Skip to content

Commit 20de4ff

Browse files
DicklesworthstoneDicklesworthstone
committed
Tighten Atuin guard metadata
1 parent be199c3 commit 20de4ff

10 files changed

Lines changed: 68 additions & 12 deletions

File tree

‎acfs.manifest.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -730,7 +730,7 @@ modules:
730730
node --version
731731
732732
- id: tools.atuin
733-
description: Atuin shell history (Ctrl-R superpowers)
733+
description: Atuin CLI with guarded agent-safe shim
734734
category: tools
735735
phase: 6
736736
run_as: target_user
@@ -741,13 +741,14 @@ modules:
741741
- base.system
742742
installed_check:
743743
run_as: target_user
744-
command: "test -x ~/.atuin/bin/atuin"
744+
command: "test -x ~/.atuin/bin/atuin && test -x \"${ACFS_BIN_DIR:-$HOME/.local/bin}/atuin\" && grep -Fq \"agent hook integration disabled by ACFS\" \"${ACFS_BIN_DIR:-$HOME/.local/bin}/atuin\""
745745
verified_installer:
746746
tool: atuin
747747
runner: sh
748748
args: ["--", "--non-interactive"]
749749
install:
750750
- |
751+
# acfs-summary: install Atuin guard wrapper
751752
real_bin="$HOME/.atuin/bin/atuin"
752753
primary_dir="${ACFS_BIN_DIR:-$HOME/.local/bin}"
753754
fallback_dir="$HOME/.local/bin"

‎apps/web/lib/generated/manifest-modules.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ export interface ManifestProvenanceMetadata {
3232

3333
export const manifestProvenance = {
3434
acfsVersion: "0.7.0",
35-
manifestSha256: "68ada50689c30f1a9212481f5a53da562d704ed881ad92658e68a41b52d421ec",
35+
manifestSha256: "0ea8f58cf9f79d6e8bc93b2b52ba90ca5f432105167d88fa70267bf7bfcf89ee",
3636
checksumsYamlSha256: "3c3f1fb130915218c4d1f3b567775986e7640a1daeb9ce8263485c9d546abc04",
3737
} as const satisfies ManifestProvenanceMetadata;
3838

@@ -262,7 +262,7 @@ export const manifestModules: ManifestModuleMetadata[] = [
262262
},
263263
{
264264
id: "tools.atuin",
265-
description: "Atuin shell history (Ctrl-R superpowers)",
265+
description: "Atuin CLI with guarded agent-safe shim",
266266
category: "tools",
267267
phase: 6,
268268
dependencies: [

‎packages/manifest/src/generate.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1538,6 +1538,12 @@ function updateShellQuoteState(line: string, initialState: ShellQuoteState): She
15381538
}
15391539

15401540
function summarizeShellBlock(blockLines: string[], fallback: string): string {
1541+
for (const line of blockLines) {
1542+
const match = line.trim().match(/^#\s*acfs-summary:\s*(.+)$/);
1543+
const summary = match?.[1]?.trim();
1544+
if (summary) return summary;
1545+
}
1546+
15411547
const topLevel: string[] = [];
15421548
let skippingFunction = false;
15431549
let skippingFunctionQuoteState: ShellQuoteState = { double: false, single: false };

‎scripts/generated/doctor_checks.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -330,7 +330,7 @@ declare -a MANIFEST_CHECKS=(
330330
"lang.rust.2 Rust nightly + cargo ~/.cargo/bin/rustup show | grep -q nightly required target_user"
331331
"lang.go Go toolchain go version required root"
332332
"lang.nvm nvm + latest Node.js export NVM_DIR=\"\$HOME/.nvm\"\\n[ -s \"\$NVM_DIR/nvm.sh\" ] && . \"\$NVM_DIR/nvm.sh\"\\nnode --version required target_user"
333-
"tools.atuin Atuin shell history (Ctrl-R superpowers) ~/.atuin/bin/atuin --version required target_user"
333+
"tools.atuin Atuin CLI with guarded agent-safe shim ~/.atuin/bin/atuin --version required target_user"
334334
"tools.zoxide Zoxide (better cd) command -v zoxide required target_user"
335335
"tools.ast_grep ast-grep (used by UBS for syntax-aware scanning) sg --version required target_user"
336336
"agents.claude Claude Code target_bin=\"\${ACFS_BIN_DIR:-\$HOME/.local/bin}\"\\n\"\$target_bin/claude\" --version || \"\$target_bin/claude\" --help required target_user"

‎scripts/generated/install_tools.sh‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -397,7 +397,7 @@ INSTALL_TOOLS_LAZYDOCKER
397397
log_success "tools.lazydocker installed"
398398
}
399399

400-
# Atuin shell history (Ctrl-R superpowers)
400+
# Atuin CLI with guarded agent-safe shim
401401
install_tools_atuin() {
402402
local module_id="tools.atuin"
403403
acfs_require_contract "module:${module_id}" || return 1
@@ -460,9 +460,10 @@ install_tools_atuin() {
460460
fi
461461
fi
462462
if [[ "${DRY_RUN:-false}" = "true" ]]; then
463-
log_info "dry-run: install: if [[ \"\${1:-}\" == \"history\" && ( \"\${2:-}\" == \"start\" || \"\${2:-}\" == \"end\" ) ]] && _acfs_atuin_agent_context; then (target_user)"
463+
log_info "dry-run: install: install Atuin guard wrapper (target_user)"
464464
else
465465
if ! run_as_target_shell <<'INSTALL_TOOLS_ATUIN'
466+
# acfs-summary: install Atuin guard wrapper
466467
real_bin="$HOME/.atuin/bin/atuin"
467468
primary_dir="${ACFS_BIN_DIR:-$HOME/.local/bin}"
468469
fallback_dir="$HOME/.local/bin"
@@ -542,7 +543,7 @@ for dir in "$primary_dir" "$fallback_dir"; do
542543
done
543544
INSTALL_TOOLS_ATUIN
544545
then
545-
log_error "tools.atuin: install command failed: if [[ \"\${1:-}\" == \"history\" && ( \"\${2:-}\" == \"start\" || \"\${2:-}\" == \"end\" ) ]] && _acfs_atuin_agent_context; then"
546+
log_error "tools.atuin: install command failed: install Atuin guard wrapper"
546547
return 1
547548
fi
548549
fi

‎scripts/generated/internal_checksums.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
declare -gA ACFS_INTERNAL_CHECKSUMS=(
1111
[scripts/lib/security.sh]="95366fc1c2497ff0e36a1f59f34621fdcec06f4da0ed439828ad601a626f4f75"
1212
[scripts/lib/agents.sh]="a6485afa0cf17d636ad7f049796a23821fb9c5dbf3640ec42ee9b1bb0a8628b4"
13-
[scripts/lib/update.sh]="b693b08ec49e822dcb540e94f8e8c6c6616ce79f31ac95d95cebcc4125d773d8"
13+
[scripts/lib/update.sh]="f310c474b5401acef9e502f71cf4ce3562788650299a189e025cffc990f8f681"
1414
[scripts/lib/doctor.sh]="0bb0626aba495c6688c2880db3306ff9a7f9b803d6ebf9d8ff8ddcc931e4ea79"
1515
[scripts/lib/doctor_fix.sh]="31a44ab36fe980d5c41edc6d25d88280f6d8d6bd1abc40ecac1a8e3e74bb864c"
1616
[scripts/lib/offline_artifact_pack.sh]="5f6fa7e5a9e115904656a627853b2c7d556183532a3d8fd42a0363bf3570c7eb"

‎scripts/generated/manifest_index.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
# ============================================================
77
# Data-only manifest index. Safe to source.
88

9-
ACFS_MANIFEST_SHA256="68ada50689c30f1a9212481f5a53da562d704ed881ad92658e68a41b52d421ec"
9+
ACFS_MANIFEST_SHA256="0ea8f58cf9f79d6e8bc93b2b52ba90ca5f432105167d88fa70267bf7bfcf89ee"
1010

1111
ACFS_MODULES_IN_ORDER=(
1212
"base.system"
@@ -521,7 +521,7 @@ declare -gA ACFS_MODULE_DESC=(
521521
['lang.rust']="Rust nightly + cargo"
522522
['lang.go']="Go toolchain"
523523
['lang.nvm']="nvm + latest Node.js"
524-
['tools.atuin']="Atuin shell history (Ctrl-R superpowers)"
524+
['tools.atuin']="Atuin CLI with guarded agent-safe shim"
525525
['tools.zoxide']="Zoxide (better cd)"
526526
['tools.ast_grep']="ast-grep (used by UBS for syntax-aware scanning)"
527527
['agents.claude']="Claude Code"
@@ -591,7 +591,7 @@ declare -gA ACFS_MODULE_INSTALLED_CHECK=(
591591
['lang.rust']="test -x ~/.cargo/bin/cargo"
592592
['lang.go']="command -v go"
593593
['lang.nvm']="test -d ~/.nvm && ls ~/.nvm/versions/node/ 2>/dev/null | grep -q ."
594-
['tools.atuin']="test -x ~/.atuin/bin/atuin"
594+
['tools.atuin']="test -x ~/.atuin/bin/atuin && test -x \"\${ACFS_BIN_DIR:-\$HOME/.local/bin}/atuin\" && grep -Fq \"agent hook integration disabled by ACFS\" \"\${ACFS_BIN_DIR:-\$HOME/.local/bin}/atuin\""
595595
['tools.zoxide']="command -v zoxide"
596596
['tools.ast_grep']="command -v sg"
597597
['agents.claude']="test -x \"\${ACFS_BIN_DIR:-\$HOME/.local/bin}/claude\" || test -x \"\$HOME/.local/bin/claude\""

‎scripts/lib/cli_tools.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,13 @@ _cli_normalize_atuin_shims() {
460460
for dir in "$primary_dir" "$fallback_dir"; do
461461
[[ -n "$dir" ]] || continue
462462
mkdir -p "$dir" 2>/dev/null || continue
463+
if [[ "${EUID:-$(id -u)}" -eq 0 && -n "$target_home" && "$dir" == "$target_home/"* ]]; then
464+
local chown_dir="$dir"
465+
while [[ "$chown_dir" == "$target_home/"* && "$chown_dir" != "$target_home" ]]; do
466+
chown "$target_user:$target_user" "$chown_dir" 2>/dev/null || chown "$target_user" "$chown_dir" 2>/dev/null || true
467+
chown_dir="${chown_dir%/*}"
468+
done
469+
fi
463470
if _cli_write_atuin_guard_wrapper "$dir/atuin" "$preferred_src"; then
464471
installed_wrapper=true
465472
if [[ "${EUID:-$(id -u)}" -eq 0 ]]; then

‎scripts/lib/update.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1317,6 +1317,13 @@ update_repair_atuin_install() {
13171317
for dir in "${bin_dirs[@]}"; do
13181318
[[ -n "$dir" ]] || continue
13191319
mkdir -p "$dir" 2>/dev/null || true
1320+
if [[ "${EUID:-$(id -u)}" -eq 0 && -n "$target_home" && "$dir" == "$target_home/"* ]]; then
1321+
local chown_dir="$dir"
1322+
while [[ "$chown_dir" == "$target_home/"* && "$chown_dir" != "$target_home" ]]; do
1323+
chown "$target_user:$target_user" "$chown_dir" 2>/dev/null || chown "$target_user" "$chown_dir" 2>/dev/null || true
1324+
chown_dir="${chown_dir%/*}"
1325+
done
1326+
fi
13201327
if update_write_atuin_guard_wrapper "$dir/atuin" "$preferred_src" 2>/dev/null; then
13211328
installed_wrapper=true
13221329
if [[ "${EUID:-$(id -u)}" -eq 0 ]]; then

‎tests/unit/lib/test_update.bats‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2848,6 +2848,40 @@ EOF
28482848
assert_success
28492849
}
28502850

2851+
@test "Atuin manifest metadata requires guarded shim" {
2852+
local manifest="$PROJECT_ROOT/acfs.manifest.yaml"
2853+
local manifest_index="$PROJECT_ROOT/scripts/generated/manifest_index.sh"
2854+
local install_tools="$PROJECT_ROOT/scripts/generated/install_tools.sh"
2855+
local web_manifest="$PROJECT_ROOT/apps/web/lib/generated/manifest-modules.ts"
2856+
2857+
run grep -F 'description: Atuin CLI with guarded agent-safe shim' "$manifest"
2858+
assert_success
2859+
2860+
run grep -F 'command: "test -x ~/.atuin/bin/atuin && test -x \"${ACFS_BIN_DIR:-$HOME/.local/bin}/atuin\"' "$manifest"
2861+
assert_success
2862+
2863+
run grep -F 'grep -Fq \"agent hook integration disabled by ACFS\" \"${ACFS_BIN_DIR:-$HOME/.local/bin}/atuin\"' "$manifest"
2864+
assert_success
2865+
2866+
run grep -F '# acfs-summary: install Atuin guard wrapper' "$manifest"
2867+
assert_success
2868+
2869+
run grep -F "['tools.atuin']=\"Atuin CLI with guarded agent-safe shim\"" "$manifest_index"
2870+
assert_success
2871+
2872+
run grep -F "agent hook integration disabled by ACFS" "$manifest_index"
2873+
assert_success
2874+
2875+
run grep -F 'dry-run: install: install Atuin guard wrapper' "$install_tools"
2876+
assert_success
2877+
2878+
run grep -F 'description: "Atuin CLI with guarded agent-safe shim"' "$web_manifest"
2879+
assert_success
2880+
2881+
run grep -F 'Atuin shell history (Ctrl-R superpowers)' "$manifest" "$manifest_index" "$web_manifest"
2882+
assert_failure
2883+
}
2884+
28512885
@test "sync_acfs_zsh_loader: removes duplicate local override sourcing" {
28522886
cat > "$HOME/.zshrc" <<'EOF'
28532887
# ACFS loader

0 commit comments

Comments
 (0)