Homebrew

Everything Homebrew installs is listed in ~/.config/homebrew/Brewfile, tracked as dotfiles/private_dot_config/homebrew/Brewfile.

run_onchange_after_brew-bundle runs brew bundle install --no-upgrade whenever the Brewfile changes. It installs what is missing and never removes anything. Removal is a manual brew uninstall after deleting the line.

What is in it

The list was cut in October 2026 to packages with recent use in shell or agent history. Groups, as the file lays them out:

• shell and core: bash, coreutils, diffutils, ripgrep, wget, tmux, mosh, gnupg, ffmpeg
• build toolchain: make, cmake. ninja, pkgconf, autoconf, automake, and libtool were dropped; add one back if a build asks for it
• iOS: cocoapods, xcodegen, swiftformat, swiftlint, ldid, ipatool
• repo hygiene and containers: gitleaks, actionlint, just, oras, skopeo, flux-operator-mcp, moshi-hook
• apps: 1Password, Raycast, Ghostty, Visual Studio Code, Docker Desktop, Discord, Fantastical, Rewind, Superwhisper, Shottr, Maccy, Rocket, CodexBar, Backblaze, Tailscale, two Nerd Fonts

Third-party taps are declared at the top of the file. brew bundle refuses an untrusted tap, so a new tap needs brew trust <tap> once per machine.

Tailscale startup

~/Library/LaunchAgents/com.tailscale.start-at-login.plist opens the installed Tailscale app in the background at login. It provides a startup path when the app’s bundled login helper is awaiting macOS authorization. Tailscale owns its connection preferences and device registration; those app-generated files stay outside chezmoi.

After the first chezmoi apply, load it for the current session with launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.tailscale.start-at-login.plist. Later logins load it automatically. Removing it requires launchctl bootout gui/$(id -u)/com.tailscale.start-at-login and removal of the managed target.

Filesystem event guard

run_onchange_after_fseventsd-watchdog.sh.tmpl installs a memory watchdog in the root-owned /Library/LaunchDaemons/local.fseventsd-watchdog.plist. The Python standard-library script lives in .chezmoitemplates/fseventsd-watchdog.py and is embedded in the plist. It runs with Apple’s /usr/bin/python3; edits to user-writable source do not change the running root process until the installer is applied with administrator access.

Every 60 seconds it reads the current system daemon’s total physical footprint with vmmap, which accounts for swapped allocations that RSS misses. Two consecutive readings at or above 2 GiB trigger SIGTERM after verifying launchd’s current PID, root ownership and the executable path. launchd starts the replacement daemon. Recovery requests are at least 600 seconds apart, and the watchdog never signals the same PID twice or escalates to SIGKILL. Failed measurements reset the consecutive-reading count and cannot trigger recovery. Actions, observed replacements and errors go to /var/log/fseventsd-watchdog.log.

This replaces the earlier warning-only watchdog, so recovery does not depend on a retained event-table warning. It is automatic recovery from excessive memory use, not a patch to Apple’s daemon. Run its policy and measurement tests with python3 -m unittest discover -s tests -p 'test_fseventsd_watchdog.py'.

Upgrading

brew update && brew upgrade && brew upgrade --cask --greedy && brew cleanup --prune=all

Nothing schedules this. An agent runs it when asked.