Add safety check before package pruning

Verifies all state packages are installed locally before running
markAllAsDeps and orphan cleanup.

.opencode/skills/grill-me/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: grill-me
+description: Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".
+---
+
+Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
+
+Ask the questions one at a time.
+
+If a question can be answered by exploring the codebase, explore the codebase instead.

AGENTS.md

@@ -10,21 +10,16 @@ tool before responding to the user:
 ## Code Organization
 
 ### Go: File Structure
-- Types must appear at the top of each file.
+- Variables must appear at the top of each file.
+- Types must appear after variables.
 - Constructors must appear after types.
 - Public (exported) functions must appear after constructors.
 - Private (unexported) functions must appear at the bottom of each file.
 - Within each section, definitions must be sorted alphabetically by name.
-- The sections must be separated by exactly these dividers:
+- The sections must be separated by exactly these dividers, filling in the section:
 
 	// -----------------------------------------
-	// constructors
+	// <section>
-
-	// -----------------------------------------
-	// public
-
-	// -----------------------------------------
-	// private
 
 ### Go: Line Length
 

README.md

@@ -27,22 +27,22 @@ sudo mv declpac /usr/local/bin/
 - pacman
 - makepkg (for AUR support)
 - git (for AUR support)
-- Root privileges
+- sudo/doas (root privileges)
 
 ## Usage
 
 ```bash
 # Single state file
-sudo declpac --state packages.txt
+declpac --state packages.txt
 
 # Multiple state files
-sudo declpac --state base.txt --state apps.txt
+declpac --state base.txt --state apps.txt
 
 # From stdin
-cat packages.txt | sudo declpac
+cat packages.txt | declpac
 
 # Preview changes without applying
-sudo declpac --dry-run --state packages.txt
+declpac --dry-run --state packages.txt
 ```
 
 ### State File Format
@@ -89,17 +89,11 @@ If the pacman database is older than 24 hours, it is automatically refreshed.
 
 ### Logging
 
-Operations are logged to `/var/log/declpac.log`.
+Operation are logged to `$XDG_STATE_HOME/declpac.log`
+(or `~/.local/state/declpac.log` on fallback)
 
 ## Troubleshooting
 
-### Permission denied
-
-Use sudo:
-```bash
-sudo declpac --state packages.txt
-```
-
 ### Package not found
 
 Check if the package exists:

cmd/declpac/main.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/urfave/cli/v3"
 
+	"github.com/Riyyi/declpac/pkg/auth"
 	"github.com/Riyyi/declpac/pkg/input"
 	"github.com/Riyyi/declpac/pkg/log"
 	"github.com/Riyyi/declpac/pkg/output"
@@ -97,6 +98,8 @@ func run(cfg *Config) error {
 		return nil
 	}
 
+	auth.Start()
+
 	if err := log.OpenLog(); err != nil {
 		fmt.Fprintf(os.Stderr, "error: %v\n", err)
 		return err

pkg/auth/auth.go

@@ -0,0 +1,104 @@
+package auth
+
+import (
+	"fmt"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"time"
+
+	"github.com/Riyyi/declpac/pkg/log"
+)
+
+var tool string
+var timeout time.Duration = 5 * time.Minute
+var refreshCommand []string = []string{"-n", "true"}
+
+// -----------------------------------------
+// public
+
+func Command(name string, args ...string) *exec.Cmd {
+	if tool == "" {
+		return log.Command(name, args...)
+	}
+	args = append([]string{name}, args...)
+	return log.Command(tool, args...)
+}
+
+func Run() {
+	exec.Command(tool, refreshCommand...).Run()
+}
+
+func Start() error {
+	err := detect()
+	if err != nil {
+		return err
+	}
+
+	// Automatically refresh privilege elevation to prevent user prompts
+	go func() {
+		for {
+			Run()
+			time.Sleep(timeout)
+		}
+	}()
+
+	return nil
+}
+
+// -----------------------------------------
+// private
+
+func detect() error {
+	tool = getTool()
+	if tool == "" {
+		return fmt.Errorf("no privilege elevation tool detected in PATH")
+	}
+
+	parseTimeout()
+	// We have to be a little faster than the actual timeout
+	timeout -= 30 * time.Second
+
+	return nil
+}
+
+func execLookPath(name string) string {
+	path, err := exec.LookPath(name)
+	if err != nil {
+		return ""
+	}
+	return path
+}
+
+func getTool() string {
+	sudo := execLookPath("sudo")
+	doas := execLookPath("doas")
+
+	if sudo != "" {
+		return "sudo"
+	}
+	if doas != "" {
+		return "doas"
+	}
+
+	return ""
+}
+
+func parseTimeout() {
+	switch tool {
+	case "sudo":
+		out, err := exec.Command("sudo", "sudo", "-V").CombinedOutput()
+		if err != nil {
+			return
+		}
+		re := regexp.MustCompile(`Authentication timestamp timeout: (\d+)\..*`)
+		matches := re.FindStringSubmatch(string(out))
+		if len(matches) == 2 {
+			if minutes, err := strconv.Atoi(matches[1]); err == nil {
+				timeout = time.Duration(minutes) * time.Minute
+			}
+		}
+	case "doas":
+		exec.Command("doas", "true").Run()
+	}
+}

pkg/fetch/fetch.go

@@ -23,6 +23,30 @@ type Fetcher struct {
 	aurClient  *aur.Client
 }
 
+// -----------------------------------------
+// constructor
+
+func New() (*Fetcher, error) {
+	start := time.Now()
+	log.Debug("fetch.Fetcher New: starting...")
+
+	alpmHandle, err := alpm.New()
+	if err != nil {
+		return nil, err
+	}
+
+	aurClient := aur.New()
+
+	log.Debug("fetch.Fetcher New: done (%.2fs)", time.Since(start).Seconds())
+	return &Fetcher{
+		alpmHandle: alpmHandle,
+		aurClient:  aurClient,
+	}, nil
+}
+
+// -----------------------------------------
+// public
+
 func (f *Fetcher) BuildLocalPkgMap() (map[string]interface{}, error) {
 	localPkgs, err := f.alpmHandle.LocalPackages()
 	if err != nil {
@@ -43,14 +67,14 @@ func (f *Fetcher) FetchAur(packages []string) (map[string]aur.Package, error) {
 	return f.aurClient.Fetch(packages)
 }
 
-func (f *Fetcher) GetAURPackage(name string) (aur.Package, bool) {
-	return f.aurClient.Get(name)
-}
-
 func (f *Fetcher) FindProvidingPackage(depName string) (string, bool) {
 	return f.alpmHandle.FindProvidingPackage(depName)
 }
 
+func (f *Fetcher) GetAURPackage(name string) (aur.Package, bool) {
+	return f.aurClient.Get(name)
+}
+
 func (f *Fetcher) Resolve(packages []string) (map[string]*PackageInfo, error) {
 	start := time.Now()
 	log.Debug("fetch.Resolve: starting...")
@@ -128,21 +152,3 @@ func (f *Fetcher) Resolve(packages []string) (map[string]*PackageInfo, error) {
 	log.Debug("fetch.Resolve: done (%.2fs)", time.Since(start).Seconds())
 	return result, nil
 }
-
-func New() (*Fetcher, error) {
-	start := time.Now()
-	log.Debug("fetch.Fetcher New: starting...")
-
-	alpmHandle, err := alpm.New()
-	if err != nil {
-		return nil, err
-	}
-
-	aurClient := aur.New()
-
-	log.Debug("fetch.Fetcher New: done (%.2fs)", time.Since(start).Seconds())
-	return &Fetcher{
-		alpmHandle: alpmHandle,
-		aurClient:  aurClient,
-	}, nil
-}

pkg/input/input.go

@@ -6,10 +6,15 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"github.com/Riyyi/declpac/pkg/lib"
 )
 
 var ErrEmptyList = errors.New("package list is empty")
 
+// -----------------------------------------
+// public
+
 func Merge(packages map[string]bool) ([]string, error) {
 	result := make([]string, 0, len(packages))
 	for name := range packages {
@@ -25,7 +30,7 @@ func ReadPackages(stateFiles []string) (map[string]bool, error) {
 	packages := make(map[string]bool)
 
 	for _, file := range stateFiles {
-		expanded := expandPath(file)
+		expanded := lib.ExpandPath(file)
 		if err := readStateFile(expanded, packages); err != nil {
 			return nil, err
 		}
@@ -48,27 +53,17 @@ func ReadPackages(stateFiles []string) (map[string]bool, error) {
 // -----------------------------------------
 // private
 
-func expandPath(path string) string {
-	if strings.HasPrefix(path, "~/") {
-		home, err := os.UserHomeDir()
-		if err != nil {
-			return path
-		}
-		return filepath.Join(home, path[2:])
-	}
-	return path
-}
-
 func fileExists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
 }
 
 func getImplicitStateFile() string {
-	cfgDir, _ := os.UserConfigDir()
+	cfgDir := os.Getenv("XDG_CONFIG_HOME")
 	if cfgDir == "" {
 		cfgDir = "~/.config"
 	}
+	cfgDir = lib.ExpandPath(cfgDir)
 	return filepath.Join(cfgDir, "declpac")
 }
 

pkg/lib/lib.go

@@ -0,0 +1,21 @@
+package lib
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// -----------------------------------------
+// public
+
+func ExpandPath(path string) string {
+	if strings.HasPrefix(path, "~/") {
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return path
+		}
+		return filepath.Join(home, path[2:])
+	}
+	return path
+}

pkg/log/log.go

@@ -8,11 +8,16 @@ import (
 	"path/filepath"
 	"strings"
 	"time"
+
+	"github.com/Riyyi/declpac/pkg/lib"
 )
 
 var logFile *os.File
 var Verbose bool
 
+// -----------------------------------------
+// public
+
 func Close() error {
 	if logFile == nil {
 		return nil
@@ -26,7 +31,7 @@ func Command(name string, args ...string) *exec.Cmd {
 	return exec.Command(name, args...)
 }
 
-func Debug(format string, args ...interface{}) {
+func Debug(format string, args ...any) {
 	if !Verbose {
 		return
 	}
@@ -38,11 +43,18 @@ func GetLogWriter() io.Writer {
 }
 
 func OpenLog() error {
-	logPath := filepath.Join("/var/log", "declpac.log")
+	stateDir := os.Getenv("XDG_STATE_HOME")
+	if stateDir == "" {
+		stateDir = "~/.local/state"
+	}
+	stateDir = lib.ExpandPath(stateDir)
+
+	logPath := filepath.Join(stateDir, "declpac.log")
 	f, err := os.OpenFile(logPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
 	if err != nil {
 		return err
 	}
+
 	logFile = f
 	writeTimestamp()
 	return nil

pkg/output/output.go

@@ -12,6 +12,9 @@ type Result struct {
 	ToRemove  []string
 }
 
+// -----------------------------------------
+// public
+
 func Format(r *Result) string {
 	var b strings.Builder
 	b.WriteString(fmt.Sprintf("installed %d packages, removed %d packages", r.Installed, r.Removed))

pkg/pacman/pacman.go

@@ -84,6 +84,12 @@ func Sync(packages []string, noCheck bool, prune bool) (*output.Result, error) {
 
 	var removed int
 	if prune {
+		log.Debug("Sync: running prune sanity check...")
+		if err := pruneSanityCheck(packages); err != nil {
+			return nil, err
+		}
+		log.Debug("Sync: prune sanity check passed (%.2fs)", time.Since(start).Seconds())
+
 		log.Debug("Sync: marking all as deps...")
 		if err := markAllAsDeps(); err != nil {
 			return nil, err
@@ -183,3 +189,29 @@ func markAllAsDeps() error {
 	log.Debug("markAllAsDeps: done (%.2fs)", time.Since(start).Seconds())
 	return nil
 }
+
+// pruneSanityCheck checks if the installation of all state packages succeeded,
+// before attempting to do package marking and orphan cleanup.
+func pruneSanityCheck(statePackages []string) error {
+	start := time.Now()
+	log.Debug("pruneSanityCheck: starting...")
+
+	localPackages, err := read.List()
+	if err != nil {
+		return fmt.Errorf("failed to list local packages: %w", err)
+	}
+
+	var missing []string
+	for _, pkg := range statePackages {
+		if !slices.Contains(localPackages, pkg) {
+			missing = append(missing, pkg)
+		}
+	}
+
+	if len(missing) > 0 {
+		return fmt.Errorf("safety check: missing state packages: %v", missing)
+	}
+
+	log.Debug("pruneSanityCheck: done (%.2fs)", time.Since(start).Seconds())
+	return nil
+}

pkg/pacman/sync/sync.go

@@ -4,23 +4,24 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/user"
 	"strings"
-	"sync"
 	"time"
 
+	"github.com/Riyyi/declpac/pkg/auth"
 	"github.com/Riyyi/declpac/pkg/fetch"
 	"github.com/Riyyi/declpac/pkg/fetch/aur"
 	"github.com/Riyyi/declpac/pkg/log"
 )
 
-var sudoUser     string
-var sudoUserOnce sync.Once
-
 type Result struct {
 	Installed int
 	Removed   int
 }
 
+// -----------------------------------------
+// public
+
 func InstallAUR(f *fetch.Fetcher, pkgName string, packageBase string, asDeps bool, logWriter io.Writer) error {
 	start := time.Now()
 	log.Debug("InstallAUR: starting...")
@@ -34,19 +35,18 @@ func InstallAUR(f *fetch.Fetcher, pkgName string, packageBase string, asDeps boo
 		return err
 	}
 
-	sudoUser := getSudoUser()
+	tmpDir := getTempDirName() + "/" + pkgName
-	tmpDir := "/tmp/declpac/" + pkgName
+	if err := createTempDir(tmpDir); err != nil {
-	if err := createTempDir(sudoUser, tmpDir); err != nil {
 		return err
 	}
 	defer os.RemoveAll(tmpDir)
 
-	if err := cloneRepo(sudoUser, packageBase, tmpDir, logWriter); err != nil {
+	if err := cloneRepo(packageBase, tmpDir, logWriter); err != nil {
 		return err
 	}
 	log.Debug("InstallAUR: cloned (%.2fs)", time.Since(start).Seconds())
 
-	if err := buildPackage(sudoUser, tmpDir, asDeps, logWriter); err != nil {
+	if err := buildPackage(tmpDir, asDeps, logWriter); err != nil {
 		return err
 	}
 	log.Debug("InstallAUR: built (%.2fs)", time.Since(start).Seconds())
@@ -77,7 +77,7 @@ func MarkAs(packages []string, flag string, logWriter io.Writer) error {
 	}
 
 	args := append([]string{"-D", "--" + flagName}, packages...)
-	cmd := log.Command("pacman", args...)
+	cmd := auth.Command("pacman", args...)
 	cmd.Stdout = logWriter
 	cmd.Stderr = logWriter
 	err := cmd.Run()
@@ -97,7 +97,7 @@ func RefreshDB(logWriter io.Writer) error {
 		logWriter = os.Stderr
 	}
 
-	cmd := log.Command("pacman", "-Syy")
+	cmd := auth.Command("pacman", "-Syy")
 	cmd.Stdout = logWriter
 	cmd.Stderr = logWriter
 	if err := cmd.Run(); err != nil {
@@ -124,7 +124,7 @@ func RemoveOrphans(orphans []string, logWriter io.Writer) (int, error) {
 	args := make([]string, 0, 3+len(orphans))
 	args = append(args, "pacman", "-Rns", "--noconfirm")
 	args = append(args, orphans...)
-	removeCmd := log.Command(args[0], args[1:]...)
+	removeCmd := auth.Command(args[0], args[1:]...)
 	removeCmd.Stdout = logWriter
 	removeCmd.Stderr = logWriter
 	err := removeCmd.Run()
@@ -147,7 +147,7 @@ func SyncPackages(packages []string, logWriter io.Writer) error {
 	}
 
 	args := append([]string{"-S", "--needed", "--noconfirm"}, packages...)
-	cmd := log.Command("pacman", args...)
+	cmd := auth.Command("pacman", args...)
 	cmd.Stdout = logWriter
 	cmd.Stderr = logWriter
 	err := cmd.Run()
@@ -162,6 +162,49 @@ func SyncPackages(packages []string, logWriter io.Writer) error {
 // -----------------------------------------
 // private
 
+func buildPackage(tmpDir string, asDeps bool, logWriter io.Writer) error {
+	makepkgArgs := []string{"-D", tmpDir, "-s", "--noconfirm"}
+	if asDeps {
+		makepkgArgs = append(makepkgArgs, "--asdeps")
+	}
+	makepkgCmd := log.Command("makepkg", makepkgArgs...)
+	makepkgCmd.Stdout = logWriter
+	makepkgCmd.Stderr = logWriter
+	if err := makepkgCmd.Run(); err != nil {
+		return fmt.Errorf("makepkg failed to build AUR package: %w", err)
+	}
+	return nil
+}
+
+func cloneRepo(packageBase string, tmpDir string, logWriter io.Writer) error {
+	cloneURL := "https://aur.archlinux.org/" + packageBase + ".git"
+	cloneCmd := log.Command("git", "clone", cloneURL, tmpDir)
+	cloneCmd.Stdout = logWriter
+	cloneCmd.Stderr = logWriter
+	if err := cloneCmd.Run(); err != nil {
+		return fmt.Errorf("failed to clone AUR repo: %w", err)
+	}
+	return nil
+}
+
+func createTempDir(tmpDir string) error {
+	if tmpDir == "" || tmpDir == "/" || !strings.HasPrefix(tmpDir, "/tmp") {
+		return fmt.Errorf("safety check: prevented malformed rm -rf call")
+	}
+
+	rmdirCmd := log.Command("rm", "-rf", tmpDir)
+	if err := rmdirCmd.Run(); err != nil {
+		return fmt.Errorf("failed to remove temp directory: %w", err)
+	}
+
+	mkdirCmd := log.Command("mkdir", "-p", tmpDir)
+	if err := mkdirCmd.Run(); err != nil {
+		return fmt.Errorf("failed to create temp directory: %w", err)
+	}
+
+	return nil
+}
+
 func findPKGFile(pkgName string, dir string) (string, error) {
 	entries, err := os.ReadDir(dir)
 	if err != nil {
@@ -172,6 +215,11 @@ func findPKGFile(pkgName string, dir string) (string, error) {
 		if !strings.HasSuffix(name, ".pkg.tar.zst") && !strings.HasSuffix(name, ".pkg.tar.gz") {
 			continue
 		}
+		// Skip packages that do not start with the exact package name, ex: sunshine-bin -> sunshine
+		if !strings.HasPrefix(name, pkgName) {
+			continue
+		}
+		// Skip packages that provide a debug package, ex: sunshine-bin -> sunshine-debug
 		if strings.HasPrefix(name, pkgName+"-debug") {
 			continue
 		}
@@ -191,6 +239,25 @@ func getAURInfo(f *fetch.Fetcher, pkgName string, packageBase string) *aur.Packa
 	return &info
 }
 
+func getTempDirName() string {
+	user, err := user.Current()
+	if err != nil {
+		return "/tmp/declpac"
+	}
+
+	return "/tmp/declpac-" + user.Username
+}
+
+func installBuiltPackage(pkgFile string, logWriter io.Writer) error {
+	installCmd := auth.Command("pacman", "-U", "--noconfirm", pkgFile)
+	installCmd.Stdout = logWriter
+	installCmd.Stderr = logWriter
+	if err := installCmd.Run(); err != nil {
+		return fmt.Errorf("failed to install package: %w", err)
+	}
+	return nil
+}
+
 func resolveAndInstallDeps(f *fetch.Fetcher, aurInfo *aur.Package, logWriter io.Writer) error {
 	if aurInfo == nil {
 		return nil
@@ -206,17 +273,26 @@ func resolveAndInstallDeps(f *fetch.Fetcher, aurInfo *aur.Package, logWriter io.
 		return fmt.Errorf("failed to resolve dependencies: %w", err)
 	}
 
-	var aurDeps []string
+	var repoDeps, aurDeps []string
 	for _, dep := range depends {
 		info := resolved[dep]
 		if info.Installed {
 			continue
 		}
-		if info.Exists {
+		pkg := dep
-			continue
+		if info.Provided != "" {
+			pkg = info.Provided
 		}
-		if info.InAUR {
+		if info.Exists {
-			aurDeps = append(aurDeps, dep)
+			repoDeps = append(repoDeps, pkg)
+		} else if info.InAUR {
+			aurDeps = append(aurDeps, pkg)
+		}
+	}
+
+	if len(repoDeps) > 0 {
+		if err := SyncPackages(repoDeps, logWriter); err != nil {
+			return fmt.Errorf("failed to install repo dependencies: %w", err)
 		}
 	}
 
@@ -240,59 +316,3 @@ func resolveAndInstallDeps(f *fetch.Fetcher, aurInfo *aur.Package, logWriter io.
 
 	return nil
 }
-
-func getSudoUser() string {
-	sudoUserOnce.Do(func() {
-		sudoUser = os.Getenv("SUDO_USER")
-		if sudoUser == "" {
-			sudoUser = os.Getenv("USER")
-			if sudoUser == "" {
-				sudoUser = "root"
-			}
-		}
-	})
-	return sudoUser
-}
-
-func createTempDir(sudoUser string, tmpDir string) error {
-	mkdirCmd := log.Command("su", "-", sudoUser, "-c", "rm -rf "+tmpDir+" && mkdir -p "+tmpDir)
-	if err := mkdirCmd.Run(); err != nil {
-		return fmt.Errorf("failed to create temp directory: %w", err)
-	}
-	return nil
-}
-
-func cloneRepo(sudoUser string, packageBase string, tmpDir string, logWriter io.Writer) error {
-	cloneURL := "https://aur.archlinux.org/" + packageBase + ".git"
-	cloneCmd := log.Command("su", "-", sudoUser, "-c", "git clone "+cloneURL+" "+tmpDir)
-	cloneCmd.Stdout = logWriter
-	cloneCmd.Stderr = logWriter
-	if err := cloneCmd.Run(); err != nil {
-		return fmt.Errorf("failed to clone AUR repo: %w", err)
-	}
-	return nil
-}
-
-func buildPackage(sudoUser string, tmpDir string, asDeps bool, logWriter io.Writer) error {
-	makepkgArgs := []string{"makepkg", "-s", "--noconfirm"}
-	if asDeps {
-		makepkgArgs = append(makepkgArgs, "--asdeps")
-	}
-	makepkgCmd := log.Command("su", "-", sudoUser, "-c", "cd "+tmpDir+" && "+strings.Join(makepkgArgs, " "))
-	makepkgCmd.Stdout = logWriter
-	makepkgCmd.Stderr = logWriter
-	if err := makepkgCmd.Run(); err != nil {
-		return fmt.Errorf("makepkg failed to build AUR package: %w", err)
-	}
-	return nil
-}
-
-func installBuiltPackage(pkgFile string, logWriter io.Writer) error {
-	installCmd := log.Command("pacman", "-U", "--noconfirm", pkgFile)
-	installCmd.Stdout = logWriter
-	installCmd.Stderr = logWriter
-	if err := installCmd.Run(); err != nil {
-		return fmt.Errorf("failed to install package: %w", err)
-	}
-	return nil
-}

skills-lock.json

@@ -5,6 +5,12 @@
       "source": "JuliusBrussee/caveman",
       "sourceType": "github",
       "computedHash": "a818cdc41dcfaa50dd891c5cb5e5705968338de02e7e37949ca56e8c30ad4176"
+    },
+    "grill-me": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/productivity/grill-me/SKILL.md",
+      "computedHash": "784f0dbb7403b0f00324bce9a112f715342777a0daee7bbb7385f9c6f0a170ea"
     }
   }
 }