fix(windows-bootstrap): stabilize WSL provisioning and package gating

Move Windows package/bootstrap inputs into chezmoidata overlays, improve WSL cloud-init templating, and align Brew condition handling so WSL/private exclusions render consistently across bootstrap paths.

Made-with: Cursor

Author: ChipWolf

AGENTS.md

@@ -122,7 +122,7 @@ Deleting a file from the chezmoi source does **not** remove it from the target (
 - **OpenCode** – `home/dot_config/opencode/opencode.jsonc.tmpl` (→ `~/.config/opencode/opencode.jsonc`). This is the global OpenCode config: model, MCP servers, permissions, etc. It is a chezmoi template (uses `.chezmoi.homeDir` for the Obsidian vault path). Edit the source here when updating OpenCode settings.
 - **OpenCode global agent rules** – `home/dot_config/opencode/AGENTS.md` (→ `~/.config/opencode/AGENTS.md`). Universal agent rules that apply across all OpenCode sessions and projects. Edit the source here and run `chezmoi apply`. Never edit `~/.config/opencode/AGENTS.md` directly.
 - **Other config** – `home/dot_config/` includes tmux, mise, finicky; `home/private_dot_gnupg/` for GnuPG (private permissions).
-- **Executable** – `home/dot_scripts/executable_brew-review` (→ `~/.scripts/brew-review`) is the Homebrew drift review script. `home/dot_scripts/executable_7zw` (→ `~/.scripts/7zw`) is a 7-zip wrapper. Both live in `dot_scripts/` — not `dot_zfunctions/` (see Brew section below).
+- **Executable** – `home/dot_scripts/executable_brew-review` (→ `~/.scripts/brew-review`) is the Homebrew drift review script, and `home/dot_scripts/executable_choco-review` is the Chocolatey drift review script (Windows source-side usage from Git Bash/WSL). `home/dot_scripts/executable_7zw` (→ `~/.scripts/7zw`) is a 7-zip wrapper. All script helpers live in `dot_scripts/` — not `dot_zfunctions/` (see Brew section below).
 - **Bootstrap** – `home/.chezmoiscripts/run_once_before_bootstrap.sh.tmpl` runs once before other updates (install deps, brew bundle, oh-my-zsh, mise, etc.). It is OS-aware (darwin/linux) and sets Codespaces overrides when `codespaces` is true.
 - **Root-level (not in source state)** – `install.sh.tmpl` and `install.ps1.tmpl` are installer templates for release assets; `.macos` holds macOS defaults; `.gitignore` excludes local/private artifacts (e.g. `*.local.*`, vim swap/undo). Do not add ignored patterns to the source state.
 - **README "What you get" table** – The tool table in `README.md` is sorted by category: shell/prompt, terminal emulators, multiplexer, editor, dev tools, version control, security, package/runtime management, then platform-specific utilities. When adding or removing a managed tool, update this table and preserve the sort order. Platform columns (macOS, Linux, Windows, Codespaces) must reflect what `.chezmoiignore` actually deploys.
@@ -137,14 +137,14 @@ Deleting a file from the chezmoi source does **not** remove it from the target (
 - **Native Windows** is supported — `chezmoi apply` deploys cross-platform configs (git, nvim, mise, opencode) and Windows-specific configs (WezTerm), while skipping Unix-only targets (zsh, brew, tmux, ghostty, kitty, finicky, gnupg, scripts, opencode-shims).
 - **OS-conditional ignores** in `home/.chezmoiignore` use `{{ if eq .chezmoi.os "windows" }}` and `{{ if ne .chezmoi.os "windows" }}` blocks to control which targets are deployed per platform.
 - **Bash chezmoiscripts** (`run_onchange_after_bootstrap.sh.tmpl`, `run_onchange_after_brew_review.sh.tmpl`, `run_onchange_after_tmux_symlinks.sh.tmpl`) are wrapped in `{{ if ne .chezmoi.os "windows" }}` guards so they render to empty on Windows (chezmoi skips empty scripts).
-- **Windows bootstrap** — `home/.chezmoiscripts/run_onchange_after_bootstrap_windows.ps1.tmpl` installs packages via Chocolatey (`choco install -y`), runs `mise install`, and syncs Neovim plugins. Runs only on Windows.
+- **Windows bootstrap** — `home/.chezmoiscripts/run_onchange_after_bootstrap_windows.ps1.tmpl` installs packages via Chocolatey (`choco install -y`) and Winget, runs `mise install`, and syncs Neovim plugins. `home/.chezmoiscripts/run_onchange_after_choco_review_windows.ps1.tmpl` runs interactive Chocolatey drift review after overlay changes when `bash` is available. Runs only on Windows. The elevated block does **not** skip Chocolatey/WSL when `CI` is set (same code path as interactive runs; `windows-elevation.ps1.tmpl` still avoids UAC in CI by running the block in-process). Package lists live in `home/.chezmoidata/chocolatey/*.yaml` and `home/.chezmoidata/winget/*.yaml` as `overlays.<name>.packages` (same merge idea as `home/.chezmoidata/brew/`: overlay dicts merge; lists under each overlay are concatenated in lexical overlay name order).
 - **`install.ps1.tmpl`** at the repo root is the Windows installer template equivalent of `install.sh.tmpl`: installs Chocolatey, chezmoi, and git, then runs `chezmoi init --apply`.
 - **WezTerm** — `home/dot_config/wezterm/wezterm.lua` (→ `~/.config/wezterm/wezterm.lua`). Windows terminal emulator with kitty graphics protocol support. Ignored on non-Windows via `.chezmoiignore`.
 - **OpenCode** — `home/dot_config/opencode/opencode.jsonc.tmpl` renders MCP and permission data from `home/.chezmoidata/mcps/*.yaml` and `home/.chezmoidata/agent-permissions/*.yaml`. Atlassian entries are gated by `conditions` in those overlays (for example `private: false`), so they are excluded on personal machines. Since Windows is always personal, this also covers Windows.
 - **Package manager** — Windows uses Chocolatey (`choco`), not winget or scoop.
 - **When adding new configs**, decide if the target is cross-platform, Unix-only, or Windows-only, and update `home/.chezmoiignore` accordingly.
 - **When adding new chezmoiscripts**, bash scripts (`.sh.tmpl`) must be guarded with `{{ if ne .chezmoi.os "windows" }}` and PowerShell scripts (`.ps1.tmpl`) with `{{ if eq .chezmoi.os "windows" }}` so they render to empty on the wrong OS.
-- **WSL** — The Windows bootstrap script provisions WSL Ubuntu non-interactively via cloud-init. It writes a cloud-config to `~/.cloud-init/Ubuntu.user-data` (using the Windows username), installs Ubuntu with `--no-launch`, then launches and waits for cloud-init to create the user, clone the dotfiles repo, install chezmoi, and run `chezmoi init --apply --source=...`. Inside WSL, `chezmoi.os` is `"linux"` so the full Unix config stack (zsh, brew, tmux, etc.) applies without modification.
+- **WSL** — The Windows bootstrap script provisions WSL Ubuntu non-interactively via cloud-init. The cloud-init YAML lives in `home/.chezmoidata/wsl/00-ubuntu-user-data.yaml` as `windowsWsl.ubuntuCloudInitUserData` (static data; `.chezmoi.toml` `[data] wsl` remains the boolean “running inside WSL”). On **first** WSL setup only, `~/.local/share/chezmoi` is created with **`cp -a` from the Windows chezmoi source** on `/mnt/<drive>/...` (see `home/.chezmoitemplates/wsl-windows-chezmoi-source-mount-path.tmpl`: maps `.chezmoi.sourceDir`). If that directory already exists, Windows scripts and cloud-init **do not** remove or overwrite it — ongoing dotfile work is done inside WSL. Shared Windows WSL script inputs (`profile.windows.wslUser` + mount path) are built in `home/.chezmoitemplates/wsl-windows-script-context.json.tmpl` (`toJson` / `fromJson`) for `run_onchange_after_bootstrap_windows.ps1.tmpl` and `run_after_95_wsl_ensure_windows.ps1.tmpl`. Set `profile.windows.wslUser` in `home/.chezmoidata/profile.yaml` (required on Windows; empty fails apply for WSL/bootstrap scripts). Scripts substitute `__WSL_CHEZMOI_SOURCE__` and `__WSL_USER__` into that blob at apply time, write `~/.cloud-init/Ubuntu.user-data`, install Ubuntu with `--no-launch`, and wait for cloud-init. Inside WSL, `chezmoi.os` is `"linux"` so the full Unix config stack (zsh, brew, tmux, etc.) applies without modification.
 
 ---
 

docs/agent-permissions.md

@@ -108,3 +108,4 @@ In this repo, Atlassian-specific permission keys live in `home/.chezmoidata/agen
 1. Render OpenCode config with `chezmoi execute-template`.
 2. Run test suite (`tests/source/chezmoi.bats`).
 3. Run `pre-commit run --all-files` before commit.
+

home/.chezmoi.toml.tmpl

@@ -1,10 +1,12 @@
 {{- $codespaces:= env "CODESPACES" | not | not -}}
 {{- $ci := env "CI" | not | not -}}
+{{- $wsl := env "WSL_DISTRO_NAME" | not | not -}}
 {{- $private := or (eq .chezmoi.os "windows") (stat (joinPath .chezmoi.homeDir ".private") | not | not) -}}
 {{- $obsidianVaultPath := joinPath .chezmoi.homeDir "Documents" "Obsidian" "Vault" -}}
 [data]
     codespaces = {{ $codespaces }}
     ci = {{ $ci }}
+    wsl = {{ $wsl }}
     private = {{ $private }}
     obsidianVaultPath = {{ $obsidianVaultPath | quote }}
 

home/.chezmoidata/brew/00-base.yaml

@@ -20,6 +20,7 @@ brew:
           conditions:
             - { kind: env, name: CODESPACES, op: unset }
             - { kind: env, name: CI, op: unset }
+            - { kind: env, name: WSL, op: unset }
         - type: brew
           name: colordiff
           conditions:
@@ -98,6 +99,7 @@ brew:
           conditions:
             - { kind: env, name: CODESPACES, op: unset }
             - { kind: env, name: CI, op: unset }
+            - { kind: env, name: WSL, op: unset }
         - type: brew
           name: tmux
           conditions:
@@ -112,6 +114,7 @@ brew:
           conditions:
             - { kind: env, name: CODESPACES, op: unset }
             - { kind: env, name: CI, op: unset }
+            - { kind: env, name: WSL, op: unset }
         - type: brew
           name: wakatime-cli
           conditions:
@@ -134,10 +137,12 @@ brew:
           name: 1password # work
           conditions:
             - { kind: os, op: is, value: mac }
+            - { kind: env, name: PRIVATE, op: unset }
         - type: cask
           name: 1password-cli # work
           conditions:
             - { kind: os, op: is, value: mac }
+            - { kind: env, name: PRIVATE, op: unset }
         - type: cask
           name: alfred # better spotlight
           conditions:

home/.chezmoidata/brew/10-chipwolf.yaml

@@ -14,10 +14,12 @@ brew:
           name: aws-vault
           conditions:
             - { kind: env, name: CODESPACES, op: unset }
+            - { kind: env, name: PRIVATE, op: unset }
         - type: brew
           name: awscli
           conditions:
             - { kind: env, name: CODESPACES, op: unset }
+            - { kind: env, name: PRIVATE, op: unset }
         - type: brew
           name: bitwarden-cli
           conditions:
@@ -30,6 +32,7 @@ brew:
           name: btop
           conditions:
             - { kind: env, name: CODESPACES, op: unset }
+            - { kind: env, name: WSL, op: unset }
         - type: brew
           name: cbonsai
           conditions:

home/.chezmoidata/chocolatey/00-base.yaml

@@ -0,0 +1,29 @@
+# Chocolatey packages for Windows bootstrap (`run_onchange_after_bootstrap_windows.ps1.tmpl`).
+# Same overlay idea as `home/.chezmoidata/brew/`: add `10-*.yaml` files; each overlay's `packages` list is concatenated in lexical overlay name order.
+chocolatey:
+  overlays:
+    base:
+      packages:
+        - bat
+        - bitwarden-cli
+        - discord
+        - eza
+        - fd
+        - fzf
+        - gnupg
+        - jq
+        - mise
+        - nerd-fonts-FiraCode
+        - neovim
+        - obsidian
+        - oh-my-posh
+        - opencode
+        - powershell-core
+        - powertoys
+        - ripgrep
+        - sysinternals
+        - tree-sitter
+        - treesizefree
+        - wingetui
+        - winlibs
+        - wezterm

home/.chezmoidata/profile.yaml

@@ -8,3 +8,6 @@ profile:
     # signingKey: "0x4C90101E11349775"
   codespaces:
     gitName: "Chip Wolf ‮"
+  windows:
+    # Linux username for WSL Ubuntu (cloud-init user, wsl.conf default). Lowercase. Required on Windows; bootstrap/WSL scripts fail apply if empty.
+    wslUser: "wolf"

home/.chezmoidata/winget/00-base.yaml

@@ -0,0 +1,8 @@
+# Winget package ids for Windows bootstrap (`run_onchange_after_bootstrap_windows.ps1.tmpl`).
+# Overlay merge matches `home/.chezmoidata/brew/` and chocolatey: each overlay contributes a `packages` list, concatenated in lexical overlay name order.
+winget:
+  overlays:
+    base:
+      packages:
+        - Wakatime.CLIWakatime
+        - Wakatime.DesktopWakatime

home/.chezmoidata/wsl/00-ubuntu-user-data.yaml

@@ -0,0 +1,38 @@
+# cloud-init user-data for WSL Ubuntu first boot (written to %USERPROFILE%\.cloud-init\Ubuntu.user-data).
+# Placeholders: __WSL_USER__ (profile.windows.wslUser), __WSL_CHEZMOI_SOURCE__ (Windows chezmoi source as /mnt/<drive>/... path, baked in at apply).
+# Seeds WSL once from the Windows chezmoi source (cp from drvfs). If ~/.local/share/chezmoi already exists, skips copy and init.
+windowsWsl:
+  ubuntuCloudInitUserData: |
+    #cloud-config
+    users:
+    - name: __WSL_USER__
+      groups: [adm,dialout,cdrom,floppy,sudo,audio,dip,video,plugdev,netdev]
+      sudo: ALL=(ALL) NOPASSWD:ALL
+      shell: /bin/bash
+
+    write_files:
+    - path: /etc/wsl.conf
+      append: true
+      content: |
+        [user]
+        default=__WSL_USER__
+
+    runcmd:
+      - |
+        sudo -u __WSL_USER__ bash -lc '
+          if [ -d /home/__WSL_USER__/.local/share/chezmoi ]; then
+            exit 0
+          fi
+
+          mkdir -p /home/__WSL_USER__/.local/share
+          cp -a __WSL_CHEZMOI_SOURCE__ /home/__WSL_USER__/.local/share/chezmoi
+
+          if ! command -v chezmoi >/dev/null 2>&1; then
+            sh -c "`$(curl -fsLS get.chezmoi.io)" -- -b "`$HOME/.local/bin"
+          fi
+
+          PATH="`$HOME/.local/bin:`$PATH"
+          WSL_DISTRO_NAME="${WSL_DISTRO_NAME:-Ubuntu}" DOTFILES_SKIP_BITWARDEN=1 \
+            "`$HOME/.local/bin/chezmoi" init --apply --guess-repo-url=false \
+            --source="`$HOME/.local/share/chezmoi" --exclude=externals
+        '

home/.chezmoiexternal.toml.tmpl

@@ -1,3 +1,5 @@
+{{- if and (not .codespaces) (not .ci) (not .wsl) }}
 ["Documents/Obsidian/Vault"]
     type = "git-repo"
     url = "https://github.com/ChipWolf/obsidian-on.git"
+{{- end }}