Close the Linux gaps in greenfield setup

[ikwach]

Tested a clean install on an Ubuntu 25.10 machine. The installer itself works — all symlinks correct, .secrets.env at 600, font installed, no broken links — but a greenfield Linux user ends up with a worse result than a greenfield Mac user. Two review rounds since; everything below is fixed and verified.

Terminal font is now set automatically

macOS links an iTerm2 dynamic profile with the font baked in. Linux got a printed instruction, so a fresh machine renders the starship powerline prompt as tofu boxes. grep -rn "dconf\|gsettings" across the repo returned nothing.

linux-terminal.sh sets it over gsettings for Ptyxis (default since Ubuntu 25.10), GNOME Terminal and Console. It leaves an existing custom font alone — the iTerm2 profile is one the user opts into, so the parity move is not to clobber a deliberate choice — reports the previous value when it does replace one, and honours DOTFILES_TERMINAL_FONT to force a change. Key names are checked via list-keys before setting, so an unexpected schema warns rather than falsely succeeding.

It also prints the thing that costs people 20 minutes: a running terminal caches fonts at startup, so a new tab is not enough.

The README targeted a terminal Ubuntu no longer ships

gnome-terminal is not installed; x-terminal-emulator resolves to /usr/bin/ptyxis. README updated.

Personal mode now installs the cask tools on Linux

cask lines are stripped on Linux, so personal mode silently lacked Claude Code, gcloud and the 1Password CLI. linux-extras.sh installs each from its official Linux channel. gnupg is installed on demand, since neither bootstrap guaranteed it.

Latched installs — the -d trap, in three places

[[ ! -d ... ]] cannot distinguish "done" from "done wrong": a directory created by a run that then failed skips the step forever.

• Nerd font — now checks for .ttf files
• tmux TPM in install.sh — now checks .git and clears a partial clone
• the second copy in tmux/.tmux.conf — same

Interactive detection

The documented path is curl … | bash -s -- personal, where stdin is the pipe for the whole run, so [[ -t 0 ]] is false with a user sat right there. That skipped the gcloud/1Password installs and the git identity prompt — and since git/.gitconfig includes .gitconfig.local unconditionally, git then commits under a guessed user@hostname. Wrong data, not a missing tool.

One have_tty() now covers mode select, identity and Toshy, and prompts read from /dev/tty. It opens /dev/tty rather than testing existence: on CI runners the node exists with no controlling terminal, and a failed redirect on read would abort the installer under set -e.

Data safety

• link() only backed up regular files — a config that was already a symlink (stow, chezmoi, another dotfiles repo) was replaced with nothing recorded. The old target now goes to $BACKUP_DIR/replaced-symlinks.txt.
• The .zprofile append used echo, joining onto a file with no trailing newline: export FOO=1eval "$(… shellenv)". Now printf '\n%s\n'.
• The shellenv dedup matched any brew shellenv line, so migrating Intel→ARM kept the stale line and never added the correct one. Matches the exact line and replaces a stale one, with a backup.
• Corporate mode skipped linking gifenc but never removed an existing link, leaving a live symlink to a script whose ffmpeg dependency corporate does not install.

Unattended gpg

gpg --dearmor prompts before overwriting an existing keyring — blocking on a tty, exit 2 without one. The keyring outlives the package, so this fires on any re-run after a failed apt step. All three calls pass --batch --yes. Verified against the real Google key: exit 2 → exit 0.

bin/

gifenc was the weakest file in the repo: unquoted $in/$out/$palette broke on exactly the filenames it exists for; a fixed /tmp/palette.png raced between runs; cut -f1 -d. cut at the first dot, so /tmp/v1.2/clip.mov wrote to /tmp/v1.gif. Now quoted, mktemp with a trap, ${in%.*}, set -eu.

fswatch and rsync are needed by super-sync — linked in both modes — but were in no Brewfile. Added to Brewfile.core.

Smaller

• Terminal setup no longer nested inside the fc-cache check; fontconfig is only apt-installed when brew was absent, so a machine with brew never got configured.
• Both new scripts return failure counts, so the || warning handlers can fire.
• Claude Code checks ~/.local/bin/claude directly; PATH only gets it from zsh/.zshrc, and install.sh runs under bash.
• Next-steps only lists sign-in commands for tools that are present.
• The TPM clone was bare while every other network call is guarded.
• chsh reads the passwd entry (getent/dscl), not $SHELL; the zsh-absent case no longer claims success.
• zsh/.zshrc uses $HOMEBREW_PREFIX instead of forking brew --prefix per shell.

Testing

Adds a personal-linux CI job that runs personal mode for real and reruns it, so the keyrings already exist on the second pass — the exact case that would have caught the gpg hang. Personal mode was previously only parse-checked, which is why linux-extras.sh originally shipped with no coverage.

Also verified locally: full install in a sandboxed HOME, idempotent on rerun, recovers from an empty font dir, symlink backup recorded, newline corruption fixed, have_tty correct on a session with no controlling terminal, and linux-terminal.sh run live against Ptyxis in both the greenfield and already-customised cases.

Not verified: the real-terminal path (curl | bash from an actual terminal) — the test session has no controlling terminal, so only the CI-safe branch was exercisable. org.gnome.Console's custom-font key is unconfirmed; apply() checks list-keys first, so it warns rather than lying.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Jyt6CQVjLRN6HHXam9qBU9

[ikwach]

Review of 65a7715

CI is red — personal-linux fails — and the failure is worth reading closely, because it exposes that the job has never tested what it claims.

The failure

The new "Remove the packages, keep the keyrings" step exits 1 at one of the test -f assertions (no command -v output in the log, so it's a silent test). Root cause is in the first step's log:

[OK] gcloud already installed

ubuntu-latest ships Google Cloud CLI preinstalled, so linux-extras.sh's gcloud block short-circuits on command -v gcloud and never creates /usr/share/keyrings/cloud.google.gpg. The new step then removes the preinstalled package and asserts a keyring that was never written.

I ruled out the alternative explanation by pulling both packages: google-cloud-cli 576.0.0-0 ships nothing under /usr/share/keyrings and has no postrm at all (only postinst/prerm); 1password-cli 2.38.1-1 likewise ships no keyring and never mentions one in its maintainer scripts. Neither removes the file — it was simply never created.

The implication is bigger than the red X. The gcloud half of linux-extras.sh has never executed in CI — not in this run, and not in the previous one (both say "gcloud already installed"). The gcloud --version check in "Verify the cask-equivalent tools actually installed" has been passing against the runner's preinstalled binary the whole time. So the code path that carried the original unattended-gpg hang — dearmor, sources.list, apt install — is still completely untested, by a job whose stated purpose is testing it.

Purge the runner's copy first, right after checkout:

- name: Drop the runner's preinstalled gcloud so the installer's own path runs
  run: |
    sudo apt-get remove -y google-cloud-cli || true
    sudo rm -f /usr/share/keyrings/cloud.google.gpg \
               /etc/apt/sources.list.d/google-cloud-sdk.list
    ! command -v gcloud

Then the remove/rerun/assert sequence added here works as designed. Worth also asserting test -f /usr/share/keyrings/cloud.google.gpg in the first verify step, so a future runner image preinstalling something can't hollow the job out again without failing loudly.

Round-three fixes — all verified

• Exit-code states. "$SCRIPT" && terminal_rc=0 || terminal_rc=$? captures 0/1/2 correctly (tested all three). The contradiction is gone from the log — the same run now reads No terminal configured with a Nerd Font. Set your terminal font to: ... and then 2. Set your terminal font to JetBrainsMono Nerd Font.
• List join. printf -v joined '%s / ' + ${joined% / } produces claude / gcloud auth login / op signin — confirmed in the CI output.
• .zprofile. Verified end-to-end against the exact single-line file the old installer wrote: stale line removed, no orphaned .tmp, one correct line, backup in $BACKUP_DIR. The anchored ERE matches both real forms including leading whitespace, and correctly leaves alone a comment, an export, and an echo that merely mention brew shellenv — all five cases tested.
• have_tty shortcut removed with a correct rationale; linux-extras.sh's have_sudo now uses the identical (exec 3</dev/tty) probe.
• tpm moved aside rather than deleted.
• Backup announcement no longer fires for the symlink ledger alone. find -mindepth 1 ! -name ... -print -quit is fine on macOS — the macos-latest job printed "Previous configs backed up to ...", so -quit executed successfully there.
• gifenc. Checked the Darwin man page rather than guessing: "If no arguments are passed or if only the -d flag is passed mktemp behaves as if -t tmp was supplied." Bare mktemp -d is supported on macOS, so the private-directory approach is correct and portable.
• linux-extras.sh reindented back to 2 spaces.

Minor

a. Nerd-font heuristic misses the abbreviated names — linux-terminal.sh:79

*[Nn]erd* doesn't match MesloLGS NF, JetBrainsMono NF, Hack NF — the naming p10k's font installer and several distro packages use. Those users get a spurious "does not look like a Nerd Font", the script exits 2, and the installer tells them to change a font that's already right. Add the NF forms.

b. The tmux backup lands inside TPM's plugin directory — .tmux.conf:71

mv ~/.tmux/plugins/tpm ~/.tmux/plugins/tpm.bak-$(date +%s) puts the rescue copy in ~/.tmux/plugins/, which is exactly the directory TPM enumerates — clean_plugins targets unlisted directories there. Move it to ~/.tmux/ instead. Separately, install.sh and .tmux.conf now rescue the same directory to two different places by two different mechanisms ($BACKUP_DIR/.tmux/plugins/tpm vs ~/.tmux/plugins/tpm.bak-<epoch>).

c. $(date +%s) inside the if-shell string is untested. It should survive — tmux expands $VAR/${VAR} inside double quotes but not $(...), and the inner single quotes reach /bin/sh intact. Still, it's a path that only fires once and would fail silently, so it's worth one tmux source-file ~/.tmux.conf by hand — or sidestep it with a fixed tpm.bak name.

d. mv is unguarded — install.sh:361. The neighbouring git clone is wrapped in if, but the mv above it isn't; a permissions failure aborts the installer before Neovim, the extras and chsh.

e. linux-terminal.sh tests failures > 0 before configured == 0, so with two terminals present and one failing it returns 1 and never mentions the one that worked. Defensible either way.

---

Fix the CI preinstall problem and this is done — a/b are small and d is one word (||). Item a is the only one a user would actually notice.