All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Added
herdr(terminal multiplexer for coding agents, https://herdr.dev) tosf-toolbox: GitHub-releases binary install on Arch (no AUR), Homebrew on Debian/Ubuntu, with automatic version management likertk sf-toolboxnow installs and refreshes global OpenSpec skills and prompt commands (~/.claude/skills/openspec-*,~/.claude/commands/opsx/*) for Claude during provisioning by runningajust sf-openspec-install-global claude, mirroring the macOS sparkdock provisioning; idempotent and skipped when the OpenSpec CLI is absent (sparkfabrik/sparkdock#521)- Enable the Claude Code
ghskill gate automatically in thesf-toolboxrole by running the sparkdock-installedclaude-gh-gate.py enable(blocks rawghcommands until theghskill is loaded), with a fallback warning to runajust claude-gh-gate-enablemanually if the sparkdock script is missing. Mirrors the existing caveman/rtk setup pattern and the macOS sparkdock provisioning. - Install
spark-http-proxyon Linux via a git clone + symlink (under~/.local/spark/http-proxy/src) instead of a standalone downloaded script, mirroring the macOS sparkdock mechanism. This makesspark-http-proxy self-updatework, keeps the compose file in sync with the CLI, and deterministically updates to the latestmainon every provision. Migrates existing installs by replacing the standalone CLI file with a symlink and removing the now-stale standalonecompose.ymlthat would otherwise shadow the clone - Added
http-proxy-install-updateajust recipe (grouphttp-proxy) for parity with macOS sjust; updatesspark-http-proxyvia the CLI's ownself-update(git-pulls the clone it was installed from), so it needs no provisioner checkout or config - Fixed the
provision-tagsajust recipe defaultprovisioner_path($HOME/provisioner→/opt/archlinux-provisioner, wherebootstrap.sh/install.linuxinstall the provisioner) so provisioner-tag recipes find the checkout without manually settingAJUST_PROVISIONER_PATH - Configured
*.loclocal DNS resolution on all OSes (including Debian/Ubuntu) by invokingspark-http-proxy configure-dnsduringsf-toolboxprovisioning - Added
ripgrep(rg) tosf-toolboxpackages for both Arch Linux (pacman) and Debian/Ubuntu (Homebrew) - Added language server binaries for Claude Code's official code-intelligence plugins to the
sf-toolboxrole so org-levelenabledPluginscan wire them in without per-machine setup:intelephense,typescript,typescript-language-server,pyrightvia npm (coversphp-lsp,typescript-lsp,pyright-lspplugins) andgoplsvia pacman on Arch / Homebrew on Debian/Ubuntu (coversgopls-lspplugin). LSP processes only spawn when matching file extensions are present in the workspace, so devs not working in a given language pay no runtime cost - Switched Claude Code from
claude-code(stable) toclaude-code@latestcask on Debian/Ubuntu, which tracks latest releases instead of pinned stable versions; includes migration task to auto-uninstall old cask - Added
/usr/local/bin/sparkfabrik-claude-code-otel-headers— Claude Code OTLPotelHeadersHelperscript, sourced from sparkdock (sparkfabrik/sparkdock#483). - Added automatic caveman configuration via sparkdock setup script (
sjust/scripts/caveman/setup.sh) insf-toolboxrole, with fallback warning to runajust sf-caveman-installmanually - Added automatic rtk configuration via sparkdock setup script after installation, with fallback warning to run
ajust sf-rtk-setupmanually - Added rtk-ai (Rust Token Killer) installation to
sf-toolboxrole with automatic version management from GitHub releases - Added GitHub Copilot CLI as a managed sf-toolbox coding agent (npm on Arch, brew cask on Debian/Ubuntu)
- Added Claude Code as a managed sf-toolbox coding agent (curl installer on Arch, brew cask on Debian/Ubuntu)
- Added Homebrew cask support to sf-toolbox packages task for Debian/Ubuntu
- Added
--help/-hflag tosf-toolboxwith colored output and OS detection display - Added
playbooks/roles/sf-toolbox/role with per-tool task files (packages, gcloud, ai, glab, ajust, http-proxy) - Added
detectsection in toolbox package definitions for binary detection in the installer - Added clean arch/debian separation in toolbox package definitions with dotted-path support in the parser
sf-toolboxnow runsgcloud components updateon every provisioning pass, so an existing Google Cloud SDK in/opt/google-cloud-sdkis kept current instead of staying pinned at the version installed on first provision- Delegated
*.locsystemd-resolved configuration to thespark-http-proxyCLI and removed the bespokedockerrole drop-in (docker-dev-dns.conf,172.17.0.1:19322); the CLI now writeshttp-proxy.conf(127.0.0.1:19322). Legacy~docker/dnsdock routing is no longer configured - Replaced the obsolete Python
yqpackage (pacman) withgo-yq, the mikefarah Go yq v4 (extrarepo); the oldyqis now removed first since the two packages conflict - Homebrew formulae, casks, and rtk now install with
state: latestso packages upgrade on every run - Split rtk installation by OS: GitHub releases on Archlinux, Homebrew on Debian/Ubuntu
- Moved
github-cli(gh) installation frompackagesrole tosf-toolboxrole with Debian/Ubuntu support via Homebrew - Moved GitHub Copilot CLI installation from
packages/tasks/development.ymlto sf-toolbox role - Disabled Google Cloud SDK usage reporting both at install time (
--usage-reporting false) and persistently viagcloud config set core/disable_usage_reporting trueto avoid sending telemetry to Google - Moved opencode base configuration from
~/.config/opencode/opencode.jsonto/etc/opencode/opencode.json(user-owned, in aroot:rootdirectory) to support user-local overrides via~/.config/opencode/opencode.json - Added automatic cleanup of duplicate
~/.config/opencode/opencode.jsonwhen identical to the shipped source, with a warning when the file contains non-custom content - Standardized all shell variable references in
bin/install.linuxto use curly braces syntax (${VAR}) - Moved
config/toolbox-packages.ymlintoplaybooks/roles/sf-toolbox/vars/main.yml(auto-loaded by Ansible, no moreinclude_vars) - Renamed
playbooks/toolbox.ymltoplaybooks/sf-toolbox.ymlfor consistent naming with thesf-toolboxrole and installer - Restructured toolbox package config from flat keys to nested
arch/debian/commonsections - Moved
src/scripts/parse-packages.pytobin/common/parse-toolbox-packages.pywith support for dotted key paths - Moved
just/gumpackage installation from sparkdock role to sf-toolbox role - Moved ajust setup (wrapper, justfile, completion, recipes) from sparkdock role to sf-toolbox role
- Stripped sparkdock role down to git clone + agent resources sync only
- Simplified
bin/install.linux— removed conflict detection/removal, removed plan presentation, added detect/inform status display - Removed invasive apt package and PPA source removal on Debian (Homebrew PATH precedence handles conflicts)
- Updated
system.ymlto import sf-toolbox role (alongside existing roles)
- Fixed
sf-toolboxClaude Code never upgrading on Arch Linux. Theclaude --versiondetection ran without~/.local/binonPATH, so it failed even when Claude Code was installed there, causing the official installer to re-run on every provision while a real upgrade never happened. The detection now includes~/.local/binonPATH, and when Claude Code is already present the role runsclaude update, matching thestate: latestupgrade behavior of the Debian/Ubuntu Homebrew cask path - Fixed
sf-toolboxHomebrew package installs failing on Debian/Ubuntu with "Bubblewrap is installed but cannot create a rootless sandbox" when building source-only formulae (e.g.opencode). Homebrew 6.0 enables a Bubblewrap build sandbox on Linux by default, which fails on distros that restrict unprivileged user namespaces (Ubuntu 24.04+ AppArmor). The brew install tasks now setHOMEBREW_NO_SANDBOX_LINUX=1, and the managed Homebrew shellenv (/etc/profile.d/homebrew.sh,~/.zshrc,~/.bashrc) exports it so manualbrewcommands work too, without relaxing kernel or AppArmor hardening - Fixed
sf-toolboxfailing with "PyYAML is not installed" when a Homebrewpython3shadows the system interpreter onPATH; the installer now selects apython3that has PyYAML (preferring/usr/bin/python3) for the toolbox package parser - Fixed
sf-toolboxnpm packages (e.g.@fission-ai/openspec) never upgrading after first install by switching the Arch and Debian/Ubuntu npm install tasks fromstate: presenttostate: latest, matching the existing Homebrew behavior - Fixed rtk not detected by sf-toolbox conflict system; added
rtktotoolbox.detectlist andis_sf_managed(), removed redundant per-rolewhich -adetection that didn't feed into the conflict resolver - Fixed
resolve_repo_dirinbin/install.linuxalways preferring/opt/archlinux-provisionerover local checkout, preventing local development testing - Fixed
sf-toolboxOS detection to treatCachyOSasArchlinux - Fixed
sf-toolboxsymlink breakingSCRIPT_DIRresolution by resolving symlinks withreadlink -fbefore computing the directory
-
Removed
playbooks/roles/packages/tasks/ai.yml,glab.yml,gcloud.yml,homebrew.yml(merged into sf-toolbox) -
Removed
playbooks/roles/docker/tasks/sparkfabrik-http-proxy.yml(merged into sf-toolbox) -
Removed
playbooks/roles/sparkdock/tasks/packages-arch.ymlandpackages-debian.yml(merged into sf-toolbox) -
Removed sparkdock zshrc sourcing (replaced by ajust shell integration)
-
Added GitHub Actions CI workflow testing the toolbox playbook on Ubuntu 24.04, Ubuntu 26.04, and Arch Linux
-
Added
bin/install.linuxsingle-command installer/updater (sf-toolbox) with detect→plan→confirm→execute flow, gum integration, and conflict removal on Debian -
Added
playbooks/toolbox.ymllightweight playbook for company tooling only (sparkdock, AI, glab, gcloud, http-proxy) without full system provisioning -
Added
config/toolbox-packages.ymlas single source of truth for package definitions consumed by both shell and Ansible -
Added
src/scripts/parse-packages.pystdlib-only YAML parser for shell consumption -
Added
bin/common/logging.shshared logging helpers (sourced from sparkdock) with gum integration and ANSI fallback -
Added Debian/Ubuntu compatibility for sparkdock, AI tooling, and shell setup using Homebrew as the package manager for dev tools on Debian systems
-
Added Homebrew bootstrap task that auto-installs linuxbrew on Debian/Ubuntu systems
-
Added OS-specific task file split pattern (e.g.,
packages-arch.yml/packages-debian.yml) to keep platform logic separated -
Added
gum spinwrapper for headlesssparkdock-agents-syncexecution in non-interactive Ansible context -
Added CHANGELOG.md following Keep a Changelog conventions