fix(scripts): use mktemp for state.json writes, not a fixed /tmp path

Ten state-mutating sites across seven scripts wrote through a predictable,
world-writable temp path (`/tmp/state.json`, `/tmp/system-state.json`)
before the atomic `sudo mv`. Because the `>` redirect runs as the invoking
user (sudo doesn't cover redirects), the shared fixed path is a symlink/
TOCTOU target and collides if two of these run concurrently. Switch each
to a per-invocation `mktemp`; the atomic rename into place is unchanged.
nomarchy-theme-set already used a temp var for its home-state write — this
makes its system-state write consistent and cleans the temp up on failure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

core/system/scripts/nomarchy-setup-dns

@@ -14,7 +14,7 @@ fi
 
 case "$dns" in
 Cloudflare|Google|DHCP)
-  sudo jq --arg dns "$dns" '.dns = $dns' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+  tmp=$(mktemp); sudo jq --arg dns "$dns" '.dns = $dns' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
   ;;
 
 Custom)
@@ -28,7 +28,7 @@ Custom)
 
   # Convert to JSON array safely
   dns_array=$(echo "$dns_servers" | jq -R 'split(" ")')
-  sudo jq --arg dns "Custom" --argjson servers "$dns_array" '.dns = $dns | .customDns = $servers' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+  tmp=$(mktemp); sudo jq --arg dns "Custom" --argjson servers "$dns_array" '.dns = $dns | .customDns = $servers' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
   ;;
 esac
 

core/system/scripts/nomarchy-setup-fido2

@@ -6,13 +6,13 @@ set -e
 STATE_FILE="/etc/nixos/state.json"
 
 if [[ "--remove" == $1 ]]; then
-    sudo jq '.features.fido2 = false' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+    tmp=$(mktemp); sudo jq '.features.fido2 = false' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
     echo "FIDO2 support disabled. Applying changes..."
     sudo nomarchy-sys-update
     exit 0
 fi
 
-sudo jq '.features.fido2 = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+tmp=$(mktemp); sudo jq '.features.fido2 = true' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
 echo "FIDO2 support enabled. Applying changes..."
 sudo nomarchy-sys-update
 

core/system/scripts/nomarchy-setup-fingerprint

@@ -6,13 +6,13 @@ set -e
 STATE_FILE="/etc/nixos/state.json"
 
 if [[ "--remove" == $1 ]]; then
-    sudo jq '.features.fingerprint = false' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+    tmp=$(mktemp); sudo jq '.features.fingerprint = false' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
     echo "Fingerprint support disabled. Applying changes..."
     sudo nomarchy-sys-update
     exit 0
 fi
 
-sudo jq '.features.fingerprint = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+tmp=$(mktemp); sudo jq '.features.fingerprint = true' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
 echo "Fingerprint support enabled. Applying changes..."
 sudo nomarchy-sys-update
 

core/system/scripts/nomarchy-toggle-hybrid-gpu

@@ -9,7 +9,7 @@ STATE_FILE="/etc/nixos/state.json"
 # Check if supergfxd is enabled in config
 if [[ $(sudo jq -r '.features.hybridGPU // false' "$STATE_FILE") != "true" ]]; then
     if gum confirm "Hybrid GPU support is not enabled. Enable it now? (Requires sys-update)"; then
-        sudo jq '.features.hybridGPU = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+        tmp=$(mktemp); sudo jq '.features.hybridGPU = true' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
         echo "Hybrid GPU support enabled in configuration. Applying changes..."
         sudo nomarchy-sys-update
         echo "Please run this command again after the update."

core/system/scripts/nomarchy-tz-select

@@ -7,7 +7,7 @@ STATE_FILE="/etc/nixos/state.json"
 
 timezone=$(timedatectl list-timezones | gum filter --height 20 --header "Set timezone") || exit 1
 
-sudo jq --arg tz "$timezone" '.timezone = $tz' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+tmp=$(mktemp); sudo jq --arg tz "$timezone" '.timezone = $tz' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
 
 echo "Timezone is now set to $timezone. Applying changes..."
 sudo nomarchy-sys-update

core/system/scripts/nomarchy-wifi-powersave

@@ -12,7 +12,7 @@ off) value="false" ;;
 *) echo "Usage: nomarchy-wifi-powersave <on|off>"; exit 1 ;;
 esac
 
-sudo jq --argjson val "$value" '.wifi.powersave = $val' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+tmp=$(mktemp); sudo jq --argjson val "$value" '.wifi.powersave = $val' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
 
 echo "Wifi powersave set to $1. Applying changes..."
 sudo nomarchy-sys-update

docs/OPTIONS.md

@@ -177,6 +177,10 @@ Without prime config, supergfxd still switches modes but render-offload via `nvi
 
 `enum ["top", "bottom"]`, default `"top"`. Waybar panel position.
 
+### `nomarchy.hyprland.gaps_in` / `nomarchy.hyprland.gaps_out` / `nomarchy.hyprland.border_size`
+
+`int`, defaults `5` / `10` / `2`. Hyprland window inner gaps, outer gaps, and active-border width (px). Map to Hyprland's `general.{gaps_in,gaps_out,border_size}` in `features/desktop/hyprland/default.nix`. Defaults come from `lib/state-schema.nix` and are read from `~/.config/nomarchy/state.json`, so they can be retuned without a rebuild; set them here to make a choice permanent.
+
 ### `nomarchy.formFactor`
 
 `enum [ "laptop" "desktop" ]`, default `"laptop"`. Mirror of `nomarchy.system.formFactor`. Filters laptop-only widgets out of waybar (battery) when set to `"desktop"`. The installer writes both system and home values together.

themes/engine/scripts/nomarchy-theme-set

@@ -40,7 +40,7 @@ jq --arg theme "$THEME_NAME" '.theme = $theme' "$STATE_FILE" > "$TMP_JSON" && mv
 # Sync to system state if we have permissions (for system-level theming like browser policies)
 SYSTEM_STATE_FILE="/etc/nixos/state.json"
 if [ -w "$SYSTEM_STATE_FILE" ] || [ -w "/etc/nixos" ]; then
-    sudo jq --arg theme "$THEME_NAME" '.theme = $theme' "$SYSTEM_STATE_FILE" > /tmp/system-state.json 2>/dev/null && sudo mv /tmp/system-state.json "$SYSTEM_STATE_FILE" 2>/dev/null || true
+    tmp=$(mktemp); sudo jq --arg theme "$THEME_NAME" '.theme = $theme' "$SYSTEM_STATE_FILE" > "$tmp" 2>/dev/null && sudo mv "$tmp" "$SYSTEM_STATE_FILE" 2>/dev/null || rm -f "$tmp"
 fi
 
 # Try to find a background for this theme