feature/WR-18897-onboarding-dotfiles-hardening#49
Merged
abarrows merged 7 commits intoJun 28, 2026
Conversation
…nsions, quiet system_profiler From the Mac Mini provisioning review (WR-18897): - onboard.sh: add envrc_is_sourceable() so a malformed/old-template .envrc is backed up and regenerated instead of silently adopted — the bug that skipped the prompt and spammed "command not found" on every new shell. Prompt logic extracted into generate_envrc(). - extensions_base.txt: remove GitHub.copilot-chat (now a built-in extension, install conflicts), stkb.rewrap (fails marketplace signature verification), and ms-vscode-remote.remote-wsl (Windows-only, no-op on macOS). - starship.zsh: redirect system_profiler stderr to /dev/null so its hw.cpufamily diagnostic stops leaking into every new shell. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…COMPANY path resolve_repo used CURRENT_COMPANY from the calling shell's environment to decide the clone path, then ensure_envrc prompted the user for the real value — too late. If the calling shell had a stale CURRENT_COMPANY (e.g. from a prior job), the repo landed in the wrong directory and every alias derived from it resolved to a corrupt path. Fix: introduce collect_machine_vars, which runs before resolve_repo. It sources any existing valid .envrc (fast no-op on re-runs) or prompts the user and writes ~/.envrc, then sources it so CURRENT_COMPANY is correct before any path decision is made. ensure_envrc (post-clone) then moves ~/.envrc into $REPO_DIR as before. Additional hardening: - CURRENT_COMPANY prompt default is hardcoded to "Retail-Success" (the correct value for this repo), so a stale env var can never silently win. - IDE_PATH defaults to "code" (VS Code CLI); stale "vscode" values are normalised at both init and post-prompt time. - generate_envrc checks ~/.envrc first to prevent double-prompting on the malformed-repo-.envrc edge case. - Generated .envrc now covers the full variable set from .envrc.example (adds JIRA_API_TOKEN placeholder and GIT_EMAIL_ADDRESS_PERSONAL). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…script Stands up the Docker MCP gateway (stdio, no url/auth) and wires Claude Code to it, replicating the default profile's enabled servers. Includes interactive secret setup and a reboot-survival checklist (auto-login, Docker autostart, sleep prevention, keychain). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ed development support.
…Hermes Agent support.
…ocumentation for Mac Mini setup.
Contributor
Reviewer's GuideThis PR hardens dotfiles onboarding and environment setup, improves macOS shell behavior, and adds documented workflows plus a bootstrap script for configuring a Mac mini as a 24/7 MCP/Claude agent host, including Docker MCP toolkit and Claude Code wiring. Sequence diagram for mac-mini-mcp-bootstrap.sh wiring Docker MCP to Claude CodesequenceDiagram
actor User
participant Script as mac-mini-mcp-bootstrap.sh
participant DockerCLI as docker
participant ClaudeCLI as claude
participant Keychain as MacOSKeychain
User->>Script: bash mac-mini-mcp-bootstrap.sh
Script->>DockerCLI: docker --version
Script->>ClaudeCLI: claude --version
Script->>DockerCLI: docker info
Script->>DockerCLI: docker mcp profile server add default DEFAULT_SERVERS
Script->>DockerCLI: docker mcp profile server ls
Script->>Keychain: docker mcp secret set <key>
Script->>DockerCLI: docker mcp secret set github.personal_access_token
Script->>DockerCLI: docker mcp secret set github-chat.api_key
Script->>DockerCLI: docker mcp secret set atlassian.jira.api_token
Script->>DockerCLI: docker mcp secret set atlassian.confluence.api_token
Script->>DockerCLI: docker mcp oauth authorize <name>
Script->>DockerCLI: docker mcp client connect claude-code
Script->>ClaudeCLI: claude mcp list
ClaudeCLI-->>Script: MCP_DOCKER: docker mcp gateway run - Connected
Script-->>User: Done. Mac mini wired for 24_7 MCP/Claude host
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
…ardening Signed-off-by: Andrew Barrows <acbarrows@gmail.com>
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- Consider adding a
--dry-run/DRY_RUNmode tomac-mini-mcp-bootstrap.shso you can validate MCP wiring and prerequisites on new machines without mutating profiles or secrets during initial experimentation. - The hard-coded
DEFAULT_SERVERSlist inmac-mini-mcp-bootstrap.shmay not always match future profiles; consider making this configurable (e.g., via a config file or env var) and/or skipping servers that are already enabled to avoid unintended overwrites.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider adding a `--dry-run`/`DRY_RUN` mode to `mac-mini-mcp-bootstrap.sh` so you can validate MCP wiring and prerequisites on new machines without mutating profiles or secrets during initial experimentation.
- The hard-coded `DEFAULT_SERVERS` list in `mac-mini-mcp-bootstrap.sh` may not always match future profiles; consider making this configurable (e.g., via a config file or env var) and/or skipping servers that are already enabled to avoid unintended overwrites.
## Individual Comments
### Comment 1
<location path="ai/workflows/mac-mini-agent/mac-mini-mcp-bootstrap.sh" line_range="67-71" />
<code_context>
+# ── 3. Secrets — these do NOT transfer from the other Mac ────────────────────
+# Secrets live in the macOS Keychain on each machine. Set them here once.
+# Re-run any line as needed; value is read from stdin so it won't hit shell history.
+step "3. Secrets (set the ones you use; skip with Ctrl-D)"
+warn "These are stored in this Mac mini's keychain. They were NOT copied from your laptop."
+set_secret() {
+ local key="$1" label="$2"
+ read -r -s -p " ${label} (Enter to skip): " val; echo
+ if [[ -n "${val}" ]]; then
+ printf '%s' "${val}" | docker mcp secret set "${key}"
</code_context>
<issue_to_address>
**issue (bug_risk):** Ctrl-D behavior with `read` conflicts with `set -e` and will terminate the script.
The prompt advertises Ctrl-D as a way to skip, but with `set -e` a failed `read` on EOF (Ctrl-D) returns non-zero and exits the script. To preserve the intended skip behavior, make `read` non-fatal (e.g. `read -r -s -p ... val || val=""`) or gate the subsequent logic on `[[ -n $val ]]` so Ctrl-D/EOF is treated like a skip rather than aborting the bootstrap.
</issue_to_address>
### Comment 2
<location path="ai/workflows/mac-mini-agent/mac-mini-mcp-bootstrap.sh" line_range="89-94" />
<code_context>
+
+# ── 4. Connect Claude Code to the gateway (the easy way) ─────────────────────
+step "4. Wiring Claude Code to the Docker MCP gateway"
+docker mcp client connect claude-code
+# Equivalent manual form (stdio, no url/auth):
+# claude mcp add MCP_DOCKER -- docker mcp gateway run
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Making `docker mcp client connect claude-code` idempotent would avoid failures on re-run.
With `set -euo pipefail`, a second run will exit if the client is already connected. Please make this step tolerant of the "already connected" case (e.g. `docker mcp client connect claude-code || warn "Claude client already connected"`) so the script is safely re-runnable.
```suggestion
# ── 4. Connect Claude Code to the gateway (the easy way) ─────────────────────
step "4. Wiring Claude Code to the Docker MCP gateway"
docker mcp client connect claude-code || warn "Claude client already connected; continuing"
# Equivalent manual form (stdio, no url/auth):
# claude mcp add MCP_DOCKER -- docker mcp gateway run
bold " Connected. Verify with: claude mcp list"
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+67
to
+71
| step "3. Secrets (set the ones you use; skip with Ctrl-D)" | ||
| warn "These are stored in this Mac mini's keychain. They were NOT copied from your laptop." | ||
| set_secret() { | ||
| local key="$1" label="$2" | ||
| read -r -s -p " ${label} (Enter to skip): " val; echo |
Contributor
There was a problem hiding this comment.
issue (bug_risk): Ctrl-D behavior with read conflicts with set -e and will terminate the script.
The prompt advertises Ctrl-D as a way to skip, but with set -e a failed read on EOF (Ctrl-D) returns non-zero and exits the script. To preserve the intended skip behavior, make read non-fatal (e.g. read -r -s -p ... val || val="") or gate the subsequent logic on [[ -n $val ]] so Ctrl-D/EOF is treated like a skip rather than aborting the bootstrap.
Comment on lines
+89
to
+94
| # ── 4. Connect Claude Code to the gateway (the easy way) ───────────────────── | ||
| step "4. Wiring Claude Code to the Docker MCP gateway" | ||
| docker mcp client connect claude-code | ||
| # Equivalent manual form (stdio, no url/auth): | ||
| # claude mcp add MCP_DOCKER -- docker mcp gateway run | ||
| bold " Connected. Verify with: claude mcp list" |
Contributor
There was a problem hiding this comment.
suggestion (bug_risk): Making docker mcp client connect claude-code idempotent would avoid failures on re-run.
With set -euo pipefail, a second run will exit if the client is already connected. Please make this step tolerant of the "already connected" case (e.g. docker mcp client connect claude-code || warn "Claude client already connected") so the script is safely re-runnable.
Suggested change
| # ── 4. Connect Claude Code to the gateway (the easy way) ───────────────────── | |
| step "4. Wiring Claude Code to the Docker MCP gateway" | |
| docker mcp client connect claude-code | |
| # Equivalent manual form (stdio, no url/auth): | |
| # claude mcp add MCP_DOCKER -- docker mcp gateway run | |
| bold " Connected. Verify with: claude mcp list" | |
| # ── 4. Connect Claude Code to the gateway (the easy way) ───────────────────── | |
| step "4. Wiring Claude Code to the Docker MCP gateway" | |
| docker mcp client connect claude-code || warn "Claude client already connected; continuing" | |
| # Equivalent manual form (stdio, no url/auth): | |
| # claude mcp add MCP_DOCKER -- docker mcp gateway run | |
| bold " Connected. Verify with: claude mcp list" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Related Links
Summary by Sourcery
Introduce a documented plan and bootstrap script for setting up a 24/7 Mac mini local-AI agent host using Docker MCP Toolkit and Claude Code, aligned with existing dotfiles onboarding work.
New Features:
Documentation: