From 7a5284b15a893e94a444f7eb7aaf10298985fb15 Mon Sep 17 00:00:00 2001 From: Bernardo Magri Date: Thu, 9 Jul 2026 19:16:17 +0100 Subject: [PATCH] feat(menu,install): #50 one-liners + record #46 V2 install pass MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #50: Bluetooth menu row + handler self-gate on `command -v blueman-manager` (no-op when bluetooth is off, like Printers); Control Center rollback list /tmp/nomarchy-gens → mktemp; usbutils on the nomarchy-install PATH (fingerprint lsusb probe); export nomarchy-doctor/control-center/battery-notify as flake packages. Verified V0 (flake check) + V1 (packages, installer, HM generation build). Also records #46: the swap=0 + unattended-LUKS fail-closed contracts (208b8d4) V2-verified via a headless two-variant install — fail-closed exits before wipe with the disk blank; swap=0 installs with no @swap subvol and boots to a themed desktop. Both items removed from NEXT. Co-Authored-By: Claude Opus 4.8 --- agent/BACKLOG.md | 22 ------------ agent/JOURNAL.md | 34 +++++++++++++++++++ flake.nix | 5 +++ modules/home/rofi.nix | 7 +++- .../nomarchy-control-center.sh | 6 ++-- pkgs/nomarchy-install/default.nix | 3 +- 6 files changed, 51 insertions(+), 26 deletions(-) diff --git a/agent/BACKLOG.md b/agent/BACKLOG.md index 44c3178..3ec78c6 100644 --- a/agent/BACKLOG.md +++ b/agent/BACKLOG.md @@ -52,18 +52,6 @@ bash -n + shellcheck) + a real-hardware read-only smoke on the dev box. cover the new rows headlessly; pin the fwupd `get-updates` exit-code semantics (0 = updates) in that fake. Spec: docs/HARDWARE.md §10. -### 46. V2 verify: install swap=0 + unattended LUKS fail-closed (`208b8d4`) -Pure `nix-instantiate` on disko subvols passed V0; **full install path -not exercised**. VM agent with KVM: -1. Unattended install with `NOMARCHY_SWAP_GB=0` + LUKS passphrase — - assert no `/swap` (or empty policy) and no `@swap` surprise; system - boots. -2. Unattended **without** passphrase and **without** `NOMARCHY_NO_LUKS=1` - — must **fail** before wipe (fail-closed). -3. Optional: `NOMARCHY_NO_LUKS=1` + swap=2 still installs. Use - `tools/test-install.sh` variants / env flags; journal results; delete - item when green (or file NOW bugs on failure). - ### 14. Automated lock bumps — confirm the first real run Slices b+c shipped 2026-07-05 (`.gitea/workflows/bump.yml`): weekly schedule (Mon 05:17 UTC) + `workflow_dispatch` as the security @@ -114,16 +102,6 @@ Next slice: on hardware, run `hyprctl clients` while each is open, read the real `class`, then append rules. Also revisit whether blueman/s-c-p actually float once seen (regex tolerance for the `.…-wrapped` form). -### 50. Small code one-liners batch — V0/V1 (promoted 2026-07-09) -- Bluetooth menu row self-gate on `command -v blueman-manager` (`rofi.nix`) — - no-op when `nomarchy.system.bluetooth.enable = false`, like Printers. -- Control Center rollback list `/tmp/nomarchy-gens` → `mktemp` (predictable - world-writable path → multi-user race). -- `usbutils` on `nomarchy-install` PATH so the fingerprint `lsusb` probe works - (sysfs is the current fallback). -- Export overlay tools (doctor/control-center/battery-notify) as flake - `packages` (`nix build .#nomarchy-doctor`) — three lines in flake.nix. - ## LATER - **Wallpapers artifact split** (ROADMAP § Faster switches — decided, diff --git a/agent/JOURNAL.md b/agent/JOURNAL.md index 3fa8901..0951261 100644 --- a/agent/JOURNAL.md +++ b/agent/JOURNAL.md @@ -17,6 +17,40 @@ Template: --- +## 2026-07-09 — #46 V2 verify: install swap=0 + LUKS fail-closed (208b8d4) +- **Task:** NEXT #46 — exercise the full install path for the swap=0 + LUKS + fail-closed contracts (previously only pure `nix-instantiate`). Headless + KVM via a two-variant driver adapted from `tools/test-install.sh`. +- **Did:** Built the live ISO, ran two offline unattended installs: + **(B fail-closed)** no passphrase + no `NOMARCHY_NO_LUKS` → installer exits + RC=1 at the encryption stage with the fail message; `/dev/vda` stays BLANK + and disko `destroy` never runs. **(A swap=0)** `SWAP_GB=0` + passphrase → + install RC=0, subvol dump on `/mnt` shows `@,@home,@log,@nix,@snapshots` + and **no `@swap`**; installed disk boots (after LUKS unlock) to a fully + themed Boreal desktop, no error/autoconfig banner. +- **Verified:** **V2** — screenshots viewed: `b-failclosed.png`, + `a-progress-480.png` (DONE_SWAP0 + subvol dump), `a-first-boot.png` (themed + boot). Both contracts hold. #49's new `installer-disko` check now guards the + swap contract at eval time too. +- **Pending:** none for #46. Incidental: HM pre-activate warned in the offline + chroot (`xrdb: no display`) yet first boot came up themed anyway — the + "pre-activate failure → durable recovery hint" PROPOSED item still stands. +- **Next suggestion:** promote V2-capable PROPOSED items now the VM is free. + +## 2026-07-09 — #50 small code one-liners batch (V0/V1) +- **Task:** NEXT #50 — four small fixes. Kept in-house (shares rofi.nix / + flake.nix with the #47/#49 agents; done after they landed). +- **Did:** Bluetooth menu row + handler self-gate on `command -v + blueman-manager` (`rofi.nix`, like Printers); Control Center rollback list + `/tmp/nomarchy-gens` → `mktemp` + cleanup; `usbutils` added to the + `nomarchy-install` PATH (fingerprint `lsusb` probe); exported + nomarchy-doctor/control-center/battery-notify as flake `packages`. +- **Verified:** V0 flake check green; V1 — built the four flake packages + (incl. the new exports), `nomarchy-install` (usbutils), and the HM + generation (rofi + control-center bash -n via writeShell*). All exit 0. +- **Pending:** none. +- **Next suggestion:** V2-capable promotions. + ## 2026-07-09 — #49 pure-contract checks.* batch (delegated, worktree) - **Task:** NEXT #49 — add pure (no-VM) `checks.*` guards. Delegated to a worktree opus agent, parallel with #46 VM + the #47/#48 agent. diff --git a/flake.nix b/flake.nix index 8bce5de..3111e5f 100644 --- a/flake.nix +++ b/flake.nix @@ -115,6 +115,11 @@ packages.${system} = { nomarchy-theme-sync = pkgs.nomarchy-theme-sync; nomarchy-install = nomarchyInstall; + # Overlay tools exported for `nix build .#nomarchy-doctor` etc. + # (maintainer/CI convenience — modules install them via the overlay). + nomarchy-doctor = pkgs.nomarchy-doctor; + nomarchy-control-center = pkgs.nomarchy-control-center; + nomarchy-battery-notify = pkgs.nomarchy-battery-notify; default = pkgs.nomarchy-theme-sync; }; diff --git a/modules/home/rofi.nix b/modules/home/rofi.nix index a845c34..a18bad8 100644 --- a/modules/home/rofi.nix +++ b/modules/home/rofi.nix @@ -367,6 +367,10 @@ ${themeRows} bluetooth) # blueman-manager GUI (services.blueman.enable, system-side). + # Self-gated in the System menu on the CLI; guard here too in case + # it's invoked directly with nomarchy.system.bluetooth.enable=false. + command -v blueman-manager >/dev/null 2>&1 \ + || { notify-send "Bluetooth" "Not available (nomarchy.system.bluetooth off?)."; exit 0; } exec blueman-manager ;; printers) @@ -755,7 +759,8 @@ ${themeRows} choice=$( { row "Network${menuHint "network"}" network-wireless row "VPN" network-vpn - row "Bluetooth${menuHint "bluetooth"}" bluetooth + command -v blueman-manager >/dev/null 2>&1 \ + && row "Bluetooth${menuHint "bluetooth"}" bluetooth [ -e "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/pulse/native" ] \ && row "Audio" audio-volume-high row "Display" video-display diff --git a/pkgs/nomarchy-control-center/nomarchy-control-center.sh b/pkgs/nomarchy-control-center/nomarchy-control-center.sh index bc286d8..a3e3c5f 100644 --- a/pkgs/nomarchy-control-center/nomarchy-control-center.sh +++ b/pkgs/nomarchy-control-center/nomarchy-control-center.sh @@ -66,8 +66,10 @@ function main_menu() { if [ -z "$gens" ]; then echo "No Home Manager generations found." else - printf "%s\n" "$gens" | awk '{ printf "Desktop gen %s — %s %s%s\n", $5, $1, $2, (NR==1 ? " (current)" : "") }' > /tmp/nomarchy-gens - sel=$(gum choose < /tmp/nomarchy-gens || true) + tmp=$(mktemp) + printf "%s\n" "$gens" | awk '{ printf "Desktop gen %s — %s %s%s\n", $5, $1, $2, (NR==1 ? " (current)" : "") }' > "$tmp" + sel=$(gum choose < "$tmp" || true) + rm -f "$tmp" if [ -n "$sel" ]; then num=${sel#Desktop gen } num=${num%% *} diff --git a/pkgs/nomarchy-install/default.nix b/pkgs/nomarchy-install/default.nix index 72dad64..994f670 100644 --- a/pkgs/nomarchy-install/default.nix +++ b/pkgs/nomarchy-install/default.nix @@ -13,6 +13,7 @@ , cryptsetup , lvm2 # dmsetup , pciutils # lspci +, usbutils # lsusb (fingerprint-reader VID probe; sysfs is the fallback) , btrfs-progs # inspect-internal map-swapfile (hibernation offset) # Baked metadata — what this installer installs and where it came from. , templateDir # templates/downstream (home.nix, theme-state.json) @@ -61,7 +62,7 @@ stdenvNoCC.mkDerivation { wrapProgram $out/bin/nomarchy-install \ --prefix PATH : ${lib.makeBinPath [ bash gum disko whois git python3 - util-linux gptfdisk parted cryptsetup lvm2 pciutils btrfs-progs + util-linux gptfdisk parted cryptsetup lvm2 pciutils usbutils btrfs-progs ]} \ --set NOMARCHY_INSTALL_SHARE "$share" \ --set NOMARCHY_NIXPKGS ${nixpkgsPath} \