@sebastienrousseau/dotfiles 0.2.481 → 0.2.500

package/scripts/security/manage-secrets.sh

@@ -1,6 +1,34 @@
 #!/usr/bin/env bash
-# Secure Configuration Management Script
-# Helps manage environment variables and secrets securely
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Secure Configuration Management.
+##
+## Manages environment variables and secrets across local development.
+## Provides init, validate, rotate, and audit capabilities for credentials.
+##
+## # Usage
+## manage-secrets.sh init           # Create .env.local from template
+## manage-secrets.sh validate       # Check configuration integrity
+## manage-secrets.sh check          # Scan for hardcoded secrets
+## manage-secrets.sh rotate github  # Secret rotation guide
+## manage-secrets.sh clean          # Remove temporary files
+##
+## # Dependencies
+## - stat: Permission checking
+## - grep: Pattern matching
+## - find: File discovery
+##
+## # Platform Notes
+## - macOS: Uses BSD stat syntax
+## - Linux: Uses GNU stat syntax
+## - WSL: Works with Linux filesystem permissions
+##
+## # Security
+## - Creates .env.local with 600 permissions
+## - Automatically adds .env.local to .gitignore
+## - Never commits secrets to version control
+##
+## # Idempotency
+## Safe to run repeatedly. init requires --force to overwrite.
 
 set -euo pipefail
 
@@ -11,16 +39,10 @@ readonly REPO_ROOT
 readonly ENV_TEMPLATE="${REPO_ROOT}/.github/security-policies/environment-template.env"
 readonly ENV_LOCAL="${REPO_ROOT}/.env.local"
 
-# Color codes (respect NO_COLOR: https://no-color.org)
-if [[ -z "${NO_COLOR:-}" ]] && [[ -t 1 ]]; then
-  readonly RED='\033[0;31m'
-  readonly GREEN='\033[0;32m'
-  readonly YELLOW='\033[1;33m'
-  readonly BLUE='\033[0;34m'
-  readonly NC='\033[0m'
-else
-  readonly RED='' GREEN='' YELLOW='' BLUE='' NC=''
-fi
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "${SCRIPT_DIR}/../dot/lib/ui.sh"
+ui_init
 
 # Help text
 show_help() {
@@ -58,22 +80,11 @@ SECURITY NOTES:
 EOF
 }
 
-# Logging functions
-log_info() {
-  echo -e "${BLUE}[INFO]${NC} $*"
-}
-
-log_success() {
-  echo -e "${GREEN}[SUCCESS]${NC} $*"
-}
-
-log_warning() {
-  echo -e "${YELLOW}[WARNING]${NC} $*"
-}
-
-log_error() {
-  echo -e "${RED}[ERROR]${NC} $*"
-}
+# Logging functions — delegate to shared ui.sh
+log_info() { ui_info "$@"; }
+log_success() { ui_ok "$@"; }
+log_warning() { ui_warn "$@"; }
+log_error() { ui_err "$@"; }
 
 # Initialize environment configuration
 init_config() {
@@ -105,6 +116,7 @@ init_config() {
   log_info "Next steps:"
   echo "  1. Edit .env.local and configure required variables"
   echo "  2. Run '$0 validate' to check configuration"
+  # shellcheck disable=SC1091
   echo "  3. Source the file: source .env.local"
 
   # Add to .gitignore if not present
@@ -130,7 +142,7 @@ validate_config() {
 
   # Check file permissions
   local perms
-  perms=$(stat -c %a "$ENV_LOCAL" 2>/dev/null || stat -f %A "$ENV_LOCAL")
+  perms=$(stat -c %a "$ENV_LOCAL" 2>/dev/null || stat -f %OLp "$ENV_LOCAL")
   if [[ "$perms" != "600" ]]; then
     log_warning ".env.local has incorrect permissions ($perms). Should be 600."
     log_info "Fix with: chmod 600 $ENV_LOCAL"
@@ -139,6 +151,7 @@ validate_config() {
 
   # Source and validate environment
   # shellcheck source=/dev/null
+  # shellcheck disable=SC1091
   if source "$ENV_LOCAL" 2>/dev/null; then
     log_success ".env.local loads successfully"
   else

package/scripts/security/ssh-cert.sh

@@ -0,0 +1,203 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# shellcheck shell=bash
+set -euo pipefail
+
+# ssh-cert.sh — Short-lived SSH certificate management
+#
+# Supports step-ca (Smallstep) and ssh-keygen-based CA workflows.
+# Short-lived certificates reduce the blast radius of key compromise
+# by expiring automatically (default: 16 hours).
+#
+# Usage:
+#   dot ssh-cert issue [--ttl 16h] [--principal user]
+#   dot ssh-cert status
+#   dot ssh-cert revoke
+
+# ---------- configuration -------------------------------------------------- #
+
+SSH_DIR="${HOME}/.ssh"
+CERT_FILE="${SSH_DIR}/id_ed25519-cert.pub"
+KEY_FILE="${SSH_DIR}/id_ed25519"
+DEFAULT_TTL="${SSH_CERT_TTL:-16h}"
+DEFAULT_PRINCIPAL="${SSH_CERT_PRINCIPAL:-${USER}}"
+CA_URL="${SSH_CERT_CA_URL:-}"
+CA_PROVISIONER="${SSH_CERT_CA_PROVISIONER:-}"
+
+# ---------- helpers -------------------------------------------------------- #
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+ui_init
+
+info() { ui_info "ssh-cert" "$*"; }
+warn() { ui_warn "ssh-cert" "$*"; }
+error() {
+  ui_err "ssh-cert" "$*"
+  exit 1
+}
+
+check_key() {
+  if [[ ! -f "$KEY_FILE" ]]; then
+    error "SSH key not found at $KEY_FILE. Generate one with: ssh-keygen -t ed25519"
+  fi
+}
+
+# ---------- issue ---------------------------------------------------------- #
+
+cmd_issue() {
+  local ttl="$DEFAULT_TTL"
+  local principal="$DEFAULT_PRINCIPAL"
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --ttl)
+        ttl="$2"
+        shift 2
+        ;;
+      --principal)
+        principal="$2"
+        shift 2
+        ;;
+      *) error "Unknown option: $1" ;;
+    esac
+  done
+
+  check_key
+
+  # Method 1: step-ca (Smallstep) — preferred for production
+  if command -v step >/dev/null 2>&1 && [[ -n "$CA_URL" ]]; then
+    info "Requesting certificate from step-ca ($CA_URL)..."
+    local step_args=(ssh certificate "$principal" "$KEY_FILE"
+      --sign
+      --not-after "$ttl"
+      --ca-url "$CA_URL"
+      --force
+    )
+    if [[ -n "$CA_PROVISIONER" ]]; then
+      step_args+=(--provisioner "$CA_PROVISIONER")
+    fi
+    step "${step_args[@]}"
+    info "Certificate issued:"
+    step ssh inspect "$CERT_FILE"
+    return 0
+  fi
+
+  # Method 2: ssh-keygen with a local CA (for dev/testing)
+  local ca_key="${SSH_DIR}/ca_key"
+  if [[ ! -f "$ca_key" ]]; then
+    warn "No step-ca configured and no local CA key found."
+    echo ""
+    echo "To use short-lived SSH certificates, choose one of:"
+    echo ""
+    echo "  Option A: Smallstep step-ca (recommended for production)"
+    echo "    1. Install: brew install step / sudo pacman -S step-cli step-ca"
+    echo "    2. Initialize CA: step ca init --name 'My CA' --provisioner admin"
+    echo "    3. Start CA: step-ca \$(step path)/config/ca.json"
+    echo "    4. Configure: export SSH_CERT_CA_URL=https://ca.example.com"
+    echo "    5. Run: dot ssh-cert issue"
+    echo ""
+    echo "  Option B: Local CA key (for development/testing)"
+    echo "    1. Generate CA: ssh-keygen -t ed25519 -f ~/.ssh/ca_key -C 'local-ca'"
+    echo "    2. Run: dot ssh-cert issue"
+    echo ""
+    echo "  Environment variables:"
+    echo "    SSH_CERT_CA_URL         step-ca server URL"
+    echo "    SSH_CERT_CA_PROVISIONER step-ca provisioner name"
+    echo "    SSH_CERT_TTL            Certificate lifetime (default: 16h)"
+    echo "    SSH_CERT_PRINCIPAL      Certificate principal (default: \$USER)"
+    return 1
+  fi
+
+  info "Signing with local CA key ($ca_key)..."
+  info "TTL: $ttl, Principal: $principal"
+
+  # Parse TTL to seconds for validity
+  local validity="-${ttl}:+${ttl}"
+
+  ssh-keygen \
+    -s "$ca_key" \
+    -I "${principal}@$(hostname)-$(date +%s)" \
+    -n "$principal" \
+    -V "$validity" \
+    "${KEY_FILE}.pub"
+
+  info "Certificate issued:"
+  ssh-keygen -L -f "$CERT_FILE"
+  info "Expires automatically after $ttl"
+}
+
+# ---------- status --------------------------------------------------------- #
+
+cmd_status() {
+  if [[ ! -f "$CERT_FILE" ]]; then
+    info "No SSH certificate found at $CERT_FILE"
+    return 0
+  fi
+
+  info "Current certificate:"
+  ssh-keygen -L -f "$CERT_FILE"
+
+  # Check expiry
+  local valid_to
+  valid_to=$(ssh-keygen -L -f "$CERT_FILE" 2>/dev/null | grep "Valid:" | sed 's/.*to //')
+  if [[ -n "$valid_to" ]]; then
+    local expiry_epoch
+    expiry_epoch=$(date -d "$valid_to" +%s 2>/dev/null || date -j -f "%Y-%m-%dT%H:%M:%S" "$valid_to" +%s 2>/dev/null || echo 0)
+    local now_epoch
+    now_epoch=$(date +%s)
+    if ((expiry_epoch > 0 && expiry_epoch < now_epoch)); then
+      warn "Certificate has EXPIRED"
+      return 1
+    else
+      local remaining=$(((expiry_epoch - now_epoch) / 3600))
+      info "Certificate valid for ~${remaining}h"
+    fi
+  fi
+}
+
+# ---------- revoke --------------------------------------------------------- #
+
+cmd_revoke() {
+  if [[ ! -f "$CERT_FILE" ]]; then
+    info "No certificate to revoke"
+    return 0
+  fi
+
+  # Step-ca revocation
+  if command -v step >/dev/null 2>&1 && [[ -n "$CA_URL" ]]; then
+    info "Revoking certificate via step-ca..."
+    step ssh revoke "$CERT_FILE" --ca-url "$CA_URL" || true
+  fi
+
+  # Local removal
+  rm -f "$CERT_FILE"
+  info "Certificate removed: $CERT_FILE"
+}
+
+# ---------- main ----------------------------------------------------------- #
+
+subcommand="${1:-}"
+shift 2>/dev/null || true
+
+case "$subcommand" in
+  issue) cmd_issue "$@" ;;
+  status) cmd_status ;;
+  revoke) cmd_revoke ;;
+  *)
+    echo "Usage: dot ssh-cert <command>"
+    echo ""
+    echo "Commands:"
+    echo "  issue   [--ttl 16h] [--principal user]  Request a short-lived certificate"
+    echo "  status                                   Show current certificate status"
+    echo "  revoke                                   Revoke and remove certificate"
+    echo ""
+    echo "Environment:"
+    echo "  SSH_CERT_CA_URL          step-ca server URL (enables Smallstep mode)"
+    echo "  SSH_CERT_CA_PROVISIONER  step-ca provisioner name"
+    echo "  SSH_CERT_TTL             Certificate lifetime (default: 16h)"
+    echo "  SSH_CERT_PRINCIPAL       Certificate principal (default: \$USER)"
+    ;;
+esac

package/scripts/security/telemetry-kill.sh

@@ -1,28 +1,50 @@
-#!/bin/sh
-set -e
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
 
-if [ "${DOTFILES_TELEMETRY:-}" != "1" ]; then
-  echo "Telemetry script is disabled by default."
-  echo "Re-run with DOTFILES_TELEMETRY=1 to apply."
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+
+DRY_RUN=0
+for arg in "$@"; do
+  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
+done
+_run_cmd() {
+  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
+}
+
+ui_init
+ui_header "Telemetry"
+
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  ui_info "Mode" "dry-run (no changes will be made)"
+elif [ "${DOTFILES_TELEMETRY:-}" != "1" ]; then
+  ui_warn "Telemetry" "disabled by default"
+  ui_info "Re-run" "DOTFILES_TELEMETRY=1"
   exit 1
 fi
 
-case "$(uname -s)" in
-  Linux)
-    echo "Disabling Ubuntu crash reporting (whoopsie/apport)..."
-    sudo systemctl disable --now whoopsie 2>/dev/null || true
-    sudo systemctl disable --now apport 2>/dev/null || true
-    sudo systemctl mask apport 2>/dev/null || true
-    echo "Disabling popularity-contest (if present)..."
-    sudo systemctl disable --now popularity-contest 2>/dev/null || true
+case "$(dot_platform_id)" in
+  linux | wsl)
+    ui_info "Disabling" "Ubuntu crash reporting (whoopsie/apport)"
+    _run_cmd sudo systemctl disable --now whoopsie 2>/dev/null || true
+    _run_cmd sudo systemctl disable --now apport 2>/dev/null || true
+    _run_cmd sudo systemctl mask apport 2>/dev/null || true
+    ui_info "Disabling" "popularity-contest"
+    _run_cmd sudo systemctl disable --now popularity-contest 2>/dev/null || true
     ;;
-  Darwin)
-    echo "Disabling macOS analytics (manual confirmation may be required)."
-    sudo defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist AutoSubmit -bool false || true
-    sudo defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist ThirdPartyDataSubmit -bool false || true
+  macos)
+    ui_info "Disabling" "macOS analytics"
+    _run_cmd sudo defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist AutoSubmit -bool false || true
+    _run_cmd sudo defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist ThirdPartyDataSubmit -bool false || true
     ;;
   *)
-    echo "Unsupported OS for telemetry kill."
+    ui_err "Unsupported OS" "telemetry kill"
     exit 1
     ;;
 esac

package/scripts/security/usb-safety.sh

@@ -1,29 +1,51 @@
-#!/bin/sh
-set -e
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
 
-if [ "${DOTFILES_USB_SAFETY:-}" != "1" ]; then
-  echo "USB safety script is disabled by default."
-  echo "Re-run with DOTFILES_USB_SAFETY=1 to apply."
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+
+DRY_RUN=0
+for arg in "$@"; do
+  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
+done
+_run_cmd() {
+  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
+}
+
+ui_init
+ui_header "USB Safety"
+
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  ui_info "Mode" "dry-run (no changes will be made)"
+elif [ "${DOTFILES_USB_SAFETY:-}" != "1" ]; then
+  ui_warn "USB safety" "disabled by default"
+  ui_info "Re-run" "DOTFILES_USB_SAFETY=1"
   exit 1
 fi
 
-case "$(uname -s)" in
-  Linux)
+case "$(dot_platform_id)" in
+  linux | wsl)
     if command -v gsettings >/dev/null; then
-      echo "Disabling GNOME automount for removable media..."
-      gsettings set org.gnome.desktop.media-handling automount false || true
-      gsettings set org.gnome.desktop.media-handling automount-open false || true
+      ui_info "Disabling" "GNOME automount for removable media"
+      _run_cmd gsettings set org.gnome.desktop.media-handling automount false || true
+      _run_cmd gsettings set org.gnome.desktop.media-handling automount-open false || true
     else
-      echo "gsettings not found."
+      ui_err "gsettings" "not found"
       exit 1
     fi
     ;;
-  Darwin)
-    echo "macOS does not expose a simple CLI toggle for USB automount."
-    echo "Use System Settings > General > Login Items > External disks."
+  macos)
+    ui_info "macOS" "no CLI toggle for USB automount"
+    ui_info "Use" "System Settings > General > Login Items > External disks"
     ;;
   *)
-    echo "Unsupported OS for USB safety."
+    ui_err "Unsupported OS" "USB safety"
     exit 1
     ;;
 esac

package/scripts/theme/apply-gnome-theme.sh

@@ -1,10 +1,28 @@
-#!/bin/bash
-# GNOME Theme Applicator - Applies Catppuccin themes to GNOME desktop
-# Usage: apply-gnome-theme.sh <theme-name>
-
-set -e
-
-THEME_NAME="$1"
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Apply GNOME Theme — Apply Catppuccin themes to GNOME desktop.
+##
+## Configures GTK theme, icon theme, cursor theme, shell theme,
+## fonts, and wallpaper using gsettings.
+##
+## # Requirements
+## - gsettings: GNOME settings tool
+## - gnome-extensions (optional): For shell themes
+## - User Themes extension (optional): For custom shell themes
+##
+## # Usage
+## apply-gnome-theme.sh catppuccin-mocha     # Apply dark theme
+## apply-gnome-theme.sh catppuccin-latte     # Apply light theme
+## apply-gnome-theme.sh current              # Show current theme
+## apply-gnome-theme.sh backup               # Backup current settings
+##
+## # Platform Notes
+## - GNOME 42+: Full color-scheme support
+## - Older GNOME: Color scheme setting skipped
+
+set -euo pipefail
+
+THEME_NAME="${1:-}"
 
 if [ -z "$THEME_NAME" ]; then
   echo "Usage: $0 <theme-name>"
@@ -12,27 +30,28 @@ if [ -z "$THEME_NAME" ]; then
   exit 1
 fi
 
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m'
+# Colors for output (respect NO_COLOR: https://no-color.org)
+if [[ -z "${NO_COLOR:-}" ]] && [[ -t 1 ]]; then
+  RED='\033[0;31m' GREEN='\033[0;32m' YELLOW='\033[1;33m'
+  BLUE='\033[0;34m' NC='\033[0m'
+else
+  RED='' GREEN='' YELLOW='' BLUE='' NC=''
+fi
 
 log() {
-  echo -e "${BLUE}[GNOME]${NC} $1"
+  printf '%b\n' "${BLUE}[GNOME]${NC} $1"
 }
 
 warn() {
-  echo -e "${YELLOW}[WARN]${NC} $1"
+  printf '%b\n' "${YELLOW}[WARN]${NC} $1"
 }
 
 error() {
-  echo -e "${RED}[ERROR]${NC} $1"
+  printf '%b\n' "${RED}[ERROR]${NC} $1"
 }
 
 success() {
-  echo -e "${GREEN}[SUCCESS]${NC} $1"
+  printf '%b\n' "${GREEN}[SUCCESS]${NC} $1"
 }
 
 # Check if we're running GNOME
@@ -174,54 +193,66 @@ apply_catppuccin_theme() {
 # Function to apply wallpaper
 apply_wallpaper() {
   local theme="$1"
-  local wallpaper_path=""
+  local wallpaper_dir="${DOTFILES_WALLPAPER_DIR:-$HOME/Pictures/Wallpapers}"
+  local mode="light"
 
-  # Check for system wallpapers first
-  if [ -d "/usr/share/backgrounds/catppuccin" ]; then
-    case "$theme" in
-      catppuccin-latte)
-        wallpaper_path="/usr/share/backgrounds/catppuccin/cat_latte.png"
-        ;;
-      catppuccin-frappe)
-        wallpaper_path="/usr/share/backgrounds/catppuccin/cat_frappe.png"
-        ;;
-      catppuccin-macchiato)
-        wallpaper_path="/usr/share/backgrounds/catppuccin/cat_macchiato.png"
-        ;;
-      catppuccin-mocha)
-        wallpaper_path="/usr/share/backgrounds/catppuccin/cat_mocha.png"
-        ;;
-    esac
+  # Determine light/dark from theme name
+  case "$theme" in
+    *-latte) mode="light" ;;
+    *-frappe | *-macchiato | *-mocha) mode="dark" ;;
+    *-light*) mode="light" ;;
+    *-dark* | *-night* | *-storm* | *-moon*) mode="dark" ;;
+  esac
+
+  # Pick a random wallpaper matching the mode from curated collection
+  local wp=""
+  if [ -d "$wallpaper_dir" ]; then
+    wp="$(find "$wallpaper_dir" -maxdepth 1 -type f -iname "*-${mode}.jpg" 2>/dev/null | shuf -n 1 || true)"
   fi
 
-  # Fallback to user wallpapers
-  if [ ! -f "$wallpaper_path" ] && [ -d "$HOME/.local/share/backgrounds/catppuccin" ]; then
+  # Fallback: check Catppuccin system/user wallpapers
+  if [ -z "$wp" ]; then
+    local cat_flavor=""
     case "$theme" in
-      catppuccin-latte)
-        wallpaper_path="$HOME/.local/share/backgrounds/catppuccin/cat_latte.png"
-        ;;
-      catppuccin-frappe)
-        wallpaper_path="$HOME/.local/share/backgrounds/catppuccin/cat_frappe.png"
-        ;;
-      catppuccin-macchiato)
-        wallpaper_path="$HOME/.local/share/backgrounds/catppuccin/cat_macchiato.png"
-        ;;
-      catppuccin-mocha)
-        wallpaper_path="$HOME/.local/share/backgrounds/catppuccin/cat_mocha.png"
-        ;;
+      catppuccin-latte) cat_flavor="latte" ;;
+      catppuccin-frappe) cat_flavor="frappe" ;;
+      catppuccin-macchiato) cat_flavor="macchiato" ;;
+      catppuccin-mocha) cat_flavor="mocha" ;;
     esac
+    if [ -n "$cat_flavor" ]; then
+      for dir in /usr/share/backgrounds/catppuccin "$HOME/.local/share/backgrounds/catppuccin"; do
+        if [ -f "$dir/cat_${cat_flavor}.png" ]; then
+          wp="$dir/cat_${cat_flavor}.png"
+          break
+        fi
+      done
+    fi
+  fi
+
+  if [ -z "$wp" ]; then
+    warn "No ${mode} wallpapers found in $wallpaper_dir"
+    return
   fi
 
-  if [ -f "$wallpaper_path" ]; then
-    log "Setting wallpaper: $wallpaper_path"
-    gsettings set org.gnome.desktop.background picture-uri "file://$wallpaper_path"
-    gsettings set org.gnome.desktop.background picture-uri-dark "file://$wallpaper_path"
-    gsettings set org.gnome.desktop.screensaver picture-uri "file://$wallpaper_path"
-    success "Wallpaper set to Catppuccin theme wallpaper"
+  log "Setting wallpaper: $wp"
+
+  # Set both light and dark URIs if we have a pair
+  local base="${wp%-${mode}.jpg}"
+  local light_wp="${base}-light.jpg"
+  local dark_wp="${base}-dark.jpg"
+
+  if [ -f "$light_wp" ] && [ -f "$dark_wp" ]; then
+    gsettings set org.gnome.desktop.background picture-uri "file://${light_wp}"
+    gsettings set org.gnome.desktop.background picture-uri-dark "file://${dark_wp}"
+    gsettings set org.gnome.desktop.screensaver picture-uri "file://${light_wp}"
   else
-    warn "Catppuccin wallpaper not found for theme: $theme"
-    log "Install wallpapers with: $HOME/.dotfiles/scripts/theme/install-catppuccin-themes.sh wallpapers"
+    gsettings set org.gnome.desktop.background picture-uri "file://$wp"
+    gsettings set org.gnome.desktop.background picture-uri-dark "file://$wp"
+    gsettings set org.gnome.desktop.screensaver picture-uri "file://$wp"
   fi
+  gsettings set org.gnome.desktop.background picture-options "zoom"
+
+  success "Wallpaper set (${mode}): $(basename "$wp")"
 }
 
 # Function to backup current settings