From 7ef5bc56fd17d30045c1d19b1e6ec3a75d304297 Mon Sep 17 00:00:00 2001
From: Ryan Hughes <ryan@heyoodle.com>
Date: Sun, 24 May 2026 16:30:04 -0400
Subject: [PATCH] install: make system scripts root-finalizer aware

---
 bin/omarchy-setup-lock                         |  2 +-
 install/config/docker.sh                       |  4 +---
 install/config/fix-powerprofilesctl-shebang.sh |  4 +++-
 install/config/increase-lockout-limit.sh       | 13 ++++++++-----
 install/config/input-group.sh                  |  2 +-
 install/post-install/pacman.sh                 | 13 +++++++------
 6 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/bin/omarchy-setup-lock b/bin/omarchy-setup-lock
index cd10e376..36701aae 100755
--- a/bin/omarchy-setup-lock
+++ b/bin/omarchy-setup-lock
@@ -7,7 +7,7 @@
 
 set -e
 
-target_user=${SUDO_USER:-}
+target_user=${OMARCHY_INSTALL_USER:-${SUDO_USER:-}}
 if [[ -z $target_user && -n ${PKEXEC_UID:-} ]]; then
   target_user=$(getent passwd "$PKEXEC_UID" | cut -d: -f1)
 fi
diff --git a/install/config/docker.sh b/install/config/docker.sh
index b06bfed6..fbd0be19 100644
--- a/install/config/docker.sh
+++ b/install/config/docker.sh
@@ -1,3 +1 @@
-sudo systemctl restart systemd-resolved
-sudo usermod -aG docker ${USER}
-sudo systemctl daemon-reload
+usermod -aG docker "${OMARCHY_INSTALL_USER:-${USER:-}}"
diff --git a/install/config/fix-powerprofilesctl-shebang.sh b/install/config/fix-powerprofilesctl-shebang.sh
index 61cac432..db2a9bd7 100644
--- a/install/config/fix-powerprofilesctl-shebang.sh
+++ b/install/config/fix-powerprofilesctl-shebang.sh
@@ -1,2 +1,4 @@
 # Ensure we use system python3 and not mise's python3
-sudo sed -i '/env python3/ c\#!/bin/python3' /usr/bin/powerprofilesctl
+if [[ -f /usr/bin/powerprofilesctl ]]; then
+  sed -i '/env python3/ c\#!/bin/python3' /usr/bin/powerprofilesctl
+fi
diff --git a/install/config/increase-lockout-limit.sh b/install/config/increase-lockout-limit.sh
index 93845e1d..e0fd9511 100644
--- a/install/config/increase-lockout-limit.sh
+++ b/install/config/increase-lockout-limit.sh
@@ -1,9 +1,12 @@
 # /etc/pam.d/{system-auth,sddm-autologin} are upstream-owned and the changes
 # are insertions, not full-file overrides, so they stay scripted.
-sudo sed -i 's|^\(auth\s\+required\s\+pam_faillock.so\)\s\+preauth.*$|\1 preauth silent deny=10 unlock_time=120|' "/etc/pam.d/system-auth"
-sudo sed -i 's|^\(auth\s\+\[default=die\]\s\+pam_faillock.so\)\s\+authfail.*$|\1 authfail deny=10 unlock_time=120|' "/etc/pam.d/system-auth"
+sed -i 's|^\(auth\s\+required\s\+pam_faillock.so\)\s\+preauth.*$|\1 preauth silent deny=10 unlock_time=120|' \
+           /etc/pam.d/system-auth
+sed -i 's|^\(auth\s\+\[default=die\]\s\+pam_faillock.so\)\s\+authfail.*$|\1 authfail deny=10 unlock_time=120|' \
+           /etc/pam.d/system-auth
 
 # Drop both lines before re-adding authsucc so reruns don't duplicate it.
-sudo sed -i '/pam_faillock\.so preauth/d'  /etc/pam.d/sddm-autologin
-sudo sed -i '/pam_faillock\.so authsucc/d' /etc/pam.d/sddm-autologin
-sudo sed -i '/auth.*pam_permit\.so/a auth        required    pam_faillock.so authsucc' /etc/pam.d/sddm-autologin
+sed -i '/pam_faillock\.so preauth/d'  /etc/pam.d/sddm-autologin
+sed -i '/pam_faillock\.so authsucc/d' /etc/pam.d/sddm-autologin
+sed -i '/auth.*pam_permit\.so/a auth        required    pam_faillock.so authsucc' \
+           /etc/pam.d/sddm-autologin
diff --git a/install/config/input-group.sh b/install/config/input-group.sh
index 82935b97..d75875e8 100644
--- a/install/config/input-group.sh
+++ b/install/config/input-group.sh
@@ -1,2 +1,2 @@
 # Give this user privileged input access for dictation tools + xbox controllers to work
-sudo usermod -aG input ${USER}
+usermod -aG input "${OMARCHY_INSTALL_USER:-${USER:-}}"
diff --git a/install/post-install/pacman.sh b/install/post-install/pacman.sh
index 4751a55a..73e1e19f 100644
--- a/install/post-install/pacman.sh
+++ b/install/post-install/pacman.sh
@@ -1,16 +1,17 @@
-# Configure pacman
-sudo cp -f $OMARCHY_PATH/default/pacman/pacman-${OMARCHY_MIRROR:-stable}.conf /etc/pacman.conf
-sudo cp -f $OMARCHY_PATH/default/pacman/mirrorlist-${OMARCHY_MIRROR:-stable} /etc/pacman.d/mirrorlist
+# Configure pacman after package installation completes. Offline target package
+# installs use the live ISO's offline pacman.conf until this final restore.
+cp -f "$OMARCHY_PATH/default/pacman/pacman-${OMARCHY_MIRROR:-stable}.conf" /etc/pacman.conf
+cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-${OMARCHY_MIRROR:-stable}" /etc/pacman.d/mirrorlist
 
 # omarchy-settings skips this override until cups-browsed is actually present
 # to avoid pacman creating cups-browsed.conf.pacnew during ISO package install.
 if [[ -f $OMARCHY_PATH/etc-overrides/cups-cups-browsed.conf && -d /etc/cups ]]; then
-  sudo cp -f "$OMARCHY_PATH/etc-overrides/cups-cups-browsed.conf" /etc/cups/cups-browsed.conf
-  sudo rm -f /etc/cups/cups-browsed.conf.pacnew
+  cp -f "$OMARCHY_PATH/etc-overrides/cups-cups-browsed.conf" /etc/cups/cups-browsed.conf
+  rm -f /etc/cups/cups-browsed.conf.pacnew
 fi
 
 if lspci -nn | grep -q "106b:180[12]"; then
-  cat <<EOF | sudo tee -a /etc/pacman.conf >/dev/null
+  cat >> /etc/pacman.conf <<'EOF'
 
 [arch-mact2]
 Server = https://github.com/NoaHimesaka1873/arch-mact2-mirror/releases/download/release