- Extracted hardware detection logic from firmware.sh into new modules/hw_detect.sh. Declares shared arrays (PCI_NET_DEVS, USB_WIFI_DEVS, etc) and _detect_all_network_devices() function. The main script now sources hw_detect.sh immediately after utils.sh. firmware.sh retains only _DETECTED_FW_PKGS and _FW_PLAN_PKG_LINES plus installation logic — the detection loop is fully removed, eliminating the circular dependency with bluetooth.sh.
- Fixed interrupt safety in main script: removed pkill -f "apt.*install" and pkill -f "dpkg.*configure" from _on_interrupt(); updated exit message to "Temp files cleaned." Only the signal handler (trap _on_interrupt INT TERM) remains.
- Added strict URL validation to modules/gaming/heroic.sh and modules/gaming/tools.sh using regex ^https://[A-Za-z0-9./_-]+\.deb$ before passing $deb_url to _run_cmd. Blocks command substitution, non-https URLs, and path traversal attempts that could bypass shell quoting.
- Implemented real Bullseye Archive rewrite in modules/bullseye/legacy.sh: adds idempotency check (grep -q archive.debian.org && return 0), creates timestamped backup of /etc/apt/sources.list with sudo cp, writes exact archive Debian sources via sudo tee heredoc, and runs sudo apt-get update || true on failure.
- Added local scope to modules/bluetooth.sh variable service_enable_only=false before the conditional assignment, preventing state bleed from the previous global-only declaration.
- Applied safe array pattern (while IFS= read -r _pkg; do ...) across 32+ files in modules/extras/* and modules/bullseye/legacy.sh, replacing all vulnerable for pkg in $cleaned / for pkg in $install_list loops. Eliminates word-splitting and command-injection risks.
- Replaced the restrictive Broadcom firmware installation flow with a persistent, step-by-step process in modules/firmware.sh. Now installs dkms, wireless-tools, and linux-headers-amd64 separately, then applies blacklist configuration, updates initramfs, and loads conflicting modules properly.
- Fixed conky package name across system.sh and bullseye/extras.sh. Changed from "conky" to "conky-all" with corresponding state variable updates for correct installation via apt.
- Corrected broken GRUB sed command in modules/gpu.sh for AMD GCN support. Added grep guard to prevent duplicate parameter insertion and fixed regex pattern for proper cmdline modification.
- Added whiptail pre-flight check in debianito.sh. Auto-installs required TUI dependencies if missing before the main menu, preventing runtime failures.
- Fixed home directory path resolution bug in modules/sudo_config.sh. Replaced eval echo "~$USER" with getent passwd approach for reliable user home detection across SUDO_USER contexts.
- Implemented global lspci output caching across 18+ locations. Single cache population via _init_lspci_cache() before detect_gpu, all subsequent reads use LSPCI_OUTPUT variable to eliminate redundant hardware polling calls.
- Added apt update deduplication helper in modules/utils.sh. _ensure_apt_updated() with APT_UPDATED flag bypasses redundant package list refreshes across extras/, gaming/, firmware/, and desktop_display/ modules while preserving transactional rollback paths in repos.sh.
- Fixed STATE_REFRESHED logic in debianito.sh main_menu case statement. Added STATE_REFRESHED=true to branches 3, 5, 7, 9, 11, 12, and 13 that mutate system state, ensuring refresh_system_state() triggers correctly after configuration changes.
- Removed dead REPOS_CONFIGURED variable from debianito.sh and modules/repos.sh. Variable was written but never read, eliminated to clean up global namespace without affecting repository functionality.
- Refactored NVIDIA installation with robust DKMS verification (`_verify_nvidia_dkms_build`). Automatically detects build failures for the current kernel and repairs them via `dpkg-reconfigure`, ensuring modules compile against active kernels without manual intervention.
- Added Secure Boot detection (`_nvidia_secure_boot_enabled`) to warn users if the NVIDIA module is compiled but unsigned, preventing boot issues on systems with UEFI security enabled.
- Implemented `_configure_nvidia_wayland()` for Wayland support. Detects hybrid laptops (Optimus) vs desktops using DMI chassis types and battery presence. Configures `NVreg_PreserveVideoMemoryAllocations` only for desktops to avoid Optimus conflicts, and adds architecture-specific guards (e.g., Kepler warnings).
- Introduced version selection menu (`_show_nvidia_version_menu`). Users can select driver versions (470/535/550/590/595) based on Debian release. Parametrized CUDA repo installation for 590/595 with post-install DKMS branch verification.
- Fixed state inconsistency bugs in `NVIDIA_DRIVER_MODE`. Added guards to ensure configuration files are only written upon successful installation, preventing partial setups after failures (e.g., backports, CUDA repo).
- Improved hardware detection helpers (`_is_hybrid_laptop`, `_get_nvidia_arch_family`). Prevents false positives on multi-GPU desktops by verifying iGPU presence alongside dGPU.
- Updated Java/Minecraft support in `modules/extras/java.sh`. Added Temurin 25 ("Minecraft 26+") to the runtime selection menu and updated documentation.
- Enhanced utility robustness (`_run_cmd`, `_configure_lightdm`). Properly propagates exit codes from commands and handles failures gracefully (yellow warnings + skip) instead of crashing under `set -e`.
- Fixed script crashes from `whiptail` Cancel/Esc under `set -e`. Added `_menu()`, `_checklist()` and `_inputbox()` wrappers with `|| true` to prevent premature exits.
- Resolved startup failures by using defaults instead of relying on unset variables with `set -u`.
- Hardened sudoers management — `_validate_sudoers()` writes to temp file, validates with `visudo -cf`, only copies if successful.
- Replaced `eval` in `_run_cmd` with safer `bash -c` execution.
Swap Management Module (`modules/swap.sh`)
- New standalone module with 9 internal functions and `manage_swap()` entry point.
- Btrfs CoW detection — applies `chattr +C` before swapfile creation to prevent mkswap rejection on Btrfs.
- Dynamic swappiness configuration — reads current system value instead of hardcoding 60, pre-fills inputbox with existing setting.
- Uses `/run/lock/debianito-swap.lock` for early init compatibility (added as option 9 in main menu).
Repository & Branch Migration (`modules/repos/migrate.sh`)
- Handles branch migration from stable (11/12) to Testing or SID with 5-screen UX flow.
- Persistent backup system — creates timestamped tar.gz backups of `/etc/apt/sources.list*`, auto-restores on apt update failure.
- SID guardrails — installs `apt-listbugs` and `apt-listchanges` before upgrade to warn about critical bugs in unstable packages.
- Dynamic menu options based on Debian version (SID shows only 1-2-3 Exit, non-SID includes backports + branch migration).
- New `_components_enabled()` helper detects current contrib/non-free state.
Gaming Module Overhaul
- Unified gaming checklist — merged i386 toggle into single prompt with lazy evaluation instead of separate pre-check.
- Lazy 32-bit architecture enablement — only enables i386 when needed (steam/lutris/i386 selected) and installs graphics drivers if `need_32bit=true`.
- New `_install_nvidia_32bit()` helper with proper driver detection, version pinning, and legacy/tesla variant handling.
Heroic & OpenRGB Downloads
- Heroic — fetches latest release from GitHub API using `jq` to extract amd64.deb URL, validates with `dpkg-deb --info`.
- OpenRGB — downloads from Codeberg Gitea API with SHA256 verification when available, fallback to `dpkg-deb` validation.
- Dynamic codename detection — now detects Bookworm vs Trixie at runtime instead of hardcoded static values for .deb download URLs.
|Other Improvements
- Renumbered main menu: 8=ZRAM, 9=Swap Management, 10=Extras, 11=Boot Rescue, 12=Exit.
- Improved `detect_storage()` — excludes loop/CD-ROM devices via `lsblk -e 7,11`, explicitly skips zram, detects USB/SD via `/sys/block/$name/removable`.
- Standardized SCROLL_HINT across all files with centralized readonly variable.
- System Time (NTP)*: Overhauled `modules/utils.sh`. `check_system_time()` now warns if year < 2025 and enables NTP silently if off but valid. `sync_system_time()` conditionally installs/starts `systemd-timesyncd` and verifies synchronization via `timedatectl NTPSynchronized`.
- LightDM Configuration: Added `_configure_lightdm()` to ensure the user list is visible in the greeter. Installs `lightdm-gtk-greeter-settings` and creates an override config (`99-show-users.conf`) during startup without interrupting the flow.
- Wine Installation: Simplified Wine setup in `system.sh` and Bullseye `extras.sh`. Removed i386 multiarch logic; now installs only `wine64 fonts-wine`. Added post-install version verification to confirm successful deployment.
- Lutris Dependencies: Updated `install_lutris()` in `tools.sh` and `legacy.sh`. Now conditionally adds `wine32` only if the system supports i386 architectures, preventing dependency failures on 64-bit-only setups.
- Boot Rescue Module: Created new standalone `modules/rescue.sh`. Provides UEFI boot repair tools: Secure Boot refirm (shim + GRUB) and Initramfs regeneration for all kernels. Integrated into the main menu as a dedicated rescue section.
- update docs
- Implemented multi-layered WiFi detection logic in `utils.sh`. Added PCI class text grep, exact `lspci -d ::0280` matching for wireless devices, Broadcom vendor ID fallback (`14e4`), and USB discovery via `lsusb`. Improved `sysinfo.sh` fallback message to guide users toward the Firmware option.
- Added `_pause()` execution after `vainfo` outputs in `gpu/_helpers.sh` (`offer_generic_tools`) and `gpu/amd_intel.sh` (`offer_amd_tools`, `offer_intel_tools`). Ensures users can review hardware info before proceeding with tool installation.
- Refactored Java selection in `extras/java.sh`. Switched from single-option `--menu` to multi-select `--checklist`, enabling simultaneous Temurin JRE installations with all versions enabled by default and iterative installation logic.
- NVIDIA CUDA extrepo refactor in `modules/gpu/nvidia.sh`: removed unnecessary `i386_active` lines, updated warning to reference `v590 (unified metapackage)`, simplified installation from 18+10 versioned packages → `nvidia-driver-pinning-590 nvidia-driver firmware-nvidia-gsp`, eliminated `apt-mark hold` since pinning packages now handle it. DKMS verification and `NVIDIA_DRIVER_MODE="cuda-repo"` preserved.
- CUDA repo case fix in `modules/gaming.sh`: replaced silent bypass with detection of `nvidia-driver-libs:i386` v590 installation; if missing, prompts user confirmation before installing via active CUDA repo + pinning.
- Palemoon internet module overhaul (`modules/extras/internet/internet.sh`): removed deprecated `_enable_palemoon_repo()`, created new `install_palemoon()` with AVX2→AVX→SSE2 CPU detection from `/proc/cpuinfo`, proper `extrepo enable` call, and package installation.
- ProtonVPN module rewrite (`modules/extras/internet/internet.sh`): removed broken `_enable_protonvpn_repo()` that failed due to missing suite; created new `install_protonvpn()` using `stable` suite + `proton-vpn-gtk-app` package with proper validation.
- Java/Minecraft rename across `modules/gaming.sh` and `modules/extras/java.sh`: renamed `_install_gaming_java()` → `install_minecraft_java()`, updated menu title from "Java Runtimes for Gaming" to "Java Runtimes for Minecraft", changed whiptail tag from `"java-jre"` to `"java"`.
- RetroArch + 4 classic cores (`modules/gaming/tools.sh` and `.sh`): added RetroArch entry to gaming menu, new case handler in `gaming.sh`, updated installation command to include `libretro-mgba libretro-snes9x libretro-nestopia libretro-gambatte`, enhanced notice with emojis, core enumeration, DFSG warning, and wiki link.
- OnlyOffice server status (`modules/extras/office/office.sh`): added fallback message for slow or down OnlyOffice servers to improve user experience during installation.
- Full syntax validation: all modified files pass `bash -n` without errors; no residual references to old variables (`i386_active`, `590.48.01`) or functions remain.
- Documentation about Debian and the script is added to supplement important information.
- update README.md
- Created standalone modules/bluetooth.sh for `_install_bluetooth_stack()` with desktop-aware frontend selection (bluedevil/KDE, blueman/XFCE/other). Extracted from `firmware.sh`, reducing it from 438 to 369 lines.
- Added `detect_desktop_environment()` and `detect_audio_server()` functions in `utils.sh` with new globals `DESKTOP_ENV=""` and `AUDIO_SERVER=""`.
- New `found_active_wifi` flag detects Qualcomm Atheros AR9485 PCI chips without loaded firmware, displaying `(no driver — install firmware)` instead of silently disappearing. Auto-installs `firmware-atheros + firmware-linux-nonfree` after Firmware & Wireless Setup.
- New `is_nvidia_blackwell()` detects GPUs in ranges `0x2900–0x29BF` and `0x2B80–0x31FF`. Added `_enable_cuda_repo()` helper for extrepo-based CUDA installation with APT pinning. DKMS verification blocks added to all `_install_nvidia_*` functions.
- Standardized repository enablement across 7 modules using `_enable_*_repo()` helpers:
- `internet.sh`: Firefox/Floorp/LibreWolf, Pale Moon, Tailscale, Mullvad VPN/Browser, ProtonVPN
- `jellyfin.sh`, `programming.sh` (VSCodium), `java.sh` (Temurin)
- New `extras/office/office.sh`: OnlyOffice + LibreOffice with language detection
- The main script was reduced from 233 to 137 lines. Created new `modules/sysinfo.sh` (97 lines) for `_show_sysinfo()`. Source chain: `utils.sh → sysinfo.sh → sudo_config.sh → repos → firmware.sh → bluetooth.sh → gpu.sh → kernel.sh → gaming.sh → extras.sh → zram.sh → java.sh`.
- Renamed menu to `"Firmware, Wireless & Bluetooth"`. Translated NTP dialog (English), basic programs install message, and NVIDIA 32-bit legacy messages.
- Created dedicated `extras/java.sh` module for modular Temurin/Adoptium repository handling and isolated GPG key management.
- Implemented selective JRE/JDK installation paths: Gaming (Minecraft) vs Development environments with version control selectors.
- Enhanced user group membership logic (`_ensure_sudo_group`) to auto-configure administrative privileges on fresh installs.
- Introduced maintenance-friendly passwordless sudo for `apt`, `systemctl`, and shutdown commands via `/etc/sudoers.d/`.
- Added home directory ownership repair utility to fix root-owned files in user directories after improper `sudo` usage.
- Enabled visual password feedback (`pwfeedback`) toggle for enhanced terminal usability during authentication prompts.
- Refactored Debian 13/Trixie repository sourcing logic to ensure idempotency and prevent backports/duplicate sources conflicts.
- Updated Bullseye legacy modules (extras.sh, repos.sh) to exclude deprecated packages (`hx`, `vscodium`) and enforce Firefox ESR defaults.
- Cleaned repository configurations by removing obsolete `bullseye-updates` source entries to prevent dependency conflicts.
- Implemented NVTOP conditional detection logic ensuring display only on active Nvidia drivers or supported architectures (Trixie/Bookworm).
- Corrected `/modules/bullseye/extras.sh` menu mappings (Programming, Dev Tools) and verified package lists excluding incompatible tools (`hx`, `vscodium`).
- Integrated ClamAV security module with daemon state management and background scan execution flows in all Security menus.
- update README.md
stornic56