0_bar", "battery_1_bar", "battery_2_bar", "battery_3_bar", "battery_4_bar", "battery_5_bar", "battery_full"]
+        return bars[Math.max(0, Math.min(bars.length - 1, Math.round(root.fraction * (bars.length - 1))))]
+    }
+
+    function formatDuration(seconds) {
+        const s = Math.max(0, Math.round(seconds || 0))
+        if (s <= 0) return "—"
+        const h = Math.floor(s / 3600)
+        const m = Math.round((s % 3600) / 60)
+        return h > 0 ? (h + "h " + m + "m") : (m + "m")
+    }
+
+    readonly property string modeLabel: {
+        if (!root.batteryPresent) return ""
+        if (root.fullyCharged) return "Fully charged"
+        return root.onBattery ? "On battery" : "Charging"
+    }
+
+    // Info grid rows — same shape as NetworkIndicator.qml's statRows/
+    // statCells: a flat label/value list, flattened again into individual
+    // grid cells (label, value, label, value, …) so a 4-column GridLayout
+    // lays them out as two label/value pairs per row.
+    readonly property var statRows: [
+        {
+            label: "HEALTH",
+            value: root.healthPercent > 0 ? Math.round(root.healthPercent) + "%" : "—"
+        },
+        {
+            label: root.onBattery ? "TIME LEFT" : "TIME TO FULL",
+            value: root.batteryPresent ? root.formatDuration(root.timeRemainingSeconds) : "—"
+        },
+        { label: "STATUS", value: root.rawStateLabel },
+        { label: "CYCLES", value: root.cycleCount > 0 ? String(root.cycleCount) : "—" }
+    ]
+
+    readonly property var statCells: {
+        const cells = []
+        for (let i = 0; i < root.statRows.length; i++) {
+            cells.push({ text: root.statRows[i].label, isLabel: true })
+            cells.push({ text: root.statRows[i].value, isLabel: false })
+        }
+        return cells
+    }
+
+    // Cute rotating status phrases while current is actually flowing —
+    // ported as-is from omarchy's power panel, which pairs the same phrase
+    // sets with the same charging/on-battery states.
+    readonly property var chargingPhrases: [
+        "Pumping power", "Injecting electrons", "Pouring juice", "Amassing watts",
+        "Hoarding joules", "Sucking volts", "Topping reserves", "Soaking amps", "Inhaling kilowatts"
+    ]
+    readonly property var onBatteryPhrases: [
+        "Slurping power", "Spending joules", "Draining watts", "Burning electrons",
+        "Sipping juice", "Spending coulombs", "Bleeding amps", "Guzzling volts", "Munching reserves"
+    ]
+    readonly property var activePhrases: root.fullyCharged ? []
+        : (root.charging ? root.chargingPhrases : (root.onBattery ? root.onBatteryPhrases : []))
+    readonly property bool rotatingPhrases: root.activePhrases.length > 0
+    property int phraseIndex: 0
+    readonly property string heroStatusText: root.rotatingPhrases
+        ? root.activePhrases[root.phraseIndex % root.activePhrases.length]
+        : root.modeLabel
+
+    // Only rotates while the panel is open and actually charging/discharging.
+    Timer {
+        id: phraseTimer
+        interval: 2800
+        running: panel.visible && root.rotatingPhrases
+        repeat: true
+        triggeredOnStart: false
+        onTriggered: phraseSwap.restart()
+    }
+
+    SequentialAnimation {
+        id: phraseSwap
+        PropertyAnimation { target: heroStatus; property: "opacity"; to: 0.0; duration: 180; easing.type: Easing.OutQuad }
+        ScriptAction {
+            script: {
+                const n = root.activePhrases.length
+                if (n > 0) root.phraseIndex = (root.phraseIndex + 1) % n
+            }
+        }
+        PropertyAnimation { target: heroStatus; property: "opacity"; to: 1.0; duration: 260; easing.type: Easing.InQuad }
+    }
+
+    // If we leave a rotating state mid-swap (e.g. unplugged mid-fade),
+    // snap back to full opacity so the new state reads immediately.
+    Connections {
+        target: root
+        function onRotatingPhrasesChanged() {
+            if (!root.rotatingPhrases) {
+                phraseSwap.stop()
+                heroStatus.opacity = 1.0
+            }
+        }
+    }
+
+    // --- Power profile list ------------------------------------------------
+    // power-profiles-daemon only ever exposes these three fixed profiles;
+    // Performance is conditional on hasPerformanceProfile (e.g. absent on
+    // battery-only/thermally-limited hardware) — same gating omarchy's own
+    // Model.js applies via its profile-list script.
+    readonly property var profileEntries: {
+        const entries = [
+            { value: PowerProfile.PowerSaver, label: "Saver", icon: "eco" },
+            { value: PowerProfile.Balanced, label: "Balanced", icon: "balance" }
+        ]
+        if (PowerProfiles.hasPerformanceProfile)
+            entries.push({ value: PowerProfile.Performance, label: "Performance", icon: "bolt" })
+        return entries
+    }
+
+    // --- Automatic power profile --------------------------------------
+    // Battery-state-driven, on top of the manual picker above: below 20%
+    // → Power Saver (protect what's left), plugged in → Performance,
+    // unplugged and healthy → Balanced. Low battery wins even if a weak
+    // charger is still plugged in — running low is the more urgent signal.
+    // Performance only gets requested when the daemon actually reports it
+    // as available, falling back to Balanced instead of erroring on
+    // hardware without a performance profile (e.g. the ERROR this exact
+    // widget hit before power-profiles-daemon was installed).
+    //
+    // This only ever writes when the *target* changes (crossing the 20%
+    // line, plugging/unplugging) rather than on every poll, so a manual
+    // pick from the buttons above still sticks until the next real
+    // transition instead of being fought immediately.
+    readonly property int desiredProfile: {
+        if (root.fraction <= 0.20) return PowerProfile.PowerSaver
+        if (!root.onBattery) return PowerProfiles.hasPerformanceProfile ? PowerProfile.Performance : PowerProfile.Balanced
+        return PowerProfile.Balanced
+    }
+
+    function applyDesiredProfile() {
+        if (!root.batteryPresent) return
+        if (PowerProfiles.profile !== root.desiredProfile) PowerProfiles.profile = root.desiredProfile
+    }
+
+    onDesiredProfileChanged: root.applyDesiredProfile()
+    Component.onCompleted: Qt.callLater(root.applyDesiredProfile)
+
+    Text {
+        id: label
+        anchors.centerIn: parent
+        font.family: Appearance.iconFontFamilyRounded
+        font.variableAxes: Appearance.iconFontAxes
+        font.pixelSize: 16
+        color: root.low ? Colors.urgent : Colors.foreground
+        text: root.batteryIcon()
+    }
+
+    MouseArea {
+        anchors.fill: parent
+        cursorShape: Qt.PointingHandCursor
+        onClicked: {
+            panel.visible = !panel.visible
+            grab.active = panel.visible
+        }
+    }
+
+    // --- Reusable pieces -----------------------------------------------
+
+    component ProfileButton: Rectangle {
+        id: profBtn
+        required property string label
+        required property string icon
+        required property bool active
+        signal activate()
+        width: parent ? parent.width : 0
+        radius: 0
+        implicitHeight: 44
+        color: mouse.containsMouse ? Colors.primary
+             : (profBtn.active ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18) : "transparent")
+
+        // Hover-only outline, offset outside the button rather than drawn on
+        // its own edge — same treatment as this project's other selectable
+        // rows (e.g. Volume.qml's DeviceRow).
+        Rectangle {
+            anchors.fill: parent
+            anchors.margins: -3
+            radius: 0
+            color: "transparent"
+            border.color: Colors.foreground
+            border.width: mouse.containsMouse ? 1 : 0
+        }
+
+        Column {
+            anchors.centerIn: parent
+            spacing: 2
+            Text {
+                anchors.horizontalCenter: parent.horizontalCenter
+                text: profBtn.icon
+                font.family: Appearance.iconFontFamilyRounded
+                font.variableAxes: Appearance.iconFontAxes
+                font.pixelSize: 18
+                color: mouse.containsMouse ? Colors.primaryText : Colors.foreground
+            }
+            Text {
+                anchors.horizontalCenter: parent.horizontalCenter
+                text: profBtn.label
+                font.family: Appearance.fontFamily
+                font.pixelSize: Appearance.fontSizeSmall
+                font.bold: profBtn.active
+                color: mouse.containsMouse ? Colors.primaryText : Colors.foreground
+            }
+        }
+
+        MouseArea {
+            id: mouse
+            anchors.fill: parent
+            hoverEnabled: true
+            cursorShape: Qt.PointingHandCursor
+            onClicked: profBtn.activate()
+        }
+    }
+
+    // --- Panel -----------------------------------------------------------
+
+    PopupWindow {
+        id: panel
+        visible: false
+        color: "transparent"
+        // Wider than before (244) to give the 2-column info grid's
+        // label/value pairs enough room per half without eliding —
+        // same reasoning as NetworkIndicator.qml's own wider panel.
+        readonly property int contentWidth: 280
+        readonly property int contentPadding: 16
+        implicitWidth: contentWidth + contentPadding * 2
+        implicitHeight: mainColumn.implicitHeight + contentPadding * 2
+
+        anchor {
+            window: root.barWindow
+            // Unlike anchor.item, anchor.window doesn't default rect to the
+            // window's own bounds — set it explicitly so edges/gravity below
+            // resolve against the full bar (and thus the true screen edges)
+            // instead of a near-zero rect at the window's origin.
+            rect.x: 0
+            rect.y: 0
+            rect.width: root.barWindow.width
+            rect.height: root.barWindow.height
+            edges: Edges.Bottom | Edges.Right
+            gravity: Edges.Bottom | Edges.Left
+            margins.bottom: -4
+            margins.right: 0
+        }
+
+        HyprlandFocusGrab {
+            id: grab
+            windows: [panel]
+            onCleared: panel.visible = false
+        }
+
+        Rectangle {
+            anchors.fill: parent
+            radius: 0
+            color: Colors.surface
+            border.color: Colors.muted
+            border.width: 3
+
+            Column {
+                id: mainColumn
+                anchors.fill: parent
+                anchors.margins: panel.contentPadding
+                spacing: 10
+
+                // Hero: icon · title/status · percentage
+                RowLayout {
+                    width: parent.width
+                    spacing: 10
+
+                    Text {
+                        text: root.batteryIcon()
+                        font.family: Appearance.iconFontFamilyRounded
+                        font.variableAxes: Appearance.iconFontAxes
+                        font.pixelSize: 30
+                        color: root.low ? Colors.urgent : Colors.foreground
+                    }
+
+                    Column {
+                        Layout.fillWidth: true
+                        spacing: 2
+                        Text {
+                            width: parent.width
+                            text: "Battery"
+                            elide: Text.ElideRight
+                            font.family: Appearance.fontFamily
+                            font.pixelSize: 18
+                            font.bold: true
+                            color: Colors.foreground
+                        }
+                        Text {
+                            id: heroStatus
+                            width: parent.width
+                            text: root.heroStatusText
+                            elide: Text.ElideRight
+                            font.family: Appearance.fontFamily
+                            font.pixelSize: Appearance.fontSizeSmall
+                            color: Colors.muted
+                        }
+                    }
+
+                    Text {
+                        text: Math.round(root.fraction * 100) + "%"
+                        font.family: Appearance.fontFamily
+                        font.pixelSize: 20
+                        font.bold: true
+                        color: Colors.foreground
+                    }
+                }
+
+                // Charge level bar
+                Item {
+                    width: parent.width
+                    height: 4
+
+                    Rectangle {
+                        anchors.fill: parent
+                        radius: 0
+                        color: Colors.muted
+                        opacity: 0.35
+                    }
+                    Rectangle {
+                        anchors.left: parent.left
+                        anchors.top: parent.top
+                        anchors.bottom: parent.bottom
+                        radius: 0
+                        color: root.low ? Colors.urgent : Colors.primary
+                        width: Math.max(height, parent.width * root.fraction)
+                        Behavior on width { NumberAnimation { duration: 320; easing.type: Easing.OutCubic } }
+                    }
+                }
+
+                // Stats — a 2-column, 2-row info grid, same layout
+                // NetworkIndicator.qml uses for its own live stats: a
+                // 4-column GridLayout fed a flattened label/value/label/value
+                // list, so each row holds two label/value pairs side by side
+                // with the values right-aligned against their own half.
+                GridLayout {
+                    width: parent.width
+                    columns: 4
+                    columnSpacing: 12
+                    rowSpacing: 5
+
+                    Repeater {
+                        model: root.statCells
+                        Text {
+                            required property var modelData
+                            Layout.fillWidth: !modelData.isLabel
+                            horizontalAlignment: modelData.isLabel ? Text.AlignLeft : Text.AlignRight
+                            text: modelData.text
+                            font.family: Appearance.fontFamily
+                            font.pixelSize: Appearance.fontSizeSmall
+                            color: modelData.isLabel ? Colors.muted : Colors.foreground
+                        }
+                    }
+                }
+
+                // Power profile picker
+                Column {
+                    width: parent.width
+                    spacing: 6
+
+                    Text {
+                        text: "POWER PROFILE"
+                        font.family: Appearance.fontFamily
+                        font.pixelSize: Appearance.fontSizeSmall
+                        color: Colors.muted
+                    }
+
+                    Row {
+                        id: profileRow
+                        width: parent.width
+                        spacing: 6
+
+                        readonly property real cellWidth: root.profileEntries.length > 0
+                            ? (width - spacing * (root.profileEntries.length - 1)) / root.profileEntries.length
+                            : 0
+
+                        Repeater {
+                            model: root.profileEntries
+                            ProfileButton {
+                                required property var modelData
+                                width: profileRow.cellWidth
+                                label: modelData.label
+                                icon: modelData.icon
+                                active: PowerProfiles.profile === modelData.value
+                                onActivate: PowerProfiles.profile = modelData.value
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

dotfiles/.config/quickshell/modules/bar/BluetoothIndicator.qml

@@ -7,7 +7,15 @@ import "../../config"
 
 Item {
     id: root
-    implicitWidth: label.implicitWidth + 4
+    // Independent left/right breathing room around the glyph. Material
+    // Symbols icons aren't monospaced — each one's font-reported advance
+    // width (label.implicitWidth) bakes in its own side bearings, so the
+    // same "+4, centered" math that every other bar icon uses can still
+    // look tighter/looser icon-to-icon. Tune these two by eye instead of
+    // the icon's own bounding box to even it out against its neighbours.
+    property real iconLeftPadding: 0
+    property real iconRightPadding: 0
+    implicitWidth: root.iconLeftPadding + label.implicitWidth + root.iconRightPadding
     implicitHeight: Appearance.barHeight
 
     // The bar's own PanelWindow — passed in from Bar.qml so this popup can
@@ -71,6 +79,7 @@ Item {
             bonded: !!d.bonded,
             trusted: !!d.trusted,
             pairing: !!d.pairing,
+            state: d.state,
             batteryAvailable: !!d.batteryAvailable,
             battery: d.battery || 0
         }
@@ -97,19 +106,107 @@ Item {
         return null
     }
 
+    // --- Action feedback ---------------------------------------------------
+    // BlueZ operations here are fire-and-forget from QML's side — connect()/
+    // disconnect()/pair()/forget() report failure only via a C++-side log
+    // line (see quickshell's bluetooth/device.cpp), nothing reaches QML. So
+    // "did it work" has to be inferred from the device's own properties
+    // instead of a success/failure callback. Shown as a line right under the
+    // specific row it's about (DeviceRow.statusText below) rather than a
+    // panel-wide banner — actionStatusAddress is how a row knows a message
+    // is meant for it; since it's address-keyed rather than tied to a
+    // particular DeviceRow instance, the message still finds its row even
+    // when the device jumps sections (Paired → Connected on a successful
+    // connect, say), because that's a new DeviceRow for the same address.
+    //  - busyStatus is purely reactive — it just reads pairing/state off
+    //    whichever row is currently mid-operation, however that operation
+    //    was triggered. It's not shown directly (each row already derives
+    //    the same "Connecting…"/"Disconnecting…" off its own dev.state);
+    //    it only exists here to tell resolvePendingAction when to fire.
+    //  - pendingAction+the busyStatus watcher below is how a *specific*
+    //    click gets its own outcome message: it snapshots what was asked
+    //    for, waits for busyStatus to clear, then checks whether the
+    //    expected end state (connected/paired) actually landed.
+    readonly property string busyStatus: {
+        for (const r of root.deviceRows) {
+            if (r.pairing) return "pairing:" + r.address
+            if (r.state === BluetoothDeviceState.Connecting) return "connecting:" + r.address
+            if (r.state === BluetoothDeviceState.Disconnecting) return "disconnecting:" + r.address
+        }
+        return ""
+    }
+
+    property var pendingAction: null
+    property string actionStatus: ""
+    property string actionStatusAddress: ""
+
+    // Checks whether pendingAction's expected end state actually landed and
+    // reports it, then clears pendingAction. Called both when busyStatus
+    // clears normally and from pendingTimeoutTimer below — an operation
+    // that resolves inside a single binding re-evaluation (a device already
+    // in range reconnecting near-instantly, say) can flip busyStatus from ""
+    // straight back to "" without ever visibly changing, which would
+    // otherwise leave pendingAction stuck forever and misattribute whatever
+    // busyStatus transition happens to come along next.
+    function resolvePendingAction() {
+        if (!root.pendingAction) return
+        const p = root.pendingAction
+        root.pendingAction = null
+        const d = root.deviceForAddress(p.address)
+        root.actionStatusAddress = p.address
+        if (p.kind === "disconnect") {
+            root.actionStatus = (d && !d.connected) ? "Disconnected" : "Couldn't disconnect"
+        } else if (p.kind === "pair") {
+            root.actionStatus = (d && d.paired) ? "Paired" : "Couldn't pair"
+        } else {
+            root.actionStatus = (d && d.connected) ? "Connected" : "Couldn't connect"
+        }
+        actionStatusTimer.restart()
+    }
+
+    onBusyStatusChanged: if (root.busyStatus === "") root.resolvePendingAction()
+
+    Timer {
+        id: actionStatusTimer
+        interval: 3500
+        repeat: false
+        onTriggered: root.actionStatus = ""
+    }
+
+    // Backstop for the "resolved before busyStatus ever visibly changed"
+    // case above, and a genuine timeout for an operation that's just stuck
+    // (device out of range, etc.) — either way, restarted whenever
+    // pendingAction is (re)set, so it always reflects the latest click.
+    Timer {
+        id: pendingTimeoutTimer
+        interval: 8000
+        repeat: false
+        onTriggered: root.resolvePendingAction()
+    }
+
     function connectDevice(row) {
         const d = root.deviceForAddress(row.address)
         if (!d) return
         // Already-paired devices just reconnect; a fresh discovery result
         // has to pair first (BlueZ's own agent handles the SSP/passkey
         // handshake — there's no PIN-entry surface exposed by this API).
-        if (row.paired || row.bonded || row.trusted) d.connect()
+        if (row.paired || row.bonded || row.trusted) {
-        else d.pair()
+            root.pendingAction = { address: row.address, kind: "connect" }
+            pendingTimeoutTimer.restart()
+            d.connect()
+        } else {
+            root.pendingAction = { address: row.address, kind: "pair" }
+            pendingTimeoutTimer.restart()
+            d.pair()
+        }
     }
 
     function disconnectDevice(row) {
         const d = root.deviceForAddress(row.address)
-        if (d) d.disconnect()
+        if (!d) return
+        root.pendingAction = { address: row.address, kind: "disconnect" }
+        pendingTimeoutTimer.restart()
+        d.disconnect()
     }
 
     function forgetDevice(row) {
@@ -117,6 +214,18 @@ Item {
         if (!d) return
         if (d.connected) d.disconnect()
         d.forget()
+        // No feedback line here — forgetting removes this row from every
+        // list immediately, so there's nothing left to show a message
+        // under. The row vanishing is the confirmation.
+    }
+
+    function setTrusted(row, trusted) {
+        const d = root.deviceForAddress(row.address)
+        if (!d) return
+        d.trusted = trusted
+        root.actionStatusAddress = row.address
+        root.actionStatus = trusted ? "Trusting" : "No longer trusting"
+        actionStatusTimer.restart()
     }
 
     readonly property bool anyConnected: root.connectedRows.length > 0
@@ -128,8 +237,10 @@ Item {
 
     Text {
         id: label
-        anchors.centerIn: parent
+        anchors.verticalCenter: parent.verticalCenter
-        font.family: Appearance.iconFontFamily
+        anchors.left: parent.left
+        anchors.leftMargin: root.iconLeftPadding
+        font.family: Appearance.iconFontFamilyRounded
         font.variableAxes: Appearance.iconFontAxes
         font.pixelSize: 16
         color: (root.adapter && root.adapter.enabled) ? Colors.foreground : Colors.muted
@@ -163,6 +274,18 @@ Item {
             color: toggleRoot.checked ? Colors.primary : Colors.muted
             opacity: toggleRoot.checked ? 1 : 0.35
         }
+        // Hover-only outline, offset outside the switch itself rather than
+        // drawn on its edge — the switch lags behind a click until the
+        // backend confirms it (e.g. the adapter's enabled state), so this
+        // is just a "you can click this" cue, not click feedback.
+        Rectangle {
+            anchors.fill: parent
+            anchors.margins: -4
+            radius: 0
+            color: "transparent"
+            border.color: Colors.foreground
+            border.width: toggleMouse.containsMouse ? 1 : 0
+        }
         Rectangle {
             width: parent.height - 4
             height: parent.height - 4
@@ -173,14 +296,21 @@ Item {
             Behavior on x { NumberAnimation { duration: Appearance.animationDuration } }
         }
         MouseArea {
+            id: toggleMouse
             anchors.fill: parent
+            hoverEnabled: true
             cursorShape: Qt.PointingHandCursor
             onClicked: toggleRoot.toggled()
         }
     }
 
-    // One device row. `showForget` hides the forget (x) button for
+    // One device row. `showForget` gates the whole trailing action cluster —
-    // discovered-but-unpaired devices, which have nothing to forget yet.
+    // trust toggle, disconnect, forget — for discovered-but-unpaired devices,
+    // which have none of those to act on yet (a plain click there pairs
+    // instead, via activate()). For a paired/connected row, the row body
+    // itself still connects/disconnects (activate()) same as before; the
+    // actions below are the explicit, discoverable versions of that plus
+    // the two this row previously had no way to reach at all.
     component DeviceRow: Rectangle {
         id: devRow
         required property var dev
@@ -189,9 +319,47 @@ Item {
         width: parent ? parent.width : 0
         radius: 0
         implicitHeight: rowContent.implicitHeight + 12
-        color: devRow.dev.connected
+
-            ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18)
+        // Which action icon (if any) the pointer is currently over — drives
-            : (rowMouse.containsMouse ? Colors.primary : "transparent")
+        // both that icon's own hover color below and rowMouse's click
+        // dispatch. Derived from rowMouse.mouseX/containsMouse rather than a
+        // MouseArea on each icon: those icons live inside rowContent, which
+        // sits underneath rowMouse in stacking order, so a nested MouseArea
+        // there would just be shadowed by it (same reason
+        // NetworkIndicator.qml's NetworkRow dispatches by position too).
+        // Checked right-to-left since that's the order the icons are laid
+        // out in, so an earlier icon's "from here to the row's right edge"
+        // zone doesn't swallow the ones after it.
+        readonly property string hoveredAction: {
+            if (!rowMouse.containsMouse) return ""
+            if (devRow.showForget && forgetIcon.visible
+                && rowMouse.mouseX >= devRow.mapFromItem(forgetIcon, 0, 0).x - 8) return "forget"
+            if (devRow.showForget && trustIcon.visible
+                && rowMouse.mouseX >= devRow.mapFromItem(trustIcon, 0, 0).x - 8) return "trust"
+            if (disconnectIcon.visible
+                && rowMouse.mouseX >= devRow.mapFromItem(disconnectIcon, 0, 0).x - 8) return "disconnect"
+            return ""
+        }
+        // Hover checked first (same ordering as Volume.qml's DeviceRow):
+        // hovering always shows a solid Colors.primary fill, even for an
+        // already-connected row, so the primaryText used below never has to
+        // sit on top of the dimmer translucent tint instead.
+        color: rowMouse.containsMouse ? Colors.primary
+            : (devRow.dev.connected ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18) : "transparent")
+
+        // Hover-only outline, offset outside the row rather than drawn on
+        // its own edge — same treatment as NetworkIndicator.qml's NetworkRow.
+        // The lists this feeds are inset by 3px (see deviceListColumn and
+        // the Connected section below) so this has room without being
+        // cropped by deviceListFlick's clip.
+        Rectangle {
+            anchors.fill: parent
+            anchors.margins: -3
+            radius: 0
+            color: "transparent"
+            border.color: Colors.foreground
+            border.width: rowMouse.containsMouse ? 1 : 0
+        }
 
         RowLayout {
             id: rowContent
@@ -207,7 +375,7 @@ Item {
                 Layout.maximumWidth: 20
                 horizontalAlignment: Text.AlignLeft
                 text: devRow.dev.icon
-                font.family: Appearance.iconFontFamily
+                font.family: Appearance.iconFontFamilyRounded
                 font.variableAxes: Appearance.iconFontAxes
                 font.pixelSize: 14
                 color: rowMouse.containsMouse ? Colors.primaryText : Colors.foreground
@@ -229,6 +397,17 @@ Item {
                 Text {
                     readonly property string statusText: {
                         if (devRow.dev.pairing) return "Pairing…"
+                        if (devRow.dev.state === BluetoothDeviceState.Connecting) return "Connecting…"
+                        if (devRow.dev.state === BluetoothDeviceState.Disconnecting) return "Disconnecting…"
+                        // The outcome of the last action taken on this
+                        // specific device (connect/disconnect/pair/trust) —
+                        // see the "Action feedback" comment above
+                        // root.busyStatus. Matched by address rather than by
+                        // this being "the same row" that was clicked, since
+                        // a successful connect/disconnect moves the device
+                        // to a different section (a new DeviceRow entirely).
+                        if (root.actionStatusAddress === devRow.dev.address && root.actionStatus !== "")
+                            return root.actionStatus
                         if (devRow.dev.connected && devRow.dev.batteryAvailable)
                             return Math.round(devRow.dev.battery * 100) + "%"
                         if (devRow.dev.connected) return "Connected"
@@ -242,14 +421,97 @@ Item {
                 }
             }
 
-            Text {
+            // Each action below is a fixed-size slot with its own
+            // hover-halo outline — offset outside the slot rather than drawn
+            // on its own edge, same treatment as devRow's own outline above
+            // and every other hoverable box in this file (ToggleSwitch,
+            // DeviceRow itself, etc.) — instead of just the color swap the
+            // row's own icons get.
+
+            // Disconnect without forgetting — same effect as clicking the
+            // row body on a Connected row (activate() below calls
+            // disconnectDevice too), just given its own explicit, always-
+            // visible icon instead of relying on that being guessed.
+            Item {
+                id: disconnectIcon
+                visible: devRow.showForget && devRow.dev.connected
+                Layout.preferredWidth: 20
+                Layout.preferredHeight: 20
+
+                Rectangle {
+                    anchors.fill: parent
+                    anchors.margins: -3
+                    radius: 0
+                    color: "transparent"
+                    border.color: Colors.foreground
+                    border.width: devRow.hoveredAction === "disconnect" ? 1 : 0
+                }
+                Text {
+                    anchors.centerIn: parent
+                    text: "link_off"
+                    font.family: Appearance.iconFontFamilyRounded
+                    font.variableAxes: Appearance.iconFontAxes
+                    font.pixelSize: 14
+                    // Stays primaryText (dark) rather than switching to
+                    // Colors.primary while targeted — devRow's own fill is
+                    // already Colors.primary on hover, so that would've put
+                    // a primary-colored glyph on a primary-colored
+                    // background. The outline Rectangle above is what shows
+                    // which slot is targeted.
+                    color: rowMouse.containsMouse ? Colors.primaryText : Colors.muted
+                }
+            }
+
+            // Trust toggle — full brightness when trusted, dimmed when not,
+            // same "state via opacity" convention PowerButton.qml uses for
+            // its disabled entries.
+            Item {
+                id: trustIcon
+                visible: devRow.showForget
+                Layout.preferredWidth: 20
+                Layout.preferredHeight: 20
+
+                Rectangle {
+                    anchors.fill: parent
+                    anchors.margins: -3
+                    radius: 0
+                    color: "transparent"
+                    border.color: Colors.foreground
+                    border.width: devRow.hoveredAction === "trust" ? 1 : 0
+                }
+                Text {
+                    anchors.centerIn: parent
+                    text: "verified_user"
+                    opacity: devRow.dev.trusted ? 1 : 0.4
+                    font.family: Appearance.iconFontFamilyRounded
+                    font.variableAxes: Appearance.iconFontAxes
+                    font.pixelSize: 14
+                    color: rowMouse.containsMouse ? Colors.primaryText : Colors.muted
+                }
+            }
+
+            Item {
                 id: forgetIcon
                 visible: devRow.showForget
-                text: "close"
+                Layout.preferredWidth: 20
-                font.family: Appearance.iconFontFamily
+                Layout.preferredHeight: 20
-                font.variableAxes: Appearance.iconFontAxes
+
-                font.pixelSize: 14
+                Rectangle {
-                color: rowMouse.containsMouse ? Colors.primaryText : Colors.muted
+                    anchors.fill: parent
+                    anchors.margins: -3
+                    radius: 0
+                    color: "transparent"
+                    border.color: Colors.foreground
+                    border.width: devRow.hoveredAction === "forget" ? 1 : 0
+                }
+                Text {
+                    anchors.centerIn: parent
+                    text: "close"
+                    font.family: Appearance.iconFontFamilyRounded
+                    font.variableAxes: Appearance.iconFontAxes
+                    font.pixelSize: 14
+                    color: rowMouse.containsMouse ? Colors.primaryText : Colors.muted
+                }
             }
         }
 
@@ -261,21 +523,15 @@ Item {
             height: rowContent.height + 12
             hoverEnabled: true
             cursorShape: Qt.PointingHandCursor
-            // forgetIcon has no MouseArea of its own — nested inside
+            // Dispatches on devRow.hoveredAction rather than its own
-            // rowContent, which sits underneath this full-row area in
+            // MouseArea per icon — see that property's comment above.
-            // stacking order, so a separate MouseArea there would just be
+            onClicked: {
-            // shadowed (see the identical fix in NetworkIndicator.qml's
+                switch (devRow.hoveredAction) {
-            // NetworkRow). Dispatch by click position against this single
+                case "forget": root.forgetDevice(devRow.dev); break
-            // area instead.
+                case "trust": root.setTrusted(devRow.dev, !devRow.dev.trusted); break
-            onClicked: (mouse) => {
+                case "disconnect": root.disconnectDevice(devRow.dev); break
-                if (devRow.showForget && forgetIcon.visible) {
+                default: devRow.activate()
-                    const forgetLeft = devRow.mapFromItem(forgetIcon, 0, 0).x
-                    if (mouse.x >= forgetLeft - 8) {
-                        root.forgetDevice(devRow.dev)
-                        return
-                    }
                 }
-                devRow.activate()
             }
         }
     }
@@ -286,7 +542,11 @@ Item {
         id: panel
         visible: false
         color: "transparent"
-        readonly property int contentWidth: 244
+        // Wider than the other panels' usual 244 — each device row now ends
+        // in a row of three 20px action slots (disconnect/trust/forget)
+        // instead of a single close icon, and the name column needs room to
+        // not immediately start eliding against that.
+        readonly property int contentWidth: 300
         readonly property int contentPadding: 16
         implicitWidth: contentWidth + contentPadding * 2
         implicitHeight: mainColumn.implicitHeight + contentPadding * 2
@@ -335,9 +595,9 @@ Item {
 
                     Text {
                         text: label.text
-                        font.family: Appearance.iconFontFamily
+                        font.family: Appearance.iconFontFamilyRounded
                         font.variableAxes: Appearance.iconFontAxes
-                        font.pixelSize: 30
+                        font.pixelSize: 21
                         color: Colors.foreground
                     }
 
@@ -350,6 +610,29 @@ Item {
                         color: Colors.foreground
                     }
 
+                    // Spins continuously while root.adapter.discovering is
+                    // true — a persistent "still searching" cue independent
+                    // of the list itself, unlike the "Scanning for devices…"
+                    // text below (which only shows while the device list is
+                    // still empty).
+                    Text {
+                        id: scanSpinner
+                        visible: root.adapter !== null && root.adapter.discovering
+                        text: "progress_activity"
+                        font.family: Appearance.iconFontFamilyRounded
+                        font.variableAxes: Appearance.iconFontAxes
+                        font.pixelSize: 16
+                        color: Colors.muted
+
+                        RotationAnimation on rotation {
+                            running: scanSpinner.visible
+                            loops: Animation.Infinite
+                            from: 0
+                            to: 360
+                            duration: 900
+                        }
+                    }
+
                     ToggleSwitch {
                         visible: root.adapter !== null
                         checked: root.adapter !== null && root.adapter.enabled
@@ -389,7 +672,10 @@ Item {
                         color: Colors.muted
                     }
                     Column {
-                        width: parent.width
+                        // Inset 3px on each side to match deviceListColumn
+                        // below, so DeviceRow's hover halo has room here too.
+                        x: 3
+                        width: parent.width - 6
                         spacing: 2
                         Repeater {
                             model: root.connectedRows
@@ -403,6 +689,42 @@ Item {
                     }
                 }
 
+                // Paired — always shown in full, same as Connected above and
+                // for the same reason: these are one click away from
+                // reconnecting (root.connectDevice reconnects rather than
+                // re-pairing whenever a row is already paired/bonded/trusted),
+                // so they shouldn't be buried in the capped-height scroll area
+                // below or hidden behind an active scan turning up other
+                // nearby devices.
+                Column {
+                    width: parent.width
+                    spacing: 4
+                    visible: root.knownRows.length > 0
+
+                    Text {
+                        text: "Paired Devices"
+                        font.family: Appearance.fontFamily
+                        font.pixelSize: Appearance.fontSizeSmall
+                        color: Colors.muted
+                    }
+                    Column {
+                        // Inset 3px on each side to match deviceListColumn
+                        // below, so DeviceRow's hover halo has room here too.
+                        x: 3
+                        width: parent.width - 6
+                        spacing: 2
+                        Repeater {
+                            model: root.knownRows
+                            DeviceRow {
+                                required property var modelData
+                                dev: modelData
+                                showForget: true
+                                onActivate: root.connectDevice(dev)
+                            }
+                        }
+                    }
+                }
+
                 Text {
                     width: parent.width
                     visible: root.adapter !== null && root.adapter.enabled && root.deviceRows.length === 0
@@ -412,9 +734,9 @@ Item {
                     color: Colors.muted
                 }
 
-                // Paired/Available — capped height, scrolls once there are
+                // Available — freshly discovered, unpaired devices only.
-                // more devices than fit rather than growing the popup
+                // Capped height, scrolls once there are more than fit rather
-                // indefinitely.
+                // than growing the popup indefinitely.
                 Flickable {
                     id: deviceListFlick
                     width: parent.width
@@ -427,35 +749,19 @@ Item {
 
                     Column {
                         id: deviceListColumn
-                        width: deviceListFlick.width
+                        // Inset 3px on every side so DeviceRow's hover halo
+                        // has room without being cropped by deviceListFlick's
+                        // clip. Left/right needs the manual x/width shift
+                        // (children bind width: parent.width, which ignores
+                        // Column's own padding); top/bottom just needs
+                        // padding, since that's along Column's own layout
+                        // axis and Flickable's contentHeight tracks it.
+                        x: 3
+                        width: deviceListFlick.width - 6
+                        topPadding: 3
+                        bottomPadding: 3
                         spacing: 6
 
-                        Column {
-                            width: parent.width
-                            spacing: 4
-                            visible: root.knownRows.length > 0
-
-                            Text {
-                                text: "Paired Devices"
-                                font.family: Appearance.fontFamily
-                                font.pixelSize: Appearance.fontSizeSmall
-                                color: Colors.muted
-                            }
-                            Column {
-                                width: parent.width
-                                spacing: 2
-                                Repeater {
-                                    model: root.knownRows
-                                    DeviceRow {
-                                        required property var modelData
-                                        dev: modelData
-                                        showForget: true
-                                        onActivate: root.connectDevice(dev)
-                                    }
-                                }
-                            }
-                        }
-
                         Column {
                             width: parent.width
                             spacing: 4

dotfiles/.config/quickshell/modules/bar/NetworkIndicator.qml

@@ -44,7 +44,13 @@ Item {
         return null
     }
 
-    // Only scan for networks while the panel is actually open.
+    // Only scan for networks while the panel is actually open. Deliberately
+    // NOT paused while a password prompt is up: scannerEnabled: false stops
+    // NetworkManager from refreshing its AP cache at all, so the existing
+    // list quietly ages out with nothing to replace it — the fix for typing
+    // being interrupted by scan-driven refreshes lives below instead (the
+    // password field itself is pulled out of the repeated row so refreshes
+    // can't touch it), not here.
     Binding {
         target: root.wifiDevice
         property: "scannerEnabled"
@@ -84,6 +90,24 @@ Item {
         ? sortWifiRows(root.wifiDevice.networks.values.map(root.wifiRow).filter(function(r) { return r && r.ssid }))
         : []
 
+    // Quickshell's WifiDevice has no "a scan is in flight" signal — only
+    // scannerEnabled, the on/off request, which stays true for as long as
+    // the panel is open rather than pulsing per scan. wifiRows re-deriving
+    // to a new array (as it does on every actual network-list change — see
+    // the comment on wifiRow() above) is the closest available proxy for
+    // "a scan just landed", so pulse briefly off that instead.
+    property bool wifiJustScanned: false
+    onWifiRowsChanged: {
+        root.wifiJustScanned = true
+        wifiScanPulseTimer.restart()
+    }
+
+    Timer {
+        id: wifiScanPulseTimer
+        interval: 1200
+        onTriggered: root.wifiJustScanned = false
+    }
+
     // Split for the "Known Networks" / "Other Networks" sections. wifiRows
     // is already sorted connected-first then by signal, so filtering
     // preserves that order within each group.
@@ -135,8 +159,17 @@ Item {
         }
     }
 
-    // SSID of the row currently showing its inline password field, if any.
+    // SSID awaiting a password, if any. The input itself lives in a single
+    // persistent widget below the network list (see passwordEntryInput),
+    // not inside the per-row NetworkRow delegate — wifiRows is rebuilt from
+    // scratch on every scan result, and a Repeater over a plain array has no
+    // way to diff that, so it destroys and recreates every delegate each
+    // time. Keeping the field outside that churn is what lets typing survive
+    // a scan landing mid-keystroke.
     property string passwordSsid: ""
+    // Cleared whenever the target SSID changes so stale text from a
+    // cancelled/previous prompt never carries over to the next one.
+    onPasswordSsidChanged: passwordEntryInput.text = ""
 
     // Wired connections don't have a user-facing "name" on the device or
     // Network object — those just expose the interface name (e.g. "eth0").
@@ -161,6 +194,14 @@ Item {
         return (row && row.ssid) || "Network"
     }
 
+    // Signal strength of the currently-connected WiFi network, if any — lets
+    // the bar icon show the same wifi-fan glyph (via wifiIcon()) as the
+    // connected row inside the popup, instead of a generic "wifi" icon.
+    readonly property int connectedWifiSignal: {
+        const row = root.wifiRows.find(function(r) { return r.connected })
+        return row ? row.signal : 0
+    }
+
     function activateNetwork(net) {
         if (net.connected) return
         if (net.known || !root.requiresCredentials(net.security)) {
@@ -171,6 +212,92 @@ Item {
         }
     }
 
+    function submitPassword() {
+        const n = root.networkForSsid(root.passwordSsid)
+        if (n && passwordEntryInput.text.length > 0) n.connectWithPsk(passwordEntryInput.text)
+        root.passwordSsid = ""
+    }
+
+    function cancelPassword() {
+        root.passwordSsid = ""
+    }
+
+    // --- Captive portal ---------------------------------------------------
+    // NetworkManager tells "portal" (a walled-garden sign-in page sits
+    // between us and the real internet) apart from "full" connectivity only
+    // via an active probe — nmcli's cached CONNECTIVITY field just reflects
+    // NM's own internal check, which runs every few minutes and is far too
+    // slow to catch a portal right after joining a network. So this forces a
+    // fresh probe itself, same shell-out approach as the stats below, and
+    // runs it whenever we're connected — not gated to panel.visible like
+    // those — since the whole point is noticing this before the popup is
+    // ever opened.
+    //
+    // "limited" is treated the same as "portal", not just "full" vs.
+    // everything-else: NM only reports "portal" when the probe request
+    // actually comes back *different* (redirected/rewritten) from what it
+    // expected. Plenty of real captive portals instead black-hole every
+    // request that isn't to their own login domain, so the probe just times
+    // out — which is also why this is slow to resolve — and NM reports
+    // "limited" (it got a route/gateway, but the internet check itself
+    // never landed) rather than "portal". From the user's side both look
+    // identical: connected, but no real internet.
+    property string connectivityState: "unknown"
+    readonly property bool connectivityRestricted: root.connectivityState === "portal" || root.connectivityState === "limited"
+
+    // A plain, unencrypted HTTP page whose only job is to be interceptable
+    // by a captive portal's redirect. An https:// URL mostly just gets
+    // silently blocked instead of redirected, which looks identical to the
+    // portal not existing at all.
+    readonly property string captivePortalCheckUrl: "http://neverssl.com/"
+
+    // Auto-opened once per network join (mirrors TailscaleIndicator's
+    // openAuthUrl/_authUrlOpened) so flapping connectivity on the same
+    // network doesn't keep popping a new browser tab — the manual "Open"
+    // button in the panel banner below still works regardless.
+    property bool _portalAutoOpened: false
+    property bool _wasConnected: false
+    onConnectedDeviceChanged: {
+        const isConnected = root.connectedDevice !== null
+        if (isConnected && !root._wasConnected) {
+            root._portalAutoOpened = false
+            root.connectivityState = "unknown"
+        }
+        root._wasConnected = isConnected
+    }
+
+    onConnectivityRestrictedChanged: {
+        if (root.connectivityRestricted && !root._portalAutoOpened)
+            root.openCaptivePortal()
+    }
+
+    function openCaptivePortal() {
+        root._portalAutoOpened = true
+        Qt.openUrlExternally(root.captivePortalCheckUrl)
+    }
+
+    Process {
+        id: connectivityProc
+        command: ["nmcli", "networking", "connectivity", "check"]
+        stdout: StdioCollector {
+            id: connectivityCollector
+            onStreamFinished: root.connectivityState = connectivityCollector.text.trim()
+        }
+    }
+
+    Timer {
+        id: connectivityTimer
+        // Poll quickly while things are still unresolved (fresh join, or an
+        // active portal we're waiting to clear) and back off once
+        // connectivity is confirmed full, rather than shelling out every
+        // few seconds forever for no reason.
+        interval: root.connectivityState === "full" ? 20000 : 3000
+        repeat: true
+        triggeredOnStart: true
+        running: root.connectedDevice !== null
+        onTriggered: if (!connectivityProc.running) connectivityProc.running = true
+    }
+
     // --- Live stats --------------------------------------------------
     // None of this comes from Quickshell's Networking API — it only knows
     // about devices/networks, not throughput, ping, or routing. So this
@@ -517,14 +644,58 @@ Item {
     Text {
         id: label
         anchors.centerIn: parent
-        font.family: Appearance.iconFontFamily
+        font.family: Appearance.iconFontFamilyRounded
         font.variableAxes: Appearance.iconFontAxes
         font.pixelSize: 16
         color: root.connectedDevice ? Colors.foreground : Colors.muted
+        // Only Wired renders its own distinct glyph; disconnected uses
+        // "signal_wifi_off" — the actual off companion to the
+        // network_wifi/signal_wifi fan family used below (not "wifi_off",
+        // which belongs to a visually different, newer glyph family and
+        // looked inconsistent next to the connected bars) — so it needs the
+        // same vertical-stretch correction as the rest of that family.
+        readonly property bool isWifiFan: root.connectedDevice === null || root.connectedDevice.type !== DeviceType.Wired
         text: {
             if (!root.connectedDevice)
-                return "wifi_off"
+                return "signal_wifi_off"
-            return root.connectedDevice.type === DeviceType.Wired ? "settings_ethernet" : "wifi"
+            if (root.connectedDevice.type === DeviceType.Wired)
+                return "settings_ethernet"
+            return root.wifiIcon(root.connectedWifiSignal)
+        }
+        // Same correction as the matching glyph inside the popup's
+        // NetworkRow — the wifi-fan family is inherently flat/wide.
+        transform: Scale {
+            origin.x: label.width / 2
+            origin.y: label.height / 2
+            yScale: label.isWifiFan ? 1.2 : 1.0
+        }
+    }
+
+    // Small warning badge over the icon's corner when the connection looks
+    // restricted (a captive portal, confirmed or just suspected — see
+    // connectivityRestricted above) — same treatment as TailscaleIndicator's
+    // login-needed badge, so "this needs your attention" reads the same way
+    // across indicators.
+    Rectangle {
+        visible: root.connectivityRestricted
+        width: Math.max(7, label.font.pixelSize * 0.42)
+        height: width
+        radius: width / 2
+        color: Colors.urgent
+        border.color: Colors.surface
+        border.width: 1
+        anchors.right: label.right
+        anchors.bottom: label.bottom
+        anchors.rightMargin: -1
+        anchors.bottomMargin: -1
+
+        Text {
+            anchors.centerIn: parent
+            text: "!"
+            color: Colors.surface
+            font.family: Appearance.fontFamily
+            font.pixelSize: Math.max(6, parent.height * 0.75)
+            font.bold: true
         }
     }
 
@@ -552,6 +723,18 @@ Item {
             color: toggleRoot.checked ? Colors.primary : Colors.muted
             opacity: toggleRoot.checked ? 1 : 0.35
         }
+        // Hover-only outline, offset outside the switch itself rather than
+        // drawn on its edge — the switch lags behind a click until the
+        // backend confirms it (e.g. Networking.wifiEnabled), so this is just
+        // a "you can click this" cue, not click feedback.
+        Rectangle {
+            anchors.fill: parent
+            anchors.margins: -4
+            radius: 0
+            color: "transparent"
+            border.color: Colors.foreground
+            border.width: toggleMouse.containsMouse ? 1 : 0
+        }
         Rectangle {
             width: parent.height - 4
             height: parent.height - 4
@@ -562,7 +745,9 @@ Item {
             Behavior on x { NumberAnimation { duration: Appearance.animationDuration } }
         }
         MouseArea {
+            id: toggleMouse
             anchors.fill: parent
+            hoverEnabled: true
             cursorShape: Qt.PointingHandCursor
             onClicked: toggleRoot.toggled()
         }
@@ -572,18 +757,32 @@ Item {
         id: netRow
         required property var net
         signal activate()
+        // Still tracked for the highlight below — the actual input lives
+        // outside this (repeatedly rebuilt) delegate, in the persistent
+        // password entry widget under the network list.
         readonly property bool passwordOpen: root.passwordSsid === netRow.net.ssid
         width: parent ? parent.width : 0
         radius: 0
-        implicitHeight: rowContent.implicitHeight + 12 + (passwordOpen ? passwordRow.implicitHeight + 6 : 0)
+        implicitHeight: rowContent.implicitHeight + 12
-        color: netRow.net.connected
+        // Hover checked first (same ordering as Volume.qml's DeviceRow):
-            ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18)
+        // hovering always shows a solid Colors.primary fill, even for an
-            : (rowMouse.containsMouse ? Colors.primary : "transparent")
+        // already-active row, so the primaryText used below never has to
+        // sit on top of the dimmer translucent tint instead.
+        color: rowMouse.containsMouse ? Colors.primary
+            : ((netRow.net.connected || netRow.passwordOpen) ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18) : "transparent")
 
-        function submit() {
+        // Hover-only outline, offset outside the row rather than drawn on
-            const n = root.networkForSsid(netRow.net.ssid)
+        // its own edge — same treatment as ToggleSwitch's halo and the DNS
-            if (n && passwordInput.text.length > 0) n.connectWithPsk(passwordInput.text)
+        // pills. networkListColumn insets its rows by 3px on each side
-            root.passwordSsid = ""
+        // specifically to give this room without getting cropped by the
+        // Flickable's clip.
+        Rectangle {
+            anchors.fill: parent
+            anchors.margins: -3
+            radius: 0
+            color: "transparent"
+            border.color: Colors.foreground
+            border.width: rowMouse.containsMouse ? 1 : 0
         }
 
         Column {
@@ -600,11 +799,12 @@ Item {
                     Layout.preferredWidth: 20
                     Layout.minimumWidth: 20
                     Layout.maximumWidth: 20
+                    Layout.alignment: Qt.AlignVCenter
                     horizontalAlignment: Text.AlignLeft
                     text: root.wifiIcon(netRow.net.signal)
-                    font.family: Appearance.iconFontFamily
+                    font.family: Appearance.iconFontFamilyRounded
                     font.variableAxes: Appearance.iconFontAxes
-                    font.pixelSize: 14
+                    font.pixelSize: 16
                     color: rowMouse.containsMouse ? Colors.primaryText : Colors.foreground
                     // The wifi-fan glyph itself is flat/wide — stretch it
                     // vertically to read taller while keeping its width (and
@@ -639,7 +839,7 @@ Item {
                 Text {
                     visible: root.requiresCredentials(netRow.net.security)
                     text: "lock"
-                    font.family: Appearance.iconFontFamily
+                    font.family: Appearance.iconFontFamilyRounded
                     font.variableAxes: Appearance.iconFontAxes
                     font.pixelSize: 13
                     color: rowMouse.containsMouse ? Colors.primaryText : Colors.muted
@@ -648,59 +848,12 @@ Item {
                     id: forgetIcon
                     visible: netRow.net.known
                     text: "close"
-                    font.family: Appearance.iconFontFamily
+                    font.family: Appearance.iconFontFamilyRounded
                     font.variableAxes: Appearance.iconFontAxes
                     font.pixelSize: 14
                     color: rowMouse.containsMouse ? Colors.primaryText : Colors.muted
                 }
             }
-
-            RowLayout {
-                id: passwordRow
-                visible: netRow.passwordOpen
-                width: parent.width
-                spacing: 6
-
-                Rectangle {
-                    Layout.fillWidth: true
-                    implicitHeight: 24
-                    radius: 0
-                    color: Colors.background
-                    border.color: Colors.muted
-                    border.width: 1
-
-                    TextInput {
-                        id: passwordInput
-                        anchors.fill: parent
-                        anchors.margins: 6
-                        echoMode: TextInput.Password
-                        color: Colors.foreground
-                        font.family: Appearance.fontFamily
-                        font.pixelSize: Appearance.fontSizeSmall
-                        clip: true
-                        focus: netRow.passwordOpen
-                        onAccepted: netRow.submit()
-                        // Explicit fallback alongside onAccepted, which only
-                        // fires when acceptableInput is true — covers both
-                        // the main Return key and numpad Enter directly.
-                        Keys.onReturnPressed: netRow.submit()
-                        Keys.onEnterPressed: netRow.submit()
-                    }
-                }
-
-                Text {
-                    text: "check"
-                    font.family: Appearance.iconFontFamily
-                    font.variableAxes: Appearance.iconFontAxes
-                    font.pixelSize: 16
-                    color: Colors.primary
-                    MouseArea {
-                        anchors.fill: parent
-                        cursorShape: Qt.PointingHandCursor
-                        onClicked: netRow.submit()
-                    }
-                }
-            }
         }
 
         MouseArea {
@@ -786,16 +939,25 @@ Item {
                     spacing: 8
 
                     Text {
+                        id: headerIcon
                         text: label.text
-                        font.family: Appearance.iconFontFamily
+                        font.family: Appearance.iconFontFamilyRounded
                         font.variableAxes: Appearance.iconFontAxes
                         font.pixelSize: 30
                         color: Colors.foreground
+                        // Mirrors the bar icon's own correction — see label's
+                        // isWifiFan/transform above — since this just
+                        // displays the same text at a larger size.
+                        transform: Scale {
+                            origin.x: headerIcon.width / 2
+                            origin.y: headerIcon.height / 2
+                            yScale: label.isWifiFan ? 1.2 : 1.0
+                        }
                     }
 
                     Text {
                         Layout.fillWidth: true
-                        text: root.connectedNetworkName
+                        text: "Network"
                         elide: Text.ElideRight
                         font.family: Appearance.fontFamily
                         font.pixelSize: 18
@@ -804,6 +966,116 @@ Item {
                     }
                 }
 
+                // Row rather than RowLayout — RowLayout is built for
+                // constraint-based stretching (Layout.fillWidth etc.), and
+                // without either Text opting into that, its sizing pass can
+                // still leave more room between them than spacing:0 implies.
+                // Row has no such stretch logic: spacing is exactly the gap
+                // you get, so these two sit flush (plus one small gap) no
+                // matter what width is bound above them.
+                Row {
+                    width: parent.width
+                    spacing: 4
+
+                    Text {
+                        text: "Connected Interface:"
+                        font.family: Appearance.fontFamily
+                        font.pixelSize: Appearance.fontSizeSmall
+                        color: Colors.muted
+                    }
+
+                    Text {
+                        text: root.connectedNetworkName
+                        font.family: Appearance.fontFamily
+                        font.pixelSize: Appearance.fontSizeSmall
+                        color: Colors.foreground
+                        font.bold: true
+                    }
+
+                }
+
+                // Captive portal banner — shown when the connectivity probe
+                // above finds either a confirmed sign-in page or a
+                // "limited" result standing between this network and the
+                // real internet (see connectivityRestricted). openCaptivePortal()
+                // already fired once automatically when this was first
+                // detected; this stays up as a manual retry in case that tab
+                // got closed.
+                Rectangle {
+                    width: parent.width
+                    visible: root.connectivityRestricted
+                    radius: 0
+                    color: Qt.rgba(Colors.urgent.r, Colors.urgent.g, Colors.urgent.b, 0.18)
+                    border.color: Colors.urgent
+                    border.width: 1
+                    implicitHeight: portalBannerRow.implicitHeight + 12
+
+                    RowLayout {
+                        id: portalBannerRow
+                        anchors.fill: parent
+                        anchors.margins: 6
+                        spacing: 8
+
+                        Text {
+                            text: "lock_open"
+                            font.family: Appearance.iconFontFamilyRounded
+                            font.variableAxes: Appearance.iconFontAxes
+                            font.pixelSize: 16
+                            color: Colors.urgent
+                        }
+
+                        ColumnLayout {
+                            Layout.fillWidth: true
+                            spacing: 0
+
+                            Text {
+                                Layout.fillWidth: true
+                                text: root.connectivityState === "portal" ? "Sign-in required" : "No internet access"
+                                elide: Text.ElideRight
+                                font.family: Appearance.fontFamily
+                                font.pixelSize: Appearance.fontSize
+                                font.bold: true
+                                color: Colors.foreground
+                            }
+                            Text {
+                                Layout.fillWidth: true
+                                text: root.connectivityState === "portal"
+                                    ? "This network needs a web sign-in first"
+                                    : "This network may need a web sign-in first"
+                                elide: Text.ElideRight
+                                font.family: Appearance.fontFamily
+                                font.pixelSize: Appearance.fontSizeSmall
+                                color: Colors.muted
+                            }
+                        }
+
+                        Rectangle {
+                            implicitWidth: openPortalText.implicitWidth + 16
+                            implicitHeight: 24
+                            radius: 0
+                            color: openPortalMouse.containsMouse ? Colors.urgent : "transparent"
+                            border.color: Colors.urgent
+                            border.width: 1
+
+                            Text {
+                                id: openPortalText
+                                anchors.centerIn: parent
+                                text: "Open"
+                                font.family: Appearance.fontFamily
+                                font.pixelSize: Appearance.fontSizeSmall
+                                color: openPortalMouse.containsMouse ? Colors.primaryText : Colors.urgent
+                            }
+                            MouseArea {
+                                id: openPortalMouse
+                                anchors.fill: parent
+                                hoverEnabled: true
+                                cursorShape: Qt.PointingHandCursor
+                                onClicked: root.openCaptivePortal()
+                            }
+                        }
+                    }
+                }
+
                 // Live stats — ping/loss/throughput/IP/gateway for whichever
                 // device is currently connected.
                 GridLayout {
@@ -863,6 +1135,18 @@ Item {
                                 border.width: 1
                                 opacity: root.dnsBusy ? 0.6 : 1
 
+                                // Hover-only outline, offset outside the pill
+                                // itself rather than drawn on its own border —
+                                // same treatment as ToggleSwitch's halo.
+                                Rectangle {
+                                    anchors.fill: parent
+                                    anchors.margins: -3
+                                    radius: 0
+                                    color: "transparent"
+                                    border.color: Colors.foreground
+                                    border.width: dnsMouse.containsMouse ? 1 : 0
+                                }
+
                                 Text {
                                     anchors.centerIn: parent
                                     text: dnsPill.modelData
@@ -936,7 +1220,7 @@ Item {
 
                         Text {
                             text: "check"
-                            font.family: Appearance.iconFontFamily
+                            font.family: Appearance.iconFontFamilyRounded
                             font.variableAxes: Appearance.iconFontAxes
                             font.pixelSize: 16
                             color: Colors.primary
@@ -974,7 +1258,7 @@ Item {
                         spacing: 8
                         Text {
                             text: "settings_ethernet"
-                            font.family: Appearance.iconFontFamily
+                            font.family: Appearance.iconFontFamilyRounded
                             font.variableAxes: Appearance.iconFontAxes
                             font.pixelSize: 14
                             color: Colors.foreground
@@ -1025,6 +1309,32 @@ Item {
                             font.pixelSize: Appearance.fontSize
                             color: Colors.foreground
                         }
+
+                        // Spins briefly each time a scan actually lands —
+                        // same "still searching" cue as
+                        // BluetoothIndicator.qml's spinner, but pulsed via
+                        // wifiJustScanned (see above) rather than staying on
+                        // for the whole time the panel is open, since
+                        // WifiDevice has no per-scan signal of its own to
+                        // key off.
+                        Text {
+                            id: wifiScanSpinner
+                            visible: root.wifiDevice !== null && root.wifiDevice.scannerEnabled && root.wifiJustScanned
+                            text: "progress_activity"
+                            font.family: Appearance.iconFontFamilyRounded
+                            font.variableAxes: Appearance.iconFontAxes
+                            font.pixelSize: 16
+                            color: Colors.muted
+
+                            RotationAnimation on rotation {
+                                running: wifiScanSpinner.visible
+                                loops: Animation.Infinite
+                                from: 0
+                                to: 360
+                                duration: 900
+                            }
+                        }
+
                         ToggleSwitch {
                             checked: Networking.wifiEnabled
                             onToggled: Networking.wifiEnabled = !Networking.wifiEnabled
@@ -1049,6 +1359,97 @@ Item {
                         color: Colors.muted
                     }
 
+                    // Password entry — a single persistent widget rather
+                    // than living inside the NetworkRow delegate for
+                    // root.passwordSsid, so a wifi scan landing mid-keystroke
+                    // (which rebuilds the whole Known/Other Networks list
+                    // below) can't destroy the focused TextInput and wipe
+                    // out what's been typed. See passwordSsid's own comment.
+                    Rectangle {
+                        width: parent.width
+                        visible: root.passwordSsid !== ""
+                        radius: 0
+                        color: Colors.background
+                        border.color: Colors.muted
+                        border.width: 1
+                        implicitHeight: passwordEntryColumn.implicitHeight + 12
+
+                        Column {
+                            id: passwordEntryColumn
+                            anchors.fill: parent
+                            anchors.margins: 6
+                            spacing: 6
+
+                            Text {
+                                width: parent.width
+                                text: "Password for “" + root.passwordSsid + "”"
+                                elide: Text.ElideRight
+                                font.family: Appearance.fontFamily
+                                font.pixelSize: Appearance.fontSizeSmall
+                                color: Colors.muted
+                            }
+
+                            RowLayout {
+                                width: parent.width
+                                spacing: 6
+
+                                Rectangle {
+                                    Layout.fillWidth: true
+                                    implicitHeight: 24
+                                    radius: 0
+                                    color: Colors.surface
+                                    border.color: Colors.muted
+                                    border.width: 1
+
+                                    TextInput {
+                                        id: passwordEntryInput
+                                        anchors.fill: parent
+                                        anchors.margins: 6
+                                        echoMode: TextInput.Password
+                                        color: Colors.foreground
+                                        font.family: Appearance.fontFamily
+                                        font.pixelSize: Appearance.fontSizeSmall
+                                        clip: true
+                                        focus: root.passwordSsid !== ""
+                                        onAccepted: root.submitPassword()
+                                        // Explicit fallback alongside onAccepted, which only
+                                        // fires when acceptableInput is true — covers both
+                                        // the main Return key and numpad Enter directly.
+                                        Keys.onReturnPressed: root.submitPassword()
+                                        Keys.onEnterPressed: root.submitPassword()
+                                        Keys.onEscapePressed: root.cancelPassword()
+                                    }
+                                }
+
+                                Text {
+                                    text: "check"
+                                    font.family: Appearance.iconFontFamilyRounded
+                                    font.variableAxes: Appearance.iconFontAxes
+                                    font.pixelSize: 16
+                                    color: Colors.primary
+                                    MouseArea {
+                                        anchors.fill: parent
+                                        cursorShape: Qt.PointingHandCursor
+                                        onClicked: root.submitPassword()
+                                    }
+                                }
+
+                                Text {
+                                    text: "close"
+                                    font.family: Appearance.iconFontFamilyRounded
+                                    font.variableAxes: Appearance.iconFontAxes
+                                    font.pixelSize: 16
+                                    color: Colors.muted
+                                    MouseArea {
+                                        anchors.fill: parent
+                                        cursorShape: Qt.PointingHandCursor
+                                        onClicked: root.cancelPassword()
+                                    }
+                                }
+                            }
+                        }
+                    }
+
                     // Known/Other Networks — capped height, scrolls once
                     // there are more networks than fit rather than growing
                     // the popup indefinitely.
@@ -1064,7 +1465,19 @@ Item {
 
                         Column {
                             id: networkListColumn
-                            width: networkListFlick.width
+                            // Inset 3px on every side (rather than flush with
+                            // the Flickable) so NetworkRow's hover halo below
+                            // has room to sit outside the row without being
+                            // cropped by the Flickable's own clip. Left/right
+                            // needs the manual x/width shift (children bind
+                            // width: parent.width, which ignores Column's own
+                            // padding); top/bottom just needs padding, since
+                            // that's along Column's own layout axis and the
+                            // Flickable's contentHeight tracks it.
+                            x: 3
+                            width: networkListFlick.width - 6
+                            topPadding: 3
+                            bottomPadding: 3
                             spacing: 6
 
                             Column {

dotfiles/.config/quickshell/modules/bar/PinnedTray.qml

@@ -0,0 +1,110 @@
+import QtQuick
+import QtQuick.Layouts
+import Quickshell
+import Quickshell.Io
+import Quickshell.Services.SystemTray
+import Quickshell.Widgets
+import "../../config"
+
+
+RowLayout {
+    id: root
+    spacing: Appearance.spacing * 1.
+
+    
+    readonly property var pinned: [
+        {
+            name: "Bitwarden",
+            icon: Qt.resolvedUrl("../../assets/bitwarden.png"),
+            binary: "bitwarden",
+            launch: ["bitwarden"],
+            secondary: ["pkill", "bitwarden"]
+        },
+        {
+            name: "Seafile",
+            icon: "seafile",
+            binary: "seafile-applet",
+            launch: ["seafile-applet"],
+            secondary: ["pkill", "seafile-applet"]
+        },
+        {
+            name: "Sunshine",
+            icon: Qt.resolvedUrl("../../assets/sunshine.svg"),
+            binary: "sunshine",
+            launch: ["systemctl", "--user", "start", "app-dev.lizardbyte.app.Sunshine.service"],
+            secondary: ["xdg-open", "https://xol.twhomelab.tailnet:47990"],
+        },
+    ]
+
+    function findTrayItem(name) {
+        const needle = name.toLowerCase()
+        for (const item of SystemTray.items.values) {
+            if (item.id.toLowerCase().includes(needle) || item.title.toLowerCase().includes(needle))
+                return item
+        }
+        return null
+    }
+
+    Repeater {
+        model: root.pinned
+
+        delegate: Item {
+            id: slot
+            required property var modelData
+            readonly property var trayItem: root.findTrayItem(modelData.name)
+            readonly property bool running: trayItem !== null
+            property bool installed: false // Application installation check
+
+            visible: slot.installed
+            implicitWidth: Appearance.iconSize
+            implicitHeight: Appearance.iconSize
+
+            Process {
+                running: true
+                command: ["which", slot.modelData.binary]
+                onExited: (exitCode) => slot.installed = exitCode === 0
+            }
+
+            IconImage {
+                anchors.fill: parent
+                // modelData.icon is a QUrl when it comes from
+                // Qt.resolvedUrl() (Bitwarden/Sunshine's local assets), not
+                // a QString — coerce to string before using String methods
+                // on it, or this throws instead of ever matching.
+                source: slot.running
+                    ? slot.trayItem.icon
+                    : (String(slot.modelData.icon).includes("://")
+                        ? slot.modelData.icon
+                        : Quickshell.iconPath(slot.modelData.icon))
+                opacity: slot.running ? 1.0 : 0.5
+            }
+
+            Process { id: launcher }
+            Process { id: secondaryProc }
+
+            MouseArea {
+                anchors.fill: parent
+                anchors.margins: -4
+                cursorShape: Qt.PointingHandCursor
+                acceptedButtons: Qt.LeftButton | Qt.RightButton
+                onClicked: (mouse) => {
+                    if (mouse.button === Qt.RightButton) {
+                        if (slot.modelData.secondary) {
+                            if (!secondaryProc.running) {
+                                secondaryProc.command = slot.modelData.secondary
+                                secondaryProc.running = true
+                            }
+                        } else if (slot.running) {
+                            slot.trayItem.secondaryActivate()
+                        }
+                    } else if (slot.running) {
+                        slot.trayItem.activate()
+                    } else if (!launcher.running) {
+                        launcher.command = slot.modelData.launch
+                        launcher.running = true
+                    }
+                }
+            }
+        }
+    }
+}

dotfiles/.config/quickshell/modules/bar/PowerButton.qml

@@ -7,7 +7,7 @@ import "../../config"
 
 Item {
     id: root
-    implicitWidth: label.implicitWidth + 4
+    implicitWidth: label.implicitWidth + 2
     implicitHeight: Appearance.barHeight
 
     // The bar's own PanelWindow — passed in from Bar.qml so this popup can
@@ -19,11 +19,11 @@ Item {
     Text {
         id: label
         anchors.centerIn: parent
-        font.family: Appearance.iconFontFamily
+        font.family: Appearance.iconFontFamilyRounded
         font.variableAxes: Appearance.iconFontAxes
         font.pixelSize: 16
         color: Colors.foreground
-        text: "power_settings_new"
+        text: "settings_power"
     }
 
     MouseArea {
@@ -41,10 +41,12 @@ Item {
         id: menu
         visible: false
         color: "transparent"
-        implicitWidth: 210
+        // Same contentWidth/contentPadding split as the other panels
-        // Same padding as Volume.qml's panel.
+        // (Volume.qml, NetworkIndicator.qml, etc.) rather than a single
+        // magic implicitWidth.
+        readonly property int contentWidth: 178
         readonly property int contentPadding: 16
-        readonly property int labelOffset: -135
+        implicitWidth: contentWidth + contentPadding * 2
         implicitHeight: mainColumn.implicitHeight + contentPadding * 2
 
         anchor {
@@ -91,9 +93,9 @@ Item {
 
                     Text {
                         text: label.text
-                        font.family: Appearance.iconFontFamily
+                        font.family: Appearance.iconFontFamilyRounded
                         font.variableAxes: Appearance.iconFontAxes
-                        font.pixelSize: 30
+                        font.pixelSize: 23
                         color: Colors.foreground
                     }
 
@@ -122,36 +124,55 @@ Item {
                             { label: "Shut down", icon: "power_settings_new", cmd: ["systemctl", "poweroff"] }
                         ]
 
+                        // Same shape as this project's other selectable rows
+                        // (e.g. VpnIndicator.qml's ProviderRow,
+                        // TailscaleIndicator.qml's ExitNodeRow): radius 0, a
+                        // fixed-width icon column followed by a fillWidth
+                        // label, and an offset hover halo rather than one
+                        // drawn on the row's own edge.
                         delegate: Rectangle {
                             id: entry
                             required property var modelData
                             width: parent ? parent.width : 0
-                            height: 40
+                            radius: 0
-                            radius: Appearance.radiusSmall
+                            implicitHeight: entryContent.implicitHeight + 12
                             color: (!entry.modelData.disabled && entryMouse.containsMouse) ? Colors.primary : "transparent"
 
-                            RowLayout {
+                            Rectangle {
                                 anchors.fill: parent
-                                anchors.leftMargin: 8
+                                anchors.margins: -3
+                                radius: 0
+                                color: "transparent"
+                                border.color: Colors.foreground
+                                border.width: entryMouse.containsMouse ? 1 : 0
+                            }
+
+                            RowLayout {
+                                id: entryContent
+                                anchors.left: parent.left
+                                anchors.right: parent.right
+                                anchors.verticalCenter: parent.verticalCenter
+                                anchors.margins: 6
                                 spacing: 8
+
                                 Text {
-                                    Layout.preferredWidth: 25
+                                    Layout.preferredWidth: 20
-                                    Layout.minimumWidth: 25
+                                    Layout.minimumWidth: 20
-                                    Layout.maximumWidth: 25
+                                    Layout.maximumWidth: 20
                                     horizontalAlignment: Text.AlignLeft
                                     text: entry.modelData.icon
-                                    font.family: Appearance.iconFontFamily
+                                    font.family: Appearance.iconFontFamilyRounded
                                     font.variableAxes: Appearance.iconFontAxes
-                                    font.pixelSize: entry.modelData.iconSize || 15
+                                    font.pixelSize: 14
                                     opacity: entry.modelData.disabled ? 0.4 : 1
                                     color: entryMouse.containsMouse ? Colors.primaryText : Colors.foreground
                                 }
                                 Text {
-                                    Layout.leftMargin: menu.labelOffset + (entry.modelData.textOffset || 0)
+                                    Layout.fillWidth: true
                                     text: entry.modelData.label
-                                    horizontalAlignment: Text.AlignLeft
+                                    elide: Text.ElideRight
                                     font.family: Appearance.fontFamily
-                                    font.pixelSize: 16
+                                    font.pixelSize: Appearance.fontSize
                                     opacity: entry.modelData.disabled ? 0.4 : 1
                                     color: entryMouse.containsMouse ? Colors.primaryText : Colors.foreground
                                 }

dotfiles/.config/quickshell/modules/bar/SystemUpdate.qml

@@ -0,0 +1,194 @@
+import QtQuick
+import QtQuick.Layouts
+import Quickshell
+import Quickshell.Hyprland
+import "../../config"
+
+Item {
+    id: root
+    implicitWidth: row.implicitWidth + 6
+    implicitHeight: Appearance.barHeight
+
+    
+    required property var barWindow
+
+    RowLayout {
+        id: row
+        anchors.centerIn: parent
+        spacing: 4
+
+        Text {
+            id: label
+            font.family: SystemUpdates.checking ? Appearance.iconFontFamilyRounded : Appearance.fontFamily
+            font.variableAxes: Appearance.iconFontAxes
+            font.pixelSize: SystemUpdates.checking ? 15 : 22
+            color: Colors.foreground
+            text: SystemUpdates.checking ? "progress_activity" : "󰏖"
+
+            RotationAnimation on rotation {
+                running: SystemUpdates.checking
+                loops: Animation.Infinite
+                from: 0
+                to: 360
+                duration: 900
+                onRunningChanged: if (!running) label.rotation = 0
+            }
+        }
+
+        Text {
+            font.family: Appearance.fontFamily
+            font.pixelSize: Appearance.fontSizeSmall
+            color: label.color
+            text: SystemUpdates.updateCount
+        }
+    }
+
+    MouseArea {
+        anchors.fill: parent
+        cursorShape: Qt.PointingHandCursor
+        acceptedButtons: Qt.LeftButton | Qt.RightButton
+        onClicked: (mouse) => {
+            if (mouse.button === Qt.RightButton) {
+                SystemUpdates.refresh()
+            } else {
+                panel.visible = !panel.visible
+                grab.active = panel.visible
+            }
+        }
+    }
+
+    PopupWindow {
+        id: panel
+        visible: false
+        color: "transparent"
+        readonly property int contentWidth: 200
+        readonly property int contentPadding: 16
+        implicitWidth: contentWidth + contentPadding * 2
+        implicitHeight: mainColumn.implicitHeight + contentPadding * 2
+
+        anchor {
+            window: root.barWindow
+            rect.x: 0
+            rect.y: 0
+            rect.width: root.barWindow.width
+            rect.height: root.barWindow.height
+            edges: Edges.Bottom
+            gravity: Edges.Bottom
+            margins.bottom: -4
+        }
+
+        HyprlandFocusGrab {
+            id: grab
+            windows: [panel]
+            onCleared: panel.visible = false
+        }
+
+        Rectangle {
+            anchors.fill: parent
+            radius: 0
+            color: Colors.surface
+            border.color: Colors.muted
+            border.width: 3
+
+            Column {
+                id: mainColumn
+                anchors.fill: parent
+                anchors.margins: panel.contentPadding
+                spacing: 10
+
+                RowLayout {
+                    width: parent.width
+                    spacing: 8
+
+                    Text {
+                        text: label.text
+                        font.family: Appearance.fontFamily
+                        font.pixelSize: 23
+                        color: Colors.foreground
+                    }
+
+                    Text {
+                        Layout.fillWidth: true
+                        text: "System Update"
+                        font.family: Appearance.fontFamily
+                        font.pixelSize: 18
+                        font.bold: true
+                        color: Colors.foreground
+                    }
+                }
+
+                Text {
+                    width: parent.width
+                    wrapMode: Text.WordWrap
+                    font.family: Appearance.fontFamily
+                    font.pixelSize: Appearance.fontSize
+                    color: Colors.foreground
+                    text: {
+                        if (SystemUpdates.updating) return "Update running in a terminal…"
+                        if (SystemUpdates.checking) return "Checking for updates…"
+                        if (SystemUpdates.updateCount === 0) return "System is up to date."
+                        return SystemUpdates.updateCount + (SystemUpdates.updateCount === 1 ? " update available." : " updates available.")
+                    }
+                }
+
+                Rectangle {
+                    id: updateBtn
+                    width: parent.width
+                    radius: 0
+                    implicitHeight: btnContent.implicitHeight + 12
+                    enabled: !SystemUpdates.updating
+                    opacity: SystemUpdates.updating ? 0.5 : 1
+                    color: btnMouse.containsMouse ? Colors.primary : "transparent"
+
+                    Rectangle {
+                        anchors.fill: parent
+                        anchors.margins: -3
+                        radius: 0
+                        color: "transparent"
+                        border.color: Colors.foreground
+                        border.width: btnMouse.containsMouse ? 1 : 0
+                    }
+
+                    RowLayout {
+                        id: btnContent
+                        anchors.left: parent.left
+                        anchors.right: parent.right
+                        anchors.verticalCenter: parent.verticalCenter
+                        anchors.margins: 6
+                        spacing: 8
+
+                        Text {
+                            Layout.preferredWidth: 20
+                            horizontalAlignment: Text.AlignLeft
+                            text: "download"
+                            font.family: Appearance.iconFontFamilyRounded
+                            font.variableAxes: Appearance.iconFontAxes
+                            font.pixelSize: 14
+                            color: btnMouse.containsMouse ? Colors.primaryText : Colors.foreground
+                        }
+                        Text {
+                            Layout.fillWidth: true
+                            text: "Update Now"
+                            font.family: Appearance.fontFamily
+                            font.pixelSize: Appearance.fontSize
+                            color: btnMouse.containsMouse ? Colors.primaryText : Colors.foreground
+                        }
+                    }
+
+                    MouseArea {
+                        id: btnMouse
+                        anchors.fill: parent
+                        enabled: !SystemUpdates.updating
+                        hoverEnabled: true
+                        cursorShape: Qt.PointingHandCursor
+                        onClicked: {
+                            SystemUpdates.runUpdate(Quickshell.shellPath("scripts/update-system.sh"))
+                            panel.visible = false
+                            grab.active = false
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

dotfiles/.config/quickshell/modules/bar/TailscaleIndicator.qml

@@ -7,7 +7,7 @@ import "../../config"
 
 Item {
     id: root
-    implicitWidth: label.implicitWidth + 4
+    implicitWidth: label.implicitWidth
     implicitHeight: Appearance.barHeight
 
     // The bar's own PanelWindow — passed in from Bar.qml so this popup can
@@ -54,7 +54,7 @@ Item {
 
     // Set when the VPN-exclusivity guard (below) forces Tailscale down —
     // as opposed to you turning it off yourself — so it knows to bring
-    // Tailscale back up automatically once Mullvad/ProtonVPN disconnect,
+    // Tailscale back up automatically once the other VPN disconnects,
     // without overriding a deliberate manual "off".
     property bool _forcedDownByVpn: false
 
@@ -204,7 +204,7 @@ Item {
             return
         }
         if (VpnExclusivity.commercialVpnActive) {
-            root.actionStatus = "Disconnect Mullvad/ProtonVPN first"
+            root.actionStatus = "Disconnect the active VPN first"
             actionStatusTimer.restart()
             return
         }
@@ -432,8 +432,8 @@ Item {
                 model: [0, 0, 0, 1, 1, 1, 0, 1, 0]
                 Rectangle {
                     required property int modelData
-                    width: logo.dotSize
+                    width: logo.dotSize - 1
-                    height: logo.dotSize
+                    height: logo.dotSize - 1
                     radius: width / 2
                     color: modelData ? '#c9f0f0f0' : logo.dimColor
                 }
@@ -505,6 +505,18 @@ Item {
             color: toggleRoot.checked ? Colors.primary : Colors.muted
             opacity: toggleRoot.checked ? 1 : 0.35
         }
+        // Hover-only outline, offset outside the switch itself rather than
+        // drawn on its edge — the switch lags behind a click until the
+        // backend confirms it (e.g. root.active), so this is just a "you
+        // can click this" cue, not click feedback.
+        Rectangle {
+            anchors.fill: parent
+            anchors.margins: -4
+            radius: 0
+            color: "transparent"
+            border.color: Colors.foreground
+            border.width: toggleMouse.containsMouse ? 1 : 0
+        }
         Rectangle {
             width: parent.height - 4
             height: parent.height - 4
@@ -515,7 +527,9 @@ Item {
             Behavior on x { NumberAnimation { duration: Appearance.animationDuration } }
         }
         MouseArea {
+            id: toggleMouse
             anchors.fill: parent
+            hoverEnabled: true
             cursorShape: Qt.PointingHandCursor
             onClicked: toggleRoot.toggled()
         }
@@ -533,9 +547,25 @@ Item {
         width: parent ? parent.width : 0
         radius: 0
         implicitHeight: rowContent.implicitHeight + 12
-        color: exitRow.active
+        // Hover checked first (same ordering as Volume.qml's DeviceRow):
-            ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18)
+        // hovering always shows a solid Colors.primary fill, even for an
-            : (rowMouse.containsMouse ? Colors.primary : "transparent")
+        // already-active row, so the primaryText used below never has to
+        // sit on top of the dimmer translucent tint instead.
+        color: rowMouse.containsMouse ? Colors.primary
+            : (exitRow.active ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18) : "transparent")
+
+        // Hover-only outline, offset outside the row rather than drawn on
+        // its own edge — same treatment as NetworkIndicator.qml's NetworkRow.
+        // listColumn below is inset by 3px to give this room without being
+        // cropped by listFlick's clip.
+        Rectangle {
+            anchors.fill: parent
+            anchors.margins: -3
+            radius: 0
+            color: "transparent"
+            border.color: Colors.foreground
+            border.width: rowMouse.containsMouse ? 1 : 0
+        }
 
         RowLayout {
             id: rowContent
@@ -551,7 +581,7 @@ Item {
                 Layout.maximumWidth: 20
                 horizontalAlignment: Text.AlignLeft
                 text: exitRow.subIcon
-                font.family: Appearance.iconFontFamily
+                font.family: Appearance.iconFontFamilyRounded
                 font.variableAxes: Appearance.iconFontAxes
                 font.pixelSize: 14
                 color: rowMouse.containsMouse ? Colors.primaryText : Colors.foreground
@@ -568,7 +598,7 @@ Item {
             Text {
                 visible: exitRow.active
                 text: "check_circle"
-                font.family: Appearance.iconFontFamily
+                font.family: Appearance.iconFontFamilyRounded
                 font.variableAxes: Appearance.iconFontAxes
                 font.pixelSize: 14
                 color: rowMouse.containsMouse ? Colors.primaryText : Colors.primary
@@ -595,9 +625,25 @@ Item {
         width: parent ? parent.width : 0
         radius: 0
         implicitHeight: accountContent.implicitHeight + 12
-        color: accountRow.selected
+        // Hover checked first (same ordering as Volume.qml's DeviceRow):
-            ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18)
+        // hovering always shows a solid Colors.primary fill, even for an
-            : (accountMouse.containsMouse ? Colors.primary : "transparent")
+        // already-selected row, so the primaryText the texts below already
+        // assume on hover is always correct (this row had the same
+        // active-first ordering bug as ExitNodeRow, just never reported).
+        color: accountMouse.containsMouse ? Colors.primary
+            : (accountRow.selected ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18) : "transparent")
+
+        // Hover-only outline, offset outside the row — same treatment as
+        // ExitNodeRow/NetworkRow. Not inside a clipped Flickable, so no
+        // inset needed on its container.
+        Rectangle {
+            anchors.fill: parent
+            anchors.margins: -3
+            radius: 0
+            color: "transparent"
+            border.color: Colors.foreground
+            border.width: accountMouse.containsMouse ? 1 : 0
+        }
 
         RowLayout {
             id: accountContent
@@ -613,7 +659,7 @@ Item {
                 Layout.maximumWidth: 20
                 horizontalAlignment: Text.AlignLeft
                 text: "person"
-                font.family: Appearance.iconFontFamily
+                font.family: Appearance.iconFontFamilyRounded
                 font.variableAxes: Appearance.iconFontAxes
                 font.pixelSize: 14
                 color: accountMouse.containsMouse ? Colors.primaryText : Colors.foreground
@@ -638,7 +684,7 @@ Item {
             Text {
                 visible: accountRow.selected
                 text: "check_circle"
-                font.family: Appearance.iconFontFamily
+                font.family: Appearance.iconFontFamilyRounded
                 font.variableAxes: Appearance.iconFontAxes
                 font.pixelSize: 14
                 color: accountMouse.containsMouse ? Colors.primaryText : Colors.primary
@@ -680,6 +726,18 @@ Item {
                  : (peerRow.expanded ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18) : "transparent")
             implicitHeight: peerContent.implicitHeight + 12
 
+            // Hover-only outline, offset outside the row — same treatment as
+            // ExitNodeRow/NetworkRow. listColumn is inset by 3px to give this
+            // room without being cropped by listFlick's clip.
+            Rectangle {
+                anchors.fill: parent
+                anchors.margins: -3
+                radius: 0
+                color: "transparent"
+                border.color: Colors.foreground
+                border.width: summaryMouse.containsMouse ? 1 : 0
+            }
+
             RowLayout {
                 id: peerContent
                 anchors.left: parent.left
@@ -694,7 +752,7 @@ Item {
                     Layout.maximumWidth: 20
                     horizontalAlignment: Text.AlignLeft
                     text: root.osIcon(peerRow.peer.os)
-                    font.family: Appearance.iconFontFamily
+                    font.family: Appearance.iconFontFamilyRounded
                     font.variableAxes: Appearance.iconFontAxes
                     font.pixelSize: 14
                     color: summaryMouse.containsMouse ? Colors.primaryText : Colors.foreground
@@ -709,7 +767,7 @@ Item {
                 }
                 Text {
                     text: peerRow.expanded ? "expand_less" : "content_copy"
-                    font.family: Appearance.iconFontFamily
+                    font.family: Appearance.iconFontFamilyRounded
                     font.variableAxes: Appearance.iconFontAxes
                     font.pixelSize: 14
                     color: summaryMouse.containsMouse ? Colors.primaryText : Colors.muted
@@ -739,6 +797,17 @@ Item {
                     color: optionMouse.containsMouse ? Colors.primary : "transparent"
                     implicitHeight: optionRow.implicitHeight + 8
 
+                    // Hover-only outline, offset outside the row — same
+                    // treatment as the rest of this file's selectable rows.
+                    Rectangle {
+                        anchors.fill: parent
+                        anchors.margins: -3
+                        radius: 0
+                        color: "transparent"
+                        border.color: Colors.foreground
+                        border.width: optionMouse.containsMouse ? 1 : 0
+                    }
+
                     RowLayout {
                         id: optionRow
                         anchors.left: parent.left
@@ -838,7 +907,7 @@ Item {
                     spacing: 8
 
                     TailscaleLogo {
-                        size: 30
+                        size: 25
                         color: label.color
                         crossed: label.crossed
                         warning: label.warning
@@ -915,7 +984,7 @@ Item {
                         spacing: 8
                         Text {
                             text: "open_in_new"
-                            font.family: Appearance.iconFontFamily
+                            font.family: Appearance.iconFontFamilyRounded
                             font.variableAxes: Appearance.iconFontAxes
                             font.pixelSize: 14
                             color: signInMouse.containsMouse ? Colors.primaryText : Colors.foreground
@@ -986,7 +1055,7 @@ Item {
                         Text {
                             visible: root.status.selfIp !== ""
                             text: "content_copy"
-                            font.family: Appearance.iconFontFamily
+                            font.family: Appearance.iconFontFamilyRounded
                             font.variableAxes: Appearance.iconFontAxes
                             font.pixelSize: 12
                             color: copyMouse.containsMouse ? Colors.primary : Colors.muted
@@ -1026,7 +1095,18 @@ Item {
 
                     Column {
                         id: listColumn
-                        width: listFlick.width
+                        // Inset 3px on every side so ExitNodeRow/PeerRow's
+                        // hover halo has room without being cropped by
+                        // listFlick's clip. Left/right needs the manual
+                        // x/width shift (children bind width: parent.width,
+                        // which ignores Column's own padding); top/bottom
+                        // just needs padding, since that's along Column's
+                        // own layout axis and Flickable's contentHeight
+                        // tracks it.
+                        x: 3
+                        width: listFlick.width - 6
+                        topPadding: 3
+                        bottomPadding: 3
                         spacing: 6
 
                         Column {

dotfiles/.config/quickshell/modules/bar/Tray.qml

@@ -5,7 +5,7 @@ import Quickshell.Widgets
 import "../../config"
 
 RowLayout {
-    spacing: Appearance.spacing * 0.6
+    spacing: Appearance.spacing
 
     Repeater {
         model: SystemTray.items

dotfiles/.config/quickshell/modules/bar/Volume.qml

@@ -7,7 +7,7 @@ import "../../config"
 
 Item {
     id: root
-    implicitWidth: label.implicitWidth + 4
+    implicitWidth: label.implicitWidth
     implicitHeight: Appearance.barHeight
 
     // The bar's own PanelWindow — passed in from Bar.qml so this popup can
@@ -40,6 +40,12 @@ Item {
         enabled: panel.visible
     }
 
+    PwNodePeakMonitor {
+        id: outputPeak
+        node: root.sink
+        enabled: panel.visible
+    }
+
     // --- Device label/icon heuristics, ported from omarchy's audio panel
     // Model.js (github.com/basecamp/omarchy shell/plugins/panels/audio/Model.js),
     // adapted to this project's Material Symbols icon set instead of Nerd Font.
@@ -67,27 +73,52 @@ Item {
                 p["device.icon-name"] || "", p["device.product.name"] || ""].join(" ").toLowerCase()
     }
 
+    // Quickshell's Pipewire API only exposes a node's own properties, not
+    // its parent Device — so device.api (unlike device.form-factor or the
+    // richer device.icon-name, which only live on the Device object) is the
+    // one reliable Bluetooth signal actually present here: it's set on
+    // every node PipeWire hands off to a bluez5-backed sink/source. Checking
+    // it directly beats sniffing the word "bluetooth" out of node names,
+    // which usually just say "bluez_output..." and never match.
+    function isBluetoothNode(node) {
+        var p = (node && node.properties) || {}
+        return p["device.api"] === "bluez5"
+    }
+
+    // PipeWire's own device.form-factor (which would call ACCENTUM a
+    // "headset" outright) isn't reachable from here for the same reason —
+    // it lives on the Device object, not the node. And some devices (a
+    // generic USB DAC like an EKSA headset) have no form-factor anywhere in
+    // PipeWire at all, headset or not, so no property-based check can catch
+    // them. This override list is the deliberate manual escape hatch for
+    // exactly that case — add a distinctive substring from the product name
+    // (device.product.name/description, matched case-insensitively via
+    // deviceBlob) whenever a new no-metadata device shows up misclassified.
+    readonly property var headphoneNameOverrides: ["e900plus"]
+
     function isHeadphoneNode(node) {
         var blob = deviceBlob(node)
-        return blob.indexOf("headphone") !== -1 || blob.indexOf("headset") !== -1
+        if (blob.indexOf("headphone") !== -1 || blob.indexOf("headset") !== -1
             || blob.indexOf("earbud") !== -1 || blob.indexOf("earphone") !== -1
-            || blob.indexOf("airpod") !== -1
+            || blob.indexOf("airpod") !== -1)
+            return true
+        return root.headphoneNameOverrides.some(function(needle) { return blob.indexOf(needle) !== -1 })
     }
 
     function sinkIcon(node) {
         if (!node) return "speaker"
         if (isHeadphoneNode(node)) return "headphones"
+        if (isBluetoothNode(node)) return "bluetooth_audio"
         var blob = deviceBlob(node)
-        if (blob.indexOf("bluetooth") !== -1) return "bluetooth_audio"
         if (blob.indexOf("hdmi") !== -1 || blob.indexOf("display") !== -1) return "tv"
         return "speaker"
     }
 
     function sourceIcon(node) {
         if (!node) return "mic"
+        if (isHeadphoneNode(node)) return "headphones"
+        if (isBluetoothNode(node)) return "bluetooth_audio"
         var blob = deviceBlob(node)
-        if (blob.indexOf("headset") !== -1) return "headphones"
-        if (blob.indexOf("bluetooth") !== -1) return "bluetooth_audio"
         if (blob.indexOf("webcam") !== -1 || blob.indexOf("camera") !== -1) return "videocam"
         return "mic"
     }
@@ -95,9 +126,9 @@ Item {
     Text {
         id: label
         anchors.centerIn: parent
-        font.family: Appearance.iconFontFamily
+        font.family: Appearance.iconFontFamilyRounded
         font.variableAxes: Appearance.iconFontAxes
-        font.pixelSize: 16
+        font.pixelSize: 18
         color: Colors.foreground
         text: (root.outputMuted || root.outputVolume <= 0) ? "volume_off"
             : (root.outputVolume < 0.5 ? "volume_down" : "volume_up")
@@ -106,15 +137,25 @@ Item {
     MouseArea {
         anchors.fill: parent
         cursorShape: Qt.PointingHandCursor
+        // Scroll distance is accumulated rather than stepping per event:
+        // a mouse wheel sends one 120-unit event per notch, but a touchpad
+        // sends a stream of tiny events, which at a fixed step per event
+        // made touchpad scrolling far too fast. One notch's worth (120) of
+        // scrolling = one volume step, regardless of input device.
+        property real wheelAccum: 0
+        readonly property real volumeStep: 0.05
+        readonly property real unitsPerStep: 120
         onClicked: {
             panel.visible = !panel.visible
             grab.active = panel.visible
         }
         onWheel: (wheel) => {
             if (!root.sink || !root.sink.audio) return
-            const step = 0.05
+            wheelAccum += wheel.angleDelta.y
-            const delta = wheel.angleDelta.y > 0 ? step : -step
+            const steps = Math.trunc(wheelAccum / unitsPerStep)
-            root.sink.audio.volume = Math.max(0, Math.min(1, root.sink.audio.volume + delta))
+            if (steps === 0) return
+            wheelAccum -= steps * unitsPerStep
+            root.sink.audio.volume = Math.max(0, Math.min(1, root.sink.audio.volume + steps * volumeStep))
         }
     }
 
@@ -234,6 +275,19 @@ Item {
         color: rowMouse.containsMouse ? Colors.primary
              : (deviceRow.active ? Qt.rgba(Colors.primary.r, Colors.primary.g, Colors.primary.b, 0.18) : "transparent")
 
+        // Hover-only outline, offset outside the row rather than drawn on
+        // its own edge — same treatment as the other bar widgets' selectable
+        // rows (e.g. NetworkIndicator.qml's NetworkRow). Not inside a
+        // clipped Flickable here, so no inset needed on its container.
+        Rectangle {
+            anchors.fill: parent
+            anchors.margins: -3
+            radius: 0
+            color: "transparent"
+            border.color: Colors.foreground
+            border.width: rowMouse.containsMouse ? 1 : 0
+        }
+
         RowLayout {
             anchors.fill: parent
             anchors.leftMargin: 8
@@ -245,7 +299,7 @@ Item {
                 Layout.maximumWidth: 18
                 horizontalAlignment: Text.AlignHCenter
                 text: deviceRow.icon
-                font.family: Appearance.iconFontFamily
+                font.family: Appearance.iconFontFamilyRounded
                 font.variableAxes: Appearance.iconFontAxes
                 font.pixelSize: 14
                 color: rowMouse.containsMouse ? Colors.primaryText : Colors.foreground
@@ -315,7 +369,7 @@ Item {
             Column {
                 id: mainColumn
                 anchors.fill: parent
-                anchors.margins: panel.contentPadding
+                anchors.margins: panel.contentPadding - 2
                 spacing: 10
 
                 // Header
@@ -325,9 +379,9 @@ Item {
 
                     Text {
                         text: label.text
-                        font.family: Appearance.iconFontFamily
+                        font.family: Appearance.iconFontFamilyRounded
                         font.variableAxes: Appearance.iconFontAxes
-                        font.pixelSize: 40
+                        font.pixelSize: 30
                         color: Colors.foreground
                     }
 
@@ -375,9 +429,14 @@ Item {
                         onMoved: (v) => { if (root.sink && root.sink.audio) root.sink.audio.volume = v }
                     }
 
+                    LevelMeter {
+                        width: parent.width
+                        level: outputPeak.peak
+                    }
+
                     Column {
                         width: parent.width
-                        spacing: 2
+                        spacing: 4
                         Repeater {
                             model: root.candidateSinks
                             DeviceRow {
@@ -425,9 +484,10 @@ Item {
                         level: inputPeak.peak
                     }
 
+
                     Column {
                         width: parent.width
-                        spacing: 2
+                        spacing: 4
                         Repeater {
                             model: root.candidateSources
                             DeviceRow {

dotfiles/.config/quickshell/modules/bar/Weather.qml

@@ -0,0 +1,413 @@
+import QtQuick
+import QtQuick.Layouts
+import Quickshell
+import Quickshell.Hyprland
+import "../../config"
+
+// Weather indicator — modeled on omarchy's weather bar pill
+// (github.com/omacom/omarchy, quattro branch,
+// shell/plugins/panels/weather) but rebuilt in this bar's own style: the
+// actual location/polling logic lives in the WeatherData singleton (config/),
+// shared across every monitor's bar; this is just the icon + panel UI,
+// same split as SystemUpdate.qml.
+Item {
+    id: root
+    implicitWidth: row.implicitWidth + 2
+    implicitHeight: Appearance.barHeight
+
+    // The bar's own PanelWindow — same barWindow-anchoring convention as
+    // every other popup-having module here (Volume.qml, SystemUpdate.qml,
+    // etc.), so the panel opens in a fixed spot rather than following this
+    // icon's exact position in its RowLayout.
+    required property var barWindow
+
+    readonly property bool busy: WeatherData.locating || WeatherData.loading
+
+    // Local to this popup instance — unlike WeatherData's own state, there's
+    // no need to share an in-progress search across monitors' bars.
+    property bool searchOpen: false
+    property string searchQuery: ""
+
+    RowLayout {
+        id: row
+        anchors.centerIn: parent
+        spacing: 4
+
+        Text {
+            id: label
+            font.family: Appearance.iconFontFamilyRounded
+            font.variableAxes: Appearance.iconFontAxes
+            font.pixelSize: 18
+            color: Colors.foreground
+            // Same spinner treatment as SystemUpdate.qml/
+            // BluetoothIndicator.qml's scan spinner while the location or
+            // conditions are still loading.
+            text: root.busy ? "progress_activity" : (WeatherData.hasLocation ? WeatherData.iconFor(WeatherData.weatherCode, WeatherData.isDay) : "cloud_off")
+
+            RotationAnimation on rotation {
+                running: root.busy
+                loops: Animation.Infinite
+                from: 0
+                to: 360
+                duration: 900
+                onRunningChanged: if (!running) label.rotation = 0
+            }
+        }
+
+        Text {
+            visible: WeatherData.hasLocation && !WeatherData.locating
+            font.family: Appearance.fontFamily
+            font.pixelSize: Appearance.fontSizeSmall
+            color: Colors.foreground
+            text: Math.round(WeatherData.tempC) + "°"
+        }
+    }
+
+    MouseArea {
+        anchors.fill: parent
+        cursorShape: Qt.PointingHandCursor
+        acceptedButtons: Qt.LeftButton | Qt.RightButton
+        onClicked: (mouse) => {
+            if (mouse.button === Qt.RightButton) {
+                WeatherData.refresh()
+            } else {
+                panel.visible = !panel.visible
+                grab.active = panel.visible
+            }
+        }
+    }
+
+    PopupWindow {
+        id: panel
+        visible: false
+        color: "transparent"
+        // Same contentWidth/contentPadding split as the other panels
+        // (Volume.qml, SystemUpdate.qml, etc.) rather than a single magic
+        // implicitWidth.
+        readonly property int contentWidth: 220
+        readonly property int contentPadding: 16
+        implicitWidth: contentWidth + contentPadding * 2
+        implicitHeight: mainColumn.implicitHeight + contentPadding * 2
+
+        anchor {
+            window: root.barWindow
+            // Unlike anchor.item, anchor.window doesn't default rect to the
+            // window's own bounds — set it explicitly so edges/gravity below
+            // resolve against the full bar. Bottom alone (no Left/Right)
+            // anchors to the bar's bottom-center, which lines up with this
+            // icon since it sits in the bar's centered RowLayout.
+            rect.x: 0
+            rect.y: 0
+            rect.width: root.barWindow.width
+            rect.height: root.barWindow.height
+            edges: Edges.Bottom
+            gravity: Edges.Bottom
+            margins.bottom: -4
+        }
+
+        HyprlandFocusGrab {
+            id: grab
+            windows: [panel]
+            onCleared: panel.visible = false
+        }
+
+        Rectangle {
+            anchors.fill: parent
+            radius: 0
+            color: Colors.surface
+            border.color: Colors.muted
+            border.width: 3
+
+            Column {
+                id: mainColumn
+                anchors.fill: parent
+                anchors.margins: panel.contentPadding
+                spacing: 10
+
+                RowLayout {
+                    width: parent.width
+                    spacing: 8
+
+                    Text {
+                        text: label.text
+                        font.family: Appearance.iconFontFamilyRounded
+                        font.variableAxes: Appearance.iconFontAxes
+                        font.pixelSize: 28
+                        color: Colors.foreground
+                    }
+
+                    ColumnLayout {
+                        Layout.fillWidth: true
+                        spacing: 0
+
+                        Text {
+                            Layout.fillWidth: true
+                            elide: Text.ElideRight
+                            text: {
+                                if (WeatherData.locating) return "Locating…"
+                                if (!WeatherData.hasLocation) return "Location unavailable"
+                                return WeatherData.locationName || "Weather"
+                            }
+                            font.family: Appearance.fontFamily
+                            font.pixelSize: 18
+                            font.bold: true
+                            color: Colors.foreground
+                        }
+
+                        Text {
+                            visible: WeatherData.hasLocation && !WeatherData.locating
+                            text: WeatherData.loading ? "Updating…" : "Feels like " + Math.round(WeatherData.feelsLikeC) + "°"
+                            font.family: Appearance.fontFamily
+                            font.pixelSize: Appearance.fontSizeSmall
+                            color: Colors.muted
+                        }
+                    }
+
+                    Text {
+                        visible: WeatherData.hasLocation && !WeatherData.locating
+                        text: Math.round(WeatherData.tempC) + "°"
+                        font.family: Appearance.fontFamily
+                        font.pixelSize: 28
+                        font.bold: true
+                        color: Colors.foreground
+                    }
+
+                    // Toggles the search box below — same tap target size
+                    // and hover feedback as the picker-target rows in
+                    // VpnIndicator.qml.
+                    Text {
+                        text: root.searchOpen ? "close" : "edit_location"
+                        font.family: Appearance.iconFontFamilyRounded
+                        font.variableAxes: Appearance.iconFontAxes
+                        font.pixelSize: 16
+                        color: editLocationMouse.containsMouse ? Colors.primary : Colors.muted
+
+                        MouseArea {
+                            id: editLocationMouse
+                            anchors.fill: parent
+                            anchors.margins: -4
+                            hoverEnabled: true
+                            cursorShape: Qt.PointingHandCursor
+                            onClicked: {
+                                root.searchOpen = !root.searchOpen
+                                root.searchQuery = ""
+                                WeatherData.searchResults = []
+                            }
+                        }
+                    }
+                }
+
+                // City search — always available regardless of how the
+                // current location was resolved (IP guess or a previous
+                // search), so a wrong auto-detected city is one click away
+                // from being fixed. Same search-box + result-list shape as
+                // VpnIndicator.qml's Mullvad location picker.
+                Column {
+                    visible: root.searchOpen
+                    width: parent.width
+                    spacing: 6
+
+                    Rectangle {
+                        width: parent.width
+                        implicitHeight: 24
+                        radius: 0
+                        color: Colors.surface
+                        border.color: Colors.muted
+                        border.width: 1
+
+                        Text {
+                            anchors.fill: parent
+                            anchors.margins: 6
+                            visible: citySearchInput.text.length === 0
+                            text: "Search city…"
+                            font.family: Appearance.fontFamily
+                            font.pixelSize: Appearance.fontSizeSmall
+                            color: Colors.muted
+                        }
+
+                        TextInput {
+                            id: citySearchInput
+                            anchors.fill: parent
+                            anchors.margins: 6
+                            color: Colors.foreground
+                            font.family: Appearance.fontFamily
+                            font.pixelSize: Appearance.fontSizeSmall
+                            clip: true
+                            focus: root.searchOpen
+                            text: root.searchQuery
+                            onTextChanged: {
+                                root.searchQuery = text
+                                searchDebounce.restart()
+                            }
+                        }
+
+                        Timer {
+                            id: searchDebounce
+                            interval: 400
+                            onTriggered: WeatherData.search(root.searchQuery)
+                        }
+                    }
+
+                    Text {
+                        visible: WeatherData.searching
+                        text: "Searching…"
+                        font.family: Appearance.fontFamily
+                        font.pixelSize: Appearance.fontSizeSmall
+                        color: Colors.muted
+                    }
+
+                    Text {
+                        visible: !WeatherData.searching && citySearchInput.text.length >= 2 && WeatherData.searchResults.length === 0
+                        text: "No matches"
+                        font.family: Appearance.fontFamily
+                        font.pixelSize: Appearance.fontSizeSmall
+                        color: Colors.muted
+                    }
+
+                    Flickable {
+                        width: parent.width
+                        height: Math.min(resultsColumn.implicitHeight, 150)
+                        contentWidth: width
+                        contentHeight: resultsColumn.implicitHeight
+                        clip: true
+                        boundsBehavior: Flickable.StopAtBounds
+
+                        Column {
+                            id: resultsColumn
+                            width: parent.width
+                            spacing: 1
+
+                            Repeater {
+                                model: WeatherData.searchResults
+
+                                delegate: Rectangle {
+                                    required property var modelData
+                                    width: parent.width
+                                    implicitHeight: resultText.implicitHeight + 8
+                                    radius: 0
+                                    color: resultMouse.containsMouse ? Colors.primary : "transparent"
+
+                                    Text {
+                                        id: resultText
+                                        anchors.left: parent.left
+                                        anchors.right: parent.right
+                                        anchors.verticalCenter: parent.verticalCenter
+                                        anchors.margins: 4
+                                        elide: Text.ElideRight
+                                        text: modelData.description ? (modelData.name + " — " + modelData.description) : modelData.name
+                                        font.family: Appearance.fontFamily
+                                        font.pixelSize: Appearance.fontSizeSmall
+                                        color: resultMouse.containsMouse ? Colors.primaryText : Colors.foreground
+                                    }
+
+                                    MouseArea {
+                                        id: resultMouse
+                                        anchors.fill: parent
+                                        hoverEnabled: true
+                                        cursorShape: Qt.PointingHandCursor
+                                        onClicked: {
+                                            WeatherData.selectLocation(modelData.name, modelData.latitude, modelData.longitude)
+                                            root.searchOpen = false
+                                            root.searchQuery = ""
+                                            WeatherData.searchResults = []
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+
+                // Humidity / wind — same two-stat layout, just laid out as
+                // a row of icon+value pairs rather than full sentences.
+                RowLayout {
+                    visible: WeatherData.hasLocation && !WeatherData.locating
+                    width: parent.width
+                    spacing: 16
+
+                    RowLayout {
+                        spacing: 4
+                        Text {
+                            text: "water_drop"
+                            font.family: Appearance.iconFontFamilyRounded
+                            font.variableAxes: Appearance.iconFontAxes
+                            font.pixelSize: 14
+                            color: Colors.muted
+                        }
+                        Text {
+                            text: WeatherData.humidity + "%"
+                            font.family: Appearance.fontFamily
+                            font.pixelSize: Appearance.fontSizeSmall
+                            color: Colors.foreground
+                        }
+                    }
+
+                    RowLayout {
+                        spacing: 4
+                        Text {
+                            text: "air"
+                            font.family: Appearance.iconFontFamilyRounded
+                            font.variableAxes: Appearance.iconFontAxes
+                            font.pixelSize: 14
+                            color: Colors.muted
+                        }
+                        Text {
+                            text: Math.round(WeatherData.windKmh) + " km/h"
+                            font.family: Appearance.fontFamily
+                            font.pixelSize: Appearance.fontSizeSmall
+                            color: Colors.foreground
+                        }
+                    }
+                }
+
+                Rectangle {
+                    visible: WeatherData.forecast.length > 0
+                    width: parent.width
+                    height: 1
+                    color: Colors.muted
+                }
+
+                RowLayout {
+                    visible: WeatherData.forecast.length > 0
+                    width: parent.width
+                    spacing: 4
+
+                    Repeater {
+                        model: WeatherData.forecast
+
+                        delegate: ColumnLayout {
+                            required property var modelData
+                            Layout.fillWidth: true
+                            spacing: 2
+
+                            Text {
+                                Layout.alignment: Qt.AlignHCenter
+                                text: Qt.formatDateTime(new Date(modelData.date + "T12:00:00"), "ddd")
+                                font.family: Appearance.fontFamily
+                                font.pixelSize: Appearance.fontSizeSmall
+                                color: Colors.muted
+                            }
+
+                            Text {
+                                Layout.alignment: Qt.AlignHCenter
+                                text: WeatherData.iconFor(modelData.code, true)
+                                font.family: Appearance.iconFontFamilyRounded
+                                font.variableAxes: Appearance.iconFontAxes
+                                font.pixelSize: 18
+                                color: Colors.foreground
+                            }
+
+                            Text {
+                                Layout.alignment: Qt.AlignHCenter
+                                text: Math.round(modelData.maxC) + "°/" + Math.round(modelData.minC) + "°"
+                                font.family: Appearance.fontFamily
+                                font.pixelSize: Appearance.fontSizeSmall
+                                color: Colors.foreground
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

dotfiles/.config/quickshell/modules/bar/Workspaces.qml

@@ -37,7 +37,8 @@ RowLayout {
             MouseArea {
                 anchors.fill: parent
                 cursorShape: Qt.PointingHandCursor
-                onClicked: Hyprland.dispatch("workspace " + modelData.name)
+                // Hyprland's Lua config expects Lua syntax from dispatch
+                onClicked: Hyprland.dispatch("hl.dsp.focus({ workspace = " + JSON.stringify(modelData.id > 0 ? modelData.id : modelData.name) + " })")
             }
         }
     }

dotfiles/.config/quickshell/modules/osd/VolumeOsd.qml

@@ -11,16 +11,13 @@ PanelWindow {
     color: "transparent"
     exclusiveZone: 0
 
-    // Top-right, just under the bar — same fixed distance from the bar and
+    // Bottom-center: anchoring only the bottom edge lets the layer shell
-    // screen edge (Appearance.spacing) that every popup opened from the bar
+    // center it horizontally.
-    // itself uses, so this lines up with them instead of floating
+    anchors { bottom: true }
-    // bottom-center.
+    margins.bottom: Appearance.spacing * 4
-    anchors { top: true; right: true }
-    margins.top: Appearance.spacing
-    margins.right: Appearance.spacing
 
-    implicitWidth: 272
+    implicitWidth: 300
-    implicitHeight: 54
+    implicitHeight: 60
 
     WlrLayershell.layer: WlrLayer.Overlay
     WlrLayershell.namespace: "quickshell:osd"
@@ -49,13 +46,13 @@ PanelWindow {
 
         RowLayout {
             anchors.fill: parent
-            anchors.margins: 14
+            anchors.margins: 15
-            spacing: 12
+            spacing: 13
 
             Text {
-                font.family: Appearance.iconFontFamily
+                font.family: Appearance.iconFontFamilyRounded
                 font.variableAxes: Appearance.iconFontAxes
-                font.pixelSize: 18
+                font.pixelSize: 21
                 color: Colors.foreground
                 text: {
                     const audio = osd.sink ? osd.sink.audio : null
@@ -67,7 +64,7 @@ PanelWindow {
             Item {
                 id: slider
                 Layout.fillWidth: true
-                implicitHeight: 16
+                implicitHeight: 18
 
                 readonly property real value: osd.sink && osd.sink.audio ? osd.sink.audio.volume : 0
                 readonly property bool enabled: !!osd.sink
@@ -76,7 +73,7 @@ PanelWindow {
                     id: track
                     anchors.verticalCenter: parent.verticalCenter
                     width: parent.width
-                    height: 4
+                    height: 5
                     radius: 0
                     color: Colors.muted
                     opacity: 0.35
@@ -85,15 +82,15 @@ PanelWindow {
                     anchors.verticalCenter: parent.verticalCenter
                     anchors.left: parent.left
                     width: track.width * Math.max(0, Math.min(1, slider.value))
-                    height: 4
+                    height: 5
                     radius: 0
                     color: Colors.primary
                     opacity: slider.enabled ? 1 : 0.4
                 }
                 Rectangle {
-                    width: 12
+                    width: 14
-                    height: 12
+                    height: 14
-                    radius: 6
+                    radius: 7
                     color: Colors.primary
                     opacity: slider.enabled ? 1 : 0.4
                     anchors.verticalCenter: parent.verticalCenter
@@ -113,10 +110,10 @@ PanelWindow {
             }
 
             Text {
-                Layout.preferredWidth: 32
+                Layout.preferredWidth: 38
                 horizontalAlignment: Text.AlignRight
                 font.family: Appearance.fontFamily
-                font.pixelSize: Appearance.fontSizeSmall
+                font.pixelSize: 13
                 color: Colors.muted
                 text: Math.round(slider.value * 100) + "%"
             }

dotfiles/.config/quickshell/scripts/CheckQuickshellSetup.sh

@@ -0,0 +1,274 @@
+#!/bin/bash
+# Pre-flight check for everything this quickshell config depends on outside
+# its own QML — fonts, the compositor, backing D-Bus services, and the
+# external CLIs individual bar modules shell out to. Run this after
+# installing/stowing quickshell on a new machine, before assuming the bar
+# is just going to work.
+#
+# Usage: ./CheckQuickshellSetup.sh [path-to-quickshell-config]
+# Defaults to $XDG_CONFIG_HOME/quickshell or ~/.config/quickshell.
+
+set -uo pipefail
+
+QS_DIR="${1:-${XDG_CONFIG_HOME:-$HOME/.config}/quickshell}"
+
+PASS=0
+WARN=0
+FAIL=0
+
+c_green="\033[0;32m"; c_yellow="\033[0;33m"; c_red="\033[0;31m"; c_reset="\033[0m"
+
+pass() { printf "  ${c_green}✓${c_reset} %s\n" "$1"; PASS=$((PASS+1)); }
+warn() { printf "  ${c_yellow}!${c_reset} %s\n" "$1"; WARN=$((WARN+1)); }
+fail() { printf "  ${c_red}✗${c_reset} %s\n" "$1"; FAIL=$((FAIL+1)); }
+section() { printf "\n%s\n" "$1"; }
+
+svc_state() {
+    # active / inactive / missing / no-systemctl. $1 = unit, $2 = --user (optional)
+    # NB: capture-then-here-string, not `cmd | grep -q`. Under `set -o
+    # pipefail`, grep -q exits the instant it finds a match, SIGPIPE-ing a
+    # still-writing producer — that producer's non-zero exit (not grep's
+    # success) becomes the pipeline's status, which reads as "not found"
+    # even when it was. Verified this actually happens with fc-list below.
+    if ! command -v systemctl >/dev/null 2>&1; then echo "no-systemctl"; return; fi
+    local unit_files
+    unit_files=$(systemctl ${2:-} list-unit-files "$1" 2>/dev/null)
+    if grep -q "$1" <<< "$unit_files"; then
+        systemctl ${2:-} is-active "$1" 2>/dev/null || echo "inactive"
+    else
+        echo "missing"
+    fi
+}
+
+# --- 0. Quickshell itself + config files present ----------------------------
+
+section "Quickshell core"
+
+if command -v quickshell >/dev/null 2>&1; then
+    ver=$(quickshell --version 2>&1 | head -1)
+    pass "quickshell found ($(command -v quickshell)) — $ver"
+else
+    fail "quickshell binary not found on PATH — install it before anything else here matters"
+fi
+
+for f in "shell.qml" "config/Appearance.qml" "config/Colors.qml" "config/qmldir"; do
+    if [ -f "$QS_DIR/$f" ]; then
+        pass "found $f"
+    else
+        fail "missing $QS_DIR/$f — dotfiles not fully stowed/symlinked here?"
+    fi
+done
+
+# Nearly every module (ActiveWindow, Workspaces, PowerButton, PanelWindow's
+# layer-shell surfaces, HyprlandFocusGrab) assumes a live Hyprland session.
+if [ -n "${HYPRLAND_INSTANCE_SIGNATURE:-}" ] && command -v hyprctl >/dev/null 2>&1 && hyprctl monitors >/dev/null 2>&1; then
+    pass "Hyprland is the running compositor"
+else
+    fail "Hyprland doesn't appear to be running — Quickshell.Hyprland and the layer-shell bar will not function"
+fi
+
+# --- 1. Fonts -----------------------------------------------------------------
+
+section "Fonts"
+
+if command -v fc-list >/dev/null 2>&1; then
+    # Captured once, then grepped via here-string — see the pipefail/SIGPIPE
+    # note on svc_state() above; fc-list's output is exactly what triggers it.
+    fc_out=$(fc-list)
+
+    if grep -qi "Material Symbols Outlined" <<< "$fc_out"; then
+        pass "Material Symbols Outlined installed"
+    else
+        fail "Material Symbols Outlined not found — install 'ttf-material-symbols-variable' (AUR); every glyph icon in the bar/panels will render as fallback text without it"
+    fi
+
+    if grep -qi "CaskaydiaCove Nerd Font Mono" <<< "$fc_out"; then
+        pass "CaskaydiaCove Nerd Font Mono installed"
+    else
+        fail "CaskaydiaCove Nerd Font Mono not found — install a Cascadia Code Nerd Font package; clock/labels/window title use it"
+    fi
+else
+    warn "fc-list not found (fontconfig missing?) — can't verify fonts"
+fi
+
+# --- 2. Backing services for native Quickshell modules ----------------------
+# These modules talk to system services directly over D-Bus rather than
+# shelling out — the service being up is the actual dependency, not a CLI.
+
+section "Backing services (native QML modules)"
+
+st=$(svc_state NetworkManager.service)
+case "$st" in
+    active) pass "NetworkManager.service active — Quickshell.Networking (NetworkIndicator)" ;;
+    missing) fail "NetworkManager not installed — required by NetworkIndicator.qml" ;;
+    *) fail "NetworkManager.service is $st — run: sudo systemctl enable --now NetworkManager" ;;
+esac
+
+st=$(svc_state bluetooth.service)
+case "$st" in
+    active) pass "bluetooth.service active — Quickshell.Bluetooth (BluetoothIndicator)" ;;
+    missing) fail "bluez not installed — required by BluetoothIndicator.qml" ;;
+    *) fail "bluetooth.service is $st — run: sudo systemctl enable --now bluetooth" ;;
+esac
+
+# Pipewire/wireplumber are user-session services, not system ones.
+st=$(svc_state pipewire.service --user)
+case "$st" in
+    active) pass "pipewire.service (user) active — Quickshell.Services.Pipewire (Volume/VolumeOsd)" ;;
+    missing) fail "pipewire not installed — required by Volume.qml/VolumeOsd.qml" ;;
+    *) fail "pipewire.service (user) is $st — run: systemctl --user enable --now pipewire pipewire-pulse wireplumber" ;;
+esac
+
+st=$(svc_state wireplumber.service --user)
+case "$st" in
+    active) pass "wireplumber.service (user) active" ;;
+    missing) warn "wireplumber not installed — pipewire falls back to pipewire-media-session if present, otherwise volume control may misbehave" ;;
+    *) fail "wireplumber.service (user) is $st — run: systemctl --user enable --now wireplumber" ;;
+esac
+
+# --- 3. External CLIs shelled out to via Process ----------------------------
+
+section "External CLIs (Quickshell.Io Process calls)"
+
+check_bin() {
+    # $1 = binary, $2 = which module(s) use it, $3 = fail|warn on missing
+    if command -v "$1" >/dev/null 2>&1; then
+        pass "$1 found — used by $2"
+    elif [ "$3" = "warn" ]; then
+        warn "$1 not found — used by $2 (optional on this machine)"
+    else
+        fail "$1 not found — used by $2"
+    fi
+}
+
+check_bin nmcli   "NetworkIndicator.qml (DNS provider panel, connection queries)" fail
+check_bin ip      "NetworkIndicator.qml (gateway/IP lookups)" fail
+check_bin ping    "NetworkIndicator.qml (latency/packet-loss stat)" fail
+check_bin cat     "NetworkIndicator.qml (/sys/class/net throughput counters)" fail
+check_bin systemctl "PowerButton.qml (suspend/hibernate/reboot/poweroff)" fail
+check_bin tailscale  "TailscaleIndicator.qml / VpnExclusivity" warn
+check_bin mullvad    "VpnIndicator.qml / VpnExclusivity" warn
+check_bin protonvpn  "VpnIndicator.qml / VpnExclusivity" warn
+
+have_tailscale=0; have_mullvad=0; have_proton=0
+command -v tailscale >/dev/null 2>&1 && have_tailscale=1
+command -v mullvad   >/dev/null 2>&1 && have_mullvad=1
+command -v protonvpn >/dev/null 2>&1 && have_proton=1
+
+if [ $have_mullvad -eq 0 ] && [ $have_proton -eq 0 ]; then
+    warn "neither Mullvad nor ProtonVPN CLI is installed — VpnIndicator.qml will show both as 'Not installed'"
+fi
+
+# Keep in sync with homeWgConnection in VpnIndicator.qml.
+if nmcli -g connection.type connection show unifi-home >/dev/null 2>&1; then
+    pass "NetworkManager profile 'unifi-home' exists — used by VpnIndicator.qml (Home/UniFi row)"
+else
+    warn "no NetworkManager profile 'unifi-home' — import one from the VPN panel's 'Add config' button (optional)"
+fi
+
+# The 'Add config' button's file chooser (scripts/PickFile.py) talks to
+# xdg-desktop-portal over D-Bus via PyGObject.
+if python3 -c "from gi.repository import Gio" >/dev/null 2>&1; then
+    pass "PyGObject available — used by PickFile.py (VPN 'Add config' file chooser)"
+else
+    warn "PyGObject (python-gobject) missing — the VPN panel's 'Add config' button can't open a file chooser"
+fi
+
+# --- 4. VPN daemons + functional status (Mullvad/ProtonVPN/Tailscale) -------
+# The exclusivity logic (VpnExclusivity.qml backing off Tailscale when a
+# commercial VPN connects) is pure QML and ships with the dotfiles — it
+# needs no setup of its own. What varies per machine is whether these three
+# are actually installed, enabled, and callable without a password prompt.
+
+section "VPN dual-setup (Mullvad/ProtonVPN + Tailscale)"
+
+if [ $have_tailscale -eq 1 ]; then
+    st=$(svc_state tailscaled.service)
+    case "$st" in
+        active) pass "tailscaled.service is active" ;;
+        missing) fail "tailscaled.service not found — reinstall tailscale" ;;
+        *) fail "tailscaled.service is $st — run: sudo systemctl enable --now tailscaled" ;;
+    esac
+
+    if out=$(timeout 5 tailscale status --json 2>&1); then
+        if python3 -c "import json,sys; json.load(sys.stdin)" >/dev/null 2>&1 <<< "$out"; then
+            pass "tailscale status --json returns valid JSON"
+        else
+            warn "tailscale status --json returned non-JSON output"
+        fi
+    else
+        fail "tailscale status --json failed: $(echo "$out" | head -1)"
+    fi
+fi
+
+if [ $have_mullvad -eq 1 ]; then
+    st=$(svc_state mullvad-daemon.service)
+    case "$st" in
+        active) pass "mullvad-daemon.service is active" ;;
+        missing) fail "mullvad-daemon.service not found — reinstall the Mullvad package" ;;
+        *) fail "mullvad-daemon.service is $st — run: sudo systemctl enable --now mullvad-daemon" ;;
+    esac
+
+    if out=$(timeout 5 mullvad status --json 2>&1); then
+        if python3 -c "import json,sys; json.load(sys.stdin)" >/dev/null 2>&1 <<< "$out"; then
+            pass "mullvad status --json returns valid JSON"
+        else
+            warn "mullvad status --json returned non-JSON output"
+        fi
+    else
+        fail "mullvad status --json failed: $(echo "$out" | head -1)"
+    fi
+fi
+
+if [ $have_proton -eq 1 ]; then
+    # ProtonVPN's CLI drives connections through NetworkManager rather than
+    # its own daemon — already checked above, just re-verified here in context.
+    if out=$(timeout 5 protonvpn status 2>&1); then
+        if grep -qi "^Status:" <<< "$out"; then
+            pass "protonvpn status returns a parseable 'Status:' line"
+        else
+            warn "protonvpn status has no 'Status:' line — applyProtonStatus() in VpnIndicator.qml may misread it: $(echo "$out" | head -1)"
+        fi
+    else
+        fail "protonvpn status failed: $(echo "$out" | head -1)"
+    fi
+fi
+
+ts_up=0; mv_up=0; pv_up=0
+# Same capture-then-here-string reasoning as above — these outputs are small
+# enough that the SIGPIPE race is unlikely, but there's no upside to relying
+# on that instead of just being consistent.
+[ $have_tailscale -eq 1 ] && grep -q '"BackendState":"Running"' <<< "$(tailscale status --json 2>/dev/null)" && ts_up=1
+[ $have_mullvad -eq 1 ] && grep -qi "^Connected" <<< "$(mullvad status 2>/dev/null)" && mv_up=1
+[ $have_proton -eq 1 ] && grep -qi "^Status:\s*Connected" <<< "$(protonvpn status 2>/dev/null)" && pv_up=1
+
+active_count=$((ts_up + mv_up + pv_up))
+if [ $active_count -le 1 ]; then
+    pass "at most one tunnel active right now (tailscale=$ts_up mullvad=$mv_up protonvpn=$pv_up)"
+else
+    warn "more than one tunnel is up right now (tailscale=$ts_up mullvad=$mv_up protonvpn=$pv_up) — bring extras down manually; quickshell only enforces exclusivity when you toggle from its own UI"
+fi
+
+# --- 5. System tray (currently disabled in Bar.qml) -------------------------
+
+section "System tray (Tray.qml)"
+
+if grep -q "^\s*//\s*Tray\s*{}" "$QS_DIR/modules/bar/Bar.qml" 2>/dev/null; then
+    warn "Tray {} is commented out in Bar.qml — skipping icon-theme check (nothing to render)"
+elif [ -f "$QS_DIR/modules/bar/Bar.qml" ]; then
+    if command -v gtk-update-icon-cache >/dev/null 2>&1 || [ -d /usr/share/icons/hicolor ]; then
+        pass "an icon theme (at least hicolor) is present for Quickshell.Services.SystemTray icon lookups"
+    else
+        warn "no icon theme found — tray icons may render blank"
+    fi
+fi
+
+# --- Summary -----------------------------------------------------------------
+
+section "Summary"
+printf "  ${c_green}%d passed${c_reset}, ${c_yellow}%d warnings${c_reset}, ${c_red}%d failed${c_reset}\n" "$PASS" "$WARN" "$FAIL"
+
+if [ $FAIL -gt 0 ]; then
+    exit 1
+fi
+exit 0

dotfiles/.config/quickshell/scripts/ImportUnifiWireguard.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+# Imports a UniFi WireGuard VPN Server client config into NetworkManager
+# under the profile name VpnIndicator.qml expects (homeWgConnection,
+# "unifi-home" by default), so the bar's VPN panel can toggle it.
+#
+# Get the .conf from UniFi Network: Settings → VPN → VPN Server → your
+# WireGuard server → Add Client → Download.
+#
+# Usage: ./ImportUnifiWireguard.sh <client.conf> [profile-name] [--replace]
+#        ./ImportUnifiWireguard.sh --pick [profile-name] [--replace]
+#
+# --pick opens a file chooser (PickFile.py) instead of taking a path — this
+# is what the VPN panel's "Add config" button runs. Exits 3 if cancelled.
+#
+# NetworkManager names both the profile and the interface after the file's
+# basename, so the config is copied to <profile-name>.conf first (interface
+# names max out at 15 chars). The private key ends up in a root-only file
+# under /etc/NetworkManager/system-connections — delete the downloaded
+# .conf afterwards.
+
+set -euo pipefail
+
+replace=0
+pick=0
+args=()
+for a in "$@"; do
+    case "$a" in
+        --replace) replace=1 ;;
+        --pick) pick=1 ;;
+        -h|--help) sed -n '2,19p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+        *) args+=("$a") ;;
+    esac
+done
+
+if [ $pick -eq 1 ]; then
+    conf=""
+    name="${args[0]:-unifi-home}"
+    rc=0
+    conf=$("$(dirname "$0")/PickFile.py" "Select UniFi WireGuard config" "*.conf") || rc=$?
+    if [ $rc -eq 1 ]; then echo "Cancelled" >&2; exit 3; fi
+    if [ $rc -ne 0 ]; then echo "Couldn't open a file chooser" >&2; exit 1; fi
+else
+    conf="${args[0]:-}"
+    name="${args[1]:-unifi-home}"
+fi
+
+if [ -z "$conf" ] || [ ! -f "$conf" ]; then
+    echo "Usage: $0 <client.conf> [profile-name] [--replace]" >&2
+    exit 1
+fi
+if ! [[ "$name" =~ ^[A-Za-z0-9_-]{1,15}$ ]]; then
+    echo "Profile name must be 1-15 chars of [A-Za-z0-9_-] (it doubles as the interface name)" >&2
+    exit 1
+fi
+
+if nmcli -g connection.id connection show "$name" >/dev/null 2>&1; then
+    if [ $replace -eq 1 ]; then
+        nmcli connection delete "$name" >/dev/null
+    else
+        echo "A NetworkManager profile named '$name' already exists — rerun with --replace to overwrite it" >&2
+        exit 1
+    fi
+fi
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+install -m 600 "$conf" "$tmpdir/$name.conf"
+
+if ! grep -qi '^\[Interface\]' "$tmpdir/$name.conf" || ! grep -qi '^\[Peer\]' "$tmpdir/$name.conf"; then
+    echo "$(basename "$conf") doesn't look like a WireGuard config" >&2
+    exit 1
+fi
+
+nmcli connection import type wireguard file "$tmpdir/$name.conf"
+# Only ever brought up deliberately from the bar — never on boot or on
+# joining a network, where it'd silently fight Tailscale/Mullvad/ProtonVPN.
+nmcli connection modify "$name" connection.autoconnect no
+# Import itself defaults to autoconnect=yes, so NetworkManager may already
+# have started bringing it up in the moment before the modify above.
+nmcli connection down "$name" >/dev/null 2>&1 || true
+
+echo
+echo "Imported as '$name'. Toggle it from the VPN panel, or: nmcli connection up $name"
+echo "You can now delete $conf"

dotfiles/.config/quickshell/scripts/PickFile.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+# Opens the xdg-desktop-portal file chooser and prints the picked file's
+# path. Quickshell has no usable file dialog of its own (QtQuick.Dialogs'
+# fallback renders inside the calling window, i.e. the tiny bar popup), and
+# no zenity/kdialog is installed — the portal goes through
+# xdg-desktop-portal-gtk, which is.
+#
+# Usage: PickFile.py [title] [glob ...]
+# Exits 0 and prints the path on a pick, 1 on cancel, 2 on error.
+
+import os
+import sys
+from urllib.parse import unquote, urlparse
+
+from gi.repository import Gio, GLib
+
+title = sys.argv[1] if len(sys.argv) > 1 else "Open File"
+globs = sys.argv[2:]
+
+try:
+    bus = Gio.bus_get_sync(Gio.BusType.SESSION, None)
+except GLib.Error as e:
+    print(f"No session bus: {e.message}", file=sys.stderr)
+    sys.exit(2)
+
+# The portal answers on a Request object whose path is derived from our
+# unique bus name and handle_token, so subscribe to it before calling —
+# otherwise a fast response could arrive before we're listening.
+token = f"quickshell_{os.getpid()}"
+sender = bus.get_unique_name().lstrip(":").replace(".", "_")
+handle = f"/org/freedesktop/portal/desktop/request/{sender}/{token}"
+
+loop = GLib.MainLoop()
+result = {"code": 2, "uris": []}
+
+
+def on_response(_conn, _sender, _path, _iface, _signal, params):
+    code, results = params.unpack()
+    result["code"] = code
+    result["uris"] = results.get("uris", [])
+    loop.quit()
+
+
+bus.signal_subscribe("org.freedesktop.portal.Desktop", "org.freedesktop.portal.Request",
+                     "Response", handle, None, Gio.DBusSignalFlags.NONE, on_response)
+
+options = {
+    "handle_token": GLib.Variant("s", token),
+    "modal": GLib.Variant("b", True),
+}
+filters = []
+if globs:
+    filters.append((", ".join(globs), [(0, g) for g in globs]))
+filters.append(("All files", [(0, "*")]))
+options["filters"] = GLib.Variant("a(sa(us))", filters)
+downloads = os.path.expanduser("~/Downloads")
+if os.path.isdir(downloads):
+    options["current_folder"] = GLib.Variant("ay", downloads.encode() + b"\0")
+
+try:
+    bus.call_sync("org.freedesktop.portal.Desktop", "/org/freedesktop/portal/desktop",
+                  "org.freedesktop.portal.FileChooser", "OpenFile",
+                  GLib.Variant("(ssa{sv})", ("", title, options)),
+                  GLib.VariantType("(o)"), Gio.DBusCallFlags.NONE, -1, None)
+except GLib.Error as e:
+    print(f"File chooser portal unavailable: {e.message}", file=sys.stderr)
+    sys.exit(2)
+
+loop.run()
+
+# Response codes: 0 = picked, 1 = cancelled, 2 = other failure.
+if result["code"] != 0 or not result["uris"]:
+    sys.exit(1 if result["code"] == 1 else 2)
+print(unquote(urlparse(result["uris"][0]).path))

dotfiles/.config/quickshell/scripts/sync-dotfiles.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Run by update-system.sh inside the update terminal, before the system
+# update — pulls the dotfiles repo and re-stows it so both machines pick up
+# config changes on every update.
+#
+# Never fails the update: a pull that can't fast-forward (local commits or
+# uncommitted changes in the way) or a stow conflict just prints a warning
+# and leaves things as they were, then the system update carries on.
+
+DOTFILES="$HOME/Projects/dotfiles"
+
+warn() { printf '\033[1;33m%s\033[0m\n' "$*"; }
+info() { printf '\033[1;36m%s\033[0m\n' "$*"; }
+
+if [ ! -d "$DOTFILES/.git" ]; then
+  warn "Dotfiles repo not found at $DOTFILES — skipping."
+  exit 0
+fi
+
+info "Pulling dotfiles..."
+# Fetch and merge separately so the warning says which one went wrong — the
+# remote is SSH via Bitwarden's agent, so a failed fetch is almost always
+# Bitwarden being closed or locked.
+if ! git -C "$DOTFILES" fetch; then
+  warn "Couldn't reach the dotfiles remote — is Bitwarden open and unlocked? Skipping stow."
+  echo
+  exit 0
+fi
+# --ff-only so a diverged branch never produces a surprise merge commit;
+# sort that out by hand instead.
+if ! git -C "$DOTFILES" merge --ff-only; then
+  warn "Couldn't fast-forward dotfiles (local changes or diverged branch) — skipping stow."
+  echo
+  exit 0
+fi
+
+if ! command -v stow &> /dev/null; then
+  warn "stow not installed — skipping."
+  exit 0
+fi
+
+info "Applying dotfiles with stow..."
+# -R restows: drops links for files removed from the repo and adds new ones.
+if stow -R -d "$DOTFILES" -t "$HOME" dotfiles; then
+  info "Dotfiles applied."
+else
+  warn "stow hit a conflict — nothing was changed. Fix it and re-run:"
+  warn "  stow -R -d $DOTFILES -t ~ dotfiles"
+fi
+echo

dotfiles/.config/quickshell/scripts/update-system.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+# Launched by SystemUpdate.qml (top bar, next to the clock) — opens a
+# terminal running whatever update command fits this distro, then notifies
+# once it's done. Ported from the old waybar custom/updater module
+# (.config/waybar/scripts/update-distro.sh); kept multi-distro even though
+# this machine is Arch, since these dotfiles aren't.
+#
+# The window it opens is floated + centered by a matching Hyprland rule
+# (system-update-terminal, in .config/hypr/UserConfigs/WindowRules.conf),
+# same treatment as Bitwarden's window, rather than tiling into whatever
+# workspace you happened to be on.
+
+iDIR="$HOME/.config/swaync/images"
+
+if ! command -v foot &> /dev/null; then
+  notify-send -i "$iDIR/error.png" "Need foot:" "foot terminal not found. Please install foot terminal."
+  exit 1
+fi
+
+# Printed inside the terminal before the actual update command runs, so it
+# reads as "updating" from the first frame rather than looking like an
+# empty/stuck window while pacman/apt/etc. take a moment to start printing.
+#
+# foot runs this in a fresh `bash -c`, which doesn't inherit shell functions
+# from this script's own environment (export -f only reaches bash processes
+# forked from *this* one, not whatever foot execs) — so instead, the
+# already-colored text is built once here with real escape bytes ($'...'),
+# then %q-quoted into a self-contained `echo '...'` that reproduces those
+# same bytes verbatim when the child bash parses it.
+msg="  Updating System — please wait  "
+line=$(printf '=%.0s' $(seq 1 ${#msg}))
+banner_text=$'\033[1;36m'"$line"$'\033[0m\n\033[1;36m'"$msg"$'\033[0m\n\033[1;36m'"$line"$'\033[0m\n\n'
+BANNER="echo $(printf '%q' "$banner_text")"
+
+if command -v paru &> /dev/null; then
+  CMD="paru -Syu"
+  LABEL="Arch-based system"
+elif command -v yay &> /dev/null; then
+  CMD="yay -Syu"
+  LABEL="Arch-based system"
+elif command -v dnf &> /dev/null; then
+  CMD="sudo dnf update --refresh -y"
+  LABEL="Fedora system"
+elif command -v apt &> /dev/null; then
+  CMD="sudo apt update && sudo apt upgrade -y"
+  LABEL="Debian/Ubuntu system"
+elif command -v zypper &> /dev/null; then
+  CMD="sudo zypper dup -y"
+  LABEL="openSUSE system"
+else
+  notify-send -i "$iDIR/error.png" -u critical "Unsupported system" "This script does not support your distribution."
+  exit 1
+fi
+
+# Keeps the terminal open (whether the update succeeded or failed — read
+# always runs regardless, since it's ; not &&) until you press Enter,
+# instead of foot closing the instant the update command exits and taking
+# any output/errors with it.
+WAIT_PROMPT="echo; read -p 'Update finished — press Enter to close...'"
+
+# Pull + re-stow the dotfiles first, so config changes from the other machine
+# land alongside the package update.
+SYNC="$(printf '%q' "$(dirname "$0")/sync-dotfiles.sh")"
+
+foot -T update bash -c "$BANNER; $SYNC; $CMD; $WAIT_PROMPT"
+notify-send -i "$iDIR/profile-pic.jpg" -u low "$LABEL" 'has been updated.'

dotfiles/.config/quickshell/shell.qml

@@ -4,7 +4,11 @@ import "./modules/osd"
 
 ShellRoot {
     Variants {
-        model: Quickshell.screens
+        // Exclude the Sunshine headless virtual monitor — nobody ever sees a
+        // bar there, but PanelWindow's exclusiveZone still reserves space for
+        // it, which left a black strip cut out of Steam Big Picture's
+        // fullscreen area on that output.
+        model: Quickshell.screens.filter(s => !s.name.startsWith("HEADLESS"))
 
         Bar {
             required property var modelData

dotfiles/.config/sunshine/.gitignore

@@ -0,0 +1,5 @@
+# Machine-local Sunshine state lives next to the stowed config; never commit it
+credentials/
+*.log
+*.log.*
+sunshine_state.json

dotfiles/.config/sunshine/apps.json

@@ -0,0 +1,47 @@
+{
+  "env": {
+    "PATH": "$(PATH):$(HOME)/.local/bin"
+  },
+  "apps": [
+    {
+      "name": "Desktop",
+      "image-path": "desktop.png"
+    },
+    {
+      "name": "Low Res Desktop",
+      "image-path": "desktop.png",
+      "prep-cmd": [
+        {
+          "do": "xrandr --output HDMI-1 --mode 1920x1080",
+          "undo": "xrandr --output HDMI-1 --mode 1920x1200"
+        }
+      ]
+    },
+    {
+      "name": "Steam Big Picture",
+      "detached": [
+        "setsid steam steam://open/bigpicture"
+      ],
+      "prep-cmd": [
+        {
+          "do": "/home/thomas/.config/sunshine/scripts/steam-bigpicture-prep.sh",
+          "undo": "setsid steam steam://close/bigpicture"
+        }
+      ],
+      "image-path": "steam.png"
+    },
+    {
+      "name": "Steam Big Picture (TV)",
+      "detached": [
+        "setsid steam steam://open/bigpicture"
+      ],
+      "prep-cmd": [
+        {
+          "do": "/home/thomas/.config/sunshine/scripts/steam-bigpicture-tv-prep.sh",
+          "undo": "/home/thomas/.config/sunshine/scripts/steam-bigpicture-tv-undo.sh"
+        }
+      ],
+      "image-path": "steam.png"
+    }
+  ]
+}

dotfiles/.config/sunshine/scripts/steam-bigpicture-prep.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Run before Sunshine launches Steam Big Picture: focus the headless virtual
+# monitor and park the cursor on it, so Big Picture (which spawns on whatever
+# monitor currently has focus/the mouse) opens there instead of wherever the
+# mouse happened to be.
+set -e
+hyprctl dispatch 'hl.dsp.focus({monitor = "HEADLESS-1"})'
+hyprctl dispatch 'hl.dsp.cursor.move({x = 5344, y = 540})'
+
+# Sunshine only flips the system default audio sink to sink-sunshine-stereo
+# after the streaming session/client handshake completes (~500ms after this
+# script runs and Steam is spawned) — see sunshine.log timestamps. If Steam's
+# own audio (SDL) initializes in that window, it binds to whatever was
+# default at the time (the real HDMI output) and never re-homes even after
+# Sunshine's swap. Set it here first so it's already correct before Steam
+# ever launches; Sunshine's own (redundant) swap right after is harmless.
+pactl set-default-sink sink-sunshine-stereo || true

dotfiles/.config/sunshine/scripts/steam-bigpicture-tv-prep.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# Run before Sunshine launches Steam Big Picture for the 4K TV target.
+# Switches the headless virtual monitor from its default 1728x1080@60
+# (used for the Steam Deck target) up to 3840x2160@60, then focuses it
+# and parks the cursor there so Big Picture opens on it. Reverted by
+# steam-bigpicture-tv-undo.sh once the stream ends.
+set -e
+# NOTE: this Hyprland build uses the Lua config layer, which rejects the
+# usual `hyprctl keyword monitor ...` syntax ("keyword can't work with
+# non-legacy parsers. Use eval.") — hl.monitor() via `hyprctl eval` is the
+# runtime equivalent of the hl.monitor() call in layout/monitors.lua.
+hyprctl eval 'hl.monitor({ output = "HEADLESS-1", mode = "3840x2160@60.00000", position = "4480x0", scale = 1.00000000, transform = 0, vrr = 0 })'
+hyprctl dispatch 'hl.dsp.focus({monitor = "HEADLESS-1"})'
+hyprctl dispatch 'hl.dsp.cursor.move({x = 6400, y = 1080})'
+
+# See steam-bigpicture-prep.sh for why this runs here instead of relying on
+# Sunshine's own post-handshake audio-sink swap.
+pactl set-default-sink sink-sunshine-stereo || true

dotfiles/.config/sunshine/scripts/steam-bigpicture-tv-undo.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+# Undo for steam-bigpicture-tv-prep.sh: close Big Picture and restore
+# HEADLESS-1 to its default mode (the one the Steam Deck target expects).
+set -e
+setsid steam steam://close/bigpicture
+hyprctl eval 'hl.monitor({ output = "HEADLESS-1", mode = "1728x1080@60.00000", position = "4480x0", scale = 1.00000000, transform = 0, vrr = 0 })'

dotfiles/.config/sunshine/sunshine.conf

@@ -0,0 +1,5 @@
+audio_sink = sink-sunshine-stereo
+csrf_allowed_origins = https://xol.twhomelab.local:47990
+nvenc_preset = 4
+output_name = HEADLESS-1
+global_prep_cmd = [{"do":"/home/thomas/.config/hypr/scripts/SunshineIdle.sh start","undo":"/home/thomas/.config/hypr/scripts/SunshineIdle.sh stop"}]

dotfiles/.config/waybar/config

@@ -13,7 +13,7 @@
         "tooltip-format": "{ipaddr} via {gwaddr}",
         "tooltip-format-disconnected": "Disconnected",
         "max-length": 50,
-        "on-click": "orbit toggle top-right",
+        "on-click": "nm-connection-editor",
         "on-click-right": "kitty -e nmtui",
         "format-icons": {
             "wifi": ["󰤯", "󰤟", "󰤢", "󰤥", "󰤨"],

dotfiles/.local/bin/Plex

@@ -0,0 +1,18 @@
+#!/bin/sh
+# Wrapper for the plex-desktop package's /usr/bin/Plex (-> /opt/plex-desktop/Plex.sh).
+#
+# QT_QUICK_CONTROLS_STYLE=org.hyprland.style is set globally in
+# hypr/core/env.lua for other Qt/QML apps' theming (hyprland-qt-support), but
+# Plex Desktop bundles its own private Qt/QML runtime that doesn't ship that
+# style plugin — inheriting the var makes it fail to load its UI and exit
+# immediately with "module \"org.hyprland.style\" is not installed" (see
+# ~/.local/share/plex/Logs/Plex.log). This dir is first on $PATH, so it
+# shadows /usr/bin/Plex for both a terminal launch and the .desktop entry
+# (Exec=Plex is PATH-resolved) without touching the global env var.
+# QT_QPA_PLATFORM: hypr env sets "wayland;xcb"; under Wayland the bundled
+# QtWebEngine never runs the web client and the window stays blank.
+unset QT_QUICK_CONTROLS_STYLE
+export QT_QPA_PLATFORM=xcb
+# Unset in the session; without it the X11 cursor in Plex is huge.
+export XCURSOR_SIZE=24
+exec /opt/plex-desktop/Plex.sh "$@"

dotfiles/.local/share/applications/tv.plex.PlexDesktop.desktop

@@ -0,0 +1,31 @@
+# User override of /usr/share/applications/tv.plex.PlexDesktop.desktop
+# (~/.local/share/applications takes XDG precedence over /usr/share for the
+# same filename, so this is picked up by app launchers instead automatically
+# — no association/mimeapps changes needed).
+#
+# QT_QPA_PLATFORM=xcb is kept from upstream: hypr env sets "wayland;xcb", and
+# under Wayland the bundled QtWebEngine never runs the web client (blank
+# window, no [Web] lines in Plex.log). XCURSOR_SIZE=24 is also kept from
+# upstream: it is unset in the session, so the X11 cursor comes out huge.
+#
+# Change from upstream: Exec unsets QT_QUICK_CONTROLS_STYLE and calls
+# the package's Plex.sh directly, bypassing $PATH entirely. Plex Desktop
+# bundles its own private Qt/QML runtime that doesn't ship the
+# "org.hyprland.style" QQC2 style hypr/core/env.lua sets globally for other
+# apps' theming — inheriting it makes Plex fail to load its UI and exit
+# immediately with "module \"org.hyprland.style\" is not installed" (see
+# ~/.local/share/plex/Logs/Plex.log). Going straight to the fixed install
+# path (rather than relying on the .local/bin/Plex wrapper shadowing
+# /usr/bin/Plex on $PATH) means this keeps working even if $PATH order ever
+# changes.
+[Desktop Entry]
+Type=Application
+Name=Plex
+Comment=Plex client for desktop computers
+Exec=env -u QT_QUICK_CONTROLS_STYLE QT_QPA_PLATFORM=xcb XCURSOR_SIZE=24 /opt/plex-desktop/Plex.sh
+Icon=tv.plex.PlexDesktop
+Terminal=false
+Categories=AudioVideo;Player;X-Media;
+X-Flatpak=tv.plex.PlexDesktop
+StartupWMClass=Plex
+Name[en_US]=Plex

dotfiles/.ssh/config

@@ -0,0 +1,18 @@
+Host gavin.twhomelab.local
+  HostName gavin.twhomelab.local
+  User thoams
+
+Host 192.168.1.87
+  HostName 192.168.1.87
+  User thoams
+  ForwardAgent yes
+
+Host 192.168.1.83
+  HostName 192.168.1.83
+  User thoams
+  ForwardAgent yes
+
+Host 192.168.1.86
+  HostName 192.168.1.86
+  User thoams
+  ForwardAgent yes

dotfiles/.zshrc

@@ -23,7 +23,7 @@ source $ZSH/oh-my-zsh.sh
 
 # My alias
 
-alias cl='clear'
+alias cl='clear && fastfetch'
 alias zed='zeditor'
 alias ssh-gavin='ssh thoams@192.168.1.83'
 alias ssh-raspberry-pi='ssh thoams@192.168.1.86'
@@ -51,3 +51,4 @@ export ZED_ALLOW_EMULATED_GPU=1
 fastfetch
 
 eval "$(oh-my-posh init zsh --config $HOME/.config/ohmyposh/zen.toml)"
+export PATH="$HOME/.local/share/turritopsis/flutter-sdk/bin:$PATH"

system/install.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Installs system-level config that stow can't manage (needs root).
+set -euo pipefail
+
+repo="$(cd "$(dirname "$0")" && pwd)"
+
+# pacman: shared [options] snippet
+sudo install -m644 "$repo/pacman/options.conf" /etc/pacman.d/options.conf
+if ! grep -q '^Include = /etc/pacman.d/options.conf' /etc/pacman.conf; then
+    sudo sed -i '/^\[options\]/a Include = /etc/pacman.d/options.conf' /etc/pacman.conf
+fi

system/packages-review.txt

@@ -0,0 +1,176 @@
+# ============================================================================
+# New-install package review — generated from this machine on 2026-10-11
+#
+# HOW TO REVIEW
+#   - Keep a line          -> it gets installed
+#   - Delete the line, or put a "#" at the start -> it gets skipped
+#   - Everything after "#" on a line is just a description for you
+#
+# Notes I flagged (look for "!!" below):
+#   - Hardware-specific packages (CPU microcode, NVIDIA driver) only make
+#     sense on matching hardware — the script can auto-detect these instead.
+#   - Some packages are leftovers from other setups (e.g. XFCE, waybar,
+#     orbit-wifi which you removed in commit 88484f8).
+# ============================================================================
+
+## ---------------- Official repos (pacman) ----------------
+adw-gtk-theme                      # Unofficial GTK 3 port of the libadwaita theme
+amd-ucode                          # Microcode update image for AMD CPUs  !! AMD CPU only — auto-detect?
+awww                               # An Answer to your Wayland Wallpaper Woes
+baobab                             # A graphical directory tree analyzer
+base                               # Minimal package set to define a basic Arch Linux installation
+base-devel                         # Basic tools to build Arch Linux packages
+blueman                            # GTK+ Bluetooth Manager
+bluez                              # Daemons for the bluetooth protocol stack
+bluez-utils                        # Development and debugging utilities for the bluetooth protocol stack
+btop                               # A monitor of system resources, bpytop ported to C++
+dolphin                            # KDE File Manager
+dunst                              # Customizable and lightweight notification-daemon  !! you use swaync for notifications
+efibootmgr                         # Linux user-space application to modify the EFI Boot Manager
+fastfetch                          # A feature-rich and performance oriented neofetch like system information tool
+ffmpeg                             # Complete solution to record, convert and stream audio and video
+filezilla                          # Fast and reliable FTP, FTPS and SFTP client
+firefox                            # Fast, Private & Safe Web Browser
+flatpak                            # Linux application sandboxing and distribution framework (formerly xdg-app)
+foot                               # Fast, lightweight, and minimalistic Wayland terminal emulator
+fzf                                # Command-line fuzzy finder
+galculator                         # GTK based scientific calculator
+#garcon                            # Freedesktop.org compliant menu library  !! XFCE desktop leftover?
+gdu                                # Fast disk usage analyzer
+git                                # the fast distributed version control system
+gnome-calendar                     # Simple and beautiful calendar application designed to perfectly fit the GNOME desktop
+gnome-disk-utility                 # Disk Management Utility for GNOME
+gnome-font-viewer                  # A font viewer utility for GNOME
+gnome-keyring                      # Stores passwords and encryption keys
+gnome-text-editor                  # A simple text editor for the GNOME desktop
+grim                               # Screenshot utility for Wayland
+gst-plugin-pipewire                # Multimedia graph framework - pipewire plugin
+gvfs                               # Virtual filesystem implementation for GIO
+gvfs-smb                           # Virtual filesystem implementation for GIO - SMB/CIFS backend (Windows file sharing)
+htop                               # Interactive process viewer
+hypridle                           # hyprland’s idle daemon  !! commented out in startup.lua
+hyprland                           # a highly customizable dynamic tiling Wayland compositor
+hyprlock                           # hyprland’s GPU-accelerated screen locking utility  !! hypridle is commented out in startup.lua
+hyprshot                           # Hyprland screenshot utility
+imv                                # Image viewer for Wayland and X11
+jq                                 # Command-line JSON processor
+kitty                              # A modern, hackable, featureful, OpenGL-based terminal emulator  !! you use foot as terminal (kitty config not in dotfiles)
+libgsf                             # Extensible I/O abstraction library for dealing with structured file formats
+libmatroska                        # Matroska library
+libpulse                           # A featureful, general-purpose sound server (client library)
+libva-nvidia-driver                # VA-API implementation that uses NVDEC as a backend  !! NVIDIA GPU only — auto-detect?
+linux                              # The Linux kernel and modules
+linux-firmware                     # Firmware files for Linux - Default set
+mkinitcpio                         # Modular initramfs image creation utility
+mkvtoolnix-cli                     # Set of tools to create, edit and inspect Matroska files
+mpv                                # a free, open source, and cross-platform media player
+mullvad-vpn-daemon                 # Mullvad VPN client (daemon and CLI)
+nano                               # Pico editor clone with enhancements
+network-manager-applet             # Applet for managing network connections
+networkmanager                     # Network connection manager and user applications
+noto-fonts                         # Google Noto TTF fonts
+noto-fonts-cjk                     # Google Noto CJK fonts
+noto-fonts-emoji                   # Google Noto Color Emoji font
+noto-fonts-extra                   # Google Noto TTF fonts - additional variants
+npm                                # JavaScript package manager
+nss-mdns                           # glibc plugin providing host name resolution via mDNS
+nvidia-open                        # NVIDIA open kernel modules  !! NVIDIA GPU only — auto-detect?
+pacman-contrib                     # Contributed scripts and tools for pacman systems
+pam-u2f                            # Universal 2nd Factor (U2F) PAM authentication module from Yubico
+papirus-icon-theme                 # Papirus icon theme
+pipewire                           # Low-latency audio/video router and processor
+pipewire-alsa                      # Low-latency audio/video router and processor - ALSA configuration
+pipewire-jack                      # Low-latency audio/video router and processor - JACK replacement
+pipewire-pulse                     # Low-latency audio/video router and processor - PulseAudio replacement
+pnpm                               # Fast, disk space efficient package manager
+polkit-kde-agent                   # Daemon providing a polkit authentication UI for KDE
+postgresql                         # Sophisticated object-relational DBMS
+postgresql-libs                    # Sophisticated object-relational DBMS - Client binaries and libraries
+proton-vpn-cli                     # Official ProtonVPN CLI Linux app
+qt5-wayland                        # Provides APIs for Wayland
+qt6-quickeffectmaker               # Qt Quick Effect Maker (QQEM) for creating and editing custom shader effects
+qt6-wayland                        # Provides APIs for Wayland
+rofi                               # A window switcher, application launcher and dmenu replacement
+sddm                               # QML based X11 and Wayland display manager
+slurp                              # Select a region in a Wayland compositor
+smartmontools                      # Control and monitor S.M.A.R.T. enabled ATA and SCSI Hard Drives
+steam                              # Valve's digital software delivery system
+stow                               # Manage installation of multiple softwares in the same directory tree
+sudo                               # Give certain users the ability to run some commands as root
+swaync                             # A simple GTK based notification daemon for Sway
+tailscale                          # A mesh VPN that makes it easy to connect your devices, wherever they are.
+thunar                             # Modern, fast and easy-to-use file manager for Xfce
+thunar-archive-plugin              # Adds archive operations to the Thunar file context menus
+thunar-media-tags-plugin           # Adds special features for media files to the Thunar File Manager
+thunar-shares-plugin               # Thunar plugin to quickly share a folder using Samba without requiring root access
+thunar-volman                      # Automatic management of removable drives and media for Thunar
+ttf-dejavu                         # Font family based on the Bitstream Vera Fonts with a wider range of characters
+ttf-iosevka-nerd                   # Patched font Iosevka from nerd fonts library
+ttf-jetbrains-mono                 # Typeface for developers, by JetBrains
+ttf-jetbrains-mono-nerd            # Patched font JetBrains Mono from nerd fonts library
+ttf-liberation                     # Font family which aims at metric compatibility with Arial, Times New Roman, and Courier New
+ttf-material-icons                 # Material Design icons by Google (deprecated classic Material Icons static style)
+ttf-material-symbols-variable      # Material Design icons by Google (Material Symbols - 4 axis variable)
+ttf-noto-nerd                      # Patched font Noto from nerd fonts library
+tumbler                            # Thumbnail service implementing the thumbnail management D-Bus specification
+uv                                 # An extremely fast Python package installer and resolver written in Rust
+uwsm                               # A standalone Wayland session manager
+vim                                # Vi Improved, a highly configurable, improved version of the vi text editor
+#waybar                             # Highly customizable Wayland bar for Sway and Wlroots based compositors  !! you've switched to quickshell (waybar is commented out in startup.lua)
+webp-pixbuf-loader                 # WebM GDK Pixbuf Loader library
+wget                               # Network utility to retrieve files from the web
+wireplumber                        # Session / policy manager implementation for PipeWire
+wofi                               # launcher for wlroots-based wayland compositors  !! you also have rofi — need both?
+wpa_supplicant                     # A utility providing key negotiation for WPA wireless networks
+xarchiver                          # GTK frontend to various command line archivers
+xdg-desktop-portal-hyprland        # xdg-desktop-portal backend for hyprland
+xdg-utils                          # Command line tools that assist applications with a variety of desktop integration tasks
+xfce4-appfinder                    # Application launcher and finder  !! XFCE desktop leftover?
+xfce4-panel                        # Panel for the Xfce desktop environment  !! XFCE desktop leftover?
+xfce4-power-manager                # Power Manager for Xfce  !! XFCE desktop leftover?
+xfce4-session                      # Xfce's session manager  !! XFCE desktop leftover?
+xfce4-settings                     # Xfce's Configuration System  !! XFCE desktop leftover?
+xfce4-terminal                     # A modern terminal emulator primarily for the Xfce desktop environment  !! XFCE desktop leftover?
+xfdesktop                          # Xfce's desktop manager  !! XFCE desktop leftover?
+xfwm4                              # Xfce's window manager  !! XFCE desktop leftover?
+zram-generator                     # Systemd unit generator for zram devices
+zsh                                # A very advanced and programmable command interpreter (shell) for UNIX
+
+## ---------------- AUR (installed via yay) ----------------
+bitwarden-bin                      # A secure and free password manager for all of your devices.
+caelestia-shell                    # The desktop shell for the Caelestia dotfiles  !! alternative quickshell config, not used by your shell.qml
+flutter-bin                        # Cross platform widget toolkit for Dart (monolithic)
+google-chrome                      # The popular web browser by Google (Stable Channel)
+hyprmod                            # Native GTK4/libadwaita settings app for Hyprland
+jellyfin-desktop-debug             # Detached debugging symbols for jellyfin-desktop  !! debug symbols, not needed
+minecraft-launcher                 # Official Minecraft Launcher
+orbit-wifi                         # A WiFi/Bluetooth manager for Wayland with glassmorphism UI  !! removed from your config in commit 88484f8
+plex-desktop                       # Plex desktop client for linux
+plexamp-bin                        # Modern music client for Plex.(Prebuilt version.Use system-wide electron)
+puddletag                          # An audio tag editor for GNU/Linux
+pwvucontrol                        # Pipewire volume control for GNOME
+python-pywal                       # Generate and change colorschemes on the fly
+raw-thumbnailer                    # A lightweight and fast raw image thumbnailer that can be used by file managers.
+seafile-client                     # GUI client for synchronizing your local files with seafile server
+sunshine                           # Self-hosted game stream host for Moonlight
+svt-av1-essential-git              # A no-nonsense SVT-AV1 encoder fork with sensible defaults and Quality of Life improvements  !! -git build, check if still needed
+ttf-icomoon-feather                # Icomoon feather font
+tumbler-extra-thumbnailers         # Customized thumbnailers for Tumbler
+turritopsis                        # Desktop Jellyfin client with mpv playback
+vesktop                            # A standalone Electron-based Discord app with Vencord & improved Linux support
+visual-studio-code-bin             # Visual Studio Code (vscode)
+waypaper                           # GUI wallpaper setter for Wayland and Xorg window managers. It works as a frontend for popular wallpaper backends like swaybg, swww, wallutils, hyprpaper and feh.
+yay                                # Yet another yogurt. Pacman wrapper and AUR helper written in go.  !! bootstrapped by the script itself anyway
+yay-debug                          # Detached debugging symbols for yay  !! debug symbols, not needed
+zen-browser-bin                    # Official package for Zen, a privacy-focused, feature packed Firefox-based web browser
+
+## ---------------- Flatpak (Flathub) ----------------
+com.makemkv.MakeMKV                # MakeMKV
+org.jellyfin.JellyfinDesktop       # Jellyfin Desktop
+
+## ---------------- Manually installed binaries (~/.local/bin) ----------------
+## These aren't from a package manager; I'd install them via their official installers.
+claude                             # Claude Code CLI (official install script)
+oh-my-posh                         # Prompt theme engine (official install script; your theme is already in dotfiles)
+ffmpeg                             # Static ffmpeg build — !! duplicate, ffmpeg is also installed via pacman above
+python3.13                         # Standalone Python 3.13 — !! probably not needed, uv can provide Python

system/packages.txt

@@ -0,0 +1,197 @@
+# ============================================================================
+# Packages installed by bootstrap.sh on a new machine.
+#
+#   - One package per line; anything after "#" is a description.
+#   - Lines starting with "#" are skipped (left here for reference).
+#   - [section] lines tell bootstrap.sh which installer to use;
+#     [services] lists systemd units to enable.
+#
+# Not listed here (bootstrap.sh handles them itself):
+#   - CPU microcode and GPU drivers: auto-detected from the hardware
+#   - yay: bootstrapped from the AUR before the [aur] section
+#   - svt-av1-essential-git: optional, also rebuilds ffmpeg against it
+# ============================================================================
+
+[pacman]
+adw-gtk-theme                      # Unofficial GTK 3 port of the libadwaita theme
+# amd-ucode                          # Microcode update image for AMD CPUs  -- auto-detected by bootstrap.sh
+awww                               # An Answer to your Wayland Wallpaper Woes
+baobab                             # A graphical directory tree analyzer
+base                               # Minimal package set to define a basic Arch Linux installation
+base-devel                         # Basic tools to build Arch Linux packages
+blueman                            # GTK+ Bluetooth Manager
+bluez                              # Daemons for the bluetooth protocol stack
+bluez-utils                        # Development and debugging utilities for the bluetooth protocol stack
+btop                               # A monitor of system resources, bpytop ported to C++
+dolphin                            # KDE File Manager
+# dunst                              # Customizable and lightweight notification-daemon  !! you use swaync for notifications
+efibootmgr                         # Linux user-space application to modify the EFI Boot Manager
+fastfetch                          # A feature-rich and performance oriented neofetch like system information tool
+ffmpeg                             # Complete solution to record, convert and stream audio and video
+filezilla                          # Fast and reliable FTP, FTPS and SFTP client
+firefox                            # Fast, Private & Safe Web Browser
+flatpak                            # Linux application sandboxing and distribution framework (formerly xdg-app)
+foot                               # Fast, lightweight, and minimalistic Wayland terminal emulator
+fzf                                # Command-line fuzzy finder
+galculator                         # GTK based scientific calculator
+# garcon                            # Freedesktop.org compliant menu library  !! XFCE desktop leftover?
+gdu                                # Fast disk usage analyzer
+git                                # the fast distributed version control system
+gnome-calendar                     # Simple and beautiful calendar application designed to perfectly fit the GNOME desktop
+gnome-disk-utility                 # Disk Management Utility for GNOME
+gnome-font-viewer                  # A font viewer utility for GNOME
+gnome-keyring                      # Stores passwords and encryption keys
+gnome-text-editor                  # A simple text editor for the GNOME desktop
+grim                               # Screenshot utility for Wayland
+gst-plugin-pipewire                # Multimedia graph framework - pipewire plugin
+gvfs                               # Virtual filesystem implementation for GIO
+gvfs-smb                           # Virtual filesystem implementation for GIO - SMB/CIFS backend (Windows file sharing)
+htop                               # Interactive process viewer
+hypridle                           # hyprland’s idle daemon
+hyprland                           # a highly customizable dynamic tiling Wayland compositor
+hyprlock                           # hyprland’s GPU-accelerated screen locking utility
+hyprshot                           # Hyprland screenshot utility
+imv                                # Image viewer for Wayland and X11
+jq                                 # Command-line JSON processor
+# kitty                              # A modern, hackable, featureful, OpenGL-based terminal emulator  !! you use foot as terminal (kitty config not in dotfiles)
+libgsf                             # Extensible I/O abstraction library for dealing with structured file formats
+libmatroska                        # Matroska library
+libpulse                           # A featureful, general-purpose sound server (client library)
+# libva-nvidia-driver                # VA-API implementation that uses NVDEC as a backend  -- auto-detected by bootstrap.sh
+linux                              # The Linux kernel and modules
+linux-firmware                     # Firmware files for Linux - Default set
+mkinitcpio                         # Modular initramfs image creation utility
+mkvtoolnix-cli                     # Set of tools to create, edit and inspect Matroska files
+mpv                                # a free, open source, and cross-platform media player
+mullvad-vpn-daemon                 # Mullvad VPN client (daemon and CLI)
+nano                               # Pico editor clone with enhancements
+network-manager-applet             # Applet for managing network connections
+networkmanager                     # Network connection manager and user applications
+noto-fonts                         # Google Noto TTF fonts
+noto-fonts-cjk                     # Google Noto CJK fonts
+noto-fonts-emoji                   # Google Noto Color Emoji font
+noto-fonts-extra                   # Google Noto TTF fonts - additional variants
+npm                                # JavaScript package manager
+nss-mdns                           # glibc plugin providing host name resolution via mDNS
+# nvidia-open                        # NVIDIA open kernel modules  -- auto-detected by bootstrap.sh
+pacman-contrib                     # Contributed scripts and tools for pacman systems
+pam-u2f                            # Universal 2nd Factor (U2F) PAM authentication module from Yubico
+papirus-icon-theme                 # Papirus icon theme
+pipewire                           # Low-latency audio/video router and processor
+pipewire-alsa                      # Low-latency audio/video router and processor - ALSA configuration
+pipewire-jack                      # Low-latency audio/video router and processor - JACK replacement
+pipewire-pulse                     # Low-latency audio/video router and processor - PulseAudio replacement
+pnpm                               # Fast, disk space efficient package manager
+polkit-kde-agent                   # Daemon providing a polkit authentication UI for KDE
+postgresql                         # Sophisticated object-relational DBMS
+postgresql-libs                    # Sophisticated object-relational DBMS - Client binaries and libraries
+proton-vpn-cli                     # Official ProtonVPN CLI Linux app
+qt5-wayland                        # Provides APIs for Wayland
+qt6-quickeffectmaker               # Qt Quick Effect Maker (QQEM) for creating and editing custom shader effects
+qt6-wayland                        # Provides APIs for Wayland
+rofi                               # A window switcher, application launcher and dmenu replacement
+sddm                               # QML based X11 and Wayland display manager
+slurp                              # Select a region in a Wayland compositor
+smartmontools                      # Control and monitor S.M.A.R.T. enabled ATA and SCSI Hard Drives
+steam                              # Valve's digital software delivery system
+stow                               # Manage installation of multiple softwares in the same directory tree
+sudo                               # Give certain users the ability to run some commands as root
+swaync                             # A simple GTK based notification daemon for Sway
+tailscale                          # A mesh VPN that makes it easy to connect your devices, wherever they are.
+thunar                             # Modern, fast and easy-to-use file manager for Xfce
+thunar-archive-plugin              # Adds archive operations to the Thunar file context menus
+thunar-media-tags-plugin           # Adds special features for media files to the Thunar File Manager
+thunar-shares-plugin               # Thunar plugin to quickly share a folder using Samba without requiring root access
+thunar-volman                      # Automatic management of removable drives and media for Thunar
+ttf-dejavu                         # Font family based on the Bitstream Vera Fonts with a wider range of characters
+ttf-iosevka-nerd                   # Patched font Iosevka from nerd fonts library
+ttf-jetbrains-mono                 # Typeface for developers, by JetBrains
+ttf-jetbrains-mono-nerd            # Patched font JetBrains Mono from nerd fonts library
+ttf-liberation                     # Font family which aims at metric compatibility with Arial, Times New Roman, and Courier New
+ttf-material-icons                 # Material Design icons by Google (deprecated classic Material Icons static style)
+ttf-material-symbols-variable      # Material Design icons by Google (Material Symbols - 4 axis variable)
+ttf-noto-nerd                      # Patched font Noto from nerd fonts library
+tumbler                            # Thumbnail service implementing the thumbnail management D-Bus specification
+uv                                 # An extremely fast Python package installer and resolver written in Rust
+uwsm                               # A standalone Wayland session manager
+vim                                # Vi Improved, a highly configurable, improved version of the vi text editor
+# waybar                             # Highly customizable Wayland bar for Sway and Wlroots based compositors  !! you've switched to quickshell (waybar is commented out in startup.lua)
+webp-pixbuf-loader                 # WebM GDK Pixbuf Loader library
+wget                               # Network utility to retrieve files from the web
+wireplumber                        # Session / policy manager implementation for PipeWire
+# wofi                               # launcher for wlroots-based wayland compositors  !! you also have rofi — need both?
+wpa_supplicant                     # A utility providing key negotiation for WPA wireless networks
+xarchiver                          # GTK frontend to various command line archivers
+xdg-desktop-portal-hyprland        # xdg-desktop-portal backend for hyprland
+xdg-utils                          # Command line tools that assist applications with a variety of desktop integration tasks
+# xfce4-appfinder                    # Application launcher and finder  !! XFCE desktop leftover?
+# xfce4-panel                        # Panel for the Xfce desktop environment  !! XFCE desktop leftover?
+# xfce4-power-manager                # Power Manager for Xfce  !! XFCE desktop leftover?
+# xfce4-session                      # Xfce's session manager  !! XFCE desktop leftover?
+# xfce4-settings                     # Xfce's Configuration System  !! XFCE desktop leftover?
+# xfce4-terminal                     # A modern terminal emulator primarily for the Xfce desktop environment  !! XFCE desktop leftover?
+# xfdesktop                          # Xfce's desktop manager  !! XFCE desktop leftover?
+# xfwm4                              # Xfce's window manager  !! XFCE desktop leftover?
+zram-generator                     # Systemd unit generator for zram devices
+zsh                                # A very advanced and programmable command interpreter (shell) for UNIX
+
+# Used by the dotfiles, previously only pulled in by caelestia-shell / waybar
+brightnessctl                      # Backlight control (quickshell, hypr keybinds)
+cliphist                           # Clipboard history (wl-paste watcher in startup.lua)
+playerctl                          # Media key control
+power-profiles-daemon              # Power profiles (quickshell battery widget)
+wl-clipboard                       # wl-copy / wl-paste
+openssh                            # SSH client/server (sshd service, git over ssh)
+avahi                              # mDNS daemon (avahi-daemon service, used by nss-mdns)
+
+[aur]
+bitwarden-bin                      # A secure and free password manager for all of your devices.
+# caelestia-shell                    # The desktop shell for the Caelestia dotfiles  !! alternative quickshell config, not used by your shell.qml
+flutter-bin                        # Cross platform widget toolkit for Dart (monolithic)
+google-chrome                      # The popular web browser by Google (Stable Channel)
+hyprmod                            # Native GTK4/libadwaita settings app for Hyprland
+# jellyfin-desktop-debug             # Detached debugging symbols for jellyfin-desktop  !! debug symbols, not needed
+minecraft-launcher                 # Official Minecraft Launcher
+# orbit-wifi                         # A WiFi/Bluetooth manager for Wayland with glassmorphism UI  !! removed from your config in commit 88484f8
+plex-desktop                       # Plex desktop client for linux
+plexamp-bin                        # Modern music client for Plex.(Prebuilt version.Use system-wide electron)
+puddletag                          # An audio tag editor for GNU/Linux
+quickshell-git                     # The shell your bar/OSD run on (previously a caelestia-shell dependency)
+pwvucontrol                        # Pipewire volume control for GNOME
+python-pywal                       # Generate and change colorschemes on the fly
+raw-thumbnailer                    # A lightweight and fast raw image thumbnailer that can be used by file managers.
+seafile-client                     # GUI client for synchronizing your local files with seafile server
+sunshine                           # Self-hosted game stream host for Moonlight
+# svt-av1-essential-git              # A no-nonsense SVT-AV1 encoder fork with sensible defaults and Quality of Life improvements  -- optional step in bootstrap.sh (rebuilds ffmpeg)
+ttf-icomoon-feather                # Icomoon feather font
+tumbler-extra-thumbnailers         # Customized thumbnailers for Tumbler
+turritopsis                        # Desktop Jellyfin client with mpv playback
+vesktop                            # A standalone Electron-based Discord app with Vencord & improved Linux support
+visual-studio-code-bin             # Visual Studio Code (vscode)
+waypaper                           # GUI wallpaper setter for Wayland and Xorg window managers. It works as a frontend for popular wallpaper backends like swaybg, swww, wallutils, hyprpaper and feh.
+# yay                                # Yet another yogurt. Pacman wrapper and AUR helper written in go.  !! bootstrapped by the script itself anyway
+# yay-debug                          # Detached debugging symbols for yay  !! debug symbols, not needed
+zen-browser-bin                    # Official package for Zen, a privacy-focused, feature packed Firefox-based web browser
+
+[flatpak]
+com.makemkv.MakeMKV                # MakeMKV
+org.jellyfin.JellyfinDesktop       # Jellyfin Desktop
+
+[installer]  # official install scripts, see bootstrap.sh
+claude                             # Claude Code CLI (official install script)
+oh-my-posh                         # Prompt theme engine (official install script; your theme is already in dotfiles)
+# ffmpeg                             # Static ffmpeg build — !! duplicate, ffmpeg is also installed via pacman above
+# python3.13                         # Standalone Python 3.13 — !! probably not needed, uv can provide Python
+
+[services]  # enabled with systemctl, start on next boot
+NetworkManager.service             # Networking
+bluetooth.service                  # Bluetooth
+sddm.service                       # Login screen
+sshd.service                       # SSH server
+avahi-daemon.service               # mDNS / .local hostnames
+systemd-resolved.service           # DNS resolver (used by the VPNs)
+systemd-timesyncd.service          # Clock sync
+fstrim.timer                       # Weekly SSD trim
+tailscaled.service                 # Tailscale
+mullvad-daemon.service             # Mullvad VPN
+proton.VPN.service                 # Proton VPN

system/pacman/options.conf

@@ -0,0 +1,5 @@
+# Shared pacman [options], included from /etc/pacman.conf.
+# Installed to /etc/pacman.d/options.conf by system/install.sh.
+Color
+#ILoveCandy
+#VerbosePkgLists

system/rebuild-ffmpeg.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Rebuilds Arch's ffmpeg package from source so it links against the installed
+# svt-av1-essential-git instead of the repo svt-av1 it was built with.
+#
+# Re-run this after a `pacman -Syu` that updates ffmpeg, otherwise the repo
+# build replaces this one.
+set -euo pipefail
+
+if ! pacman -Qq svt-av1-essential-git >/dev/null 2>&1; then
+    echo "svt-av1-essential-git is not installed; nothing to rebuild against." >&2
+    exit 1
+fi
+
+build="$(mktemp -d)"
+trap 'rm -rf "$build"' EXIT
+
+git clone --depth 1 https://gitlab.archlinux.org/archlinux/packaging/packages/ffmpeg.git "$build/ffmpeg"
+cd "$build/ffmpeg"
+
+# The PKGBUILD verifies a signed ffmpeg tag; makepkg won't fetch the keys itself
+mapfile -t keys < <(source ./PKGBUILD && printf '%s\n' "${validpgpkeys[@]}")
+if (( ${#keys[@]} )); then
+    gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys "${keys[@]}"
+fi
+
+# No --needed: the version matches what's installed, we want it replaced anyway
+makepkg --syncdeps --install --cleanbuild --noconfirm