install.sh

#!/bin/bash
#
# ██████╗ ██████╗  █████╗ ██████╗ ██╗  ██╗██╗   ██╗ ██████╗ ███████╗
# ██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║  ██║╚██╗ ██╔╝██╔═══██╗██╔════╝
# ██║  ██║██████╔╝███████║██████╔╝███████║ ╚████╔╝ ██║   ██║███████╗
# ██║  ██║██╔══██╗██╔══██║██╔═══╝ ██╔══██║  ╚██╔╝  ██║   ██║╚════██║
# ██████╔╝██║  ██║██║  ██║██║     ██║  ██║   ██║   ╚██████╔╝███████║
# ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝     ╚═╝  ╚═╝   ╚═╝    ╚═════╝ ╚══════╝
#
# draphyOS Installer
# https://github.com/draphy/draphyOS
#
# Usage: git clone https://github.com/draphy/draphyOS ~/.draphyOS && ~/.draphyOS/install.sh
#        ~/.draphyOS/install.sh --vm    (for virtual machines)
#
# Options:
#   --vm      Force VM mode (use xrender backend for picom)
#   --help    Show help message
#

# Exit on undefined variable (but not on error - we handle those)
set -u

# Colors (with fallback for non-color terminals)
if [[ -t 1 ]] && [[ "${TERM:-dumb}" != "dumb" ]]; then
    RED='\033[0;31m'
    GREEN='\033[0;32m'
    YELLOW='\033[1;33m'
    BLUE='\033[0;34m'
    MINT='\033[38;2;154;184;124m'  # Mint-Y green #9ab87c
    NC='\033[0m'
else
    RED=''
    GREEN=''
    YELLOW=''
    BLUE=''
    MINT=''
    NC=''
fi

# Validate HOME directory exists and is writable
if [ -z "${HOME:-}" ]; then
    echo "ERROR: HOME environment variable is not set"
    exit 1
fi
if [ ! -d "$HOME" ]; then
    echo "ERROR: HOME directory does not exist: $HOME"
    exit 1
fi
if [ ! -w "$HOME" ]; then
    echo "ERROR: HOME directory is not writable: $HOME"
    exit 1
fi

# Variables
REPO_URL="https://github.com/draphy/draphyOS.git"
INSTALL_DIR="$HOME/.draphyOS"
BACKUP_DIR="$HOME/.config-backup-$(date +%Y%m%d-%H%M%S)"
MARKER_FILE="$HOME/.draphyOS-installed"
LOCK_FILE="/tmp/draphyOS-install-$UID.lock"
LOG_FILE="/tmp/draphyOS-install.log"

# Hardware detection results (populated by configure_hardware, written by create_marker)
IS_VM_MODE="false"

# Command line flags
FORCE_VM_MODE="false"

# Failed items tracking (displayed at end of installation)
FAILED_ITEMS=()

# Discover all config files in the repo's configs/ directory
# Returns relative paths (e.g., "i3/config", "fish/config.fish")
# Used by symlink creation, backup, checksums — ensures new files are auto-handled
get_all_config_files() {
    local configs_dir="$INSTALL_DIR/configs"
    if [ ! -d "$configs_dir" ]; then
        return
    fi
    find "$configs_dir" -type f -printf '%P\n' 2>/dev/null | sort
}

# Map a config name (relative path) to the user's file path
get_user_config_path() {
    local config_name="$1"
    case "$config_name" in
        xprofile)
            echo "$HOME/.xprofile"
            ;;
        *)
            echo "$HOME/.config/$config_name"
            ;;
    esac
}

# Helper functions for pre-check and post-verify
check_package_installed() {
    local pkg="$1"
    rpm -q "$pkg" &>/dev/null
}

check_command_exists() {
    local cmd="$1"
    command -v "$cmd" &>/dev/null
}

verify_package() {
    local cmd="$1"
    local name="$2"
    if command -v "$cmd" &>/dev/null; then
        print_success "$name installed successfully"
        return 0
    else
        print_error "$name installation failed"
        FAILED_ITEMS+=("$name")
        return 1
    fi
}

verify_service() {
    local service="$1"
    if systemctl is-active --quiet "$service"; then
        print_success "$service is running"
        return 0
    else
        print_error "$service is not running"
        FAILED_ITEMS+=("$service")
        return 1
    fi
}

# Cleanup function
cleanup() {
    local exit_code=$?
    # Remove lock (handles both file and directory)
    rm -rf "$LOCK_FILE" 2>/dev/null || true
    # Kill sudo keeper if running (validate PID is numeric first)
    if [ -n "${SUDO_KEEPER_PID:-}" ] && [[ "${SUDO_KEEPER_PID}" =~ ^[0-9]+$ ]]; then
        kill "$SUDO_KEEPER_PID" 2>/dev/null || true
        wait "$SUDO_KEEPER_PID" 2>/dev/null || true
    fi
    return $exit_code
}
trap cleanup EXIT
trap 'cleanup; exit 130' INT
trap 'cleanup; exit 143' TERM

# Safe user input (handles non-TTY environments)
# Usage: ask_user "prompt" "default" -> sets REPLY variable
ask_user() {
    local prompt="$1"
    local default="${2:-n}"

    echo -e "$prompt"
    if [ -t 0 ] || [ -e /dev/tty ]; then
        read -r REPLY </dev/tty 2>/dev/null || REPLY="$default"
    else
        # Non-interactive: use default
        REPLY="$default"
        echo "(Non-interactive mode, using default: $default)"
    fi

    # Normalize empty response to default
    [ -z "$REPLY" ] && REPLY="$default"
}

# Print functions
print_header() {
    echo ""
    echo -e "${MINT}"
    echo "  ██████╗ ██████╗  █████╗ ██████╗ ██╗  ██╗██╗   ██╗ ██████╗ ███████╗"
    echo "  ██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║  ██║╚██╗ ██╔╝██╔═══██╗██╔════╝"
    echo "  ██║  ██║██████╔╝███████║██████╔╝███████║ ╚████╔╝ ██║   ██║███████╗"
    echo "  ██║  ██║██╔══██╗██╔══██║██╔═══╝ ██╔══██║  ╚██╔╝  ██║   ██║╚════██║"
    echo "  ██████╔╝██║  ██║██║  ██║██║     ██║  ██║   ██║   ╚██████╔╝███████║"
    echo "  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝     ╚═╝  ╚═╝   ╚═╝    ╚═════╝ ╚══════╝"
    echo -e "${NC}"
    echo -e "                        Installer"
    echo ""
}

print_step() {
    echo -e "${GREEN}[*]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[!]${NC} $1"
}

print_error() {
    echo -e "${RED}[✗]${NC} $1"
}

print_success() {
    echo -e "${GREEN}[✓]${NC} $1"
}

# Check if another instance is running (atomic lock using mkdir)
check_lock() {
    local lock_dir="/tmp/draphyOS-install-$UID.lock.d"

    # Try to create lock directory atomically
    if mkdir "$lock_dir" 2>/dev/null; then
        # Successfully acquired lock, save PID
        echo $$ > "$lock_dir/pid"
        LOCK_FILE="$lock_dir"
        return 0
    fi

    # Lock exists - check if stale
    if [ -f "$lock_dir/pid" ]; then
        local pid
        pid=$(cat "$lock_dir/pid" 2>/dev/null)
        if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
            print_error "Another installation is already running (PID: $pid)"
            exit 1
        fi
    fi

    # Stale lock - remove and retry
    rm -rf "$lock_dir" 2>/dev/null
    if mkdir "$lock_dir" 2>/dev/null; then
        echo $$ > "$lock_dir/pid"
        LOCK_FILE="$lock_dir"
        return 0
    fi

    print_error "Could not acquire lock"
    exit 1
}

# Check required commands
check_requirements() {
    print_step "Checking requirements..."

    local missing=()
    local optional_missing=()

    # Check for required commands
    for cmd in git sudo dnf timeout; do
        if ! command -v "$cmd" &>/dev/null; then
            missing+=("$cmd")
        fi
    done

    # Check for optional but recommended commands
    for cmd in xrandr ip ping; do
        if ! command -v "$cmd" &>/dev/null; then
            optional_missing+=("$cmd")
        fi
    done

    if [ ${#missing[@]} -gt 0 ]; then
        print_error "Missing required commands: ${missing[*]}"
        print_error "Please install them first: sudo dnf install ${missing[*]}"
        exit 1
    fi

    if [ ${#optional_missing[@]} -gt 0 ]; then
        print_warning "Optional commands not found: ${optional_missing[*]}"
        print_warning "Some features may not work correctly."
    fi

    print_success "All requirements met"
}

# Check internet connection
check_internet() {
    print_step "Checking internet connection..."

    local connected=false

    # Try multiple methods to check connectivity
    # Method 1: curl to GitHub (most reliable for our use case)
    if command -v curl &>/dev/null; then
        if curl -sfI --connect-timeout 5 --max-time 10 https://github.com &>/dev/null; then
            connected=true
        fi
    fi

    # Method 2: ping GitHub (may be blocked in some networks)
    if [ "$connected" = false ] && command -v ping &>/dev/null; then
        if ping -c 1 -W 5 github.com &>/dev/null; then
            connected=true
        fi
    fi

    # Method 3: DNS lookup (check if DNS works)
    if [ "$connected" = false ] && command -v host &>/dev/null; then
        if host github.com &>/dev/null; then
            connected=true
        fi
    fi

    # Method 4: ping fallback IP
    if [ "$connected" = false ] && command -v ping &>/dev/null; then
        if ping -c 1 -W 5 8.8.8.8 &>/dev/null || ping -c 1 -W 5 1.1.1.1 &>/dev/null; then
            print_warning "Internet detected but GitHub may not be reachable"
            connected=true
        fi
    fi

    if [ "$connected" = false ]; then
        print_error "No internet connection detected"
        print_error "Please connect to the internet and try again"
        exit 1
    fi

    print_success "Internet connection OK"
}

# Check sudo access
check_sudo() {
    print_step "Checking sudo access..."

    if ! sudo -v &>/dev/null; then
        print_error "Sudo access required. Please run with a user that has sudo privileges."
        exit 1
    fi

    # Keep sudo alive in background (with error handling)
    (while true; do sudo -v 2>/dev/null || break; sleep 50; done) &
    SUDO_KEEPER_PID=$!
    # Note: cleanup trap already handles SUDO_KEEPER_PID

    print_success "Sudo access OK"
}

# Check if running on Fedora
check_fedora() {
    print_step "Checking operating system..."

    if [ ! -f /etc/fedora-release ]; then
        print_error "This installer is designed for Fedora"
        local detected_os="Unknown"
        if [ -f /etc/os-release ]; then
            detected_os=$(grep -m1 "^PRETTY_NAME=" /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d '"')
        fi
        print_error "Detected OS: ${detected_os:-Unknown}"
        exit 1
    fi

    FEDORA_VERSION=$(rpm -E %fedora 2>/dev/null || echo "unknown")
    print_success "Fedora $FEDORA_VERSION detected"
}

# Check if already installed
check_installed() {
    if [ -f "$MARKER_FILE" ]; then
        print_warning "draphyOS is already installed."
        echo -e "Do you want to ${YELLOW}update/reinstall${NC}? (y/n)"
        read -r response </dev/tty || response="n"
        if [[ ! "$response" =~ ^[Yy](es)?$ ]]; then
            echo "Exiting."
            exit 0
        fi
        print_step "Proceeding with reinstall..."
    fi
}

# Verify and update repo
setup_repo() {
    print_step "Verifying draphyOS files..."

    # Repo must exist (user clones first)
    if [ ! -d "$INSTALL_DIR" ]; then
        print_error "draphyOS not found at $INSTALL_DIR"
        print_error "Please clone first: git clone https://github.com/draphy/draphyOS ~/.draphyOS"
        exit 1
    fi

    if [ ! -d "$INSTALL_DIR/.git" ]; then
        print_error "$INSTALL_DIR is not a git repository"
        print_error "Please clone properly: git clone https://github.com/draphy/draphyOS ~/.draphyOS"
        exit 1
    fi

    # Try to update (non-fatal if offline)
    if cd "$INSTALL_DIR"; then
        if timeout 60 git fetch --quiet origin 2>/dev/null; then
            local default_branch
            default_branch=$(git remote show origin 2>/dev/null | grep 'HEAD branch' | awk '{print $NF}')
            default_branch="${default_branch:-main}"
            if git reset --hard "origin/$default_branch" --quiet 2>/dev/null; then
                print_step "Updated to latest version"
            fi
        else
            print_warning "Could not check for updates (offline?). Using existing files."
        fi
    fi

    # Verify essential files exist
    local essential_files=(
        "$INSTALL_DIR/configs/i3/config"
        "$INSTALL_DIR/configs/polybar/config.ini"
        "$INSTALL_DIR/configs/fish/config.fish"
        "$INSTALL_DIR/configs/environment.d/defaults.conf"
        "$INSTALL_DIR/update.sh"
    )

    local missing_count=0
    for file in "${essential_files[@]}"; do
        if [ ! -f "$file" ]; then
            print_error "Missing essential file: $file"
            ((missing_count++))
        fi
    done

    if [ $missing_count -gt 0 ]; then
        print_error "Installation files are incomplete ($missing_count files missing)."
        print_error "Please re-clone: rm -rf ~/.draphyOS && git clone https://github.com/draphy/draphyOS ~/.draphyOS"
        exit 1
    fi

    print_success "draphyOS files verified"
}

# Add RPMFusion repositories (required for many media packages)
add_rpmfusion() {
    if dnf repolist | grep -qi rpmfusion; then
        print_step "RPMFusion already configured"
        return 0
    fi

    print_step "Adding RPMFusion repositories..."

    # Install both free and nonfree repos
    if ! sudo dnf install -y \
        "https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm" \
        "https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm"; then
        print_error "Failed to add RPMFusion repositories"
        FAILED_ITEMS+=("rpmfusion")
        return 1
    fi

    # Enable Cisco OpenH264 for Firefox (Fedora 41+)
    sudo dnf config-manager setopt fedora-cisco-openh264.enabled=1 2>/dev/null || true

    # Verify installation
    if dnf repolist | grep -qi rpmfusion; then
        print_success "RPMFusion configured"
    else
        print_error "RPMFusion setup failed"
        FAILED_ITEMS+=("rpmfusion")
        return 1
    fi
}

# Setup third-party repositories (Brave, Chrome, VS Code, ProtonVPN, Docker, yazi, ueberzugpp)
setup_third_party_repos() {
    print_step "Setting up third-party repositories..."

    # =========================================================================
    # PRELIMINARY: Check if we can reach package repositories
    # =========================================================================
    local repo_connectivity=true
    if ! curl -sfI --connect-timeout 5 --max-time 10 https://dl.google.com &>/dev/null; then
        print_warning "Some package repositories may be unreachable"
        repo_connectivity=false
    fi

    # =========================================================================
    # BRAVE BROWSER
    # =========================================================================
    if [ ! -f /etc/yum.repos.d/brave-browser.repo ]; then
        print_step "Adding Brave repository..."
        if ! sudo dnf config-manager addrepo --from-repofile=https://brave-browser-rpm-release.s3.brave.com/brave-browser.repo 2>/dev/null; then
            # Fallback: create repo file manually
            if cat << 'EOF' | sudo tee /etc/yum.repos.d/brave-browser.repo > /dev/null 2>&1
[brave-browser]
name=Brave Browser
baseurl=https://brave-browser-rpm-release.s3.brave.com/x86_64/
enabled=1
gpgcheck=1
gpgkey=https://brave-browser-rpm-release.s3.brave.com/brave-core.asc
EOF
            then
                sudo rpm --import https://brave-browser-rpm-release.s3.brave.com/brave-core.asc 2>/dev/null || true
                print_step "Brave repo added (manual fallback)"
            else
                print_warning "Failed to add Brave repo"
                FAILED_ITEMS+=("brave-repo")
            fi
        fi
    fi

    # Google Chrome
    if [ ! -f /etc/yum.repos.d/google-chrome.repo ]; then
        print_step "Adding Google Chrome repository..."
        # Import Google's signing key first
        sudo rpm --import https://dl.google.com/linux/linux_signing_key.pub 2>/dev/null || true
        # Create repo file manually (more reliable than addrepo)
        if ! cat << 'EOF' | sudo tee /etc/yum.repos.d/google-chrome.repo > /dev/null
[google-chrome]
name=Google Chrome
baseurl=https://dl.google.com/linux/chrome/rpm/stable/x86_64
enabled=1
gpgcheck=1
gpgkey=https://dl.google.com/linux/linux_signing_key.pub
EOF
        then
            print_warning "Failed to add Google Chrome repo"
            FAILED_ITEMS+=("chrome-repo")
        fi
    fi

    # VS Code
    if [ ! -f /etc/yum.repos.d/vscode.repo ]; then
        print_step "Adding VS Code repository..."
        if ! sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc 2>/dev/null; then
            print_warning "Failed to import Microsoft GPG key"
        fi
        if ! cat << 'EOF' | sudo tee /etc/yum.repos.d/vscode.repo > /dev/null
[code]
name=Visual Studio Code
baseurl=https://packages.microsoft.com/yumrepos/vscode
enabled=1
gpgcheck=1
gpgkey=https://packages.microsoft.com/keys/microsoft.asc
EOF
        then
            print_error "Failed to create VS Code repo file"
            FAILED_ITEMS+=("vscode-repo")
        fi
        # Verify repo was created
        if [ ! -f /etc/yum.repos.d/vscode.repo ]; then
            print_error "VS Code repo file not found after creation"
            FAILED_ITEMS+=("vscode-repo-verify")
        fi
    fi

    # ProtonVPN
    if ! rpm -q protonvpn-stable-release &>/dev/null; then
        print_step "Adding ProtonVPN repository..."
        local fedora_ver
        fedora_ver=$(rpm -E %fedora)
        if curl -fsSL "https://repo.protonvpn.com/fedora-${fedora_ver}-stable/protonvpn-stable-release/protonvpn-stable-release-1.0.3-1.noarch.rpm" -o /tmp/protonvpn-repo.rpm; then
            if sudo dnf install /tmp/protonvpn-repo.rpm -y 2>/dev/null; then
                rm -f /tmp/protonvpn-repo.rpm
                # Verify repo was installed
                if rpm -q protonvpn-stable-release &>/dev/null; then
                    print_step "ProtonVPN repo installed (verified)"
                else
                    print_warning "ProtonVPN repo package not found after install"
                    FAILED_ITEMS+=("protonvpn-repo-verify")
                fi
            else
                print_warning "Failed to install ProtonVPN repo"
                FAILED_ITEMS+=("protonvpn-repo-install")
                rm -f /tmp/protonvpn-repo.rpm
            fi
        else
            print_warning "Failed to download ProtonVPN repo"
            FAILED_ITEMS+=("protonvpn-repo")
        fi
    else
        print_step "ProtonVPN repo already installed"
    fi

    # Docker
    if [ ! -f /etc/yum.repos.d/docker-ce.repo ]; then
        print_step "Adding Docker repository..."
        sudo dnf config-manager addrepo --from-repofile=https://download.docker.com/linux/fedora/docker-ce.repo || {
            print_warning "Failed to add Docker repo"
            FAILED_ITEMS+=("docker-repo")
        }
    fi

    # yazi COPR
    if ! dnf repolist | grep -q "copr:copr.fedorainfracloud.org:lihaohong:yazi"; then
        print_step "Enabling yazi COPR..."
        sudo dnf copr enable lihaohong/yazi -y 2>/dev/null || {
            print_warning "Failed to enable yazi COPR"
            FAILED_ITEMS+=("yazi-copr")
        }
    fi

    # ueberzugpp OBS (for yazi image preview)
    if [ ! -f /etc/yum.repos.d/home:justkidding.repo ] && [ ! -f /etc/yum.repos.d/home_justkidding.repo ]; then
        print_step "Adding ueberzugpp OBS repository..."
        local fedora_ver
        fedora_ver=$(rpm -E %fedora)
        # Note: URL uses home:/justkidding (colon-slash) format
        local obs_url="https://download.opensuse.org/repositories/home:/justkidding/Fedora_${fedora_ver}/home:justkidding.repo"

        # Check if repo exists for this Fedora version
        if curl -sLf "$obs_url" -o /tmp/ueberzugpp.repo 2>/dev/null; then
            if sudo cp /tmp/ueberzugpp.repo /etc/yum.repos.d/home_justkidding.repo; then
                rm -f /tmp/ueberzugpp.repo
                print_step "ueberzugpp repo added"
            else
                rm -f /tmp/ueberzugpp.repo
                print_warning "Failed to add ueberzugpp repo"
                FAILED_ITEMS+=("ueberzugpp-repo")
            fi
        else
            # Try Fedora 41 as fallback
            local fallback_url="https://download.opensuse.org/repositories/home:/justkidding/Fedora_41/home:justkidding.repo"
            if curl -sLf "$fallback_url" -o /tmp/ueberzugpp.repo 2>/dev/null; then
                print_step "Using Fedora 41 repo as fallback for ueberzugpp..."
                if sudo cp /tmp/ueberzugpp.repo /etc/yum.repos.d/home_justkidding.repo; then
                    rm -f /tmp/ueberzugpp.repo
                    print_step "ueberzugpp repo added (Fedora 41 fallback)"
                else
                    rm -f /tmp/ueberzugpp.repo
                    print_warning "Failed to add ueberzugpp repo (fallback)"
                    FAILED_ITEMS+=("ueberzugpp-repo")
                fi
            else
                print_warning "ueberzugpp repo not available for Fedora $fedora_ver (optional)"
                FAILED_ITEMS+=("ueberzugpp-repo")
            fi
        fi
    fi

    # Post-verification: check repos are usable
    print_step "Verifying third-party repositories..."
    local repo_errors=0

    # Check that added repos appear in dnf repolist (quick verification)
    local repolist
    repolist=$(dnf repolist 2>/dev/null)

    # Verify key repos are present (only if we added them)
    if [ -f /etc/yum.repos.d/brave-browser.repo ]; then
        if ! echo "$repolist" | grep -qi "brave"; then
            print_warning "Brave repository added but not detected in repolist"
            FAILED_ITEMS+=("brave-repo-verify")
            ((repo_errors++))
        fi
    fi

    if [ -f /etc/yum.repos.d/vscode.repo ]; then
        if ! echo "$repolist" | grep -qi "code"; then
            print_warning "VS Code repository added but not detected in repolist"
            FAILED_ITEMS+=("vscode-repo-verify")
            ((repo_errors++))
        fi
    fi

    if [ -f /etc/yum.repos.d/docker-ce.repo ]; then
        if ! echo "$repolist" | grep -qi "docker"; then
            print_warning "Docker repository added but not detected in repolist"
            FAILED_ITEMS+=("docker-repo-verify")
            ((repo_errors++))
        fi
    fi

    if [ $repo_errors -gt 0 ]; then
        print_warning "Third-party repositories configured with $repo_errors verification issue(s)"
    else
        print_success "Third-party repositories configured (verified)"
    fi

    # Refresh DNF cache after adding repos (critical for new repos to work)
    print_step "Refreshing package cache..."
    if ! sudo dnf makecache --refresh 2>&1 | tee -a "$LOG_FILE"; then
        print_warning "DNF cache refresh had issues, continuing anyway..."
    fi
}

# Save current package state (for clean uninstall later)
save_package_state() {
    print_step "Saving current package state..."
    local pkg_state_file="$HOME/.draphyOS-packages-before"

    # Use rpm -qa for reliable package listing (works across DNF4/DNF5)
    # Output just package names without version/arch
    if ! rpm -qa --qf '%{NAME}\n' 2>/dev/null | sort -u > "$pkg_state_file"; then
        print_warning "Failed to save package state"
        FAILED_ITEMS+=("package-state-save")
        return 1
    fi

    # Verify the file was created and has reasonable content
    if [ -f "$pkg_state_file" ] && [ -s "$pkg_state_file" ]; then
        local count
        count=$(wc -l < "$pkg_state_file")
        # A minimal Fedora system has at least 500+ packages
        if [ "$count" -ge 100 ]; then
            print_success "Package state saved ($count packages, verified)"
        else
            print_warning "Package state seems incomplete ($count packages)"
            FAILED_ITEMS+=("package-state-incomplete")
        fi
    else
        print_warning "Could not save package state"
        FAILED_ITEMS+=("package-state-verify")
    fi
}

# Install packages
install_packages() {
    print_step "Installing required packages..."

    # Remove redshift if installed (replaced by gammastep in v10)
    if rpm -q redshift &>/dev/null; then
        print_step "Removing redshift (replaced by gammastep)..."
        sudo dnf remove -y redshift geoclue2 2>/dev/null || true
    fi

    # Packages based on official Fedora i3 Spin + draphyOS customizations
    PACKAGES=(
        # === Core ===
        git  # Needed first for repo operations
        i3 i3lock dunst lightdm
        # Terminal
        alacritty
        # Networking
        NetworkManager network-manager-applet firefox
        # Audio
        pulseaudio-utils pavucontrol
        # Utilities
        brightnessctl htop mousepad Thunar
        # App launcher
        rofi
        # Productivity & GUI tools
        lxappearance powertop arandr tmux

        # === draphyOS Customizations ===
        # Shell
        fish
        # Status bar
        polybar
        # Compositor
        picom
        # Utilities
        feh flameshot playerctl xss-lock
        ImageMagick xdotool xclip
        # Bluetooth
        blueman
        # Authentication
        xfce-polkit gnome-keyring
        # Theming
        xfce4-settings
        # Night light (gammastep replaces redshift in v10)
        gammastep
        # Fonts
        fira-code-fonts google-noto-sans-mono-vf-fonts
        fontawesome-6-free-fonts fontawesome-6-brands-fonts
        # Icons & Themes
        mint-y-icons adwaita-cursor-theme
        # Calendar popup
        yad
        # Qt theming
        qt5ct

        # === v10 Additions ===
        # Third-party apps (repos added by setup_third_party_repos)
        brave-browser
        google-chrome-stable
        code
        proton-vpn-gnome-desktop

        # Docker
        docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

        # yazi file manager (COPR)
        yazi
        # Note: ueberzugpp installed separately (OBS repo may not be available)

        # Media
        torbrowser-launcher
        neovim
        obs-studio kdenlive mpv audacious

        # Documents
        zathura zathura-pdf-poppler
        libreoffice-writer libreoffice-calc libreoffice-impress libreoffice-draw

        # System tools
        gparted btop

        # CLI tools
        zoxide ffmpeg p7zip jq poppler-utils
        fd-find ripgrep fzf ffmpegthumbnailer atool

        # Database
        postgresql-server postgresql-contrib
    )

    print_step "This may take a few minutes..."

    # Handle ffmpeg conflict (ffmpeg-free vs ffmpeg from RPMFusion)
    # RPMFusion's ffmpeg has more codecs, so prefer it
    if rpm -q ffmpeg-free &>/dev/null; then
        print_step "Replacing ffmpeg-free with full ffmpeg from RPMFusion..."
        if sudo dnf swap -y ffmpeg-free ffmpeg --allowerasing 2>&1 | tee -a "$LOG_FILE"; then
            if rpm -q ffmpeg &>/dev/null && ! rpm -q ffmpeg-free &>/dev/null; then
                print_step "ffmpeg swap successful"
            else
                print_warning "ffmpeg swap may not have completed correctly"
            fi
        else
            print_warning "ffmpeg swap failed, continuing with ffmpeg-free"
        fi
    fi

    # Install all packages with --allowerasing to handle conflicts
    # Use retry logic for network failures
    print_step "Installing packages (this may take several minutes)..."

    local install_retries=3
    local install_success=false

    while [ $install_retries -gt 0 ]; do
        # Configure DNF for better network handling
        # Use subshell to capture exit code properly while still logging
        local dnf_exit=0
        (
            set -o pipefail
            sudo dnf install -y "${PACKAGES[@]}" \
                --skip-unavailable \
                --allowerasing \
                --setopt=install_weak_deps=False \
                --setopt=timeout=60 \
                --setopt=retries=5 \
                --setopt=minrate=1000 \
                2>&1 | tee -a "$LOG_FILE"
        ) || dnf_exit=$?

        if [ "$dnf_exit" -eq 0 ]; then
            install_success=true
            break
        fi

        # Check if it's a network error (exit code 1 with curl/timeout in log)
        if grep -qE "Curl error|Timeout|Connection|Failed to download" "$LOG_FILE" 2>/dev/null; then
            ((install_retries--))
            if [ $install_retries -gt 0 ]; then
                print_warning "Network error detected, retrying in 5 seconds... ($install_retries attempts left)"
                sleep 5
                # Clear DNF cache on retry
                sudo dnf clean metadata 2>/dev/null || true
            fi
        else
            # Not a network error, don't retry
            break
        fi
    done

    if [ "$install_success" = false ]; then
        print_warning "Some packages may have failed. Continuing anyway..."
    fi

    # Try to install ueberzugpp separately (optional, for yazi image preview)
    if [ -f /etc/yum.repos.d/home:justkidding.repo ]; then
        print_step "Installing ueberzugpp (optional)..."
        sudo dnf install -y ueberzugpp 2>/dev/null || {
            print_warning "ueberzugpp not available (yazi image preview disabled)"
        }
    fi

    # Verify critical packages are installed
    print_step "Verifying critical packages..."
    local CRITICAL_PACKAGES=(
        "i3:i3"
        "polybar:polybar"
        "fish:fish"
        "rofi:rofi"
        "alacritty:alacritty"
        "picom:picom"
        "dunst:dunst"
        "feh:feh"
        "gammastep:gammastep"
        "lightdm:lightdm"
    )

    local failed_count=0
    for pkg_cmd in "${CRITICAL_PACKAGES[@]}"; do
        local pkg="${pkg_cmd%%:*}"
        local cmd="${pkg_cmd##*:}"
        if ! rpm -q "$pkg" &>/dev/null && ! command -v "$cmd" &>/dev/null; then
            print_error "Critical package not installed: $pkg"
            FAILED_ITEMS+=("pkg-$pkg")
            ((failed_count++))
        fi
    done

    if [ $failed_count -eq 0 ]; then
        print_success "All critical packages verified"
    else
        print_warning "$failed_count critical packages missing"
    fi

    # Verify theme packages
    print_step "Verifying theme packages..."
    local THEME_PACKAGES=(
        "mint-y-icons"
        "adwaita-cursor-theme"
        "fira-code-fonts"
        "fontawesome-6-free-fonts"
    )

    local theme_failed=0
    for pkg in "${THEME_PACKAGES[@]}"; do
        if ! rpm -q "$pkg" &>/dev/null; then
            print_warning "Theme package not installed: $pkg"
            FAILED_ITEMS+=("theme-$pkg")
            ((theme_failed++))
        fi
    done

    if [ $theme_failed -eq 0 ]; then
        print_success "All theme packages verified"
    else
        print_warning "$theme_failed theme packages missing (visual issues possible)"
    fi

    # Verify font files exist
    if ! command -v fc-list &>/dev/null; then
        print_warning "fontconfig tools not available, skipping font verification"
    elif fc-list 2>/dev/null | grep -qi "fira code"; then
        print_step "Fira Code font verified"
    else
        print_warning "Fira Code font not found in font cache"
        FAILED_ITEMS+=("font-fira-code")
    fi

    # Verify icon theme exists
    if [ -d /usr/share/icons/Mint-Y ] || [ -d "$HOME/.icons/Mint-Y" ]; then
        print_step "Mint-Y icon theme verified"
    else
        print_warning "Mint-Y icon theme not found"
        FAILED_ITEMS+=("icons-mint-y")
    fi

    # Verify third-party applications (optional but reported)
    print_step "Verifying third-party applications..."
    local THIRD_PARTY_APPS=(
        "brave-browser:brave-browser"
        "google-chrome-stable:google-chrome"
        "code:code"
        "docker-ce:docker"
        "yazi:yazi"
    )

    local apps_installed=0
    local apps_missing=0
    for app_cmd in "${THIRD_PARTY_APPS[@]}"; do
        local pkg="${app_cmd%%:*}"
        local cmd="${app_cmd##*:}"
        if rpm -q "$pkg" &>/dev/null || command -v "$cmd" &>/dev/null; then
            ((apps_installed++))
        else
            print_warning "Third-party app not installed: $pkg (optional)"
            FAILED_ITEMS+=("app-$pkg")
            ((apps_missing++))
        fi
    done

    if [ $apps_missing -eq 0 ]; then
        print_success "All third-party apps verified ($apps_installed installed)"
    else
        print_warning "$apps_missing third-party apps missing (optional, can install later)"
    fi

    # Verify CLI tools
    print_step "Verifying CLI tools..."
    local CLI_TOOLS=(
        "zoxide:zoxide"
        "fzf:fzf"
        "ripgrep:rg"
        "fd-find:fd"
        "jq:jq"
        "btop:btop"
        "neovim:nvim"
    )

    local cli_installed=0
    local cli_missing=0
    for tool_cmd in "${CLI_TOOLS[@]}"; do
        local pkg="${tool_cmd%%:*}"
        local cmd="${tool_cmd##*:}"
        if rpm -q "$pkg" &>/dev/null || command -v "$cmd" &>/dev/null; then
            ((cli_installed++))
        else
            print_warning "CLI tool not installed: $pkg"
            FAILED_ITEMS+=("cli-$pkg")
            ((cli_missing++))
        fi
    done

    if [ $cli_missing -eq 0 ]; then
        print_success "All CLI tools verified ($cli_installed installed)"
    else
        print_warning "$cli_missing CLI tools missing"
    fi

    # Verify media & document applications
    print_step "Verifying media & document applications..."
    local MEDIA_DOC_APPS=(
        "mpv:mpv"
        "audacious:audacious"
        "obs-studio:obs"
        "kdenlive:kdenlive"
        "zathura:zathura"
        "libreoffice-writer:libreoffice"
        "libreoffice-calc:libreoffice"
        "libreoffice-impress:libreoffice"
        "libreoffice-draw:libreoffice"
    )

    local media_installed=0
    local media_missing=0
    for app_cmd in "${MEDIA_DOC_APPS[@]}"; do
        local pkg="${app_cmd%%:*}"
        local cmd="${app_cmd##*:}"
        if rpm -q "$pkg" &>/dev/null || command -v "$cmd" &>/dev/null; then
            ((media_installed++))
        else
            print_warning "Media/doc app not installed: $pkg"
            FAILED_ITEMS+=("media-$pkg")
            ((media_missing++))
        fi
    done

    if [ $media_missing -eq 0 ]; then
        print_success "All media & document apps verified ($media_installed installed)"
    else
        print_warning "$media_missing media/document apps missing"
    fi

    print_success "Packages ready"
}

# Backup existing configs
backup_configs() {
    print_step "Backing up existing configs..."

    # Ensure backup directory name is unique (add PID if same-second collision)
    if [ -d "$BACKUP_DIR" ]; then
        BACKUP_DIR="${BACKUP_DIR}-$$"
    fi

    if ! mkdir -p "$BACKUP_DIR"; then
        print_error "Could not create backup directory: $BACKUP_DIR"
        print_error "Please check disk space and permissions."
        echo -e "Continue without backup? This is ${YELLOW}NOT recommended${NC}. (y/n)"
        read -r response </dev/tty || response="n"
        if [[ ! "$response" =~ ^[Yy](es)?$ ]]; then
            exit 1
        fi
        print_warning "Continuing without backup..."
        return
    fi

    # Auto-discover all config files from repo and backup their user copies
    local backed_up=0
    local failed=0
    local config_name
    while IFS= read -r config_name; do
        [ -z "$config_name" ] && continue
        local user_file
        user_file=$(get_user_config_path "$config_name")
        if [ -e "$user_file" ] && [ ! -L "$user_file" ]; then
            local rel_path="${user_file#$HOME/}"
            mkdir -p "$BACKUP_DIR/$(dirname "$rel_path")" 2>/dev/null
            if cp -r "$user_file" "$BACKUP_DIR/$rel_path" 2>/dev/null; then
                ((backed_up++))
            else
                ((failed++))
                print_warning "Failed to backup: $user_file"
            fi
        fi
    done < <(get_all_config_files)

    # Also backup wallpaper (not in configs/)
    if [ -f "$HOME/.config/wallpaper.png" ] && [ ! -L "$HOME/.config/wallpaper.png" ]; then
        if cp "$HOME/.config/wallpaper.png" "$BACKUP_DIR/" 2>/dev/null; then
            ((backed_up++))
        fi
    fi

    if [ $backed_up -gt 0 ]; then
        # Verify backup directory has content
        local backup_count
        backup_count=$(find "$BACKUP_DIR" -type f 2>/dev/null | wc -l)
        if [ "$backup_count" -gt 0 ]; then
            print_success "Backup created at $BACKUP_DIR ($backed_up items, $backup_count files, verified)"
        else
            print_warning "Backup directory may be empty"
            FAILED_ITEMS+=("backup-verify")
        fi
        if [ $failed -gt 0 ]; then
            print_warning "$failed items failed to backup"
            FAILED_ITEMS+=("backup-partial")
        fi
    else
        print_step "No existing configs to backup"
        rmdir "$BACKUP_DIR" 2>/dev/null || true
    fi
}

# Safe symlink function (removes existing file/link first)
safe_symlink() {
    local src="$1"
    local dst="$2"

    # Validate inputs
    if [ -z "$src" ] || [ -z "$dst" ]; then
        print_warning "safe_symlink: missing arguments"
        return 1
    fi

    if [ ! -e "$src" ]; then
        print_warning "Source not found: $src"
        return 1
    fi

    # Get parent directory
    local parent_dir
    parent_dir=$(dirname "$dst")

    # Create parent directory if needed
    if [ ! -d "$parent_dir" ]; then
        if ! mkdir -p "$parent_dir" 2>/dev/null; then
            print_warning "Cannot create parent directory for: $dst"
            return 1
        fi
    fi

    # Check if parent directory is writable
    if [ ! -w "$parent_dir" ]; then
        print_warning "Parent directory not writable: $parent_dir"
        return 1
    fi

    # Handle existing destination
    if [ -e "$dst" ] || [ -L "$dst" ]; then
        # Check if it's already the correct symlink
        if [ -L "$dst" ] && [ "$(readlink "$dst" 2>/dev/null)" = "$src" ]; then
            return 0  # Already correct
        fi

        # Check if it's a directory (not a symlink to directory)
        if [ -d "$dst" ] && [ ! -L "$dst" ]; then
            # Backup directory instead of removing
            local backup_name="${dst}.backup.$(date +%s)"
            if ! mv "$dst" "$backup_name" 2>/dev/null; then
                print_warning "Cannot backup directory: $dst"
                return 1
            fi
            print_step "Backed up existing directory: $(basename "$dst")"
        else
            # Remove existing file or symlink
            if ! rm -f "$dst" 2>/dev/null; then
                print_warning "Cannot remove existing: $dst"
                return 1
            fi
        fi
    fi

    # Create symlink
    if ! ln -sf "$src" "$dst"; then
        print_warning "Failed to create symlink: $dst"
        return 1
    fi

    # Verify symlink was created
    if [ ! -L "$dst" ]; then
        print_warning "Symlink verification failed: $dst"
        return 1
    fi

    return 0
}

# Install configs with verification
install_configs() {
    print_step "Installing draphyOS configs..."

    local failed_configs=0

    # Auto-discover and create config directories from repo structure
    print_step "Creating config directories..."
    local dir_failures=0
    local config_name
    while IFS= read -r config_name; do
        [ -z "$config_name" ] && continue
        local user_file
        user_file=$(get_user_config_path "$config_name")
        local user_dir
        user_dir=$(dirname "$user_file")
        if [ ! -d "$user_dir" ]; then
            if ! mkdir -p "$user_dir" 2>/dev/null; then
                print_warning "Failed to create directory: $user_dir"
                FAILED_ITEMS+=("dir-$(basename "$user_dir")")
                ((dir_failures++))
            fi
        fi
    done < <(get_all_config_files)

    if [ $dir_failures -eq 0 ]; then
        print_step "All config directories ready"
    else
        print_warning "$dir_failures directory issues"
    fi

    # Remove old redshift config if exists (replaced by gammastep)
    rm -rf "$HOME/.config/redshift" 2>/dev/null || true

    # Auto-discover and create symlinks for all config files
    # Cheatsheet .txt files are copied (not symlinked) so users can edit freely
    local symlink_count=0
    local config_name
    while IFS= read -r config_name; do
        [ -z "$config_name" ] && continue

        local src="$INSTALL_DIR/configs/$config_name"
        local dst
        dst=$(get_user_config_path "$config_name")
        local name
        name=$(basename "$dst")

        # Cheatsheet .txt files are copied, not symlinked
        if [[ "$config_name" == i3/scripts/cheatsheets/*.txt ]]; then
            if [ -f "$src" ]; then
                if ! cp "$src" "$dst" 2>/dev/null; then
                    print_warning "Failed to copy cheatsheet: $name"
                    FAILED_ITEMS+=("config-$name")
                    ((failed_configs++))
                fi
            fi
            continue
        fi

        # Verify source exists before attempting symlink
        if [ ! -e "$src" ]; then
            print_warning "Config source missing: $name"
            FAILED_ITEMS+=("config-$name-missing")
            ((failed_configs++))
            continue
        fi

        # Check if symlink already correct
        if [ -L "$dst" ] && [ "$(readlink "$dst" 2>/dev/null)" = "$src" ]; then
            ((symlink_count++))
            continue  # Already correct, skip
        fi

        # Create symlink
        if ! safe_symlink "$src" "$dst"; then
            FAILED_ITEMS+=("config-$name")
            ((failed_configs++))
            continue
        fi

        # Verify symlink was created correctly
        if [ ! -L "$dst" ]; then
            print_warning "Symlink not created: $name"
            FAILED_ITEMS+=("config-$name")
            ((failed_configs++))
        else
            ((symlink_count++))
        fi
    done < <(get_all_config_files)

    # Copy wallpaper (actual copy, not symlink)
    if [ -f "$INSTALL_DIR/assets/wallpaper.png" ]; then
        if ! cp -f "$INSTALL_DIR/assets/wallpaper.png" "$HOME/.config/wallpaper.png"; then
            print_warning "Failed to copy wallpaper"
            FAILED_ITEMS+=("config-wallpaper")
        fi
    fi

    # Make scripts executable and verify
    local SCRIPTS=(
        "$HOME/.config/i3/lock.sh"
        "$HOME/.config/i3/scripts/cheatsheet.sh"
        "$HOME/.config/polybar/launch.sh"
    )
    for script in "${SCRIPTS[@]}"; do
        if [ -f "$script" ]; then
            chmod +x "$script" 2>/dev/null
            if [ ! -x "$script" ]; then
                print_warning "Script not executable: $(basename "$script")"
                FAILED_ITEMS+=("script-$(basename "$script")")
            fi
        fi
    done

    # Set Alacritty as default terminal
    if ! echo "Alacritty.desktop" > "$HOME/.config/xdg-terminals.list"; then
        print_warning "Failed to set default terminal"
        FAILED_ITEMS+=("config-xdg-terminals")
    else
        # Verify the file was created correctly
        if [ -f "$HOME/.config/xdg-terminals.list" ] && grep -q "Alacritty" "$HOME/.config/xdg-terminals.list" 2>/dev/null; then
            print_step "Default terminal set to Alacritty (verified)"
        else
            print_warning "Default terminal config may not be correct"
            FAILED_ITEMS+=("config-xdg-terminals-verify")
        fi
    fi

    # Verify wallpaper was copied
    if [ -f "$HOME/.config/wallpaper.png" ]; then
        print_step "Wallpaper installed (verified)"
    else
        print_warning "Wallpaper not found"
        FAILED_ITEMS+=("config-wallpaper-verify")
    fi

    # Verify critical config file contents
    print_step "Verifying config file contents..."

    # Verify GTK settings has correct theme
    if [ -f "$HOME/.config/gtk-3.0/settings.ini" ]; then
        if grep -q "gtk-icon-theme-name=Mint-Y" "$HOME/.config/gtk-3.0/settings.ini" 2>/dev/null; then
            print_step "GTK icon theme configured (Mint-Y)"
        else
            print_warning "GTK icon theme may not be configured correctly"
            FAILED_ITEMS+=("gtk-icon-theme")
        fi
    else
        print_warning "GTK settings file missing"
        FAILED_ITEMS+=("gtk-settings-missing")
    fi

    # Set gsettings for dark mode (required for xdg-desktop-portal to report dark theme to browsers)
    if command -v gsettings &>/dev/null; then
        print_step "Configuring system dark mode..."
        gsettings set org.gnome.desktop.interface color-scheme 'prefer-dark' 2>/dev/null || true
        gsettings set org.gnome.desktop.interface gtk-theme 'Adwaita-dark' 2>/dev/null || true
        gsettings set org.gnome.desktop.interface icon-theme 'Mint-Y' 2>/dev/null || true
        gsettings set org.gnome.desktop.interface cursor-theme 'Adwaita' 2>/dev/null || true
        # Verify
        if gsettings get org.gnome.desktop.interface color-scheme 2>/dev/null | grep -q "prefer-dark"; then
            print_step "Dark mode configured for browsers"
        else
            print_warning "Could not set dark mode preference"
        fi
    fi

    # Verify environment.d defaults has required variables
    if [ -f "$HOME/.config/environment.d/defaults.conf" ]; then
        local env_ok=true
        if ! grep -q "^LOCKER=" "$HOME/.config/environment.d/defaults.conf" 2>/dev/null; then
            print_warning "LOCKER variable missing in defaults.conf"
            FAILED_ITEMS+=("env-locker")
            env_ok=false
        fi
        if ! grep -q "^BAR=" "$HOME/.config/environment.d/defaults.conf" 2>/dev/null; then
            print_warning "BAR variable missing in defaults.conf"
            FAILED_ITEMS+=("env-bar")
            env_ok=false
        fi
        if [ "$env_ok" = true ]; then
            print_step "Environment defaults verified"
        fi
    else
        print_warning "Environment defaults file missing"
        FAILED_ITEMS+=("env-defaults-missing")
    fi

    # Verify i3 config has required i3 syntax
    if [ -f "$HOME/.config/i3/config" ]; then
        if grep -qE "^set \\\$mod|^bindsym|^exec" "$HOME/.config/i3/config" 2>/dev/null; then
            print_step "i3 config verified"
        else
            print_warning "i3 config may be corrupted or not valid i3 config"
            FAILED_ITEMS+=("i3-config-content")
        fi
    else
        print_warning "i3 config missing"
        FAILED_ITEMS+=("i3-config-missing")
    fi

    # Final summary
    if [ $failed_configs -eq 0 ]; then
        print_success "All ${#SYMLINKS[@]} configs installed and verified"
    else
        print_warning "$failed_configs configs failed (see summary at end)"
    fi
}

# Auto-detect and configure hardware
configure_hardware() {
    print_step "Configuring hardware settings..."

    # Create a local copy of polybar config for hardware-specific edits
    local polybar_config="$HOME/.config/polybar/config.ini"
    local hw_failures=0

    # Check if polybar config exists
    if [ ! -e "$polybar_config" ] && [ ! -L "$polybar_config" ]; then
        print_warning "Polybar config not found, skipping hardware configuration"
        FAILED_ITEMS+=("hardware-polybar-config")
        return 1
    fi

    # If it's a symlink, copy to real file for editing
    if [ -L "$polybar_config" ]; then
        local target
        target=$(readlink -f "$polybar_config")
        if [ ! -f "$target" ]; then
            print_error "Polybar config symlink target not found: $target"
            FAILED_ITEMS+=("hardware-polybar-symlink")
            return 1
        fi
        rm -f "$polybar_config"
        if ! cp "$target" "$polybar_config"; then
            print_error "Failed to copy polybar config for editing"
            FAILED_ITEMS+=("hardware-polybar-copy")
            return 1
        fi
    fi

    # Detect battery (for laptops)
    BATTERY=""
    for bat in /sys/class/power_supply/BAT*; do
        [ -e "$bat" ] && BATTERY=$(basename "$bat") && break
    done
    ADAPTER=""
    for adp in /sys/class/power_supply/AC* /sys/class/power_supply/ACAD* /sys/class/power_supply/ADP*; do
        [ -e "$adp" ] && ADAPTER=$(basename "$adp") && break
    done

    if [ -n "$BATTERY" ]; then
        print_step "Battery detected: $BATTERY"
        # Escape special chars for sed
        local battery_escaped
        battery_escaped=$(printf '%s\n' "$BATTERY" | sed 's/[&/\]/\\&/g')
        if sed -i "s/^battery = .*/battery = $battery_escaped/" "$polybar_config" 2>/dev/null; then
            # Verify battery was set
            if ! grep -q "^battery = $BATTERY" "$polybar_config" 2>/dev/null; then
                print_warning "Battery config may not have been written correctly"
                FAILED_ITEMS+=("hardware-battery-verify")
                ((hw_failures++))
            fi
        else
            print_warning "Failed to configure battery in polybar"
            FAILED_ITEMS+=("hardware-battery")
            ((hw_failures++))
        fi
    else
        print_step "No battery detected (desktop mode)"
        # Comment out battery module for desktops
        if ! sed -i 's/battery tray/tray/' "$polybar_config" 2>/dev/null; then
            print_warning "Failed to disable battery module"
            # Non-critical, don't add to FAILED_ITEMS
        fi
    fi

    if [ -n "$ADAPTER" ]; then
        # Escape special chars for sed
        local adapter_escaped
        adapter_escaped=$(printf '%s\n' "$ADAPTER" | sed 's/[&/\]/\\&/g')
        if sed -i "s/^adapter = .*/adapter = $adapter_escaped/" "$polybar_config" 2>/dev/null; then
            # Verify adapter was set
            if ! grep -q "^adapter = $ADAPTER" "$polybar_config" 2>/dev/null; then
                print_warning "Adapter config may not have been written correctly"
                FAILED_ITEMS+=("hardware-adapter-verify")
                ((hw_failures++))
            fi
        else
            print_warning "Failed to configure adapter in polybar"
            FAILED_ITEMS+=("hardware-adapter")
            ((hw_failures++))
        fi
    fi

    # Network interfaces auto-detected by polybar (interface-type = wireless/wired)
    # No manual configuration needed - polybar 3.6+ handles this automatically
    print_step "Network interfaces: auto-detected by polybar"

    if [ $hw_failures -gt 0 ]; then
        print_warning "Hardware configured with $hw_failures issue(s)"
    else
        print_success "Hardware configured (verified)"
    fi
}

# Install NVIDIA drivers if GPU detected
configure_nvidia() {
    print_step "Checking for NVIDIA GPU..."

    # Check if lspci is available
    if ! command -v lspci &>/dev/null; then
        print_warning "lspci not available, skipping NVIDIA detection"
        return 0
    fi

    if ! lspci | grep -qi nvidia; then
        print_step "No NVIDIA GPU detected, skipping driver installation"
        return 0
    fi

    # =========================================================================
    # SECURE BOOT CHECK
    # =========================================================================
    local secure_boot_enabled=false
    if [ -d /sys/firmware/efi ]; then
        if mokutil --sb-state 2>/dev/null | grep -qi "SecureBoot enabled"; then
            secure_boot_enabled=true
            print_step "Secure Boot is ENABLED"
        fi
    fi

    # =========================================================================
    # HYBRID GRAPHICS DETECTION
    # =========================================================================
    local has_intel_gpu=false
    local has_amd_gpu=false
    local is_hybrid=false

    if lspci | grep -qi "VGA.*Intel"; then
        has_intel_gpu=true
    fi
    if lspci | grep -qi "VGA.*AMD\|VGA.*ATI"; then
        has_amd_gpu=true
    fi

    if [ "$has_intel_gpu" = true ] || [ "$has_amd_gpu" = true ]; then
        is_hybrid=true
        if [ "$has_intel_gpu" = true ]; then
            print_step "Hybrid graphics detected: Intel + NVIDIA"
        else
            print_step "Hybrid graphics detected: AMD + NVIDIA"
        fi
    fi

    # Check if already installed
    if rpm -q akmod-nvidia &>/dev/null; then
        print_step "NVIDIA drivers already installed"
        # Verify module exists
        if modinfo nvidia &>/dev/null; then
            print_success "NVIDIA module verified"
            return 0
        else
            print_warning "NVIDIA drivers installed but module not ready (may need reboot)"
            return 0
        fi
    fi

    print_step "NVIDIA GPU detected, installing drivers..."

    # =========================================================================
    # SECURE BOOT WARNING
    # =========================================================================
    if [ "$secure_boot_enabled" = true ]; then
        echo ""
        echo "  WARNING: Secure Boot is enabled!"
        echo "  NVIDIA drivers require MOK (Machine Owner Key) enrollment."
        echo "  After reboot, you'll see a blue 'MOK Management' screen."
        echo "  Select 'Enroll MOK' and enter a password you'll set now."
        echo ""

        # Check if mokutil is available
        if ! command -v mokutil &>/dev/null; then
            print_step "Installing mokutil for Secure Boot support..."
            sudo dnf install -y mokutil 2>/dev/null || true
        fi
    fi

    # =========================================================================
    # INSTALL DRIVERS
    # =========================================================================

    # Install akmod-nvidia (auto-rebuilds on kernel updates)
    local -a nvidia_packages=(akmod-nvidia xorg-x11-drv-nvidia-cuda nvidia-settings)

    # For hybrid graphics, also install switching tools
    if [ "$is_hybrid" = true ]; then
        nvidia_packages+=(switcheroo-control)
    fi

    if ! sudo dnf install -y "${nvidia_packages[@]}"; then
        print_error "Failed to install NVIDIA drivers"
        FAILED_ITEMS+=("nvidia-drivers")
        return 1
    fi

    # Force build kmod to ensure it's ready before reboot
    print_step "Building NVIDIA kernel module (this may take 2-5 minutes)..."
    if ! sudo akmods --force; then
        print_error "Failed to build NVIDIA kernel module"
        FAILED_ITEMS+=("nvidia-kmod")

        # Check for common failures
        if [ "$secure_boot_enabled" = true ]; then
            echo "  Note: With Secure Boot, you may need to enroll the signing key."
            echo "  After reboot, follow the MOK enrollment prompts."
        fi
    fi

    if ! sudo dracut --force; then
        print_warning "dracut regeneration failed (non-critical)"
    fi

    # Enable switcheroo for hybrid graphics
    if [ "$is_hybrid" = true ]; then
        sudo systemctl enable switcheroo-control 2>/dev/null || true
        sudo systemctl start switcheroo-control 2>/dev/null || true
        print_step "GPU switching enabled (use 'switcherooctl' to manage)"
    fi

    # =========================================================================
    # VERIFICATION
    # =========================================================================

    if rpm -q akmod-nvidia &>/dev/null; then
        print_success "NVIDIA drivers installed"
        print_warning "REBOOT REQUIRED for NVIDIA drivers to take effect"

        if [ "$secure_boot_enabled" = true ]; then
            echo ""
            echo "  SECURE BOOT INSTRUCTIONS:"
            echo "  1. Reboot your system"
            echo "  2. At the blue 'MOK Management' screen, select 'Enroll MOK'"
            echo "  3. Enter the password you set during installation"
            echo "  4. Select 'Continue' and reboot"
            echo ""
        fi

        if [ "$is_hybrid" = true ]; then
            echo ""
            echo "  HYBRID GRAPHICS TIPS:"
            echo "  - Default: Intel/AMD for power saving"
            echo "  - Run apps on NVIDIA: switcherooctl launch <app>"
            echo "  - Or right-click apps and select 'Launch using Discrete GPU'"
            echo ""
        fi
    else
        print_error "NVIDIA driver installation could not be verified"
        FAILED_ITEMS+=("nvidia-verify")
    fi
}

# Set fish as default shell
setup_fish() {
    print_step "Setting up fish shell..."

    local fish_path
    fish_path=$(command -v fish 2>/dev/null || echo "")

    if [ -z "$fish_path" ]; then
        print_error "Fish shell not found"
        FAILED_ITEMS+=("fish-not-installed")
        return 1
    fi

    # Add fish to /etc/shells if not present
    if ! grep -qxF "$fish_path" /etc/shells 2>/dev/null; then
        print_step "Adding fish to /etc/shells..."
        if ! echo "$fish_path" | sudo tee -a /etc/shells >/dev/null 2>&1; then
            print_error "Failed to add fish to /etc/shells"
            FAILED_ITEMS+=("fish-shells")
        fi
    fi

    # Verify fish is in /etc/shells
    if ! grep -qxF "$fish_path" /etc/shells 2>/dev/null; then
        print_warning "Fish not in /etc/shells - shell change may fail"
    fi

    # Change default shell if not already fish
    local current_shell
    current_shell=$(getent passwd "$USER" | cut -d: -f7)

    if [ "$current_shell" != "$fish_path" ]; then
        print_step "Setting fish as default shell..."
        if sudo chsh -s "$fish_path" "$USER" 2>/dev/null || chsh -s "$fish_path" 2>/dev/null; then
            # Verify the change
            local new_shell
            new_shell=$(getent passwd "$USER" | cut -d: -f7)
            if [ "$new_shell" = "$fish_path" ]; then
                print_success "Fish set as default shell (verified)"
            else
                print_warning "Shell change may not have taken effect"
                FAILED_ITEMS+=("fish-default-shell")
            fi
        else
            print_error "Could not set fish as default. Run manually: chsh -s $fish_path"
            FAILED_ITEMS+=("fish-default-shell")
        fi
    else
        print_step "Fish is already the default shell"
    fi

    # Set fish color scheme
    print_step "Configuring fish colors..."
    if command -v fish &>/dev/null; then
        fish -c '
            # Syntax highlighting colors
            set -U fish_color_autosuggestion brblack
            set -U fish_color_cancel -r
            set -U fish_color_command normal
            set -U fish_color_comment red
            set -U fish_color_cwd green
            set -U fish_color_cwd_root red
            set -U fish_color_end green
            set -U fish_color_error brred
            set -U fish_color_escape brcyan
            set -U fish_color_history_current --bold
            set -U fish_color_host normal
            set -U fish_color_host_remote yellow
            set -U fish_color_normal normal
            set -U fish_color_operator brcyan
            set -U fish_color_param cyan
            set -U fish_color_quote yellow
            set -U fish_color_redirection cyan --bold
            set -U fish_color_search_match white --background=brblack --bold
            set -U fish_color_selection white --background=brblack --bold
            set -U fish_color_status red
            set -U fish_color_user brgreen
            set -U fish_color_valid_path --underline
            # Pager colors
            set -U fish_pager_color_completion normal
            set -U fish_pager_color_description yellow -i
            set -U fish_pager_color_prefix normal --bold --underline
            set -U fish_pager_color_progress brwhite --background=cyan --bold
            # Key bindings
            set -U fish_key_bindings fish_default_key_bindings
        ' 2>/dev/null && print_step "Fish colors configured" || print_warning "Could not set fish colors"
    fi
}

# Setup fnm (Fast Node Manager) and Node.js LTS
configure_fnm() {
    print_step "Setting up fnm (Fast Node Manager)..."

    # =========================================================================
    # CHECK FOR CONFLICTING NODE INSTALLATIONS
    # =========================================================================
    local has_system_node=false
    local system_node_path=""

    # Check for system-installed Node.js (dnf/apt)
    if [ -x /usr/bin/node ]; then
        has_system_node=true
        system_node_path="/usr/bin/node"
    fi

    # Check for Homebrew Node.js (common conflict on Linux too)
    if [ -x /home/linuxbrew/.linuxbrew/bin/node ]; then
        has_system_node=true
        system_node_path="/home/linuxbrew/.linuxbrew/bin/node"
    fi

    if [ "$has_system_node" = true ]; then
        print_warning "System Node.js detected at: $system_node_path"
        echo "  fnm will take precedence, but you may want to remove the system version"
        echo "  to avoid PATH conflicts: sudo dnf remove nodejs npm"
    fi

    # =========================================================================
    # INSTALL FNM
    # =========================================================================
    if ! command -v fnm &>/dev/null && [ ! -d "$HOME/.local/share/fnm" ]; then
        print_step "Installing fnm..."

        # Download install script first, then execute (safer than curl|bash)
        local fnm_script
        fnm_script=$(mktemp)
        local fnm_install_retries=3
        local fnm_downloaded=false

        while [ $fnm_install_retries -gt 0 ]; do
            if curl -fsSL https://fnm.vercel.app/install -o "$fnm_script" 2>/dev/null; then
                # Verify it's a shell script (basic sanity check)
                if head -1 "$fnm_script" | grep -q "^#!.*sh"; then
                    fnm_downloaded=true
                    break
                fi
            fi
            ((fnm_install_retries--))
            if [ $fnm_install_retries -gt 0 ]; then
                print_warning "fnm download failed, retrying... ($fnm_install_retries attempts left)"
                sleep 5
            fi
        done

        if [ "$fnm_downloaded" = false ]; then
            print_error "Failed to download fnm installer"
            rm -f "$fnm_script"
            FAILED_ITEMS+=("fnm-download")
            return 1
        fi

        # Execute the downloaded script
        if ! bash "$fnm_script" --skip-shell 2>&1; then
            print_error "Failed to install fnm"
            rm -f "$fnm_script"
            FAILED_ITEMS+=("fnm-install")
            return 1
        fi
        rm -f "$fnm_script"
    else
        print_step "fnm already installed"
    fi

    # =========================================================================
    # SOURCE FNM FOR CURRENT SESSION
    # =========================================================================
    # Add fnm to PATH with higher priority than system paths
    export PATH="$HOME/.local/share/fnm:$PATH"

    if command -v fnm &>/dev/null; then
        # Use explicit shell type for faster initialization
        eval "$(fnm env --shell bash)" 2>/dev/null || true
    fi

    # Verify fnm is available
    if ! command -v fnm &>/dev/null; then
        print_error "fnm not available after installation"
        FAILED_ITEMS+=("fnm-verify")
        return 1
    fi

    # =========================================================================
    # INSTALL NODE.JS LTS
    # =========================================================================
    # Check if Node.js LTS is already installed
    if fnm list 2>/dev/null | grep -q "lts-"; then
        local current_node
        current_node=$(node --version 2>/dev/null || echo "unknown")
        print_step "Node.js LTS already installed: $current_node"
    else
        # Install Node.js LTS
        print_step "Installing Node.js LTS..."
        if ! fnm install --lts; then
            print_error "Failed to install Node.js LTS"
            FAILED_ITEMS+=("nodejs-lts-install")
            return 1
        fi

        if ! fnm default lts-latest; then
            print_warning "Failed to set LTS as default"
            FAILED_ITEMS+=("nodejs-lts-default")
        fi
    fi

    # =========================================================================
    # VERIFY INSTALLATION
    # =========================================================================
    # Re-eval fnm env to get node in PATH
    eval "$(fnm env --shell bash)" 2>/dev/null || true

    if command -v node &>/dev/null; then
        local node_version
        node_version=$(node --version 2>/dev/null || echo "unknown")
        local node_path
        node_path=$(command -v node)

        # Verify it's fnm's node, not system node
        if echo "$node_path" | grep -q "fnm"; then
            print_success "Node.js $node_version installed via fnm (verified)"
        else
            print_warning "Node.js found but may not be from fnm: $node_path"
        fi
    else
        # Node may not be in PATH until shell restart
        if fnm list 2>/dev/null | grep -q "lts-"; then
            print_success "Node.js LTS installed (will be in PATH after shell restart)"
        else
            print_error "Node.js installation could not be verified"
            FAILED_ITEMS+=("nodejs-lts-verify")
            return 1
        fi
    fi

    # =========================================================================
    # VERIFY FISH CONFIGURATION
    # =========================================================================
    local fnm_fish_config="$HOME/.config/fish/conf.d/fnm.fish"
    if [ ! -f "$fnm_fish_config" ] && [ ! -L "$fnm_fish_config" ]; then
        print_error "Fish fnm config missing - fnm won't work after login"
        FAILED_ITEMS+=("fnm-fish-config")
    else
        # Verify the config has correct PATH setup
        if ! grep -q 'set PATH.*fnm' "$fnm_fish_config" 2>/dev/null && \
           ! grep -q 'fish_add_path.*fnm' "$fnm_fish_config" 2>/dev/null; then
            print_warning "Fish fnm config may not have correct PATH setup"
        fi
    fi
}

# Setup PostgreSQL with user database
configure_postgresql() {
    print_step "Setting up PostgreSQL..."

    # Check if PostgreSQL is installed (should be from package list)
    if ! command -v psql &>/dev/null && ! rpm -q postgresql-server &>/dev/null; then
        print_warning "PostgreSQL not installed, skipping setup"
        return 0
    fi

    # Initialize if needed
    if [ ! -f /var/lib/pgsql/data/PG_VERSION ]; then
        print_step "Initializing PostgreSQL database..."
        if ! sudo postgresql-setup --initdb --unit postgresql; then
            print_error "Failed to initialize PostgreSQL"
            FAILED_ITEMS+=("postgresql-init")
            return 1
        fi
    fi

    # Enable and start
    if ! sudo systemctl enable postgresql 2>/dev/null; then
        print_warning "Could not enable PostgreSQL service"
        FAILED_ITEMS+=("postgresql-enable")
    fi

    if ! sudo systemctl start postgresql 2>/dev/null; then
        print_error "Could not start PostgreSQL service"
        FAILED_ITEMS+=("postgresql-start")
        return 1
    fi

    # Wait for service to be fully ready (up to 20 seconds for slow systems)
    local retries=20
    local pg_ready=false
    while [ $retries -gt 0 ]; do
        if systemctl is-active postgresql &>/dev/null && \
           sudo -u postgres psql -tAc "SELECT 1" &>/dev/null 2>&1; then
            pg_ready=true
            break
        fi
        sleep 1
        ((retries--))
    done

    # Verify service is running
    if [ "$pg_ready" = false ] || ! systemctl is-active postgresql &>/dev/null; then
        print_error "PostgreSQL service not ready after 20 seconds"
        FAILED_ITEMS+=("postgresql-service")
        return 1
    fi

    # Validate username for PostgreSQL (prevent SQL injection with special chars)
    local pg_user="$USER"
    if [[ ! "$pg_user" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
        print_warning "Username '$pg_user' contains special characters"
        print_warning "Skipping PostgreSQL user/database creation for safety"
        FAILED_ITEMS+=("postgresql-user-invalid-name")
        return 0
    fi

    # Create superuser if not exists (username validated above)
    if ! sudo -u postgres psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='$pg_user'" 2>/dev/null | grep -q 1; then
        print_step "Creating PostgreSQL superuser: $pg_user"
        if ! sudo -u postgres createuser --superuser "$pg_user" 2>/dev/null; then
            print_error "Could not create PostgreSQL user"
            FAILED_ITEMS+=("postgresql-user")
        fi
    fi

    # Create database if not exists
    if ! sudo -u postgres psql -tAc "SELECT 1 FROM pg_database WHERE datname='$pg_user'" 2>/dev/null | grep -q 1; then
        print_step "Creating PostgreSQL database: $pg_user"
        if ! sudo -u postgres createdb "$pg_user" 2>/dev/null; then
            print_error "Could not create PostgreSQL database"
            FAILED_ITEMS+=("postgresql-database")
        fi
    fi

    # Final verification - test connection
    if sudo -u postgres psql -tAc "SELECT 1" &>/dev/null; then
        print_success "PostgreSQL setup complete (verified). Run 'psql' to connect."
    else
        print_warning "PostgreSQL running but connection test failed"
        FAILED_ITEMS+=("postgresql-verify")
    fi
}

# Setup Docker service and user group
configure_docker() {
    print_step "Setting up Docker..."

    # Check if Docker is installed (should be from package list)
    if ! command -v docker &>/dev/null && ! rpm -q docker-ce &>/dev/null; then
        print_warning "Docker not installed, skipping setup"
        return 0
    fi

    # Remove old conflicting packages (safe to run even if not present)
    sudo dnf remove -y docker docker-client docker-common docker-latest \
        docker-latest-logrotate docker-logrotate docker-selinux \
        docker-engine-selinux docker-engine 2>/dev/null || true

    # =========================================================================
    # CGROUPS V2 CHECK: Required for resource limits in rootless mode
    # =========================================================================
    if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
        print_step "cgroups v2 detected (good for resource limits)"

        # Check if CPU/memory controllers are delegated for rootless
        if [ -f "/sys/fs/cgroup/user.slice/user-$(id -u).slice/cgroup.controllers" ]; then
            local user_controllers
            user_controllers=$(cat "/sys/fs/cgroup/user.slice/user-$(id -u).slice/cgroup.controllers" 2>/dev/null || echo "")
            if ! echo "$user_controllers" | grep -q "cpu"; then
                print_step "Enabling cgroup delegation for resource limits..."
                # Create systemd override for cgroup delegation
                sudo mkdir -p /etc/systemd/system/user@.service.d
                if ! sudo tee /etc/systemd/system/user@.service.d/delegate.conf > /dev/null 2>&1 << 'EOF'
[Service]
Delegate=cpu cpuset io memory pids
EOF
                then
                    print_warning "Could not create cgroup delegation config"
                else
                    # Reload systemd to pick up new cgroup delegation config
                    sudo systemctl daemon-reload 2>/dev/null || true
                    print_success "cgroup delegation enabled (requires re-login)"
                fi
            fi
        fi
    else
        print_step "cgroups v1 detected (resource limits may not work in rootless mode)"
    fi

    # =========================================================================
    # DBUS CHECK: Required for systemd cgroup driver
    # =========================================================================
    if ! rpm -q dbus-daemon &>/dev/null; then
        print_step "Installing dbus-daemon for Docker cgroup support..."
        sudo dnf install -y dbus-daemon 2>/dev/null || true
    fi

    # =========================================================================
    # SERVICE MANAGEMENT
    # =========================================================================

    # Stop any conflicting services
    sudo systemctl stop docker.socket 2>/dev/null || true

    # Enable and start Docker service
    if ! sudo systemctl enable docker 2>/dev/null; then
        print_warning "Could not enable Docker service"
        FAILED_ITEMS+=("docker-enable")
    fi

    if ! sudo systemctl start docker 2>/dev/null; then
        # Check for common startup failures
        local docker_status
        docker_status=$(systemctl status docker 2>&1 || true)

        if echo "$docker_status" | grep -q "overlay"; then
            print_error "Docker failed - filesystem may not support overlay2"
            echo "  Try: sudo dnf install -y fuse-overlayfs"
        elif echo "$docker_status" | grep -q "cgroup"; then
            print_error "Docker failed - cgroup configuration issue"
            echo "  Try rebooting after installation"
        else
            print_error "Could not start Docker service"
        fi
        FAILED_ITEMS+=("docker-start")
    fi

    # Wait for Docker to be ready (up to 30 seconds for slow systems/first kernel module load)
    local retries=30
    local docker_ready=false
    while [ $retries -gt 0 ]; do
        if systemctl is-active docker &>/dev/null && \
           sudo docker info &>/dev/null 2>&1; then
            docker_ready=true
            break
        fi
        sleep 1
        ((retries--))
    done

    if [ "$docker_ready" = false ]; then
        print_warning "Docker service not ready after 30 seconds"
        print_warning "Docker may still work after reboot"
        FAILED_ITEMS+=("docker-ready-timeout")
    fi

    # =========================================================================
    # USER GROUP MANAGEMENT
    # =========================================================================

    # Create docker group if it doesn't exist
    if ! getent group docker &>/dev/null; then
        sudo groupadd docker 2>/dev/null || true
    fi

    # Add user to docker group (avoids needing sudo for docker commands)
    if ! getent group docker | grep -qw "$USER"; then
        print_step "Adding $USER to docker group..."
        if ! sudo usermod -aG docker "$USER"; then
            print_error "Failed to add $USER to docker group"
            FAILED_ITEMS+=("docker-group")
        fi
    fi

    # Verify group membership
    if getent group docker | grep -qw "$USER"; then
        print_step "User $USER is in docker group"
    else
        print_warning "User not in docker group - may need manual fix"
        FAILED_ITEMS+=("docker-group-verify")
    fi

    # =========================================================================
    # VERIFICATION
    # =========================================================================

    if systemctl is-active --quiet docker; then
        # Get Docker info for verification
        local docker_info
        docker_info=$(sudo docker info 2>/dev/null || echo "")

        if echo "$docker_info" | grep -q "Cgroup Driver: systemd"; then
            print_success "Docker installed and running (cgroup: systemd)"
        elif echo "$docker_info" | grep -q "Cgroup Driver: cgroupfs"; then
            print_success "Docker installed and running (cgroup: cgroupfs)"
        else
            print_success "Docker installed and running"
        fi
    else
        print_error "Docker service is not running"
        FAILED_ITEMS+=("docker-service")
    fi

    print_warning "LOGOUT/LOGIN required for docker group membership to take effect!"
}

# Setup Claude Code CLI (AI coding assistant)
configure_claude_code() {
    print_step "Setting up Claude Code CLI..."

    # Check if already installed
    if command -v claude &>/dev/null; then
        local claude_version
        claude_version=$(claude --version 2>/dev/null | head -1 || echo "unknown")
        print_step "Claude Code already installed: $claude_version"
        return 0
    fi

    # Also check if binary exists but not in PATH
    if [ -x "$HOME/.claude/bin/claude" ]; then
        print_step "Claude Code already installed (not in current PATH)"
        return 0
    fi

    # Install using native installer (not npm - deprecated)
    print_step "Installing Claude Code..."
    if curl -fsSL https://claude.ai/install.sh | bash 2>/dev/null; then
        # Add to PATH for current session
        export PATH="$HOME/.claude/bin:$PATH"

        # Verify installation
        if command -v claude &>/dev/null; then
            print_success "Claude Code installed (verified). Run 'claude' to login."
        elif [ -x "$HOME/.claude/bin/claude" ]; then
            print_success "Claude Code installed (will work after shell restart)"
        else
            print_warning "Claude Code binary not found after installation"
            FAILED_ITEMS+=("claude-code-verify")
        fi

        # Verify fish config has Claude PATH (Claude installer should add this)
        local fish_config="$HOME/.config/fish/config.fish"
        if [ -f "$fish_config" ] || [ -L "$fish_config" ]; then
            if ! grep -q "\.claude" "$fish_config" 2>/dev/null; then
                # Claude installer didn't add to fish config, check if it's in conf.d
                if [ ! -f "$HOME/.config/fish/conf.d/claude.fish" ]; then
                    print_warning "Claude Code PATH may not be in fish config"
                fi
            fi
        fi
    else
        print_warning "Claude Code installation failed (optional)"
        FAILED_ITEMS+=("claude-code")
    fi
}

# Auto-detect location for gammastep blue light filter
configure_gammastep_location() {
    local config_file="$HOME/.config/gammastep/config.ini"

    # Skip if config doesn't exist
    if [ ! -f "$config_file" ] && [ ! -L "$config_file" ]; then
        print_step "Gammastep config not found, skipping location setup"
        return 0
    fi

    # If config is a symlink, replace with a copy to avoid modifying repo
    if [ -L "$config_file" ]; then
        local real_file
        real_file=$(readlink -f "$config_file")
        if [ ! -f "$real_file" ]; then
            print_warning "Gammastep config symlink target not found"
            FAILED_ITEMS+=("gammastep-symlink")
            return 1
        fi
        rm "$config_file"
        if ! cp "$real_file" "$config_file"; then
            print_error "Failed to copy gammastep config for editing"
            FAILED_ITEMS+=("gammastep-copy")
            return 1
        fi
    fi

    # Check if location is already configured (non-default values)
    local current_lat current_lon
    current_lat=$(grep -E "^lat=" "$config_file" 2>/dev/null | cut -d'=' -f2)
    current_lon=$(grep -E "^lon=" "$config_file" 2>/dev/null | cut -d'=' -f2)

    # Skip if already configured with non-default values (not 0.0 or empty)
    if [ -n "$current_lat" ] && [ -n "$current_lon" ] && \
       [ "$current_lat" != "0.0" ] && [ "$current_lon" != "0.0" ]; then
        print_step "Gammastep location already configured: $current_lat, $current_lon"
        return 0
    fi

    print_step "Detecting location for blue light filter..."

    # Try IP geolocation (ip-api.com - free, no key needed)
    local location lat lon
    if command -v curl &>/dev/null; then
        location=$(curl -s --connect-timeout 5 "http://ip-api.com/json" 2>/dev/null)

        if [ -n "$location" ] && command -v jq &>/dev/null; then
            lat=$(echo "$location" | jq -r '.lat // empty')
            lon=$(echo "$location" | jq -r '.lon // empty')
        elif [ -n "$location" ]; then
            print_warning "jq not available, using fallback coordinates"
        fi
    else
        print_warning "curl not available for geolocation, using fallback coordinates"
    fi

    # Fallback coordinates (will be used if geolocation fails)
    lat="${lat:-20.5}"
    lon="${lon:-78.9}"

    # Update config file with verification
    local lat_ok=false lon_ok=false

    if sed -i "s/^lat=.*/lat=$lat/" "$config_file" 2>/dev/null; then
        if grep -q "^lat=$lat" "$config_file" 2>/dev/null; then
            lat_ok=true
        fi
    fi

    if sed -i "s/^lon=.*/lon=$lon/" "$config_file" 2>/dev/null; then
        if grep -q "^lon=$lon" "$config_file" 2>/dev/null; then
            lon_ok=true
        fi
    fi

    if [ "$lat_ok" = true ] && [ "$lon_ok" = true ]; then
        print_success "Gammastep location set: $lat, $lon (verified)"
    else
        print_warning "Gammastep location may not have been set correctly"
        FAILED_ITEMS+=("gammastep-location")
        return 1
    fi
}

# Configure power management (handle TLP vs power-profiles-daemon conflict)
configure_power_management() {
    print_step "Configuring power management..."

    # Check if we're in a VM - skip power management
    if systemd-detect-virt -q 2>/dev/null; then
        print_step "Virtual machine detected, skipping power management setup"
        return 0
    fi

    # Check if this is a laptop (has battery)
    local is_laptop=false
    if ls /sys/class/power_supply/BAT* /sys/class/power_supply/CMB* /sys/class/power_supply/BATT 2>/dev/null | grep -q .; then
        is_laptop=true
    fi

    # =========================================================================
    # CONFLICT DETECTION: TLP vs power-profiles-daemon
    # =========================================================================
    # These services conflict because both try to manage CPU governors

    local has_tlp=false
    local has_ppd=false

    if rpm -q tlp &>/dev/null || systemctl is-enabled tlp &>/dev/null 2>&1; then
        has_tlp=true
    fi

    if rpm -q power-profiles-daemon &>/dev/null || systemctl is-enabled power-profiles-daemon &>/dev/null 2>&1; then
        has_ppd=true
    fi

    if [ "$has_tlp" = true ] && [ "$has_ppd" = true ]; then
        print_warning "Conflict detected: TLP and power-profiles-daemon are both installed"
        echo "  These services conflict - only one should be active."
        echo "  Fedora default: power-profiles-daemon (GNOME integration)"
        echo "  Alternative: TLP (more features, better for advanced users)"
        echo ""

        # Disable TLP in favor of ppd (Fedora default)
        if systemctl is-active tlp &>/dev/null; then
            print_step "Disabling TLP in favor of power-profiles-daemon..."
            sudo systemctl stop tlp 2>/dev/null || true
            sudo systemctl disable tlp 2>/dev/null || true
            sudo systemctl mask tlp 2>/dev/null || true
        fi
    fi

    # =========================================================================
    # RFKILL CONFLICT: systemd-rfkill vs TLP
    # =========================================================================
    if [ "$has_tlp" = true ]; then
        # Mask systemd-rfkill to avoid conflicts with TLP's radio management
        if systemctl is-enabled systemd-rfkill.service &>/dev/null 2>&1; then
            print_step "Masking systemd-rfkill (conflicts with TLP)..."
            sudo systemctl mask systemd-rfkill.service 2>/dev/null || true
            sudo systemctl mask systemd-rfkill.socket 2>/dev/null || true
        fi
    fi

    # =========================================================================
    # VENDOR-SPECIFIC TOOLS
    # =========================================================================

    # Check for vendor-specific power management tools
    local vendor=""
    if [ -f /sys/class/dmi/id/sys_vendor ]; then
        vendor=$(cat /sys/class/dmi/id/sys_vendor 2>/dev/null | tr '[:upper:]' '[:lower:]')
    fi

    case "$vendor" in
        *lenovo*|*thinkpad*)
            # ThinkPad-specific tools
            if [ "$is_laptop" = true ]; then
                print_step "Lenovo/ThinkPad detected"
                # thinkfan for fan control (optional)
                if rpm -q thinkfan &>/dev/null; then
                    print_step "thinkfan available for fan control"
                fi
            fi
            ;;
        *asus*)
            # ASUS-specific tools
            if [ "$is_laptop" = true ]; then
                print_step "ASUS laptop detected"
                if command -v asusctl &>/dev/null; then
                    print_step "asusctl available for ASUS-specific features"
                fi
            fi
            ;;
        *dell*)
            print_step "Dell system detected"
            # Dell systems may need specific thermal management
            ;;
    esac

    # =========================================================================
    # LAPTOP-SPECIFIC SETTINGS
    # =========================================================================
    if [ "$is_laptop" = true ]; then
        # Ensure power management service is running
        if [ "$has_ppd" = true ] && ! [ "$has_tlp" = true ]; then
            if ! systemctl is-active power-profiles-daemon &>/dev/null; then
                sudo systemctl enable power-profiles-daemon 2>/dev/null || true
                sudo systemctl start power-profiles-daemon 2>/dev/null || true
            fi
            print_step "Power profiles daemon active (use 'powerprofilesctl' to manage)"
        elif [ "$has_tlp" = true ]; then
            print_step "TLP active (check 'tlp-stat' for status)"
        fi
    fi

    print_step "Power management configured"
}

# Configure LightDM (login screen)
configure_lightdm() {
    print_step "Configuring login screen..."

    # Check if LightDM is installed
    if [ ! -f /etc/lightdm/lightdm-gtk-greeter.conf ]; then
        print_step "LightDM not found. Skipping login screen customization."
        return
    fi

    # Copy wallpaper to system location
    if ! sudo mkdir -p /usr/share/backgrounds/draphyOS 2>/dev/null; then
        print_warning "Could not create system backgrounds directory"
        FAILED_ITEMS+=("lightdm-wallpaper-dir")
        return
    fi

    if [ -f "$INSTALL_DIR/assets/wallpaper.png" ]; then
        if ! sudo cp -f "$INSTALL_DIR/assets/wallpaper.png" /usr/share/backgrounds/draphyOS/ 2>/dev/null; then
            print_warning "Could not copy wallpaper to system location"
            FAILED_ITEMS+=("lightdm-wallpaper")
        fi
    fi

    # Configure LightDM greeter (backup original first)
    sudo cp /etc/lightdm/lightdm-gtk-greeter.conf /etc/lightdm/lightdm-gtk-greeter.conf.backup 2>/dev/null || true

    if ! sudo tee /etc/lightdm/lightdm-gtk-greeter.conf > /dev/null 2>&1 << 'EOF'
[greeter]
background=/usr/share/backgrounds/draphyOS/wallpaper.png
theme-name=Adwaita-dark
icon-theme-name=Mint-Y
font-name=Fira Code 10
cursor-theme-name=Adwaita
EOF
    then
        print_error "Failed to configure LightDM"
        FAILED_ITEMS+=("lightdm-config")
        return 1
    fi

    # Verify config was written
    if grep -q "draphyOS" /etc/lightdm/lightdm-gtk-greeter.conf 2>/dev/null; then
        print_success "LightDM configured (verified)"
    else
        print_warning "LightDM config may not have been written correctly"
        FAILED_ITEMS+=("lightdm-verify")
    fi
}

# Configure default applications via xdg-settings
configure_default_apps() {
    print_step "Setting default applications..."

    # Source environment.d to get default app names
    if [ -f "$HOME/.config/environment.d/defaults.conf" ]; then
        # shellcheck source=/dev/null
        . "$HOME/.config/environment.d/defaults.conf"
    fi

    # Helper to check if desktop file exists
    desktop_exists() {
        local desktop="$1"
        [ -f "/usr/share/applications/$desktop" ] || \
        [ -f "$HOME/.local/share/applications/$desktop" ]
    }

    # Helper to set xdg-mime default
    set_mime_default() {
        local desktop="$1"
        shift
        if desktop_exists "$desktop"; then
            for mime in "$@"; do
                xdg-mime default "$desktop" "$mime" 2>/dev/null || true
            done
        fi
    }

    local browser="${BROWSER:-brave-browser}"
    local file_manager="${FILE_MANAGER:-thunar}"
    local player="${PLAYER:-mpv}"
    local ide="${IDE:-code}"

    # Set default browser via xdg-settings
    if command -v xdg-settings &>/dev/null; then
        local browser_desktop="${browser}.desktop"
        if desktop_exists "$browser_desktop"; then
            # Temporarily unset BROWSER to allow xdg-settings to work
            local saved_browser="$BROWSER"
            unset BROWSER
            if xdg-settings set default-web-browser "$browser_desktop" 2>/dev/null; then
                print_step "Default browser set: $browser"
            fi
            export BROWSER="$saved_browser"
        fi
    fi

    # Set defaults via xdg-mime
    if command -v xdg-mime &>/dev/null; then
        # Browser (xdg-mime as backup to xdg-settings)
        set_mime_default "${browser}.desktop" \
            "x-scheme-handler/http" "x-scheme-handler/https" \
            "x-scheme-handler/about" "text/html"

        # File manager
        set_mime_default "${file_manager}.desktop" "inode/directory"

        # Video player
        set_mime_default "${player}.desktop" \
            "video/mp4" "video/x-matroska" "video/webm" "video/avi" \
            "video/quicktime" "video/x-msvideo"

        # Audio player
        set_mime_default "${player}.desktop" \
            "audio/mpeg" "audio/mp3" "audio/flac" "audio/ogg" \
            "audio/wav" "audio/x-wav"

        # Image viewer (feh)
        set_mime_default "feh.desktop" \
            "image/png" "image/jpeg" "image/gif" "image/webp" "image/bmp"

        # Text/code editor
        set_mime_default "${ide}.desktop" \
            "text/plain" "application/json" "text/x-python" \
            "text/x-shellscript" "application/javascript"

        print_step "MIME associations configured"
    fi

    print_success "Default applications configured"
}

# Configure battery charging limit (if supported)
# Supports: ThinkPad, ASUS, Dell, Lenovo IdeaPad, Huawei, LG, MSI, Samsung, Framework, System76
configure_battery_limit() {
    local battery_type=""
    local battery_path=""
    local battery_name=""
    local allowed_values=""
    local min_value=60
    local max_value=100
    local is_toggle=false
    local current_limit=""
    local kernel_version=""

    # Get kernel version for compatibility checks
    kernel_version=$(uname -r | cut -d. -f1-2)

    # =========================================================================
    # DETECTION: Find supported battery interface
    # =========================================================================

    # Method 1: Standard kernel interface (ThinkPad natacpi, ASUS, Dell 6.12+, Framework, MSI, System76)
    # Check all possible battery names: BAT0, BAT1, BATC, BATT, CMB0, CMB1
    # Use shopt to handle non-matching globs gracefully
    shopt -s nullglob 2>/dev/null || true
    for bat in /sys/class/power_supply/BAT* /sys/class/power_supply/CMB* /sys/class/power_supply/BATT; do
        if [ -f "$bat/charge_control_end_threshold" ]; then
            battery_path="$bat/charge_control_end_threshold"
            battery_name=$(basename "$bat")
            battery_type="standard"
            break
        fi
    done
    shopt -u nullglob 2>/dev/null || true

    # Method 2: Lenovo IdeaPad conservation mode (binary toggle, limits to ~60%)
    if [ -z "$battery_type" ]; then
        shopt -s nullglob 2>/dev/null || true
        for vpc in /sys/bus/platform/drivers/ideapad_acpi/VPC*/conservation_mode; do
            if [ -f "$vpc" ]; then
                battery_path="$vpc"
                battery_type="ideapad"
                is_toggle=true
                break
            fi
        done
        shopt -u nullglob 2>/dev/null || true
    fi

    # Method 3: Huawei MateBook (uses different path)
    if [ -z "$battery_type" ] && [ -f "/sys/devices/platform/huawei-wmi/charge_control_thresholds" ]; then
        battery_path="/sys/devices/platform/huawei-wmi/charge_control_thresholds"
        battery_type="huawei"
        min_value=1
    fi

    # Method 4: LG Gram battery care
    if [ -z "$battery_type" ] && [ -f "/sys/devices/platform/lg-laptop/battery_care_limit" ]; then
        battery_path="/sys/devices/platform/lg-laptop/battery_care_limit"
        battery_type="lg"
        is_toggle=true
        allowed_values="80 100"
    fi

    # Method 5: Samsung battery life extender
    if [ -z "$battery_type" ] && [ -f "/sys/devices/platform/samsung/battery_life_extender" ]; then
        battery_path="/sys/devices/platform/samsung/battery_life_extender"
        battery_type="samsung"
        is_toggle=true
    fi

    # Method 6: Old ThinkPad tp_smapi interface (pre-2011 models)
    if [ -z "$battery_type" ]; then
        shopt -s nullglob 2>/dev/null || true
        for bat in /sys/devices/platform/smapi/BAT*; do
            if [ -f "$bat/stop_charge_thresh" ]; then
                battery_path="$bat/stop_charge_thresh"
                battery_name=$(basename "$bat")
                battery_type="tp_smapi"
                break
            fi
        done
        shopt -u nullglob 2>/dev/null || true
    fi

    # =========================================================================
    # NO SUPPORT: Exit early if no battery interface found
    # =========================================================================

    if [ -z "$battery_type" ]; then
        # Check if we're in a VM
        if systemd-detect-virt -q 2>/dev/null; then
            print_step "Battery charge limit: Not available (virtual machine detected)"
        # Check if there's any battery at all
        elif ! ls /sys/class/power_supply/BAT* /sys/class/power_supply/CMB* /sys/class/power_supply/BATT 2>/dev/null | grep -q .; then
            print_step "Battery charge limit: Not available (no battery - desktop/server)"
        else
            print_step "Battery charge limit: Not supported by this hardware"
            echo "  Your laptop may need a specific kernel module or newer kernel."
            echo "  Possible solutions:"
            # Check for common modules that might need loading
            if grep -qi "lenovo" /sys/class/dmi/id/sys_vendor 2>/dev/null; then
                if ! lsmod 2>/dev/null | grep -q "ideapad_laptop"; then
                    echo "    - Try: sudo modprobe ideapad_laptop"
                fi
            elif grep -qi "asus" /sys/class/dmi/id/sys_vendor 2>/dev/null; then
                if ! lsmod 2>/dev/null | grep -q "asus_nb_wmi\|asus_wmi"; then
                    echo "    - Try: sudo modprobe asus_nb_wmi"
                fi
            elif grep -qi "dell" /sys/class/dmi/id/sys_vendor 2>/dev/null; then
                echo "    - Dell requires kernel 6.12+ (current: $kernel_version)"
            fi
            echo "    - Run: sudo tlp-stat -b (install tlp first) for diagnostics"
        fi
        return
    fi

    # =========================================================================
    # VERIFY: Check if path is readable/writable
    # =========================================================================

    if [ ! -r "$battery_path" ]; then
        print_warning "Battery interface found but not readable: $battery_path"
        return
    fi

    # Get current value for display
    current_limit=$(cat "$battery_path" 2>/dev/null | head -1)

    # =========================================================================
    # ASUS SPECIAL HANDLING: Only accepts 40, 60, 80, 100
    # =========================================================================

    if [ "$battery_type" = "standard" ]; then
        # Detect ASUS by checking if asus-nb-wmi module is loaded or ASUS in DMI
        if lsmod 2>/dev/null | grep -q "asus_nb_wmi\|asus_wmi"; then
            battery_type="asus"
            allowed_values="40 60 80 100"
        elif grep -qi "asus" /sys/class/dmi/id/sys_vendor 2>/dev/null; then
            battery_type="asus"
            allowed_values="40 60 80 100"
        fi
    fi

    # =========================================================================
    # CLEANUP: Remove existing service/udev rule/scripts if present
    # =========================================================================

    if [ -f /etc/systemd/system/battery-charge-limit.service ]; then
        sudo systemctl stop battery-charge-limit.service 2>/dev/null || true
        sudo systemctl disable battery-charge-limit.service 2>/dev/null || true
        sudo rm -f /etc/systemd/system/battery-charge-limit.service 2>/dev/null || true
        sudo systemctl daemon-reload 2>/dev/null || true
    fi
    if [ -f /etc/udev/rules.d/99-battery-charge-limit.rules ]; then
        sudo rm -f /etc/udev/rules.d/99-battery-charge-limit.rules 2>/dev/null || true
    fi
    if [ -f /usr/local/bin/asus-battery-limit.sh ]; then
        sudo rm -f /usr/local/bin/asus-battery-limit.sh 2>/dev/null || true
    fi

    # =========================================================================
    # USER PROMPT: Get desired limit
    # =========================================================================

    print_step "Battery charge limit supported"
    echo ""
    echo "  Detected: $battery_type interface"
    echo "  Battery:  ${battery_name:-N/A}"
    echo "  Current:  ${current_limit:-unknown}"
    echo ""
    echo "  Setting a charge limit extends battery lifespan."
    echo "  Recommended: 60-80% for daily use, 100% for travel."
    echo ""

    local limit=""
    local choice=""

    if [ "$is_toggle" = true ]; then
        # Binary toggle interfaces
        case "$battery_type" in
            ideapad)
                echo "  Lenovo IdeaPad Conservation Mode limits charging to ~60%."
                local current_status=$([ "$current_limit" = "1" ] && echo "enabled" || echo "disabled")
                echo "  Currently: $current_status"
                read -rp "  Enable conservation mode? (yes/no/skip) [skip]: " choice </dev/tty
                choice="${choice:-skip}"  # Default to skip if empty
                case "$choice" in
                    yes|y|Y) limit="1" ;;
                    no|n|N) limit="0" ;;
                    skip|s|S|"") print_step "Skipping battery limit setup"; return ;;
                    *) print_warning "Invalid input. Skipping."; return ;;
                esac
                ;;
            lg)
                echo "  LG Battery Care limits charging to 80%."
                local current_status=$([ "$current_limit" = "80" ] && echo "enabled (80%)" || echo "disabled (100%)")
                echo "  Currently: $current_status"
                read -rp "  Enable battery care (80% limit)? (yes/no/skip) [skip]: " choice </dev/tty
                choice="${choice:-skip}"
                case "$choice" in
                    yes|y|Y) limit="80" ;;
                    no|n|N) limit="100" ;;
                    skip|s|S|"") print_step "Skipping battery limit setup"; return ;;
                    *) print_warning "Invalid input. Skipping."; return ;;
                esac
                ;;
            samsung)
                echo "  Samsung Battery Life Extender limits charging to ~80%."
                local current_status=$([ "$current_limit" = "1" ] && echo "enabled" || echo "disabled")
                echo "  Currently: $current_status"
                read -rp "  Enable battery life extender? (yes/no/skip) [skip]: " choice </dev/tty
                choice="${choice:-skip}"
                case "$choice" in
                    yes|y|Y) limit="1" ;;
                    no|n|N) limit="0" ;;
                    skip|s|S|"") print_step "Skipping battery limit setup"; return ;;
                    *) print_warning "Invalid input. Skipping."; return ;;
                esac
                ;;
        esac
    elif [ "$battery_type" = "asus" ]; then
        echo "  ASUS laptops only accept: 40, 60, 80, or 100"
        read -rp "  Enter charge limit (40/60/80/100, or 'skip') [skip]: " limit </dev/tty
        limit="${limit:-skip}"

        if [[ "$limit" == "skip" || -z "$limit" ]]; then
            print_step "Skipping battery limit setup"
            return
        fi

        if [[ ! "$limit" =~ ^(40|60|80|100)$ ]]; then
            print_warning "ASUS only accepts 40, 60, 80, or 100. Skipping."
            return
        fi
    elif [ "$battery_type" = "huawei" ]; then
        echo "  Huawei supports start and stop thresholds."
        read -rp "  Enter stop threshold (${min_value}-${max_value}, or 'skip') [skip]: " limit </dev/tty
        limit="${limit:-skip}"

        if [[ "$limit" == "skip" || -z "$limit" ]]; then
            print_step "Skipping battery limit setup"
            return
        fi

        if ! [[ "$limit" =~ ^[0-9]+$ ]] || [ "$limit" -lt "$min_value" ] || [ "$limit" -gt "$max_value" ]; then
            print_warning "Invalid value. Must be ${min_value}-${max_value}. Skipping."
            return
        fi
    else
        # Standard percentage input
        read -rp "  Enter charge limit percentage (${min_value}-${max_value}, or 'skip') [skip]: " limit </dev/tty
        limit="${limit:-skip}"

        if [[ "$limit" == "skip" || -z "$limit" ]]; then
            print_step "Skipping battery limit setup"
            return
        fi

        if ! [[ "$limit" =~ ^[0-9]+$ ]] || [ "$limit" -lt "$min_value" ] || [ "$limit" -gt "$max_value" ]; then
            print_warning "Invalid value. Must be ${min_value}-${max_value}. Skipping."
            return
        fi
    fi

    # Check if value is already set
    if [ "$current_limit" = "$limit" ]; then
        print_step "Battery limit already set to $limit. No change needed."
        return
    fi

    # =========================================================================
    # APPLY: Set the limit based on interface type
    # =========================================================================

    local write_value=""
    local display_limit=""

    case "$battery_type" in
        standard|asus|tp_smapi)
            write_value="$limit"
            display_limit="$limit%"
            ;;
        ideapad)
            write_value="$limit"
            display_limit=$([ "$limit" = "1" ] && echo "~60% (conservation mode)" || echo "100% (disabled)")
            ;;
        huawei)
            # Huawei uses "start stop" format, set start to stop-10
            local start=$((limit - 10))
            [ "$start" -lt 0 ] && start=0
            write_value="$start $limit"
            display_limit="$limit%"
            ;;
        lg)
            write_value="$limit"
            display_limit="$limit%"
            ;;
        samsung)
            write_value="$limit"
            display_limit=$([ "$limit" = "1" ] && echo "~80% (extender on)" || echo "100% (extender off)")
            ;;
    esac

    # Apply immediately with retry (using printf|tee instead of eval for security)
    local retry_count=0
    local max_retries=3
    local apply_success=false

    while [ "$retry_count" -lt "$max_retries" ]; do
        if printf '%s' "$write_value" | sudo tee "$battery_path" > /dev/null 2>&1; then
            apply_success=true
            break
        fi
        retry_count=$((retry_count + 1))
        sleep 0.5
    done

    if [ "$apply_success" = false ]; then
        print_error "Failed to set battery limit after $max_retries attempts"
        FAILED_ITEMS+=("battery-limit-set")
        return 1
    fi

    # Brief delay for hardware to register the change
    sleep 0.2

    # Verify the limit was applied
    local verify_value
    verify_value=$(cat "$battery_path" 2>/dev/null | head -1)

    # Skip verification if we couldn't read the value
    if [ -z "$verify_value" ]; then
        print_warning "Could not verify battery limit (unable to read value)"
        FAILED_ITEMS+=("battery-limit-read")
        return 0
    fi

    # Type-specific verification
    case "$battery_type" in
        huawei)
            # Huawei returns "start stop" format, extract stop value
            verify_value=$(echo "$verify_value" | awk '{print $2}')
            if [ "$verify_value" != "$limit" ]; then
                print_warning "Battery limit verification: expected $limit, got $verify_value"
                FAILED_ITEMS+=("battery-limit-verify")
            fi
            ;;
        ideapad|samsung)
            # Binary toggles
            if [ "$verify_value" != "$limit" ]; then
                print_warning "Battery limit verification: expected $limit, got $verify_value"
                FAILED_ITEMS+=("battery-limit-verify")
            fi
            ;;
        *)
            # Standard numeric comparison
            if [ "$verify_value" != "$limit" ]; then
                print_warning "Battery limit verification: expected $limit, got $verify_value"
                FAILED_ITEMS+=("battery-limit-verify")
            fi
            ;;
    esac

    # =========================================================================
    # PERSIST: Create systemd service for boot persistence
    # =========================================================================

    local service_content=""

    # ASUS needs udev rule instead of systemd (resets on power-on)
    if [ "$battery_type" = "asus" ]; then
        print_step "Creating udev rule for ASUS battery (persists across reboots)..."

        # Create a script that handles all ASUS battery names (BAT0, BAT1, BATC, BATT)
        if ! sudo tee /usr/local/bin/asus-battery-limit.sh > /dev/null 2>&1 << 'SCRIPT'
#!/bin/bash
# ASUS battery charge limit - set by draphyOS
LIMIT="$1"
for bat in /sys/class/power_supply/BAT* /sys/class/power_supply/BATT /sys/class/power_supply/BATC 2>/dev/null; do
    if [ -f "$bat/charge_control_end_threshold" ]; then
        echo "$LIMIT" > "$bat/charge_control_end_threshold" 2>/dev/null || true
    fi
done
SCRIPT
        then
            print_error "Failed to create ASUS battery script"
            FAILED_ITEMS+=("battery-limit-script")
            return 1
        fi

        sudo chmod +x /usr/local/bin/asus-battery-limit.sh

        if ! sudo tee /etc/udev/rules.d/99-battery-charge-limit.rules > /dev/null 2>&1 << EOF
# ASUS battery charge limit - set by draphyOS
ACTION=="add", KERNEL=="asus-nb-wmi", RUN+="/usr/local/bin/asus-battery-limit.sh $limit"
EOF
        then
            print_error "Failed to create udev rule"
            FAILED_ITEMS+=("battery-limit-udev")
            return 1
        fi

        sudo udevadm control --reload-rules 2>/dev/null || true
        print_success "Battery limit set to $display_limit (verified)"
        return
    fi

    # For all other types, use systemd service
    print_step "Creating systemd service for persistence..."

    if ! sudo tee /etc/systemd/system/battery-charge-limit.service > /dev/null 2>&1 << EOF
[Unit]
Description=Set battery charge limit to $display_limit
After=multi-user.target

[Service]
Type=oneshot
ExecStart=/bin/bash -c "printf '%s' '$write_value' > '$battery_path'"
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF
    then
        print_error "Failed to create battery limit service"
        FAILED_ITEMS+=("battery-limit-service")
        return 1
    fi

    if ! sudo systemctl daemon-reload 2>/dev/null; then
        print_warning "Failed to reload systemd"
        FAILED_ITEMS+=("battery-limit-daemon-reload")
    fi

    if ! sudo systemctl enable battery-charge-limit.service 2>/dev/null; then
        print_warning "Failed to enable battery limit service"
        FAILED_ITEMS+=("battery-limit-enable")
    fi

    # Verify service exists
    if [ -f /etc/systemd/system/battery-charge-limit.service ]; then
        print_success "Battery limit set to $display_limit (verified)"
    else
        print_warning "Battery limit service file not found"
        FAILED_ITEMS+=("battery-limit-file")
    fi
}

# Create marker file with system info
create_marker() {
    print_step "Creating installation marker..."

    # Create marker file with installation timestamp
    if ! echo "Installed: $(date)" > "$MARKER_FILE"; then
        print_error "Failed to create marker file"
        FAILED_ITEMS+=("marker-create")
        return 1
    fi

    # Read draphyOS version from VERSION file
    local draphyos_version="1"
    if [ -f "$INSTALL_DIR/VERSION" ]; then
        draphyos_version=$(tr -d '[:space:]' < "$INSTALL_DIR/VERSION")
    fi
    echo "DRAPHYOS_VERSION=$draphyos_version" >> "$MARKER_FILE"
    print_step "draphyOS version: $draphyos_version"

    # Detect and store base Fedora variant for smart uninstall
    local variant_id=""
    if [ -f /etc/os-release ]; then
        variant_id=$(grep "^VARIANT_ID=" /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d '"')
    fi

    # Check if this is Fedora i3 Spin
    if [ "$variant_id" = "i3" ] || [ -d /usr/share/backgrounds/i3 ]; then
        echo "BASE_SYSTEM=fedora-i3" >> "$MARKER_FILE"
        print_step "Detected: Fedora i3 Spin"
    else
        echo "BASE_SYSTEM=fedora-other" >> "$MARKER_FILE"
        echo "BASE_VARIANT=$variant_id" >> "$MARKER_FILE"
        print_step "Detected: Fedora ${variant_id:-unknown}"
    fi

    # Write hardware detection results (populated by configure_vm)
    if [ "$IS_VM_MODE" = "true" ]; then
        echo "VM_MODE=true" >> "$MARKER_FILE"
    fi

    # Verify marker file was created with required content
    if [ -f "$MARKER_FILE" ]; then
        if grep -q "DRAPHYOS_VERSION=" "$MARKER_FILE" && grep -q "BASE_SYSTEM=" "$MARKER_FILE"; then
            print_success "Installation marker created (verified)"
        else
            print_warning "Marker file incomplete"
            FAILED_ITEMS+=("marker-content")
        fi
    else
        print_error "Marker file not found after creation"
        FAILED_ITEMS+=("marker-verify")
        return 1
    fi
}

# Save checksums of original configs for three-way merge during updates
save_config_checksums() {
    print_step "Saving config checksums for future updates..."

    local checksum_file="$HOME/.draphyOS-config-checksums"

    # Clear existing checksums (with error handling)
    if ! > "$checksum_file" 2>/dev/null; then
        print_warning "Could not create checksum file"
        FAILED_ITEMS+=("checksums-create")
        return 1
    fi

    # Auto-discover all config files from repo
    local saved_count=0
    local failed_count=0
    local config_name
    while IFS= read -r config_name; do
        [ -z "$config_name" ] && continue
        local config="$INSTALL_DIR/configs/$config_name"
        if [ -f "$config" ]; then
            local sum
            sum=$(md5sum "$config" 2>/dev/null | cut -d' ' -f1)
            if [ -n "$sum" ]; then
                echo "$config_name:$sum:$config" >> "$checksum_file"
                ((saved_count++))
            else
                ((failed_count++))
            fi
        fi
    done < <(get_all_config_files)

    # Verify checksums were saved
    if [ -f "$checksum_file" ] && [ -s "$checksum_file" ]; then
        local line_count
        line_count=$(wc -l < "$checksum_file")
        if [ "$line_count" -ge 10 ]; then
            print_success "Config checksums saved ($saved_count files, verified)"
        else
            print_warning "Only $line_count checksums saved (expected $saved_count)"
            FAILED_ITEMS+=("checksums-incomplete")
        fi
    else
        print_warning "Checksum file is empty or missing"
        FAILED_ITEMS+=("checksums-verify")
    fi
}

# Install system update script
install_update_script() {
    print_step "Installing system update script..."

    local update_script="$INSTALL_DIR/update.sh"
    local target="/usr/local/bin/update-draphyOS"

    if [ ! -f "$update_script" ]; then
        print_error "Update script not found in installation directory"
        FAILED_ITEMS+=("update-script-missing")
        return 1
    fi

    if ! sudo cp "$update_script" "$target"; then
        print_error "Failed to copy update script"
        FAILED_ITEMS+=("update-script-copy")
        return 1
    fi

    if ! sudo chmod +x "$target"; then
        print_error "Failed to make update script executable"
        FAILED_ITEMS+=("update-script-chmod")
        return 1
    fi

    # Verify installation
    if [ -x "$target" ]; then
        print_success "Update script installed: update-draphyOS (verified)"
    else
        print_warning "Update script may not be executable"
        FAILED_ITEMS+=("update-script-verify")
    fi
}

# Install wallpaper management script
install_wallpaper_script() {
    print_step "Installing wallpaper management script..."

    local wallpaper_script="$INSTALL_DIR/scripts/set-wallpaper"
    local target="/usr/local/bin/set-wallpaper"

    if [ ! -f "$wallpaper_script" ]; then
        print_warning "Wallpaper script not found, skipping"
        return 0
    fi

    if ! sudo cp "$wallpaper_script" "$target"; then
        print_warning "Failed to copy wallpaper script"
        FAILED_ITEMS+=("wallpaper-script-copy")
        return 1
    fi

    if ! sudo chmod +x "$target"; then
        print_warning "Failed to make wallpaper script executable"
        FAILED_ITEMS+=("wallpaper-script-chmod")
        return 1
    fi

    # Verify installation
    if [ -x "$target" ]; then
        print_success "Wallpaper script installed: set-wallpaper (verified)"
    else
        print_warning "Wallpaper script may not be executable"
        FAILED_ITEMS+=("wallpaper-script-verify")
    fi
}

# Configure for VM environment (picom compatibility)
configure_vm() {
    local picom_config="$HOME/.config/picom/picom.conf"

    # VM mode only enabled via --vm flag (no auto-detection)
    if [ "$FORCE_VM_MODE" != "true" ]; then
        return 0
    fi

    print_step "VM mode: enabled via --vm flag"

    # Apply VM-specific picom settings
    print_step "Applying VM-optimized picom settings..."

    if [ ! -f "$picom_config" ] && [ ! -L "$picom_config" ]; then
        print_warning "Picom config not found, skipping VM optimization"
        FAILED_ITEMS+=("vm-picom-config")
        return 1
    fi

    # If it's a symlink, copy to real file for editing (don't modify repo!)
    if [ -L "$picom_config" ]; then
        local target
        target=$(readlink -f "$picom_config")
        if [ ! -f "$target" ]; then
            print_error "Picom config symlink target not found: $target"
            FAILED_ITEMS+=("vm-picom-symlink")
            return 1
        fi
        rm -f "$picom_config"
        if ! cp "$target" "$picom_config"; then
            print_error "Failed to copy picom config for editing"
            FAILED_ITEMS+=("vm-picom-copy")
            return 1
        fi
    fi

    local vm_failures=0

    # Change backend from glx to xrender
    if sed -i 's/^backend = "glx";/backend = "xrender";/' "$picom_config" 2>/dev/null; then
        if ! grep -q '^backend = "xrender";' "$picom_config" 2>/dev/null; then
            # May already be xrender or different format - check if glx still present
            if grep -q '^backend = "glx";' "$picom_config" 2>/dev/null; then
                print_warning "Failed to change picom backend to xrender"
                FAILED_ITEMS+=("vm-picom-backend")
                ((vm_failures++))
            fi
        fi
    fi

    # Disable corner radius (not supported with xrender)
    if sed -i 's/^corner-radius = [0-9]*;/corner-radius = 0;/' "$picom_config" 2>/dev/null; then
        if ! grep -qE '^corner-radius = 0;' "$picom_config" 2>/dev/null; then
            # Check if non-zero corner radius still present
            if grep -qE '^corner-radius = [1-9]' "$picom_config" 2>/dev/null; then
                print_warning "Failed to disable picom corner radius"
                FAILED_ITEMS+=("vm-picom-corner")
                ((vm_failures++))
            fi
        fi
    fi

    # Disable vsync
    if sed -i 's/^vsync = true;/vsync = false;/' "$picom_config" 2>/dev/null; then
        if grep -q '^vsync = true;' "$picom_config" 2>/dev/null; then
            print_warning "Failed to disable picom vsync"
            FAILED_ITEMS+=("vm-picom-vsync")
            ((vm_failures++))
        fi
    fi

    # Disable use-damage
    if sed -i 's/^use-damage = true;/use-damage = false;/' "$picom_config" 2>/dev/null; then
        if grep -q '^use-damage = true;' "$picom_config" 2>/dev/null; then
            print_warning "Failed to disable picom use-damage"
            FAILED_ITEMS+=("vm-picom-damage")
            ((vm_failures++))
        fi
    fi

    # Mark as VM install (written to marker file in create_marker)
    IS_VM_MODE="true"

    if [ $vm_failures -gt 0 ]; then
        print_warning "VM mode configured with $vm_failures issue(s)"
    else
        print_success "VM mode configured (xrender backend, no rounded corners) - verified"
    fi
}

# Show summary of installation with any failures
show_summary() {
    echo ""
    if [ ${#FAILED_ITEMS[@]} -gt 0 ]; then
        echo -e "${RED}╔═══════════════════════════════════════════════════════════════╗${NC}"
        echo -e "${RED}║                    INSTALLATION ISSUES                        ║${NC}"
        echo -e "${RED}╚═══════════════════════════════════════════════════════════════╝${NC}"
        echo ""
        print_warning "The following ${#FAILED_ITEMS[@]} items had issues:"
        echo ""
        for item in "${FAILED_ITEMS[@]}"; do
            echo -e "  ${RED}✗${NC} $item"
        done
        echo ""
        echo "Most issues are non-critical. draphyOS should still work."
        echo ""
        echo "To retry installation: ~/.draphyOS/install.sh"
        echo "To update configs:     update-draphyOS -d"
        echo ""
        # Save failed items to a file for reference
        printf '%s\n' "${FAILED_ITEMS[@]}" > "$HOME/.draphyOS-failed-items" 2>/dev/null || true
        echo "Failed items saved to: ~/.draphyOS-failed-items"
    else
        print_success "All items installed and verified successfully!"
    fi
}

# Main installation
main() {
    # Parse command line arguments
    while [[ $# -gt 0 ]]; do
        case "$1" in
            --vm)
                FORCE_VM_MODE="true"
                shift
                ;;
            --help|-h)
                echo "Usage: install.sh [OPTIONS]"
                echo ""
                echo "Options:"
                echo "  --vm      Force VM mode (use xrender backend for picom)"
                echo "  --help    Show this help message"
                exit 0
                ;;
            *)
                print_warning "Unknown option: $1"
                shift
                ;;
        esac
    done

    print_header

    # Pre-flight checks
    check_lock
    check_requirements
    check_fedora
    check_internet
    check_sudo
    check_installed

    print_step "Starting installation..."
    echo ""

    # Installation steps
    setup_repo
    add_rpmfusion       # Add RPMFusion repos (required for media packages)
    setup_third_party_repos  # Brave, Chrome, VS Code, ProtonVPN, Docker, yazi, ueberzugpp
    save_package_state  # Save state BEFORE installing, for clean uninstall
    install_packages
    backup_configs
    install_configs
    save_config_checksums  # Save checksums for three-way merge during updates
    configure_hardware
    configure_nvidia    # Install NVIDIA drivers if GPU detected
    configure_vm
    setup_fish
    configure_fnm       # Install fnm and Node.js LTS
    configure_postgresql # Setup PostgreSQL with user database
    configure_docker    # Setup Docker service and user group
    configure_claude_code # Install Claude Code CLI
    configure_gammastep_location # Auto-detect location for blue light filter
    configure_power_management # Handle TLP vs power-profiles-daemon conflict
    configure_lightdm
    configure_default_apps
    configure_battery_limit
    create_marker
    install_update_script
    install_wallpaper_script

    # Show summary of any failed items
    show_summary

    echo ""
    echo -e "${MINT}  ╔═══════════════════════════════════════════════════════════════╗${NC}"
    echo -e "${MINT}  ║              Installation Complete!                           ║${NC}"
    echo -e "${MINT}  ╚═══════════════════════════════════════════════════════════════╝${NC}"
    echo ""
    if [ -d "$BACKUP_DIR" ]; then
        echo -e "  Backup saved to: ${YELLOW}$BACKUP_DIR${NC}"
        echo ""
    fi
    echo -e "  ${MINT}Next steps:${NC}"
    echo "    1. Log out and log back in (or reboot)"
    echo "    2. Select 'i3' from the login screen"
    echo "    3. Press Super+F1 for keybinding cheatsheet"
    echo ""
    echo -e "  Press ${MINT}Super+d${NC} for app launcher"
    echo -e "  Press ${MINT}Super+Return${NC} for terminal"
    echo ""
    echo -e "  Run ${MINT}update-draphyOS${NC} to update your system"
    echo -e "  Run ${MINT}set-wallpaper${NC} <image> to change wallpaper"
    echo ""
    echo -e "  ${MINT}Enjoy draphyOS!${NC}"
    echo ""
    echo -e "  Install log: ${YELLOW}$LOG_FILE${NC}"
}

main "$@"