Adom Hydrogen (macOS / Lima)

@@ -246,6 +246,35 @@ if (!present) { } else {   console.log("[hydrogen-mac-bootstrap] platform-hygiene hook already registered"); }' 2>/dev/null || log "WARN: node unavailable - hygiene hook not registered (converge-time purge still ran)"+# 0.1.25: ALSO a systemd user timer. The prompt hook alone has a hole proven+# live on a fresh install (Kyle 2026-08-26): the adom-core auto-update hook+# runs its `pkg update` DETACHED, so a hydrogen-bootstrap re-delivery can land+# seconds AFTER the same prompt's hygiene pass already ran — the very first+# audit then sees the twins. The adom user lingers (user@1001 at boot, a bake+# invariant), so a 5-min user timer heals any window without prompt traffic.+if command -v systemctl >/dev/null 2>&1; then+  mkdir -p "$HOME/.config/systemd/user"+  cat > "$HOME/.config/systemd/user/hydrogen-mac-platform-hygiene.service" <<'UNIT'+[Unit]+Description=Purge Windows-line skills a pkg update re-delivered (hydrogen-mac-bootstrap)+[Service]+Type=oneshot+ExecStart=/usr/bin/bash %h/.adom/hooks/hydrogen-mac-platform-hygiene.sh+UNIT+  cat > "$HOME/.config/systemd/user/hydrogen-mac-platform-hygiene.timer" <<'UNIT'+[Unit]+Description=Platform-hygiene sweep every 5 minutes+[Timer]+OnBootSec=2min+OnUnitActiveSec=5min+[Install]+WantedBy=timers.target+UNIT+  XDG_RUNTIME_DIR="/run/user/$(id -u)" systemctl --user daemon-reload 2>/dev/null \+    && XDG_RUNTIME_DIR="/run/user/$(id -u)" systemctl --user enable --now hydrogen-mac-platform-hygiene.timer 2>/dev/null \+    && log "platform-hygiene timer enabled (5-min sweep)" \+    || log "WARN: user systemd unavailable - hygiene runs on prompts + converges only"+fi # Run it once NOW so this converge leaves the container clean. bash "$HOME/.adom/hooks/hydrogen-mac-platform-hygiene.sh" | while read -r l; do log "$l"; done 

@@ -4,7 +4,7 @@   "type": "bootstrap",   "title": "Adom Hydrogen (macOS / Lima)",   "brief": "The macOS platform layer for Adom Hydrogen.",-  "version": "0.1.24",+  "version": "0.1.25",   "description": "The macOS platform layer for Adom Hydrogen, where the workspace runs in a Lima Ubuntu VM hosting the Adom-Workspace systemd-nspawn machine. Depends on adom/hydrogen-bootstrap (the platform-generic Hydrogen layer) and adds everything specific to the Lima/nspawn runtime: the container/networking/ports/setup/topology/volume/workspace-lifecycle hydrogen-* skills (the macOS-runtime bucket), the in-machine workspace-updater daemon, and the macOS code-server workbench seed. Sibling layers adom/hydrogen-windows-bootstrap (WSL2) and adom/hydrogen-ubuntu-bootstrap depend on the same adom/hydrogen-bootstrap. This is the package the golden Lima image installs.",   "org": "adom",   "tags": [

@@ -4,7 +4,7 @@   "slug": "hydrogen-mac-bootstrap",   "title": "Adom Hydrogen (macOS / Lima)",   "brief": "The macOS platform layer for Adom Hydrogen.",-  "version": "0.1.24",+  "version": "0.1.25",   "license": "proprietary",   "visibility": "public",   "metadata": {

@@ -9,7 +9,7 @@ description: How Hydrogen does port forwarding between your workspace machine an > runtime (`HD_RUNTIME=docker`) see the docker/ bucket.  The Hydrogen workspace is the `Adom-Workspace` machine (a systemd-nspawn machine booted-inside the `hd-builder` Lima VM), not a Docker container. There is **no Docker+inside the `hydrogen-builder` Lima VM), not a Docker container. There is **no Docker `-p` port mapping** — Lima exposes the machine's listeners to the Mac for you. Any service that binds `0.0.0.0:<port>` inside the machine is reachable at `localhost:<sameport>` on the Mac automatically. code-server itself binds@@ -119,7 +119,7 @@ via the Browser Picker.  Hydrogen reads/writes its host-side port assignments at `~/Library/Application Support/adom-hydrogen/ports.json`. The `PortConfig` struct-(`hd-control/src/ports.rs`) holds exactly four service ports —+(`hydrogen-control/src/ports.rs`) holds exactly four service ports — `code_server`, `proxy`, `control`, `cdp` — plus the bind `hostname`. There are no relay-WS / relay-HTTP host ports in `PortConfig`: in the machine the relay binds **8765 (WS) / 8766 (HTTP) inside the workspace machine**, reached at the same port on@@ -153,7 +153,7 @@ machine's exposed port). So a busy box does NOT predictably land on and has since moved. To find the real runtime ports, hit **`GET /ports`** on the control API (default `127.0.0.1:47084`) — it returns `{code_server, proxy, control, cdp, hostname}` straight from the resolved-`PortConfig` (`hd-app/src/lib.rs` `get_ports`). `ports.json` is the single source+`PortConfig` (`hydrogen-app/src/lib.rs` `get_ports`). `ports.json` is the single source of truth every consumer reads.  ## Inside vs outside — which URL to use

@@ -8,15 +8,15 @@ description: What Hydrogen's setup steps did to prepare your workspace — the 1 Machine-runtime version (default). The legacy 24-step Docker cascade (`HD_RUNTIME=docker`) is in the docker/ bucket. -When you first launched Adom Hydrogen (or after a virgin reset), Hydrogen ran a 18-step install sequence to turn a blank workspace into a fully-tooled Adom workspace — the `Adom-Workspace` machine. The heavy tooling (code-server, the 8 Adom CLIs, the claude CLI + Code extension, VS Code settings, and all `hd-*` skills) is already BAKED into the golden image; setup just imports that image, injects your Adom session, wires up the relay, and walks the Claude auth gate. This skill explains what each step did so you can help the user understand their environment, re-run failed steps, or wipe and rebuild. See `hydrogen-golden-image` for the baked-image model.+When you first launched Adom Hydrogen (or after a virgin reset), Hydrogen ran a ~19-step install sequence to turn a blank workspace into a fully-tooled Adom workspace — the `Adom-Workspace` machine. The golden image is SLIM: it bakes only the STATIC layer (Ubuntu, code-server, the Adom CLIs). The tooling layer — the `hydrogen-*` skills, the adom-vscode + Claude Code extensions, editor settings — is converge-installed fresh from the Adom Wiki by the cascade (`install-hydrogen-skills`, `install-adom-vscode`, `install-claude-ext`, `configure-vscode`), and the `claude` CLI is a shim to the binary bundled inside the Claude Code extension (golden v21). Setup imports the image, runs those converges, injects your Adom session, and wires up the relay. This skill explains what each step did so you can help the user understand their environment, re-run failed steps, or wipe and rebuild. See `hydrogen-golden-image` for the baked-image model. -The cascade is executed by `setup_steps_macos.rs` (`step_defs_machine()` / `run_all_machine()`). `run_all_machine` is halt-on-failure, resume-not-restart, with per-step 3× auto-retry. In-machine work runs via `limactl shell hd-builder -- sudo nsenter -t <leader> -a -S 1001 -G 1001 -- bash -lc '<cmd>'` (the machine's DEFAULT user is `adom`, UID 1001, home `/home/adom`; under systemd-nspawn the default user comes from the machine config / nsenter `-S 1001 -G 1001`; root variant drops `-S 1001 -G 1001`). There is NO `docker exec` and NO Docker image anywhere in this flow.+The cascade is executed by `setup_steps_macos.rs` (`step_defs_macos()` / `run_all_macos()`). `run_all_macos` is halt-on-failure, resume-not-restart, with per-step 3× auto-retry. In-machine work runs via `limactl shell hydrogen-builder -- sudo nsenter -t <leader> -a -S 1001 -G 1001 -- bash -lc '<cmd>'` (the machine's DEFAULT user is `adom`, UID 1001, home `/home/adom`; under systemd-nspawn the default user comes from the machine config / nsenter `-S 1001 -G 1001`; root variant drops `-S 1001 -G 1001`). There is NO `docker exec` and NO Docker image anywhere in this flow.  ## The 18 steps (in order)  | # | Step | Purpose | |---|------|---------|-| 1 | ensure-workspace | Ensure the Lima VM `hd-builder` is up (provision it if missing — no host reboot needed on macOS), `machinectl import-tar Adom-Workspace` from the golden image `adom-golden.tar.gz` (full pre-baked image from the `adom-inc/hd-lima-image` GitHub release), create the `adom` user, start code-server, verify code-server reachable from the Mac on 7380. SUBSUMES the old Docker pull-image / create-container / start-container steps. |+| 1 | ensure-workspace | Ensure the Lima VM `hydrogen-builder` is up (provision it if missing — no host reboot needed on macOS), `machinectl import-tar Adom-Workspace` from the golden image `adom-golden-v21-arm64.tar.gz` (full pre-baked image from the `adom-inc/hydrogen-lima-image` GitHub release), create the `adom` user, start code-server, verify code-server reachable from the Mac on 7380. SUBSUMES the old Docker pull-image / create-container / start-container steps. | | 2 | wait-codeserver | Host TCP probe of the code-server port (default 7380), 120s | | 3 | install-adom-vscode | "Activate editor extensions" — installs NOTHING (binary + extension are baked); waits for Adom sign-in, reloads the editor iframe, and proves the :8821 editor-control API answers | | 4 | set-env-vars | Set `ADOM_CARBON_URL`, `ADOM_HYDROGEN_URL`, `ADOM_HD_CONTROL_URL`, `VSCODE_PROXY_URI`, `ADOM_DESKTOP_MODE` |@@ -37,13 +37,13 @@ The cascade is executed by `setup_steps_macos.rs` (`step_defs_machine()` / `run_  ### Steps that NO LONGER EXIST (baked into the golden image) -These are NOT setup steps anymore — they are baked at image-build time: `install-hd-skills`, `verify-adom-desktop`, `install-claude-cli`, `install-claude-ext`, `write-vscode-settings`, `set-trusted-domains`, `clean-layout`. If a user asks "what installed the Claude extension / my skills / VS Code settings", the answer is: **baked into the `adom-golden.tar.gz` golden image at build time, not a setup step.** See `hydrogen-golden-image`.+These OLD step names are gone. If a user asks "what installed the Claude extension / my skills / VS Code settings", the answer is: **the live cascade converge-installed them from the Adom Wiki** (`install-hydrogen-skills` → skills + adom-vscode, `install-claude-ext` → the pinned Claude Code extension, `configure-vscode` → settings). Only the static OS/editor layer is baked. See `hydrogen-golden-image`.  ## Common user questions -**"Why is X installed in my workspace?"** → If X is an Adom CLI, the claude CLI, the Claude Code extension, VS Code settings, or an `hd-*` skill, it was **baked into the golden image** — not run as a setup step. The setup steps only import the image, inject your session, wire the relay, and walk Claude auth. The setup panel (Hydrogen UI → bottom) lists every step with its current status.+**"Why is X installed in my workspace?"** → If X is an Adom CLI it is baked into the golden image; the Claude Code extension, VS Code settings, and every `hydrogen-*` skill were **converge-installed by the setup cascade from the Adom Wiki** (slim-image model). The `claude` CLI is a shim to the extension-bundled binary. The setup panel (Hydrogen UI → bottom) lists every step with its current status. -**"Setup failed at step N"** → The setup panel shows the error. Most common failures: step 1 (Lima VM `hd-builder` not available / failed to provision, or the `adom-golden.tar.gz` download), step 11 (test-adom-cli — carbon/hydrogen-proxy not reachable yet), step 12 (Claude credentials expired). Each step has a retry button (and the cascade already retried it 3×).+**"Setup failed at step N"** → The setup panel shows the error. Most common failures: step 1 (Lima VM `hydrogen-builder` not available / failed to provision, or the `adom-golden-v21-arm64.tar.gz` download), step 11 (test-adom-cli — carbon/hydrogen-proxy not reachable yet), step 12 (Claude credentials expired). Each step has a retry button (and the cascade already retried it 3×).  **"Re-run a single step"** → In the setup panel, click the step row and use the Re-run action. Or via API: `POST http://127.0.0.1:47084/setup/step/<id>` (optional body `{"continue_after":true}` to keep going after it). @@ -57,7 +57,7 @@ Virgin reset wipes parts of your workspace so setup can rebuild them cleanly. Th |--------|----------------|-------------| | Install step state (`install_state`) | Marks all steps as pending (`setup-steps-macos.json`) so they re-run | Always (default on) | | Workspace machine (`container`) | PRISTINE `machinectl remove Adom-Workspace` + reimport — deletes the machine AND everything in it, including `/home/adom/project` | Always (default on); your work in `/home/adom/project` is GONE |-| Machine tarball (`tarball`, legacy `image`) | Deletes the cached `adom-golden.tar.gz` (full-image re-download) | Rarely — only if the tarball is corrupted |+| Machine tarball (`tarball`, legacy `image`) | Deletes the cached `adom-golden-v21-arm64.tar.gz` (full-image re-download) | Rarely — only if the tarball is corrupted | | Webview storage (`webview_storage`) | Queued wipe, flushed at next Hydrogen launch (restart_required) | Rarely | | VS Code state (`vscode_state`) | Queued wipe, flushed at next Hydrogen launch (restart_required) | Rarely | | Adom session token (`adom_token`) | Deletes `hydrogen-session.txt`; forces re-login | Rarely |@@ -65,7 +65,7 @@ Virgin reset wipes parts of your workspace so setup can rebuild them cleanly. Th  `confirmed_destructive` must be set. After toggling, hit "Wipe Selected", then "Run All" to rebuild. The machine reset backs up Claude creds first UNLESS `claude_token` is checked; the `webview_storage` / `vscode_state` wipes are queued and flushed at the next Hydrogen launch (restart_required), not immediate. -CRITICAL: the machine reset ONLY ever runs `machinectl remove Adom-Workspace` (+ reimport). It never runs a global teardown — stopping/deleting the `hd-builder` Lima VM itself or running global `machinectl` teardown (those would kill the user's other Lima VMs / `machinectl` machines, including Docker-for-Mac's own VM), and it performs NO Docker actions and NO reboot for the wipe.+CRITICAL: the machine reset ONLY ever runs `machinectl remove Adom-Workspace` (+ reimport). It never runs a global teardown — stopping/deleting the `hydrogen-builder` Lima VM itself or running global `machinectl` teardown (those would kill the user's other Lima VMs / `machinectl` machines, including Docker-for-Mac's own VM), and it performs NO Docker actions and NO reboot for the wipe.  ## Setup panel APIs (useful for AI automation) @@ -86,7 +86,7 @@ Setup writes its state to `~/Library/Application Support/adom-hydrogen/setup-ste  ## Related skills -- `hydrogen-golden-image` — the baked-image model: what's pre-installed in `adom-golden.tar.gz` vs. what setup does+- `hydrogen-golden-image` — the baked-image model: what's pre-installed in `adom-golden-v21-arm64.tar.gz` vs. what setup does - `hydrogen-container` — the workspace machine and runtime that setup configures - `hydrogen-networking` — how the machine reaches the host (via the `adom-host` gateway alias; live control URL in `~/.adom/hydrogen-control-url`) and how ports forward - `hydrogen-browser-picker` — used by step 12 (claude-auth) for the Claude auth OAuth flow