Mnt/more hardening

.gitignore

@@ -9,3 +9,11 @@ __pycache__/
 # Tool caches
 .ruff_cache/
 .mypy_cache/
+
+# Emacs backups and autosaves
+*~
+\#*\#
+.\#*
+# Vim swap files
+*.swp
+*.swo

bin/bwclaude

@@ -260,18 +260,10 @@ ensure_host_dirs() {
 # This is intentional for shared accounts.  On a personal machine,
 # run with --init-auth once to bootstrap persistent credentials.
 build_claude_home_mount() {
-    # Create intermediate --dir entries if CLAUDE_HOME_DIR is nested under $HOME.
-    if [[ "${CLAUDE_HOME_DIR}" == "${_HOME}"/* ]]; then
-        local _rel="${CLAUDE_HOME_DIR#"${_HOME}"/}"
-        local _accum="${_HOME}"
-        local _parts
-        IFS='/' read -ra _parts <<< "${_rel}"
-        local _i
-        for ((_i = 0; _i < ${#_parts[@]} - 1; _i++)); do
-            _accum="${_accum}/${_parts[$_i]}"
-            BWRAP_ARGS+=(--dir "${_accum}")
-        done
-    fi
+    # Create intermediate --dir entries if CLAUDE_HOME_DIR is nested under
+    # $HOME.  CLAUDE_HOME_DIR is the tmpfs mount point, so only its ancestors
+    # are pre-created.
+    _emit_home_intermediate_dirs "${CLAUDE_HOME_DIR}"
 
     BWRAP_ARGS+=(--tmpfs "${CLAUDE_HOME_DIR}")
 
@@ -339,6 +331,10 @@ build_claude_cache_mount() {
 
 # ── Claude env vars ──────────────────────────────────────────────
 build_claude_env() {
+    # NOTE: bwclaude is hard-wired for the NSLS-II AIFAPIM/foundry gateway.
+    # It cannot be used on a personal machine without modifying the foundry
+    # URL/key logic below to point at a different foundry instance.
+
     # Foundry mode is forced on (see CLAUDE_CODE_USE_FOUNDRY below).
     # In foundry mode, Claude Code uses ANTHROPIC_FOUNDRY_* env vars and
     # ignores ANTHROPIC_BASE_URL / ANTHROPIC_API_KEY, so we no longer set
@@ -352,7 +348,7 @@ build_claude_env() {
         echo "Error: bwclaude (foundry mode) requires an API key." >&2
         echo "Export one of:" >&2
         echo "  ANTHROPIC_FOUNDRY_API_KEY=<key>   # direct foundry key" >&2
-        echo "  AIFAPIM_API_KEY=<key>             # NSLS-II hermes/AIFAPIM key (preferred)" >&2
+        echo "  AIFAPIM_API_KEY=<key>             # NSLS-II AIFAPIM key (preferred)" >&2
         exit 1
     fi
 
@@ -373,18 +369,18 @@ build_claude_env() {
     else
         echo "Error: bwclaude requires AIFAPIM_HOST (or ANTHROPIC_FOUNDRY_BASE_URL) to be set." >&2
         echo "Export one of:" >&2
-        echo "  AIFAPIM_HOST=hermes.nsls2.bnl.gov        # NSLS-II Hermes gateway hostname" >&2
+        echo "  AIFAPIM_HOST=<gateway-hostname>          # NSLS-II AIFAPIM gateway hostname" >&2
         echo "  ANTHROPIC_FOUNDRY_BASE_URL=https://...   # full Foundry base URL override" >&2
         exit 1
     fi
 
     # Forward any host CLAUDE_* env vars (incl. user overrides for verbosity, etc.).
     local _key
-    for _key in $(compgen -e); do
+    while IFS= read -r _key; do
         if [[ "${_key}" == CLAUDE_* ]]; then
             BWRAP_ARGS+=(--setenv "${_key}" "${!_key}")
         fi
-    done
+    done < <(compgen -e)
 
     # Enforce after the loop so host env cannot override these.
     BWRAP_ARGS+=(--setenv CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS 1)

bin/bwcodex

@@ -306,18 +306,10 @@ check_codex_config() {
 # behaviour for shared accounts.  On a personal account using
 # ChatGPT login, run with --init-auth once to bootstrap persistent auth.
 build_codex_home_mount() {
-    # Create intermediate --dir entries if CODEX_HOME_DIR is nested under $HOME.
-    if [[ "${CODEX_HOME_DIR}" == "${_HOME}"/* ]]; then
-        local _rel="${CODEX_HOME_DIR#"${_HOME}"/}"
-        local _accum="${_HOME}"
-        local _parts
-        IFS='/' read -ra _parts <<< "${_rel}"
-        local _i
-        for ((_i = 0; _i < ${#_parts[@]} - 1; _i++)); do
-            _accum="${_accum}/${_parts[$_i]}"
-            BWRAP_ARGS+=(--dir "${_accum}")
-        done
-    fi
+    # Create intermediate --dir entries if CODEX_HOME_DIR is nested under
+    # $HOME.  CODEX_HOME_DIR is the tmpfs mount point, so only its ancestors
+    # are pre-created.
+    _emit_home_intermediate_dirs "${CODEX_HOME_DIR}"
 
     BWRAP_ARGS+=(--tmpfs "${CODEX_HOME_DIR}")
 
@@ -417,11 +409,11 @@ build_codex_env() {
 
     # Generic CODEX_* sweep so user-defined overrides flow through.
     local _key
-    for _key in $(compgen -e); do
+    while IFS= read -r _key; do
         if [[ "${_key}" == CODEX_* ]]; then
             BWRAP_ARGS+=(--setenv "${_key}" "${!_key}")
         fi
-    done
+    done < <(compgen -e)
 
     # --debug wrapper flag: force verbose logging regardless of host env.
     if [[ "${DEBUG_MODE}" -eq 1 ]]; then

bin/bwcopilot

@@ -271,17 +271,9 @@ ensure_host_dirs() {
 #   - command-history-state.json, ide/: transient state
 build_copilot_home_mount() {
     # Create intermediate directories for paths under $HOME in the tmpfs.
-    if [[ "${COPILOT_HOME_DIR}" == "${_HOME}"/* ]]; then
-        local _rel="${COPILOT_HOME_DIR#"${_HOME}"/}"
-        local _accum="${_HOME}"
-        local _parts
-        IFS='/' read -ra _parts <<< "${_rel}"
-        local _i
-        for ((_i = 0; _i < ${#_parts[@]} - 1; _i++)); do
-            _accum="${_accum}/${_parts[$_i]}"
-            BWRAP_ARGS+=(--dir "${_accum}")
-        done
-    fi
+    # COPILOT_HOME_DIR is the tmpfs mount point, so only its ancestors are
+    # pre-created.
+    _emit_home_intermediate_dirs "${COPILOT_HOME_DIR}"
 
     # Mount COPILOT_HOME as tmpfs (ephemeral by default)
     BWRAP_ARGS+=(--tmpfs "${COPILOT_HOME_DIR}")

bin/bwopencode

@@ -372,11 +372,11 @@ build_opencode_env() {
     pass_through_if_set AIFAPIM_API_KEY
 
     local _key
-    for _key in $(compgen -e); do
+    while IFS= read -r _key; do
         if [[ "${_key}" == OPENCODE_* ]]; then
             BWRAP_ARGS+=(--setenv "${_key}" "${!_key}")
         fi
-    done
+    done < <(compgen -e)
 }
 
 # ═══════════════════════════════════════════════════════════════════

bin/gh-protect-branch

@@ -45,10 +45,15 @@
 
 set -euo pipefail
 
+if ((BASH_VERSINFO[0] < 4)); then
+    echo "Error: gh-protect-branch requires bash >= 4.0 (found ${BASH_VERSION})." >&2
+    exit 1
+fi
+
 RULESET_NAME="nsls2-branch-protection"
 
 show_help() {
-    sed -n '2,/^$/p' "$0" | sed 's/^# \{0,1\}//'
+    sed -n '2,/^$/{ s/^# \{0,1\}//; p; }' "$0"
 }
 
 APPROVERS_TEAM=""
@@ -89,7 +94,8 @@ REPO="$1"
 BRANCH="${2:-main}"
 
 if [[ ! "${REPO}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
-    echo "Error: repository must be in 'owner/repo' format (got: ${REPO})" >&2
+    echo "Error: repository must be in 'owner/repo' format (e.g. NSLS2/n2snscripts)." >&2
+    echo "       Got: '${REPO}'" >&2
     exit 1
 fi