sys-admin.sh

#!/usr/bin/env bash
#
# System Administration Script for Linux Configuration & Installation Suite
#
set -euo pipefail

# ============================================================================
# CONFIGURATION
# ============================================================================

readonly SCRIPT_VERSION="1.0.0"
readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
readonly LOG_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/sys-admin"
readonly LOG_FILE="${LOG_DIR}/sys-admin-$(date +%Y%m%d-%H%M%S).txt"

# Colors (use $'...' so the escape sequences are actual control chars)
readonly RED=$'\033[0;31m'
readonly GREEN=$'\033[0;32m'
readonly YELLOW=$'\033[1;33m'
readonly BLUE=$'\033[0;34m'
readonly MAGENTA=$'\033[0;35m'
readonly CYAN=$'\033[0;36m'
readonly WHITE=$'\033[1;37m'
readonly BOLD=$'\033[1m'
readonly DIM=$'\033[2m'
readonly NC=$'\033[0m'

# Distro detection results
DISTRO_ID=""
DISTRO_VERSION=""
DISTRO_FAMILY=""
PACKAGE_MANAGER=""
INIT_SYSTEM=""

# PID of background sudo keepalive (set by check_sudo, cleaned up by trap)
sudo_keepalive_pid=""

# ============================================================================
# CLEANUP TRAP
# ============================================================================

cleanup() {
    if [[ -n "$sudo_keepalive_pid" ]] && kill -0 "$sudo_keepalive_pid" 2>/dev/null; then
        kill "$sudo_keepalive_pid" 2>/dev/null || true
    fi
    debug "Cleanup completed"
}
trap cleanup EXIT INT TERM HUP

setup_logging() {
    mkdir -p "$LOG_DIR"
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] === Sys Admin v${SCRIPT_VERSION} Started ===" >> "$LOG_FILE"
}

# ============================================================================
# UTILITY FUNCTIONS
# ============================================================================

_log_to_file() { echo "[$(date '+%H:%M:%S')] $*" >> "$LOG_FILE" 2>/dev/null || true; }
log()     { echo -e "${BLUE}[INFO]${NC} $1";    _log_to_file "[INFO] $1"; }
success() { echo -e "${GREEN}[✓]${NC} $1";      _log_to_file "[OK]   $1"; }
warn()    { echo -e "${YELLOW}[!]${NC} $1";     _log_to_file "[WARN] $1"; }
error()   { echo -e "${RED}[✗]${NC} $1" >&2;   _log_to_file "[ERR]  $1"; }
fatal()   { error "$1"; exit 1; }
debug()   { [[ "${DEBUG:-0}" == "1" ]] && echo -e "${DIM}[DEBUG]${NC} $1" || true; }

center_text() {
    local text="$1"
    local width="${2:-80}"
    local padding=$(( (width - ${#text}) / 2 ))
    printf "%*s%s\n" "$padding" "" "$text"
}

draw_line() {
    local char="${1:-=}"
    local width="${2:-80}"
    printf '%*s\n' "$width" '' | tr ' ' "$char"
}

press_any_key() {
    echo
    read -n 1 -s -r -p "Press any key to continue..."
    echo
}

show_main_banner() {
    clear
    echo -e "${CYAN}${BOLD}"
    draw_line "=" 80
    cat << 'EOF'
███████ ██    ██ ███████      █████  ██████  ███    ███ ██ ███    ██ 
██       ██  ██  ██          ██   ██ ██   ██ ████  ████ ██ ████   ██ 
███████   ████   ███████     ███████ ██   ██ ██ ████ ██ ██ ██ ██  ██ 
     ██    ██         ██     ██   ██ ██   ██ ██  ██  ██ ██ ██  ██ ██ 
███████    ██    ███████     ██   ██ ██████  ██      ██ ██ ██   ████ 
                                                                     
                                                                     
            Linux Configuration & Installation Suite
EOF
    draw_line "=" 80
    echo -e "${NC}"
}

show_section_banner() {
    local title="$1"
    echo
    echo -e "${MAGENTA}${BOLD}"
    draw_line "━" 70
    center_text "$title" 70
    draw_line "━" 70
    echo -e "${NC}"
}

# ============================================================================
# DISTRO DETECTION
# ============================================================================

detect_distro() {
    show_section_banner "SYSTEM DETECTION"

    log "Detecting Linux distribution..."

    if [[ -f /etc/os-release ]]; then
        # Read only the variables we need — avoid leaking arbitrary vars into
        # the script's environment from os-release.
        eval "$(sed -n 's/^\(ID\|VERSION_ID\|VERSION\|NAME\)=/local os_\1=/p' /etc/os-release)"
        DISTRO_ID="${os_ID:-unknown}"

        # Try multiple sources for version info
        DISTRO_VERSION="${os_VERSION_ID:-}"
        if [[ -z "$DISTRO_VERSION" && -n "${os_VERSION:-}" ]]; then
            DISTRO_VERSION="$os_VERSION"
        fi
        if [[ -z "$DISTRO_VERSION" ]] && command -v lsb_release &>/dev/null; then
            DISTRO_VERSION="$(lsb_release -rs 2>/dev/null || true)"
        fi

        # Detect distro family
        case "$DISTRO_ID" in
            arch|manjaro|cachyos|endeavouros|garuda|artix)
                DISTRO_FAMILY="arch"
                PACKAGE_MANAGER="pacman"
                ;;
            ubuntu|debian|linuxmint|pop|elementary|zorin|deepin)
                DISTRO_FAMILY="debian"
                PACKAGE_MANAGER="apt"
                ;;
            fedora|rhel|centos|rocky|alma|nobara)
                DISTRO_FAMILY="fedora"
                PACKAGE_MANAGER="dnf"
                ;;
            opensuse*|suse|tumbleweed)
                DISTRO_FAMILY="suse"
                PACKAGE_MANAGER="zypper"
                ;;
            gentoo|funtoo)
                DISTRO_FAMILY="gentoo"
                PACKAGE_MANAGER="emerge"
                ;;
            void)
                DISTRO_FAMILY="void"
                PACKAGE_MANAGER="xbps-install"
                ;;
            alpine)
                DISTRO_FAMILY="alpine"
                PACKAGE_MANAGER="apk"
                ;;
            nixos)
                DISTRO_FAMILY="nixos"
                PACKAGE_MANAGER="nix-env"
                ;;
            *)
                DISTRO_FAMILY="unknown"
                PACKAGE_MANAGER="unknown"
                ;;
        esac

        success "Detected: ${os_NAME:-$DISTRO_ID}${DISTRO_VERSION:+ $DISTRO_VERSION}"
        success "Family: $DISTRO_FAMILY"
        success "Package Manager: $PACKAGE_MANAGER"
    else
        warn "Could not detect distribution (no /etc/os-release)"
        DISTRO_ID="unknown"
        DISTRO_FAMILY="unknown"
    fi

    # Additional system info
    log "Kernel: $(uname -r)"
    log "Architecture: $(uname -m)"
    log "Hostname: $(cat /etc/hostname 2>/dev/null || uname -n)"

    # Detect init system (prefer checking PID 1 or systemd runtime dir)
    if [ -d /run/systemd/system ] || [[ "$(ps -p 1 -o comm=)" == "systemd" ]]; then
        success "Init system: systemd"
        INIT_SYSTEM="systemd"
    elif [ -f /sbin/openrc ] || [ -f /usr/sbin/openrc ] || [[ "$(ps -p 1 -o comm=)" == "openrc" ]]; then
        success "Init system: openrc"
        INIT_SYSTEM="openrc"
    else
        warn "systemd/openrc not detected or unknown init system"
        INIT_SYSTEM="unknown"
    fi

    # Check for common tools
    local tools=(curl wget git sudo)
    for tool in "${tools[@]}"; do
        if command -v "$tool" &>/dev/null; then
            debug "$tool: available"
        else
            warn "$tool: not found"
        fi
    done

    echo
}

# ============================================================================
# PACKAGE MANAGEMENT
# ============================================================================

check_package() {
    local package="$1"

    case "$PACKAGE_MANAGER" in
        pacman)
            pacman -Qi "$package" &>/dev/null
            ;;
        apt)
            dpkg -l "$package" 2>/dev/null | grep -q "^ii"
            ;;
        dnf)
            rpm -q "$package" &>/dev/null
            ;;
        zypper)
            rpm -q "$package" &>/dev/null
            ;;
        *)
            command -v "$package" &>/dev/null
            ;;
    esac
}

# ============================================================================
# BUILT-IN FUNCTIONS
# ============================================================================

builtin_system_update() {
    show_section_banner "SYSTEM UPDATE"

    cat << EOF
${YELLOW}Description:${NC}
  Updates system packages using the native package manager.

${YELLOW}Detected package manager:${NC} $PACKAGE_MANAGER

EOF

    read -p "Continue with system update? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped system update"
        return
    fi

    log "Updating system packages..."
    echo

    case "$PACKAGE_MANAGER" in
        pacman)
            sudo pacman -Syu
            ;;
        apt)
            sudo apt-get update
            sudo apt-get upgrade -y
            sudo apt-get autoremove -y
            sudo apt-get clean
            ;;
        dnf)
            sudo dnf upgrade -y
            sudo dnf autoremove -y
            ;;
        zypper)
            sudo zypper refresh
            sudo zypper update -y
            ;;
        emerge)
            sudo emerge --sync
            sudo emerge -uDN @world
            ;;
        xbps-install)
            sudo xbps-install -Su
            ;;
        apk)
            sudo apk update
            sudo apk upgrade
            ;;
        nix-env)
            nix-channel --update
            nix-env -u
            ;;
        *)
            error "Unsupported package manager: $PACKAGE_MANAGER"
            ;;
    esac

    success "System update completed"
    press_any_key
}

# ============================================================================
# USB DEVICE MANAGEMENT HELPERS
# ============================================================================

list_usb_devices() {
    # Lists all USB devices with vendor/product IDs
    # Returns: empty if lsusb not available
    if ! command -v lsusb &>/dev/null; then
        return
    fi
    lsusb
}


configure_tlp_usb_blacklist() {
    show_section_banner "TLP USB DEVICE BLACKLIST CONFIGURATION"

    cat << EOF
${YELLOW}Description:${NC}
  Prevent TLP from suspending specific USB devices (like Bluetooth adapters).
  Uses USB_BLACKLIST configuration to keep devices powered during idle.

${YELLOW}Why this matters:${NC}
  • Prevents Bluetooth disconnection during AC power
  • Keeps USB devices like wireless adapters functional
  • Preserves keyboard/mouse responsiveness
  • No negative impact on battery life when plugged in

EOF

    log "Scanning for USB devices..."
    echo

    # Get list of USB devices
    local usb_list
    usb_list=$(list_usb_devices)

    if [[ -z "$usb_list" ]]; then
        warn "Could not detect USB devices (lsusb not available)"
        return
    fi

    # Detect Bluetooth devices from the already-fetched list (no second lsusb call)
    local bt_devices
    bt_devices=$(echo "$usb_list" | grep -iE "(bluetooth|bcm|intel.*wireless|qualcomm|realtek|atheros)" || true)

    echo -e "${BOLD}${CYAN}Available USB Devices:${NC}"
    echo

    local -a device_ids
    local counter=1
    while IFS= read -r line; do
        if [[ -z "$line" ]]; then continue; fi

        local id=$(echo "$line" | sed -n 's/.*ID \([0-9a-f]*:[0-9a-f]*\).*/\1/p')
        local name=$(echo "$line" | sed 's/.*ID [0-9a-f:]*[[:space:]]*//' || true)
        if echo "$line" | grep -qiE "(bluetooth|bcm|intel.*wireless|qualcomm|realtek|atheros)"; then
            printf "  ${GREEN}%2d)${NC} [${CYAN}%s${NC}] ${BOLD}%s${NC} ${DIM}(Bluetooth)${NC}\n" "$counter" "$id" "$name"
        else
            printf "  ${GREEN}%2d)${NC} [${CYAN}%s${NC}] %s\n" "$counter" "$id" "$name"
        fi
        device_ids+=("$id")
        counter=$((counter + 1))
    done <<< "$usb_list"

    echo
    echo -e "  ${GREEN}0)${NC} Skip USB blacklist configuration"
    echo

    # Ask user for selection
    read -p "Select devices to blacklist (comma-separated: 1,3,5 or 'all' for Bluetooth): " -r selection

    if [[ "$selection" == "0" || -z "$selection" ]]; then
        warn "Skipped USB blacklist configuration"
        return
    fi

    # Validate format before parsing (prevent injection into TLP config)
    if [[ ! "$selection" =~ ^([0-9]+(,[0-9]+)*|all)$ ]]; then
        error "Invalid input — use numbers like 1,3 or 'all'"
        return
    fi
    local -a selected_ids
    local tlp_blacklist="USB_BLACKLIST="
    local usb_autosuspend_blacklist="USB_AUTOSUSPEND_BLACKLIST="

    if [[ "$selection" == "all" ]]; then
        # Use all Bluetooth devices
        log "Selecting all Bluetooth USB devices..."
        while IFS= read -r line; do
            local id=$(echo "$line" | sed -n 's/.*ID \([0-9a-f]*:[0-9a-f]*\).*/\1/p')
            if [[ -n "$id" ]]; then
                selected_ids+=("$id")
            fi
        done <<< "$bt_devices"
    else
        # Parse comma-separated selection
        IFS=',' read -ra selections <<< "$selection"
        for sel in "${selections[@]}"; do
            sel=$(echo "$sel" | xargs)  # Trim whitespace
            if [[ "$sel" =~ ^[0-9]+$ ]] && (( sel > 0 && sel <= ${#device_ids[@]} )); then
                selected_ids+=("${device_ids[$((sel-1))]}")
            fi
        done
    fi

    if [[ ${#selected_ids[@]} -eq 0 ]]; then
        warn "No valid devices selected"
        return
    fi

    # Build TLP configuration
    for id in "${selected_ids[@]}"; do
        tlp_blacklist+="$id "
        usb_autosuspend_blacklist+="$id "
    done

    echo
    success "Selected devices to blacklist:"
    for id in "${selected_ids[@]}"; do
        echo "  • $id"
    done
    echo

    # Back up TLP config
    log "Backing up /etc/tlp.conf..."
    sudo cp /etc/tlp.conf "/etc/tlp.conf.backup.$(date +%s)" || warn "Could not backup tlp.conf"

    # Modify TLP configuration
    log "Updating /etc/tlp.conf with USB blacklist..."

    # Check if settings already exist and comment them out
    sudo sed -i.bak '/^USB_BLACKLIST=/s/^/#&/; /^USB_AUTOSUSPEND_BLACKLIST=/s/^/#&/' /etc/tlp.conf 2>/dev/null || true

    # Add new blacklist configuration at end of file
    {
        echo ""
        echo "# ============================================================================"
        echo "# USB Device Blacklist Configuration (Added by Sys Admin)"
        echo "# ============================================================================"
        echo "# Prevent TLP from suspending these USB devices"
        echo "$tlp_blacklist"
        echo "$usb_autosuspend_blacklist"
        echo ""
    } | sudo tee -a /etc/tlp.conf > /dev/null

    success "TLP configuration updated"

    # Validate the updated configuration
    if tlp-stat -c &>/dev/null 2>&1; then
        success "TLP configuration validated"
    else
        error "TLP configuration validation failed"
        local backup
        backup=$(ls -t /etc/tlp.conf.backup.* 2>/dev/null | head -1)
        if [[ -n "$backup" ]]; then
            warn "Restoring from backup: $backup"
            sudo cp "$backup" /etc/tlp.conf
            sudo systemctl restart tlp 2>/dev/null || true
            success "Previous configuration restored"
        fi
    fi
    echo
    log "USB blacklist configuration added:"
    sudo grep -A 5 "# USB Device Blacklist" /etc/tlp.conf | sed 's/^/  /'

    echo
    log "Restarting TLP to apply changes..."
    sudo tlp start || warn "Could not restart TLP"
    success "TLP restarted"
    echo
}

configure_bluetooth_autoenable() {
    show_section_banner "BLUETOOTH AUTO-ENABLE CONFIGURATION"

    cat << EOF
${YELLOW}Description:${NC}
  Ensures Bluetooth automatically enables on boot, even if powered off previously.
  Prevents Bluetooth from staying disabled due to power management or rfkill blocks.

EOF

    if [[ ! -f /etc/bluetooth/main.conf ]]; then
        warn "Bluetooth configuration file not found at /etc/bluetooth/main.conf"
        return
    fi

    read -p "Configure Bluetooth auto-enable? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped Bluetooth auto-enable configuration"
        return
    fi

    log "Updating /etc/bluetooth/main.conf..."

    # Already correct — skip to avoid duplicating lines on re-run
    if sudo grep -q '^AutoEnable=true' /etc/bluetooth/main.conf 2>/dev/null; then
        success "AutoEnable=true is already set"
        return
    fi

    # Backup config
    sudo cp /etc/bluetooth/main.conf "/etc/bluetooth/main.conf.backup.$(date +%s)" || warn "Could not backup main.conf"

    # Check if [Policy] section exists
    if sudo grep -q '^\[Policy\]' /etc/bluetooth/main.conf; then
        log "Found [Policy] section - updating AutoEnable setting..."
        # Comment out any existing AutoEnable line, then insert after [Policy]
        sudo sed -i '/^#*AutoEnable=/s/^/#/' /etc/bluetooth/main.conf
        sudo sed -i '0,/^\[Policy\]/{ /^\[Policy\]/a AutoEnable=true
}' /etc/bluetooth/main.conf
    else
        log "Adding [Policy] section with AutoEnable..."
        printf '\n[Policy]\nAutoEnable=true\n' | sudo tee -a /etc/bluetooth/main.conf > /dev/null
    fi

    # Verify the setting
    local autoenable_value
    autoenable_value=$(sudo grep "^AutoEnable=" /etc/bluetooth/main.conf 2>/dev/null || echo "not found")

    if [[ "$autoenable_value" == "AutoEnable=true" ]]; then
        success "Bluetooth AutoEnable set to true"
    else
        warn "Could not verify Bluetooth AutoEnable setting"
    fi

    echo
    log "Restarting Bluetooth service..."
    sudo systemctl restart bluetooth || warn "Could not restart Bluetooth service"
    success "Bluetooth service restarted"
    echo
}

builtin_install_tlp() {
    show_section_banner "TLP POWER MANAGEMENT INSTALLATION"

    cat << EOF
${YELLOW}Description:${NC}
  TLP is an advanced power management tool that optimizes battery life and
  system performance. This installer will:

  • Install TLP and TLP-RDW (radio device wizard for Wi-Fi/Bluetooth on boot)
  • Remove conflicting power-profiles-daemon (if present)
  • Enable TLP service at boot (systemd/openrc)
  • Apply Bluetooth optimization fixes
  • Optionally install TLPUI (graphical interface)

${YELLOW}System:${NC} $DISTRO_ID
${YELLOW}Init System:${NC} $INIT_SYSTEM
${YELLOW}Package Manager:${NC} $PACKAGE_MANAGER

EOF

    read -p "Continue with TLP installation? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped TLP installation"
        return
    fi

    log "Starting TLP installation process..."
    echo

    # Step 1: Remove conflicting package
    log "Checking for conflicting power management packages..."
    if check_package "power-profiles-daemon"; then
        log "Found power-profiles-daemon - removing to avoid conflicts..."
        case "$PACKAGE_MANAGER" in
            pacman) sudo pacman -R --noconfirm power-profiles-daemon || warn "Failed to remove power-profiles-daemon" ;;
            apt)    sudo apt-get remove -y power-profiles-daemon    || warn "Failed to remove power-profiles-daemon" ;;
            dnf)    sudo dnf remove -y power-profiles-daemon        || warn "Failed to remove power-profiles-daemon" ;;
            zypper) sudo zypper remove -y power-profiles-daemon     || warn "Failed to remove power-profiles-daemon" ;;
            *)      warn "Cannot auto-remove power-profiles-daemon for $PACKAGE_MANAGER — please remove it manually" ;;
        esac
        success "Removed power-profiles-daemon"
    else
        debug "power-profiles-daemon not installed"
    fi

    # Stop and mask/disable the service to prevent conflicts (init system dependent)
    if [[ "$INIT_SYSTEM" == "systemd" ]]; then
        if systemctl is-active --quiet power-profiles-daemon.service 2>/dev/null; then
            log "Stopping power-profiles-daemon.service..."
            sudo systemctl stop power-profiles-daemon.service || warn "Failed to stop power-profiles-daemon.service"
            success "power-profiles-daemon.service stopped"
        fi

        if systemctl list-unit-files 2>/dev/null | grep -q "power-profiles-daemon.service"; then
            log "Masking power-profiles-daemon.service to prevent interference..."
            sudo systemctl mask power-profiles-daemon.service || warn "Failed to mask power-profiles-daemon.service"
            success "power-profiles-daemon.service masked"
        fi
    elif [[ "$INIT_SYSTEM" == "openrc" ]]; then
        if sudo rc-service power-profiles-daemon status &>/dev/null 2>&1; then
            log "Stopping power-profiles-daemon service..."
            sudo rc-service power-profiles-daemon stop || warn "Failed to stop power-profiles-daemon"
            success "power-profiles-daemon stopped"
        fi
        if sudo rc-update show 2>/dev/null | grep -q "power-profiles-daemon"; then
            log "Removing power-profiles-daemon from OpenRC runlevels..."
            sudo rc-update del power-profiles-daemon || warn "Failed to remove power-profiles-daemon from OpenRC"
            success "power-profiles-daemon removed from OpenRC"
        fi
    fi
    echo

    # Step 2: Install TLP and related tools
    log "Installing TLP packages (tlp, tlp-rdw)..."
    case "$PACKAGE_MANAGER" in
        pacman)
            sudo pacman -S --noconfirm tlp tlp-rdw || fatal "Failed to install TLP packages"
            ;;
        apt)
            sudo apt-get install -y tlp tlp-rdw || fatal "Failed to install TLP packages"
            ;;
        dnf)
            sudo dnf install -y tlp tlp-rdw || fatal "Failed to install TLP packages"
            ;;
        *)
            error "Automatic TLP installation not supported for $PACKAGE_MANAGER"
            error "Please install TLP manually and run this script again"
            press_any_key
            return
            ;;
    esac
    success "TLP packages installed"
    echo

    # Step 3: Enable TLP service (init system dependent)
    log "Enabling TLP service..."
    
    if [[ "$INIT_SYSTEM" == "systemd" ]]; then
        sudo systemctl enable --now tlp.service || fatal "Failed to enable TLP service"
        success "TLP service enabled and started (systemd)"
    elif [[ "$INIT_SYSTEM" == "openrc" ]]; then
        # Add tlp to default runlevel
        sudo rc-update add tlp || fatal "Failed to add tlp to OpenRC runlevel"
        # Start tlp service
        sudo rc-service tlp start || fatal "Failed to start tlp service"
        success "TLP service enabled and started (openrc)"
    else
        error "Unsupported init system: $INIT_SYSTEM"
        press_any_key
        return
    fi
    echo

    # Step 4: Verify installation
    log "Verifying TLP installation and configuration..."
    if tlp-stat -s &>/dev/null; then
        success "TLP installation verified"
        echo
        log "TLP Status:"
        tlp-stat -s | sed 's/^/  /'
    else
        warn "TLP verification failed - service may need restart"
    fi
    echo

    # Step 4a: Configure USB blacklist for Bluetooth and other devices
    read -p "Configure USB device blacklist (keep Bluetooth/devices alive)? [y/N]: " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        configure_tlp_usb_blacklist
    fi
    echo

    # Step 4b: Configure Bluetooth auto-enable
    read -p "Configure Bluetooth auto-enable on boot? [y/N]: " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        configure_bluetooth_autoenable
    fi
    echo

    # Step 6: Optional TLPUI installation
    read -p "Install TLPUI (graphical interface) for TLP? [y/N]: " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        log "Installing TLPUI..."

        case "$PACKAGE_MANAGER" in
            pacman)
                # Check if AUR helper exists
                if command -v yay &>/dev/null; then
                    log "Using yay for AUR access..."
                    yay -S --noconfirm tlp-ui 2>/dev/null && success "TLPUI installed via yay" || \
                        warn "Failed to install TLPUI via yay"
                elif command -v paru &>/dev/null; then
                    log "Using paru for AUR access..."
                    paru -S --noconfirm tlp-ui 2>/dev/null && success "TLPUI installed via paru" || \
                        warn "Failed to install TLPUI via paru"
                else
                    warn "No AUR helper (yay/paru) found — cannot install TLPUI"
                    echo "  Install an AUR helper first, then retry:"
                    echo "    git clone https://aur.archlinux.org/yay.git && cd yay && makepkg -si"
                    echo "  Then run: yay -S tlp-ui"
                fi
                ;;
            *)
                warn "TLPUI installation requires AUR/source access - not fully supported for $DISTRO_ID"
                warn "Try installing manually if available for your distro"
                ;;
        esac
    fi

    success "TLP installation and optimization complete!"

    log "Next steps:"
    echo "  1. Review TLP configuration: sudo nano /etc/tlp.conf"
    echo "  2. Check status: tlp-stat -s"
    echo "  3. Monitor thermal data: watch -n 1 sensors"
    echo "  4. For graphical control: tlpui (if installed)"
    
    if [[ "$INIT_SYSTEM" == "openrc" ]]; then
        echo "  5. Manage TLP on openrc: sudo rc-service tlp {start|stop|restart|status}"
    fi
    echo

    press_any_key
}



builtin_mullvad_headless_setup() {
    show_section_banner "MULLVAD VPN INSTALLATION & HEADLESS SETUP"

    cat << EOF
${YELLOW}Description:${NC}
  Installs Mullvad VPN and configures it for headless operation with auto-connect.

${YELLOW}This installer will:${NC}
  • Install Mullvad VPN for your distro (if not already installed)
  • Start the Mullvad daemon (systemd/openrc compatible)
  • Prompt you to log in with your account number
  • Enable auto-connect on boot
  • Establish and verify the VPN connection

${YELLOW}Requirements:${NC}
  • Valid Mullvad account number (format: XXXX-XXXX-XXXX-XXXX)
  • Internet connection
  • Supported init system (systemd or openrc)

EOF

    read -p "Continue with Mullvad installation & headless setup? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped Mullvad setup"
        return
    fi

    # Detect init system and delegate to appropriate function
    if [[ "$INIT_SYSTEM" == "openrc" ]]; then
        log "Detected OpenRC init system — delegating to OpenRC setup..."
        echo
        builtin_mullvad_openrc_setup
        return
    elif [[ "$INIT_SYSTEM" == "systemd" ]]; then
        log "Detected systemd init system — proceeding with systemd setup..."
        echo
    else
        error "Unsupported init system: $INIT_SYSTEM"
        error "Mullvad setup requires either systemd or openrc"
        press_any_key
        return
    fi

    log "Starting Mullvad VPN installation and headless setup..."
    echo

    # ── Step 1: Install Mullvad if not present ──────────────────────────────
    if command -v mullvad &>/dev/null; then
        success "Mullvad already installed: $(mullvad --version 2>/dev/null || echo 'version unknown')"
    else
        log "Installing Mullvad VPN for $DISTRO_ID ($PACKAGE_MANAGER)..."
        echo

        case "$PACKAGE_MANAGER" in
            pacman)
                # mullvad-vpn is in the official Arch extra repository
                sudo pacman -S --noconfirm mullvad-vpn \
                    || fatal "Failed to install mullvad-vpn"
                ;;
            apt)
                log "Adding Mullvad official apt repository..."
                # Key stored as plain .asc — no gpg --dearmor needed
                sudo curl -fsSLo /usr/share/keyrings/mullvad-keyring.asc \
                    https://repository.mullvad.net/deb/mullvad-keyring.asc \
                    || fatal "Failed to download Mullvad signing key"
                echo "deb [signed-by=/usr/share/keyrings/mullvad-keyring.asc arch=$(dpkg --print-architecture)] \
https://repository.mullvad.net/deb/stable stable main" \
                    | sudo tee /etc/apt/sources.list.d/mullvad.list > /dev/null
                sudo apt-get update -qq
                sudo apt-get install -y mullvad-vpn || fatal "Failed to install mullvad-vpn"
                ;;
            dnf)
                log "Adding Mullvad official dnf repository..."
                # addrepo with --from-repofile is the current correct syntax
                sudo dnf config-manager addrepo \
                    --from-repofile=https://repository.mullvad.net/rpm/stable/mullvad.repo \
                    || fatal "Failed to add Mullvad dnf repo"
                sudo dnf install -y mullvad-vpn || fatal "Failed to install mullvad-vpn"
                ;;
            zypper)
                # No official zypper repo — download the RPM directly
                log "Downloading Mullvad RPM for openSUSE..."
                local mullvad_rpm
                mullvad_rpm=$(mktemp --suffix=.rpm)
                wget -q --trust-server-names \
                    "https://mullvad.net/download/app/rpm/latest" \
                    -O "$mullvad_rpm" \
                    || { rm -f "$mullvad_rpm"; fatal "Failed to download Mullvad RPM"; }
                sudo zypper --non-interactive install "$mullvad_rpm" \
                    || { rm -f "$mullvad_rpm"; fatal "Failed to install Mullvad RPM"; }
                rm -f "$mullvad_rpm"
                ;;
            *)
                error "Unsupported package manager: $PACKAGE_MANAGER"
                warn "Install Mullvad manually from https://mullvad.net/download/vpn/linux then re-run this setup."
                press_any_key
                return
                ;;
        esac

        success "Mullvad VPN installed"
    fi
    echo

    # ── Step 2: Enable and start the Mullvad daemon ─────────────────────────
    log "Enabling Mullvad daemon..."
    sudo systemctl enable --now mullvad-daemon 2>/dev/null \
        || fatal "Failed to enable/start mullvad-daemon"

    # Wait for daemon socket to be ready (up to 30s via systemd, then CLI check)
    if ! systemctl is-active --quiet mullvad-daemon 2>/dev/null; then
        log "Waiting for mullvad-daemon to become active..."
        timeout 30 bash -c 'until systemctl is-active --quiet mullvad-daemon 2>/dev/null; do sleep 1; done' \
            || fatal "mullvad-daemon did not start in time"
    fi
    if ! mullvad status &>/dev/null; then
        fatal "Mullvad daemon is not responding"
    fi
    success "Mullvad daemon running"
    echo

    local MULLVAD_BIN
    MULLVAD_BIN=$(command -v mullvad)

    # ── Step 3: Account login ────────────────────────────────────────────────
    # Check positively for "Not logged in" — grep -qv would falsely pass on blank lines
    if "$MULLVAD_BIN" account get 2>/dev/null | grep -q "Not logged in"; then
        echo -e "${BOLD}${CYAN}Mullvad Account Login${NC}"
        echo
        echo "  Your account number can be found at https://mullvad.net/account"
        echo "  Format: XXXX-XXXX-XXXX-XXXX"
        echo

        local login_success=false
        local attempts=0
        while [[ $login_success == false && $attempts -lt 3 ]]; do
            read -p "  Enter account number (or 'q' to skip): " -r account_number
            echo

            if [[ "$account_number" == "q" || -z "$account_number" ]]; then
                warn "Skipped account login — headless setup cannot continue without login"
                press_any_key
                return
            fi

            if [[ ! "$account_number" =~ ^[0-9]{4}(-[0-9]{4}){3}$ ]]; then
                warn "Invalid format — expected XXXX-XXXX-XXXX-XXXX"
                attempts=$((attempts + 1))
                continue
            fi

            log "Logging in..."
            if "$MULLVAD_BIN" account login "$account_number" 2>&1; then
                if ! "$MULLVAD_BIN" account get 2>/dev/null | grep -q "Not logged in"; then
                    login_success=true
                    success "Logged in to Mullvad account:"
                    "$MULLVAD_BIN" account get 2>/dev/null | sed 's/^/  /'
                else
                    warn "Login command ran but account not verified — try again"
                fi
            else
                warn "Login failed — check your account number and try again"
            fi
            # Use arithmetic assignment — ((attempts++)) exits 1 when attempts=0 under set -e
            attempts=$((attempts + 1))
        done

        if [[ $login_success == false ]]; then
            error "Could not log in after $attempts attempts"
            press_any_key
            return
        fi
    else
        success "Already logged in to Mullvad account:"
        "$MULLVAD_BIN" account get 2>/dev/null | sed 's/^/  /'
    fi
    echo

    # ── Step 4: Enable auto-connect ─────────────────────────────────────────
    log "Enabling auto-connect on boot..."
    "$MULLVAD_BIN" auto-connect set on >/dev/null 2>&1 || warn "Could not enable auto-connect"
    success "Auto-connect enabled"
    echo

    # ── Step 5: Connect ──────────────────────────────────────────────────────
    log "Establishing VPN connection..."
    timeout 30 "$MULLVAD_BIN" connect --wait 2>/dev/null || true

    local attempt=0
    while [[ $attempt -lt 15 ]]; do
        sleep 1
        if "$MULLVAD_BIN" status 2>/dev/null | grep -iq "connected"; then
            success "VPN connected successfully"
            echo
            log "Current status:"
            "$MULLVAD_BIN" status | head -5 | sed 's/^/  /'
            break
        fi
        attempt=$((attempt + 1))
    done

    if [[ $attempt -eq 15 ]]; then
        warn "VPN connection may not be established yet — verify with: mullvad status"
    fi

    echo
    success "Mullvad headless setup complete!"
    log "Useful commands:"
    echo "  • Check status:        mullvad status"
    echo "  • View account info:   mullvad account get"
    echo "  • Disconnect:          mullvad disconnect"
    echo "  • Reconnect:           mullvad connect"
    echo
    press_any_key
}



builtin_mullvad_openrc_setup() {
    show_section_banner "MULLVAD VPN OPENRC CONFIGURATION"

    cat << EOF
${YELLOW}Description:${NC}
  Configures Mullvad VPN for systems using OpenRC init system.
  Sets up headless operation with auto-connect and auto-start on boot.

${YELLOW}This installer will:${NC}
  • Verify Mullvad VPN is installed
  • Enable mullvad-daemon service in OpenRC
  • Prompt you to log in with your account number
  • Configure auto-connect
  • Establish and verify the VPN connection

${YELLOW}Requirements:${NC}
  • Mullvad VPN package already installed
  • Valid Mullvad account number (format: XXXX-XXXX-XXXX-XXXX)
  • OpenRC init system
  • Internet connection

${YELLOW}Note:${NC}
  For full Mullvad installation, use the main 'Mullvad Headless Setup' option first.

EOF

    read -p "Continue with Mullvad OpenRC configuration? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped Mullvad OpenRC setup"
        return
    fi

    # ── Step 1: Verify Mullvad is installed ──────────────────────────────
    if ! command -v mullvad &>/dev/null; then
        error "Mullvad VPN is not installed"
        error "Please install Mullvad first, then configure OpenRC"
        echo
        log "To install Mullvad, use the main menu option: 'Essential Tools > Mullvad Headless Setup'"
        echo
        press_any_key
        return
    fi

    success "Mullvad already installed: $(mullvad --version 2>/dev/null || echo 'version unknown')"
    echo

    # ── Step 2: Check for OpenRC service script ──────────────────────────
    local openrc_service_dir="/etc/init.d"
    if [[ ! -d "$openrc_service_dir" ]]; then
        error "OpenRC service directory not found: $openrc_service_dir"
        warn "This system may not be using OpenRC, or it's not properly installed"
        press_any_key
        return
    fi

    log "Checking for mullvad-daemon OpenRC service script..."
    if [[ ! -f "$openrc_service_dir/mullvad-daemon" ]]; then
        error "OpenRC service script not found at $openrc_service_dir/mullvad-daemon"
        log "Attempting to symlink from systemd service..."
        
        # Try to create an OpenRC-compatible wrapper if it doesn't exist
        # Some systems may provide a compatibility layer
        if [[ -f /usr/lib/systemd/system-generators/openrc-generator ]]; then
            warn "Found OpenRC compatibility layer - it may auto-generate the service"
            log "Retrying service detection..."
            if ! rc-service mullvad-daemon status &>/dev/null 2>&1; then
                error "Could not verify mullvad-daemon service with OpenRC"
                warn "You may need to manually create an OpenRC service script"
                warn "Reference: https://wiki.gentoo.org/wiki/OpenRC"
                press_any_key
                return
            fi
        else
            error "Cannot auto-configure OpenRC service"
            log "Manual setup required. Create or install mullvad-daemon OpenRC service."
            press_any_key
            return
        fi
    else
        success "Found mullvad-daemon OpenRC service script"
    fi
    echo

    # ── Step 3: Enable and start the Mullvad daemon ─────────────────────
    log "Enabling mullvad-daemon service for OpenRC..."
    if ! sudo rc-update add mullvad-daemon 2>/dev/null; then
        warn "Failed to add mullvad-daemon to OpenRC runlevel"
        log "Attempting manual activation..."
        if ! sudo rc-service mullvad-daemon start 2>/dev/null; then
            error "Could not start mullvad-daemon service"
            press_any_key
            return
        fi
    fi

    # Start the service
    log "Starting mullvad-daemon service..."
    if ! sudo rc-service mullvad-daemon start 2>/dev/null; then
        error "Failed to start mullvad-daemon"
        press_any_key
        return
    fi

    # Wait for daemon to be ready
    log "Waiting for mullvad-daemon to become responsive..."
    local attempt=0
    while [[ $attempt -lt 30 ]]; do
        if mullvad status &>/dev/null; then
            success "Mullvad daemon is responding"
            break
        fi
        sleep 1
        attempt=$((attempt + 1))
    done

    if [[ $attempt -eq 30 ]]; then
        error "mullvad-daemon did not respond within 30 seconds"
        press_any_key
        return
    fi
    echo

    local MULLVAD_BIN
    MULLVAD_BIN=$(command -v mullvad)

    # ── Step 4: Account login ────────────────────────────────────────────
    if "$MULLVAD_BIN" account get 2>/dev/null | grep -q "Not logged in"; then
        echo -e "${BOLD}${CYAN}Mullvad Account Login${NC}"
        echo
        echo "  Your account number can be found at https://mullvad.net/account"
        echo "  Format: XXXX-XXXX-XXXX-XXXX"
        echo

        local login_success=false
        local attempts=0
        while [[ $login_success == false && $attempts -lt 3 ]]; do
            read -p "  Enter account number (or 'q' to skip): " -r account_number
            echo

            if [[ "$account_number" == "q" || -z "$account_number" ]]; then
                warn "Skipped account login — headless setup cannot continue without login"
                press_any_key
                return
            fi

            if [[ ! "$account_number" =~ ^[0-9]{4}(-[0-9]{4}){3}$ ]]; then
                warn "Invalid format — expected XXXX-XXXX-XXXX-XXXX"
                attempts=$((attempts + 1))
                continue
            fi

            log "Logging in..."
            if "$MULLVAD_BIN" account login "$account_number" 2>&1; then
                if ! "$MULLVAD_BIN" account get 2>/dev/null | grep -q "Not logged in"; then
                    login_success=true
                    success "Logged in to Mullvad account:"
                    "$MULLVAD_BIN" account get 2>/dev/null | sed 's/^/  /'
                else
                    warn "Login command ran but account not verified — try again"
                fi
            else
                warn "Login failed — check your account number and try again"
            fi
            attempts=$((attempts + 1))
        done

        if [[ $login_success == false ]]; then
            error "Could not log in after $attempts attempts"
            press_any_key
            return
        fi
    else
        success "Already logged in to Mullvad account:"
        "$MULLVAD_BIN" account get 2>/dev/null | sed 's/^/  /'
    fi
    echo

    # ── Step 5: Enable auto-connect ─────────────────────────────────────
    log "Enabling auto-connect on boot..."
    "$MULLVAD_BIN" auto-connect set on >/dev/null 2>&1 || warn "Could not enable auto-connect"
    success "Auto-connect enabled"
    echo

    # ── Step 6: Connect ──────────────────────────────────────────────────
    log "Establishing VPN connection..."
    timeout 30 "$MULLVAD_BIN" connect --wait 2>/dev/null || true

    local attempt=0
    while [[ $attempt -lt 15 ]]; do
        sleep 1
        if "$MULLVAD_BIN" status 2>/dev/null | grep -iq "connected"; then
            success "VPN connected successfully"
            echo
            log "Current status:"
            "$MULLVAD_BIN" status | head -5 | sed 's/^/  /'
            break
        fi
        attempt=$((attempt + 1))
    done

    if [[ $attempt -eq 15 ]]; then
        warn "VPN connection may not be established yet — verify with: mullvad status"
    fi

    echo
    
    # ── Step 7: Verify OpenRC configuration ──────────────────────────────
    log "Verifying OpenRC service configuration..."
    if sudo rc-service mullvad-daemon status &>/dev/null; then
        success "mullvad-daemon service is running"
    else
        warn "mullvad-daemon service status is unclear - check manually"
    fi
    echo

    success "Mullvad OpenRC configuration complete!"
    log "Useful commands:"
    echo "  • Check status:           mullvad status"
    echo "  • View account info:      mullvad account get"
    echo "  • Start daemon:           sudo rc-service mullvad-daemon start"
    echo "  • Stop daemon:            sudo rc-service mullvad-daemon stop"
    echo "  • Daemon status:          sudo rc-service mullvad-daemon status"
    echo "  • View daemon logs:       sudo rc-tail mullvad-daemon"
    echo
    press_any_key
}

builtin_install_omz_zsh_setup() {
    show_section_banner "OH MY ZSH + FZF-TAB + FASTFETCH SETUP"

    cat << EOF
${YELLOW}Description:${NC}
  Full Zsh environment powered by Oh My Zsh, with fzf fuzzy tab completions,
  fastfetch system info on launch, auto-suggestions, and syntax highlighting.

${YELLOW}This installer will:${NC}
  • Install Zsh, fzf, git, and fastfetch
  • Set Zsh as your default shell (chsh)
  • Install Oh My Zsh (unattended — no interactive shell spawn)
  • Clone fzf-tab, zsh-autosuggestions, and zsh-syntax-highlighting as OMZ plugins
  • Configure ~/.zshrc with the correct plugin load order
  • Optionally add fastfetch to terminal startup

${YELLOW}Plugin load order in .zshrc (enforced by OMZ):${NC}
  1. compinit            (handled automatically by Oh My Zsh)
  2. fzf-tab             (after compinit, before widget-wrapping plugins)
  3. zsh-autosuggestions
  4. zsh-syntax-highlighting

${YELLOW}Key bindings:${NC}
  • Tab    — fzf-tab fuzzy completion menu
  • Ctrl+R — fzf fuzzy history search
  • Ctrl+T — fzf fuzzy file search

${YELLOW}Requirements:${NC}
  • curl and git for OMZ installation
  • sudo access for package installation
  • Log out / back in after chsh to activate default shell

EOF

    read -p "Continue with Oh My Zsh + fzf-tab + fastfetch setup? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped Oh My Zsh setup"
        return
    fi

    log "Starting Oh My Zsh + fzf-tab + fastfetch setup..."
    echo

    # ── Step 1: Install base packages ──────────────────────────────────────
    log "Installing zsh, fzf, git, and fastfetch..."

    case "$PACKAGE_MANAGER" in
        pacman)
            sudo pacman -S --needed --noconfirm zsh fzf git fastfetch || \
                fatal "Failed to install required packages"
            ;;
        apt)
            # fastfetch is not in repos before Debian 13 / Ubuntu 24.04
            sudo apt-get install -y zsh fzf git || \
                fatal "Failed to install required packages"
            if apt-cache show fastfetch &>/dev/null 2>&1; then
                sudo apt-get install -y fastfetch || warn "Failed to install fastfetch"
            else
                warn "fastfetch not available in your apt repos (requires Debian 13+ / Ubuntu 24.04+)"
                warn "You can install it manually later from https://github.com/fastfetch-cli/fastfetch"
            fi
            ;;
        dnf)
            sudo dnf install -y zsh fzf git fastfetch || \
                fatal "Failed to install required packages"
            ;;
        zypper)
            sudo zypper install -y zsh fzf git fastfetch || \
                fatal "Failed to install required packages"
            ;;
        *)
            error "Automatic installation not supported for $PACKAGE_MANAGER"
            warn "Please install zsh, fzf, git, and fastfetch manually, then re-run"
            press_any_key
            return
            ;;
    esac

    success "Base packages installed"
    echo

    # ── Step 2: Set Zsh as default shell ──────────────────────────────────
    local zsh_path
    zsh_path="$(command -v zsh 2>/dev/null)" || fatal "zsh binary not found after install"

    if [[ "$SHELL" == "$zsh_path" ]]; then
        success "Zsh is already the default shell ($SHELL)"
    else
        log "Setting Zsh as default shell for $USER..."
        chsh -s "$zsh_path" || warn "chsh failed — set manually: chsh -s $zsh_path"
        success "Default shell set to $zsh_path"
        warn "Log out and back in (or reboot) for the shell change to take effect"
    fi
    echo

    # ── Step 3: Install Oh My Zsh (headless) ──────────────────────────────
    local omz_dir="$HOME/.oh-my-zsh"

    if [[ -d "$omz_dir/.git" ]]; then
        success "Oh My Zsh already installed at $omz_dir"
    else
        log "Installing Oh My Zsh (unattended — RUNZSH=no CHSH=no)..."
        # RUNZSH=no  — don't exec zsh after install (stays in current shell/script)
        # CHSH=no    — already handled above
        RUNZSH=no CHSH=no \
            sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" \
            || fatal "Oh My Zsh installation failed"
        success "Oh My Zsh installed"
    fi
    echo

    # ── Step 4: Clone external plugins into OMZ custom dir ────────────────
    local omz_custom="${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}"

    # fzf-tab (must load before zsh-autosuggestions — OMZ sources plugins in order)
    log "Setting up fzf-tab plugin..."
    local fzf_tab_dir="$omz_custom/plugins/fzf-tab"
    if [[ -d "$fzf_tab_dir/.git" ]]; then
        git -C "$fzf_tab_dir" pull --ff-only 2>/dev/null \
            || warn "Could not update fzf-tab (using existing version)"
        success "fzf-tab updated"
    else
        git clone --depth=1 https://github.com/Aloxaf/fzf-tab "$fzf_tab_dir" \
            || fatal "Failed to clone fzf-tab"
        success "fzf-tab cloned"
    fi

    # zsh-autosuggestions
    log "Setting up zsh-autosuggestions plugin..."
    local autosuggest_dir="$omz_custom/plugins/zsh-autosuggestions"
    if [[ -d "$autosuggest_dir/.git" ]]; then
        git -C "$autosuggest_dir" pull --ff-only 2>/dev/null \
            || warn "Could not update zsh-autosuggestions (using existing version)"
        success "zsh-autosuggestions updated"
    else
        git clone --depth=1 https://github.com/zsh-users/zsh-autosuggestions "$autosuggest_dir" \
            || fatal "Failed to clone zsh-autosuggestions"
        success "zsh-autosuggestions cloned"
    fi

    # zsh-syntax-highlighting
    log "Setting up zsh-syntax-highlighting plugin..."
    local syntax_hl_dir="$omz_custom/plugins/zsh-syntax-highlighting"
    if [[ -d "$syntax_hl_dir/.git" ]]; then
        git -C "$syntax_hl_dir" pull --ff-only 2>/dev/null \
            || warn "Could not update zsh-syntax-highlighting (using existing version)"
        success "zsh-syntax-highlighting updated"
    else
        git clone --depth=1 https://github.com/zsh-users/zsh-syntax-highlighting.git "$syntax_hl_dir" \
            || fatal "Failed to clone zsh-syntax-highlighting"
        success "zsh-syntax-highlighting cloned"
    fi
    echo

    # ── Step 5: Configure ~/.zshrc ────────────────────────────────────────
    log "Configuring ~/.zshrc..."

    local zshrc="$HOME/.zshrc"

    if grep -q "fzf-tab" "$zshrc" 2>/dev/null; then
        warn "fzf-tab already present in ~/.zshrc — skipping plugin block rewrite"
    else
        # OMZ installer creates ~/.zshrc with plugins=(git); update that line.
        # fzf-tab MUST appear before zsh-autosuggestions (widget load order).
        if grep -q "^plugins=" "$zshrc" 2>/dev/null; then
            sed -i 's/^plugins=(.*)/plugins=(git fzf-tab zsh-autosuggestions zsh-syntax-highlighting)/' "$zshrc"
            success "Updated plugins=() line in ~/.zshrc"
        else
            echo 'plugins=(git fzf-tab zsh-autosuggestions zsh-syntax-highlighting)' >> "$zshrc"
            success "Added plugins=() to ~/.zshrc"
        fi

        # Append fzf key bindings and fzf-tab recommended zstyles
        cat >> "$zshrc" << 'ZSHEXTRA'

# ── fzf key bindings (added by Sys Admin) ───────────────────────────────────
if [[ -f /usr/share/fzf/key-bindings.zsh ]]; then
    source /usr/share/fzf/key-bindings.zsh
elif command -v fzf &>/dev/null; then
    eval "$(fzf --zsh)"
fi
[[ -f /usr/share/fzf/completion.zsh ]] && source /usr/share/fzf/completion.zsh

# ── fzf-tab recommended config ───────────────────────────────────────────────
# disable sort when completing git checkout
zstyle ':completion:*:git-checkout:*' sort false
# set descriptions format to enable group support
zstyle ':completion:*:descriptions' format '[%d]'
# colorize filenames using LS_COLORS
zstyle ':completion:*' list-colors ${(s.:.)LS_COLORS}
# disable default completion menu so fzf-tab takes over
zstyle ':completion:*' menu no
# preview directory contents on cd completion
if command -v eza &>/dev/null; then
    zstyle ':fzf-tab:complete:cd:*' fzf-preview 'eza -1 --color=always $realpath'
else
    zstyle ':fzf-tab:complete:cd:*' fzf-preview 'ls --color=always $realpath'
fi
# switch groups using < and >
zstyle ':fzf-tab:*' switch-group '<' '>'

# ── auto-suggestion style ─────────────────────────────────────────────────────
ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=8'
ZSHEXTRA

        success "fzf key bindings and fzf-tab config added to ~/.zshrc"
    fi
    echo

    # ── Step 6: Optionally add fastfetch to startup ───────────────────────
    read -p "Add fastfetch to terminal startup? [y/N]: " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        if ! grep -q "^fastfetch" "$zshrc" 2>/dev/null; then
            {
                echo ""
                echo "# Show system info on terminal launch (added by Sys Admin)"
                echo "fastfetch"
            } >> "$zshrc"
            success "Added fastfetch to terminal startup"
        else
            warn "fastfetch already in ~/.zshrc"
        fi
    fi
    echo

    # ── Step 7: Verify ───────────────────────────────────────────────────
    log "Verifying installations..."

    command -v zsh       &>/dev/null && success "zsh:         $(zsh --version | cut -d' ' -f1-2)"        || warn "zsh: not found in PATH"
    command -v fzf       &>/dev/null && success "fzf:         $(fzf --version)"                          || warn "fzf: not found in PATH"
    command -v fastfetch &>/dev/null && success "fastfetch:   $(fastfetch --version 2>/dev/null | head -1)" || warn "fastfetch: not found in PATH"
    [[ -d "$omz_dir" ]]  && success "oh-my-zsh:   installed at $omz_dir"                                 || warn "oh-my-zsh: not found"
    [[ -f "$fzf_tab_dir/fzf-tab.plugin.zsh" ]] && success "fzf-tab:     plugin present"                 || warn "fzf-tab: plugin missing"

    echo
    success "Oh My Zsh + fzf-tab + fastfetch setup complete!"
    log "Next steps:"
    echo "  1. Log out and back in for the default shell change to apply"
    echo "  2. Open a new terminal — Oh My Zsh loads automatically"
    echo "  3. Tab for fzf-tab completions · Ctrl+R history · Ctrl+T file search"
    echo "  4. → or End to accept an auto-suggestion"
    echo
    log "Key paths:"
    echo "  • Config:       ~/.zshrc"
    echo "  • OMZ dir:      $omz_dir"
    echo "  • OMZ plugins:  $omz_custom/plugins/"
    echo

    press_any_key
}

builtin_install_essentials() {
    while true; do
        show_section_banner "TERMINAL & POWER TOOLS"

        cat << EOF
${YELLOW}Description:${NC}
  Tools for terminal enhancement, VPN configuration, and power management.

${YELLOW}Options:${NC}
  1) Oh My Zsh Setup (fastfetch + fzf-tab + auto-suggestions)
  2) Install & Configure TLP
  3) Mullvad Headless Setup (auto-detects init system)
  0) Back
EOF

        echo -n -e "${YELLOW}Select option:${NC} "
        read -r choice
        echo

        case "$choice" in
            1)
                builtin_install_omz_zsh_setup
                ;;
            2)
                builtin_install_tlp
                ;;
            3)
                builtin_mullvad_headless_setup
                ;;
            0)
                return
                ;;
            *)
                warn "Invalid selection"
                ;;
        esac
    done
}

builtin_privacy_optimization_menu() {
    while true; do
        show_section_banner "PRIVACY & OPTIMIZATION TOOLS"

        cat << EOF
${YELLOW}Description:${NC}
  Advanced tools for system optimization and privacy enhancement.

${YELLOW}Options:${NC}
  1) nohang - Intelligent OOM Prevention
  2) auto-cpufreq - Dynamic CPU Governor
  3) usbguard - USB Device Authorization
  4) kanshi - Display Profile Manager (Wayland)
  5) zram-generator - Compressed Swap
  6) interception-tools - Keyboard Remapping
  7) mat2 - Metadata Sanitizer
  0) Back
EOF

        echo -n -e "${YELLOW}Select option:${NC} "
        read -r choice
        echo

        case "$choice" in
            1) builtin_install_nohang ;;
            2) builtin_install_auto_cpufreq ;;
            3) builtin_install_usbguard ;;
            4) builtin_install_kanshi ;;
            5) builtin_install_zram_generator ;;
            6) builtin_install_interception_tools ;;
            7) builtin_install_mat2 ;;
            0) return ;;
            *) warn "Invalid selection" ;;
        esac
    done
}

builtin_install_nohang() {
    show_section_banner "NOHANG - INTELLIGENT OOM PREVENTION"

    cat << EOF
${YELLOW}Description:${NC}
  Prevents system lockups from out-of-memory conditions using dynamic heuristics.
  Monitors memory pressure trends and kills only truly problematic processes.

${YELLOW}Benefits:${NC}
  • Prevents browser/app crashes during heavy compilation
  • Smarter than earlyoom (uses predictive analysis)
  • Works seamlessly with TLP power management
  • Optional PSI (Pressure Stall Information) support on Linux 4.20+

EOF

    read -p "Install nohang? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped nohang installation"
        return
    fi

    log "Installing nohang..."
    case "$PACKAGE_MANAGER" in
        pacman)
            # nohang is only in AUR, requires AUR helper
            if command -v yay &>/dev/null; then
                log "Using yay to install nohang from AUR..."
                yay -S --noconfirm nohang-git 2>/dev/null && success "nohang installed via yay" || \
                    warn "Failed to install nohang via yay"
            elif command -v paru &>/dev/null; then
                log "Using paru to install nohang from AUR..."
                paru -S --noconfirm nohang-git 2>/dev/null && success "nohang installed via paru" || \
                    warn "Failed to install nohang via paru"
            else
                warn "nohang requires an AUR helper (yay or paru) for Arch Linux"
                echo "Install with: yay -S nohang-git  or  paru -S nohang-git"
                press_any_key
                return
            fi
            ;;
        apt)
            sudo apt-get update -qq
            sudo apt-get install -y nohang || fatal "Failed to install nohang"
            ;;
        dnf)
            # RHEL/Fedora - check EPEL repos
            sudo dnf install -y nohang 2>/dev/null || warn "nohang not in standard repos"
            warn "For RHEL 7/8, enable EPEL: sudo yum install epel-release"
            ;;
        zypper)
            sudo zypper install -y nohang || warn "Failed to install nohang"
            ;;
        *)
            warn "nohang installation not automated for $PACKAGE_MANAGER"
            echo "Install from source: https://github.com/hakavlad/nohang"
            press_any_key
            return
            ;;
    esac

    log "Enabling nohang service..."
    if sudo systemctl enable --now nohang-desktop 2>/dev/null; then
        success "nohang-desktop service enabled"
    elif sudo systemctl enable --now nohang 2>/dev/null; then
        success "nohang service enabled"
    else
        warn "Failed to enable nohang service - try manual: sudo systemctl enable --now nohang-desktop"
    fi
    echo

    log "Verifying installation..."
    nohang --version 2>/dev/null && success "nohang is ready" || warn "Could not verify nohang"
    echo
    log "Next steps:"
    echo "  • For desktop: sudo systemctl restart nohang-desktop"
    echo "  • For server: sudo systemctl restart nohang"
    echo "  • View logs: sudo journalctl -eu nohang-desktop"
    echo
    press_any_key
}

builtin_install_auto_cpufreq() {
    show_section_banner "AUTO-CPUFREQ - DYNAMIC CPU GOVERNOR"

    cat << EOF
${YELLOW}Description:${NC}
  Dynamically switches CPU governors based on battery/AC state and system load.
  Complements TLP by optimizing CPU behavior independently.

${YELLOW}Benefits:${NC}
  • Better responsiveness on battery
  • Automatic performance boost when plugged in
  • Reduces unnecessary CPU frequency scaling

EOF

    read -p "Install auto-cpufreq? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped auto-cpufreq installation"
        return
    fi

    log "Installing auto-cpufreq..."

    case "$PACKAGE_MANAGER" in
        pacman)
            # Check if AUR helper exists for Arch
            if command -v yay &>/dev/null; then
                log "Using yay to install auto-cpufreq from AUR..."
                yay -S --noconfirm auto-cpufreq 2>/dev/null && success "auto-cpufreq installed via yay" || \
                    warn "Failed to install auto-cpufreq via yay"
            elif command -v paru &>/dev/null; then
                log "Using paru to install auto-cpufreq from AUR..."
                paru -S --noconfirm auto-cpufreq 2>/dev/null && success "auto-cpufreq installed via paru" || \
                    warn "Failed to install auto-cpufreq via paru"
            else
                warn "No AUR helper found. Install yay or paru to get auto-cpufreq"
                echo "Manual install: yay -S auto-cpufreq"
                press_any_key
                return
            fi
            ;;
        apt|dnf|zypper)
            # auto-cpufreq is not in apt/dnf/zypper repos — use upstream installer
            log "auto-cpufreq is not in $PACKAGE_MANAGER repos — using upstream installer..."
            if ! command -v git &>/dev/null; then
                fatal "git is required to install auto-cpufreq but was not found"
            fi
            local _acf_tmp
            _acf_tmp=$(mktemp -d)
            trap 'rm -rf "$_acf_tmp"; cleanup' EXIT INT TERM HUP
            git clone --depth=1 https://github.com/AdnanHodzic/auto-cpufreq "$_acf_tmp/auto-cpufreq" \
                || { rm -rf "$_acf_tmp"; fatal "Failed to clone auto-cpufreq repository"; }
            sudo "$_acf_tmp/auto-cpufreq/auto-cpufreq-installer" \
                || { rm -rf "$_acf_tmp"; fatal "auto-cpufreq installer failed"; }
            rm -rf "$_acf_tmp"
            trap cleanup EXIT INT TERM HUP
            ;;
        *)
            warn "auto-cpufreq not supported for $PACKAGE_MANAGER"
            warn "Please install manually from: https://github.com/AdnanHodzic/auto-cpufreq"
            press_any_key
            return
            ;;
    esac

    echo

    # Enable auto-cpufreq service
    log "Configuring auto-cpufreq service..."
    if command -v auto-cpufreq &>/dev/null; then
        if sudo auto-cpufreq --install &>/dev/null; then
            success "auto-cpufreq service installed and enabled"
        else
            warn "Could not enable auto-cpufreq service - try manually: sudo auto-cpufreq --install"
        fi
    else
        error "auto-cpufreq command not found after installation"
        press_any_key
        return
    fi

    echo

    log "Checking auto-cpufreq turbo boost status..."
    if sudo auto-cpufreq --turbo=auto &>/dev/null; then
        log "Turbo boost set to auto mode"
    fi

    echo
    success "auto-cpufreq installation and configuration complete!"
    log "Verify with: sudo auto-cpufreq --status"
    echo
    press_any_key
}

builtin_install_usbguard() {
    show_section_banner "USBGUARD - USB DEVICE AUTHORIZATION"

    cat << EOF
${YELLOW}Description:${NC}
  Hardware-level security framework that blocks unauthorized USB devices.
  Prevents BadUSB attacks by requiring explicit approval for new devices.

${YELLOW}Benefits:${NC}
  • Protects against BadUSB attacks
  • Critical for security-conscious users
  • Whitelist-based authorization by default

${YELLOW}Warning:${NC}
  This will block all unknown USB devices. You'll need to authorize trusted ones.

EOF

    read -p "Install usbguard? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped usbguard installation"
        return
    fi

    log "Installing usbguard..."
    case "$PACKAGE_MANAGER" in
        pacman)
            sudo pacman -S --noconfirm usbguard || fatal "Failed to install usbguard"
            ;;
        apt)
            sudo apt-get update -qq
            sudo apt-get install -y usbguard || fatal "Failed to install usbguard"
            ;;
        dnf)
            sudo dnf install -y usbguard || fatal "Failed to install usbguard"
            ;;
        zypper)
            sudo zypper install -y usbguard || fatal "Failed to install usbguard"
            ;;
        *)
            press_any_key
            return
            ;;
    esac

    log "Generating USB policy from currently connected devices..."
    sudo usbguard generate-policy | sudo tee /etc/usbguard/rules.conf > /dev/null || \
        warn "Failed to generate USB policy"

    log "Enabling usbguard service..."
    sudo systemctl enable --now usbguard || warn "Failed to enable usbguard"
    success "usbguard installed and enabled"
    echo

    log "Authorized USB devices:"
    sudo usbguard list-devices --allowed | sed 's/^/  /' || warn "Could not list devices"
    press_any_key
}

builtin_install_kanshi() {
    show_section_banner "KANSHI - DYNAMIC DISPLAY CONFIGURATION"

    cat << EOF
${YELLOW}Description:${NC}
  Automatically manages display layouts when monitors/docks are connected.
  Essential for Wayland users with multiple displays.

${YELLOW}Benefits:${NC}
  • Automatic profile switching for docked/undocked states
  • Works with Sway, Hyprland, and Wayfire
  • Replaces xrandr functionality on Wayland
  • Equivalent to autorandr for Wayland

${YELLOW}Requirements:${NC}
  • Wayland compositor with wlr-output-management protocol support
  • Multiple displays or dock scenario
  • Requires manual profile setup

${YELLOW}Note:${NC}
  Repository has moved to SourceHut: https://sr.ht/~emersion/kanshi/

EOF

    read -p "Install kanshi? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped kanshi installation"
        return
    fi

    log "Installing kanshi..."
    case "$PACKAGE_MANAGER" in
        pacman)
            sudo pacman -S --noconfirm kanshi || warn "Failed to install kanshi from pacman"
            ;;
        apt)
            sudo apt-get update -qq
            sudo apt-get install -y kanshi || warn "Failed to install kanshi from apt"
            ;;
        dnf)
            sudo dnf install -y kanshi || warn "Failed to install kanshi from dnf"
            ;;
        zypper)
            sudo zypper install -y kanshi || warn "Failed to install kanshi from zypper"
            ;;
        *)
            warn "kanshi not available in $PACKAGE_MANAGER"
            echo "Build from source: https://sr.ht/~emersion/kanshi/"
            press_any_key
            return
            ;;
    esac

    log "Creating configuration directory..."
    mkdir -p ~/.config/kanshi

    success "kanshi installed"
    echo
    log "Next steps:"
    echo "  1. Edit ~/.config/kanshi/config with your display profiles"
    echo "  2. Enable with: systemctl --user enable --now kanshi"
    echo "  3. Monitor with: journalctl --user -u kanshi -f"
    echo "  4. Reference: man 5 kanshi (for config syntax)"
    echo
    press_any_key
}

builtin_install_zram_generator() {
    show_section_banner "ZRAM-GENERATOR - COMPRESSED SWAP"

    cat << EOF
${YELLOW}Description:${NC}
  Creates on-demand compressed swap in RAM instead of disk storage.
  Provides 2-3x effective RAM without SSD wear. systemd-native solution.

${YELLOW}Benefits:${NC}
  • No disk wear from swap operations
  • Faster than disk-based swap (2-3x effective RAM)
  • Critical for ≤8GB RAM systems or embedded systems
  • Automatic sizing based on available memory
  • Uses zstd compression by default (best ratio/speed tradeoff)

${YELLOW}Requirements:${NC}
  • systemd-based init (required for zram-generator)
  • zram kernel module (auto-loaded)

EOF

    read -p "Install zram-generator? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped zram-generator installation"
        return
    fi

    log "Installing zram-generator..."
    case "$PACKAGE_MANAGER" in
        pacman)
            sudo pacman -S --noconfirm zram-generator || warn "Failed to install zram-generator"
            ;;
        apt)
            sudo apt-get update -qq
            # Debian 12+ has systemd-zram-generator in official repos
            if sudo apt-get install -y systemd-zram-generator 2>/dev/null; then
                success "systemd-zram-generator installed"
            else
                warn "zram-generator not in standard repos (Debian 12+ required)"
                warn "For older Debian/Ubuntu, install from: https://debian.nabijaczleweli.xyz/"
                press_any_key
                return
            fi
            ;;
        dnf)
            sudo dnf install -y zram-generator-defaults || warn "Failed to install zram-generator"
            ;;
        zypper)
            sudo zypper install -y zram-generator || warn "Failed to install zram-generator"
            ;;
        *)
            warn "zram-generator not available in $PACKAGE_MANAGER"
            echo "Build from source: https://github.com/systemd/zram-generator"
            press_any_key
            return
            ;;
    esac

    log "Configuring zram with sensible defaults..."
    sudo mkdir -p /etc/systemd/zram-generator.conf.d

    cat << 'ZRAMCONF' | sudo tee /etc/systemd/zram-generator.conf.d/swap.conf > /dev/null
# zram-generator configuration for compressed swap
[zram0]
# Set size to minimum of (half RAM) or 4GB - adjust as needed
zram-size = min(ram / 2, 4096)
# Use zstd compression (best balance of speed/ratio)
compression-algorithm = zstd
# Higher priority ensures zram is used before disk swap
swap-priority = 100
ZRAMCONF

    log "Reloading systemd configuration..."
    sudo systemctl daemon-reload

    log "Starting zram swap..."
    if sudo systemctl start /dev/zram0 2>/dev/null; then
        success "zram0 device created and activated"
    else
        warn "Failed to create zram0 - may need: sudo modprobe zram"
    fi
    echo

    log "Verifying zram swap:"
    free -h | sed 's/^/  /'
    echo
    log "Check zram device status:"
    zramctl 2>/dev/null | sed 's/^/  /' || warn "zramctl not found"
    echo
    press_any_key
}

builtin_install_interception_tools() {
    show_section_banner "INTERCEPTION-TOOLS - KEYBOARD REMAPPING"

    cat << EOF
${YELLOW}Description:${NC}
  Low-level input remapping at the kernel/libinput layer, bypassing X/Wayland.
  Enables advanced remaps like CapsLock→Ctrl (conditional) or dual-function keys.

${YELLOW}Benefits:${NC}
  • Works on both X11 and Wayland compositors
  • Kernel-level interception (before desktop sees input)
  • Enables complex remaps (conditional key behavior, Colemak, etc.)
  • Perfect for ergonomic key remapping

${YELLOW}Requirements:${NC}
  • Manual YAML configuration for udevmon
  • systemd udev support
  • Optional plugins: dual-function-keys, space-cadet-shift, etc.

EOF

    read -p "Install interception-tools? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped interception-tools installation"
        return
    fi

    log "Installing interception-tools..."
    case "$PACKAGE_MANAGER" in
        pacman)
            # interception-tools is in the official extra repo
            sudo pacman -S --noconfirm interception-tools || warn "Failed to install interception-tools"
            ;;
        apt)
            sudo apt-get update -qq
            sudo apt-get install -y interception-tools || warn "Failed to install interception-tools"
            ;;
        dnf)
            sudo dnf install -y interception-tools || warn "Failed to install interception-tools"
            ;;
        zypper)
            sudo zypper install -y interception-tools || warn "Failed to install interception-tools"
            ;;
        *)
            warn "interception-tools not available in $PACKAGE_MANAGER"
            echo "Build from source: https://gitlab.com/interception-tools/interception-tools"
            press_any_key
            return
            ;;
    esac

    log "Creating configuration directory..."
    sudo mkdir -p /etc/interception/udevmon.d

    success "interception-tools installed"
    echo
    log "Next steps:"
    echo "  1. Create udevmon YAML config: /etc/interception/udevmon.d/udevmon.yaml"
    echo "  2. Enable service: sudo systemctl enable --now udevmon"
    echo "  3. Install plugins (optional): yay -S interception-dual-function-keys"
    echo "  4. Check logs: sudo journalctl -u udevmon -f"
    echo
    log "Basic config example:"
    echo "---"
    echo "- CMD: intercept -g %{DEVNODE} | caps2esc | uinput -d %{DEVNODE}"
    echo "  DEVICE:"
    echo "    EVENTS:"
    echo "      EV_KEY: [KEY_CAPSLOCK, KEY_ESC]"
    echo "---"
    echo
    press_any_key
}

builtin_install_mat2() {
    show_section_banner "MAT2 - METADATA SANITIZER"

    cat << EOF
${YELLOW}Description:${NC}
  Removes hidden metadata from files before sharing (EXIF, author info, etc).
  Successor to MAT; prevents accidental privacy leaks in documents/photos.

${YELLOW}Supported formats:${NC}
  • Images: JPEG, PNG, GIF, TIFF, WebP
  • Documents: PDF, LibreOffice, MS Office
  • Audio: MP3, FLAC, OGG, WAV
  • Archives: ZIP, TAR, 7z
  • And more...

${YELLOW}Benefits:${NC}
  • Strips EXIF GPS/camera data from photos
  • Removes author/creation info from documents
  • CLI tool with optional GUI integration
  • File manager integration available

${YELLOW}Use cases:${NC}
  • Before sharing photos to social media
  • Sanitizing sensitive documents
  • Privacy-preserving file sharing

EOF

    read -p "Install mat2? [y/N]: " -n 1 -r
    echo
    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
        warn "Skipped mat2 installation"
        return
    fi

    log "Installing mat2..."
    case "$PACKAGE_MANAGER" in
        pacman)
            sudo pacman -S --noconfirm mat2 || warn "Failed to install mat2 from pacman"
            ;;
        apt)
            sudo apt-get update -qq
            sudo apt-get install -y mat2 || warn "Failed to install mat2 from apt"
            ;;
        dnf)
            sudo dnf install -y mat2 || warn "Failed to install mat2 from dnf"
            ;;
        zypper)
            sudo zypper install -y mat2 || warn "Failed to install mat2 from zypper"
            ;;
        *)
            warn "mat2 not available in $PACKAGE_MANAGER"
            echo "Alternative: pip install mat2  (requires python3-pip)"
            press_any_key
            return
            ;;
    esac

    success "mat2 installed"
    echo
    log "Quick start:"
    echo "  • Show metadata: mat2 --show file.jpg"
    echo "  • Sanitize (in-place): mat2 --inplace file.jpg"
    echo "  • Create sanitized copy: mat2 file.jpg"
    echo "  • Check supported types: mat2 --list-unsupported"
    echo "  • Help: mat2 --help"
    echo
    log "Example workflow:"
    echo "  mat2 --show photo.jpg  # Review metadata to remove"
    echo "  mat2 photo.jpg         # Creates photo.cleaned.jpg"
    echo
    press_any_key
}

builtin_system_info() {
    show_section_banner "SYSTEM INFORMATION"

    echo -e "${BOLD}Operating System:${NC}"
    if [[ -f /etc/os-release ]]; then
        cat /etc/os-release | grep -E "^(NAME|VERSION|ID|VERSION_ID)=" | sed 's/^/  /'
    fi
    echo

    echo -e "${BOLD}Kernel:${NC}"
    echo "  $(uname -sr)"
    echo

    echo -e "${BOLD}Architecture:${NC}"
    echo "  $(uname -m)"
    echo

    echo -e "${BOLD}CPU:${NC}"
    local cpu_model cpu_cores
    cpu_model=$(grep "model name" /proc/cpuinfo | head -1 | cut -d: -f2 | xargs)
    cpu_cores=$(grep -c "^processor" /proc/cpuinfo)
    echo "  $cpu_model"
    echo "  Cores: $cpu_cores"
    echo

    echo -e "${BOLD}Memory:${NC}"
    free -h | sed 's/^/  /'
    echo

    echo -e "${BOLD}Disk Usage:${NC}"
    df -h / /home 2>/dev/null | sed 's/^/  /' || df -h / | sed 's/^/  /'
    echo

    echo -e "${BOLD}Uptime:${NC}"
    echo "  $(uptime -p)"
    echo

    press_any_key
}

builtin_view_logs() {
    while true; do
        show_section_banner "LOG FILE VIEWER"

        # Get all log files, sorted by modification time (newest first)
        # Note: -printf is GNU find only (fine for Linux; not portable to BSD/macOS)
        local -a log_files
        mapfile -t log_files < <(find "$LOG_DIR" -maxdepth 1 -type f -name "sys-admin-*.txt" -printf '%T@ %p\n' 2>/dev/null | sort -rn | cut -d' ' -f2-)

        if [[ ${#log_files[@]} -eq 0 ]]; then
            warn "No log files found in $LOG_DIR"
            echo
            press_any_key
            return
        fi

        echo -e "${YELLOW}Available log files:${NC}"
        echo

        local i
        for i in "${!log_files[@]}"; do
            local filename=$(basename "${log_files[$i]}")
            local filesize=$(du -h "${log_files[$i]}" | cut -f1)
            local modtime=$(stat -c "%y" "${log_files[$i]}" 2>/dev/null | cut -d' ' -f1-2)
            printf "  ${GREEN}%d)${NC} %-50s [${BLUE}%s${NC}] ${DIM}%s${NC}\n" $((i + 1)) "$filename" "$filesize" "$modtime"
        done

        echo
        echo -e "  ${GREEN}0)${NC} Back to Main Menu"
        echo
        echo -n -e "${YELLOW}Select a log file to view (or 0 to go back):${NC} "
        read -r choice
        echo

        if [[ "$choice" == "0" ]]; then
            return
        fi

        if [[ "$choice" =~ ^[0-9]+$ ]] && [[ $choice -gt 0 ]] && [[ $choice -le ${#log_files[@]} ]]; then
            local selected_log="${log_files[$((choice - 1))]}"
            if command -v nano &>/dev/null; then
                nano -v "$selected_log"
            elif command -v less &>/dev/null; then
                less "$selected_log"
            elif command -v more &>/dev/null; then
                more "$selected_log"
            else
                cat "$selected_log"
                press_any_key
            fi
        else
            warn "Invalid selection"
            sleep 1
        fi
    done
}

builtin_about() {
    show_section_banner "ABOUT"

    cat << EOF
${BOLD}${CYAN}Sys Admin Menu${NC}
${DIM}Version: $SCRIPT_VERSION${NC}

${YELLOW}Description:${NC}
  An interactive installation and configuration menu system
  with automatic distribution detection and built-in tools.

${YELLOW}Key Features:${NC}
  • Automatic Linux distribution detection (20+ distros)
  • Multi-distro package manager support
  • Comprehensive logging and error handling
  • Beautiful ASCII art interface
  • Organized tool categories

${YELLOW}Supported Distribution Families:${NC}
  • Arch Linux    (Arch, Manjaro, EndeavourOS, Garuda, Artix)
  • Debian        (Debian, Ubuntu, Mint, Pop!_OS, Zorin, Elementary)
  • Fedora        (Fedora, RHEL, CentOS, Rocky, AlmaLinux, Nobara)
  • SUSE          (openSUSE, SLES, Tumbleweed)
  • Others        (Gentoo, Void, Alpine, NixOS)

${YELLOW}Logging:${NC}
  Current log: ${CYAN}$LOG_FILE${NC}
  All logs: ${CYAN}$LOG_DIR${NC}

${YELLOW}Created by:${NC}
  Dana Davis

EOF

    press_any_key
}

# ============================================================================
# MAIN MENU
# ============================================================================

show_menu() {
    show_main_banner

    echo -e "${DIM}System: ${GREEN}$DISTRO_ID${DISTRO_VERSION:+ $DISTRO_VERSION}${DIM} | Family: ${GREEN}$DISTRO_FAMILY${DIM} | Package Manager: ${GREEN}$PACKAGE_MANAGER${NC}"
    echo
    draw_line "-" 80
    echo

    cat << EOF
${BOLD}${CYAN}MAIN MENU${NC}

  ${BOLD}Installation & Configuration${NC}
    ${GREEN}1)${NC} Essential Tools (TLP, Mullvad, Bluetooth)
    ${GREEN}2)${NC} Privacy & Optimization Tools

  ${BOLD}System & Information${NC}
    ${GREEN}3)${NC} System Update
    ${GREEN}4)${NC} View System Information
    ${GREEN}5)${NC} View Logs

  ${BOLD}Help${NC}
    ${GREEN}6)${NC} About
    ${GREEN}0)${NC} Exit

EOF

    echo -n -e "${YELLOW}Select option:${NC} "
}

menu_loop() {
    while true; do
        show_menu
        read -r choice
        echo

        case "$choice" in
            1)
                builtin_install_essentials
                ;;
            2)
                builtin_privacy_optimization_menu
                ;;
            3)
                builtin_system_update
                ;;
            4)
                builtin_system_info
                ;;
            5)
                builtin_view_logs
                ;;
            6)
                builtin_about
                ;;
            0)
                echo -e "${GREEN}Thank you for using Sys Admin!${NC}"
                echo -e "${DIM}Logs saved to: $LOG_FILE${NC}"
                exit 0
                ;;
            *)
                error "Invalid option: $choice"
                sleep 1
                ;;
        esac
    done
}

check_sudo() {
    if ! sudo -v &>/dev/null; then
        error "Sudo access required but not available"
        return 1
    fi
    # Keep sudo timestamp alive in the background for the duration of the script
    ( while kill -0 "$$" 2>/dev/null; do sudo -n true 2>/dev/null; sleep 55; done ) &
    sudo_keepalive_pid=$!
    disown "$sudo_keepalive_pid" 2>/dev/null || true
}

# ============================================================================
# MAIN EXECUTION
# ============================================================================

main() {
    # Parse arguments
    while [[ $# -gt 0 ]]; do
        case "$1" in
            --debug)
                DEBUG=1
                shift
                ;;
            --help|-h)
                cat << EOF
Usage: $0 [OPTIONS]

Universal Installation Menu - Linux system configuration tool

OPTIONS:
    --debug         Enable debug output
    --help, -h      Show this help message

ENVIRONMENT:
    DEBUG=1         Enable debug mode

DIRECTORIES:
    Logs:           $LOG_DIR

For more information, run the menu and select 'About'.
EOF
                exit 0
                ;;
            *)
                error "Unknown option: $1"
                exit 1
                ;;
        esac
    done

    # Setup logging
    setup_logging

    # Check if running as root (warn, don't require)
    if [[ $EUID -eq 0 ]]; then
        warn "Running as root. Some configuration tasks may require user privileges."
        warn "Consider running as regular user with sudo access."
        echo
    fi

    # Verify sudo access and keep credentials alive
    check_sudo || exit 1

    # Detect distribution
    detect_distro

    # Enter main menu loop
    menu_loop
}

# Run main function
main "$@"