aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/dot_config
Commit message (Collapse)AuthorAgeFilesLines
* feat(nix): saturate builds, add community cache, pin nixpkgs registryLibravatar sommerfeld2026-05-131-0/+17
| | | | | | | | | | | | | | - Drop auto-optimise-store: slows every build for modest disk savings. Run 'nix store optimise' manually if disk pressure ever shows up. - max-jobs=auto, cores=0: defaults are 1/1, which left most of the box idle during large closures (LLVM, protobuf, …). - Add nix-community.cachix.org as an extra substituter with its public key. Big hit-rate boost against nixos-unstable, which is what the new user registry points 'nixpkgs' at. - dot_config/nix/registry.json pins 'nixpkgs' indirect ref to github:NixOS/nixpkgs/nixos-unstable, so 'nix shell nixpkgs#foo' is fast + reproducible. Project flakes are unaffected — they pin their own inputs via flake.lock.
* feat(nvim): pin copilot to Node 24 to dodge LSP/Node 26 incompatLibravatar sommerfeld2026-05-131-0/+3
| | | | | | | | | | | | | | | | | copilot-language-server emits 'HTTP 200 response does not appear to originate from GitHub' under Node 26 (the current Arch nodejs). Upstream tracking: https://github.com/zbirenbaum/copilot.lua/issues/695 https://github.com/github/copilot.vim/issues/282 https://github.com/github/copilot-language-server-release/issues/45 Workaround universally confirmed in those threads is to run the language-server under Node 24. Rather than downgrade system nodejs (used by lots of other tooling) install a private Node 24 under ~/.local/share/copilot-node/ via a chezmoi run_onchange script that verifies the official sha256, and point copilot.lua at it via copilot_node_command. Drop in once, bump NODE_VERSION when the upstream incompatibility is resolved.
* Revert "fix(sway): keep exec_always so outputs.conf self-heals on reload"Libravatar sommerfeld2026-05-131-1/+1
| | | | | | | | The exec_always change was only justified by a one-off migration: on the first reload after the include-file refactor, outputs.conf didn't exist yet. After that bootstrap, plain `exec` is sufficient -- the include file persists across reloads and only needs to be (re)written when the user actually toggles modes or hotplugs.
* fix(sway): keep exec_always so outputs.conf self-heals on reloadLibravatar sommerfeld2026-05-131-1/+1
| | | | | | | Plain `exec` doesn't re-run on reload. If outputs.conf is missing (fresh deploy, never toggled) reload falls back to sway's side-by-side defaults. `exec_always` regenerates the include on every reload, so the next reload after that is already flash-free.
* refactor(sway): apply display layout natively via include fileLibravatar sommerfeld2026-05-132-6/+31
| | | | | | | | | | | | | | | Persist the layout as a sway-include file (~/.config/sway/outputs.conf) so sway's own parser applies output directives natively on every reload. Eliminates the side-by-side flash that came from sway's default "enable everything side-by-side" before exec_always could override it. - display-toggle.sh: write outputs.conf alongside the live swaymsg commands, mirroring the same enable/disable/pos directives. - sway/config: `include ~/.config/sway/outputs.conf` next to the background line; downgrade exec_always back to plain exec since the include handles reloads now (script only needs to run once at startup to bootstrap the include file on first boot).
* fix(sway): re-apply display layout on config reload, drop resume hookLibravatar sommerfeld2026-05-133-12/+14
| | | | | | | | | | | | | | | Real cause of the silent switch back to side-by-side: sway reload (Super+Shift+c or swaymsg reload) re-evaluates output config and defaults to all-outputs-enabled-side-by-side, dropping the runtime positions set by display-toggle.sh. - sway config: `exec` -> `exec_always` so the saved layout is re-applied on every reload, and use `apply` instead of `init` so user-chosen layouts (e.g. side-by-side picked deliberately) survive reloads. First boot still defaults to laptop-off via the script's state-file fallback. - swayidle.service: drop the after-resume hook -- DPMS resume isn't what was breaking the layout, reload was. Less surface area.
* style(wob): bigger overlay, top anchorLibravatar sommerfeld2026-05-131-6/+6
| | | | | Move OSD to top, increase height/width, thicker border and padding. Colors were already fully opaque (ff alpha) -- no change needed there.
* fix(wob): keep fifo writer open via tail -fLibravatar sommerfeld2026-05-131-1/+1
| | | | | | | Reading directly from the fifo (`wob <fifo`) makes wob exit as soon as the first wrapper closes its write end (EOF after one printf). The upstream pattern is to pipe `tail -f` into wob so there's always a writer holding the fifo open.
* feat(desktop): xdg-desktop-portal pinning, wob OSD, mako DND toggleLibravatar sommerfeld2026-05-137-10/+83
| | | | | | | | | | | | | | | - xdg-desktop-portal: pin wlr for ScreenCast/Screenshot, gtk for the rest, so flatpak browsers (Meet, Slack, Discord) get a working screen-share path instead of whatever the portal frontend happens to pick first. - wob: small wayland overlay bar fed via a fifo. New vol-osd.sh / brightness-osd.sh wrappers replace the bare pactl/brightnessctl invocations in keybinds so adjusting volume or backlight flashes a bar at the bottom of the screen. wob.service owns the fifo lifecycle (mkfifo before, rm after). - mako: add a [mode=do-not-disturb] section that hides notifications while the mode is active, plus a Super+x n submode binding to toggle it. Notifications still accumulate in history; just no popups.
* fix(mako): Super+Shift+n also clears history from pending countLibravatar sommerfeld2026-05-131-0/+1
| | | | | | | | dismiss-visible.sh's 'all' mode previously only recorded visible notification ids and ran 'makoctl dismiss --all'. Notifications already in mako's history (auto-expired) still counted as pending in waybar's mako-status. Now also append history ids to the dismissed state file so the pending counter actually drops to zero.
* fix(sway): re-apply display layout on resumeLibravatar sommerfeld2026-05-132-3/+10
| | | | | | | | | | | | After resume from suspend sway resets output config to defaults (both monitors enabled side-by-side), so a laptop-off mode set before suspend silently snapped back to side-by-side on wake. The display-watcher script only reacts to changes in the count of connected externals, so it doesn't notice this. - Add an 'apply' mode to display-toggle.sh that reads the saved state and applies it (no toggle, no notification). - Wire it into swayidle's after-resume directive.
* refactor(power-menu): use wofi (vim nav) and systemctl (polkit)Libravatar sommerfeld2026-05-131-4/+6
| | | | | | | | | - wofi --dmenu --hide-search: pure j/k arrow-key picker, no fuzzy search field. Matches existing wofi config (key_up/key_down already include j/k). - systemctl reboot/poweroff/suspend instead of sudo: rely on polkit, which permits these for active session users by default — no passwordless sudo required.
* feat(sway): keyboard-driven fuzzel power menu, replace swaynagLibravatar sommerfeld2026-05-132-5/+20
| | | | | | swaynag buttons require a mouse click. Replace the Mod+Shift+e session prompt with a fuzzel --dmenu picker so the whole menu is keyboard navigable. Adds Suspend as a new entry while we're here.
* style(swaylock): pure black backgroundLibravatar sommerfeld2026-05-132-6/+6
|
* fix(swayidle): screen off at 5min, lock 30s later, lock on suspendLibravatar sommerfeld2026-05-131-8/+3
|
* refactor(swayidle): drop bespoke post-resume grace scriptLibravatar sommerfeld2026-05-132-42/+6
| | | | | | | | | | Replaces the resume-lock-grace.sh + after-resume hook from the previous commit with the simpler observation that sway already provides a wake grace for free: it pauses the idle counter during suspend and resets it on the first input event post-resume, so the existing timeout 300 lock naturally gives ~5min to interact before locking. Just dropping the before-sleep lock is enough; the script and after-resume directive were overcomplicating it.
* feat(sway): browser-aware idle inhibits + post-resume lock graceLibravatar sommerfeld2026-05-133-2/+58
| | | | | | | | | | | | | | | | | | | | | | Two related session-idle improvements: 1. ScreenSaver inhibit bridge. Browsers (LibreWolf/Chromium flatpaks) ask the session not to idle via the legacy org.freedesktop.ScreenSaver D-Bus API during video calls and fullscreen video; swayidle only honors logind's BlockInhibited property. Add inhibridge as a user unit to translate the former into the latter, so e.g. a Google Meet tab now keeps the screen from locking, dimming and (downstream) suspending. 2. Post-resume grace period. Locking on before-sleep meant every wake demanded the password even for a quick check. Replace with: before-sleep -> only pause media after-resume -> resume-lock-grace.sh 30 The grace script runs a one-shot swayidle that locks iff the user stays idle for 30s after the wake, with a watchdog that exits as soon as swaylock comes up (or after a hard cap) so it never lingers alongside the main swayidle. The 5-min main idle-lock and explicit loginctl lock-session paths are unchanged.
* fix(sudoers-rs,waybar): pass DIFFPROG (and friends) through sudo-rsLibravatar sommerfeld2026-05-132-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The previous fix sidestepped sudo-rs's env scrubbing by setting DIFFPROG inside a nested root shell. That works but it's the wrong shape — every command that wants to honour a user UX env var would have to do the same dance. Configure the policy once instead. etc/sudoers-rs: Defaults env_keep += "DIFFPROG" Defaults env_keep += "EDITOR VISUAL SUDO_EDITOR GIT_EDITOR" Defaults env_keep += "PAGER MANPAGER GIT_PAGER SYSTEMD_PAGER" Defaults env_keep += "LESS LESSOPEN SYSTEMD_LESS" env_keep is the unconditional pass-through list, so no '-E' is needed on the call site — `DIFFPROG='nvim -d' sudo pacdiff` Just Works, same as it does for `EDITOR=nvim sudo systemctl edit foo`, `PAGER=less sudo journalctl …`, etc. None of these vars influence privilege boundaries; they only configure user-facing program behaviour, so widening env_keep to cover them carries no security trade-off worth accounting for. The existing per-visudo env_keep lines are kept for documentation value (they're now subsumed by the global rule but make the intent explicit at the visudo call sites). The waybar pacdiff click handler reverts to the canonical form `DIFFPROG='nvim -d' sudo pacdiff`, matching the recipe pacman.git ships in /usr/share/doc/pacman/. Will take effect after the next `chezmoi apply` redeploys /etc/sudoers-rs (the run_onchange_after_deploy-etc.sh.tmpl script re-installs it with mode 0440 whenever its hash changes).
* fix(waybar): pacdiff click — set DIFFPROG inside the root shellLibravatar sommerfeld2026-05-132-3/+5
| | | | | | | | | | | | | sudo-rs scrubs the env by default, so neither `DIFFPROG=… sudo pacdiff` nor `sudo DIFFPROG=… pacdiff` reaches pacdiff with the variable set. Sidestep the env-policy question entirely by running sudo sh -c 'DIFFPROG="nvim -d" pacdiff' so the assignment happens inside the privileged shell, after the env-scrubbing boundary. No sudoers-rs change required, and the same form works identically under stock sudo if the user ever switches back.
* feat(waybar,systemd-units): wire up new system-health modules and timersLibravatar sommerfeld2026-05-132-1/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bar layout: insert the four new modules between custom/update and custom/thunderbird so that all 'something needs your attention' indicators live as a contiguous group on the right side, in roughly escalating actionability: custom/notifications -- mako history (always present, gray baseline) custom/update -- '`just update` was N hours/days ago' custom/pacdiff -- '.pacnew/.pacsave waiting' custom/arch-audit -- 'fixable CVE in installed package' custom/failed-units -- 'systemd unit failed' custom/lostfiles -- 'unowned files under tracked dirs' custom/thunderbird -- 'unread mail' Click handlers all use the floating-ghostty + 'press enter to close' idiom established by the existing update module so output stays inspectable. arch-audit and lostfiles open their /run report in `nvim -R` (read-only) since the source of truth lives in those files. style.css: extend the shared 6px-padding selector list, the .fresh zero-padding rule (so empty-state modules disappear cleanly), and add .warn/.critical color rules consistent with the rest of the palette (yellow #fabd2f for 'review when convenient', red #fb4934 for 'review soon'). systemd-units/system.txt: enable the three new system timers - btrfs-balance@-.timer (monthly partial balance on /) - arch-audit.timer (daily CVE report refresh) - lostfiles.timer (weekly unowned-files report refresh) Picked up automatically on the next `just unit-apply`.
* feat(waybar): pacdiff + failed-units remindersLibravatar sommerfeld2026-05-132-0/+105
| | | | | | | | | | | | | | | | | | | | | | | | | Two live waybar modules — no timer/state-file pipeline because the inputs are cheap to compute on every poll: custom/pacdiff (interval 300s) Counts unresolved .pacnew / .pacsave files via `pacdiff -o` (output mode — lists only, takes no action). Hidden at zero. Yellow 'pacdiff N' otherwise. Mako fires once on the 0→N transition, so you get exactly one nudge per upgrade wave, not a sustained re-nag for files you've decided to defer. Click runs `sudo DIFFPROG='nvim -d' pacdiff` in a floating ghostty. custom/failed-units (interval 30s) Sums `systemctl --failed` (system) and `systemctl --user --failed` counts. Hidden at zero. Red 'failed N' otherwise. Mako fires only on upward transition (count went up since last poll), so already-known failures don't keep paging you while you investigate. Click prints both `systemctl --failed` outputs in a floating ghostty. Both modules use the same $XDG_RUNTIME_DIR/waybar-X-prev pattern as the update reminder for state, which makes 'reboot resets the nag' the default behaviour — exactly the right semantics for both: a fresh boot deserves a fresh look at pending pacdiffs and any failed units.
* feat(lostfiles): weekly unowned-files refresh + waybar reminderLibravatar sommerfeld2026-05-131-0/+48
| | | | | | | | | | | | | | | | Wiring (mirrors arch-audit, with weekly cadence and Nice=19/idle I/O): lostfiles.timer (weekly, Persistent=true, RandomizedDelaySec=1h) → lostfiles.service → /run/lostfiles.txt (default mode — strict produces too many false positives for a passive reminder) → custom/lostfiles waybar module (interval 600s) → mako 'normal' once/7d while count > 0 → on-click: `ghostty -e nvim -R /run/lostfiles.txt` Default mode (no `strict` argument) is intentional: it already filters the package's curated false-positive list at /etc/lostfiles.conf, which is what we want for a low-noise weekly nudge. Switching to `strict` is a one-line change in lostfiles.service if signal-vs-noise tilts later.
* feat(arch-audit): daily CVE refresh + waybar reminderLibravatar sommerfeld2026-05-131-0/+46
| | | | | | | | | | | | | | | | | | | | | | | Wiring: arch-audit.timer (daily, RandomizedDelaySec=1h, Persistent=true) → arch-audit.service (After=network-online.target) → /run/arch-audit.txt ('--upgradable' output, atomic via .tmp+mv) → custom/arch-audit waybar module (interval 300s) → mako 'critical' once/24h while count > 0 → on-click: `ghostty -e nvim -R /run/arch-audit.txt` The bar entry stays hidden when there are no fixable CVEs, fades in as red 'CVE N' the moment arch-audit finds at least one, and the throttled mako means you'll see exactly one notification per day instead of one per waybar poll. No -Sy refresh and no auto-update — this only reports the gap between what's installed and what's already in the repos. Why /run and not the user's runtime dir: the producer is a system unit (needs the system's pacman db on the network-online path), the consumer is a user-scope waybar that just reads it; /run is the canonical 'fast, volatile, world-readable' system-tmpfs and survives the reboot cycle in exactly the way we want — fresh empty file on every boot, repopulated on the next timer fire.
* feat(zsh): rebuild PATH hash on every completionLibravatar sommerfeld2026-05-131-0/+1
| | | | | | | | | | | | | `zstyle ':completion:*' rehash true` makes zle re-scan $PATH directories on every TAB instead of caching the hash table at shell startup. Cost is trivial (one stat() per PATH entry per completion), benefit is that newly installed binaries — from paru, cargo install, pip install --user, npm install -g, manual /usr/local/bin drops, anything — show up immediately without an explicit `hash -r` or new shell. The pacman-hook alternative at https://wiki.archlinux.org/title/Zsh#Persistent_rehash only catches paru/pacman installs, missing cargo/pip/manual; rehash=true catches them all for the same negligible cost.
* feat(waybar,nvim): update-staleness reminder; nvim update visibleLibravatar sommerfeld2026-05-134-5/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | Two related changes around the 'just update' UX: 1. nvim-update no longer runs --headless. The diff buffer that vim.pack.update opens *is* the per-plugin changelog, and that was being thrown away under headless. Drop --headless from the justfile recipe and the trailing :qa! from config.update.run() so the buffer stays open until the user reviews and quits manually. Mason output was already visible because mason-tool-installer print()s. 2. New waybar 'custom/update' module + matching mako notification as a gentle staleness reminder, replacing any temptation to run unattended pacman -Syu (a bad idea on Arch: rolling, news-driven manual interventions, AUR rebuilds, partial-upgrade hazards). Source of truth: /var/log/pacman.log — last '[PACMAN] starting full system upgrade'. No daemon, no -Sy poll, no extra state file beyond a per-session notify-throttle stamp in $XDG_RUNTIME_DIR. Tiers (hours since last full upgrade): < 24h hidden (":empty" via #custom-update.fresh padding 0) 24-168h yellow + normal-urgency mako, throttled to 1/24h >= 168h red + critical-urgency mako, throttled to 1/24h Click runs 'just update' in a floating ghostty.
* feat(sway): non-XF86 alternatives for media/hardware keybindsLibravatar sommerfeld2026-05-131-0/+25
| | | | | | | | | | | | | | | | | | | | | Every sway action that was reachable only via an XF86 keysym now has a Super-based alternative, so all bindings work on keyboards without a multimedia row. Frequent (direct binds, vim-direction layout on Super+Ctrl): Super+Ctrl+k/j = volume +/- Super+Ctrl+space = play/pause Super+Ctrl+l/h = next/previous track Super+Ctrl+]/[ = brightness +/- Rare (submode 'system' via Super+x; one letter runs and exits): b bluetooth · w wifi · r rfkill · s suspend · d display v pulsemixer · k KEYBINDS viewer · m mako history Escape/Return exits Existing Super+m / Super+Shift+m / Super+Shift+s already covered mic-mute / sink-mute / lock; XF86 binds untouched so the laptop's Fn-row keeps working. KEYBINDS.md updated.
* feat(git): pre-push checks Co-authored-by trailers for agentsLibravatar sommerfeld2026-05-131-5/+14
| | | | | | | | | | | | | | Same substring blacklist (copilot, claude, codex, ...) is now also applied to every Co-authored-by trailer in the commit message, not just the author header. Agents commonly slip in via that route. Trailers extracted with %(trailers:key=Co-authored-by,valueonly, unfold,separator=%x1f) and split in awk on \037, which can't appear in identity strings, so the tab-delimited record format stays unambiguous. To fix a flagged trailer use git commit --amend / interactive rebase to drop the Co-authored-by line; --reset-author won't help here.
* feat(git): pre-push also rejects coding-agent authorsLibravatar sommerfeld2026-05-131-14/+42
| | | | | | | | | | | | | | Block commits where the author name/email contains any of: copilot, claude, codex, chatgpt, cursor, aider, devin, [bot], @openai., @anthropic. Use plain index() substring matching in awk to dodge regex-escaping pitfalls (an earlier draft using regex turned \[bot\] into a char class via -v escape processing and false-matched 'o' in 'com'). Fix: rebase with --reset-author re-stamps you as author while keeping the agent as it was (or drop them entirely). Documented in the failure message.
* feat(git): pre-push also rejects commits with foreign committerLibravatar sommerfeld2026-05-131-8/+34
| | | | | | | | | | | | | Now flags any commit whose committer name+email doesn't match the local user.name / user.email (which respects the includeIf rules in ~/.config/git/config, so per-tree work/personal identities work). Author is left free: pulling someone else's commit and rebasing it locally re-stamps the committer to you, satisfies this gate, and the original author is preserved in the commit metadata. Both checks (signature + committer) run in one rev-list pass with tab-separated fields so awk parses unambiguously.
* feat(git): global pre-push hook rejecting unsigned commitsLibravatar sommerfeld2026-05-132-0/+60
| | | | | | | | | | | | | | Activated via core.hooksPath = ~/.config/git/hooks in the global git config. The hook walks each ref being pushed (range: remote..local or, for new branches, local --not --remotes) and checks %G? on every commit. Accepts G/U/X/Y (good signature variants), rejects N/B/E/R (no signature, bad, missing key, revoked). Bypass: git push --no-verify This repo overrides hooksPath to .githooks/ for its just-check pre-commit gate, so a thin .githooks/pre-push delegates to the global hook to keep the policy enforced here too.
* feat(sway,waybar): scratch nvim+ipython binds; bolder VPN visualsLibravatar sommerfeld2026-05-133-4/+10
| | | | | | | | | | | | | | | | | VPN module: - Pango markup colours the text directly so up/down is visually unambiguous even without CSS classes (green shield up, dim strikethrough down) - .down also gets a faint red background tint for at-a-glance scan Sway: - Super+Shift+t -> floating ghostty with nvim editing a fresh $XDG_RUNTIME_DIR/scratch-<epoch>.txt (auto-cleared on reboot via tmpfs) - Super+c -> floating ghostty with ipython (quick calculator / python scratch) KEYBINDS.md updated.
* feat(waybar,sway): htop click handler, app keybinds, VPN toggleLibravatar sommerfeld2026-05-135-0/+54
| | | | | | | | | | | | | | | | | | | | waybar: - cpu / custom/memory: on-click opens floating ghostty with htop - new custom/vpn module between custom/memory and network#bond: shows 'VPN' coloured by interface UP flag (green up, dim down); on-click toggles networkctl up/down hodor; SIGRTMIN+8 used for instant refresh after toggle sway: - Super+Shift+Return -> ghostty -e yazi - Super+Shift+b -> librewolf vpn-toggle.sh runs networkctl (no sudo) thanks to a new polkit rule allowing wheel-group members to invoke org.freedesktop.network1.* without a password prompt. systemd-networkd's polkit gate is a separate path from sudoers, so this is the idiomatic fix. KEYBINDS.md updated for both new sway bindings.
* feat(mako-history): reopen picker after each selectionLibravatar sommerfeld2026-05-131-22/+25
| | | | | | After Enter copies+dismisses an entry, reopen the wofi window so the remaining notifications can be processed without re-triggering the keybind. Esc closes the loop.
* fix(mako-history): drop Alt-d; Enter copies+dismissesLibravatar sommerfeld2026-05-131-20/+7
| | | | | | | | wofi's key_custom_N only stages an exit code; it does not actually exit on the keybind, so Alt-d alone did nothing visible. Drop the custom keybind entirely and let Enter copy+dismiss in one stroke. Esc cancels. Since dismissed entries are now hidden, walking the list with Enter is a workable replacement for the dropped "dismiss without copy" path.
* fix(webcam-status): silence SC2086 on intentional word-splittingLibravatar sommerfeld2026-05-131-0/+1
|
* feat(mako-history): hide dismissed entries; consolidate keybindsLibravatar sommerfeld2026-05-131-41/+38
| | | | | | | | | | | | | | | | | Two behaviour changes: - Hide entries that were previously dismissed via the picker (the state file now acts as a hide-list, not a marker). The list shrinks as you process it; no more grey ' ' rows clogging the view. - Drop the secondary Alt-c custom key. wofi's '--define key_custom_N' appears unreliable past N=0, so Alt-c and Alt-d both silently failed. Reduce to a single custom slot (Alt-d) and remap actions: Enter -> copy + dismiss (was: re-emit + mark seen) Alt-d -> dismiss without copy Re-emit was rarely useful given mako already shows the bubble on arrival; copying is the common need. KEYBINDS.md updated to reflect the new action set.
* chore: drop dot_copilot tree; format clangd configLibravatar sommerfeld2026-05-131-6/+6
| | | | | - Remove dot_copilot/ entirely (no longer needed). - Run prettier on dot_config/clangd/config.yaml.
* style: apply formatter drift across repoLibravatar sommerfeld2026-05-1310-41/+54
| | | | | | | Pre-existing whitespace/style drift caught by `just check`. Touch nothing semantic — pure formatter output (shfmt -i 2 -ci -s, ruff, prettier, taplo). Excludes dot_config/clangd/config.yaml whose manual indentation is intentionally preserved.
* feat(privesc): migrate from opendoas to sudo-rsLibravatar sommerfeld2026-05-133-15/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | doas's one-shot password and absent 'sudo -v' kept wasting hour-long paru AUR builds. sudo-rs is a memory-safe Rust rewrite (ISRG/Ferrous Systems), drop-in CLI compatible, and the same one Ubuntu 25.10 ships as default. We follow the Arch wiki 'Using sudo-rs without the sudo package' recipe verbatim — no custom shims. - meta/base.txt: -doas-sudo-shim +sudo-rs - etc/sudoers-rs (mode 0440): wiki minimal config + NOPASSWD reboot/poweroff - etc/pam.d/sudo: 4-line copy of upstream sudo's PAM file - run_onchange_after_deploy-etc.sh.tmpl: use real sudo, deploy sudoers-rs at 0440, create /etc/pam.d/sudo-i and /usr/local/bin/{sudo,sudoedit, su,visudo} → sudo-rs symlinks idempotently - delete etc/doas.conf, dot_local/bin/{doasedit,sudo} - zshrc: drop sudo=doas/sudoedit=doasedit aliases; rewrite ss/gimme/ pacdiff/ssys to call sudo - justfile: s/doas/sudo/g (status/diff/restore helpers) - nvim: rename :DoasWrite → :SudoWrite (uses sudo -S) - sway config: reboot/poweroff buttons call sudo - bootstrap.sh: update step-5 comment - README/KEYBINDS/copilot-instructions: flip the privesc convention No Defaults overrides: sudo's defaults (passwd_tries=3, timestamp_timeout=5) already fix the doas pain, and paru SudoLoop (kept) refreshes the 5-min window via real sudo -v.
* feat(doas): smarter sudo shim + paru SudoLoopLibravatar sommerfeld2026-05-131-1/+1
| | | | | | | | | | | | | | | | | | | The packaged doas-sudo-shim is just 'exec doas "$@"', which means 'sudo -v' (used by paru --sudoloop to keep the auth timestamp fresh during long AUR builds) hits doas, which doesn't implement -v, and the loop dies. Then when the build finally finishes and tries the real install, the cached timestamp has long expired, so we reprompt — and opendoas only allows one attempt before bailing, so a single mistype throws an hour of compilation away. Replace it (per-user, via $HOME/.local/bin precedence) with a shim that translates: -v -> doas true (refresh persist timestamp) -k / -K -> doas -L (clear) -E -H -i -S etc -> dropped (no doas equivalent) rest -> doas "$@" Then enable SudoLoop in paru.conf so the timestamp stays fresh.
* style(waybar): use real anchor U+2693 (⚓) for dock indicatorLibravatar sommerfeld2026-05-131-1/+1
| | | | | Plain Unicode anchor renders via the system emoji font everywhere instead of the nerd-font private-use-area glyph.
* style(waybar): swap dock glyph to anchor (nf-md-anchor)Libravatar sommerfeld2026-05-131-1/+1
| | | | | Pun on "ship docked at port" — and just looks better than the dock_window glyph at small sizes.
* feat(waybar): add dock indicator next to batteryLibravatar sommerfeld2026-05-133-0/+40
| | | | | | | | | | Detects the ThinkPad USB-C Dock Gen2 by its built-in ethernet adapter (USB 17ef:a387) — the dock's USB hubs share product IDs with internal ThinkPad hubs but the ethernet only exists when the dock is attached. The custom/dock module sits to the left of battery; collapses to empty text when undocked so the bar stays clean on the go. Green dock glyph when docked.
* fix(emoji): split skin-tone filter into its own picker scriptLibravatar sommerfeld2026-05-132-5/+10
| | | | | | | | The previous one-liner stuffed an inline pipeline into BEMOJI_PICKER_CMD via 'sh -c' with three layers of nested quoting, which broke under bemoji's eval ("grep: 1: Syntax error: Unterminated quoted string"). Move the filter+wofi pipeline into emoji-wofi.sh and point the env var directly at it. No more quoting gymnastics.
* feat(emoji): filter out skin-tone variants in bemoji pickerLibravatar sommerfeld2026-05-132-1/+12
| | | | | | | | Skin-tone modifiers (U+1F3FB..U+1F3FF) clutter search results with five near-duplicates per people-emoji. New ~/.config/sway/emoji-picker.sh wraps bemoji and pipes its emoji list through grep -vP before handing it to wofi. Quoting was getting hairy inline in sway's exec, so the wrapper script makes it readable.
* fix(wofi): allow fuzzy search in emoji pickerLibravatar sommerfeld2026-05-132-11/+8
| | | | | | | | | The bemoji invocation passed --hide-search, and the shared wofi stylesheet additionally forced #input opacity to 0, so even without the flag the search box was unusable. Drop --hide-search from bemoji's picker cmd and replace the CSS hack with a normal styled input. Pickers that want arrow-only UI (mako-history, clip-picker) keep --hide-search and continue to render without an input row.
* feat: vim nav in wofi, bemoji, clip picker, webcam glyph fixLibravatar sommerfeld2026-05-134-3/+46
| | | | | | | | | | | | | | | | | | | | | | | - wofi config: key_up/key_down accept Up,k / Down,j; Ctrl-u/Ctrl-d for page jumps. Picker scripts auto-load this since they only pass --style. - waybar webcam glyph: U+F0D5D (camera/photo, looked Instagram-y) -> U+F0567 nf-md-video (handheld video camera). - Clipboard picker migrated from fuzzel to wofi for consistency with the notification picker. New driver dot_config/waybar/clip-picker.sh: pick (Mod+p) Enter pastes, Alt-d deletes delete (Mod+Shift+p) Enter deletes No clipboard "read" indicator: Wayland has no API for observing reads. - Emoji picker: bemoji on Mod+period, driven through wofi (so vim nav applies there too) and configured to type + copy via wtype. - LibreWolf flatpak: --device=all override so v4l2 webcams work. Flatpak has no finer-grained device flag. - KEYBINDS.md updated: Mod+p / Mod+Shift+p now describe wofi behavior; Mod+period documented.
* fix(waybar): dismiss/restore wrappers parse mako text formatLibravatar sommerfeld2026-05-132-3/+11
| | | | | | | | | | Same -f-doesn't-exist regression as 3205afc / d76ff3c. Without -f the inner pipeline produced no ids, so the dismissed-set never grew and notifications stayed pending forever after Mod+n. Switch to sed extraction of 'Notification N:' lines for both dismiss-visible.sh (list) and restore-pending.sh (history). Verified the dismissed-set is populated correctly for top/all modes.
* fix(waybar): mako-status counts ids by parsing text dumpLibravatar sommerfeld2026-05-131-9/+11
| | | | | | | | Same root cause as 3205afc: this makoctl version has no -f flag, so the '%i' lookup silently produced no ids and the bar always showed empty. Switch to a sed extraction of 'Notification N:' lines from list+history. Verified against simulated input matching the user's real makoctl output: 0/some/all dismissed all render correctly.
* fix(waybar): parse real makoctl text format (no -f support)Libravatar sommerfeld2026-05-131-24/+44
| | | | | | | | | | | | This makoctl version doesn't accept -f. Drop that path and parse the actual text dump: Notification N: <summary> <- summary on the same line App name: <app> [Category: <cat>] [Body: ...] <- absent on this version, kept anyway Urgency: <urgency> Verified against the user's pasted output.
generated by cgit v1.3.1 (git 2.54.0) at 2026-05-31 23:28:54 +0000