no caching in test containers

AGENTS.md

@@ -8,7 +8,7 @@ Only entries that would be missed without explicit help are included.
 
 - **Dotfiles** for a personal workstation (hyprland + Neovim + VST plugin).
 - No CI or build scripts – the repo is purely configuration data; the only executable content is the `install_*` scripts and the `test/` harness.
-- **Testing** lives in `test/`. Run `make test-lint` / `make test-stow` (offline, no Docker) or `make test-smoke` (Docker-based, see `test/Dockerfile` and `README.md → Testing`). The harness currently surfaces pre-existing Makefile bugs by design (missing `/` in `install_*` script paths, `stow nvim` with no `nvim/` package).
+- **Testing** lives in `test/`. `make test` runs the offline lint plus the Docker smoke with the real pacman install (`REAL_SMOKE=1`); `make test-lint` / `make test-stow` are the fast offline subset, and `make test-smoke REAL_SMOKE=0` runs dry probes only (see `test/Dockerfile` and `README.md → Testing`).
 
 ---
 ## 2. System Setup

Makefile

@@ -1,23 +1,33 @@
-# setup ist ein Kommando-Target (keine Datei) und soll immer ausgeführt werden.
+# Alle Targets sind Kommando-Targets (keine Dateien) und werden immer ausgeführt.
-.PHONY: basic
+.PHONY: basic term utils hypr kreation buntes-monster
 
-term:
+# basic wird immer zuerst eingerichtet: es legt die Basis-Systemumgebung an
+# (multilib, yay, Display-Manager, Audio-Stack), von der alle anderen
+# Zweige abhaengen. Die uebrigen Ziele haengen nur von basic ab und sind
+# untereinander unabhaengig.
+basic:
+	bash basic/setup.sh
+
+term: basic
 	bash term/setup.sh
 	stow term
-basic: term
+
-	bash _install_skripte_install_basic_pcks.sh
+utils: basic
-	stow nvim
+	bash utils/setup.sh
 	bash _install_skripte/nextcloud.sh
+
 hypr: basic
-	bash _install_skripte_install_hypr_pcks.sh 
+	bash _install_skripte/install_hypr_pcks.sh
 	stow hypr
 	bash hypr/.config/hypr/scripts/ensure-env.sh
 	bash hypr/.config/hypr/scripts/portal-host-override.sh
 	bash hypr/.config/hypr/scripts/fix_dolphin_file_associations.sh
+
 kreation: basic
-	bash _install_skripte_install_kreation_pcks.sh
+	bash _install_skripte/install_kreation_pcks.sh
 	stow kreation
-bunters-monster: basic hypr kreation
+
+buntes-monster: hypr kreation
 	_install_skripte/buntes-monster-links.sh
 
 # ---------------------------------------------------------------------------
@@ -25,7 +35,8 @@ bunters-monster: basic hypr kreation
 # ---------------------------------------------------------------------------
 .PHONY: test test-lint test-smoke test-stow test-shellcheck test-lint-docker
 
-# Full test suite: fast offline lint first, then the optional Docker smoke.
+# Full test suite: offline lint first, then the Docker smoke (which by
+# default runs the real install + verification; see test-smoke below).
 test: test-lint test-smoke
 
 # Fast, offline integrity checks. No Docker required.
@@ -48,14 +59,19 @@ test-lint-docker:
 	docker run --rm dotfiles-lint
 
 # Docker smoke test: builds the Arch container and runs the dry probes.
-#   RUN_SMOKE=1  also installs the real pacman packages inside the container.
+#   By default (REAL_SMOKE=1) it also installs the real pacman packages inside
-#   RUN_SMOKE=1 RUN_FULL=1  additionally attempts AUR/npm + hypr/kreation.
+#   the container and verifies them, so a plain `make test` actually exercises
-#   SKIP_NET=1   skips anything that contacts the network.
+#   the install path. Set REAL_SMOKE=0 (or RUN_SMOKE=0) for the fast dry-probe
-# Example:  make test-smoke RUN_SMOKE=1
+#   run. RUN_FULL=1 additionally attempts AUR/npm + hypr/kreation. SKIP_NET=1
+#   skips anything that contacts the network.
+# Example:  make test-smoke            # real term package install + verify
+#           make test-smoke REAL_SMOKE=0   # dry probes only
+#           make test-smoke RUN_FULL=1 # full AUR/npm + hypr/kreation
+REAL_SMOKE ?= 1
 test-smoke:
 	docker build --target test -t dotfiles-test -f test/Dockerfile .
 	docker run --rm \
-		-e RUN_SMOKE="$${RUN_SMOKE:-0}" \
+		-e RUN_SMOKE="$${RUN_SMOKE:-$(REAL_SMOKE)}" \
 		-e RUN_FULL="$${RUN_FULL:-0}" \
 		-e SKIP_NET=$${SKIP_NET:-0} \
 		-v "$$PWD":/dotfiles \

README.md

@@ -140,14 +140,14 @@ There are **two tiers**:
 | `make test-stow` | `stow --simulate` for every stow-able package; fails if a package the Makefile stows doesn't exist (e.g. `stow nvim` — nvim lives under `term/`). | No |
 | `make test-shellcheck` | Runs shellcheck over all tracked scripts (shellcheck must be installed). | No |
 | `make test-lint-docker` | Builds the `/dev` stage (`archlinux:latest` + shellcheck) and runs `test/lint.sh` inside it. | Yes |
-| `make test-smoke` | Builds the `/test` stage and runs the container's dry probes: `make -n` over every target, `stow --simulate` over every Makefile-stowed package, plus `test/lint.sh`. A network-enabled `RUN_SMOKE=1` variant installs the real pacman packages. | Yes |
+| `make test-smoke` | Builds the `/test` stage, runs the container's dry probes (`make -n` over every target, `stow --simulate` over every Makefile-stowed package, `test/lint.sh`), **and by default installs the real pacman packages** (`REAL_SMOKE=1`) then verifies them. | Yes |
-| `make test` | `test-lint` + `test-smoke`. | Partially |
+| `make test` | `test-lint` + `test-smoke` (the real install runs). | Partially |
 
 ### Docker smoke details
 
 ```bash
-make test-smoke                     # dry probes only (fast, no installs)
+make test-smoke                     # real pacman install of the term packages + verify
-make test-smoke RUN_SMOKE=1         # + real pacman installs of the term packages
+make test-smoke REAL_SMOKE=0        # dry probes only (fast, no installs)
 make test-smoke RUN_SMOKE=1 RUN_FULL=1   # + AUR/npm + hypr/kreation/buntes-monster
 make test-smoke SKIP_NET=1          # skip anything that contacts the network
 ```
@@ -159,24 +159,19 @@ The container:
   scripts don't hang on a password prompt,
 - mounts the live repo at `/dotfiles` (`-v "$PWD":/dotfiles`), so the tests
   always run against your current checkout,
-- stubs host daemon commands (`systemctl`, `updatedb`, `kbuildsycoca6`,
+- stubs host-dependent commands as no-ops so nothing talks to a real systemd/dbus
-  `dbus-update-activation-environment`) as no-ops so nothing talks to a real
+  inside the container (`systemctl`, `updatedb`, `kbuildsycoca6`,
-  systemd/dbus inside the container.
+  `dbus-update-activation-environment`, `chsh`), and routes `yay` through
+  `pacman` for the pacman-only smoke.
 
-In the `RUN_SMOKE=1` install path, the harness additionally **verifies the
+In the `REAL_SMOKE=1` (default) install path, the harness additionally
-installed packages** (`test/verify_packages.sh`):
+**verifies the installed packages** (`test/verify_packages.sh`):
 - every `@pacman` entry is confirmed via `pacman -Q <pkg>` (covers fonts,
   libs and python modules that ship no binary),
 - a curated mapping probes each package's binary with a real
   `--version`-style call (e.g. `fish --version`, `nvim --version`,
   `ssh -V`), failing if the binary is missing or does not report a version.
 
-> **Note for the current repo state:** `make test-lint` and `make test-smoke`
-> currently **fail** because the harness surfaces pre-existing Makefile bugs
-> (missing `/` in the `install_*` script paths and `stow nvim` for a
-> non-existent `nvim/` package). That is the intended behaviour — fix the
-> Makefile and the tests should go green.
-
 ---
 
 **When in doubt:** run `stow --verbose --simulate <target>` first — it prints what would happen (linking) without changing anything. Never `rm -rf` the `~/.config` of something you still want to keep; move it to a backup directory instead.

_install_skripte/install_basic_pcks.sh

@@ -1,41 +0,0 @@
-#!/bin/bash
-
-sudo pacman -S --needed \
-    firefox \
-    nextcloud-client \
-    cups \
-    wine \
-    wine-mono \
-    wine-gecko \
-    winetricks \
-    thunderbird \
-    ktouch \
-    ktorrent \
-    pipewire \
-    pipewire-session-manager \
-    qpwgraph \
-    cifs-utils \
-    rbw \
-    sddm
-
-yay -S \
-    catppuccin-sddm-theme-mocha
-
-echo "
-[General]
-Numlock=on
-
-[Theme]
-ThemeDir=/usr/share/sddm/themes            # Standardverzeichnis für Designvorlagen
-Current=catppuccin-mocha-blue              # Standardthema
-CursorTheme=breeze_cursors                 # Mausthema
-FacesDir=/usr/share/sddm/faces             # Verzeichnis für Avatarbilder
-
-[Users]
-MaximumUID=1100
-HideUsers=mathieu
-" | sudo tee /etc/sddm.conf
-
-sudo systemctl disable gdm
-sudo systemctl enable sddm
-

_install_skripte/nextcloud.sh

@@ -1,8 +1,9 @@
+#!/bin/bash
 
 retry() {
     local N=$1; shift
     local t=$2; shift
-    for i in $(seq 1 $N); do
+    for _ in $(seq 1 $N); do
         "$@" && return 0 || sleep $t
     done
     return 1

basic/packages.txt

@@ -0,0 +1,23 @@
+# ---------------------------------------------------------------------------
+# System package list for basic/setup.sh
+#
+# Every other dotfile branch depends on these foundational packages
+# (base system, display manager, audio stack, AUR helper).
+# `basic` is always set up first in the Makefile.
+#
+#   - Lines starting with '#' and blank lines are ignored.
+#   - Use "@pacman", "@aur" or "@npm" markers to switch section.
+#   - The default section is @pacman.
+# ---------------------------------------------------------------------------
+
+@pacman
+sddm
+firefox
+cups
+pipewire
+pipewire-session-manager
+qpwgraph
+cifs-utils
+
+@aur
+catppuccin-sddm-theme-mocha

basic/setup.sh

@@ -0,0 +1,142 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PACKAGES_FILE="$SCRIPT_DIR/packages.txt"
+
+# ---------------------------------------------------------------------------
+# Enable multilib in /etc/pacman.conf (with a safety backup)
+# ---------------------------------------------------------------------------
+enable_multilib() {
+    sudo sed -i.bak '/^#\[multilib\]/,+1 s/^#//' /etc/pacman.conf
+}
+
+# ---------------------------------------------------------------------------
+# Ensure yay (AUR helper) is installed.
+# ---------------------------------------------------------------------------
+install_yay() {
+    if pacman -Q yay &>/dev/null; then
+        echo "yay bereits installiert; fahre fort."
+        return
+    fi
+    if pacman -Si yay &>/dev/null; then
+        echo "Installiere yay mit pacman ..."
+        sudo pacman -S --needed yay
+        return
+    fi
+    echo "installiere yay via git ..."
+    sudo pacman -S --needed base-devel git
+    local tmp
+    tmp="$(mktemp -d)"
+    git clone https://aur.archlinux.org/yay.git "$tmp/yay"
+    (
+        cd "$tmp/yay"
+        makepkg -si
+    )
+    rm -rf "$tmp"
+}
+
+# ---------------------------------------------------------------------------
+# Read packages.txt, split into pacman / aur / npm sections.
+# ---------------------------------------------------------------------------
+read_packages() {
+    local section="pacman"
+    local current
+    current=""
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        current="${line%%#*}"
+        current="${current##*( )}"
+        current="${current%%*( )}"
+        [[ -z "$current" ]] && continue
+        case "$current" in
+            @pacman) section="pacman" ;;
+            @aur)    section="aur" ;;
+            @npm)    section="npm" ;;
+            *)
+                case "$section" in
+                    pacman) pacman_pkgs+=("$current") ;;
+                    aur)    aur_pkgs+=("$current") ;;
+                    npm)    npm_pkgs+=("$current") ;;
+                esac
+                ;;
+        esac
+    done < "$PACKAGES_FILE"
+}
+
+declare -a pacman_pkgs=() aur_pkgs=() npm_pkgs=()
+
+# ---------------------------------------------------------------------------
+# Install sections.
+# ---------------------------------------------------------------------------
+install_pacman() {
+    if ((${#pacman_pkgs[@]})); then
+        echo "==> Installiere Pacman-Pakete: ${pacman_pkgs[*]}"
+        yay -S --needed "${pacman_pkgs[@]}"
+    fi
+}
+
+install_aur() {
+    if ((${#aur_pkgs[@]})); then
+        echo "==> Installiere AUR-Pakete: ${aur_pkgs[*]}"
+        yay -S --needed "${aur_pkgs[@]}"
+    fi
+}
+
+install_npm() {
+    if ((${#npm_pkgs[@]})); then
+        echo "==> Installiere globale npm-Pakete: ${npm_pkgs[*]}"
+        npm install -g "${npm_pkgs[@]}"
+    fi
+}
+
+# ---------------------------------------------------------------------------
+# Write SDDM configuration and switch display manager from gdm to sddm.
+# ---------------------------------------------------------------------------
+configure_sddm() {
+    echo "==> Schreibe /etc/sddm.conf ..."
+    echo "
+[General]
+Numlock=on
+
+[Theme]
+ThemeDir=/usr/share/sddm/themes            # Standardverzeichnis für Designvorlagen
+Current=catppuccin-mocha-blue              # Standardthema
+CursorTheme=breeze_cursors                 # Mausthema
+FacesDir=/usr/share/sddm/faces             # Verzeichnis für Avatarbilder
+
+[Users]
+MaximumUID=1100
+HideUsers=mathieu
+" | sudo tee /etc/sddm.conf >/dev/null
+
+    echo "==> Deaktiviere gdm, aktiviere sddm ..."
+    sudo systemctl disable gdm
+    sudo systemctl enable sddm
+}
+
+# ---------------------------------------------------------------------------
+# Main
+# ---------------------------------------------------------------------------
+main() {
+    echo "==> Aktiviere multilib ..."
+    enable_multilib
+
+    echo "==> System aktualisieren ..."
+    sudo pacman -Syu
+
+    echo "==> Sicherstelle yay ..."
+    install_yay
+
+    echo "==> Lese Paketliste: $PACKAGES_FILE"
+    read_packages
+
+    install_pacman
+    install_aur
+    install_npm
+
+    configure_sddm
+
+    echo "Fertig. Die Basis-Systemumgebung ist eingerichtet."
+}
+
+main

term/.config/tmux/layouts/demo.session.sh

@@ -1,3 +1,4 @@
+#!/bin/bash
 # Example session: demo
 # Usage: tmuxifier load-session demo
 # Edit:  tmuxifier edit-session demo

term/setup.sh

@@ -4,38 +4,6 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PACKAGES_FILE="$SCRIPT_DIR/packages.txt"
 
-# ---------------------------------------------------------------------------
-# Enable multilib in /etc/pacman.conf (with a safety backup)
-# ---------------------------------------------------------------------------
-enable_multilib() {
-    sudo sed -i.bak '/^#\[multilib\]/,+1 s/^#//' /etc/pacman.conf
-}
-
-# ---------------------------------------------------------------------------
-# Ensure yay (AUR helper) is installed.
-# ---------------------------------------------------------------------------
-install_yay() {
-    if pacman -Q yay &>/dev/null; then
-        echo "yay bereits installiert; fahre fort."
-        return
-    fi
-    if pacman -Si yay &>/dev/null; then
-        echo "Installiere yay mit pacman ..."
-        sudo pacman -S --needed yay
-        return
-    fi
-    echo "installiere yay via git ..."
-    sudo pacman -S --needed base-devel git
-    local tmp
-    tmp="$(mktemp -d)"
-    git clone https://aur.archlinux.org/yay.git "$tmp/yay"
-    (
-        cd "$tmp/yay"
-        makepkg -si
-    )
-    rm -rf "$tmp"
-}
-
 # ---------------------------------------------------------------------------
 # Read packages.txt, split into pacman / aur / npm sections.
 # ---------------------------------------------------------------------------
@@ -125,15 +93,8 @@ add_yazi_git_plugin() {
 # Main
 # ---------------------------------------------------------------------------
 main() {
-    echo "==> Aktiviere multilib ..."
+    # Hinweis: multilib, yay und das System-Update werden von
-    enable_multilib
+    # basic/setup.sh uebernommen (laeuft vor term im Makefile).
-
-    echo "==> System aktualisieren ..."
-    sudo pacman -Syu
-
-    echo "==> Sicherstelle yay ..."
-    install_yay
-
     echo "==> Lese Paketliste: $PACKAGES_FILE"
     read_packages
 

test/Dockerfile

@@ -32,15 +32,23 @@ RUN pacman -Syu --noconfirm \
         sudo \
     && pacman -Scc --noconfirm
 
-RUN useradd -m -u "$UID_ARG" -s /bin/bash -G wheel "$USERNAME"
+# Remove the /etc/skel profile files so `useradd -m` starts the test user with
+# a truly empty HOME: the term package owns .bashrc/.bash_profile, and stow
+# must be able to take ownership of them without conflicting with copied files.
+RUN rm -f /etc/skel/.bashrc /etc/skel/.bash_profile /etc/skel/.bash_logout \
+    && useradd -m -u "$UID_ARG" -s /bin/bash -G wheel "$USERNAME"
 
 # Passwordless sudo so scripts that call `sudo pacman`, `sudo systemctl`, etc.
 # do not hang on a password prompt inside the container.
 RUN printf '%%wheel ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/wheel-nopasswd \
     && chmod 440 /etc/sudoers.d/wheel-nopasswd
 
-USER "$USERNAME"
+# Use a literal (not the ARG) for USER/ENV: the legacy builder can silently
-ENV HOME="/home/$USERNAME"
+# ignore a `USER "$ARG"` when the variable resolves after a stage boundary,
+# leaving the container running as root (which breaks git ownership checks on
+# the mounted host-owned repo). The value is fixed at mathias by default anyway.
+USER mathias
+ENV HOME="/home/mathias"
 WORKDIR /dotfiles
 
 # ---------------------------------------------------------------------------
@@ -51,10 +59,10 @@ FROM base AS dev
 USER root
 RUN pacman -S --noconfirm --needed shellcheck
 
-USER "$USERNAME"
+USER mathias
 WORKDIR /dotfiles
 
-COPY --chown="$USERNAME" . /dotfiles
+COPY --chown=mathias . /dotfiles
 
 CMD ["bash", "test/lint.sh"]
 
@@ -65,7 +73,7 @@ CMD ["bash", "test/lint.sh"]
 # ---------------------------------------------------------------------------
 FROM base AS test
 
-USER "$USERNAME"
+USER mathias
 WORKDIR /dotfiles
 
 # The entrypoint drives the smoke tests. The repo is mounted at /dotfiles

test/entrypoint-test.sh

@@ -42,6 +42,12 @@ say_ok()  { printf '  ok:   %s\n' "$*"; PASS=$((PASS+1)); }
 say_fail(){ printf '  FAIL: %s\n' "$*"; FAIL=$((FAIL+1)); }
 header()  { printf '\n==== %s ====\n' "$*"; }
 
+# Scratch file for captured stderr; kept OUTSIDE the repo mount so it never
+# leaks into the host workspace (the mount is /dotfiles).
+ERR_LOG="$(mktemp -t entrypoint.XXXXXX)"
+cleanup() { rm -f "$ERR_LOG"; }
+trap cleanup EXIT
+
 if command -v git >/dev/null 2>&1 && [[ ! -d .git ]]; then
     # when mounted from a worktree, .git may be a file; fine.
     :
@@ -59,25 +65,23 @@ header "Dry probes"
 targets=$(grep -oE '^[A-Za-z0-9_-]+:' Makefile | tr -d ':' | grep -v '^test' | sort -u)
 for target in $targets; do
     # `make -n` must not error out from missing scripts / dirs.
-    if ( cd "$REPO" && make -n "$target" >/dev/null 2>err.txt ); then
+    if ( cd "$REPO" && make -n "$target" >/dev/null 2>"$ERR_LOG" ); then
         say_ok "make -n $target parses"
     else
         say_fail "make -n $target (typo? missing script?)"
-        sed 's/^/      /' err.txt 2>/dev/null
+        sed 's/^/      /' "$ERR_LOG" 2>/dev/null
     fi
-    rm -f err.txt
 done
 
 # 1b. stow --simulate for every package the Makefile stows.
 while IFS= read -r pkg; do
     [[ -z "$pkg" ]] && continue
-    if stow --simulate --dir="$REPO" --target="$REPO" "$pkg" 2>err.txt; then
+    if stow --simulate --dir="$REPO" --target="$REPO" "$pkg" 2>"$ERR_LOG"; then
         say_ok "stow --simulate $pkg resolves"
     else
         say_fail "stow --simulate $pkg (non-existent package or conflict)"
-        sed 's/^/      /' err.txt 2>/dev/null
+        sed 's/^/      /' "$ERR_LOG" 2>/dev/null
     fi
-    rm -f err.txt
 done < <(grep -P '^\t' Makefile | grep -oE 'stow [A-Za-z0-9_-]+' | awk '{print $2}' | sort -u)
 
 # 1c. run the repo's own lint + probe scripts (they're mounted here).
@@ -125,27 +129,45 @@ NOOP
 #!/bin/bash
 echo "[stub] updatedb $*"
 exit 0
+NOOP
+    # chsh has no functional /etc/passwd in the container; make it a no-op so
+    # set_fish_default_shell doesn't fail (documented in the header comment).
+    cat > "$HOME/bin/chsh" <<'NOOP'
+#!/bin/bash
+echo "[stub] chsh $*"
+exit 0
+NOOP
+    # The AUR section is stripped for the pacman-only smoke, so term/setup.sh
+    # only ever passes repo packages here; route yay through pacman directly.
+    # --noconfirm is needed because the container isn't interactive.
+    cat > "$HOME/bin/yay" <<'NOOP'
+#!/bin/bash
+echo "[stub] yay $* (routed through pacman)"
+exec sudo pacman --noconfirm "$@"
 NOOP
     chmod +x "$HOME/bin/"*
     export PATH="$HOME/bin:$PATH"
 
-    # 2c. term/setup.sh package parsing sanity (mirrors read_packages).
+    # 2c. setup.sh package parsing sanity (mirrors read_packages) for each
-    if ( cd "$REPO" && bash -n term/setup.sh ); then
+    # package dir: basic/term/utils.
-        say_ok "term/setup.sh syntax OK"
+    for d in basic term utils; do
-    else
+        if ( cd "$REPO" && bash -n "$d/setup.sh" ); then
-        say_fail "term/setup.sh syntax error"
+            say_ok "$d/setup.sh syntax OK"
-    fi
+        else
-    pacman_count=$(awk '
+            say_fail "$d/setup.sh syntax error"
-        /^@pacman/{s="pacman"}
+        fi
-        /^@aur/{s="aur"}
+        pacman_count=$(awk '
-        /^@npm/{s="npm"}
+            /^@pacman/{s="pacman"}
-        /^[[:space:]]*#/{next}
+            /^@aur/{s="aur"}
-        /^[[:space:]]*$/{next}
+            /^@npm/{s="npm"}
-        s=="pacman"{pc++} s=="aur"{ac++} s=="npm"{nc++}
+            /^[[:space:]]*#/{next}
-        END{printf "%d %d %d", pc,ac,nc}
+            /^[[:space:]]*$/{next}
-    ' $REPO/term/packages.txt)
+            s=="pacman"{pc++} s=="aur"{ac++} s=="npm"{nc++}
-    read -r PC AC NC <<< "$pacman_count"
+            END{printf "%d %d %d", pc,ac,nc}
-    say_ok "packages.txt -> ${PC} pacman, ${AC} aur, ${NC} npm entries"
+        ' "$REPO/$d/packages.txt")
+        read -r PC AC NC <<< "$pacman_count"
+        say_ok "$d/packages.txt -> ${PC} pacman, ${AC} aur, ${NC} npm entries"
+    done
 
     # 2d. If network allowed and not skipped, actually install the pacman
     # section of term/setup.sh (mirrors `make term` without AUR/npm).
@@ -192,15 +214,18 @@ NOOP
 
     # 2e. stow --actual into $HOME to prove real symlinks are created.
     header "stow real symlinks into \$HOME"
+    # term/setup.sh may have just re-created the yazi plugin (`ya pkg add`)
+    # as real files. The repo vendors the same plugin under term/.config/yazi,
+    # so drop the duplicate first, letting stow take ownership of that config.
+    rm -rf "$HOME/.config/yazi"
     for pkg in term hypr kreation local_ai; do
         if [[ -d "$REPO/$pkg" ]]; then
-            if stow --dir="$REPO" --target="$HOME" "$pkg" 2>err.txt; then
+            if stow --dir="$REPO" --target="$HOME" "$pkg" 2>"$ERR_LOG"; then
                 say_ok "stow $pkg into \$HOME"
             else
                 say_fail "stow $pkg into \$HOME"
-                sed 's/^/      /' err.txt 2>/dev/null
+                sed 's/^/      /' "$ERR_LOG" 2>/dev/null
             fi
-            rm -f err.txt
         else
             say_fail "package dir missing: $pkg"
         fi

test/lint.sh

@@ -11,8 +11,7 @@
 set -uo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-CD="$(pwd)"
+cd "$REPO_ROOT" || exit 1
-cd "$REPO_ROOT"
 
 PASS=0
 FAIL=0
@@ -25,11 +24,19 @@ say_pass() { printf 'ok:   %s\n' "$*"; PASS=$((PASS+1)); }
 #    Only repo-owned scripts; skip vendored tpm/ plugin shell scripts.
 #    Preferred source is git ls-files (the repo checkout); fall back to a
 #    filesystem scan when .git is not present (e.g. inside the docker dev
-#    image, where the repo is COPYied without .git).
+#    image, where the repo is COPYied without .git). Note: git ls-files can
+#    also silently return nothing when the mount has dubious ownership, so the
+#    fallback must stay robust by excluding vendored plugin trees ('*/plugins/').
 # ---------------------------------------------------------------------------
-mapfile -t SCRIPTS < <(git ls-files '*.sh' 2>/dev/null | grep -v '/tpm/' | grep -vE '/plugins/[^/]+/scripts/')
+# Exclusions: never lint tpm or general vendored plugin trees, whose third-party
+# scripts may legitimately fail `bash -n` and are not written/maintained here.
+EXCLUDE_VENDOR='(/tpm/|/plugins/|/plugins$)'
+mapfile -t SCRIPTS < <(git ls-files '*.sh' 2>/dev/null | grep -vE "$EXCLUDE_VENDOR")
 if [[ ${#SCRIPTS[@]} -eq 0 ]]; then
-    mapfile -t SCRIPTS < <(find . -name '*.sh' -not -path './.git/*' -not -path '*/tpm/*' -not -path '*/.git/*' | sort)
+    mapfile -t SCRIPTS < <(find . -name '*.sh' \
+        -not -path './.git/*' -not -path '*/.git/*' \
+        -not -path '*/tpm/*' -not -path '*/plugins/*' \
+        | sort)
 fi
 
 if [[ ${#SCRIPTS[@]} -eq 0 ]]; then
@@ -70,23 +77,29 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# 4. packages.txt parsing sanity (mirrors term/setup.sh read_packages).
+# 4. packages.txt parsing sanity (mirrors each setup.sh read_packages).
 # ---------------------------------------------------------------------------
-echo "== Checking term/packages.txt markers =="
+echo "== Checking packages.txt markers =="
-if grep -q '^@pacman' term/packages.txt; then
+for pkgdir in term basic utils; do
-    say_pass "packages.txt declares @pacman section"
+    if ! [[ -f "$pkgdir/packages.txt" ]]; then
-else
+        say_fail "$pkgdir/packages.txt missing"
-    say_fail "packages.txt missing @pacman marker"
+        continue
-fi
-# every @aur/@npm marker must be matched by a real consumer in setup.sh
-for marker in '@aur' '@npm'; do
-    if grep -q "^$marker" term/packages.txt; then
-        grep -q "$marker" term/setup.sh \
-            && say_pass "packages.txt $marker handled by term/setup.sh" \
-            || say_fail "packages.txt uses $marker but term/setup.sh does not handle it"
-    else
-        say_pass "packages.txt has no $marker section"
     fi
+    if grep -q '^@pacman' "$pkgdir/packages.txt"; then
+        say_pass "$pkgdir/packages.txt declares @pacman section"
+    else
+        say_fail "$pkgdir/packages.txt missing @pacman marker"
+    fi
+    # every @aur/@npm marker must be matched by a real consumer in setup.sh
+    for marker in '@aur' '@npm'; do
+        if grep -q "^$marker" "$pkgdir/packages.txt"; then
+            grep -q "$marker" "$pkgdir/setup.sh" \
+                && say_pass "$pkgdir/packages.txt $marker handled by $pkgdir/setup.sh" \
+                || say_fail "$pkgdir/packages.txt uses $marker but $pkgdir/setup.sh does not handle it"
+        else
+            say_pass "$pkgdir/packages.txt has no $marker section"
+        fi
+    done
 done
 
 # ---------------------------------------------------------------------------

test/probe_stow.sh

@@ -14,7 +14,7 @@
 set -uo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$REPO_ROOT"
+cd "$REPO_ROOT" || exit 1
 
 # A stow-able package is any tracked top-level directory that contains a
 # dot-prefixed config subtree (or a dot-prefixed top-level file/dir).
@@ -48,16 +48,20 @@ fi
 echo "== Probing stow packages: ${PACKAGES[*]} =="
 
 FAIL=0
+ERR_LOG="$(mktemp -t probe_stow.XXXXXX)"
+
+cleanup() { rm -f "$ERR_LOG"; }
+trap cleanup EXIT
+
 for pkg in "${PACKAGES[@]}"; do
     echo "--- stow --simulate: $pkg ---"
-    if stow --simulate --verbose=1 --dir="$REPO_ROOT" --target="$REPO_ROOT" "$pkg" >/dev/null 2>probe_err.txt; then
+    if stow --simulate --verbose=1 --dir="$REPO_ROOT" --target="$REPO_ROOT" "$pkg" >/dev/null 2>"$ERR_LOG"; then
         echo "ok: stow --simulate '$pkg' resolved without conflicts"
     else
         echo "FAIL: stow --simulate '$pkg'"
-        sed 's/^/    /' probe_err.txt
+        sed 's/^/    /' "$ERR_LOG"
         FAIL=$((FAIL+1))
     fi
-    rm -f probe_err.txt
 done
 
 # Cross-check: does the Makefile stow anything that is NOT in our package set?

test/verify_packages.sh

@@ -46,7 +46,7 @@ declare -A BINS=(
     [tree-sitter-cli]="tree-sitter --version"
     [python]="python --version"
     [python-pip]="pip3 --version"
-    [unzip]="unzip --version"
+    [unzip]="unzip -v"
     [selene]="selene --version"
     [tmux]="tmux -V"
     [yazi]="yazi --version"

utils/packages.txt

@@ -0,0 +1,22 @@
+# ---------------------------------------------------------------------------
+# Standalone desktop utility package list for utils/setup.sh
+#
+# Programs that are not core to every branch, but are expected on a full
+# desktop: office / web / mail / native-app replacements (Wine), the
+# Nextcloud sync client, etc.
+#
+#   - Lines starting with '#' and blank lines are ignored.
+#   - Use "@pacman", "@aur" or "@npm" markers to switch section.
+#   - The default section is @pacman.
+# ---------------------------------------------------------------------------
+
+@pacman
+nextcloud-client
+thunderbird
+ktouch
+ktorrent
+wine
+wine-mono
+wine-gecko
+winetricks
+rbw

utils/setup.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PACKAGES_FILE="$SCRIPT_DIR/packages.txt"
+
+# ---------------------------------------------------------------------------
+# Read packages.txt, split into pacman / aur / npm sections.
+# ---------------------------------------------------------------------------
+read_packages() {
+    local section="pacman"
+    local current
+    current=""
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        current="${line%%#*}"
+        current="${current##*( )}"
+        current="${current%%*( )}"
+        [[ -z "$current" ]] && continue
+        case "$current" in
+            @pacman) section="pacman" ;;
+            @aur)    section="aur" ;;
+            @npm)    section="npm" ;;
+            *)
+                case "$section" in
+                    pacman) pacman_pkgs+=("$current") ;;
+                    aur)    aur_pkgs+=("$current") ;;
+                    npm)    npm_pkgs+=("$current") ;;
+                esac
+                ;;
+        esac
+    done < "$PACKAGES_FILE"
+}
+
+declare -a pacman_pkgs=() aur_pkgs=() npm_pkgs=()
+
+# ---------------------------------------------------------------------------
+# Install sections.
+# ---------------------------------------------------------------------------
+install_pacman() {
+    if ((${#pacman_pkgs[@]})); then
+        echo "==> Installiere Pacman-Pakete: ${pacman_pkgs[*]}"
+        yay -S --needed "${pacman_pkgs[@]}"
+    fi
+}
+
+install_aur() {
+    if ((${#aur_pkgs[@]})); then
+        echo "==> Installiere AUR-Pakete: ${aur_pkgs[*]}"
+        yay -S --needed "${aur_pkgs[@]}"
+    fi
+}
+
+install_npm() {
+    if ((${#npm_pkgs[@]})); then
+        echo "==> Installiere globale npm-Pakete: ${npm_pkgs[*]}"
+        npm install -g "${npm_pkgs[@]}"
+    fi
+}
+
+# ---------------------------------------------------------------------------
+# Main
+# ---------------------------------------------------------------------------
+main() {
+    echo "==> Lese Paketliste: $PACKAGES_FILE"
+    read_packages
+
+    install_pacman
+    install_aur
+    install_npm
+
+    echo "Fertig. Standalone Utilities sind eingerichtet."
+}
+
+main