dual-gpu hardening & wireless robustness

- Protected apt repository writes across modules/repos.sh by adding `|| return 1` to `_write_deb822()` and `_write_classic()`, ensuring script continuation on failure instead of aborting under set -e.
- Added idempotent backup restoration in restore_previous_repos() with `sudo cp ... || true` and `sudo rm ... || true` to prevent fatal errors during repository recovery operations.
- Implemented rollback mechanism in migrate_to_branch() by wrapping _write_branch_sources() in a conditional check, restoring backup on failure and returning error code 1.
- Hardened firmware installation flow in modules/firmware.sh with `|| true` guards on all apt commands (broadcom-sta-dkms, network firmware packages, backports/stable paths), preventing set -e aborts during package management.
- Secured modprobe operations by adding `|| true` to wl module loading and blacklist file writes, ensuring wireless driver installation proceeds even if kernel module operations fail.
- Added GPU tools installation protection in _helpers.sh with `|| true` guard on vainfo command execution after nvtop installation completes successfully.
- Fixed NVIDIA Wayland configuration in modules/gpu/nvidia.sh by adding `|| return 1` to nvidia-wayland.conf tee operation, preventing silent failures when writing modprobe configuration files.
- Implemented network warning notification before Broadcom wireless module removal to alert users of potential SSH disconnection during WiFi driver transitions.
- Added broadcom blacklist file protection with `|| true` guard on modprobe.d/blacklist-broadcom.conf writes to prevent script termination on filesystem errors.
- Standardized error handling patterns across all firmware and GPU modules, replacing direct command execution with conditional wrappers that maintain script continuity under failure conditions.

modules/firmware.sh

@@ -207,7 +207,7 @@ _install_detected_firmware() {
     done
     if [ ${#to_install[@]} -gt 0 ]; then
         _run_cmd "Firmware" "sudo DEBIAN_FRONTEND=noninteractive apt install -y ${to_install[*]}" \
-            "Installing network firmware packages..."
+            "Installing network firmware packages..." || true
     fi
 }
 
@@ -247,7 +247,7 @@ _handle_wireless() {
         # --- Persist blacklist of conflicting modules ---
         local blacklist_conf="/etc/modprobe.d/blacklist-broadcom.conf"
         local blacklist_content="blacklist b43\nblacklist b43legacy\nblacklist brcmsmac\nblacklist bcma\nblacklist ssb"
-        echo -e "$blacklist_content" | sudo tee "$blacklist_conf" >/dev/null
+        echo -e "$blacklist_content" | sudo tee "$blacklist_conf" >/dev/null || true
 
         # --- Update initramfs and load module ---
         _run_cmd "Initramfs" "sudo update-initramfs -u" || true
@@ -266,7 +266,7 @@ _handle_wireless() {
         if $has_broadcom_bt; then
             echo -e "${YELLOW}[+] Broadcom WiFi+BT combo card detected.${NC}"
             sudo mkdir -p /etc/modprobe.d
-            printf 'softdep wl post: btusb\n' | sudo tee /etc/modprobe.d/broadcom-combo.conf >/dev/null
+            printf 'softdep wl post: btusb\n' | sudo tee /etc/modprobe.d/broadcom-combo.conf >/dev/null || true
             echo -e "${YELLOW}    A reboot may be required for Bluetooth support.${NC}"
         fi
 
@@ -291,8 +291,9 @@ _handle_wireless() {
             fi
         fi
 
+        _msg "Network Warning" "The script is about to unload current WiFi kernel modules to load the Broadcom driver.\n\nIf you are connected via SSH over WiFi, YOUR CONNECTION WILL DROP. Please reconnect after a few seconds."
         sudo modprobe -r b43 b43legacy b44 bcma brcmsmac brcmfmac ssb wl 2>/dev/null || true
-        sudo modprobe wl 2>/dev/null
+        sudo modprobe wl 2>/dev/null || true
 
         # --- Verificación de carga ---
         if lsmod | grep -q '^wl '; then
@@ -440,7 +441,7 @@ install_firmware() {
             local current_ver
             current_ver=$(dpkg -l "$fw_pkg" 2>/dev/null | awk '/^ii/{print $3}')
             if _confirm "Firmware" "firmware-linux-nonfree ${current_ver} already installed.\n\nUpgrade to backports version ${fw_bpo}?\n\nBackports often includes newer hardware support."; then
-                _run_cmd "Firmware" "sudo apt install -y -t ${DEBIAN_CODENAME}-backports $fw_pkg" "Upgrading firmware..."
+                _run_cmd "Firmware" "sudo apt install -y -t ${DEBIAN_CODENAME}-backports $fw_pkg" "Upgrading firmware..." || true
             fi
         else
             echo "$fw_pkg already installed."
@@ -457,15 +458,15 @@ install_firmware() {
             msg+="                     2025/2026: recent GPUs, processors, WiFi.\n\n"
             msg+="Choose version:"
             if _confirm_custom "Firmware" "$msg" "Backports" "Stable"; then
-                _run_cmd "Firmware" "sudo apt install -y -t ${DEBIAN_CODENAME}-backports $fw_pkg" "Installing firmware from backports..."
+                _run_cmd "Firmware" "sudo apt install -y -t ${DEBIAN_CODENAME}-backports $fw_pkg" "Installing firmware from backports..." || true
             else
-                _run_cmd "Firmware" "sudo apt install -y $fw_pkg" "Installing firmware from stable..."
+                _run_cmd "Firmware" "sudo apt install -y $fw_pkg" "Installing firmware from stable..." || true
             fi
         else
             msg+="  Version: ${fw_stable}\n\n"
             msg+="Install it?"
             if _confirm "Firmware" "$msg"; then
-                _run_cmd "Firmware" "sudo apt install -y $fw_pkg" "Installing firmware..."
+                _run_cmd "Firmware" "sudo apt install -y $fw_pkg" "Installing firmware..." || true
             fi
         fi
         echo -e "${GREEN}Base firmware installed.${NC}"

modules/gpu/_helpers.sh

@@ -172,7 +172,7 @@ offer_generic_tools() {
     local tool_pkgs
     tool_pkgs=$(pkg_versions nvtop vainfo)
     if _confirm "GPU Tools" "Install monitoring and info tools?\n\n${tool_pkgs}"; then
-        _run_cmd "GPU Tools" "sudo apt install -y nvtop vainfo" "Installing GPU tools..."
+        _run_cmd "GPU Tools" "sudo apt install -y nvtop vainfo" "Installing GPU tools..." || true
         vainfo
         _pause "vainfo output shown above."
     else

modules/gpu/nvidia.sh

@@ -19,7 +19,7 @@ _enable_cuda_repo() {
         # Método oficial NVIDIA: cuda-keyring (extrepo no configura
         # correctamente el repo en Trixie)
         if dpkg -s cuda-keyring &>/dev/null; then
-            return 0   # ya instalado → su .list ya existe
+            return 0 # ya instalado → su .list ya existe
         fi
         if ! wget -q "https://developer.download.nvidia.com/compute/cuda/repos/debian13/x86_64/cuda-keyring_1.1-1_all.deb" \
             -O /tmp/cuda-keyring.deb; then
@@ -135,7 +135,7 @@ _verify_nvidia_dkms_build() {
 # Returns: 0 if a version was chosen, 1 if the user cancelled
 # -------------------------------------------------------------------
 _is_cuda_repo_ready() {
-    [ -f /etc/apt/sources.list.d/extrepo_nvidia-cuda.sources ] || \
+    [ -f /etc/apt/sources.list.d/extrepo_nvidia-cuda.sources ] ||
         grep -qr 'developer.download.nvidia.com' /etc/apt/sources.list.d/ 2>/dev/null
 }
 
@@ -181,14 +181,14 @@ _configure_nvidia_wayland() {
 
     # ── Arquitectura: solo fbdev y mensaje de color ──
     case "$arch" in
-        kepler)
+    kepler)
-            color="${RED}"
+        color="${RED}"
-            msg="WARNING: Wayland not supported on Kepler. Use X11 (Xorg)."
+        msg="WARNING: Wayland not supported on Kepler. Use X11 (Xorg)."
-            ;;
+        ;;
-        maxwell|pascal)
+    maxwell | pascal)
-            color="${YELLOW}"
+        color="${YELLOW}"
-            msg="Wayland support on ${arch} is experimental. X11 recommended."
+        msg="Wayland support on ${arch} is experimental. X11 recommended."
-            ;;
+        ;;
     esac
 
     # ── Híbrida vs desktop: NVreg independiente de la arquitectura ──
@@ -200,13 +200,13 @@ _configure_nvidia_wayland() {
     else
         content="options nvidia NVreg_PreserveVideoMemoryAllocations=1"$'\n'
         case "$ver" in
-            590|595) content+="options nvidia NVreg_UseKernelSuspendNotifiers=1"$'\n' ;;
+        590 | 595) content+="options nvidia NVreg_UseKernelSuspendNotifiers=1"$'\n' ;;
         esac
         content+="options nvidia-drm modeset=1"$'\n'
         [ "$arch" != "kepler" ] && content+="options nvidia-drm fbdev=1"$'\n'
     fi
 
-    printf "%b" "$content" | sudo tee "$conf" >/dev/null
+    printf "%b" "$content" | sudo tee "$conf" >/dev/null || return 1
     echo -e "${color}${msg}${NC}"
 }
 
@@ -338,7 +338,7 @@ _install_nvidia_standard() {
     fam=$(_get_nvidia_arch_family)
     local kernel_pkg="nvidia-kernel-dkms"
     case "$fam" in
-        turing|ampere|ada|blackwell) kernel_pkg="nvidia-open-kernel-dkms" ;;
+    turing | ampere | ada | blackwell) kernel_pkg="nvidia-open-kernel-dkms" ;;
     esac
 
     # --- 2. PAQUETES — UN SOLO apt install ---
@@ -373,7 +373,7 @@ _install_nvidia_standard() {
 
     # Fix obligatorio para Debian 12 con módulo abierto
     if [ "$DEBIAN_VERSION" = "12" ] && [[ "$kernel_pkg" == *"open"* ]]; then
-        echo "options nvidia NVreg_OpenRmEnableUnsupportedGpus=1" | sudo tee /etc/modprobe.d/nvidia-open.conf > /dev/null
+        echo "options nvidia NVreg_OpenRmEnableUnsupportedGpus=1" | sudo tee /etc/modprobe.d/nvidia-open.conf >/dev/null
         echo "Applied required Open RM parameter for Debian 12."
     fi
 

modules/repos.sh

@@ -27,10 +27,10 @@ restore_previous_repos() {
         local rel="${f#/etc/apt/}"
         local backup_file="$REPO_BACKUP_DIR/$rel"
         if [ -f "$backup_file" ]; then
-            sudo cp "$backup_file" "$f"
+            sudo cp "$backup_file" "$f" || true
             found=true
         elif [ -f "$f" ]; then
-            sudo rm -f "$f"
+            sudo rm -f "$f" || true
             found=true
         fi
     done
@@ -103,7 +103,7 @@ _write_deb822() {
     if content_differs "$main_file" "$main_content"; then
         if _confirm "Deb822 Sources" "Write main deb822 configuration to ${main_file}?"; then
             sudo mkdir -p /etc/apt/sources.list.d
-            echo -e "$main_content" | sudo tee "$main_file" >/dev/null
+            echo -e "$main_content" | sudo tee "$main_file" >/dev/null || return 1
             echo "Wrote ${main_file}"
         else
             echo "Main repository configuration skipped."
@@ -199,7 +199,7 @@ _write_classic() {
 
     if content_differs "$main_file" "$main_content"; then
         if _confirm "Classic Sources" "Write main classic configuration to ${main_file}?"; then
-            echo -e "$main_content" | sudo tee "$main_file" >/dev/null
+            echo -e "$main_content" | sudo tee "$main_file" >/dev/null || return 1
             echo "Wrote ${main_file}"
         else
             echo "Main repository configuration skipped."

modules/repos/migrate.sh

@@ -64,7 +64,7 @@ _write_deb822_branch() {
     fi
 
     sudo mkdir -p /etc/apt/sources.list.d
-    echo -e "$main_content" | sudo tee "$main_file" > /dev/null
+    echo -e "$main_content" | sudo tee "$main_file" >/dev/null
     echo "Wrote $main_file"
 }
 
@@ -80,14 +80,14 @@ _write_classic_branch() {
         main_content+="deb https://security.debian.org/debian-security ${target}-security main contrib non-free non-free-firmware\n"
     fi
 
-    echo -e "$main_content" | sudo tee "$main_file" > /dev/null
+    echo -e "$main_content" | sudo tee "$main_file" >/dev/null
     echo "Wrote $main_file"
 }
 
 _branch_migration() {
     # ── Screen 1: Risk warning ──
     _msg_red "WARNING: Branch Migration" \
-"Migrating from Debian Stable to Testing or SID is a\n\
+        "Migrating from Debian Stable to Testing or SID is a\n\
 MAJOR change and CAN make your system UNBOOTABLE.\n\n\
 Risks include:\n\
   • NVIDIA / DKMS drivers may break\n\
@@ -125,7 +125,10 @@ so you can restore if things go wrong." 16 70
     branch=$(_inputbox "Target Branch" \
         "Type exactly TESTING or SID (case-sensitive):" 10 60 "")
 
-    [ -z "$branch" ] && { echo "Migration cancelled."; return; }
+    [ -z "$branch" ] && {
+        echo "Migration cancelled."
+        return
+    }
 
     if [ "$branch" != "TESTING" ] && [ "$branch" != "SID" ]; then
         _msg "Invalid Branch" "You typed: $branch\n\nExpected: TESTING or SID (exact, case-sensitive).\nAborting." 10 60
@@ -155,7 +158,11 @@ so you can restore if things go wrong." 16 70
     [ -f /etc/apt/sources.list ] && sudo rm -f /etc/apt/sources.list
 
     # 4d. Write new sources
-    _write_branch_sources "$target"
+    if ! _write_branch_sources "$target"; then
+        echo -e "${RED}[-]${NC} Failed to write new sources. Restoring backup..."
+        _restore_backup || true
+        return 1
+    fi
 
     # 4e. SID guardrails: install bug alerts before upgrade
     if [ "$target" = "sid" ]; then
@@ -170,7 +177,7 @@ so you can restore if things go wrong." 16 70
         echo -e "${RED}apt update failed. Restoring backup...${NC}"
         _restore_backup
         _msg_red "Migration Failed" \
-"apt update failed. Backup has been restored from:\n\
+            "apt update failed. Backup has been restored from:\n\
 $_MIGRATE_BACKUP\n\n\
 Your system should be back to its previous state.\n\
 Run 'sudo apt update' manually to verify." 12 70
@@ -193,7 +200,7 @@ Run 'sudo apt update' manually to verify." 12 70
 
     # ── Screen 5: Reboot reminder ──
     _msg "Migration Complete" \
-"System has been migrated to ${target}.\n\n\
+        "System has been migrated to ${target}.\n\n\
 Backup saved at:\n  $_MIGRATE_BACKUP\n\n\
 REBOOT your system.\nIf it fails to boot, restore the backup manually:\n\
   sudo tar xzf $_MIGRATE_BACKUP -C /\n  sudo apt update\n  sudo apt upgrade" 16 70