- Abort with a clear log_fatal when the up-front sudo -v fails, instead
of an unexplained errexit later on.
- Move the shelly bootstrap ahead of any gum use, and install gum from
pacman in its own non-fatal transaction: a repo set without gum or a
stale sync db must not take base-devel/git down with it. No -Sy (that
would be a partial upgrade); the gum safety net retries via shelly,
and gum is dropped from the shelly prerequisite list.
- run_step: spinner via gum spin when gum exists, plain otherwise. The
step's output is captured and replayed on failure through stdout, so
makepkg/git errors land in $LOG rather than only on the terminal.
- try_step: one helper for the run / "try it manually" hint /
record_failure blocks (7 copies). The hint is built from the command
that ran, so it cannot drift. makepkg now uses -D (pacman >= 7.0) so
the build step is a single command.
- Sudo keep-alive loop stops its own sleep from a TERM trap, replacing
the racy pkill -P in cleanup; its stderr stays out of the log.
Verified: bash -n + shellcheck clean; try_step/run_step and the loop's
shutdown exercised with stub commands. Not run end to end on Arch.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Route failures through log_error/log_fatal (gum log --level error/fatal
with kitchen timestamps and colour), falling back to plain echo before
the gum bootstrap. log_fatal guards against gum's fatal level exiting 1
under errexit. record_failure uses log_error; $REPORT keeps plain
colour-free lines for the gum pager.
- Fatal level on the four aborting errors (gum install failures, gum
required, fish-shell refusal), error level on the non-fatal headlines
and invalid menu option; the "run it manually" command blocks stay as
plain echo.
- Snapshot the package database (pacman, else rpm) before the first
install step and report the net delta in the INSTALL SUMMARY. apt-only
systems report nothing, by request.
- Ask for sudo once up front and refresh the timestamp in the background
(250s, sudo -n true only) so shelly/makepkg stay un-sudo'd and the user
is never re-prompted mid-run; the loop is killed by a cleanup EXIT trap
that also removes WORK_DIR.
- Replace the numbered text menu with gum choose, wrap sub-script runs in
gum spin, and add sudo -v checkpoints before each privileged menu step.
- Add an INSTALL SUMMARY block (log/report paths, failure count).
- Move the fish-shell refusal after the gum bootstrap so it can always
use gum confirm; drop the ERR trap and hand-rolled select_options now
that errexit + gum cover those paths.
First real run of tests/smoke.sh surfaced three issues:
- fish.sh: repo configs/ ships fisher.fish and nvm.fish functions, so the
new (previously always-broken) 'fisher install' hit fisher's own
conflict check and aborted. Now: check 'type -q fisher' / 'type -q nvm'
inside fish and only bootstrap what is actually missing.
- fish.sh: end-4 renamed hypr/hyprland/colors.conf to colors.lua and
moved hyprlock colors under hypr/hyprlock/ - the stale paths made the
old script abort on cp. Updated paths, warn-and-skip stays as the
safety net if upstream moves again.
- LazyVim.sh: same fisher conflict class in its fish branch - guard the
nvm.fish install with a 'type -q nvm' check.
- tests/smoke.sh: the zsh backup assertion was wrong (fresh container has
no .zshrc for run 1 to back up). Pre-seed a marker config instead and
assert both rotation (2 backups) and that neither run destroys the
original content.
Verified: tests/smoke.sh fish.sh zsh.sh -> PASS/PASS, bat.sh -> PASS;
pre-push hook green on all 9 scripts.
- hooks/pre-push: bash -n + shellcheck -S warning -e SC1090 on every
tracked *.sh; fails closed when shellcheck is missing, bypassable with
--no-verify; enable with 'git config core.hooksPath hooks' (documented)
- tests/smoke.sh: manual docker/podman Arch-container run of bat.sh,
zsh.sh and fish.sh with assertions (idempotent bat config, timestamped
zsh backups, fisher actually installed in fish); LazyVim.sh opt-in.
This catches the inverted-condition/quoting class shellcheck cannot.
fish.sh gains a SKIP_END4_SETUP=1 test hook to skip end-4's installer
- README: scripts table (documents installbeta.sh vs install.sh and why
SecureBoot.sh is not in the menu), apt full-upgrade note, development
section; claims audited against current behavior (gum wording already
correct, no whiptail/selection claims remain)
- remove untracked vendored gum.md (reference only, per decision)
- timestamped .zshrc backups (was: .zshrc.bak overwritten every run, so
only the latest pre-run state survived)
- only remove ~/.oh-my-zsh when it actually contains oh-my-zsh.sh; warn
and leave anything else alone (was: unguarded rm -rf)
- add --needed to the pacman prerequisite install
- drop the empty ~/.fzf/shell/key-bindings.zsh placeholder (nothing
sourced it; fzf integration comes from the oh-my-zsh plugin)
- LICENSE spelling in banners (zsh.sh, installbeta.sh)
- print a 'log out and back in' notice after usermod -aG docker (both
fresh-install and already-installed branches; previously missing)
- remove the unexplained sleep 10 in the already-installed docker branch
- remove 'echo "+ sleep 10" && sleep 10' fake-command lines in failure
branches (record_failure already reports the failure)
- affinity keeps its 10s read-the-instructions delay but announces it
honestly instead of echoing a fake '+ 10 sleep' command
- set -Eeuo pipefail at the top (was only enabled after the menu, so
package installs and shelly bootstrap ran unchecked); preamble audited
for guarded vs unguarded commands ([ -t 1 ] && ... became an if, clear
is now 'clear || true')
- error_handler now reports exit status, line number and the failing
command, and the ERR trap is installed after strict mode so preamble
failures abort instead of printing a message and continuing
- exit 1 when any step was recorded as failed (was: always exit 0)
- single STAMP shared by LOG and REPORT; both created via mktemp
(predictable /tmp log names + tee -a was the same symlink class)
- local script/config fallbacks resolved via BASH_SOURCE (SCRIPT_DIR),
not the caller's CWD; falls back to remote fetch when piped
- $? captured via rc=$? inside each failure branch (idempotent under
reordering) for all record_failure call sites
- ${1:-} for the flag check, ${SHELL:-} in the fish detection,
tty-guarded fish warning prompt
- mktemp -d workspace (trap-cleaned) for the shelly AUR clone, shelly toml
downloads, docker installer and affinity script - no more predictable
/tmp/shelly_install, /tmp/shelly-standard.toml, /tmp/shelly-aur.toml
- download get.docker.sh and AffinityLinuxInstaller.py with curl -fsSL to a
file instead of piping to sh/python3 (the python pipe was missing -f, so an
HTTP 404 body was executed as Python)
- plain numbered menu fallback when gum is unavailable (Fedora has neither
shelly nor apt, so gum was never installed and 'gum choose' failed with a
misleading 'User cancelled installation.')
- $? capture via rc=$? inside the failure branch (safe under reordering)
- swap the crossed branch tests (fish branch checked ~/.bashrc, bash branch
checked ~/.config/fish/config.fish - each never matched its shell)
- install fisher/nvm.fish via 'fish -c' instead of calling fisher from bash
- timestamped backups (nvim.bak-YYYYmmdd-HHMMSS) instead of rm -rf of all
*.bak dirs first - a re-run no longer destroys the original backup
- check git clone result and point at the preserved backup on failure
- load nvm by sourcing its init script (nvm is a function; 'command -v nvm'
never succeeded, so the whole block was dead code)
- guard nvm init sourcing under set +u, fall back to system nodejs
- idempotent rc appends (grep guard), tty-guarded Ctrl+C grace period
- set -euo pipefail with guarded/unguarded audit
- typos: prerequisites, secconds
- prerequisite condition tested fish (was inverted: 'zsh missing and
git/curl/fzf present', so fish was never installed on a working machine)
- run fisher bootstrap inside fish via 'fish -c' (was: 'curl | source' in
bash, which always failed with 'filename argument required')
- download fisher.fish with curl -fsSL to a temp file first (fail on HTTP error)
- resolve configs/ via BASH_SOURCE; when piped (curl | bash) fall back to
the end-4 clone instead of failing on relative paths from an arbitrary CWD
- clone dots-hyprland into mktemp -d, never into the caller's CWD; git -C
style usage so a failed pull can't strand the script's working directory
- set -euo pipefail from the top with a guarded/unguarded audit
- warn visibly that end-4 still runs with --force --skip-backup (kept per decision)
- mkdir -p before config copies; tty-guarded fish warning; ${1:-}
- set -euo pipefail with audit: every tolerated failure is guarded
- write --theme to bat's config file, not into the themes/ directory (was: append to a directory, failed silently)
- download and configure the same theme (Catppuccin Mocha; was: Macchiato downloaded, Mocha configured)
- preserve MANPAGER quoting via printf (was: collapsed to export MANPAGER=bat -plman, invalid when sourced)
- detect shell via $SHELL instead of $0 (was: always matched *) and reported 'Unsupported shell: bat.sh')
- fish branch appends fish syntax, no more exec of a mangled command string
- check pacman/apt bat install results (was: unchecked, continued on failure)
- idempotent appends (grep guard), tty-guarded fish warning
- remove broken rc-sourcing block (sourced .zshrc/config.fish from bash)
- set -euo pipefail and fix pacman --noconfirm typo (was -noconfirm)
- abort on non-UEFI systems (/sys/firmware/efi check)
- verify sbctl installed and sign targets exist before touching keys
- fix x84_64-efi typo, skip missing targets instead of failing silently
- require sbctl verify to pass before offering enrollment
- prompt y/N before enroll-keys with BIOS/USB recovery guidance
- gate success message on final sbctl verify, non-zero exit on failure
alvinlollo
alvinlollo