acrogenesis
394c1371c9
Review of the previous commits turned up four places where the predicates and their tests disagreed with the tools they are modelling, each checked against udevadm verify, systemd-analyze verify and visudo -cf rather than against reading of the sources. An empty ExecStop= resets the list, so a unit an administrator neutralised that way runs nothing at shutdown and is no longer ours to remove; the predicate now tracks the last state instead of returning on the first home path it sees. A file whose last line ends in a backslash still carries a live directive for systemd, so the pending logical line is emitted at EOF; udev ignores such a line and sudo rejects the file outright, so this costs those two nothing. The scanner's taint pass now reads += appends, which its own comment already promised: the value of an append is no use, but a name that reaches a user root through one has to be judged on it. Two regression guards passed against the implementations they were written for. The udev continuation fixture put the whole RUN+= below the comment, so it matched whether or not the pending half was carried across; the split now falls inside the RUN+= value. The sudoers one kept its file on the strength of a spec above the comment, so it could not fail either; the hand-written spec now sits below. Both fail against a mutant that discards the pending line. The comment above the second also claimed a continued comment stays a comment, which visudo contradicts.
14 lines
516 B
Bash
14 lines
516 B
Bash
#!/bin/bash
|
|
|
|
# One hop between the expansion and the home path it carries. The token in the
|
|
# heredoc has no slash and the value never resolves to a literal path, so a scan
|
|
# that rescues unresolved values would exempt a unit baking the user's home into
|
|
# /etc/systemd/system.
|
|
helper="$HOME/.local/share/omarchy/bin/omarchy-agent"
|
|
|
|
# omarchy:heredoc-expands paths=none -- helper is just the agent command name
|
|
cat <<EOF | sudo tee /etc/systemd/system/omarchy-agent.service >/dev/null
|
|
[Service]
|
|
ExecStart=$helper
|
|
EOF
|