From d2de52d977658e061a4aa8f98279dbc7c20954d9 Mon Sep 17 00:00:00 2001 From: Peter Pathirana Date: Sun, 16 Aug 2026 20:20:32 +0000 Subject: [PATCH 1/2] fix: vscode remote memory settings + stop leaking PII into remotePlatform extensions.autoUpdate was inverted against its own comment (APPLICATION scope, verified against microsoft/vscode's extensions.contribution.ts) -- this produced six concurrently-installed Claude Code extension versions on the remote. Extends files.watcherExclude/search.exclude to cover the ~11 GB ~/.vscode-server tree, the brew symlink farm and mise's toolchain store, caps tsserver memory, and narrows the git extension's background repository scanning -- all confirmed RESOURCE/WINDOW scope, so they load from this file (VS Code Remote reads User settings from the client for every scope except MACHINE/MACHINE_OVERRIDABLE). remote.SSH.remotePlatform previously hardcoded the deployment's real domain and username in plaintext. One of the two host-key entries doesn't parse under the Coder VS Code extension's current SSH authority format (coder/vscode-coder's src/util/authority.ts) and predates it, so it's dropped; the other is templated using the domain's existing bitwardenSecrets UUID (already used elsewhere in this repo) plus a new coderUsername prompt. Adds private_dot_local/bash/limits.bash to restore an unlimited soft RLIMIT_DATA in every interactive shell, for ppat/coder#859's watchdog, which stamps that limit on the VS Code server tree and relies on inheriting terminals restoring themselves. Roo Code stays in remote.SSH.defaultExtensions -- its removal is blocked on the Mac-side backup in ppat/dotfiles#770. Ref: ppat/dotfiles#772 Co-Authored-By: Claude Opus 5 (1M context) --- .chezmoi.toml.tmpl | 2 + .github/workflows/full-apply-test.yaml | 1 + .../{settings.json => settings.json.tmpl} | 70 +++++++++++++++++-- private_dot_local/bash/limits.bash | 7 ++ 4 files changed, 74 insertions(+), 6 deletions(-) rename private_Library/private_Application Support/private_Code/User/{settings.json => settings.json.tmpl} (63%) create mode 100644 private_dot_local/bash/limits.bash diff --git a/.chezmoi.toml.tmpl b/.chezmoi.toml.tmpl index 7926e81f..948e3ec8 100644 --- a/.chezmoi.toml.tmpl +++ b/.chezmoi.toml.tmpl @@ -4,6 +4,7 @@ {{- $gitName := promptStringOnce . "name" "Enter your full name for Git" -}} {{- $gitEmail := promptStringOnce . "email" "Enter your email for Git" -}} {{- $accessToken := promptStringOnce . "bwsAccessToken" "Enter your BWS Access Token" -}} +{{- $coderUsername := promptStringOnce . "coderUsername" "Enter your Coder deployment username (used in the VS Code remote.SSH.remotePlatform host key)" -}} {{- $editor := or (env "EDITOR") "vim" -}} # Set values in the data section @@ -12,6 +13,7 @@ email = {{ $gitEmail | quote }} editor = {{ $editor | quote }} bwsAccessToken = {{ $accessToken | quote }} + coderUsername = {{ $coderUsername | quote }} [diff] command = "diff" diff --git a/.github/workflows/full-apply-test.yaml b/.github/workflows/full-apply-test.yaml index 29b1f603..075b0157 100644 --- a/.github/workflows/full-apply-test.yaml +++ b/.github/workflows/full-apply-test.yaml @@ -64,6 +64,7 @@ jobs: name = "CI Test" email = "ci@example.com" bwsAccessToken = "unused-fake-token" + coderUsername = "ci-test" EOF - name: chezmoi init --apply (first-time bootstrap) diff --git a/private_Library/private_Application Support/private_Code/User/settings.json b/private_Library/private_Application Support/private_Code/User/settings.json.tmpl similarity index 63% rename from private_Library/private_Application Support/private_Code/User/settings.json rename to private_Library/private_Application Support/private_Code/User/settings.json.tmpl index 8408374d..107c69f7 100644 --- a/private_Library/private_Application Support/private_Code/User/settings.json +++ b/private_Library/private_Application Support/private_Code/User/settings.json.tmpl @@ -38,18 +38,64 @@ // Increase delay before showing code completion suggestions (default: 10ms) "editor.suggestDelay": 3000, "editor.suggest.preview": true, - // Prevent extensions from automatically updating in the background - "extensions.autoUpdate": true, + // Prevent extensions from automatically updating in the background. + // "off" (not boolean false) matches the current extensions.autoUpdate schema -- VS Code + // migrates a legacy boolean to "on"/"off" automatically, but writing the string directly + // avoids relying on that migration (and an in-place rewrite of this chezmoi-managed file). + "extensions.autoUpdate": "off", + "extensions.autoCheckUpdates": false, "files.autoSave": "afterDelay", "files.autoSaveDelay": 300, - // Exclude large directories from file watching to reduce I/O and CPU load + // Exclude large/generated directories from file watching to reduce I/O and CPU load. + // The remote (Coder workspace) home holds an 11 GB ~/.vscode-server tree that VS Code + // would otherwise watch recursively (including itself), plus a Homebrew symlink farm and + // every installed mise toolchain version -- none of these are ever hand-edited. "files.watcherExclude": { "**/.git/objects/**": true, "**/.git/subtree-cache/**": true, "**/node_modules/**": true, "**/dist/**": true, - "**/build/**": true + "**/build/**": true, + "**/.vscode-server/**": true, + "**/.linuxbrew/**": true, + "**/.local/share/mise/**": true, + "**/.terraform/**": true, + "**/.cache/**": true, + "**/.cargo/**": true, + "**/go/pkg/**": true, + "**/.claude/**": true, + "**/target/**": true, + "**/vendor/**": true, + "**/.venv/**": true }, + // Same directories as files.watcherExclude -- keep full-text search from indexing them too. + "search.exclude": { + "**/.git/objects/**": true, + "**/.git/subtree-cache/**": true, + "**/node_modules/**": true, + "**/dist/**": true, + "**/build/**": true, + "**/.vscode-server/**": true, + "**/.linuxbrew/**": true, + "**/.local/share/mise/**": true, + "**/.terraform/**": true, + "**/.cache/**": true, + "**/.cargo/**": true, + "**/go/pkg/**": true, + "**/.claude/**": true, + "**/target/**": true, + "**/vendor/**": true, + "**/.venv/**": true + }, + // Homebrew/mise symlink farms make plain (non-excluded) symlink traversal expensive. + "search.followSymlinks": false, + // Cap the TypeScript server's heap instead of leaving it unbounded. + "typescript.tsserver.maxTsServerMemory": 2048, + "typescript.disableAutomaticTypeAcquisition": true, + // Reduce the git extension's background repository scanning. + "git.autoRepositoryDetection": "openEditors", + "git.repositoryScanMaxDepth": 1, + "git.autofetch": false, "telemetry.telemetryLevel": "off", "window.restoreWindows": "preserve", "window.zoomLevel": 0, @@ -59,9 +105,21 @@ "workbench.list.smoothScrolling": false, "remote.SSH.connectTimeout": 1800, + // Host key matches the "coder-vscode.----." format + // that the Coder VS Code extension's SSH authority parser actually produces (verified against + // coder/vscode-coder's src/util/authority.ts). A second, differently-shaped entry that used + // to live here (a "----" tail instead of ".") does not parse under + // that scheme -- it predates the current extension version and was dropped rather than + // templated (dotfiles#772). "remote.SSH.remotePlatform": { - "coder-vscode.coder.homelab.nikara.net--ppat--peter--main": "linux", - "coder-vscode.coder.homelab.nikara.net--peter--peter.main": "linux" + "coder-vscode.coder.{{ (bitwardenSecrets "288eeda0-d57f-4a91-8651-b2090163ecc0" .bwsAccessToken).value }}--{{ .coderUsername }}--{{ .coderUsername }}.main": "linux" + }, + // APPLICATION/WINDOW-scoped in VS Code's own configuration registry (never MACHINE or + // MACHINE_OVERRIDABLE), so it must live in this file -- the remote Machine settings file + // parses only [MACHINE, MACHINE_OVERRIDABLE] scopes and silently drops anything else. + "remote.extensionKind": { + "vscode-icons-team.vscode-icons": ["ui"], + "bierner.markdown-mermaid": ["ui"] }, "remote.SSH.defaultExtensions": [ "bierner.markdown-mermaid", diff --git a/private_dot_local/bash/limits.bash b/private_dot_local/bash/limits.bash new file mode 100644 index 00000000..63a00067 --- /dev/null +++ b/private_dot_local/bash/limits.bash @@ -0,0 +1,7 @@ +# The Coder workspace memory watchdog (coder repo: script-memory-watchdog.sh) stamps a soft +# RLIMIT_DATA on the VS Code server tree via prlimit to keep it from re-approaching the +# container's memory.max. Terminals forked from ptyHost inherit that soft limit. The watchdog +# deliberately leaves the hard limit at "unlimited" specifically so a shell can restore itself -- +# do that here, every time an interactive shell starts, rather than requiring the operator to +# notice and fix it by hand. +ulimit -d unlimited 2>/dev/null || true From 685fb345a38969253b838fb8d8242e9bcb84dfdc Mon Sep 17 00:00:00 2001 From: Peter Pathirana Date: Sun, 16 Aug 2026 20:23:33 +0000 Subject: [PATCH 2/2] fix(github-actions): NUL-delimit the bitwardenSecrets fake-out grep|xargs grep -rl | xargs (no -Z/-0) word-splits on spaces in paths. This repo's own private_Application Support tree has one, and the previous commit added the first *.tmpl file under it -- full-apply-test's "Fake out bitwardenSecrets calls" step failed immediately once that path was actually matched by --include='*.tmpl'. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/full-apply-test.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/full-apply-test.yaml b/.github/workflows/full-apply-test.yaml index 075b0157..111ee2a8 100644 --- a/.github/workflows/full-apply-test.yaml +++ b/.github/workflows/full-apply-test.yaml @@ -48,7 +48,9 @@ jobs: # prove real Bitwarden Secrets Manager resolution works, which requires a real # bwsAccessToken on a real machine (see DESIGN.md's "CI can't be the full story"). run: | - grep -rl 'bitwardenSecrets' . --include='*.tmpl' --include='*.toml' | xargs -r sed -i 's|{{ (bitwardenSecrets "[^"]*" .bwsAccessToken).value }}|fake-test-value|g' + # -Z/-0: NUL-delimited, so paths with spaces (e.g. "private_Application Support") + # survive the grep -> xargs handoff intact instead of being word-split. + grep -rlZ 'bitwardenSecrets' . --include='*.tmpl' --include='*.toml' | xargs -0 -r sed -i 's|{{ (bitwardenSecrets "[^"]*" .bwsAccessToken).value }}|fake-test-value|g' - name: Install chezmoi run: |