fix(tools): install zsh on Linux from the catalog

[mlorentedev]

Summary

On Linux nothing installed zsh: packages.json had no entry and no setup step installs it. The zshrc, zsh-aliases, zsh-functions and zsh-nvm deploy entries are gated on requires: zsh, so on a fresh ubuntu-latest runner they never deployed, and the gate reported it as "not this machine's tool". Found by the from-zero job (#2013 X1, run 38110204139; ledger row in #2013 comment 6105288445).

• packages.json: a system entry for zsh, apt only. macOS ships zsh; on Windows the zsh configs do not apply.
• Guard TestManifest_EveryRequiredCommandIsInstalledWhereTheEntryDeploys: every command an ai/deploy.json entry requires is installed by the catalog on each OS the entry deploys to, or is named in requiredButNotCataloged with the reason. An exemption that is no longer needed fails too, so claude (PLAT-001: [EPIC] OS-agnostic from-zero bootstrap — macOS bring-up as the forcing function #2013 PR-B) and pi (Move the pi CLI install from the setup twins into packages.json #2278) must drop theirs when they reach the catalog.

Test plan

• go vet ./... && GOOS=windows go vet ./... && go test ./...: exit 0; golangci-lint run ./...: 0 issues
• bats suites reading packages.json: exit 0
• Mutations: zsh entry removed from packages.json fails the guard on zsh/linux; a stale exemption (lazygit) fails it as no longer needed

Spec

Under 50 production LOC (9 lines of packages.json). It is the P5b row of #2013's X1 ledger.

Knowledge

• Lesson: none: the guard's comment carries the bug class (a requires gate hides a command nothing installs)
• ADR: none: no decision, a missing catalog entry
• Runbook: none: tool-installation.md describes system entries generically

Refs #2013

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 23 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: mlorentedev/dotfiles/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7176ed67-12a2-467e-8802-8c0163306d64

---

📥 Commits

Reviewing files that changed from the base of the PR and between e31c4ee and 8855f10.

---

📒 Files selected for processing (2)

• cli/internal/deploy/manifest_requires_test.go
• packages.json

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 2013 - Partially compliant Compliant requirements: The PR fixes one from-zero ledger finding (nothing installs zsh on Linux, so the requires: zsh deploy entries never deploy and the gate reads as "not this machine's tool"). The fix lands together with a guard (TestManifest_EveryRequiredCommandIsInstalledWhereTheEntryDeploys) that fails if any requires command is uncataloged on a target OS, or if an exemption becomes unnecessary — mutation-verified per the test plan. Well under the ~300 production LOC cap (9 lines of packages.json), one PR. No auto-merge mechanism in the diff; no shell file touched, so ADR-003 bash/zsh portability is not affected. Windows scope respected: the zsh entry is apt-only, Windows/darwin behaviour is declared via explicit exemptions rather than changed. PR body carries a ## Knowledge section with explicit none: rationales per DoD. Non-compliant requirements: Other epic rows this PR does not attempt (W1–W9, W10 macOS CI leg, P0–P2 and later tracks) remain open — they are separate rows/PRs, not defects of this change. No specs/<id>/ folder is touched; the PR relies on a written skip rationale in its body instead (see human verification below). Requires further human verification: Whether the PR actually carries the skip-sdd label: the written rationale ("Under 50 production LOC... P5b row of PLAT-001: [EPIC] OS-agnostic from-zero bootstrap — macOS bring-up as the forcing function #2013's X1 ledger") is present, but labels are not visible in the diff/description provided. Whether the from-zero job (X1, run 38110204139) now deploys zshrc/zsh-aliases/zsh-functions/zsh-nvm on ubuntu-latest after this merges — needs a live CI run, not static review. Board state for PLAT-001: [EPIC] OS-agnostic from-zero bootstrap — macOS bring-up as the forcing function #2013 (issue picked up / Status In Progress per Standing Order feat(tmux): focus-events, vi visual-mode bindings, slower status refresh #8) cannot be verified from the diff. 2278 - Partially compliant Compliant requirements: (none) — this PR does not implement Move the pi CLI install from the setup twins into packages.json #2278; it only references the ticket. Non-compliant requirements: All acceptance items (packages.json pi entry with ignore-scripts, PI_VERSION removal, setup twins stop installing pi, catalog test, doctor pin read, Windows CI install) are untouched — explicitly deferred by this PR until Move the pi CLI install from the setup twins into packages.json #2278, whose sequencing requires feat(install): make install.{sh,ps1} the one entrypoint that hands off to converge #2275 to merge first. Requires further human verification: Confirm the temporary pi exemption in requiredButNotCataloged is removed in Move the pi CLI install from the setup twins into packages.json #2278 (the guard now enforces this, so the risk is self-correcting). Whether feat(install): make install.{sh,ps1} the one entrypoint that hands off to converge #2275 has merged (sequencing gate for Move the pi CLI install from the setup twins into packages.json #2278) is outside this PR's scope.

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

---

⚙️ Agent run details

• Model: openai/mimo-v2.6-flash
• Tokens: 18,430 in / 21,113 out / 39,543 total
• Time cost: 407.0s
• AI calls: 1

[mlorentedev]

Review triage

Reviewers on 8855f10:

• PR-Agent (full review): no major issues, no security concerns, no inline findings. Its three "human verification" items:
  • skip-sdd label: not needed; spec-gate applies at 50 production LOC and this diff has 9.
  • X1 deploying the zsh configs: checked live once ci: prove a machine from zero converges and stays converged #2331 runs on main.
  • Board state of PLAT-001: [EPIC] OS-agnostic from-zero bootstrap — macOS bring-up as the forcing function #2013: In Progress.
• CodeRabbit: did not review (free-tier limit), so it raised nothing.

The test job failure was curl: (35) Connection reset by peer while downloading age, unrelated to this diff. The failed job was re-run, and #2339 adds retries to those downloads.