[harleypig]

Summary

Fixes in the bin/ scripts, one commit each:

• Tests: share the repo fixture in tests/shell and the Vim launcher in tests/vim #136 (tests/shell half): the git fixture that four submodule test
  files each set up (a source repository, bare remotes and a
  superproject) is now in tests/shell/helpers/git-fixture.bash, loaded
  with load. The tests/vim half is left for its own change.
• Submodule scripts: unchecked checkout, uncommitted .gitmodules edit, and .git/modules in worktrees #135: set-submodule-branch now checks that git checkout
  worked. If it fails, it reports the submodule, records no branch for
  it, and exits non-zero. Each branch it records is committed right
  away, with only .gitmodules in the commit, so a later rmsubmodule
  no longer refuses over an unstaged .gitmodules. rmsubmodule now
  finds the submodule's git directory in a linked worktree.
• post-clone's apt step aborts on stock Ubuntu because terraform is not in its repositories #130: post-clone no longer asks apt or dnf for terraform or
  terraform-ls. The closing "install by hand" message now lists them
  with HashiCorp's install pages.
• Remove language-server blocks in coc-settings.json that a CoC extension already provides #21 (post-clone half): post-clone no longer installs
  dockerfile-language-server-nodejs. coc-docker depends on it and runs
  its own copy (checked in the npm registry: coc-docker@1.0.2
  depends on dockerfile-language-server-nodejs ^0.9.0). The matching
  coc-settings.json change is in the intellisense PR.
  vscode-html-languageservice was never installed by post-clone, so
  nothing to remove for the html block.
• Four configured ALE linter names do not exist, and vimls is inert #100 (follow-up): post-clone no longer installs
  vim-language-server. ALE stopped running vimls in fix: XDG fallbacks, w!!, paste toggle and ALE linter names (#85, #101, #25, #100) #123, and
  coc-vimlsp builds the server into its own bundle (the npm registry
  lists vim-language-server ^2.3.1 as a devDependency of
  coc-vimlsp@0.13.1, compiled into out/index.js), so the global
  install was used by nothing.
• In-editor Markdown fixer and linter may disagree with .markdownlint.yaml #51 (follow-up): post-clone no longer installs prettier. It
  was installed only as ALE's Markdown fixer, which the intellisense PR
  removes, and nothing else configured runs it. The ALE half lands in
  that PR. If this PR merges first, ALE briefly names a fixer that
  post-clone no longer installs.
• Small tidy-ups: envsubstitute help quote, old shell-lint warnings, proselint config path #44, shfmt: tests/shell/update-coc-extensions.bats reformatted
  with the shfmt options .editorconfig sets for bin/. This is a
  formatting-only commit.
• Small tidy-ups: envsubstitute help quote, old shell-lint warnings, proselint config path #44, bin/ tidy-ups: the commit messages no longer say "and updated
  readme". Unexplained commented-out lines are removed from
  mvsubmodule. update-coc-extensions now reads
  $XDG_CONFIG_HOME/coc/extensions the same way CoC does, and says
  "Cannot parse" when package.json is malformed. post-clone loads nvm
  from where nvm's installer puts it, and uses dpkg-query status, so a
  package that was removed but left its config files gets installed.
• docs/scripts.md is updated for the behaviour changes.

Closes #130
Closes #135
Refs #136
Refs #44
Refs #21
Refs #100
Refs #51

Decisions

• post-clone's apt step aborts on stock Ubuntu because terraform is not in its repositories #130: list terraform for manual install, and add no repository.
  Neither Ubuntu's nor Fedora's repositories carry terraform or
  terraform-ls, so asking apt or dnf for them can only fail. Installing
  packages one at a time would let gawk, jq, shellcheck and shfmt
  install, but every stock machine would still report "Setup did not
  complete". Adding HashiCorp's repository would make the script take a
  trust decision for the user. Listing them with hadolint, sqlint and
  tflint matches how this script already handles tools it does not
  install.
• Submodule scripts: unchecked checkout, uncommitted .gitmodules edit, and .git/modules in worktrees #135: the fix uses --git-path, not --git-common-dir as the issue
  suggested. In a linked worktree, git keeps that worktree's submodule
  directories under .git/worktrees/<wt>/modules/, and
  git rev-parse --git-path modules/NAME returns that path.
  --git-common-dir points at the main checkout's .git/modules, which
  is the wrong directory. Checked with git 2.53.
• Submodule scripts: unchecked checkout, uncommitted .gitmodules edit, and .git/modules in worktrees #135: the issue named mvsubmodule too, but it never reads
  .git/modules. A new test confirms it already works in a linked
  worktree, so it needed no fix.
• Submodule scripts: unchecked checkout, uncommitted .gitmodules edit, and .git/modules in worktrees #135: set-submodule-branch makes one commit per submodule, not one
  at the end. The script's existing early exit (no default branch)
  would otherwise leave edits made before it uncommitted again.
  Committing -- .gitmodules leaves anything else that was staged
  alone. Only .gitmodules is committed, as the issue asked. If
  checking out the branch moves a submodule's gitlink, that change is
  left for the user to commit.
• Tests: share the repo fixture in tests/shell and the Vim launcher in tests/vim #136: the helper is in tests/shell/helpers/. .claude/TESTS.md
  does not say where helpers go. The shared bats convention puts them in
  tests/helpers/, but this helper is shell-only and that directory is
  outside this change's files. bats does not recurse, so
  bats tests/shell does not run it as a test.
• Small tidy-ups: envsubstitute help quote, old shell-lint warnings, proselint config path #44 nvm: the path follows nvm v0.39.7's install.sh
  (nvm_install_dir): NVM_DIR, else $XDG_CONFIG_HOME/nvm, else
  ~/.nvm. If nvm.sh is missing, post-clone now warns instead of
  failing with a source error, and the existing npm check still
  records the failure.

Testing evaluation

Run by the author, to the qa-tester's standard (no delegation in this
run).

1. Verdict: needs tests. They are written in this PR.
2. Automatable: yes. bats, tests/shell/*.bats, with stubs on PATH
   and local bare remotes. Nothing reaches the network and nothing is
   really installed.
3. Falsifiers. Each test was run red against the unfixed script, then
   green:
   • rmsubmodule "removes the submodule's git directory in a linked
     worktree": goes red if the script deletes .git/modules/NAME
     instead of the --git-path result.
   • set-submodule-branch "commits the branch it records, and nothing
     else": goes red if the commit is dropped, or if it commits
     everything that is staged.
   • set-submodule-branch "records no branch when the checkout fails":
     goes red if the checkout result is ignored.
   • post-clone "asks no package manager for terraform…" and "names the
     configured tools…": go red if terraform goes back into
     system_packages.
   • post-clone "installs the linters…": goes red if
     dockerfile-language-server-nodejs, vim-language-server or
     prettier goes back into npm_packages.
   • post-clone "apt-get installs a package that was removed but left
     its configuration": goes red when the check goes back to dpkg -l.
   • post-clone nvm tests (NVM_DIR, ~/.nvm, missing nvm.sh, "reports
     npm installed once"): go red when the script sources the
     dotfiles-only startup file.
   • update-coc-extensions XDG test: goes red with a hard-coded
     ~/.config. The parse test goes red when jq's failure is ignored.
   • mvsubmodule/rmsubmodule "says in its commit message only what it
     did": go red if "and updated readme" returns.
   • The shared fixture: pointing its protocol.file.allow at never
     turned 24 tests red.
   • Characterization, green on master: mvsubmodule "moves a submodule
     in a linked worktree".
4. Disposition: written in this PR. The commented-out lines removed
   from mvsubmodule get no test, because removing a comment changes no
   behaviour.
5. Entry-point reach: each script was exercised through its real
   entry point (the script run as a command). The set-submodule-branch
   failure path was run with a submodule that has neither a local nor a
   remote-tracking main.

Manual verification

1. Where: a stock ubuntu:24.04 container with this branch copied
   in, plus sudo, git and curl installed.
2. What: run bin/post-clone with no npm and no pipx.
3. Success: the apt step reads "Installing missing packages: gawk jq
   shellcheck shfmt", with no terraform. Afterwards dpkg-query reports
   all four as install ok installed. nvm loads from ~/.nvm, and the
   script prints "npm installed successfully". The manual list names
   terraform and terraform-ls.
4. Failure: apt aborts on an unknown terraform package and none of
   the four are installed. Or source reports a missing
   shell-startup/nodejs.
5. What happened: every success line above appeared. The script
   still exited 1 and printed "Setup did not complete". The submodule
   step failed (fatal: not a git repository) because the copy of the
   worktree's .git file points at a path outside the container. That
   failure comes from how the test was set up, not from this change.
   The full failure list was not captured.

Locally: bats tests/shell passed 97 of 97 (and again after the #100 and #51 commits). It also passed run the way
CI runs it, with SIGPIPE ignored and GNU coreutils first on PATH, under
a fresh empty TMPDIR that was still empty afterwards. shfmt -d bin/
and shellcheck bin/* are clean, and the bats files are clean under
shfmt with bin/'s options. markdownlint is clean on
docs/scripts.md.

Review

opt-out: no review skill ran. The changes are small shell fixes,
each with a regression test that was seen to fail first. In place of a
review skill, the author reviewed the full diff by hand.

Self-review of the full diff (git diff origin/master). It found one
problem: the first docs wording missed the case where XDG_CONFIG_HOME
is set but is not a directory. That is fixed. No hook, and no rule or
skill that can refuse work, is changed.

Completion report

1. Functionality works: met. Tests and the container run are above.
2. Access model: not applicable. These are local developer scripts with
   no access surface.
3. Permissions: not applicable, for the same reason. sudo use is
   unchanged.
4. Audit logging: not applicable. The scripts log nothing, and git
   commits are their record.
5. Validation: met. package.json parse failures and failed checkouts
   are now caught.
6. Errors handled: met. A failed checkout, a missing nvm.sh and a
   malformed JSON file each give a clear message and a non-zero exit.
7. Testing: met. See the testing evaluation.
8. Documentation: met for docs/scripts.md and the scripts' --help.
   docs/hashicorp.md still says to install terraform "via package
   manager". That file is outside this change and is listed as a
   follow-up.
9. Completion report: this section.

Co-Authored-By: AI Agent noreply@harleypig.com