Make setup ISO-only

Remove legacy online installer entrypoints, collapse migrations for 4.0, and move setup responsibilities into target-side system, hardware, and user commands.

AGENTS.md

@@ -74,18 +74,19 @@ Example:
 
 # Install Scripts
 
-Install entry points (`install.sh`, `boot.sh`) use `#!/bin/bash`. Many scripts under `install/` are sourced via `run_logged` and intentionally do not have shebangs.
+The ISO owns installation orchestration. This repo ships target-side setup commands and reusable setup leaves:
 
-Install stage files follow this pattern:
+- `bin/omarchy-setup-system` runs root-owned system setup during ISO finalization.
+- `bin/omarchy-setup-hardware` runs idempotent hardware-specific setup and is called by `omarchy-setup-system`.
+- `bin/omarchy-setup-user` runs user setup for the initial user and future users.
+- leaf scripts under `install/` are sourced by `run_logged $OMARCHY_INSTALL/path/to/script.sh` and intentionally do not have shebangs.
+- avoid `exit` in sourced setup scripts unless intentionally aborting setup.
+- use `$OMARCHY_INSTALL` and `$OMARCHY_PATH` instead of hard-coded Omarchy paths.
+- keep root-scoped hardware setup under `install/hardware/` and orchestrate it through `install/hardware/all.sh`.
+- keep every per-user setup leaf under `install/user/` (including `install/user/hardware/` and `install/user/first-run/`) so it is clear what must run for each user.
+- prefer helper commands for package and command checks where available.
 
-- `install/*/all.sh` lists scripts in execution order
-- leaf scripts are sourced by `run_logged $OMARCHY_INSTALL/path/to/script.sh`
-- avoid `exit` in sourced install scripts unless intentionally aborting the install
-- use `$OMARCHY_INSTALL` and `$OMARCHY_PATH` instead of hard-coded Omarchy paths
-- keep hardware-specific logic under `install/config/hardware/`
-- prefer helper commands for package and command checks where available
-
-Raw `command -v`, `pacman`, and `pacman-key` are acceptable in bootstrap/preflight/package-helper contexts where the helper commands may not be available yet or where direct package-manager behavior is the point of the script.
+Raw `command -v`, `pacman`, and `pacman-key` are acceptable in package-helper contexts where direct package-manager behavior is the point of the script.
 
 # Helper Commands
 
@@ -98,7 +99,7 @@ Use these instead of raw shell commands:
 - `omarchy-notification-send` - send desktop notifications; do not call `notify-send` directly
 - `omarchy-hw-asus-rog` - detect ASUS ROG hardware (and similar `hw-*` commands)
 
-Exceptions are allowed for bootstrap, preflight, migration, and package-helper scripts where the helper may not be available yet, where the helper itself is being implemented, or where direct package-manager behavior is required.
+Exceptions are allowed for migration and package-helper scripts where the helper may not be available yet, where the helper itself is being implemented, or where direct package-manager behavior is required.
 
 # Config Structure
 
@@ -170,7 +171,7 @@ To copy a default config to user config with automatic backup:
 omarchy-refresh-config hypr/hyprlock.conf
 ```
 
-This copies `~/.local/share/omarchy/config/hypr/hyprlock.conf` to `~/.config/hypr/hyprlock.conf`.
+This copies `$OMARCHY_PATH/config/hypr/hyprlock.conf` to `~/.config/hypr/hyprlock.conf`.
 
 # Migrations
 
@@ -183,6 +184,6 @@ New migration format:
 - Use `$OMARCHY_PATH` to reference the omarchy directory
 - Prefer helper commands such as `omarchy-cmd-present`, `omarchy-cmd-missing`, `omarchy-pkg-present`, and `omarchy-pkg-missing`
 
-Some older migrations predate these rules. Do not copy older migrations that start with shebangs, omit the leading `echo`, or hard-code `~/.local/share/omarchy`.
+Omarchy 4.0 intentionally collapses historical migrations into a single package-layout migration. Do not add compatibility migrations for old installer layouts.
 
-Migrations may use raw `pacman`, `command -v`, or direct config edits when needed for historical compatibility or one-off repair work.
+Migrations may use raw `pacman`, `command -v`, or direct config edits when needed for one-off repair work.

REVIEW-CROSSWALK.md

@@ -1,95 +0,0 @@
-# Installer Revamp Review Crosswalk
-
-This branch is easiest to review as a behavior migration: each row below maps an old install script/behavior to its new owner and phase.
-
-## Install architecture
-
-| Phase | Entry point | Runs as | Runs when | Owns |
-|---|---|---|---|---|
-| System install | `system-finalize.sh` -> `install/system/all.sh` | root with `OMARCHY_INSTALL_USER` set to the non-root target user | once at install/finalize time | machine config, services, login manager, root-owned post-install cleanup |
-| User setup | `omarchy-setup-user` -> `install/user/all.sh` | target user | install user during `finalize.sh`, and every future user on first login | home config, AI skills, XDG dirs, app launchers, user services, user/session hardware tweaks |
-| User finalization | `finalize.sh` | target user | once during install | marks shipped migrations done, creates offline first-run marker, calls `omarchy-setup-user --force`, shows finish/reboot UI |
-| First run system one-shot | `omarchy-first-run` when `~/.local/state/omarchy/first-run.mode` exists | install user with temporary sudoers | first graphical login after offline install | firewall/DNS/icon-cache/voxtype work that needs a live boot |
-| First run user one-shot | `omarchy-first-run` when `first-run-user.done` is missing | current user | first graphical login for every user | session-only user tasks: monitor recovery, GNOME settings, primary paste, welcome, Wi-Fi |
-| Package-owned defaults | `etc/**`, `config/**`, `applications/**`, `default/**` via `omarchy-settings` / `omarchy` packages | pacman | package install/upgrade | static `/etc`, `/etc/skel`, `/usr/share/omarchy` defaults |
-
-Rules of thumb:
-
-- `install/system/**` should not write a user's home directory except through explicit target-user metadata like `OMARCHY_INSTALL_USER`.
-- `omarchy-setup-user` is the canonical path for current and future users. `/etc/skel` seeds new homes, but setup-user keeps existing users and first-login users aligned. The runtime `omarchy` package depends on `omarchy-installer` so `/usr/share/omarchy/install/user/**` is present for future users.
-- `install/user/**` contains reusable user setup pieces, but callers should normally invoke `omarchy-setup-user` rather than source those files directly.
-
-## Crosswalk
-
-| Old file / behavior | New owner(s) | Phase | Review status / verification |
-|---|---|---|---|
-| `install.sh` ran package install then directly entered `finalize.sh`. | `install.sh` now runs root `system-finalize.sh` with `OMARCHY_INSTALL_USER=$USER`, then user `finalize.sh`. Offline callers must do the same root-before-user handoff. | system -> user | `rg 'system-finalize|OMARCHY_INSTALL_USER|finalize.sh' install.sh system-finalize.sh` |
-| `finalize.sh` ran all system/user/post-install phases. | `system-finalize.sh` owns system phases; `finalize.sh` now calls `omarchy-setup-user --force` and `post-install/finished.sh`. | split | `rg 'omarchy-setup-user|finished.sh|system/all' finalize.sh system-finalize.sh` |
-| `install/packaging/all.sh` mixed hardware package work and user app setup. | `install/packaging/system.sh` for hardware-gated packages; `install/packaging/user.sh` for user package setup (`nvim`). App launchers/npm wrappers are driven through `omarchy-refresh-applications` in setup-user. | split | `cat install/packaging/{all,system,user}.sh` |
-| `install/config/config.sh` copied `config/**` and bashrc into the install user's home. | `omarchy-settings` seeds `/etc/skel`; `omarchy-setup-user` copies `config/**`, `.bashrc`, and `.bash_profile` for existing/current users. | user setup + package/skel | `rg 'cp -R .*config|bashrc' bin/omarchy-setup-user` |
-| `install/config/theme.sh` mixed system icon/Chromium setup and user theme setup. | `install/config/theme-system.sh` and `install/config/theme-user.sh`. | split | `cat install/config/theme-{system,user}.sh` |
-| `install/first-run/gnome-theme.sh` mixed user `gsettings` with root icon-cache refresh. | `install/first-run/gnome-theme-system.sh` and `install/first-run/gnome-theme-user.sh`. | first-run split | `cat install/first-run/gnome-theme-{system,user}.sh` |
-| `install/config/branding.sh` copied branding into the user config. | `/etc/skel/.config/omarchy/branding` via package plus refresh in `omarchy-setup-user`. | package + user setup | `rg 'branding' bin/omarchy-setup-user /home/ryan/Work/omarchy/omarchy-pkgs/pkgbuilds/omarchy-settings/PKGBUILD` |
-| `install/config/omarchy-ai-skill.sh` symlinked assistant skills. | `omarchy-setup-user`. | per-user | `rg 'skills/omarchy' bin/omarchy-setup-user` |
-| `install/config/omarchy-toggles.sh` seeded toggle flags. | `omarchy-setup-user`; `omarchy-refresh-hyprland` also refreshes flags when resetting Hypr configs. | per-user | `rg 'flags.lua|toggles' bin/omarchy-setup-user bin/omarchy-refresh-hyprland` |
-| `install/config/detect-keyboard-layout.sh` inserted `/etc/vconsole.conf` layout into Hypr config. | `omarchy-setup-user`; `omarchy-refresh-hyprland` contains the same idempotent refresh behavior. | per-user | `rg 'XKBLAYOUT|kb_layout' bin/omarchy-setup-user bin/omarchy-refresh-hyprland` |
-| `install/config/user-dirs.sh` created XDG dirs/bookmarks. | `omarchy-setup-user` with idempotent bookmark insertion. | per-user | `rg 'xdg-user-dirs|bookmarks' bin/omarchy-setup-user` |
-| `install/config/mimetypes.sh` set app/MIME defaults. | `omarchy-refresh-applications` plus `xdg-settings` / `xdg-mime` in `omarchy-setup-user`. | per-user | `rg 'omarchy-refresh-applications|xdg-mime|xdg-settings' bin/omarchy-setup-user` |
-| `install/config/nautilus-python.sh` copied Nautilus extensions. | `omarchy-setup-user`. | per-user | `rg 'nautilus-python' bin/omarchy-setup-user` |
-| `install/config/localdb.sh` ran `updatedb`. | `install/post-install/localdb.sh`. | system post-install | `cat install/post-install/localdb.sh` |
-| `install/config/docker.sh` restarted/daemon-reloaded Docker bits and added current user to docker. | Package-owned Docker/resolved config in `etc/**`; `docker.sh` keeps the install-user group membership. | system + package | `cat install/config/docker.sh etc/docker/daemon.json etc/systemd/system/docker.service.d/no-block-boot.conf` |
-| `install/config/enable-services.sh` and service enables scattered elsewhere. | `install/config/enable-services.sh` is the centralized service-enable step for bluetooth/cups/avahi/docker/NetworkManager/power-profiles/sddm. | system | `rg 'systemctl enable' install` |
-| `install/config/hardware/network.sh` enabled NetworkManager and disabled iwd/wait-online. | NetworkManager enable moved to `enable-services.sh`; `network.sh` only disables iwd and masks wait-online. | system | `cat install/config/enable-services.sh install/config/hardware/network.sh` |
-| `install/config/hardware/bluetooth.sh` mixed `/etc/bluetooth` with user WirePlumber and `bt-agent`. | `bluetooth.sh` keeps system AutoEnable; `bluetooth-user.sh` handles user WirePlumber and user service; `/etc/skel` symlink seeds future users. | split | `cat install/config/hardware/bluetooth{,-user}.sh; find config/systemd/user -maxdepth 3 -type l -ls` |
-| `install/config/hardware/nvidia.sh` installed drivers, wrote `/etc`, and appended user Hypr env vars. | `nvidia.sh` keeps driver/system config; `nvidia-user.sh` appends user env vars idempotently. | split | `cat install/config/hardware/nvidia{,-user}.sh` |
-| ASUS audio mixer/mic scripts ran in system config. | Moved to `install/config/user.sh`; behavior preserved in `asus/fix-audio-mixer.sh` and `asus/fix-mic.sh`. | per-user/session | `rg 'fix-audio-mixer|fix-mic' install/config/user.sh install/config/hardware/asus` |
-| Framework AMD F13 audio input ran in system config. | Moved to `install/config/user.sh`; `framework/fix-f13-amd-audio-input.sh` preserves the `pactl` profile fix. | per-user/session | `rg 'fix-f13|pactl' install/config/user.sh install/config/hardware/framework` |
-| `install/config/hardware/fix-synaptic-touchpad.sh` was removed in the split. | Restored and called from `install/config/all.sh`. | system hardware | `rg 'fix-synaptic-touchpad' install/config/all.sh install/config/hardware/fix-synaptic-touchpad.sh` |
-| `install/config/lockscreen-pam.sh` delegated to `omarchy-setup-lock`. | Kept as `omarchy-setup-lock`; `omarchy-setup-lock` now honors `OMARCHY_INSTALL_USER`. | system helper | `cat install/config/lockscreen-pam.sh; rg 'OMARCHY_INSTALL_USER' bin/omarchy-setup-lock` |
-| `install/config/increase-fd-limit.sh` wrote systemd manager nofile drop-ins. | Package-owned `etc/systemd/system.conf.d/20-omarchy-nofile.conf` and `etc/systemd/user.conf.d/20-omarchy-nofile.conf`; legacy `99` files removed by `post-install/legacy-cleanup.sh`. | package + cleanup | `cat etc/systemd/{system.conf.d,user.conf.d}/20-omarchy-nofile.conf install/post-install/legacy-cleanup.sh` |
-| `install/config/increase-file-watchers.sh` ran `sysctl --system`. | Package-owned `etc/sysctl.d/90-omarchy-file-watchers.conf`; install is followed by reboot. | package | `cat etc/sysctl.d/90-omarchy-file-watchers.conf` |
-| `install/config/fast-shutdown.sh` only reloaded systemd after drop-ins. | Package-owned faster-shutdown drop-ins; install is followed by reboot. | package | `cat etc/systemd/system.conf.d/10-faster-shutdown.conf etc/systemd/system/user@.service.d/10-faster-shutdown.conf` |
-| `install/config/powerprofilesctl-rules.sh` and `wifi-powersave-rules.sh` wrote/reloaded udev rules. | Package-owned `etc/udev/rules.d/99-omarchy-*.rules`; `post-install/legacy-cleanup.sh` removes old non-namespaced rules; `post-install/udev.sh` reloads/triggers. | package + post-install | `cat etc/udev/rules.d/99-omarchy-*.rules install/post-install/{legacy-cleanup,udev}.sh` |
-| `install/config/gpg.sh` copied GnuPG config and restarted dirmngr. | Package-owned `etc/gnupg/dirmngr.conf`; live dirmngr restart removed. | package | `cat etc/gnupg/dirmngr.conf` |
-| `install/config/pi.sh` activated Pi theme. | No direct install path remains; theme changes still run Pi retint hooks when applicable. | intentionally removed / review | `rg 'omarchy-theme-set-pi' bin install migrations` |
-| `install/login/all.sh` mixed default keyring with SDDM/login manager work. | `install/login/system.sh` owns SDDM/hibernation/limine; `install/login/default-keyring.sh` runs through user setup and is idempotent. | split | `cat install/login/system.sh install/login/default-keyring.sh` |
-| `install/login/sddm.sh` wrote/copied static SDDM config/assets, autologin, PAM tweaks, and enabled service. | Static SDDM drop-ins live under `etc/sddm.conf.d`; theme/session assets are package-owned; `sddm.sh` now manages only autologin, legacy `hyprland.conf` cleanup, and PAM tweaks; service enable moved to `enable-services.sh`. | package + system | `cat etc/sddm.conf.d/*.conf install/login/sddm.sh install/config/enable-services.sh` |
-| `install/post-install/allow-reboot.sh` created online reboot sudoers. | Kept, now also grants one-time cleanup; `omarchy-first-run` calls `cleanup-reboot-sudoers.sh` with `sudo -n` so future users are not prompted. | online post-install + first-run cleanup | `cat install/post-install/allow-reboot.sh install/first-run/cleanup-reboot-sudoers.sh` |
-
-## Deleted migration/helper policy
-
-Old migrations that only sourced helpers now replaced by package-owned files were removed with their helpers. Legacy cleanup that still matters moved into `install/post-install/legacy-cleanup.sh`:
-
-- old udev rule names: `/etc/udev/rules.d/99-power-profile.rules`, `/etc/udev/rules.d/99-wifi-powersave.rules`
-- old nofile drop-in names: `/etc/systemd/system.conf.d/99-omarchy-nofile.conf`, `/etc/systemd/user.conf.d/99-omarchy-nofile.conf`
-
-## Review commit plan
-
-The branch should be reviewed in this order:
-
-1. `installer: split root and user finalization`
-   - `install.sh`, `system-finalize.sh`, `finalize.sh`, `install/system/all.sh`, `install/user/all.sh`, helper/root-aware changes.
-2. `setup: make omarchy-setup-user canonical for users`
-   - `bin/omarchy-setup-user`, `bin/omarchy-first-run`, user setup idempotency fixes, `default-keyring`, `cleanup-reboot-sudoers`.
-3. `install: split packaging phases`
-   - `install/packaging/{all,system,user}.sh` and app setup routing through `omarchy-refresh-applications`.
-4. `install: split theme and first-run theme setup`
-   - `theme.sh` -> `theme-system.sh` / `theme-user.sh`; `gnome-theme.sh` -> first-run system/user split.
-5. `install: move static system config to package-owned files`
-   - `etc/**` additions, removal of no-op helpers/migrations, post-install legacy cleanup/udev/localdb.
-6. `install: split user-scoped hardware/session config`
-   - bluetooth/nvidia split, ASUS/Framework user audio fixes, Synaptics restoration.
-7. `install: split SDDM config from autologin`
-   - package-owned SDDM drop-ins, trimmed `sddm.sh`, centralized service enable.
-8. `docs: add installer review crosswalk`
-   - this file.
-
-## Follow-up checks
-
-```bash
-git status --porcelain=v1 --untracked-files=all
-rg 'systemctl enable' install
-rg 'fast-shutdown|increase-file-watchers|powerprofilesctl-rules|wifi-powersave-rules|increase-fd-limit' install migrations bin || true
-bash -n install.sh system-finalize.sh finalize.sh bin/omarchy-setup-user bin/omarchy-first-run
-bash test/offline-finalizer-bootstrap-test.sh
-```

applications/Basecamp.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=Basecamp
+Exec=omarchy-launch-webapp https://launchpad.37signals.com
+Terminal=false
+Type=Application
+Icon=basecamp
+StartupNotify=true

applications/ChatGPT.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=ChatGPT
+Exec=omarchy-launch-webapp https://chatgpt.com/
+Terminal=false
+Type=Application
+Icon=chatgpt
+StartupNotify=true

applications/Discord.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=Discord
+Exec=omarchy-launch-webapp https://discord.com/channels/@me
+Terminal=false
+Type=Application
+Icon=discord
+StartupNotify=true

applications/Disk Usage.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=Disk Usage
+Exec=xdg-terminal-exec --app-id=TUI.float -e bash -c "dust -r; read -n 1 -s"
+Terminal=false
+Type=Application
+Icon=disk-usage
+StartupNotify=true

applications/Docker.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=Docker
+Exec=xdg-terminal-exec --app-id=TUI.tile -e lazydocker
+Terminal=false
+Type=Application
+Icon=docker
+StartupNotify=true

applications/Figma.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=Figma
+Exec=omarchy-launch-webapp https://figma.com/
+Terminal=false
+Type=Application
+Icon=figma
+StartupNotify=true

applications/Fizzy.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=Fizzy
+Exec=omarchy-launch-webapp https://app.fizzy.do/
+Terminal=false
+Type=Application
+Icon=fizzy
+StartupNotify=true

applications/GitHub.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=GitHub
+Exec=omarchy-launch-webapp https://github.com/
+Terminal=false
+Type=Application
+Icon=github
+StartupNotify=true

applications/Google Contacts.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=Google Contacts
+Exec=omarchy-launch-webapp https://contacts.google.com/
+Terminal=false
+Type=Application
+Icon=google-contacts
+StartupNotify=true

applications/Google Maps.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=Google Maps
+Exec=omarchy-launch-webapp https://maps.google.com
+Terminal=false
+Type=Application
+Icon=google-maps
+StartupNotify=true

applications/Google Messages.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=Google Messages
+Exec=omarchy-launch-webapp https://messages.google.com/web/conversations
+Terminal=false
+Type=Application
+Icon=google-messages
+StartupNotify=true

applications/Google Photos.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=Google Photos
+Exec=omarchy-launch-webapp https://photos.google.com/
+Terminal=false
+Type=Application
+Icon=google-photos
+StartupNotify=true

applications/HEY.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Version=1.0
+Name=HEY
+Exec=omarchy-webapp-handler-hey %u
+Terminal=false
+Type=Application
+Icon=hey
+StartupNotify=true
+MimeType=x-scheme-handler/mailto

applications/WhatsApp.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=WhatsApp
+Exec=omarchy-launch-webapp https://web.whatsapp.com/
+Terminal=false
+Type=Application
+Icon=whatsapp
+StartupNotify=true

applications/X.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=X
+Exec=omarchy-launch-webapp https://x.com/
+Terminal=false
+Type=Application
+Icon=x
+StartupNotify=true

applications/YouTube.desktop

@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=1.0
+Name=YouTube
+Exec=omarchy-launch-webapp https://youtube.com/
+Terminal=false
+Type=Application
+Icon=youtube
+StartupNotify=true

applications/Zoom.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Version=1.0
+Name=Zoom
+Exec=omarchy-webapp-handler-zoom %u
+Terminal=false
+Type=Application
+Icon=zoom
+StartupNotify=true
+MimeType=x-scheme-handler/zoommtg;x-scheme-handler/zoomus

applications/battlenet.desktop

@@ -4,7 +4,7 @@ Name=Battle.net
 GenericName=Game Launcher
 Comment=Blizzard game launcher (umu-launcher + GE-Proton)
 Exec=omarchy-launch-battlenet
-Icon=Battle.net
+Icon=battle-net
 Terminal=false
 Categories=Game;
 StartupNotify=true

bin/omarchy-branch-set

@@ -1,18 +0,0 @@
-#!/bin/bash
-
-# omarchy:summary=Set the branch for Omarchy's git repository.
-# omarchy:args=<master|rc|dev>
-
-if (($# == 0)); then
-  echo "Usage: omarchy-branch-set [master|rc|dev]"
-  exit 1
-else
-  branch="$1"
-fi
-
-if [[ $branch != "master" && $branch != "rc" && $branch != "dev" ]]; then
-  echo "Error: Invalid branch '$branch'. Must be one of: master, rc, dev"
-  exit 1
-fi
-
-git -C $OMARCHY_PATH switch $branch

bin/omarchy-channel-set

@@ -1,22 +1,21 @@
 #!/bin/bash
 
-# omarchy:summary=Set the Omarchy channel, which dictates what git branch and package repository is used.
+# omarchy:summary=Set the Omarchy package channel.
 # omarchy:args=<stable|rc|edge|dev>
 # omarchy:requires-sudo=true
 
+set -e
+
 if (($# == 0)); then
   echo "Usage: omarchy-channel-set [stable|rc|edge|dev]"
   exit 1
-else
-  channel="$1"
 fi
 
+channel="$1"
 case "$channel" in
-"stable") omarchy-branch-set "master" && omarchy-refresh-pacman "stable" ;;
-"rc") omarchy-branch-set "rc" && omarchy-refresh-pacman "rc" ;;
-"edge") omarchy-branch-set "master" && omarchy-refresh-pacman "edge" ;;
-"dev") omarchy-branch-set "dev" && omarchy-refresh-pacman "edge" ;;
-*) echo "Unknown channel: $channel"; exit 1; ;;
+  stable|rc|edge) omarchy-refresh-pacman "$channel" ;;
+  dev) omarchy-refresh-pacman edge ;;
+  *) echo "Unknown channel: $channel"; exit 1 ;;
 esac
 
 omarchy-update -y

bin/omarchy-debug

@@ -37,7 +37,7 @@ fi
 cat > "$LOG_FILE" <<EOF
 Date: $(date)
 Hostname: $(hostname)
-Omarchy Branch: $(git -C "$OMARCHY_PATH" branch --show-current 2>/dev/null || echo "unknown")
+Omarchy Package: $(pacman -Q omarchy 2>/dev/null || echo "unknown")
 
 =========================================
 SYSTEM INFORMATION

bin/omarchy-dev-add-migration

@@ -1,13 +1,16 @@
 #!/bin/bash
 
-# omarchy:summary=Creates a new Omarchy migration named after the unix timestamp of the last commit.
+# omarchy:summary=Create a new Omarchy migration in the current source tree.
 
-cd ~/.local/share/omarchy
-migration_file="$HOME/.local/share/omarchy/migrations/$(git log -1 --format=%cd --date=unix).sh"
-touch $migration_file
+set -euo pipefail
 
-if [[ $1 != "--no-edit" ]]; then
-  nvim $migration_file
+cd "${OMARCHY_PATH:-$(pwd)}"
+mkdir -p migrations
+migration_file="migrations/$(git log -1 --format=%cd --date=unix).sh"
+touch "$migration_file"
+
+if [[ ${1:-} != "--no-edit" ]]; then
+  nvim "$migration_file"
 fi
 
-echo $migration_file
+printf '%s\n' "$PWD/$migration_file"

bin/omarchy-dev-link

@@ -38,7 +38,7 @@ target=$(realpath -e "$1" 2>/dev/null) || {
 
 for required in bin default shell; do
   if [[ ! -d "$target/$required" ]]; then
-    echo "Warning: $target/$required not found — does this look like an omarchy-installer checkout?" >&2
+    echo "Warning: $target/$required not found — does this look like an Omarchy source checkout?" >&2
   fi
 done
 

bin/omarchy-dev-pkg-test

@@ -11,7 +11,7 @@ if [[ ${1:-} == "-h" || ${1:-} == "--help" ]]; then
   cat <<USAGE
 Usage: omarchy dev pkg-test [package-name] [path-to-checkout]
 
-Builds and installs an Omarchy package from a local omarchy-installer
+Builds and installs an Omarchy package from a local Omarchy source
 checkout. Use when changes need to land at fixed system paths (/etc/,
 /usr/lib/systemd/, udev rule bodies, plymouth) that omarchy-dev-link
 can't shadow.

bin/omarchy-first-run

@@ -1,45 +1,23 @@
 #!/bin/bash
 
-# omarchy:summary=Finish the installation of Omarchy with items that can only be done after logging in.
-# omarchy:requires-sudo=true
+# omarchy:summary=Finish first-login setup for Omarchy.
 
 set -e
 
-# Always: refresh per-user defaults (skel-derived configs, AI skills, XDG
-# dirs, branding, MIME defaults, etc.). Idempotent via its own marker.
 omarchy-setup-user || true
 
-# Online installs grant a one-time passwordless reboot from the installer.
-# Clean it up after first login without prompting future users for sudo.
-bash "$OMARCHY_PATH/install/first-run/cleanup-reboot-sudoers.sh"
-
 state_dir=~/.local/state/omarchy
 mkdir -p "$state_dir"
 
-# System-wide one-shot. Gated on first-run.mode (created by finalize.sh during
-# ISO installs). The install user is the only one whose /etc/sudoers.d/first-run
-# shim grants the passwordless commands these scripts need, so only that user
-# clears this marker.
-SYSTEM_MARKER="$state_dir/first-run.mode"
-if [[ -f $SYSTEM_MARKER ]]; then
-  rm -f "$SYSTEM_MARKER"
-
-  bash "$OMARCHY_PATH/install/first-run/firewall.sh"
-  bash "$OMARCHY_PATH/install/first-run/dns-resolver.sh"
-  bash "$OMARCHY_PATH/install/first-run/gnome-theme-system.sh"
-  omarchy-hook-install post-update "$OMARCHY_PATH/install/first-run/install-voxtype.hook"
-  sudo rm -f /etc/sudoers.d/first-run
-fi
-
-# Per-user one-shot. Runs on the first login for every user, including any
-# users created after install. Touches only $HOME / user dbus, no sudo.
 USER_MARKER="$state_dir/first-run-user.done"
 if [[ ! -f $USER_MARKER ]]; then
-  bash "$OMARCHY_PATH/install/first-run/recover-internal-monitor.sh"
-  bash "$OMARCHY_PATH/install/first-run/gnome-theme-user.sh"
-  bash "$OMARCHY_PATH/install/first-run/gtk-primary-paste.sh"
-  bash "$OMARCHY_PATH/install/first-run/welcome.sh"
-  bash "$OMARCHY_PATH/install/first-run/wifi.sh"
+  omarchy-hook-install post-update "$OMARCHY_PATH/install/user/first-run/install-voxtype.hook"
+
+  bash "$OMARCHY_PATH/install/user/hardware/recover-internal-monitor.sh"
+  bash "$OMARCHY_PATH/install/user/first-run/gnome-theme.sh"
+  bash "$OMARCHY_PATH/install/user/first-run/gtk-primary-paste.sh"
+  bash "$OMARCHY_PATH/install/user/first-run/welcome.sh"
+  bash "$OMARCHY_PATH/install/user/first-run/wifi.sh"
 
   touch "$USER_MARKER"
 fi

bin/omarchy-games-retro-install

@@ -51,11 +51,7 @@ desktop_name="$game_name"
 desktop_id=$(printf '%s' "$desktop_name" | tr '[:upper:]' '[:lower:]' | tr -cs '[:alnum:]' '-' | sed 's/^-//; s/-$//')
 desktop_dir="$HOME/.local/share/applications"
 desktop_file="$desktop_dir/$desktop_id.desktop"
-icon_dir="$desktop_dir/icons"
-icon_path="$icon_dir/Retro Gaming.png"
-
-mkdir -p "$desktop_dir" "$icon_dir"
-[[ -f $icon_path ]] || cp "$OMARCHY_PATH/applications/icons/Retro Gaming.png" "$icon_path"
+mkdir -p "$desktop_dir"
 
 cat >"$desktop_file" <<EOF
 [Desktop Entry]
@@ -65,7 +61,7 @@ Comment=Play $game_name with RetroArch
 Exec=retroarch -L "$core_path" "$game_path"
 Terminal=false
 Type=Application
-Icon=$icon_path
+Icon=retro-gaming
 StartupNotify=true
 Categories=Game;Emulator;
 EOF

bin/omarchy-hibernation-setup

@@ -39,7 +39,6 @@ if [[ -f $MKINITCPIO_CONF ]] && grep -q "^HOOKS+=(resume)$" "$MKINITCPIO_CONF";
       echo "Fixing empty resume_offset ($RESUME_OFFSET)"
       sudo sed -i "s/resume_offset=\"$/resume_offset=$RESUME_OFFSET\"/" "$RESUME_DROP_IN"
       if ! $NO_REBUILD; then
-        sudo sed -i "s/resume_offset=\"$/resume_offset=$RESUME_OFFSET\"/" /etc/default/limine
         sudo limine-mkinitcpio
       fi
     fi
@@ -102,7 +101,6 @@ if [[ ! -f $RESUME_DROP_IN ]]; then
   if [[ -n $RESUME_OFFSET ]]; then
     sudo mkdir -p /etc/limine-entry-tool.d
     echo "KERNEL_CMDLINE[default]+=\" resume=$RESUME_DEVICE resume_offset=$RESUME_OFFSET\"" | sudo tee "$RESUME_DROP_IN" >/dev/null
-    $NO_REBUILD || sudo tee -a /etc/default/limine < "$RESUME_DROP_IN" >/dev/null
   else
     echo "Warning: Could not determine resume offset for $SWAP_FILE" >&2
   fi
@@ -115,7 +113,6 @@ if grep -q "\[s2idle\]" /sys/power/mem_sleep 2>/dev/null; then
     echo "Enabling ACPI RTC alarm for s2idle suspend"
     sudo mkdir -p /etc/limine-entry-tool.d
     echo 'KERNEL_CMDLINE[default]+=" rtc_cmos.use_acpi_alarm=1"' | sudo tee "$LIMINE_DROP_IN" >/dev/null
-    $NO_REBUILD || sudo tee -a /etc/default/limine < "$LIMINE_DROP_IN" >/dev/null
   fi
 fi
 

bin/omarchy-install

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-# omarchy:summary=Online Omarchy install (on an existing Arch system)
-# omarchy:group=install
-
-set -eEo pipefail
-
-# Online entry point. The ISO install is driven by omarchy-iso's Python
-# orchestrator instead, which arch-chroots into /mnt and runs finalize.sh
-# directly — never touches this script.
-exec bash "${OMARCHY_PATH:-/usr/share/omarchy}/install.sh" "$@"

bin/omarchy-install-gaming-battlenet

@@ -63,12 +63,9 @@ EOF
   launched_installer=1
 fi
 
-mkdir -p "$HOME/.local/share/applications" "$HOME/.local/share/icons/hicolor/48x48/apps"
+mkdir -p "$HOME/.local/share/applications"
 install -m 644 "$OMARCHY_PATH/applications/battlenet.desktop" \
   "$HOME/.local/share/applications/battlenet.desktop"
-install -m 644 "$OMARCHY_PATH/applications/icons/Battle.net.png" \
-  "$HOME/.local/share/icons/hicolor/48x48/apps/Battle.net.png"
-gtk-update-icon-cache "$HOME/.local/share/icons/hicolor" &>/dev/null || true
 update-desktop-database "$HOME/.local/share/applications" 2>/dev/null || true
 
 if (( launched_installer )); then

bin/omarchy-install-mode

@@ -1,8 +0,0 @@
-#!/bin/bash
-
-# omarchy:summary=Print the OMARCHY_INSTALL_MODE in the current env
-# omarchy:group=install
-
-# install.sh exports this during the install flow. Not persisted post-install,
-# so this prints 'unknown' outside the installer.
-echo "${OMARCHY_INSTALL_MODE:-unknown}"

bin/omarchy-install-service-sunshine

@@ -13,8 +13,6 @@ SUNSHINE_ADMIN_APP="Sunshine Admin"
 SUNSHINE_ADMIN_URL="https://localhost:47990"
 SUNSHINE_ADMIN_EXEC="omarchy-launch-webapp $SUNSHINE_ADMIN_URL --ignore-certificate-errors"
 SUNSHINE_ICON_SOURCE="/usr/share/sunshine/web/images/logo-sunshine-45.png"
-SUNSHINE_ICON_NAME="Sunshine Admin.png"
-WEBAPP_ICON_DIR="$HOME/.local/share/applications/icons"
 HYPR_AUTOSTART_FILE="$HOME/.config/hypr/autostart.lua"
 HYPR_AUTOSTART_ENTRY='o.launch_on_start("sunshine")'
 
@@ -59,9 +57,7 @@ open_ufw_ports() {
 }
 
 install_admin_webapp() {
-  mkdir -p "$WEBAPP_ICON_DIR"
-  cp "$SUNSHINE_ICON_SOURCE" "$WEBAPP_ICON_DIR/$SUNSHINE_ICON_NAME"
-  omarchy-webapp-install "$SUNSHINE_ADMIN_APP" "$SUNSHINE_ADMIN_URL" "$SUNSHINE_ICON_NAME" "$SUNSHINE_ADMIN_EXEC"
+  omarchy-webapp-install "$SUNSHINE_ADMIN_APP" "$SUNSHINE_ADMIN_URL" "$SUNSHINE_ICON_SOURCE" "$SUNSHINE_ADMIN_EXEC"
 }
 
 enable_hyprland_autostart() {

bin/omarchy-migrate

@@ -1,28 +1,19 @@
 #!/bin/bash
 
-# omarchy:summary=Run all pending migrations to bring the system in line with the installed version.
+# omarchy:summary=Run pending Omarchy migrations for the current user.
+
+set -euo pipefail
 
 STATE_DIR="$HOME/.local/state/omarchy/migrations"
 mkdir -p "$STATE_DIR"
 
-# Skipped migrations are tracked separately
-mkdir -p "$STATE_DIR/skipped"
-
-# Run any pending migrations
-for file in $OMARCHY_PATH/migrations/*.sh; do
+for file in "$OMARCHY_PATH"/migrations/*.sh; do
+  [[ -f $file ]] || continue
   filename=$(basename "$file")
 
-  if [[ ! -f $STATE_DIR/$filename && ! -f $STATE_DIR/skipped/$filename ]]; then
+  if [[ ! -f $STATE_DIR/$filename ]]; then
     echo -e "\e[32m\nRunning migration (${filename%.sh})\e[0m"
-
-    if bash $file; then
-      touch "$STATE_DIR/$filename"
-    else
-      if gum confirm "Migration ${filename%.sh} failed. Skip and continue?"; then
-        touch "$STATE_DIR/skipped/$filename"
-      else
-        exit 1
-      fi
-    fi
+    bash "$file"
+    touch "$STATE_DIR/$filename"
   fi
 done

bin/omarchy-refresh-applications

@@ -1,10 +1,6 @@
 #!/bin/bash
 
-# omarchy:summary=Ensure all default .desktop, web apps, TUIs, and mise wrappers are installed.
-
-mkdir -p ~/.local/share/icons/hicolor/48x48/apps/
-cp "$OMARCHY_PATH"/applications/icons/*.png ~/.local/share/icons/hicolor/48x48/apps/
-gtk-update-icon-cache ~/.local/share/icons/hicolor &>/dev/null
+# omarchy:summary=Ensure default application launchers and mise wrappers are installed.
 
 # Copy .desktop declarations
 mkdir -p ~/.local/share/applications
@@ -14,10 +10,8 @@ if omarchy-cmd-present alacritty; then
   cp "$OMARCHY_PATH/default/alacritty/Alacritty.desktop" ~/.local/share/applications/
 fi
 
-# Refresh the webapps, TUIs, and mise wrappers
-bash "$OMARCHY_PATH/install/packaging/icons.sh"
-bash "$OMARCHY_PATH/install/packaging/webapps.sh"
-bash "$OMARCHY_PATH/install/packaging/tuis.sh"
-bash "$OMARCHY_PATH/install/packaging/mise.sh"
+if [[ -f "$OMARCHY_PATH/install/user/mise.sh" ]]; then
+  bash "$OMARCHY_PATH/install/user/mise.sh"
+fi
 
 update-desktop-database ~/.local/share/applications

bin/omarchy-reinstall

@@ -5,12 +5,9 @@
 
 set -e
 
-# Attempt to reinstall all default Omarchy packages and reset all the default configs.
+echo -e "This will reinstall all default Omarchy packages and reset default configs.\nWarning: user config changes will be overwritten.\n"
 
-echo -e "This will reinstall all the default Omarchy packages and reset all default configs.\nWarning: All user changes to configs will be lost.\n"
-
-if gum confirm "Are you sure you want to reinstall and lose all config changes?"; then
-  omarchy-reinstall-git
+if gum confirm "Are you sure you want to reinstall and lose config changes?"; then
   omarchy-reinstall-pkgs
   omarchy-reinstall-configs
 

bin/omarchy-reinstall-configs

@@ -5,24 +5,18 @@
 
 set -e
 
-# Overwrite all user configs with the Omarchy defaults.
-
 if (( EUID == 0 )); then
   echo "Error: This script should not be run as root"
   exit 1
 fi
 
 echo "Resetting all Omarchy configs"
-cp -R $OMARCHY_PATH/config/* ~/.config/
-cp $OMARCHY_PATH/default/bashrc ~/.bashrc
-echo '[[ -f ~/.bashrc ]] && . ~/.bashrc' | tee ~/.bash_profile >/dev/null
-
-env OMARCHY_PATH="$OMARCHY_PATH" OMARCHY_INSTALL_MODE=online bash -c '
-  source "$OMARCHY_PATH/install/helpers/mode.sh"
-  detect_install_mode
-  source "$OMARCHY_PATH/install/config/theme-user.sh"
-'
-
+omarchy-setup-user --force
 omarchy-refresh-limine
 omarchy-refresh-plymouth
-omarchy-nvim-setup
+
+if omarchy-cmd-present omarchy-nvim-refresh; then
+  omarchy-nvim-refresh
+elif omarchy-cmd-present omarchy-nvim-setup; then
+  omarchy-nvim-setup --force
+fi

bin/omarchy-reinstall-git

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-# omarchy:summary=Reinstall the stable Omarchy source directory from git
-
-set -e
-
-# Reinstall the Omarchy configuration directory from the git source.
-
-git clone --depth=1 --branch master "https://github.com/basecamp/omarchy.git" ~/.local/share/omarchy-new >/dev/null
-mv $OMARCHY_PATH ~/.local/share/omarchy-old
-mv ~/.local/share/omarchy-new $OMARCHY_PATH

bin/omarchy-remove-gaming-battlenet

@@ -12,9 +12,7 @@ sleep 1
 
 rm -rf "$PREFIX"
 rm -f "$HOME/.local/share/applications/battlenet.desktop"
-rm -f "$HOME/.local/share/icons/hicolor/48x48/apps/Battle.net.png"
 rm -f "$HOME/.cache/omarchy/Battle.net-Setup.exe"
-gtk-update-icon-cache "$HOME/.local/share/icons/hicolor" &>/dev/null || true
 update-desktop-database "$HOME/.local/share/applications" 2>/dev/null || true
 
 echo

bin/omarchy-setup-hardware

@@ -0,0 +1,62 @@
+#!/bin/bash
+
+# omarchy:summary=Apply Omarchy hardware-specific packages and system configuration
+# omarchy:group=setup
+# omarchy:requires-sudo=true
+# omarchy:examples=omarchy setup hardware --install-user dhh
+
+set -euo pipefail
+
+usage() {
+  cat <<USAGE
+Usage: omarchy setup hardware --install-user USER
+
+Runs idempotent hardware detection/setup for the installed machine. This is
+called by omarchy-setup-system during ISO finalization and can be rerun later
+for diagnostics or after hardware/package updates.
+USAGE
+}
+
+install_user="${OMARCHY_INSTALL_USER:-}"
+while (($#)); do
+  case "$1" in
+    --install-user)
+      install_user="${2:-}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if (( EUID != 0 )); then
+  echo "Error: omarchy-setup-hardware must run as root" >&2
+  exit 1
+fi
+
+if [[ -z $install_user || $install_user == "root" ]]; then
+  echo "Error: --install-user must name the target non-root user" >&2
+  exit 1
+fi
+
+if ! getent passwd "$install_user" >/dev/null; then
+  echo "Error: user '$install_user' does not exist" >&2
+  exit 1
+fi
+
+export OMARCHY_INSTALL_USER="$install_user"
+export OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
+export OMARCHY_INSTALL="${OMARCHY_INSTALL:-$OMARCHY_PATH/install}"
+export OMARCHY_INSTALL_LOG_FILE="${OMARCHY_INSTALL_LOG_FILE:-/var/log/omarchy-install.log}"
+export PATH="$OMARCHY_PATH/bin:$PATH"
+
+source "$OMARCHY_INSTALL/helpers/logging.sh"
+source "$OMARCHY_INSTALL/helpers/chroot.sh"
+source "$OMARCHY_INSTALL/hardware/all.sh"

bin/omarchy-setup-system

@@ -0,0 +1,94 @@
+#!/bin/bash
+
+# omarchy:summary=Apply Omarchy system setup in the installed target
+# omarchy:group=setup
+# omarchy:requires-sudo=true
+# omarchy:examples=omarchy setup system --install-user dhh --first-install
+
+set -euo pipefail
+
+usage() {
+  cat <<USAGE
+Usage: omarchy setup system --install-user USER [--first-install|--upgrade]
+
+Runs root-owned Omarchy system setup. The ISO calls this in the target chroot
+after packages are installed and the target user exists. It also calls
+omarchy-setup-hardware, so hardware setup cannot be accidentally skipped.
+USAGE
+}
+
+install_user="${OMARCHY_INSTALL_USER:-}"
+first_install=0
+upgrade=0
+
+while (($#)); do
+  case "$1" in
+    --install-user)
+      install_user="${2:-}"
+      shift 2
+      ;;
+    --first-install)
+      first_install=1
+      shift
+      ;;
+    --upgrade)
+      upgrade=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if (( EUID != 0 )); then
+  echo "Error: omarchy-setup-system must run as root" >&2
+  exit 1
+fi
+
+if [[ -z $install_user || $install_user == "root" ]]; then
+  echo "Error: --install-user must name the target non-root user" >&2
+  exit 1
+fi
+
+if ! getent passwd "$install_user" >/dev/null; then
+  echo "Error: user '$install_user' does not exist" >&2
+  exit 1
+fi
+
+export OMARCHY_INSTALL_USER="$install_user"
+export OMARCHY_FIRST_INSTALL="$first_install"
+export OMARCHY_UPGRADE="$upgrade"
+export OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
+export OMARCHY_INSTALL="${OMARCHY_INSTALL:-$OMARCHY_PATH/install}"
+export OMARCHY_INSTALL_LOG_FILE="${OMARCHY_INSTALL_LOG_FILE:-/var/log/omarchy-install.log}"
+export PATH="$OMARCHY_PATH/bin:$PATH"
+
+source "$OMARCHY_INSTALL/helpers/logging.sh"
+source "$OMARCHY_INSTALL/helpers/chroot.sh"
+start_install_log
+
+run_logged "$OMARCHY_INSTALL/config/theme-system.sh"
+run_logged "$OMARCHY_INSTALL/config/increase-lockout-limit.sh"
+run_logged "$OMARCHY_INSTALL/config/lockscreen-pam.sh"
+run_logged "$OMARCHY_INSTALL/config/fix-powerprofilesctl-shebang.sh"
+run_logged "$OMARCHY_INSTALL/config/docker.sh"
+run_logged "$OMARCHY_INSTALL/config/enable-services.sh"
+run_logged "$OMARCHY_INSTALL/config/firewall.sh"
+
+omarchy-setup-hardware --install-user "$install_user"
+
+run_logged "$OMARCHY_INSTALL/login/sddm.sh"
+
+run_logged "$OMARCHY_INSTALL/post-install/dns-resolver.sh"
+run_logged "$OMARCHY_INSTALL/post-install/pacman.sh"
+run_logged "$OMARCHY_INSTALL/post-install/udev.sh"
+run_logged "$OMARCHY_INSTALL/post-install/localdb.sh"
+
+stop_install_log

bin/omarchy-setup-user

@@ -6,28 +6,51 @@
 
 set -euo pipefail
 
+usage() {
+  cat <<USAGE
+Usage: omarchy setup user [--force] [--first-install]
+
+Idempotent user-level setup: copies/symlinks defaults from \$OMARCHY_PATH
+into \$HOME, installs user services/session defaults, refreshes app launchers,
+and applies user-scoped hardware/session tweaks.
+
+--first-install is used by the ISO in the target chroot. It marks shipped
+migrations complete for the freshly-created user and enables the first graphical
+login one-shot.
+
+Idempotency marker: ~/.local/state/omarchy/setup-user.done
+USAGE
+}
+
 if (( EUID == 0 )); then
   echo "Error: run omarchy-setup-user as the user being configured, not as root." >&2
   exit 1
 fi
 
 force=0
-if [[ ${1:-} == "--force" ]]; then
-  force=1
-elif [[ ${1:-} == "-h" || ${1:-} == "--help" ]]; then
-  cat <<USAGE
-Usage: omarchy setup user [--force]
-
-Idempotent user-level setup: copies/symlinks defaults from \$OMARCHY_PATH
-into \$HOME (config files, AI skills, nautilus extensions, branding, MIME
-defaults, etc.). Runs automatically on first user login via the omarchy
-first-run flow; rerun manually after creating a new user, or with --force
-to refresh after a dev-link.
-
-Idempotency marker: ~/.local/state/omarchy/setup-user.done
-USAGE
-  exit 0
-fi
+first_install=0
+while (($#)); do
+  case "$1" in
+    --force)
+      force=1
+      shift
+      ;;
+    --first-install)
+      first_install=1
+      force=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
 
 state_dir="$HOME/.local/state/omarchy"
 marker="$state_dir/setup-user.done"
@@ -40,15 +63,11 @@ fi
 
 export OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
 export OMARCHY_INSTALL="${OMARCHY_INSTALL:-$OMARCHY_PATH/install}"
+export OMARCHY_SETUP_CONTEXT="${OMARCHY_SETUP_CONTEXT:-runtime}"
 export PATH="$OMARCHY_PATH/bin:$PATH"
 
-if [[ -f $OMARCHY_INSTALL/helpers/mode.sh ]]; then
-  source "$OMARCHY_INSTALL/helpers/mode.sh"
-  detect_install_mode
-  export_legacy_mode_flags
-else
-  install_mode_is() { [[ ${OMARCHY_INSTALL_MODE:-online} == "$1" ]]; }
-  export -f install_mode_is
+if (( first_install )); then
+  export OMARCHY_SETUP_CONTEXT=iso-chroot
 fi
 
 if [[ -n ${OMARCHY_INSTALL_LOG_FILE:-} && -f $OMARCHY_INSTALL/helpers/logging.sh ]]; then
@@ -60,38 +79,60 @@ else
   }
 fi
 
-# Copy over Omarchy configs for this user. /etc/skel handles newly-created
-# users, but existing users installing Omarchy need the same defaults seeded.
+omarchy_user_systemctl_enable() {
+  local unit="$1" unit_path target
+  local -a targets=()
+
+  if systemctl --user enable "$unit" >/dev/null 2>&1; then
+    return 0
+  fi
+
+  # ISO chroot setup has no running user systemd manager. Enabling a user unit
+  # is just creating the [Install] WantedBy symlinks, so do that directly.
+  unit_path="$HOME/.config/systemd/user/$unit"
+  if [[ -f $unit_path ]]; then
+    mapfile -t targets < <(awk -F= '
+      /^\[Install\]/ { in_install=1; next }
+      /^\[/ { in_install=0 }
+      in_install && $1 == "WantedBy" {
+        n=split($2, values, /[[:space:]]+/)
+        for (i = 1; i <= n; i++) if (values[i] != "") print values[i]
+      }
+    ' "$unit_path")
+  fi
+  ((${#targets[@]})) || targets=(default.target)
+
+  for target in "${targets[@]}"; do
+    mkdir -p "$HOME/.config/systemd/user/$target.wants"
+    ln -sfn "../$unit" "$HOME/.config/systemd/user/$target.wants/$unit"
+  done
+}
+export -f omarchy_user_systemctl_enable
+
 mkdir -p ~/.config
 cp -R "$OMARCHY_PATH/config/." ~/.config/
 cp "$OMARCHY_PATH/default/bashrc" ~/.bashrc
 echo '[[ -f ~/.bashrc ]] && . ~/.bashrc' > ~/.bash_profile
 
-# AI assistant skill symlinks. Each agent has its own conventional skills
-# directory; we drop an 'omarchy' entry into each so the skill is loaded.
 mkdir -p ~/.agents/skills ~/.claude/skills ~/.codex/skills ~/.pi/agent/skills
 ln -sfn "$OMARCHY_PATH/default/omarchy-skill" ~/.agents/skills/omarchy
 ln -sfn "$OMARCHY_PATH/default/omarchy-skill" ~/.claude/skills/omarchy
 ln -sfn "$OMARCHY_PATH/default/omarchy-skill" ~/.codex/skills/omarchy
 ln -sfn "$OMARCHY_PATH/default/omarchy-skill" ~/.pi/agent/skills/omarchy
 
-# Toggle state and flags
 mkdir -p ~/.local/state/omarchy/toggles/hypr
 cp "$OMARCHY_PATH/default/hypr/toggles/flags.lua" ~/.local/state/omarchy/toggles/hypr/
 
-# Nautilus python extensions
 mkdir -p "$HOME/.local/share/nautilus-python/extensions"
 cp "$OMARCHY_PATH/default/nautilus-python/extensions/localsend.py" \
    "$HOME/.local/share/nautilus-python/extensions/"
 cp "$OMARCHY_PATH/default/nautilus-python/extensions/transcode.py" \
    "$HOME/.local/share/nautilus-python/extensions/"
 
-# Branding (fastfetch about + screensaver text)
 mkdir -p ~/.config/omarchy/branding
 cp "$OMARCHY_PATH/icon.txt" ~/.config/omarchy/branding/about.txt
 cp "$OMARCHY_PATH/logo.txt" ~/.config/omarchy/branding/screensaver.txt
 
-# XDG user dirs (folder layout, gtk bookmarks)
 mkdir -p ~/Downloads ~/Pictures ~/Videos ~/.config/gtk-3.0
 xdg-user-dirs-update --set TEMPLATES "$HOME"
 xdg-user-dirs-update --set PUBLICSHARE "$HOME"
@@ -103,7 +144,6 @@ for dir in Downloads Projects Pictures Videos; do
   grep -qxF "$bookmark" ~/.config/gtk-3.0/bookmarks || echo "$bookmark" >>~/.config/gtk-3.0/bookmarks
 done
 
-# Hyprland keyboard layout from /etc/vconsole.conf
 conf=/etc/vconsole.conf
 hyprlua="$HOME/.config/hypr/input.lua"
 if [[ -f $conf && -f $hyprlua ]]; then
@@ -120,15 +160,18 @@ if [[ -f $conf && -f $hyprlua ]]; then
   fi
 fi
 
-# Reusable per-user install phase: theme, shell/user services, default keyring,
-# hardware-specific user session fixes, and other current-user setup.
 source "$OMARCHY_INSTALL/user/all.sh"
 
-# Application catalog + MIME defaults. Run after mise/node setup from user/all
-# so npm-backed wrappers can be installed for each user.
 omarchy-refresh-applications
 xdg-settings set default-web-browser chromium.desktop
 xdg-mime default HEY.desktop x-scheme-handler/mailto
 
+if (( first_install )); then
+  mkdir -p "$state_dir/migrations"
+  for migration in "$OMARCHY_PATH"/migrations/*.sh; do
+    [[ -f $migration ]] && touch "$state_dir/migrations/$(basename "$migration")"
+  done
+fi
+
 touch "$marker"
 echo "User setup complete."

bin/omarchy-system-sleep-monitor

@@ -7,11 +7,13 @@
 monitor_command='exec dbus-monitor --system "type='\''signal'\'',sender='\''org.freedesktop.login1'\'',interface='\''org.freedesktop.login1.Manager'\'',member='\''PrepareForSleep'\''"'
 
 consume_sleep_events() {
-  local line
+  local line sleep_lock
+  sleep_lock=$(command -v omarchy-system-sleep-lock || true)
+  sleep_lock=${sleep_lock:-/usr/bin/omarchy-system-sleep-lock}
 
   while IFS= read -r line; do
     if [[ $line == *"boolean true"* ]]; then
-      "$OMARCHY_PATH/bin/omarchy-system-sleep-lock"
+      "$sleep_lock"
       exit 0
     fi
   done
@@ -22,9 +24,12 @@ if [[ ${1:-} == "--consume" ]]; then
   exit 0
 fi
 
+sleep_monitor=$(command -v omarchy-system-sleep-monitor || true)
+sleep_monitor=${sleep_monitor:-/usr/bin/omarchy-system-sleep-monitor}
+
 exec systemd-inhibit \
   --what=sleep \
   --mode=delay \
   --who=Omarchy \
   --why="Lock screen before suspend" \
-  bash -lc "$monitor_command | \"$OMARCHY_PATH/bin/omarchy-system-sleep-monitor\" --consume"
+  bash -lc "$monitor_command | \"$sleep_monitor\" --consume"

bin/omarchy-theme-set

@@ -110,6 +110,10 @@ set_theme_background() {
 }
 
 THEME_NAME=$(echo "$1" | sed -E 's/<[^>]+>//g' | tr '[:upper:]' '[:lower:]' | tr ' ' '-')
+THEME_HEADLESS=0
+if [[ ${OMARCHY_THEME_HEADLESS:-} == "1" || ${OMARCHY_THEME_OFFLINE:-} == "1" ]]; then
+  THEME_HEADLESS=1
+fi
 
 if [[ ! -d $OMARCHY_THEMES_PATH/$THEME_NAME ]] && [[ ! -d $USER_THEMES_PATH/$THEME_NAME ]]; then
   echo "Theme '$THEME_NAME' does not exist"
@@ -139,7 +143,7 @@ fi
 omarchy-theme-set-templates
 
 OLD_BACKGROUND_SNAPSHOT=""
-if [[ $OMARCHY_THEME_SKIP_BACKGROUND != "1" ]]; then
+if [[ $THEME_HEADLESS != "1" && $OMARCHY_THEME_SKIP_BACKGROUND != "1" ]]; then
   OLD_BACKGROUND_SNAPSHOT=$(snapshot_current_background)
 fi
 
@@ -154,7 +158,7 @@ echo "$THEME_NAME" >"$HOME/.config/omarchy/current/theme.name"
 # the theme hooks run.
 colors_payload=$([[ -f $CURRENT_THEME_PATH/colors.toml ]] && base64 -w 0 "$CURRENT_THEME_PATH/colors.toml")
 shell_payload=$([[ -f $CURRENT_THEME_PATH/shell.toml ]] && base64 -w 0 "$CURRENT_THEME_PATH/shell.toml")
-if [[ ${OMARCHY_THEME_OFFLINE:-} == "1" ]]; then
+if [[ $THEME_HEADLESS == "1" ]]; then
   : # No shell/session bus exists during ISO chroot finalization.
 elif [[ $OMARCHY_THEME_SKIP_BACKGROUND == "1" ]]; then
   shell_ipc shell applyTheme "$colors_payload" "$shell_payload" || true
@@ -183,7 +187,7 @@ post_theme_commands=(
   omarchy-theme-set-keyboard
 )
 
-if [[ ${OMARCHY_THEME_OFFLINE:-} != "1" ]]; then
+if [[ $THEME_HEADLESS != "1" ]]; then
   run_parallel "${post_theme_commands[@]}"
 
   # Call hook on theme set

bin/omarchy-tui-install

@@ -1,40 +1,76 @@
 #!/bin/bash
 
 # omarchy:summary=Create a desktop launcher for a terminal UI app
-# omarchy:args=[name command window-style icon-url]
+# omarchy:args=[name command window-style icon-url-or-name]
 
 set -e
 
+ICON_DIR="$HOME/.local/share/icons/hicolor/256x256/apps"
+
+safe_icon_name() {
+  printf '%s\n' "$1" \
+    | tr '[:upper:]' '[:lower:]' \
+    | sed 's/[^[:alnum:]]\+/-/g; s/^-//; s/-$//'
+}
+
+icon_name_from_ref() {
+  local ref="$1"
+  local name
+  name=$(basename "$ref")
+
+  if [[ $name == *.* ]]; then
+    safe_icon_name "${name%.*}"
+  else
+    printf '%s\n' "$name"
+  fi
+}
+
+install_user_icon() {
+  local source="$1"
+  local name="$2"
+  local ext="${source##*.}"
+
+  [[ $ext == "$source" ]] && ext="png"
+  mkdir -p "$ICON_DIR"
+  cp "$source" "$ICON_DIR/$name.$ext"
+  gtk-update-icon-cache "$HOME/.local/share/icons/hicolor" &>/dev/null || true
+  printf '%s\n' "$name"
+}
+
 if (( $# != 4 )); then
   echo -e "\e[32mLet's create a TUI shortcut you can start with the app launcher.\n\e[0m"
   APP_NAME=$(gum input --prompt "Name> " --placeholder "My TUI")
   APP_EXEC=$(gum input --prompt "Launch Command> " --placeholder "lazydocker or bash -c 'dust; read -n 1 -s'")
   WINDOW_STYLE=$(gum choose --header "Window style" float tile)
-  ICON_URL=$(gum input --prompt "Icon URL> " --placeholder "See https://dashboardicons.com (must use PNG or SVG!)")
+  ICON_REF=$(gum input --prompt "Icon URL/name> " --placeholder "See https://dashboardicons.com or enter an installed icon name")
 else
   APP_NAME="$1"
   APP_EXEC="$2"
   WINDOW_STYLE="$3"
-  ICON_URL="$4"
+  ICON_REF="$4"
 fi
 
-if [[ -z $APP_NAME || -z $APP_EXEC || -z $ICON_URL ]]; then
-  echo "You must set app name, app command, and icon URL!"
+if [[ -z $APP_NAME || -z $APP_EXEC || -z $ICON_REF ]]; then
+  echo "You must set app name, app command, and icon URL/name!"
   exit 1
 fi
 
-ICON_DIR="$HOME/.local/share/applications/icons"
 DESKTOP_FILE="$HOME/.local/share/applications/$APP_NAME.desktop"
+mkdir -p "$(dirname "$DESKTOP_FILE")"
 
-if [[ ! $ICON_URL =~ ^https?:// ]] && [[ -f $ICON_URL ]]; then
-  ICON_PATH="$ICON_URL"
-else
-  ICON_PATH="$ICON_DIR/$APP_NAME.png"
+if [[ $ICON_REF =~ ^https?:// ]]; then
+  ICON_VALUE=$(safe_icon_name "$APP_NAME")
   mkdir -p "$ICON_DIR"
-  if ! curl -sL -o "$ICON_PATH" "$ICON_URL"; then
+  if ! curl -sL -o "$ICON_DIR/$ICON_VALUE.png" "$ICON_REF"; then
     echo "Error: Failed to download icon."
     exit 1
   fi
+  gtk-update-icon-cache "$HOME/.local/share/icons/hicolor" &>/dev/null || true
+elif [[ -f $ICON_REF ]]; then
+  ICON_VALUE=$(install_user_icon "$ICON_REF" "$(safe_icon_name "$APP_NAME")")
+else
+  # Bundled Omarchy icons are package-owned under /usr/share/icons/hicolor.
+  ICON_VALUE=$(icon_name_from_ref "$ICON_REF")
 fi
 
 if [[ $WINDOW_STYLE == "float" ]]; then
@@ -51,7 +87,7 @@ Comment=$APP_NAME
 Exec=xdg-terminal-exec --app-id=$APP_CLASS -e $APP_EXEC
 Terminal=false
 Type=Application
-Icon=$ICON_PATH
+Icon=$ICON_VALUE
 StartupNotify=true
 EOF
 

bin/omarchy-tui-remove

@@ -5,7 +5,8 @@
 
 set -e
 
-ICON_DIR="$HOME/.local/share/applications/icons"
+ICON_DIR="$HOME/.local/share/icons/hicolor/256x256/apps"
+OLD_ICON_DIR="$HOME/.local/share/applications/icons"
 DESKTOP_DIR="$HOME/.local/share/applications/"
 
 if (( $# == 0 )); then
@@ -32,6 +33,7 @@ if [[ -z $APP_NAME ]]; then
   exit 1
 fi
 
+icon_name=$(printf '%s\n' "$APP_NAME" | tr '[:upper:]' '[:lower:]' | sed 's/[^[:alnum:]]\+/-/g; s/^-//; s/-$//')
 rm -f "$DESKTOP_DIR/$APP_NAME.desktop"
-rm -f "$ICON_DIR/$APP_NAME.png"
+rm -f "$ICON_DIR/$icon_name.png" "$ICON_DIR/$APP_NAME.png" "$OLD_ICON_DIR/$APP_NAME.png"
 omarchy-notification-send -g  "TUI removed" "$APP_NAME"

bin/omarchy-tui-remove-all

@@ -5,7 +5,8 @@
 set -e
 
 APP_DIR="${1:-$HOME/.local/share/applications}"
-ICON_DIR="$HOME/.local/share/applications/icons"
+ICON_DIR="$HOME/.local/share/icons/hicolor/256x256/apps"
+OLD_ICON_DIR="$HOME/.local/share/applications/icons"
 
 echo "Scanning for TUIs in $APP_DIR..."
 
@@ -23,9 +24,10 @@ fi
 
 for file in "${tui_desktop_files[@]}"; do
   app_name=$(basename "$file" .desktop)
+  icon_name=$(printf '%s\n' "$app_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^[:alnum:]]\+/-/g; s/^-//; s/-$//')
   echo "Removing TUI: $app_name"
   rm -f "$file"
-  rm -f "$ICON_DIR/$app_name.png"
+  rm -f "$ICON_DIR/$icon_name.png" "$ICON_DIR/$app_name.png" "$OLD_ICON_DIR/$app_name.png"
 done
 
 if command -v update-desktop-database &>/dev/null; then

bin/omarchy-update

@@ -7,8 +7,6 @@
 
 set -e
 
-# Run the update inside a PTY so pacman/yay keep showing download progress
-# while still logging the full session for later analysis.
 if [[ -z $OMARCHY_UPDATE_LOGGED ]]; then
   script_command=$(printf '%q ' "$0" "$@")
   exec env OMARCHY_UPDATE_LOGGED=1 script -qefc "$script_command" "/tmp/omarchy-update.log"
@@ -16,8 +14,7 @@ fi
 
 trap 'echo ""; echo -e "\033[0;31mSomething went wrong during the update!\n\nPlease review the output above carefully, correct the error, and retry the update.\n\nIf you need assistance, get help from the community at https://omarchy.org/discord\033[0m"' ERR
 
-if [[ $1 == "-y" ]] || omarchy-update-confirm; then
+if [[ ${1:-} == "-y" ]] || omarchy-update-confirm; then
   omarchy-snapshot create || (($? == 127))
-  omarchy-update-git
   omarchy-update-perform
 fi

bin/omarchy-update-available

@@ -1,24 +1,15 @@
 #!/bin/bash
 
-# omarchy:summary=Get remote tag
+# omarchy:summary=Check whether the Omarchy package has an available update.
 
-latest_tag=$(git -C "$OMARCHY_PATH" ls-remote --tags origin | grep -v "{}" | awk '{print $2}' | sed 's#refs/tags/##' | sort -V | tail -n 1)
-if [[ -z $latest_tag ]]; then
-  echo "Error: Could not retrieve latest tag."
-  exit 1
-fi
+set -e
 
-# Get local tag
-current_tag=$(git -C "$OMARCHY_PATH" describe --tags $(git -C "$OMARCHY_PATH" rev-list --tags --max-count=1))
-if [[ -z $current_tag ]]; then
-  echo "Error: Could not retrieve current tag."
-  exit 1
-fi
-
-if [[ $current_tag != $latest_tag ]]; then
-  echo "Omarchy update available ($latest_tag)"
+if pacman -Qu omarchy >/tmp/omarchy-update-available.$$ 2>/dev/null; then
+  cat /tmp/omarchy-update-available.$$
+  rm -f /tmp/omarchy-update-available.$$
   exit 0
-else
-  echo "Omarchy is up to date ($current_tag)"
-  exit 1
 fi
+
+rm -f /tmp/omarchy-update-available.$$
+echo "Omarchy is up to date"
+exit 1

bin/omarchy-update-branch

@@ -1,36 +0,0 @@
-#!/bin/bash
-
-# omarchy:summary=Switch Omarchy branches and update from the selected branch
-# omarchy:args=<branch>
-
-set -e
-
-if (($# == 0)); then
-  echo "Usage: omarchy-update-branch [master|dev]"
-  exit 1
-fi
-
-branch="$1"
-
-# Snapshot before switching branch
-omarchy-snapshot create || (( $? == 127 ))
-
-if ! git -C "$OMARCHY_PATH" diff --quiet || ! git -C "$OMARCHY_PATH" diff --cached --quiet; then
-  stashed=true
-  git -C "$OMARCHY_PATH" stash push -u -m "Autostash before switching to $branch"
-else
-  stashed=false
-fi
-
-# Switch branches
-git -C "$OMARCHY_PATH" switch "$branch"
-
-# Reapply stash if we made one
-if [[ $stashed == "true" ]]; then
-  if ! git -C "$OMARCHY_PATH" stash pop; then
-    echo "⚠️ Conflicts when applying stash — stash kept"
-  fi
-fi
-
-# Update the system from the new branch
-omarchy-update-perform

bin/omarchy-update-git

@@ -1,18 +0,0 @@
-#!/bin/bash
-
-# omarchy:summary=Pull the latest Omarchy git changes
-
-set -e
-
-echo -e "\e[32mUpdate Omarchy\e[0m"
-
-omarchy-update-time
-
-# Suppress Hyprland config errors while git updates default config files mid-pull
-hyprctl keyword debug:suppress_errors true &>/dev/null || true
-hyprctl eval 'hl.config({ debug = { suppress_errors = true } })' &>/dev/null || true
-
-git -C $OMARCHY_PATH pull --autostash
-git -C $OMARCHY_PATH --no-pager diff --check || git -C $OMARCHY_PATH reset --merge
-
-hyprctl reload &>/dev/null || true

bin/omarchy-version-branch

@@ -1,5 +0,0 @@
-#!/bin/bash
-
-# omarchy:summary=Print the current Omarchy git branch
-
-echo $(git -C "$OMARCHY_PATH" rev-parse --abbrev-ref HEAD)

bin/omarchy-webapp-install

@@ -1,11 +1,41 @@
 #!/bin/bash
 
 # omarchy:summary=Create a desktop launcher for a web app
-# omarchy:args=[name url icon [custom-exec] [mime-types]]
+# omarchy:args=[name url icon-url-or-name [custom-exec] [mime-types]]
 
 set -e
 
-ICON_DIR="$HOME/.local/share/applications/icons"
+ICON_DIR="$HOME/.local/share/icons/hicolor/256x256/apps"
+
+safe_icon_name() {
+  printf '%s\n' "$1" \
+    | tr '[:upper:]' '[:lower:]' \
+    | sed 's/[^[:alnum:]]\+/-/g; s/^-//; s/-$//'
+}
+
+icon_name_from_ref() {
+  local ref="$1"
+  local name
+  name=$(basename "$ref")
+
+  if [[ $name == *.* ]]; then
+    safe_icon_name "${name%.*}"
+  else
+    printf '%s\n' "$name"
+  fi
+}
+
+install_user_icon() {
+  local source="$1"
+  local name="$2"
+  local ext="${source##*.}"
+
+  [[ $ext == "$source" ]] && ext="png"
+  mkdir -p "$ICON_DIR"
+  cp "$source" "$ICON_DIR/$name.$ext"
+  gtk-update-icon-cache "$HOME/.local/share/icons/hicolor" &>/dev/null || true
+  printf '%s\n' "$name"
+}
 
 if (( $# < 3 )); then
   echo -e "\e[32mLet's create a new web app you can start with the app launcher.\n\e[0m"
@@ -18,10 +48,12 @@ if (( $# < 3 )); then
   # Try to fetch favicon automatically first.
   FAVICON_URL="https://www.google.com/s2/favicons?domain=${APP_URL}&sz=128"
   mkdir -p "$ICON_DIR"
-  if curl -fsSL -o "$ICON_DIR/$APP_NAME.png" "$FAVICON_URL" && [[ -s $ICON_DIR/$APP_NAME.png ]]; then
-    ICON_REF="$APP_NAME.png"
+  ICON_VALUE=$(safe_icon_name "$APP_NAME")
+  if curl -fsSL -o "$ICON_DIR/$ICON_VALUE.png" "$FAVICON_URL" && [[ -s $ICON_DIR/$ICON_VALUE.png ]]; then
+    gtk-update-icon-cache "$HOME/.local/share/icons/hicolor" &>/dev/null || true
+    ICON_REF="$ICON_VALUE"
   else
-    ICON_REF=$(gum input --prompt "Icon URL> " --placeholder "Could not fetch favicon automatically. Enter PNG icon URL (see https://dashboardicons.com)")
+    ICON_REF=$(gum input --prompt "Icon URL/name> " --placeholder "Could not fetch favicon automatically. Enter PNG icon URL or icon name")
   fi
 
   CUSTOM_EXEC=""
@@ -45,21 +77,24 @@ if [[ -z $APP_NAME || -z $APP_URL ]]; then
   exit 1
 fi
 
-# Resolve icon from URL or from a local icon name.
-mkdir -p "$ICON_DIR"
-
 if [[ -z $ICON_REF ]]; then
   ICON_REF="https://www.google.com/s2/favicons?domain=${APP_URL}&sz=128"
 fi
 
 if [[ $ICON_REF =~ ^https?:// ]]; then
-  ICON_PATH="$ICON_DIR/$APP_NAME.png"
-  if ! curl -fsSL -o "$ICON_PATH" "$ICON_REF" || [[ ! -s $ICON_PATH ]]; then
+  ICON_VALUE=$(safe_icon_name "$APP_NAME")
+  mkdir -p "$ICON_DIR"
+  if ! curl -fsSL -o "$ICON_DIR/$ICON_VALUE.png" "$ICON_REF" || [[ ! -s $ICON_DIR/$ICON_VALUE.png ]]; then
     echo "Error: Failed to download icon."
     exit 1
   fi
+  gtk-update-icon-cache "$HOME/.local/share/icons/hicolor" &>/dev/null || true
+elif [[ -f $ICON_REF ]]; then
+  ICON_VALUE=$(install_user_icon "$ICON_REF" "$(safe_icon_name "$APP_NAME")")
 else
-  ICON_PATH="$ICON_DIR/$ICON_REF"
+  # Bundled Omarchy icons are package-owned under /usr/share/icons/hicolor.
+  # Accept either "HEY" or the historical "HEY.png" argument form.
+  ICON_VALUE=$(icon_name_from_ref "$ICON_REF")
 fi
 
 # Use custom exec if provided, otherwise default behavior
@@ -67,6 +102,7 @@ EXEC_COMMAND="${CUSTOM_EXEC:-omarchy-launch-webapp $APP_URL}"
 
 # Create application .desktop file
 DESKTOP_FILE="$HOME/.local/share/applications/$APP_NAME.desktop"
+mkdir -p "$(dirname "$DESKTOP_FILE")"
 
 cat >"$DESKTOP_FILE" <<EOF
 [Desktop Entry]
@@ -76,7 +112,7 @@ Comment=$APP_NAME
 Exec=$EXEC_COMMAND
 Terminal=false
 Type=Application
-Icon=$ICON_PATH
+Icon=$ICON_VALUE
 StartupNotify=true
 EOF
 

bin/omarchy-webapp-remove

@@ -5,7 +5,8 @@
 
 set -e
 
-ICON_DIR="$HOME/.local/share/applications/icons"
+ICON_DIR="$HOME/.local/share/icons/hicolor/256x256/apps"
+OLD_ICON_DIR="$HOME/.local/share/applications/icons"
 DESKTOP_DIR="$HOME/.local/share/applications/"
 
 if (( $# == 0 )); then
@@ -32,8 +33,9 @@ if [[ -z $APP_NAME ]]; then
   exit 1
 fi
 
+icon_name=$(printf '%s\n' "$APP_NAME" | tr '[:upper:]' '[:lower:]' | sed 's/[^[:alnum:]]\+/-/g; s/^-//; s/-$//')
 rm -f "$DESKTOP_DIR/$APP_NAME.desktop"
-rm -f "$ICON_DIR/$APP_NAME.png"
+rm -f "$ICON_DIR/$icon_name.png" "$ICON_DIR/$APP_NAME.png" "$OLD_ICON_DIR/$APP_NAME.png"
 
 omarchy-notification-send -g  "Web app removed" "$APP_NAME"
 update-desktop-database "$DESKTOP_DIR" &>/dev/null

bin/omarchy-webapp-remove-all

@@ -5,7 +5,8 @@
 set -e
 
 APP_DIR="${1:-$HOME/.local/share/applications}"
-ICON_DIR="$HOME/.local/share/applications/icons"
+ICON_DIR="$HOME/.local/share/icons/hicolor/256x256/apps"
+OLD_ICON_DIR="$HOME/.local/share/applications/icons"
 
 echo "Scanning for web apps in $APP_DIR..."
 
@@ -23,9 +24,10 @@ fi
 
 for file in "${webapp_desktop_files[@]}"; do
   app_name=$(basename "$file" .desktop)
+  icon_name=$(printf '%s\n' "$app_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^[:alnum:]]\+/-/g; s/^-//; s/-$//')
   echo "Removing web app: $app_name"
   rm -f "$file"
-  rm -f "$ICON_DIR/$app_name.png"
+  rm -f "$ICON_DIR/$icon_name.png" "$ICON_DIR/$app_name.png" "$OLD_ICON_DIR/$app_name.png"
 done
 
 if command -v update-desktop-database &>/dev/null; then

bin/omarchy-windows-vm

@@ -44,19 +44,14 @@ install_windows() {
 
   mkdir -p "$HOME/.windows"
   mkdir -p "$HOME/.config/windows"
-  mkdir -p "$HOME/.local/share/applications/icons"
-
-  # Install Windows VM icon and desktop file
-  if [[ -f $OMARCHY_PATH/applications/icons/windows.png ]]; then
-    cp "$OMARCHY_PATH/applications/icons/windows.png" "$HOME/.local/share/applications/icons/windows.png"
-  fi
+  mkdir -p "$HOME/.local/share/applications"
 
   cat << EOF | tee "$HOME/.local/share/applications/windows-vm.desktop" > /dev/null
 [Desktop Entry]
 Name=Windows
 Comment=Start Windows VM via Docker and connect with RDP
 Exec=uwsm app -- omarchy-windows-vm launch
-Icon=$HOME/.local/share/applications/icons/windows.png
+Icon=windows
 Terminal=false
 Type=Application
 Categories=System;Virtualization;

boot.sh

@@ -1,53 +0,0 @@
-#!/bin/bash
-# Curl-able Omarchy bootstrap. Configures the omarchy pacman repo on a fresh
-# Arch system, installs the omarchy-installer package (which pulls omarchy,
-# omarchy-settings, and omarchy-limine via depends), then hands off to
-# `omarchy install`.
-#
-# Usage:
-#   curl -sSL https://omarchy.org/boot.sh | bash
-#   curl -sSL https://omarchy.org/boot.sh | OMARCHY_REF=dev bash
-
-set -e
-
-ansi_art='                 ▄▄▄
- ▄█████▄    ▄███████████▄    ▄███████   ▄███████   ▄███████   ▄█   █▄    ▄█   █▄
-███   ███  ███   ███   ███  ███   ███  ███   ███  ███   ███  ███   ███  ███   ███
-███   ███  ███   ███   ███  ███   ███  ███   ███  ███   █▀   ███   ███  ███   ███
-███   ███  ███   ███   ███ ▄███▄▄▄███ ▄███▄▄▄██▀  ███       ▄███▄▄▄███▄ ███▄▄▄███
-███   ███  ███   ███   ███ ▀███▀▀▀███ ▀███▀▀▀▀    ███      ▀▀███▀▀▀███  ▀▀▀▀▀▀███
-███   ███  ███   ███   ███  ███   ███ ██████████  ███   █▄   ███   ███  ▄██   ███
-███   ███  ███   ███   ███  ███   ███  ███   ███  ███   ███  ███   ███  ███   ███
- ▀█████▀    ▀█   ███   █▀   ███   █▀   ███   ███  ███████▀   ███   █▀    ▀█████▀
-                                       ███   █▀                                  '
-clear
-echo -e "\n$ansi_art\n"
-
-# Pick the omarchy package channel. stable is the default; dev/rc are for
-# pre-release testing.
-case "${OMARCHY_REF:-master}" in
-  dev) channel=edge ;;
-  rc)  channel=rc ;;
-  *)   channel=stable ;;
-esac
-
-echo "Configuring omarchy [${channel}] pacman repo..."
-sudo tee /etc/pacman.d/omarchy.conf >/dev/null <<EOF
-[omarchy]
-SigLevel = Optional TrustAll
-Server = https://pkgs.omarchy.org/${channel}/\$arch
-EOF
-if ! grep -q '^Include = /etc/pacman.d/omarchy.conf' /etc/pacman.conf; then
-  echo -e "\nInclude = /etc/pacman.d/omarchy.conf" | sudo tee -a /etc/pacman.conf >/dev/null
-fi
-
-echo "Refreshing pacman databases..."
-sudo pacman -Sy --noconfirm
-
-echo "Installing omarchy-installer..."
-# Only install the runner here — install.sh pulls the full omarchy runtime
-# itself once it knows the mode and has logged in.
-sudo pacman -S --noconfirm --needed omarchy-keyring omarchy-installer
-
-echo -e "\nInstallation starting..."
-exec omarchy-install

config/fastfetch/config.jsonc

@@ -68,12 +68,6 @@
       "keyColor": "blue",
       "text": "version=$(omarchy-version); echo \"Omarchy $version\""
     },
-    {
-      "type": "command",
-      "key": "│ ├󰘬",
-      "keyColor": "blue",
-      "text": "branch=$(omarchy-version-branch); echo \"$branch\""
-    },
     {
       "type": "command",
       "key": "│ ├󰔫",

config/mimeapps.list

@@ -12,10 +12,7 @@ application/pdf=org.gnome.Evince.desktop
 
 x-scheme-handler/http=chromium.desktop
 x-scheme-handler/https=chromium.desktop
-
-# Note: x-scheme-handler/mailto -> HEY.desktop is set at install time by
-# install/config/mimetypes.sh because HEY.desktop is generated by
-# install/packaging/webapps.sh, not shipped as a /etc/skel file.
+x-scheme-handler/mailto=HEY.desktop
 
 video/mp4=mpv.desktop
 video/x-msvideo=mpv.desktop

config/systemd/user/omarchy-sleep-lock.service

@@ -5,7 +5,7 @@ Requires=dbus.socket
 
 [Service]
 Type=simple
-ExecStart=%h/.local/share/omarchy/bin/omarchy-system-sleep-monitor
+ExecStart=/usr/bin/omarchy-system-sleep-monitor
 Restart=always
 RestartSec=2
 

config/uwsm/env

@@ -1,10 +1,9 @@
 # Changes require a restart to take effect.
 
 # Source /etc/omarchy.conf so omarchy-dev-link (which writes
-# OMARCHY_PATH=<checkout> there) wins over the default. install.sh's
-# script-mode export still wins because the file uses the same :- guard.
-# UWSM doesn't source /etc/profile.d/, so this duplicates that logic for the
-# Hyprland session.
+# OMARCHY_PATH=<checkout> there) wins over the packaged default. UWSM doesn't
+# source /etc/profile.d/, so this duplicates that logic for the Hyprland
+# session.
 [ -f /etc/omarchy.conf ] && . /etc/omarchy.conf
 export OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
 export PATH="$OMARCHY_PATH/bin:$PATH:$HOME/.local/bin"

default/bash/envs

@@ -7,8 +7,8 @@ export MANROFFOPT="-c"
 export MANPAGER="sh -c 'col -bx | bat -l man -p'"
 
 # Duplicated from .config/uwsm/env so SSH/non-login shells also see the
-# override. /etc/omarchy.conf wins (omarchy-dev-link writes it);
-# install.sh's script-mode export wins over that via the :- guard.
+# override. /etc/omarchy.conf wins (omarchy-dev-link writes it); otherwise
+# the packaged runtime under /usr/share/omarchy is used.
 [ -f /etc/omarchy.conf ] && . /etc/omarchy.conf
 export OMARCHY_PATH="${OMARCHY_PATH:-/usr/share/omarchy}"
 export PATH="$OMARCHY_PATH/bin:$PATH:$HOME/.local/bin"

default/limine/default.conf

@@ -1,20 +1,3 @@
-TARGET_OS_NAME="Omarchy"
-
 ESP_PATH="/boot"
 
 KERNEL_CMDLINE[default]+="@@CMDLINE@@"
-KERNEL_CMDLINE[default]+=" quiet splash loglevel=0 systemd.show_status=false rd.udev.log_level=0 vt.global_cursor_default=0"
-
-ENABLE_UKI=yes
-CUSTOM_UKI_NAME="omarchy"
-
-ENABLE_LIMINE_FALLBACK=yes
-
-# Find and add other bootloaders
-FIND_BOOTLOADERS=yes
-
-BOOT_ORDER="*, *fallback, Snapshots"
-
-MAX_SNAPSHOT_ENTRIES=5
-
-SNAPSHOT_FORMAT_CHOICE=5

default/omarchy-skill/SKILL.md

@@ -8,7 +8,7 @@ description: >
   blur, opacity, omarchy-shell, bar, terminal config, themes, background,
   night light, idle, lock screen, screenshots, reminders, layer rules, workspace
   settings, display config, and user-facing omarchy commands. Excludes Omarchy
-  source development in ~/.local/share/omarchy/ and `omarchy dev` workflows.
+  source development through `omarchy dev link` workflows.
 ---
 
 # Omarchy Skill
@@ -34,11 +34,11 @@ It is not for contributing to Omarchy source code.
 
 **If you're about to edit a config file in ~/.config/ on this system, STOP and use this skill first.**
 
-**Do NOT use this skill for Omarchy development tasks** (editing files in `~/.local/share/omarchy/`, creating migrations, or running `omarchy dev ...` workflows).
+**Do NOT use this skill for Omarchy development tasks** (editing the Omarchy source tree, creating migrations, or running `omarchy dev ...` workflows).
 
 ## Critical Safety Rules
 
-**For end-user customization tasks, NEVER modify anything in `~/.local/share/omarchy/`** - but READING is safe and encouraged.
+**For end-user customization tasks, NEVER modify anything in `/usr/share/omarchy/`** - but READING is safe and encouraged.
 
 This directory contains Omarchy's source files managed by git. Any changes will be:
 - Lost on next `omarchy update`
@@ -46,7 +46,7 @@ This directory contains Omarchy's source files managed by git. Any changes will
 - Break the system's update mechanism
 
 ```
-~/.local/share/omarchy/     # READ-ONLY - NEVER EDIT (reading is OK)
+/usr/share/omarchy/     # READ-ONLY - NEVER EDIT (reading is OK)
 ├── bin/                    # Source scripts (symlinked to PATH)
 ├── config/                 # Default config templates
 ├── themes/                 # Stock themes
@@ -56,11 +56,11 @@ This directory contains Omarchy's source files managed by git. Any changes will
 └── install/                # Installation scripts
 ```
 
-**Reading `~/.local/share/omarchy/` is SAFE and useful** - do it freely to:
+**Reading `/usr/share/omarchy/` is SAFE and useful** - do it freely to:
 - Understand how omarchy commands work: `omarchy theme set --help` or `cat $(which omarchy-theme-set)`
-- See default configs before customizing: `cat ~/.local/share/omarchy/config/omarchy/shell.json`
+- See default configs before customizing: `cat /usr/share/omarchy/config/omarchy/shell.json`
 - Check stock theme files to copy for customization
-- Reference default hyprland settings: `cat ~/.local/share/omarchy/default/hypr/*`
+- Reference default hyprland settings: `cat /usr/share/omarchy/default/hypr/*`
 
 **Always use these safe locations instead:**
 - `~/.config/` - User configuration (safe to edit)
@@ -154,7 +154,7 @@ inside a single long-running Quickshell process (`omarchy-shell`).
 
 ```
 ~/.config/omarchy/shell.json      # User overrides: bar.position, bar.layout, plugins[]
-~/.local/share/omarchy/config/omarchy/shell.json   # Canonical defaults
+/usr/share/omarchy/config/omarchy/shell.json   # Canonical defaults
 ```
 
 The shell hot-reloads `shell.json` on save — no restart needed for layout
@@ -208,7 +208,7 @@ cp ~/.config/hypr/bindings.conf ~/.config/hypr/bindings.conf.bak.$(date +%s)
 ### Pattern 2: Make a new theme
 
 1. Create a directory under ~/.config/omarchy/themes.
-2. See how an existing theme is done via ~/.local/share/omarchy/themes/catppuccin.
+2. See how an existing theme is done via /usr/share/omarchy/themes/catppuccin.
 3. Download a matching background (or several) from the internet and put them in ~/.config/omarchy/themes/[name-of-new-theme]
 4. When done with the theme, run `omarchy theme set "Name of new theme"`
 
@@ -243,7 +243,7 @@ omarchy refresh hyprland
 
 # The refresh command:
 # 1. Backs up current config with timestamp
-# 2. Copies default from ~/.local/share/omarchy/config/
+# 2. Copies default from /usr/share/omarchy/config/
 # 3. Restarts the component
 ```
 
@@ -354,7 +354,7 @@ omarchy reinstall
 When user requests system changes:
 
 1. **Is it a stock omarchy command?** Use it directly
-2. **Is it a config edit?** Edit in `~/.config/`, never `~/.local/share/omarchy/`
+2. **Is it a config edit?** Edit in `~/.config/`, never `/usr/share/omarchy/`
 3. **Is it a theme customization?** Create a NEW custom theme directory
 4. **Is it automation?** Use hooks in `~/.config/omarchy/hooks/`
 5. **Is it a package install?** Use `omarchy pkg add <pkgs...>` (or `omarchy pkg aur add <pkgs...>` for AUR-only packages)
@@ -374,7 +374,7 @@ omarchy reminder clear
 ## Out of Scope
 
 This skill intentionally does not cover Omarchy source development. Do not use this skill for:
-- Editing files in `~/.local/share/omarchy/` (`bin/`, `config/`, `default/`, `shell/`, `themes/`, `migrations/`, etc.)
+- Editing files in `/usr/share/omarchy/` (`bin/`, `config/`, `default/`, `shell/`, `themes/`, `migrations/`, etc.)
 - Creating or editing migrations
 - Running `omarchy dev ...` commands
 

finalize.sh

@@ -1,64 +0,0 @@
-#!/bin/bash
-#
-# The in-target portion of an Omarchy install. This is intentionally boring:
-# the caller has already prepared the system; all this script does is run the
-# target-side setup scripts. The ISO parent owns UI/error handling, while the
-# online path re-establishes its tty-backed traps below.
-
-export OMARCHY_INSTALL_LOG_FILE="${OMARCHY_INSTALL_LOG_FILE:-/var/log/omarchy-install.log}"
-
-if [[ ${OMARCHY_INSTALL_DEBUG:-} == "1" ]]; then
-  if [[ -n ${OMARCHY_CHROOT_FINALIZER:-} || ${OMARCHY_INSTALL_MODE:-} == "offline" ]]; then
-    if { mkdir -p "$(dirname "$OMARCHY_INSTALL_LOG_FILE")" && touch "$OMARCHY_INSTALL_LOG_FILE"; } 2>/dev/null; then
-      exec >>"$OMARCHY_INSTALL_LOG_FILE" 2>&1
-    else
-      echo "[finalize-debug] WARNING: cannot write $OMARCHY_INSTALL_LOG_FILE; tracing to inherited stderr" >&2
-    fi
-  fi
-  export PS4='+ ${BASH_SOURCE[0]##*/}:${LINENO}:${FUNCNAME[0]:-main}: '
-  echo "[finalize-debug] tracing enabled for $$ at $(date -Is)"
-  set -x
-fi
-
-set -eEo pipefail
-
-_OMARCHY_INSTALLER_DIR=$(dirname "$(realpath "${BASH_SOURCE[0]}")")
-export OMARCHY_PATH="${OMARCHY_PATH:-$_OMARCHY_INSTALLER_DIR}"
-export OMARCHY_INSTALL="${OMARCHY_INSTALL:-$_OMARCHY_INSTALLER_DIR/install}"
-export PATH="$_OMARCHY_INSTALLER_DIR/bin:$OMARCHY_PATH/bin:$PATH"
-
-# Do not source helpers/all.sh here. That bundle unconditionally pulls in
-# presentation and interactive error handling, both of which assume a
-# controlling tty. The ISO runs this file through arch-chroot with
-# stdout/stderr captured by the parent. Keep the offline bootstrap to the
-# non-interactive primitives the scripts below use.
-source "$OMARCHY_INSTALL/helpers/mode.sh"
-detect_install_mode
-export_legacy_mode_flags
-source "$OMARCHY_INSTALL/helpers/chroot.sh"
-source "$OMARCHY_INSTALL/helpers/logging.sh"
-
-# Online installs still run finalize.sh directly after install.sh execs it, so
-# re-establish the interactive UI/error traps only for that tty-backed path.
-if install_mode_is online; then
-  source "$OMARCHY_INSTALL/helpers/presentation.sh"
-  source "$OMARCHY_INSTALL/helpers/errors.sh"
-fi
-
-# Mark every shipped migration as "done" so future updates only run the new
-# ones. Idempotent; safe to re-run.
-mkdir -p ~/.local/state/omarchy/migrations
-for _f in "$OMARCHY_PATH/migrations"/*.sh; do
-  [[ -f $_f ]] && touch ~/.local/state/omarchy/migrations/"$(basename "$_f")"
-done
-
-# Offline installs need the privileged system first-run block on the install
-# user's first login. The sudoers shim is written by system-finalize.sh; this
-# per-user marker ensures only the install user consumes it.
-if install_mode_is offline; then
-  mkdir -p ~/.local/state/omarchy
-  touch ~/.local/state/omarchy/first-run.mode
-fi
-
-omarchy-setup-user --force
-source "$OMARCHY_INSTALL/post-install/finished.sh"

install.sh

@@ -1,54 +0,0 @@
-#!/bin/bash
-#
-# Online install entry point. Run by the user on an existing Arch system to
-# install / refresh Omarchy. Guards the host, ensures the omarchy runtime is
-# up to date, then hands off to finalize.sh for the actual configure work.
-#
-# Offline installs (from the ISO) skip this script entirely: the Python
-# orchestrator owns disk, base, bootloader, and package install before calling
-# finalize.sh directly in the chroot.
-
-set -eEo pipefail
-
-_OMARCHY_INSTALLER_DIR=$(dirname "$(realpath "${BASH_SOURCE[0]}")")
-export OMARCHY_PATH="${OMARCHY_PATH:-$_OMARCHY_INSTALLER_DIR}"
-export OMARCHY_INSTALL="${OMARCHY_INSTALL:-$OMARCHY_PATH/install}"
-export OMARCHY_INSTALL_LOG_FILE="${OMARCHY_INSTALL_LOG_FILE:-/var/log/omarchy-install.log}"
-export PATH="$OMARCHY_PATH/bin:$PATH"
-
-source "$OMARCHY_INSTALL/helpers/mode.sh"
-detect_install_mode
-export_legacy_mode_flags
-
-source "$OMARCHY_INSTALL/helpers/all.sh"
-
-# Online-only setup: sanity-check the host, show the logo, start capturing
-# the install log to /var/log. The orchestrator handles all of this itself
-# in offline mode, so finalize.sh's caller environment looks the same in
-# both modes by the time finalize.sh runs.
-source "$OMARCHY_INSTALL/preflight/guard.sh"
-source "$OMARCHY_INSTALL/preflight/begin.sh"
-run_logged "$OMARCHY_INSTALL/preflight/show-env.sh"
-
-# Install/update the omarchy runtime + the default install set.
-_omarchy_runtime_pkg="${OMARCHY_RUNTIME_PACKAGE:-omarchy}"
-mapfile -t _omarchy_base_pkgs < <(grep -v '^#\|^$' "$OMARCHY_PATH/install/omarchy-base.packages")
-sudo pacman -Syu --noconfirm --needed "$_omarchy_runtime_pkg" "${_omarchy_base_pkgs[@]}"
-
-# Root/system setup first; user-home setup remains in finalize.sh below.
-sudo env \
-  OMARCHY_INSTALL_MODE="${OMARCHY_INSTALL_MODE:-}" \
-  OMARCHY_ONLINE_INSTALL="${OMARCHY_ONLINE_INSTALL:-}" \
-  OMARCHY_CHROOT_INSTALL="${OMARCHY_CHROOT_INSTALL:-}" \
-  OMARCHY_PATH="$OMARCHY_PATH" \
-  OMARCHY_INSTALL="$OMARCHY_INSTALL" \
-  OMARCHY_INSTALL_LOG_FILE="$OMARCHY_INSTALL_LOG_FILE" \
-  OMARCHY_START_TIME="${OMARCHY_START_TIME:-}" \
-  OMARCHY_START_EPOCH="${OMARCHY_START_EPOCH:-}" \
-  OMARCHY_USER_NAME="${OMARCHY_USER_NAME:-}" \
-  OMARCHY_USER_EMAIL="${OMARCHY_USER_EMAIL:-}" \
-  OMARCHY_MIRROR="${OMARCHY_MIRROR:-}" \
-  OMARCHY_INSTALL_USER="$USER" \
-  bash "$OMARCHY_PATH/system-finalize.sh"
-
-exec bash "$OMARCHY_PATH/finalize.sh"

install/config/all.sh

@@ -1,44 +1,7 @@
-run_logged $OMARCHY_INSTALL/config/theme-system.sh
-run_logged $OMARCHY_INSTALL/config/increase-lockout-limit.sh
-run_logged $OMARCHY_INSTALL/config/lockscreen-pam.sh
-run_logged $OMARCHY_INSTALL/config/fix-powerprofilesctl-shebang.sh
-run_logged $OMARCHY_INSTALL/config/docker.sh
-run_logged $OMARCHY_INSTALL/config/input-group.sh
-
-# Service enables centralized; run after all drop-in files are in place.
-run_logged $OMARCHY_INSTALL/config/enable-services.sh
-
-run_logged $OMARCHY_INSTALL/config/hardware/network.sh
-run_logged $OMARCHY_INSTALL/config/hardware/set-wireless-regdom.sh
-run_logged $OMARCHY_INSTALL/config/hardware/fix-fkeys.sh
-run_logged $OMARCHY_INSTALL/config/hardware/fix-synaptic-touchpad.sh
-run_logged $OMARCHY_INSTALL/config/hardware/bluetooth.sh
-run_logged $OMARCHY_INSTALL/config/hardware/nvidia.sh
-run_logged $OMARCHY_INSTALL/config/hardware/vulkan.sh
-
-run_logged $OMARCHY_INSTALL/config/hardware/intel/video-acceleration.sh
-run_logged $OMARCHY_INSTALL/config/hardware/intel/lpmd.sh
-run_logged $OMARCHY_INSTALL/config/hardware/intel/thermald.sh
-run_logged $OMARCHY_INSTALL/config/hardware/intel/ipu7-camera.sh
-run_logged $OMARCHY_INSTALL/config/hardware/intel/ptl-kernel.sh
-run_logged $OMARCHY_INSTALL/config/hardware/intel/fred.sh
-run_logged $OMARCHY_INSTALL/config/hardware/intel/fix-wifi7-eht.sh
-run_logged $OMARCHY_INSTALL/config/hardware/intel/sof-firmware.sh
-
-run_logged $OMARCHY_INSTALL/config/hardware/asus/fix-asus-ptl-display-backlight.sh
-run_logged $OMARCHY_INSTALL/config/hardware/asus/fix-asus-ptl-b9406-display.sh
-run_logged $OMARCHY_INSTALL/config/hardware/asus/fix-asus-ptl-b9406-touchpad.sh
-run_logged $OMARCHY_INSTALL/config/hardware/asus/fix-z13-touchpad.sh
-
-run_logged $OMARCHY_INSTALL/config/hardware/framework/qmk-hid.sh
-
-run_logged $OMARCHY_INSTALL/config/hardware/apple/fix-spi-keyboard.sh
-run_logged $OMARCHY_INSTALL/config/hardware/apple/fix-suspend-nvme.sh
-run_logged $OMARCHY_INSTALL/config/hardware/apple/fix-t2.sh
-
-run_logged $OMARCHY_INSTALL/config/hardware/lenovo/fix-yoga-pro7-bass-speakers.sh
-
-run_logged $OMARCHY_INSTALL/config/hardware/fix-bcm43xx.sh
-run_logged $OMARCHY_INSTALL/config/hardware/fix-surface-keyboard.sh
-run_logged $OMARCHY_INSTALL/config/hardware/fix-yt6801-ethernet-adapter.sh
-run_logged $OMARCHY_INSTALL/config/hardware/fix-tuxedo-backlight.sh
+run_logged "$OMARCHY_INSTALL/config/theme-system.sh"
+run_logged "$OMARCHY_INSTALL/config/increase-lockout-limit.sh"
+run_logged "$OMARCHY_INSTALL/config/lockscreen-pam.sh"
+run_logged "$OMARCHY_INSTALL/config/fix-powerprofilesctl-shebang.sh"
+run_logged "$OMARCHY_INSTALL/config/docker.sh"
+run_logged "$OMARCHY_INSTALL/config/enable-services.sh"
+run_logged "$OMARCHY_INSTALL/config/firewall.sh"

install/config/enable-services.sh

@@ -1,6 +1,5 @@
 # Enable services only. Installs are followed by reboot, so don't start/reload
 # daemons mid-install. UFW and hardware-gated services stay in their own scripts.
-systemctl enable bluetooth.service
 systemctl enable cups.service
 systemctl enable cups-browsed.service
 systemctl enable avahi-daemon.service

install/config/firewall.sh

@@ -0,0 +1,19 @@
+# Allow nothing in, everything out.
+ufw default deny incoming
+ufw default allow outgoing
+
+# Allow ports for LocalSend.
+ufw allow 53317/udp
+ufw allow 53317/tcp
+
+# Allow Docker containers to use DNS on host.
+ufw allow in proto udp from 172.16.0.0/12 to 172.17.0.1 port 53 comment 'allow-docker-dns'
+ufw allow in proto udp from 192.168.0.0/16 to 172.17.0.1 port 53 comment 'allow-docker-dns'
+
+# Turn on Docker protections.
+ufw-docker install
+
+# Installs are followed by reboot, so configure UFW to start on the installed
+# system instead of mutating the live install session's firewall.
+sed -i 's/^ENABLED=.*/ENABLED=yes/' /etc/ufw/ufw.conf
+systemctl enable ufw

install/config/sleep-lock.sh

@@ -1,3 +0,0 @@
-mkdir -p ~/.config/systemd/user/
-cp "$OMARCHY_PATH/config/systemd/user/omarchy-sleep-lock.service" ~/.config/systemd/user/
-systemctl --user enable omarchy-sleep-lock.service

install/config/theme-system.sh

@@ -4,6 +4,7 @@ ln -snf /usr/share/icons/Adwaita/symbolic/actions/go-previous-symbolic.svg \
           /usr/share/icons/Yaru/scalable/actions/go-previous-symbolic.svg
 ln -snf /usr/share/icons/Adwaita/symbolic/actions/go-next-symbolic.svg \
           /usr/share/icons/Yaru/scalable/actions/go-next-symbolic.svg
+gtk-update-icon-cache /usr/share/icons/Yaru &>/dev/null || true
 
 # Chromium policy directory for theme
 mkdir -p /etc/chromium/policies/managed

install/config/theme-user.sh

@@ -1,17 +0,0 @@
-# Setup user theme folder
-mkdir -p ~/.config/omarchy/themes
-
-# Set initial theme. Offline ISO installs only need the user's theme files and
-# symlinks seeded; there is no running desktop/session bus in the chroot, so
-# skip shell IPC, dconf, app retint hooks, and background transition work.
-if install_mode_is offline; then
-  OMARCHY_THEME_OFFLINE=1 OMARCHY_THEME_SKIP_BACKGROUND=1 omarchy-theme-set "Tokyo Night"
-else
-  omarchy-theme-set "Tokyo Night"
-fi
-rm -rf ~/.config/chromium/SingletonLock # otherwise archiso will own the chromium singleton
-omarchy-theme-set-pi --activate
-
-# Set specific app links for current theme
-mkdir -p ~/.config/btop/themes
-ln -snf ~/.config/omarchy/current/theme/btop.theme ~/.config/btop/themes/current.theme

install/config/user.sh

@@ -1,9 +0,0 @@
-run_logged $OMARCHY_INSTALL/config/theme-user.sh
-run_logged $OMARCHY_INSTALL/config/git.sh
-run_logged $OMARCHY_INSTALL/config/xcompose.sh
-run_logged $OMARCHY_INSTALL/config/mise-work.sh
-run_logged $OMARCHY_INSTALL/config/sleep-lock.sh
-run_logged $OMARCHY_INSTALL/config/hardware/bluetooth-user.sh
-run_logged $OMARCHY_INSTALL/config/hardware/asus/fix-audio-mixer.sh
-run_logged $OMARCHY_INSTALL/config/hardware/asus/fix-mic.sh
-run_logged $OMARCHY_INSTALL/config/hardware/framework/fix-f13-amd-audio-input.sh

install/first-run/cleanup-reboot-sudoers.sh

@@ -1 +0,0 @@
-sudo -n rm -f /etc/sudoers.d/99-omarchy-installer-reboot 2>/dev/null || true

install/first-run/dns-resolver.sh

@@ -1,4 +0,0 @@
-# https://wiki.archlinux.org/title/Systemd-resolved
-echo "Symlink resolved stub-resolv to /etc/resolv.conf"
-
-sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

install/first-run/firewall.sh

@@ -1,21 +0,0 @@
-# Allow nothing in, everything out
-sudo ufw default deny incoming
-sudo ufw default allow outgoing
-
-# Allow ports for LocalSend
-sudo ufw allow 53317/udp
-sudo ufw allow 53317/tcp
-
-# Allow Docker containers to use DNS on host
-sudo ufw allow in proto udp from 172.16.0.0/12 to 172.17.0.1 port 53 comment 'allow-docker-dns'
-sudo ufw allow in proto udp from 192.168.0.0/16 to 172.17.0.1 port 53 comment 'allow-docker-dns'
-
-# Turn on the firewall
-sudo ufw --force enable
-
-# Enable UFW systemd service to start on boot
-sudo systemctl enable ufw
-
-# Turn on Docker protections
-sudo ufw-docker install
-sudo ufw reload

install/first-run/gnome-theme-system.sh

@@ -1 +0,0 @@
-sudo gtk-update-icon-cache /usr/share/icons/Yaru

install/hardware/all.sh

@@ -0,0 +1,41 @@
+run_logged "$OMARCHY_INSTALL/hardware/asus-rog.sh"
+run_logged "$OMARCHY_INSTALL/hardware/framework16.sh"
+run_logged "$OMARCHY_INSTALL/hardware/dell-xps-touchpad-haptics.sh"
+run_logged "$OMARCHY_INSTALL/hardware/surface.sh"
+
+run_logged "$OMARCHY_INSTALL/hardware/network.sh"
+run_logged "$OMARCHY_INSTALL/hardware/input-group.sh"
+run_logged "$OMARCHY_INSTALL/hardware/set-wireless-regdom.sh"
+run_logged "$OMARCHY_INSTALL/hardware/fix-fkeys.sh"
+run_logged "$OMARCHY_INSTALL/hardware/fix-synaptic-touchpad.sh"
+run_logged "$OMARCHY_INSTALL/hardware/bluetooth.sh"
+run_logged "$OMARCHY_INSTALL/hardware/nvidia.sh"
+run_logged "$OMARCHY_INSTALL/hardware/vulkan.sh"
+
+run_logged "$OMARCHY_INSTALL/hardware/intel/video-acceleration.sh"
+run_logged "$OMARCHY_INSTALL/hardware/intel/lpmd.sh"
+run_logged "$OMARCHY_INSTALL/hardware/intel/thermald.sh"
+run_logged "$OMARCHY_INSTALL/hardware/intel/ipu7-camera.sh"
+run_logged "$OMARCHY_INSTALL/hardware/intel/ptl-kernel.sh"
+run_logged "$OMARCHY_INSTALL/hardware/intel/fred.sh"
+run_logged "$OMARCHY_INSTALL/hardware/intel/fix-wifi7-eht.sh"
+run_logged "$OMARCHY_INSTALL/hardware/intel/sof-firmware.sh"
+
+run_logged "$OMARCHY_INSTALL/hardware/asus/fix-asus-ptl-display-backlight.sh"
+run_logged "$OMARCHY_INSTALL/hardware/asus/fix-asus-ptl-b9406-display.sh"
+run_logged "$OMARCHY_INSTALL/hardware/asus/fix-asus-ptl-b9406-touchpad.sh"
+run_logged "$OMARCHY_INSTALL/hardware/asus/fix-z13-touchpad.sh"
+
+run_logged "$OMARCHY_INSTALL/hardware/framework/qmk-hid.sh"
+
+run_logged "$OMARCHY_INSTALL/hardware/apple/fix-spi-keyboard.sh"
+run_logged "$OMARCHY_INSTALL/hardware/apple/fix-suspend-nvme.sh"
+run_logged "$OMARCHY_INSTALL/hardware/apple/fix-t2.sh"
+
+run_logged "$OMARCHY_INSTALL/hardware/lenovo/fix-yoga-pro7-bass-speakers.sh"
+
+run_logged "$OMARCHY_INSTALL/hardware/fix-bcm43xx.sh"
+run_logged "$OMARCHY_INSTALL/hardware/fix-surface-keyboard.sh"
+run_logged "$OMARCHY_INSTALL/hardware/fix-yt6801-ethernet-adapter.sh"
+run_logged "$OMARCHY_INSTALL/hardware/fix-tuxedo-backlight.sh"
+run_logged "$OMARCHY_INSTALL/hardware/pacman.sh"

install/hardware/bluetooth.sh

@@ -1,3 +1,5 @@
+systemctl enable bluetooth.service
+
 # Persist last power state across reboots (default AutoEnable=true overrides it)
 if [[ -f /etc/bluetooth/main.conf ]]; then
   sed -i 's/^#\?AutoEnable=.*/AutoEnable=false/' /etc/bluetooth/main.conf

install/hardware/intel/fred.sh

@@ -1,7 +1,6 @@
 # Enable Flexible Return and Event Delivery on Intel Panther Lake.
 
 DROP_IN="/etc/limine-entry-tool.d/intel-panther-lake-fred.conf"
-DEFAULT_LIMINE="/etc/default/limine"
 
 if omarchy-hw-intel-ptl; then
   if [[ ! -f $DROP_IN ]] || ! grep -q 'fred=on' "$DROP_IN"; then
@@ -11,8 +10,4 @@ if omarchy-hw-intel-ptl; then
 KERNEL_CMDLINE[default]+=" fred=on"
 EOF
   fi
-
-  if [[ -f $DEFAULT_LIMINE ]] && ! grep -q 'fred=on' "$DEFAULT_LIMINE"; then
-    cat "$DROP_IN" | sudo tee -a "$DEFAULT_LIMINE" >/dev/null
-  fi
 fi