#1872 fix: drop the legacy dot and repair dangling metafile paths - #1881
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughInstaller dot metadata removes stale source references, updates current sync and preserve paths, removes the legacy Hyprland configuration, and adds validation that declared non-glob source paths exist. ChangesDot metadata maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/python/check_dots.py`:
- Around line 104-108: Update the declared-path validation loop in
declared_paths(table) to resolve each string candidate relative to the resolved
source_root and reject it unless it remains inside that source-root directory,
including rejecting absolute paths and .. traversal. Perform this containment
check before the has_glob(relative) exemption, while preserving the existing
missing-path validation for allowed candidates.
- Around line 22-25: Update declared_paths to normalize only string and list
values; for any other paths value, return it wrapped in a one-element list
instead of passing it to list(). This lets the existing validator report invalid
scalar types such as integers and booleans without raising TypeError.
In `@tests/README.md`:
- Line 25: Update the test_dots.sh README description to state that filesystem
existence validation applies only to non-glob source paths, while preserving the
existing guarantees for installer metafile parsing, required keys, known
actions, source directories, and Grimblast’s fixed official source.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 276709e8-5902-40da-8b4a-7f3ff31308b7
📒 Files selected for processing (9)
CHANGELOG.mdScripts/dots/fish.tomlScripts/dots/hyprland-legacy.tomlScripts/dots/hyprland.tomlScripts/dots/swaync.tomlScripts/dots/waybar.tomlScripts/dots/zsh.tomltests/README.mdtests/python/check_dots.py
💤 Files with no reviewable changes (2)
- Scripts/dots/hyprland-legacy.toml
- Scripts/dots/hyprland.toml
Comment on lines
+104
to
+108
| for relative in declared_paths(table): | ||
| if not isinstance(relative, str): | ||
| fail(f"{where} declares a path as {type(relative).__name__}, expected a string") | ||
| elif not has_glob(relative) and not (REPO_ROOT / source_root / relative).exists(): | ||
| fail(f"{where} points at a missing path {relative!r}") |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Constrain declared paths to source_root.
Only source_root is checked with inside_repo; an absolute path or a path containing .. can escape that directory and pass whenever the resulting filesystem entry exists. Resolve each candidate and require it to remain beneath the resolved source root before applying the glob exemption.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/python/check_dots.py` around lines 104 - 108, Update the declared-path
validation loop in declared_paths(table) to resolve each string candidate
relative to the resolved source_root and reject it unless it remains inside that
source-root directory, including rejecting absolute paths and .. traversal.
Perform this containment check before the has_glob(relative) exemption, while
preserving the existing missing-path validation for allowed candidates.
Author
There was a problem hiding this comment.
Fixed. Each declared path is resolved against the resolved source root and has to stay under it, checked before the glob exemption. ../../etc/passwd and /etc/passwd are both rejected now.
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- Current relevant implementation ---'
sed -n '15,125p' tests/python/check_dots.py
echo
echo '--- Working-tree diff for the validation file ---'
git diff -- tests/python/check_dots.pyLength of output: 4583
@RAprogramm, I can’t verify the fix in the current PR revision: tests/python/check_dots.py still lacks a resolved-path containment check, and there is no diff for that file. It continues to check only path existence after the glob exemption.
Please push or update the commit containing the change, then retry so I can confirm and mark this resolved.
This chat is LLM-generated and may be inaccurate.
This was referenced Jul 29, 2026
This was referenced Jul 30, 2026
kRHYME7
added a commit
that referenced
this pull request
Jul 30, 2026
* feat: add wayle bar support as alternative to waybar - Add wayle to session.py known bars for clean session management - Add wallbash hook (wayle.dcol) to sync wallpaper colors with wayle - Make waybar.dcol conditional: skip waybar update when not running * dev * docs: add @0xGeN02 to contributors * feat: add wayle-bin and matugen-bin as optional packages in pkg_extra.lst * feat: add wallbash-to-wayle palette bridge for dynamic theming Uses dcol_* environment variables passed by wallbash's fn_wallbash to set wayle palette colors on every wallpaper/theme change. Files placed in .config/hyde/wallbash/ (non-core component). * fix: hyde-shell pypr subcommand passes args as single string to pypr CLI (#1741) When running `hyde-shell pypr toggle console`, the `run_pypr()` function used `${*:-help}` to capture arguments into a scalar variable. When passed to `pypr "${message[@]}"`, the scalar expands as a single string "toggle console" instead of two separate args. The pypr client then normalizes spaces to underscores, looking up "toggle_console" instead of the "toggle" command with "console" as its argument. Additionally, socket direct writes via nc/socat/ncat lacked a trailing newline, which the pyprland daemon's readline() expects. Fix by using a bash array (`local -a msg=("$@")`) to preserve proper word-splitting, and adding `\n` to socket writes. # Pull Request ## Description Please read these instructions and remove unnecessary text. - Try to include a summary of the changes and which issue is fixed. - Also include relevant motivation and context (if applicable). - Make sure to make PR against dev and not the master - List any dependencies that are required for this change. (e.g., packages or other PRs) - Provide a link if there is an issue related to this pull request. e.g., Fixes # (issue) - Please add Reviewers, Assignees, Labels, Projects, and Milestones to the PR. (if applicable) ## Type of change Please put an `x` in the boxes that apply: - [ ] **Bug fix** (non-breaking change which fixes an issue) - [ ] **New feature** (non-breaking change which adds functionality) - [ ] **Breaking change** (fix or feature that would cause existing functionality to not work as expected) - [ ] **Documentation update** (non-breaking change; modified files are limited to the documentations) - [ ] **Technical debt** (a code change that does not fix a bug or add a feature but makes something clearer for devs) - [ ] **Other** (provide details below) ## Checklist Please put an `x` in the boxes that apply: - [ ] I have read the [CONTRIBUTING](https://github.com/HyDE-Project/HyDE/blob/master/CONTRIBUTING.md) document. - [ ] My code follows the code style of this project. - [ ] My commit message follows the [commit guidelines](https://github.com/HyDE-Project/HyDE/blob/master/COMMIT_MESSAGE_GUIDELINES.md). - [ ] My change requires a change to the documentation. - [ ] I have updated the documentation accordingly. - [ ] I have added a changelog entry. - [ ] I have added necessary comments/documentation to my code. - [ ] I have added tests to cover my changes. - [ ] I have tested my code locally and it works as expected. - [ ] All new and existing tests passed. ## Screenshots (if appropriate) ## Additional context Add any other context about the problem here. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Enhanced socket message handling for more reliable and consistent command argument processing across all operations. * Improved default command behavior to automatically display helpful information when commands are executed without any arguments provided. * Optimized internal message formatting and delivery while maintaining complete compatibility with existing fallback communication mechanisms for continued system reliability and operational stability. [](https://app.coderabbit.ai/change-stack/HyDE-Project/HyDE/pull/1741) <!-- end of auto-generated comment: release notes by coderabbit.ai --> * Remove * fix: Fix Hyprland 0.55 breaking changes in configuration files (#1742) * fix(hypr): unset HL_INITIAL_WORKSPACE_TOKEN in startup to prevent apps locking to workspace 1 (#1781) * docs: sync Chinese README with English version (#1779) * fix(volume): use [[ ]] for VOLUME_PIPEWIRE_ENABLE comparison (#1786) The PipeWire detection fallback was written as `|| $VOLUME_PIPEWIRE_ENABLE == true`, which executes the variable's value as a command with `==` and `true` as arguments instead of comparing it. On PulseAudio-only systems (where the pactl grep does not short-circuit) every invocation printed "==: command not found" when the variable was unset, and setting it to "true" only worked by accident of running /usr/bin/true. Wrap the check in [[ ]] so it is an actual string comparison. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * fix(pm): restore module header position in zypper.py (#1784) count_updates and list_updates were inserted above the module docstring and the `from __future__ import annotations` line. Python requires __future__ imports at the top of the file, so the module raised SyntaxError on import, breaking `hyde-shell pm` on openSUSE. Move both functions to the end of the file, matching the layout of the other manager modules. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * Fix/globalcontrol wallpaper validation (#1785) * fix(lib): add missing $ to XDG_DATA_HOME fallback path in get_hyprConf The first fallback config path in get_hyprConf was the literal string "XDG_DATA_HOME/hyde/hyde.conf", which never exists, so user-level default theme values in $XDG_DATA_HOME/hyde/hyde.conf were silently skipped (the grep error is suppressed by 2>/dev/null). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(wallpaper): validate nonexistent path passed to --set The check used `[ -z "$wallpaper_path" ] && [ ! -f "$wallpaper_path" ]`, so a non-empty path to a missing file skipped validation entirely and failed later in get_hashmap with a confusing "No image found in any source" error. Use || so both empty and nonexistent paths report "Wallpaper not found" as intended. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * fix(zsh,hyde-shell): prevent PATH duplication on repeated source (#1823) Co-authored-by: NoistNT <noistnt@users.noreply.github.com> * Lua (#1755) * lua * Added lua configs * Added lua support for Scripts * [for testing ] Added deez dots manifest files * [for testing ] Added deez dots manifest files * some migration logic for zsh * Added the partial deps list * Removed old hyprlang. * added defualt blnk hyprland.lua * Added hyprland error when wallbash for hyprland is not yet generated * Added hyprland error when wallbash for hyprland is not yet generated * Clean up all deprecated scripts * fixing session management logic for newer hyprland * reload on on common --reload and better keb hint UX and alt tab behavior * altab implementation and better binds handling * fix hyprlock * fix dolphin * fix dolphin * move kdeglobals to hyde bundle * cleanup * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * anim * fix batteerynotify dameon * resolves some issues * no anim on selection layer * exposes hyprland.anim.duration_scale for animation speed(duration) control * Silent fail when missing toml parser * fix altab * fix altab * y * app2unit wrapper for non systemd * kitty * some adjustments * added pm agnostic system update ui * cleanup * fix sys update * pm * fix: gobject theming * Fix waybar, move dconf to use lua lgi * make keepass and bitwarden float * some foundation for i18n , docs etc for scripts * todo * fix screenshot conflict * org * some handling on fresh install * almost * Update Configs/.local/bin/hyde-shell Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Configs/.local/lib/hyde/luautils/selector/rofi.lua Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Configs/.local/lib/hyde/keybinds_hint.sh Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Configs/.local/lib/hyde/session/compositor/hyprland.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Configs/.local/lib/hyde/session/plugins/brave.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Configs/.local/lib/hyde/shell/activate.fish Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix shell activations * uwsm hyprland env * fix session hyprland compositor * fix luau hyprtils rofi helper * fix no regex alternation on lua. * fix lua runtime * fix json output on lua * fix list builtin in completions --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Lua (#1835) * lua * Added lua configs * Added lua support for Scripts * [for testing ] Added deez dots manifest files * [for testing ] Added deez dots manifest files * some migration logic for zsh * Added the partial deps list * Removed old hyprlang. * added defualt blnk hyprland.lua * Added hyprland error when wallbash for hyprland is not yet generated * Added hyprland error when wallbash for hyprland is not yet generated * Clean up all deprecated scripts * fixing session management logic for newer hyprland * reload on on common --reload and better keb hint UX and alt tab behavior * altab implementation and better binds handling * fix hyprlock * fix dolphin * fix dolphin * move kdeglobals to hyde bundle * cleanup * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * anim * fix batteerynotify dameon * resolves some issues * no anim on selection layer * exposes hyprland.anim.duration_scale for animation speed(duration) control * Silent fail when missing toml parser * fix altab * fix altab * y * app2unit wrapper for non systemd * kitty * some adjustments * added pm agnostic system update ui * cleanup * fix sys update * pm * fix: gobject theming * Fix waybar, move dconf to use lua lgi * make keepass and bitwarden float * some foundation for i18n , docs etc for scripts * todo * fix screenshot conflict * org * some handling on fresh install * almost * Update Configs/.local/bin/hyde-shell Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Configs/.local/lib/hyde/luautils/selector/rofi.lua Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Configs/.local/lib/hyde/keybinds_hint.sh Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Configs/.local/lib/hyde/session/compositor/hyprland.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Configs/.local/lib/hyde/session/plugins/brave.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update Configs/.local/lib/hyde/shell/activate.fish Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * fix shell activations * uwsm hyprland env * fix session hyprland compositor * fix luau hyprtils rofi helper * fix no regex alternation on lua. * fix lua runtime * fix json output on lua * fix list builtin in completions * safe theme lua state generation --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * pr * waybar: fix `on-scroll` behaviour of `hyprland/workspaces` module with Lua dispatchers (#1850) * waybar: fix `on-scroll` behaviour * waybar: add changelog entry * fix: resolve lua before shell and retire superseded scripts (#1860) * #1854 fix: resolve lua before shell and retire superseded scripts * #1854 fix: name migration after the tagged release * #1854 fix: report migration failures and keep existing backups --------- Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * fix: add `luarocks` to core packages (#1851) Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * chore: refresh outdated dependency pins (#1861) #1856 chore: refresh outdated dependency pins Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * docs: align release version across manifest and changelog (#1862) #1857 docs: align release version across manifest and changelog Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * fix: expand variables in shader source includes (#1859) * #1853 fix: expand variables in shader source includes * #1853 fix: treat empty xdg directory lists as unset --------- Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * fix: adapt other waybar variants for hyprland lua (#1865) This commit also disables [tooltip](Alexays/Waybar#3017), it is quite useless if unconfigured Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * #1866 fix: deduplicate binds by resolved combo and drop unreachable ones (#1870) Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * #1867 test: add a regression suite and a CI job to run it (#1871) * #1867 test: add a regression suite and a CI job to run it * #1867 test: check touchpad gestures alongside keybinds * fix: add luacheck for linting lua files (#1880) Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * fix: resolve Lua migration regressions (#1879) * fix: resolve Lua migration regressions Restore the documented HyDE keymap in the Lua configuration, fix the all-monitors screenshot action, and isolate app2unit from unrelated DEBUG values. Add regression coverage for the public shortcuts and app wrapper environment. * test: address app wrapper review feedback Apply scoped debug defaults before selecting the systemd or direct execution path. Exercise xdg-terminal-exec without systemd and extend the restored keybinding assertions. * test: preserve explicit app debug settings Cover caller-provided APP2UNIT_DEBUG and XTE_DEBUG values in addition to the unrelated DEBUG fallback regression. * fix: launch Lua battery notifier from schema Keep generated desktop startup defaults aligned with the Lua implementation installed by the migration. Add regression coverage so removed shell commands cannot return through generated schema artifacts. * fix: use corrected upstream Grimblast selector Replace the stale experimental toplevel branch with upstream main, which performs a single slurp selection and avoids combining monitor geometry with window capture. Guard the installer source with the dotfile regression test. * fix: render Satty previews with GTK GL Default Satty to the compatible GSK GL renderer when launched from Hyprland while preserving explicit user overrides. Add wrapper regression coverage. --------- Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * fix: provision lua runtime and repair fish activation (#1858) * #1852 fix: provision lua runtime and repair fish activation * #1852 fix: unify lua resolution and isolate the runtime fallback * #1872 fix: drop the legacy dot and repair dangling metafile paths (#1881) Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * #1882 fix: harden the metafile check and exempt remote sources (#1883) * #1882 fix: harden the metafile check and exempt remote sources * #1882 fix: validate sources and survive symlink loops * #1856 chore: refresh Python and Lua dependency pins (#1888) Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * #1875 fix: declare bash in pm.sh and check the sh dialect (#1887) Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * #1891 docs: describe the Lua keybind configuration and add a transition guide (#1892) * #1891 docs: describe the Lua keybind configuration and add a transition guide * #1891 docs: qualify the override rule and expand the entry point path --------- Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> * #1889 fix: point shipped callers at files that still exist (#1890) Co-authored-by: Khing <53417443+kRHYME7@users.noreply.github.com> --------- Co-authored-by: 0xGeN02 <manuelmateodgl02@gmail.com> Co-authored-by: kRHYME7 <53417443+kRHYME7@users.noreply.github.com> Co-authored-by: yun <chenzm39@gmail.com> Co-authored-by: PureFallen <68307987+PureFallen@users.noreply.github.com> Co-authored-by: BigDawnGhost <yelouis231589@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Ariel Piazzano <104594670+NoistNT@users.noreply.github.com> Co-authored-by: NoistNT <noistnt@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Ilya Bogdanov <zeerayne1337@gmail.com> Co-authored-by: RA <70325462+RAprogramm@users.noreply.github.com> Co-authored-by: Rubin Bhandari <roobin.bhandari@gmail.com> Co-authored-by: Jared Bautista <dylanjaredbautistasierra03@gmail.com>
](https://app.coderabbit.ai/change-stack/HyDE-Project/HyDE/pull/1741){kind=link}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Description
Fixes #1872. Both calls in that thread are yours: drop the legacy dot, and the
four remaining ones were an oversight.
Legacy dot removed
Scripts/dots/hyprland-legacy.tomldeployed eleven.conffiles that the Luarelease deleted. Selecting it produced an empty deployment, not a legacy
configuration. The file is gone, and the stale
conflictsentry naming it isgone from
hyprland.toml.Four dangling paths repaired
fish.tomlcompletionsConfigs/.config/fishhas no such directoryswaync.tomlhyde/wallbash/scripts/swaync.dcolswaync.sh, which is the file that exists — the hook is a script, not a templatewaybar.tomlscriptsConfigs/.local/share/waybarhas no such directoryzsh.tomlconf.d/bindsconf.d/binds.zshThe check that would have caught them
tests/python/check_dots.pyvalidatedsource_rootbut not the paths underit. It now resolves every declared path, skipping patterns since those are
expanded at deploy time. Against
devas it stands the check reports allthirteen:
Type of change
Removing the legacy dot is a removal rather than a breaking change: it
deployed nothing, so nobody depended on it working.
Checklist
Testing
sh tests/run.sh— 8 cases, 0 failed. The metafile case reports 24 files afterthe legacy one is gone, all clean.
The new assertion was checked from both sides: it reports the thirteen paths
above against
dev, and is silent on this branch.Summary by CodeRabbit
Removed
Improvements
Tests
Documentation