dotfiles-public

ben/dotfiles-public

Fork 0

Commit Graph

Author	SHA1	Message	Date
bcherb2	4043787a58	fix: close the four known installer bugs (DU-H1, DU-H2, BUG-1, BUG-2) - DU-H1: flags are parsed wherever they sit, so `install --unattended` and `--unattended install` are the same run; any unknown flag, word, or subcommand exits 2 to stderr before a package manager is touched. - DU-H2: every download lands in one private mktemp -d (mode 700) workdir per run, is checked non-empty before sudo tar sees it, and an EXIT/INT/TERM trap cleans up. No fixed /tmp paths remain. - BUG-1: ^t is now toggle-shown — it ticks only the rows the active filter is showing, and @needs expansion stops at the first invasive row, so an invasive package can never be ticked off-screen. - BUG-2: ^t journals what it added, so a second ^t over the same shown set unticks exactly that set; the bind no longer clears the query. - lab: the type verb polls fzf's reported query to a deadline instead of a fixed sleep; marks_settled retries within its deadline. Suite 256/0 host, 214/0 docker (ubuntu:24.04), mutations 24/24 killed (six new mutants re-introduce each bug and all die), lab 6/6 green.	2026-08-22 13:25:21 -04:00
bcherb2	042320208e	test: seal the fake PATH instead of prepending it The old harness put .tests/fakebin at the front of $PATH, which fails OPEN: a package manager with no fake fell through to the real one, and an audit of this suite invoked the host's actual `brew`. The twelve one-line fakes are replaced by a single dispatcher every fake symlinks to, plus seal.sh, which builds the WHOLE of $PATH for a run — real binaries for the pure tools, fakes for anything that installs, downloads or needs root, and command-not-found for everything else. Runs go under `env -i` so they inherit nothing. Two audits ship with it: any `have`/`find_tool` probe the seal has never heard of is an error, and the four absolute paths find_tool probes are written to .shadowed so a test needing a tool to be genuinely absent can say so. The dispatcher also fails on demand (FAKE_FAIL), which is what makes the installers' failure paths reachable at all — the apt and npm one-at-a-time retries, note_fail, and cmd_install's non-zero exit had all been unreachable, and all three survived being deleted outright. _curl stands in for every remote the installer talks to and for nothing else: an unrecognised URL is a failed download, so a typo'd host shows up as the failure it would really be. The fzf fake records its argv, which is what makes the picker's bindings testable.	2026-08-21 22:34:30 -04:00
bcherb2	b487b0e855	feat: public dotfiles tier — no credential, no identity, one installer Fresh history. This is the repo a throwaway VM clones anonymously: it brings a machine to a working baseline and carries nothing that makes it mine. 56 files. 50 land in $HOME, 3 are chezmoi metadata, 2 are repo documentation, 1 is the manifest, and a 15-file test harness stays behind in .tests/. What did not travel, and why: encrypted_private_bws-token.age a real credential; age is dropped entirely .chezmoidata/bws.toml env-var -> secret-id map; belongs with the tier that can use it SECRETS.md documentation of the rules, not config finish-setup.sh.tmpl superseded by dotup nvim/init.lua.backup dead file dot_claude/, dot_codex/, 120 files of agent config, private tier dot_pi/** De-identified rather than dropped: .gitconfig [user], the GitHub ssh rewrite and both Gitea host rewrites are identity, not configuration. They move behind an [include] of ~/.config/git/config.local, which the private tier writes. Git treats a missing include as a no-op, so a public-only machine reads the file and stops. .zshrc the two gitea aliases carried a personal domain and a LAN IP. They move behind a guarded source of ~/.config/zsh/local.zsh, the sibling of the secrets.zsh seam phase 2 established. nvim a commented-out LM Studio endpoint naming a LAN address. ghostty a stale auto-generated header naming an absolute home directory. Newly captured, never tracked before: ~/.zshenv, ~/.config/gh/config.yml. The former sourced ~/.cargo/env unguarded, so every zsh on a machine without rustup printed an error -- the same shape as the unguarded oh-my-zsh source phase 2 fixed. It is guarded now. .chezmoiexternal.toml grows from one entry to six. oh-my-zsh, powerlevel10k, zsh-autosuggestions, zsh-ai and tpm were hand-installed and declared nowhere, which is why `chezmoi init --apply` on a clean box produced a .zshrc that broke the shell it configures. The theme and both plugins nest under .oh-my-zsh/custom/, which is what $ZSH_CUSTOM resolves to. dotup gains an install engine. It resolves each selected package to a channel (apt, brew, npm, uv, snap, deb, flatpak, tarball, script, builtin) through one function every consumer reads, probes apt-cache before batching so a name apt does not know moves to brew instead of failing all thirty, and retries individually if a batch still fails -- which earned its keep on the first real container run, where mermaid-cli's puppeteer dependency failed and the other twelve npm packages installed anyway. --unattended computes safe defaults fresh from the manifest rather than inheriting a state file, and refuses private and invasive rows outright even when a stale state file ticks them. The manifest gains @spec, a second directive kind alongside @needs, carrying the argument a channel needs but a package name cannot supply -- the scoped npm name, the flatpak app id, the .deb source. The TSV stays five columns wide. Three bugs the container runs found, all fixed here: * `apt install nodejs` gives you node WITHOUT npm on Ubuntu, so all thirteen npm packages failed on a fresh box. The manifest asks apt for both names. * A tool installed a moment ago is not on this process's PATH -- uv lands in ~/.local/bin, npm -g honours the ~/.npmrc prefix, linuxbrew is outside a non-login PATH. Resolved by looking in the places we just wrote to, never by exporting a modified PATH. * `A \|\| { B && C; }` is one \|\| list, so when `command -v sudo` failed the list failed and `set -e` killed dotup at load. On a non-root machine with no sudo it died before printing anything. There is a regression test. .zshenv and .p10k.zsh are marked private_. Both are shell code the login shell executes and both applied at 664, group-writable. Third occurrence of the class of bug phase 1 found on .pi/agent/auth.json and phase 2 found on .zshrc; the first one found on purpose rather than by accident. Verification: 81 assertions, 81/81 on this box and in ubuntu:24.04, ubuntu:22.04 and debian:12. The installer is driven against a directory of fake package managers that record what they were asked to do and install nothing, so the engine is exercised end to end without a package landing on the test machine. `gitleaks detect` over the full history and the working tree: no leaks found, with no allowlist and no .gitleaks.toml. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-17 00:24:41 -04:00

Author

SHA1

Message

Date

bcherb2

4043787a58

fix: close the four known installer bugs (DU-H1, DU-H2, BUG-1, BUG-2)

- DU-H1: flags are parsed wherever they sit, so `install --unattended`
  and `--unattended install` are the same run; any unknown flag, word,
  or subcommand exits 2 to stderr before a package manager is touched.
- DU-H2: every download lands in one private mktemp -d (mode 700)
  workdir per run, is checked non-empty before sudo tar sees it, and an
  EXIT/INT/TERM trap cleans up. No fixed /tmp paths remain.
- BUG-1: ^t is now toggle-shown — it ticks only the rows the active
  filter is showing, and @needs expansion stops at the first invasive
  row, so an invasive package can never be ticked off-screen.
- BUG-2: ^t journals what it added, so a second ^t over the same shown
  set unticks exactly that set; the bind no longer clears the query.
- lab: the type verb polls fzf's reported query to a deadline instead
  of a fixed sleep; marks_settled retries within its deadline.

Suite 256/0 host, 214/0 docker (ubuntu:24.04), mutations 24/24 killed
(six new mutants re-introduce each bug and all die), lab 6/6 green.

2026-08-22 13:25:21 -04:00

bcherb2

042320208e

test: seal the fake PATH instead of prepending it

The old harness put .tests/fakebin at the front of $PATH, which fails OPEN: a
package manager with no fake fell through to the real one, and an audit of this
suite invoked the host's actual `brew`. The twelve one-line fakes are replaced
by a single dispatcher every fake symlinks to, plus seal.sh, which builds the
WHOLE of $PATH for a run — real binaries for the pure tools, fakes for anything
that installs, downloads or needs root, and command-not-found for everything
else. Runs go under `env -i` so they inherit nothing.

Two audits ship with it: any `have`/`find_tool` probe the seal has never heard
of is an error, and the four absolute paths find_tool probes are written to
.shadowed so a test needing a tool to be genuinely absent can say so.

The dispatcher also fails on demand (FAKE_FAIL), which is what makes the
installers' failure paths reachable at all — the apt and npm one-at-a-time
retries, note_fail, and cmd_install's non-zero exit had all been unreachable,
and all three survived being deleted outright.

_curl stands in for every remote the installer talks to and for nothing else:
an unrecognised URL is a failed download, so a typo'd host shows up as the
failure it would really be. The fzf fake records its argv, which is what makes
the picker's bindings testable.

2026-08-21 22:34:30 -04:00

bcherb2

b487b0e855

feat: public dotfiles tier — no credential, no identity, one installer

Fresh history. This is the repo a throwaway VM clones anonymously: it brings a
machine to a working baseline and carries nothing that makes it mine.

56 files. 50 land in $HOME, 3 are chezmoi metadata, 2 are repo documentation,
1 is the manifest, and a 15-file test harness stays behind in .tests/.

What did not travel, and why:

  encrypted_private_bws-token.age   a real credential; age is dropped entirely
  .chezmoidata/bws.toml             env-var -> secret-id map; belongs with the
                                    tier that can use it
  SECRETS.md                        documentation of the rules, not config
  finish-setup.sh.tmpl              superseded by dotup
  nvim/init.lua.backup              dead file
  dot_claude/**, dot_codex/**,      120 files of agent config, private tier
  dot_pi/**

De-identified rather than dropped:

  .gitconfig   [user], the GitHub ssh rewrite and both Gitea host rewrites are
               identity, not configuration. They move behind an [include] of
               ~/.config/git/config.local, which the private tier writes. Git
               treats a missing include as a no-op, so a public-only machine
               reads the file and stops.
  .zshrc       the two gitea aliases carried a personal domain and a LAN IP.
               They move behind a guarded source of ~/.config/zsh/local.zsh,
               the sibling of the secrets.zsh seam phase 2 established.
  nvim         a commented-out LM Studio endpoint naming a LAN address.
  ghostty      a stale auto-generated header naming an absolute home directory.

Newly captured, never tracked before: ~/.zshenv, ~/.config/gh/config.yml. The
former sourced ~/.cargo/env unguarded, so every zsh on a machine without rustup
printed an error -- the same shape as the unguarded oh-my-zsh source phase 2
fixed. It is guarded now.

.chezmoiexternal.toml grows from one entry to six. oh-my-zsh, powerlevel10k,
zsh-autosuggestions, zsh-ai and tpm were hand-installed and declared nowhere,
which is why `chezmoi init --apply` on a clean box produced a .zshrc that broke
the shell it configures. The theme and both plugins nest under
.oh-my-zsh/custom/, which is what $ZSH_CUSTOM resolves to.

dotup gains an install engine. It resolves each selected package to a channel
(apt, brew, npm, uv, snap, deb, flatpak, tarball, script, builtin) through one
function every consumer reads, probes apt-cache before batching so a name apt
does not know moves to brew instead of failing all thirty, and retries
individually if a batch still fails -- which earned its keep on the first real
container run, where mermaid-cli's puppeteer dependency failed and the other
twelve npm packages installed anyway. --unattended computes safe defaults fresh
from the manifest rather than inheriting a state file, and refuses private and
invasive rows outright even when a stale state file ticks them.

The manifest gains @spec, a second directive kind alongside @needs, carrying the
argument a channel needs but a package name cannot supply -- the scoped npm
name, the flatpak app id, the .deb source. The TSV stays five columns wide.

Three bugs the container runs found, all fixed here:

  * `apt install nodejs` gives you node WITHOUT npm on Ubuntu, so all thirteen
    npm packages failed on a fresh box. The manifest asks apt for both names.
  * A tool installed a moment ago is not on this process's PATH -- uv lands in
    ~/.local/bin, npm -g honours the ~/.npmrc prefix, linuxbrew is outside a
    non-login PATH. Resolved by looking in the places we just wrote to, never by
    exporting a modified PATH.
  * `A || { B && C; }` is one || list, so when `command -v sudo` failed the list
    failed and `set -e` killed dotup at load. On a non-root machine with no
    sudo it died before printing anything. There is a regression test.

.zshenv and .p10k.zsh are marked private_. Both are shell code the login shell
executes and both applied at 664, group-writable. Third occurrence of the class
of bug phase 1 found on .pi/agent/auth.json and phase 2 found on .zshrc; the
first one found on purpose rather than by accident.

Verification: 81 assertions, 81/81 on this box and in ubuntu:24.04, ubuntu:22.04
and debian:12. The installer is driven against a directory of fake package
managers that record what they were asked to do and install nothing, so the
engine is exercised end to end without a package landing on the test machine.
`gitleaks detect` over the full history and the working tree: no leaks found,
with no allowlist and no .gitleaks.toml.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-17 00:24:41 -04:00

3 Commits