From e2f9c1b26e8c0dd95cad1fa68c197f52052aece8 Mon Sep 17 00:00:00 2001 From: Steffen Maechtel Date: Sat, 29 Aug 2026 21:18:21 +0200 Subject: [PATCH 1/2] feat(cli): rename command to opk (#48) opencode-permissions-kit -> opk: install/update create /usr/local/bin/opk and remove the legacy long-name symlink (update migrates old installs); uninstall removes both names. Command hints, usage text, tests and docs updated; deploy paths, sudoers, rc hooks and library dir unchanged. --- docs/concepts/ddev-integration.md | 8 ++-- docs/concepts/sharing-group.md | 2 +- docs/getting-started.md | 2 +- docs/how-to/dev-owned-projects.md | 8 ++-- docs/how-to/manage-projects.md | 6 +-- docs/how-to/secure-git-config.md | 6 +-- docs/how-to/switch-container-backend.md | 4 +- docs/how-to/uninstall.md | 2 +- docs/how-to/update.md | 16 ++++---- docs/reference/cli.md | 40 ++++++++++--------- docs/reference/files.md | 2 +- docs/troubleshooting.md | 6 +-- files/config.sh | 4 +- files/install.sh | 15 +++---- files/opencode-deny-all.jsonc | 2 +- .../ddev-as-opencode.sh | 4 +- files/opencode-permissions-kit-lib/kit | 16 ++++---- .../migrate-denies.sh | 4 +- files/status.sh | 8 ++-- files/uninstall.sh | 4 +- files/update.sh | 9 +++-- tests/e2e/fixtures/camino/README.md | 2 +- tests/e2e/run.sh | 6 ++- tests/test-kit-cli.sh | 12 +++--- tests/test-kit-files.sh | 2 +- tests/test-uninstall.sh | 1 + 26 files changed, 100 insertions(+), 91 deletions(-) diff --git a/docs/concepts/ddev-integration.md b/docs/concepts/ddev-integration.md index f4b6049..4a9214a 100644 --- a/docs/concepts/ddev-integration.md +++ b/docs/concepts/ddev-integration.md @@ -192,7 +192,7 @@ elevation path** (`ddev hostname 127.0.0.1` as your user → `ddev-hostname.exe` → the Windows permission dialog): ```bash -opencode-permissions-kit ddev-hosts-add # in the project dir +opk ddev-hosts-add # in the project dir ``` It adds every hostname missing from @@ -202,10 +202,10 @@ under the default `*.ddev.site` TLD are never touched: ddev's public wildcard DNS already resolves them, no hosts entry is needed. After `ddev start`/`restart` the kit's `ddev()` shell function prints the missing hostnames with one ready-made command each — -`opencode-permissions-kit ddev-hosts-add ` also works +`opk ddev-hosts-add ` also works standalone from anywhere, so you add exactly what was reported; `ddev-hosts-check` lists them on demand, and -`opencode-permissions-kit status` reports them per project root (its +`opk status` reports them per project root (its scan skips `vendor/`, `node_modules/` and `testdata/` — packages and test fixtures ship their own `.ddev` dirs that are not your projects). @@ -252,7 +252,7 @@ sudo sh /usr/local/lib/opencode-permissions-kit/ddev-migrate.sh import ddev start && ddev import-db --file=.sql.gz ``` -`opencode-permissions-kit status` lists dumps still waiting for import. +`opk status` lists dumps still waiting for import. Only each project's **default** database is exported; extra named databases need a manual `ddev export-db --database=` on the old side — do that **before** the `.ddev` handover made your side diff --git a/docs/concepts/sharing-group.md b/docs/concepts/sharing-group.md index d681f66..03fd5b7 100644 --- a/docs/concepts/sharing-group.md +++ b/docs/concepts/sharing-group.md @@ -60,5 +60,5 @@ soft `.git/config` deny — see If group bits drift (e.g. after unpacking an archive as root), re-apply: ```bash -opencode-permissions-kit update --refresh +opk update --refresh ``` diff --git a/docs/getting-started.md b/docs/getting-started.md index b24123b..9179760 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -85,7 +85,7 @@ wrapper. Same-shell fix: `hash -r` and Run the status script: ```bash -opencode-permissions-kit status +opk status ``` It reports the protection mode, backend + socket reachability, ddev runtime diff --git a/docs/how-to/dev-owned-projects.md b/docs/how-to/dev-owned-projects.md index 6e4578a..0db6b7b 100644 --- a/docs/how-to/dev-owned-projects.md +++ b/docs/how-to/dev-owned-projects.md @@ -48,14 +48,14 @@ Fresh installs already have it on (recommended default). On an existing install: ```bash -sudo opencode-permissions-kit config ddev-settings on -sudo opencode-permissions-kit config refresh # flags existing projects + hands back +sudo opk config ddev-settings on +sudo opk config refresh # flags existing projects + hands back ``` Per project (faster, no full baseline): ```bash -sudo opencode-permissions-kit config handover /var/www/vhosts/ +sudo opk config handover /var/www/vhosts/ ``` **Commit the added `disable_settings_management: true` line** — it is @@ -92,7 +92,7 @@ hand-write the include (design plan, open extension). ## Disable it ```bash -sudo opencode-permissions-kit config ddev-settings off +sudo opk config ddev-settings off ``` Stops future flag writes. Already-committed flags stay (repo content) — diff --git a/docs/how-to/manage-projects.md b/docs/how-to/manage-projects.md index 9d4f9d3..9384080 100644 --- a/docs/how-to/manage-projects.md +++ b/docs/how-to/manage-projects.md @@ -10,7 +10,7 @@ inside one of these directories or their subdirectories. ## Add a project directory ```bash -opencode-permissions-kit config projects add /var/www/vhosts/new-project +opk config projects add /var/www/vhosts/new-project ``` Multiple paths at once are fine, and `~` works. System paths (`/`, `/usr`, @@ -32,13 +32,13 @@ sudo setfacl -R -d -m g:opencode:rwx /var/www/vhosts/new-project ## List configured directories ```bash -opencode-permissions-kit config projects list +opk config projects list ``` ## Remove a project directory ```bash -opencode-permissions-kit config projects remove /var/www/vhosts/old-project +opk config projects remove /var/www/vhosts/old-project ``` Only the `projects.conf` line is removed; files and their group bits stay as diff --git a/docs/how-to/secure-git-config.md b/docs/how-to/secure-git-config.md index 05bb8e7..7705694 100644 --- a/docs/how-to/secure-git-config.md +++ b/docs/how-to/secure-git-config.md @@ -19,9 +19,9 @@ curl -fsSL https://raw.githubusercontent.com/steffenmaechtel/opencode-permission Later, at any time: ```bash -opencode-permissions-kit config git-config on -opencode-permissions-kit config git-config off -opencode-permissions-kit config git-config status +opk config git-config on +opk config git-config off +opk config git-config status ``` `on` re-renders the agent's `opencode.jsonc` with the deny rules (the diff --git a/docs/how-to/switch-container-backend.md b/docs/how-to/switch-container-backend.md index 35fd408..f9cdf84 100644 --- a/docs/how-to/switch-container-backend.md +++ b/docs/how-to/switch-container-backend.md @@ -7,13 +7,13 @@ The backend is configured at install time (`--container-backend docker-rootless|podman-rootless`) and can be switched at any time: ```bash -opencode-permissions-kit config container-backend podman-rootless +opk config container-backend podman-rootless ``` Check the current backend and socket state: ```bash -opencode-permissions-kit config container-backend status +opk config container-backend status ``` ## What the switch does diff --git a/docs/how-to/uninstall.md b/docs/how-to/uninstall.md index 137a026..fbc76b3 100644 --- a/docs/how-to/uninstall.md +++ b/docs/how-to/uninstall.md @@ -6,7 +6,7 @@ stays behind. ## Run the uninstall ```bash -opencode-permissions-kit uninstall +opk uninstall ``` Run it as your default user (it asks for `sudo` where needed). Options: diff --git a/docs/how-to/update.md b/docs/how-to/update.md index be38f07..466a9d8 100644 --- a/docs/how-to/update.md +++ b/docs/how-to/update.md @@ -21,18 +21,18 @@ curl -fsSL https://raw.githubusercontent.com/steffenmaechtel/opencode-permission `update.sh` re-deploys the kit files and refreshes the `install.conf` version stamp. It does **not** touch `projects.conf` or `/home/opencode/.config/opencode/opencode.jsonc` — your project list and -deny-list customizations survive. Since this update (kit 0.0.14) the -`opencode-permissions-kit` command (see [CLI](../reference/cli.md)) exists — +deny-list customizations survive. Since kit 0.0.14 the +`opk` command (see [CLI](../reference/cli.md)) exists — future updates work without the curl one-liner: ```bash -opencode-permissions-kit update +opk update ``` To re-apply the group baseline (chgrp/setgid/default ACLs) as well: ```bash -opencode-permissions-kit update --refresh +opk update --refresh ``` ## Upgrade the opencode binary @@ -43,10 +43,10 @@ the bundled config sets `autoupdate: false`, and `update.sh` is the upgrade entry point: ```bash -opencode-permissions-kit upgrade-opencode # latest release -opencode-permissions-kit upgrade-opencode --binary-path ./opencode # specific file +opk upgrade-opencode # latest release +opk upgrade-opencode --binary-path ./opencode # specific file # equivalent long form: -opencode-permissions-kit update --only-binary +opk update --only-binary ``` Binary upgrades are best-effort: a failure leaves the current binary in @@ -55,7 +55,7 @@ place, the previous one is kept in `/tmp/opencode-upgrade-backup-*`. ## Verify ```bash -opencode-permissions-kit status +opk status ``` `status.sh` shows the deployed version and the backend state after the diff --git a/docs/reference/cli.md b/docs/reference/cli.md index 9b8bd79..c04e995 100644 --- a/docs/reference/cli.md +++ b/docs/reference/cli.md @@ -2,20 +2,20 @@ This page lists the kit's commands and flags. -## The `opencode-permissions-kit` command +## The `opk` command After installation, one command manages everything (works from anywhere in your WSL/Linux system): ```bash -opencode-permissions-kit status -opencode-permissions-kit config projects add /var/www/vhosts/new-project -opencode-permissions-kit update --binary -opencode-permissions-kit upgrade-opencode # just the opencode binary -opencode-permissions-kit ddev-hosts-add # in a ddev project dir -opencode-permissions-kit handover me .gotmp # mixed-owner tree -> yours again -opencode-permissions-kit uninstall -opencode-permissions-kit help # commands + arguments overview +opk status +opk config projects add /var/www/vhosts/new-project +opk update --binary +opk upgrade-opencode # just the opencode binary +opk ddev-hosts-add # in a ddev project dir +opk handover me .gotmp # mixed-owner tree -> yours again +opk uninstall +opk help # commands + arguments overview ``` Everything after the subcommand goes to the underlying script unchanged, @@ -24,9 +24,11 @@ elevate via sudo automatically; `status` needs no sudo; `uninstall` runs as your user and asks for sudo itself; `ddev-hosts-*` run as your user (they drive Windows-side elevation through ddev itself). -The command is a symlink (`/usr/local/bin/opencode-permissions-kit`) into -the kit library — deployed since kit 0.0.14. On older installs, run -[update](../how-to/update.md) once to get it. The direct script calls below +The command is a symlink (`/usr/local/bin/opk`) into +the kit library — deployed since kit 0.0.14 as `opencode-permissions-kit` +and renamed to `opk` (issue #48). On older installs, run +[update](../how-to/update.md) once to switch to the new name — it creates +`opk` and removes the old long-name symlink. The direct script calls below keep working everywhere. ## handover @@ -38,13 +40,13 @@ Switch file ownership between the two kit users — you and the agent: # cache now contains files of both users and every build complains # ("chmod ... Operation not permitted"). Make the whole tree yours again: cd /var/www/vhosts/ddev -opencode-permissions-kit handover me .gotmp +opk handover me .gotmp # Same idea the other way — give a folder to the agent user: -opencode-permissions-kit handover opencode /var/www/vhosts/some-project/ +opk handover opencode /var/www/vhosts/some-project/ # Not sure yet? Show what would happen, without sudo: -opencode-permissions-kit handover me .gotmp --dry-run +opk handover me .gotmp --dry-run ``` `me` and `opencode` resolve to your default user and the agent user from @@ -67,8 +69,8 @@ the Windows hosts file — your Windows browser cannot resolve custom- agent never gets hosts-file access. ```bash -opencode-permissions-kit ddev-hosts-check # what is missing? -opencode-permissions-kit ddev-hosts-add # add it (Windows asks permission) +opk ddev-hosts-check # what is missing? +opk ddev-hosts-add # add it (Windows asks permission) ``` `ddev-hosts-add` runs `ddev hostname 127.0.0.1` as your user for @@ -84,7 +86,7 @@ entry is needed (the per-hostname commands the status and the `ddev()` hook print include the name, so you add exactly what was reported: ```bash -opencode-permissions-kit ddev-hosts-add my-fancy-project.local +opk ddev-hosts-add my-fancy-project.local ``` works from anywhere). The status scan also skips `vendor/` and @@ -149,7 +151,7 @@ curl -fsSL https://raw.githubusercontent.com/steffenmaechtel/opencode-permission | `--only-binary` | Skip every kit step, only upgrade the opencode binary | | `--binary-path ` | Install a specific binary file instead | -`opencode-permissions-kit upgrade-opencode` is the shorthand for +`opk upgrade-opencode` is the shorthand for `update --yes --only-binary` — extra flags (e.g. `--binary-path`) pass through. diff --git a/docs/reference/files.md b/docs/reference/files.md index 9abb9b9..8892f18 100644 --- a/docs/reference/files.md +++ b/docs/reference/files.md @@ -43,7 +43,7 @@ This page lists every file and directory the kit manages, and every key in | Path | Purpose | |---|---| | `/usr/local/bin/opencode` | Wrapper symlink | -| `/usr/local/bin/opencode-permissions-kit` | CLI dispatcher symlink (see [CLI](cli.md)) | +| `/usr/local/bin/opk` | CLI dispatcher symlink (see [CLI](cli.md)) | | `/usr/local/lib/opencode-permissions-kit/kit` | CLI dispatcher (status/config/update/uninstall routing) | | `/usr/local/lib/opencode-permissions-kit/bin/opencode` | The actual opencode binary (`root:opencode` 750) | | `/usr/local/lib/opencode-permissions-kit/bin/socket-check.sh` | Rootless socket probe (`test -S` only) | diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index 8a541c5..c1656e6 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -169,7 +169,7 @@ owner-only on Linux. **Fix:** run the handover (fast — one project, no group baseline): ```bash -sudo opencode-permissions-kit config handover /var/www/vhosts/ +sudo opk config handover /var/www/vhosts/ ``` (or `update.sh` / `config.sh refresh` to re-run it over every registered @@ -221,12 +221,12 @@ shows its permission dialog: ```bash cd /var/www/vhosts/ -opencode-permissions-kit ddev-hosts-add +opk ddev-hosts-add ``` `ddev-hosts-check` lists what is missing (one ready-made `ddev-hosts-add ` command each — that form works from -anywhere); `opencode-permissions-kit status` reports it per project +anywhere); `opk status` reports it per project root. Manual fallback: edit `C:\Windows\System32\drivers\etc\hosts` in an elevated editor and add `127.0.0.1 .`. Hostnames under the default `*.ddev.site` diff --git a/files/config.sh b/files/config.sh index 8c1dc70..02f3038 100755 --- a/files/config.sh +++ b/files/config.sh @@ -536,8 +536,8 @@ ddev_settings_apply() { DDEV_DEV_OWNED=true ui_success "ddev-settings on — dev-owned projects (recommended)" ui_info "existing projects get the flag + handback on the next scan. Run:" - ui_detail "sudo opencode-permissions-kit config refresh" - ui_detail "(or per project: sudo opencode-permissions-kit config handover )" + ui_detail "sudo opk config refresh" + ui_detail "(or per project: sudo opk config handover )" ui_detail "commit the added disable_settings_management line in each repo." else update_install_conf_ddev_owned false diff --git a/files/install.sh b/files/install.sh index 77e79f6..62beffc 100755 --- a/files/install.sh +++ b/files/install.sh @@ -470,7 +470,7 @@ if id "$OPENCODE_USER" >/dev/null 2>&1 || [ -f /etc/opencode-permissions-kit/ins if [ "$INTERACTIVE" = true ]; then # Convention: docs/design/conventions.md — [Y/n] via ui_confirm. if ! ui_confirm "Re-configure the existing installation with install.sh?" "y"; then - ui_info "Aborted — run: opencode-permissions-kit update" + ui_info "Aborted — run: opk update" exit 0 fi fi @@ -1262,10 +1262,11 @@ sudo ln -sf "$LIBDIR/wrapper" /usr/local/bin/opencode ui_success "wrapper installed: /usr/local/bin/opencode -> $LIBDIR/wrapper" log "wrapper symlink: /usr/local/bin/opencode -> $LIBDIR/wrapper" -# CLI dispatcher: /usr/local/bin/opencode-permissions-kit -> kit -sudo ln -sf "$LIBDIR/kit" /usr/local/bin/opencode-permissions-kit -ui_success "cli installed: opencode-permissions-kit -> $LIBDIR/kit" -log "cli symlink: /usr/local/bin/opencode-permissions-kit -> $LIBDIR/kit" +# CLI dispatcher: /usr/local/bin/opk -> kit +sudo rm -f /usr/local/bin/opencode-permissions-kit +sudo ln -sf "$LIBDIR/kit" /usr/local/bin/opk +ui_success "cli installed: opk -> $LIBDIR/kit" +log "cli symlink: /usr/local/bin/opk -> $LIBDIR/kit" # sudoers -> /etc/opencode-permissions-kit/sudoers, symlinked as /etc/sudoers.d/opencode-permissions-kit SUDO_TMP=$(mktemp) @@ -1569,7 +1570,7 @@ echo "" ui_info "Next:" ui_detail "opencode start the agent (new terminal!)" [ -n "$DD_MIG_DUMP_DIR" ] && ui_detail "ddev-migrate.sh import re-import your ddev databases (first start pulls images)" -ui_detail "opencode-permissions-kit status verify the protection" -ui_detail "opencode-permissions-kit config change settings later (or update/uninstall)" +ui_detail "opk status verify the protection" +ui_detail "opk config change settings later (or update/uninstall)" ui_detail "Docs: https://github.com/steffenmaechtel/opencode-permissions-kit/blob/master/docs/README.md" log "install complete" diff --git a/files/opencode-deny-all.jsonc b/files/opencode-deny-all.jsonc index 9b67e0a..b3efaca 100644 --- a/files/opencode-deny-all.jsonc +++ b/files/opencode-deny-all.jsonc @@ -15,7 +15,7 @@ // locks out the bypass mode. The agent runs as its own user and reads: // /home/opencode/.config/opencode/opencode.jsonc // Edit that file (you are in its sharing group) or run - // `opencode-permissions-kit config` to change settings. + // `opk config` to change settings. "share": "disabled", "permission": { "*": "deny" } } diff --git a/files/opencode-permissions-kit-lib/ddev-as-opencode.sh b/files/opencode-permissions-kit-lib/ddev-as-opencode.sh index 15eb584..7f3ecbc 100755 --- a/files/opencode-permissions-kit-lib/ddev-as-opencode.sh +++ b/files/opencode-permissions-kit-lib/ddev-as-opencode.sh @@ -136,7 +136,7 @@ _opk_hosts_hint() { echo " add them (Windows asks for permission, one command each —" echo " you see exactly what gets added):" for _opk_h in $_opk_miss; do - echo " opencode-permissions-kit ddev-hosts-add $_opk_h" + echo " opk ddev-hosts-add $_opk_h" done return 0 } @@ -170,7 +170,7 @@ _opk_bootstrap_hint() { echo " the root belongs to you, ddev runs as opencode). Hand it over once" echo " (the kit hands it back after install):" echo "" - echo " sudo opencode-permissions-kit config handover $PWD" + echo " sudo opk config handover $PWD" # Dev-owned mode: the same command also writes # disable_settings_management: true (the durable fix — ddev then never # touches paths outside .ddev/, the root stays yours permanently). diff --git a/files/opencode-permissions-kit-lib/kit b/files/opencode-permissions-kit-lib/kit index bc148f0..2cda2d3 100755 --- a/files/opencode-permissions-kit-lib/kit +++ b/files/opencode-permissions-kit-lib/kit @@ -1,13 +1,13 @@ #!/bin/sh # opencode permissions kit — CLI dispatcher -# Deployed to /usr/local/bin/opencode-permissions-kit by install.sh +# Deployed to /usr/local/bin/opk by install.sh # (symlink -> /usr/local/lib/opencode-permissions-kit/kit). # # One command for all management scripts, usable from anywhere in WSL: -# opencode-permissions-kit status -> status.sh (no sudo needed) -# opencode-permissions-kit config ... -> config.sh (auto sudo) -# opencode-permissions-kit update ... -> update.sh (auto sudo) -# opencode-permissions-kit uninstall -> uninstall.sh (runs as your user, +# opk status -> status.sh (no sudo needed) +# opk config ... -> config.sh (auto sudo) +# opk update ... -> update.sh (auto sudo) +# opk uninstall -> uninstall.sh (runs as your user, # asks for sudo itself) # # Everything after the subcommand is passed through to the script, so all @@ -47,7 +47,7 @@ usage() { cat < [args...] +Usage: opk [args...] Commands: status Show the protection status (no sudo needed) @@ -151,7 +151,7 @@ case "$cmd" in echo "missing from $DDEV_WIN_HOSTS:" printf '%s\n' "$_khm" | sed 's/^/ /' echo "add them (one command each):" - printf '%s\n' "$_khm" | sed 's/^/ opencode-permissions-kit ddev-hosts-add /' + printf '%s\n' "$_khm" | sed 's/^/ opk ddev-hosts-add /' fi ;; ddev-hosts-add) @@ -175,7 +175,7 @@ case "$cmd" in # argument errors and --dry-run work unprivileged. _ho_err() { ui_error "$1" - echo " usage: opencode-permissions-kit handover ... [--dry-run]" >&2 + echo " usage: opk handover ... [--dry-run]" >&2 exit 1 } [ "$#" -ge 2 ] || _ho_err "handover: need a target (me or opencode) and at least one path" diff --git a/files/opencode-permissions-kit-lib/migrate-denies.sh b/files/opencode-permissions-kit-lib/migrate-denies.sh index 62a00b8..2b7c05f 100644 --- a/files/opencode-permissions-kit-lib/migrate-denies.sh +++ b/files/opencode-permissions-kit-lib/migrate-denies.sh @@ -14,8 +14,8 @@ # - DELETE this file when the upgrade floor moves past 0.0.14. # # Replacement for the only still-needed function (group baseline refresh): -# opencode-permissions-kit update --refresh (inline in update.sh) -# opencode-permissions-kit config refresh (inline in config.sh) +# opk update --refresh (inline in update.sh) +# opk config refresh (inline in config.sh) echo "migrate-denies.sh was removed in kit 0.0.15 — the group baseline" >&2 echo "refresh now lives in update.sh --refresh / config.sh refresh." >&2 exit 0 diff --git a/files/status.sh b/files/status.sh index c76bde4..db73346 100755 --- a/files/status.sh +++ b/files/status.sh @@ -127,7 +127,7 @@ case "${CONTAINER_BACKEND:-}" in if [ -S "$sockpath" ] 2>/dev/null || sudo -n test -S "$sockpath" 2>/dev/null; then ui_kv "socket" "reachable — $sock" "$UI_GREEN" elif [ -d "$(dirname "$sockpath")" ] && [ ! -x "$(dirname "$sockpath")" ]; then - ui_kv "socket" "unknown — needs root to check (run: sudo opencode-permissions-kit status)" "$UI_YELLOW" + ui_kv "socket" "unknown — needs root to check (run: sudo opk status)" "$UI_YELLOW" else ui_kv "socket" "NOT reachable — $sock" "$UI_RED" fi @@ -151,7 +151,7 @@ case "${CONTAINER_BACKEND:-}" in if [ -S "$sockpath" ] 2>/dev/null || sudo -n test -S "$sockpath" 2>/dev/null; then ui_kv "socket" "reachable — $sock" "$UI_GREEN" elif [ -d "$(dirname "$sockpath")" ] && [ ! -x "$(dirname "$sockpath")" ]; then - ui_kv "socket" "unknown — needs root to check (run: sudo opencode-permissions-kit status)" "$UI_YELLOW" + ui_kv "socket" "unknown — needs root to check (run: sudo opk status)" "$UI_YELLOW" else ui_kv "socket" "NOT reachable — $sock" "$UI_RED" fi @@ -250,7 +250,7 @@ else # caller cannot stat the file, so "missing" may just mean "unchecked". # Only root can genuinely confirm absence. if [ "$(id -u)" -ne 0 ] && [ -d "/home/$OPENCODE_USER" ]; then - ui_kv "mkcert CA" "unknown — needs root to check (run: sudo opencode-permissions-kit status)" "$UI_YELLOW" + ui_kv "mkcert CA" "unknown — needs root to check (run: sudo opk status)" "$UI_YELLOW" else ui_kv "mkcert CA" "missing (optional — ddev HTTPS will need a trusted CA)" "$UI_YELLOW" fi @@ -310,7 +310,7 @@ if [ -d /mnt/c ] && [ -f "$LIBDIR/ddev-hosts.sh" ] && [ -f /mnt/c/Windows/System [ -n "$_st_m" ] || continue ui_kv_warn "hosts (win)" "$(dirname "$_st_d"): missing $(printf '%s' "$_st_m" | tr '\n' ' ')" for _st_h in $_st_m; do - echo " add: opencode-permissions-kit ddev-hosts-add $_st_h" + echo " add: opk ddev-hosts-add $_st_h" done done done < "$PROJECTS_CONF" diff --git a/files/uninstall.sh b/files/uninstall.sh index 2357aff..3581a18 100755 --- a/files/uninstall.sh +++ b/files/uninstall.sh @@ -149,9 +149,9 @@ log "wrapper removed: /usr/local/bin/opencode" echo "" echo "--- Removing cli dispatcher ---" -run "sudo rm -f /usr/local/bin/opencode-permissions-kit" +run "sudo rm -f /usr/local/bin/opk /usr/local/bin/opencode-permissions-kit" echo "CLI dispatcher removed." -log "cli removed: /usr/local/bin/opencode-permissions-kit" +log "cli removed: /usr/local/bin/opk" echo "" echo "--- Removing opencode library ---" diff --git a/files/update.sh b/files/update.sh index 5e03d74..5d21db1 100755 --- a/files/update.sh +++ b/files/update.sh @@ -333,8 +333,9 @@ log "library re-deployed: $LIBDIR" sudo ln -sf "$LIBDIR/wrapper" /usr/local/bin/opencode ui_success "wrapper symlink refreshed: /usr/local/bin/opencode" -sudo ln -sf "$LIBDIR/kit" /usr/local/bin/opencode-permissions-kit -ui_success "cli symlink refreshed: /usr/local/bin/opencode-permissions-kit" +sudo rm -f /usr/local/bin/opencode-permissions-kit +sudo ln -sf "$LIBDIR/kit" /usr/local/bin/opk +ui_success "cli symlink refreshed: /usr/local/bin/opk (legacy name removed)" # --- re-deploy sudoers ------------------------------------------------------- @@ -680,6 +681,6 @@ else fi [ "$BINARY_UPDATE" = true ] || ui_kv "Binary" "untouched (use --binary to upgrade)" ui_info "Next:" -ui_detail "opencode-permissions-kit status verify the protection" -ui_detail "opencode-permissions-kit upgrade-opencode upgrade the opencode binary" +ui_detail "opk status verify the protection" +ui_detail "opk upgrade-opencode upgrade the opencode binary" log "update complete (version $VERSION)" diff --git a/tests/e2e/fixtures/camino/README.md b/tests/e2e/fixtures/camino/README.md index 54a4008..79b97de 100644 --- a/tests/e2e/fixtures/camino/README.md +++ b/tests/e2e/fixtures/camino/README.md @@ -54,7 +54,7 @@ db/db credentials) and the site config with its relative `base: /camino/` ddev config --php-version 8.3 --project-type=typo3 --docroot=public \ --webserver-type=apache-fpm --project-tld local \ --web-environment-add="TYPO3_CONTEXT=Development/ddev" --nodejs-version=14.18.1 -sudo opencode-permissions-kit config handover "$PWD" +sudo opk config handover "$PWD" ddev start ddev composer create-project "typo3/cms-base-distribution:^14" ddev composer req typo3/theme-camino diff --git a/tests/e2e/run.sh b/tests/e2e/run.sh index 301279f..c036bcb 100755 --- a/tests/e2e/run.sh +++ b/tests/e2e/run.sh @@ -140,6 +140,10 @@ echo "" echo "--- 3. Wrapper & binary ---" check "Wrapper at /usr/local/bin/opencode" \ E 'test -x /usr/local/bin/opencode' +check "CLI dispatcher at /usr/local/bin/opk" \ + E 'test -x /usr/local/bin/opk' +check "legacy CLI name /usr/local/bin/opencode-permissions-kit not present" \ + E '! test -e /usr/local/bin/opencode-permissions-kit' check "Binary at /usr/local/lib/opencode-permissions-kit/bin/opencode" \ E 'sudo test -x /usr/local/lib/opencode-permissions-kit/bin/opencode' check "Binary owned root:opencode (not world-executable)" \ @@ -531,7 +535,7 @@ check "11b: install.conf version NOT re-stamped (still section 11's sentinel)" \ # top-level shorthand (issue #24): kit CLI maps upgrade-opencode onto # update.sh --yes --only-binary, flags pass through E 'printf "#!/bin/sh\necho \"opencode version 7.7.7-shorthand\"\n" > /tmp/stub-opencode2 && chmod +x /tmp/stub-opencode2' -E 'opencode-permissions-kit upgrade-opencode --binary-path /tmp/stub-opencode2' && \ +E 'opk upgrade-opencode --binary-path /tmp/stub-opencode2' && \ echo " ${GREEN}OK${NC} kit CLI upgrade-opencode completed" check "11b: upgrade-opencode replaced the binary (shorthand works)" \ E 'test "$(/usr/local/lib/opencode-permissions-kit/bin/opencode --version 2>/dev/null | head -1)" = "opencode version 7.7.7-shorthand"' diff --git a/tests/test-kit-cli.sh b/tests/test-kit-cli.sh index be64ed5..44ab1d2 100755 --- a/tests/test-kit-cli.sh +++ b/tests/test-kit-cli.sh @@ -64,12 +64,12 @@ export PATH # Dispatch through a symlink like /usr/local/bin does. BIN="$WORK/bin" mkdir -p "$BIN" -ln -s "$LIB/kit" "$BIN/opencode-permissions-kit" +ln -s "$LIB/kit" "$BIN/opk" cp "$KIT" "$LIB/kit" chmod +x "$LIB/kit" run_kit() { - OPK_INSTALL_CONF="$WORK/install.conf" "$BIN/opencode-permissions-kit" "$@" 2>/dev/null + OPK_INSTALL_CONF="$WORK/install.conf" "$BIN/opk" "$@" 2>/dev/null } echo "=== CLI dispatcher tests ===" @@ -145,7 +145,7 @@ if run_kit update >/dev/null 2>&1; then else echo " ${GREEN}PASS${NC} missing script exits non-zero"; passed=$((passed + 1)) fi -errout="$("$BIN/opencode-permissions-kit" update 2>&1 >/dev/null || true)" +errout="$("$BIN/opk" update 2>&1 >/dev/null || true)" case "$errout" in *"not found"*) echo " ${GREEN}PASS${NC} missing script names the problem"; passed=$((passed + 1)) ;; *) echo " ${RED}FAIL${NC} missing script names the problem (got: $errout)"; failures=$((failures + 1)) ;; @@ -170,7 +170,7 @@ fi # unknown target -> usage error naming the choices (hermetic: explicit # install.conf — CI runners have no /etc/opencode-permissions-kit) -errout="$(OPK_INSTALL_CONF="$WORK/install.conf" "$BIN/opencode-permissions-kit" handover nobody "$WORK/ho-tree" 2>&1 >/dev/null || true)" +errout="$(OPK_INSTALL_CONF="$WORK/install.conf" "$BIN/opk" handover nobody "$WORK/ho-tree" 2>&1 >/dev/null || true)" case "$errout" in *"me or opencode"*) echo " ${GREEN}PASS${NC} handover rejects unknown target"; passed=$((passed + 1)) ;; *) echo " ${RED}FAIL${NC} handover rejects unknown target (got: $errout)"; failures=$((failures + 1)) ;; @@ -185,7 +185,7 @@ fi # system roots and whole home directories are refused for _bad in / /usr /etc /var "/home/$(id -un)"; do - errout="$(OPK_INSTALL_CONF="$WORK/install.conf" "$BIN/opencode-permissions-kit" handover me "$_bad" 2>&1 >/dev/null || true)" + errout="$(OPK_INSTALL_CONF="$WORK/install.conf" "$BIN/opk" handover me "$_bad" 2>&1 >/dev/null || true)" case "$errout" in *"refusing"*) echo " ${GREEN}PASS${NC} handover refuses $_bad"; passed=$((passed + 1)) ;; *) echo " ${RED}FAIL${NC} handover refuses $_bad (got: $errout)"; failures=$((failures + 1)) ;; @@ -211,7 +211,7 @@ fi # elevate — the loop guard must stop the re-entry instead of recursing. rm -f "$WORK/sudo-marker" if [ "$(id -u)" -ne 0 ]; then - errout="$(OPK_INSTALL_CONF="$WORK/install.conf" "$BIN/opencode-permissions-kit" handover me "$WORK/ho-tree" 2>&1 >/dev/null || true)" + errout="$(OPK_INSTALL_CONF="$WORK/install.conf" "$BIN/opk" handover me "$WORK/ho-tree" 2>&1 >/dev/null || true)" if [ -f "$WORK/sudo-marker" ]; then echo " ${GREEN}PASS${NC} handover elevates via sudo"; passed=$((passed + 1)) else diff --git a/tests/test-kit-files.sh b/tests/test-kit-files.sh index 06f85ec..a005fd8 100755 --- a/tests/test-kit-files.sh +++ b/tests/test-kit-files.sh @@ -166,7 +166,7 @@ esac # --- 5. fetch_kit pre-creates every subdirectory in the list ---------------------- # curl -o cannot write into a missing directory: the streamed fetch aborts # with curl error 23 at the first nested file (the tui/ regression — every -# `opencode-permissions-kit update` from the library failed mid-fetch). +# `opk update` from the library failed mid-fetch). fetch_body() { sed -n '/^fetch_kit() {/,/^}/p' "$1" } diff --git a/tests/test-uninstall.sh b/tests/test-uninstall.sh index 5f1e097..9c55e71 100755 --- a/tests/test-uninstall.sh +++ b/tests/test-uninstall.sh @@ -95,6 +95,7 @@ PLAN="$(PATH="$WORK:$PATH" FAKE_SUDO_LOG="$WORK/log" sh "$UNINSTALL" --yes --dry for want in \ "/etc/sudoers.d/opencode-permissions-kit" \ "/usr/local/bin/opencode" \ + "/usr/local/bin/opk" \ "/usr/local/lib/opencode-permissions-kit" \ "/etc/profile.d/opencode-permissions-kit-umask.sh" \ "/etc/opencode-permissions-kit"; do From cc8683d69c5b49535af2f0bc451336716eec89c1 Mon Sep 17 00:00:00 2001 From: Steffen Maechtel Date: Sat, 29 Aug 2026 21:18:45 +0200 Subject: [PATCH 2/2] chore(release): bump VERSION to 0.0.25 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index b056f41..2678ff8 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.0.24 +0.0.25