Plan: Mac app setup via Brewfile + toggle TUI + auth helpers by yulonglin · Pull Request #4 · yulonglin/dotfiles

yulonglin · 2026-06-16T16:28:38Z

Summary

Adds the implementation plan for one-command new-Mac app setup (no code yet — planning artifact pending approval).

The approach:

config/apps.conf registry (method · id · category · trust-tier · default · description · auth) → generates a committed config/Brewfile (casks + mas App Store apps + formulae).
gum toggle TUI (app-picker) bootstrapped right after Homebrew — browse descriptions, toggle apps, emit the Brewfile.
scripts/setup/auth-setup interactive post-install login/setup checklist.
Encodes the ChatGPT-derived trust policy: Homebrew + official casks only, no new taps, MAS for vendor App Store apps, tier tags, brew info before adding.

Resolved decisions

Prune: zerobrew + Coven/3rd-party-tap only. ty, zotero-mcp, experimental component stay.
Antivirus: Trellix = university-managed (checklist note, not Brewfile); Malwarebytes optional cask, default OFF.
Optional: Google Drive + WakaTime default OFF.
TUI: gum (fzf --preview as drop-in alt).

Full detail + verified app→cask/mas table in plans/2026-06-16-mac-app-setup-brewfile.md.

🤖 Draft — implementation to follow on plan approval.

https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

Generated by Claude Code

https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

coderabbitai · 2026-06-16T16:28:52Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cd212724-1082-403d-b15d-e6874f98e92c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/quirky-hypatia-wj5t9g

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-06-16T16:28:55Z

🤖 Hi @yulonglin, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

…rrection - Prefer Mac App Store > vendor download > cask (sandbox/least-privilege), cask only when unsandboxed system access needed or not on MAS - Antivirus: recommend Malwarebytes for personal use, skip heavy Trellix EDR, never run two real-time engines - Correct Bitwarden: cask exists for desktop; MAS only needed for Safari ext - Prune list finalized: zerobrew + Coven/tap only https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

github-actions · 2026-06-16T16:31:50Z

🤖 I'm sorry @yulonglin, but I was unable to process your request. Please see the logs for more details.

https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

- Install integrity vs runtime defense (Gatekeeper, sha256, XProtect already cover) - Enforce quarantine policy (no --no-quarantine) - spctl/codesign signature-verify step in auth-setup - LuLu optional outbound firewall (default OFF) - Harden curl|bash: prefer brew formula, else fetch-verify-run https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

- config/apps.conf: single-source registry (method|id|category|tier|default|name|desc|auth) for 34 GUI/App Store apps; official casks + mas only, no third-party taps - custom_bins/app-picker: gum toggle TUI reads apps.conf, generates config/Brewfile (brew/cask/mas sections); --defaults/--dry-run for non-interactive use - config/Brewfile: generated default selection (32 apps) - scripts/setup/auth-setup: post-install login checklist + spctl/codesign signature+notarization audit; App Store sign-in caveat documented

- install.sh: new --apps block (macOS) — bootstrap gum, run app-picker, brew bundle config/Brewfile; folds in Finicky. Points to auth-setup afterward. - config.sh: add 'apps' to INSTALL_REGISTRY (replaces standalone 'finicky' install component); drop INSTALL_FINICKY from server profile - Prune zerobrew (P1): remove install block, zb alias wrapper, experimental.yaml entry - Prune Coven + Crazytieguy/tap (P3): third-party tap violates no-new-taps policy (alignment-hive plugin marketplace left intact — separate, not a brew tap) - Harden uv install: prefer official brew formula on macOS over curl|bash (sha-pinned)

…UDE.md - supply-chain-security.md: GUI apps & Brewfile section (casks+mas only, no taps, MAS-first, never --no-quarantine, brew info before adding); curl|bash hardening (prefer formula > verify checksum > blind pipe; glance != integrity control) - CLAUDE.md: 'Install/manage Mac apps' quick-reference row

…ity control

… add FineTune; cull iTerm Gemini CLI consumer access ends 2026-06-18; Google's official successor is Antigravity CLI (agy). Wire both the official successor and OpenCode (OSS, multi-provider) into the ai-tools component. - helpers.sh: install_gemini_cli → install_opencode (core formula) + install_antigravity_cli (cask antigravity-cli; Linux = manual per curl|bash policy) - install.sh / config.sh / update-ai-tools / ai-check: swap Gemini → OpenCode + Antigravity - auto_commit_worker + ai_automation: backend order codex,gemini → codex,opencode - scripts: sync_claude_to_gemini.sh → sync_claude_to_antigravity.sh (skills → ~/.gemini/antigravity-cli/skills; AGENTS.md; permission sync flagged untested) - apps.conf: add FineTune (audio, OSS, default-OFF per young/single-maintainer rule) - supply-chain-security.md: add two-gate modernity/adoption selection rule - cull iTerm leftovers (itermcolors); remove GEMINI.md + gemini/ - README: Gemini CLI section → Antigravity CLI + OpenCode https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

…ce switching Core formula, OSS, no driver. Complements FineTune (per-app mixer) by handling system default input/output device switching, which FineTune's per-app URL schemes don't cover. Default OFF. https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

- install.sh/helpers.sh: factor install_rust_toolchain() — prefer official brew 'rustup' formula on macOS over curl|bash (mirrors uv hardening), keep TLS-pinned rustup installer as Linux/no-brew fallback. Both rustup call sites now consistent. - update-ai-tools/setup_ai_update.sh: add update_antigravity (brew --cask antigravity-cli on macOS, skip on Linux manual install). Closes the Gemini-> Antigravity migration gap in the daily AI-tools updater. - sync_claude_to_antigravity.sh: port the permission sync — map Claude permissions.{allow,deny,ask} to Antigravity action(target) rules, merge idempotently into ~/.gemini/antigravity-cli/settings.json. Uncertain mappings (web/mcp actions, glob-vs-exact) routed to a sidecar + TODO, not guessed. Mac-only verification still pending: brew formula/cask names, agy permission load, glob semantics. https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

- macos_settings.sh: keep Dock tweaks (autohide, instant-show, tilesize 48); revert the menu-bar clock reformat (minimal menu bar by preference). - config/login_items.conf: curated menu-bar apps to seed at login (Stats, FineTune, Tailscale, NordVPN). - scripts/setup/setup-login-items: additive/bootstrap-once helper. Adds a curated app as a login item only if missing AND not previously added (state file at ~/.config/dotfiles/login-items.bootstrapped); never removes, never re-adds what you removed manually, never runs on deploy. System Settings stays your daily driver. --list/--force/--reset-state supported. - auth-setup: surface setup-login-items in the post-install checklist. https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

- BLOCKER: 'local status' aborted --list mode — 'status' is a zsh read-only special var (alias for $?). Renamed to 'st'. (zsh -n can't catch this; it's a runtime, not parse, error — verified the old form dies with 'read-only variable'.) - SHOULD-FIX: whitespace trim only stripped a single leading/trailing space and missed tabs. Use extendedglob [[:space:]]## runs. Verified spaces+tabs trimmed. - Note the comma-in-display-name assumption in current_login_items. https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

yulonglin · 2026-06-17T04:37:22Z

Superseded by a 2-way split, rebased onto current main (which has since advanced past this branch's base):

feat(ai-tools): migrate Gemini CLI → Antigravity CLI + OpenCode #5 — feat(ai-tools): migrate Gemini CLI → Antigravity CLI + OpenCode (higher-risk half, isolated for independent revert)
feat(macos): one-command new-Mac app setup via Brewfile + picker TUI #6 — feat(macos): one-command new-Mac app setup via Brewfile + picker TUI (app setup + login items + dock + curl|bash hardening + zerobrew/iTerm pruning + plan doc)

Together they reconstruct this PR exactly (verified file-by-file), minus one cosmetic divergence (the ai-tools-block rust call stays inline instead of using the new install_rust_toolchain helper — identical behavior). Closing this in favor of the two.

🤖 Generated with Claude Code

Add plan: Mac app setup via Brewfile + toggle TUI + auth helpers

0667fb2

https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

claude added 11 commits June 16, 2026 16:33

Correct PopClip (MAS abandoned, use cask) and Spark (MAS not crippled)

ba80ce6

https://claude.ai/code/session_01SfjhAKQcQMoRvQRqh7QQTg

Clarify in plan: manual script inspection is a smell test, not integr…

7291a5b

…ity control

This was referenced Jun 17, 2026

feat(ai-tools): migrate Gemini CLI → Antigravity CLI + OpenCode #5

Merged

feat(macos): one-command new-Mac app setup via Brewfile + picker TUI #6

Merged

yulonglin closed this Jun 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Plan: Mac app setup via Brewfile + toggle TUI + auth helpers#4

Plan: Mac app setup via Brewfile + toggle TUI + auth helpers#4
yulonglin wants to merge 13 commits into
mainfrom
claude/quirky-hypatia-wj5t9g

yulonglin commented Jun 16, 2026

Uh oh!

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

yulonglin commented Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

yulonglin commented Jun 16, 2026

Summary

Resolved decisions

Uh oh!

coderabbitai Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

yulonglin commented Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading