harmonize with coredesktop

updates.d/10-pacman.sh

@@ -25,7 +25,9 @@ if initramfs_build_failed; then
 fi
 
 echo "Checking for new packages..."
-install_packages "${SERVERS[@]}"
-install_packages "${UTILITIES[@]}"
+install_packages "${SERVERS[@]}" || STATUS=1
+install_packages "${UTILITIES[@]}" || STATUS=1
+install_packages "${SHELL_TOOLS[@]}" || STATUS=1
+install_packages "${AGENTS[@]}" || STATUS=1
 
 exit $STATUS

updates.d/12-migrations.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Run one-time changes from migrations/ that haven't run on this machine yet.
+# This is how machines installed before a change to install.sh catch up, so a
+# change that should reach existing machines needs a migration as well. To add
+# one, create migrations/$(date +%s).sh; it runs with bash, once, on success.
+#
+# Runs after 10-pacman.sh so migrations install packages against fresh
+# package databases.
+
+MINISERVER="$HOME/.local/share/MiniServer"
+
+source "$MINISERVER/utils.sh"
+
+run_migrations

updates.d/70-claude.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+MINISERVER="$HOME/.local/share/MiniServer"
+
+# claude.sh has run if Claude Code is installed, ~/.local/bin is on PATH in
+# .bashrc, and its settings file exists
+if command -v claude &>/dev/null \
+    && grep -qF 'export PATH="$HOME/.local/bin:$PATH"' ~/.bashrc 2>/dev/null \
+    && [ -f "$HOME/.claude/settings.json" ]; then
+    echo "Claude Code already set up."
+else
+    echo "Setting up Claude Code..."
+    bash "$MINISERVER/claude.sh"
+fi

updates.d/72-sandbox.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+MINISERVER="$HOME/.local/share/MiniServer"
+
+run_update() {
+  local status=0 gateway=0
+  bash "$MINISERVER/sandbox/setup.sh" || status=1
+
+  # Hermes update asks a running gateway to finish its work and restart, but
+  # that signal (SIGUSR1) reaches srt, not the gateway inside its sandbox, so
+  # the update would wait half an hour. Stop the gateway for the update instead;
+  # starting it afterwards also loads new sandbox rules and dependencies.
+  if systemctl --user is-active --quiet hermes-gateway.service; then
+    gateway=1
+    systemctl --user stop hermes-gateway.service || status=1
+  fi
+
+  # The real command, not the sandboxed one in sandbox/bin: updating Hermes
+  # writes outside what its sandbox allows. python-olm, for Matrix, bundles a
+  # CMake file too old for CMake 4 unless told which policies to use.
+  if [ -x "$HOME/.local/bin/hermes" ]; then
+    echo "Updating Hermes Agent..."
+    CMAKE_POLICY_VERSION_MINIMUM=3.5 "$HOME/.local/bin/hermes" update < /dev/null || status=1
+  fi
+
+  if [ "$gateway" = 1 ]; then
+    echo "Starting Hermes' gateway..."
+    systemctl --user start hermes-gateway.service || status=1
+  fi
+  return $status
+}