Move more host tooling to Nix

34 files changed, 40 insertions, 36 deletions

diff --git a/dot_config/git/hooks/_dispatch.sh b/dot_config/git/hooks/_dispatch.sh
index ed5acbf..9ba6e3b 100644
--- a/dot_config/git/hooks/_dispatch.sh
+++ b/dot_config/git/hooks/_dispatch.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Sourced by every hook in this directory. Runs the per-repo hook of
 # the same name and then returns control so the calling user-level
 # hook can do its own work after.
diff --git a/dot_config/git/hooks/executable_commit-msg b/dot_config/git/hooks/executable_commit-msg
index e484ccb..628ac94 100755
--- a/dot_config/git/hooks/executable_commit-msg
+++ b/dot_config/git/hooks/executable_commit-msg
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Strip Co-authored-by trailers whose identity looks like a coding agent
 # (Copilot, Claude, Codex, ChatGPT, Cursor, Aider, Devin, ...). Various
 # tools — GitHub Copilot CLI, VS Code chat, etc. — append these
@@ -58,7 +58,11 @@ esac
 
 # Collapse any trailing blank lines produced by the removal so we don't
 # leave a dangling blank trailer block.
-sed -e :a -e '/^$/{$d;N;ba' -e '}' "$tmp" >"$msg_file"
+awk '
+  NF { last = NR }
+  { lines[NR] = $0 }
+  END { for (i = 1; i <= last; i++) print lines[i] }
+' "$tmp" >"$msg_file"
 
 printf 'commit-msg: stripped AI Co-authored-by trailer(s).\n' >&2
 exit 0
diff --git a/dot_config/git/hooks/executable_post-commit b/dot_config/git/hooks/executable_post-commit
index 45f13f0..69d85f9 100755
--- a/dot_config/git/hooks/executable_post-commit
+++ b/dot_config/git/hooks/executable_post-commit
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # User-level post-commit. No global checks — exists purely so that
 # `<repo>/.githooks/post-commit` gets picked up automatically without
 # the project needing to override core.hooksPath. If there is no
diff --git a/dot_config/git/hooks/executable_pre-commit b/dot_config/git/hooks/executable_pre-commit
index 548925b..76d623b 100755
--- a/dot_config/git/hooks/executable_pre-commit
+++ b/dot_config/git/hooks/executable_pre-commit
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # User-level pre-commit. No global checks — exists purely so that
 # `<repo>/.githooks/pre-commit` gets picked up automatically without
 # the project needing to override core.hooksPath. If there is no
diff --git a/dot_config/git/hooks/executable_pre-push b/dot_config/git/hooks/executable_pre-push
index 286958b..b0915bf 100755
--- a/dot_config/git/hooks/executable_pre-push
+++ b/dot_config/git/hooks/executable_pre-push
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Reject pushes that include commits which:
 #   * lack a good signature, or
 #   * have a committer different from this repo's user.name / user.email, or
diff --git a/dot_config/sway/executable_brightness-osd.sh b/dot_config/sway/executable_brightness-osd.sh
index cc802ad..614fc6f 100644
--- a/dot_config/sway/executable_brightness-osd.sh
+++ b/dot_config/sway/executable_brightness-osd.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Print brightness percent to wob's fifo to flash a brightness bar.
 # Usage: brightness-osd.sh up|down
 set -eu
diff --git a/dot_config/sway/executable_bt-toggle.sh b/dot_config/sway/executable_bt-toggle.sh
index 02b72f9..29ec6c6 100644
--- a/dot_config/sway/executable_bt-toggle.sh
+++ b/dot_config/sway/executable_bt-toggle.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Toggle Bluetooth power via bluetoothctl. Uses notify-send's synchronous
 # hint so repeated toggles replace the previous notification instead of
 # stacking.
diff --git a/dot_config/sway/executable_display-toggle.sh b/dot_config/sway/executable_display-toggle.sh
index 39e3367..50f84f8 100755
--- a/dot_config/sway/executable_display-toggle.sh
+++ b/dot_config/sway/executable_display-toggle.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Display mode manager: laptop-off ↔ side-by-side.
 #   (no arg)  toggle between modes (F7 / Super+x d).
 #   apply     re-apply the saved mode (used by display-watcher after
diff --git a/dot_config/sway/executable_display-watcher.sh b/dot_config/sway/executable_display-watcher.sh
index 94ee943..7e446f5 100755
--- a/dot_config/sway/executable_display-watcher.sh
+++ b/dot_config/sway/executable_display-watcher.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Watch sway output events. When the set of connected external displays
 # changes (plug/unplug), re-apply the preferred layout via display-toggle.sh.
 # Manual F7 toggles don't trip this because they don't change external count.
diff --git a/dot_config/sway/executable_emoji-picker.sh b/dot_config/sway/executable_emoji-picker.sh
index 2a18283..86a379f 100644
--- a/dot_config/sway/executable_emoji-picker.sh
+++ b/dot_config/sway/executable_emoji-picker.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Bemoji wrapper: drop skin-tone variants (U+1F3FB..U+1F3FF) so the
 # picker isn't cluttered with five copies of every people-emoji.
 # Bemoji pipes its emoji list to whatever BEMOJI_PICKER_CMD evaluates
diff --git a/dot_config/sway/executable_emoji-wofi.sh b/dot_config/sway/executable_emoji-wofi.sh
index 8d37240..1c16169 100644
--- a/dot_config/sway/executable_emoji-wofi.sh
+++ b/dot_config/sway/executable_emoji-wofi.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Bemoji picker backend: filter out skin-tone variants
 # (U+1F3FB..U+1F3FF) before handing the emoji list to wofi.
 set -eu
diff --git a/dot_config/sway/executable_power-menu.sh b/dot_config/sway/executable_power-menu.sh
index 999259c..40598a8 100644
--- a/dot_config/sway/executable_power-menu.sh
+++ b/dot_config/sway/executable_power-menu.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Keyboard-driven power menu via wofi --dmenu (j/k navigation).
 set -eu
 
diff --git a/dot_config/sway/executable_tb-autostart.sh b/dot_config/sway/executable_tb-autostart.sh
index 13c8fe8..3a85dc5 100644
--- a/dot_config/sway/executable_tb-autostart.sh
+++ b/dot_config/sway/executable_tb-autostart.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Launch Thunderbird and stash the main window into the scratchpad once sway
 # marks it. Used at sway startup so TB is running but hidden from the outset.
 # Invoking Super+t (tb-toggle.sh) while TB isn't running takes a different
diff --git a/dot_config/sway/executable_tb-toggle.sh b/dot_config/sway/executable_tb-toggle.sh
index 56bb662..13382ed 100644
--- a/dot_config/sway/executable_tb-toggle.sh
+++ b/dot_config/sway/executable_tb-toggle.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Toggle the Thunderbird main window between the sway scratchpad and the
 # current workspace (tiled). If Thunderbird isn't running yet, launch it —
 # the for_window rule in sway config will mark it and stash it.
diff --git a/dot_config/sway/executable_type-vpn-otp.sh b/dot_config/sway/executable_type-vpn-otp.sh
index b3f0924..f62ecbc 100644
--- a/dot_config/sway/executable_type-vpn-otp.sh
+++ b/dot_config/sway/executable_type-vpn-otp.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Fetch the current VPN TOTP from pass-otp and type it into the focused
 # surface via wtype. If wtype isn't available or fails (focused surface
 # lacks virtual-keyboard support, e.g. an Xwayland app), copy the code
diff --git a/dot_config/sway/executable_vol-osd.sh b/dot_config/sway/executable_vol-osd.sh
index 7e324e0..e593710 100644
--- a/dot_config/sway/executable_vol-osd.sh
+++ b/dot_config/sway/executable_vol-osd.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Print 0–100 to wob's fifo to flash a volume bar overlay.
 # Usage: vol-osd.sh up|down|mute (mute toggles)
 set -eu
diff --git a/dot_config/systemd/user/wob.service b/dot_config/systemd/user/wob.service
index d9c0869..559487a 100644
--- a/dot_config/systemd/user/wob.service
+++ b/dot_config/systemd/user/wob.service
@@ -6,8 +6,8 @@ ConditionEnvironment=WAYLAND_DISPLAY
 
 [Service]
 Type=simple
-ExecStartPre=/usr/bin/sh -c 'rm -f "$XDG_RUNTIME_DIR/wob.sock" && mkfifo "$XDG_RUNTIME_DIR/wob.sock"'
-ExecStart=/usr/bin/sh -c 'exec tail -f "$XDG_RUNTIME_DIR/wob.sock" | %h/.nix-profile/bin/wob'
+ExecStartPre=%h/.nix-profile/bin/dash -c 'rm -f "$XDG_RUNTIME_DIR/wob.sock" && mkfifo "$XDG_RUNTIME_DIR/wob.sock"'
+ExecStart=%h/.nix-profile/bin/dash -c 'exec tail -f "$XDG_RUNTIME_DIR/wob.sock" | %h/.nix-profile/bin/wob'
 ExecStopPost=/usr/bin/rm -f %t/wob.sock
 Restart=on-failure
 RestartSec=2s
diff --git a/dot_config/waybar/executable_arch-audit-status.sh b/dot_config/waybar/executable_arch-audit-status.sh
index 73edf6f..3c25c18 100755
--- a/dot_config/waybar/executable_arch-audit-status.sh
+++ b/dot_config/waybar/executable_arch-audit-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/arch-audit: shows count of installed packages with known
 # CVEs that already have a fix available in the repos. Source of truth
 # is /run/arch-audit.txt, refreshed daily by arch-audit.timer (system
diff --git a/dot_config/waybar/executable_clip-picker.sh b/dot_config/waybar/executable_clip-picker.sh
index d7f5b61..c94e3de 100644
--- a/dot_config/waybar/executable_clip-picker.sh
+++ b/dot_config/waybar/executable_clip-picker.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Clipboard picker on top of cliphist + wofi (vim-nav, hide-search,
 # Alt-d to delete the highlighted entry).
 #
diff --git a/dot_config/waybar/executable_dock-status.sh b/dot_config/waybar/executable_dock-status.sh
index b8093fb..ca6d031 100644
--- a/dot_config/waybar/executable_dock-status.sh
+++ b/dot_config/waybar/executable_dock-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Detect a Lenovo ThinkPad USB-C Dock Gen2 by its distinctive built-in
 # ethernet adapter (17ef:a387). The dock's USB hubs share product IDs
 # with internal ThinkPad hubs on some models, but the ethernet is only
diff --git a/dot_config/waybar/executable_failed-units-status.sh b/dot_config/waybar/executable_failed-units-status.sh
index da7db49..9066904 100755
--- a/dot_config/waybar/executable_failed-units-status.sh
+++ b/dot_config/waybar/executable_failed-units-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/failed-units: shows count of failed systemd units across
 # the system bus and the current user's session bus. Hidden when zero.
 # Mako fires only on transition upward (count went up since last check),
diff --git a/dot_config/waybar/executable_lostfiles-status.sh b/dot_config/waybar/executable_lostfiles-status.sh
index f5f1099..be1adae 100755
--- a/dot_config/waybar/executable_lostfiles-status.sh
+++ b/dot_config/waybar/executable_lostfiles-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/lostfiles: shows count of filesystem entries not owned
 # by any pacman package (and not on lostfiles' built-in safe-list).
 # Source of truth is /run/lostfiles.txt, refreshed weekly by
diff --git a/dot_config/waybar/executable_mako-status.sh b/dot_config/waybar/executable_mako-status.sh
index 4e9f053..bab3765 100644
--- a/dot_config/waybar/executable_mako-status.sh
+++ b/dot_config/waybar/executable_mako-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar status: count of currently-visible mako notifications. With
 # default-timeout=0 in mako/config, "visible" == "pending"; once a
 # notification is dismissed it's gone and never comes back.
diff --git a/dot_config/waybar/executable_memory-status.sh b/dot_config/waybar/executable_memory-status.sh
index 33ccc04..5b19ca5 100755
--- a/dot_config/waybar/executable_memory-status.sh
+++ b/dot_config/waybar/executable_memory-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Emit waybar JSON with memory usage. Used% uses a heat scale (green → red),
 # available% uses the inverse (red → green). Values embedded via Pango span.
 set -eu
diff --git a/dot_config/waybar/executable_pacdiff-status.sh b/dot_config/waybar/executable_pacdiff-status.sh
index c9278d2..92eb6a8 100755
--- a/dot_config/waybar/executable_pacdiff-status.sh
+++ b/dot_config/waybar/executable_pacdiff-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/pacdiff: shows count of unresolved .pacnew/.pacsave files.
 # Source of truth is `pacdiff -o` (output mode — lists differing files,
 # does nothing). Hidden when zero. Mako fires once when the count goes
diff --git a/dot_config/waybar/executable_snx-vpn-status.sh b/dot_config/waybar/executable_snx-vpn-status.sh
index 9088630..f88c3a0 100644
--- a/dot_config/waybar/executable_snx-vpn-status.sh
+++ b/dot_config/waybar/executable_snx-vpn-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/snx-vpn module: report the snx-rs (Check Point) tunnel
 # state. `snxctl status` is fast (talks over a local UDS to the daemon)
 # but might briefly stall during connect; cap it with `timeout`.
diff --git a/dot_config/waybar/executable_snx-vpn-toggle.sh b/dot_config/waybar/executable_snx-vpn-toggle.sh
index c21643b..80ced4c 100644
--- a/dot_config/waybar/executable_snx-vpn-toggle.sh
+++ b/dot_config/waybar/executable_snx-vpn-toggle.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Toggle the snx-rs (Check Point) tunnel.
 #
 # Refresh the waybar custom/snx-vpn module immediately with SIGRTMIN+9.
diff --git a/dot_config/waybar/executable_tb-unread.sh b/dot_config/waybar/executable_tb-unread.sh
index 200cb70..b969215 100644
--- a/dot_config/waybar/executable_tb-unread.sh
+++ b/dot_config/waybar/executable_tb-unread.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Emit waybar JSON with the count of unread messages in the protonmail-bridge
 # IMAP Inbox. Requires bridge credentials in `pass` at the paths below; the
 # bridge prints them via `protonmail-bridge --cli` → `info`.
diff --git a/dot_config/waybar/executable_update-status.sh b/dot_config/waybar/executable_update-status.sh
index 2317256..cbd899e 100755
--- a/dot_config/waybar/executable_update-status.sh
+++ b/dot_config/waybar/executable_update-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/update: gentle reminder that the system hasn't been
 # upgraded recently. Source of truth is /var/log/pacman.log — the last
 # "[PACMAN] starting full system upgrade" entry. No daemon, no -Sy
diff --git a/dot_config/waybar/executable_vpn-status.sh b/dot_config/waybar/executable_vpn-status.sh
index 3e6faba..9a5016f 100644
--- a/dot_config/waybar/executable_vpn-status.sh
+++ b/dot_config/waybar/executable_vpn-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Waybar custom/vpn module: report whether the wireguard interface
 # (managed by systemd-networkd) is admin-up. Pango markup makes the
 # state visually unambiguous (green shield up, red strikethrough down)
diff --git a/dot_config/waybar/executable_vpn-toggle.sh b/dot_config/waybar/executable_vpn-toggle.sh
index c348971..1a996df 100644
--- a/dot_config/waybar/executable_vpn-toggle.sh
+++ b/dot_config/waybar/executable_vpn-toggle.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Toggle the wireguard interface managed by systemd-networkd. Polkit
 # rule (etc/polkit-1/rules.d/50-networkd-wheel.rules) lets wheel-group
 # members invoke networkctl up/down without a password prompt.
diff --git a/dot_config/waybar/executable_webcam-status.sh b/dot_config/waybar/executable_webcam-status.sh
index 2441039..be78774 100644
--- a/dot_config/waybar/executable_webcam-status.sh
+++ b/dot_config/waybar/executable_webcam-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Emit waybar JSON when any /dev/video* device is held open by a process.
 # V4L2 capture (firefox, zoom, OBS, etc.) doesn't go through PipeWire's
 # privacy portal, so the built-in waybar privacy module never sees it.
diff --git a/dot_config/waybar/executable_wifi-status.sh b/dot_config/waybar/executable_wifi-status.sh
index 93b3048..2b3201b 100755
--- a/dot_config/waybar/executable_wifi-status.sh
+++ b/dot_config/waybar/executable_wifi-status.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Emit waybar JSON describing wifi link state.
 #
 # Uses iwd's D-Bus API for state + SSID (net.connman.iwd is a documented,
diff --git a/dot_config/waybar/executable_wifi-toggle.sh b/dot_config/waybar/executable_wifi-toggle.sh
index 2eb27bc..e57f11f 100644
--- a/dot_config/waybar/executable_wifi-toggle.sh
+++ b/dot_config/waybar/executable_wifi-toggle.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env dash
 # Toggle wifi (wlan0) Powered state via iwd's D-Bus API. Driven by waybar
 # on-click on the custom/wifi module.
 set -eu