Review Mac bootstrap script changes for setup safety
Session from heypocket-reader-sessions on Hugging Face by thomasmustier · MIT · condensed by Coders Talk
2msession
0interventions
GOAL
Review the working tree diff of a personal Mac setup/bootstrap repo against origin/main, checking correctness, completeness on fresh machines, maintainability, and safety of the bootstrap/doctor flow.
- +0Prompt · +0Review the working tree changes in this bootstrap repo against origin/main for correctness, setup completeness, maintainability, and safety of the bootstrap/doctor flow.
- +0mAgent did · +0mPulled the full git diff of the repo against origin/main to see what changed in README, scripts, and config.
- +0mAgent did · +0mRead the key scripts and config files: merge-bootstrap-settings.py, ensure-skill-vendors.py, Brewfile, and settings.json to understand the merge and vendoring logic.
- +1mAgent did · +1mDumped and read bootstrap.sh, install.sh, and new-machine.sh with line numbers to trace the install/bootstrap flow end to end.
- +1mAgent did · +1mRe-read merge-bootstrap-settings.py in detail with line numbers to check exactly how existing settings.json files are merged or overwritten.
- +2mOutcome · +2mDelivered findings, flagging as a P2 issue that install.sh and merge-bootstrap-settings.py write directly to settings.json even when it's a symlink, risking silent edits to a symlinked target instead of the intended backup/replace behavior.
VERDICT
Next time I'd ask upfront to specifically check how the bootstrap scripts treat existing symlinked config files, since that's exactly where the real risk turned out to be. Having the agent read through bootstrap.sh, install.sh, and the merge script in full before answering is what surfaced the settings.json symlink issue rather than a generic 'looks fine' review.