chore(dotfiles): batch dangling workspace updates

Apply pending repo-local editor associations, Windows bootstrap winget Wakatime installs, Brew ignore/docs updates, and Cursor terminal profile tweaks in one atomic change.

Made-with: Cursor

Author: ChipWolf

.vscode/settings.json

@@ -1,11 +1,12 @@
 {
-  "workbench.iconTheme": "fira-code-material-minimal",
-  "editor.fontFamily": "fira-code-nerd, FiraCode Nerd Font, Consolas, 'Courier New', monospace",
-  "editor.fontLigatures": true,
-  "terminal.integrated.defaultProfile.linux": "zsh",
-  "terminal.integrated.profiles.linux": {
-    "zsh": {
-      "path": "zsh"
-    }
+  "files.associations": {
+    "*.tmpl": "gotmpl",
+    "*.sh.tmpl": "shellscript",
+    "*.ps1.tmpl": "powershell",
+    "*.json.tmpl": "jsonc",
+    "*.jsonc.tmpl": "jsonc",
+    "*.toml.tmpl": "toml",
+    "*.cfg.tmpl": "ini",
+    "*.zsh.tmpl": "shellscript"
   }
 }

README.md

@@ -209,5 +209,6 @@ gh attestation verify oci://ghcr.io/chipwolf/dotfiles:v1.5.1 --repo chipwolf/dot
 
 | Document                           | Contents                                                       |
 |------------------------------------|----------------------------------------------------------------|
+| [docs/brew-review.md](docs/brew-review.md) | Homebrew drift review flow, prompts, and safe tap handling     |
 | [docs/yubikey.md](docs/yubikey.md) | YubiKey SSH workflow, backup strategy, credential hygiene      |
 | [docs/secrets.md](docs/secrets.md) | Bitwarden integration, GnuPG config, secret introduction order |

docs/brew-review.md

@@ -0,0 +1,56 @@
+# brew-review
+
+`brew-review` is an interactive Homebrew drift review helper used by this dotfiles repo.
+
+It compares:
+
+- what is currently installed (`brew bundle dump`)
+- what is declared in `home/Brewfile`
+- what is explicitly ignored in `home/Brewfile.ignore`
+
+## Why it exists
+
+Over time, ad-hoc `brew install` usage can create drift between your machine and the repo's declared package set. `brew-review` helps reconcile that drift so `Brewfile` stays intentional.
+
+## When it runs
+
+The script is wired into chezmoi as an `after` `run_onchange` script:
+
+- `home/.chezmoiscripts/run_onchange_after_brew_review.sh.tmpl`
+
+It runs after apply when the tracked `Brewfile` content changes, and only in interactive sessions (TTY). In non-interactive contexts, it exits silently.
+
+## What it does
+
+For each package installed locally but missing from `Brewfile` (and not ignored), it prompts:
+
+- **add**: append to `Brewfile` and re-sort sections
+- **remove**: uninstall the package
+- **ignore permanently**: append to `Brewfile.ignore`
+- **skip**: do nothing
+
+It also reports packages declared in `Brewfile` but currently missing locally (informational only).
+
+## Manual usage
+
+The executable is managed at:
+
+- `home/dot_scripts/executable_brew-review` (deploys to `~/.scripts/brew-review`)
+
+Basic usage:
+
+```bash
+brew-review
+```
+
+Optional positional arguments:
+
+```bash
+brew-review /path/to/Brewfile /path/to/Brewfile.ignore
+```
+
+## Notes
+
+- Sections are sorted by package name while preserving section order.
+- Tap removal is handled safely by uninstalling installed tap packages before untapping.
+- `Brewfile` and `Brewfile.ignore` in this repo are source-state files (they are not directly deployed into `~/`).

home/.chezmoiscripts/run_onchange_after_bootstrap_windows.ps1.tmpl

@@ -22,9 +22,15 @@
   "winlibs"
   "wezterm"
 -}}
+{{- $wingetPackages := list
+  "Wakatime.CLIWakatime"
+  "Wakatime.DesktopWakatime"
+-}}
 {{ if eq .chezmoi.os "windows" -}}
 # Chocolatey package list hash (triggers re-run when this list changes):
 # {{ join " " $chocoPackages | sha256sum }}
+# Winget package list hash (triggers re-run when this list changes):
+# {{ join " " $wingetPackages | sha256sum }}
 
 $ErrorActionPreference = "Stop"
 
@@ -45,6 +51,18 @@ $elevatedScript = {
     Write-Host "Installing Chocolatey packages..."
     choco install {{ join " " $chocoPackages }} -y --no-progress
 
+    $wingetPackages = "{{ join " " $wingetPackages }}".Split(" ", [System.StringSplitOptions]::RemoveEmptyEntries)
+    foreach ($wingetPackage in $wingetPackages) {
+        $existing = winget list --id $wingetPackage --exact --accept-source-agreements 2>$null | Out-String
+        if ($existing -match [Regex]::Escape($wingetPackage)) {
+            Write-Host "Winget package already installed: $wingetPackage"
+            continue
+        }
+
+        Write-Host "Installing Winget package: $wingetPackage"
+        winget install --id $wingetPackage --exact --silent --accept-package-agreements --accept-source-agreements
+    }
+
     # --- WSL ---
     if (-not (Get-Command wsl -ErrorAction SilentlyContinue)) {
         Write-Host "Installing WSL..."

home/.chezmoitemplates/cursor-settings.json.tmpl

@@ -9,6 +9,12 @@
     "obsidianPreview.vaultPath": "{{ .chezmoi.homeDir }}/Documents/Obsidian/Vault",
     "update.releaseTrack": "prerelease"{{ if eq .chezmoi.os "windows" }},
     "terminal.integrated.fontFamily": "FiraCode Nerd Font Mono",
+    "terminal.integrated.defaultProfile.linux": "zsh",
+    "terminal.integrated.profiles.linux": {
+      "zsh": {
+        "path": "zsh"
+      }
+    },
     "terminal.integrated.defaultProfile.windows": "WSL Bash",
     "terminal.integrated.profiles.windows": {
         "WSL Bash": {

home/Brewfile.ignore

@@ -2,4 +2,5 @@
 # Packages listed here are permanently excluded from drift review.
 # One entry per line, same format as Brewfile (e.g. `brew "foo"`, `cask "bar"`).
 # Lines beginning with # are ignored.
+brew "k9s"
 brew "prowler"