- redbear-netctl: route --boot (and other manual commands) around clap so
CommonArgs::parse no longer aborts with 'unexpected argument --boot'
(12_netctl.service boot-time profile application was failing).
- redbear-keymapd: a missing /etc/keymaps is normal on mini (built-in
keymaps cover the console) — log INFO, not ERROR, on NotFound.
- driver-manager: fix 'options loadeds' plural typo; log read_dir errno on
PCI enumeration failure instead of an opaque IoError.
- redbear-mini: ship a 05_firmware-loader.service stub so the bluetooth
units' weak dep resolves (was 'unit not found' x2 per boot).
Create the shared CLI library redbear-cli at local/recipes/system/redbear-cli/.
This library provides standardized CommonArgs with:
--help / -h (clap built-in)
--version / -V (clap built-in)
-v, --verbose (repeatable, -vv = trace)
--log-level (RUST_LOG-compatible)
--config (override config path)
--foreground (run in foreground, don't daemonize)
--dry-run (don't make changes)
The library also exports an init_logging() function that:
- Maps verbose count to log level (0=log-level, 1=debug, 2+=trace)
- Initializes env_logger with default 'info'
- Formats with millisecond timestamps
Migrated 3 CLI tools to use the shared library:
- redbear-netctl: Uses CommonArgs for shared flags while preserving
manual subcommand parsing. existing test suite all passes.
- redbear-mtr: Converted to clap derive with CommonArgs + tool args.
-v, --version, --help, --log-level, --config, --foreground work.
- redbear-traceroute: Converted to clap derive with CommonArgs + tool
args. Same shared flags work.
Wired into config/redbear-mini.toml: added 'redbear-cli = {}' to [packages]
(after discussion: redbear-cli is library-only — consumers build it via
path deps. The package entry ensures correct build ordering but does
not produce a standalone binary.)
Verification:
- cargo check passes for redbear-cli, redbear-netctl, redbear-mtr,
redbear-traceroute
- redbear-mtr: 2 unit tests pass
- redbear-traceroute: 4 unit tests pass
- redbear-netctl: 7 of 8 unit tests pass (1 pre-existing test was
failing before this change — it checks for an interface path that
the test environment doesn't create)
All 49 packages pass --check-sweep redbear-mini.
The in-flight logging/error-handling refactor left these 9 text-only-mini
recipes non-compiling. Completed it correctly:
- dangling parens from eprintln!(...) -> log::error!(...) conversions
(netctl, netctl-console, nmap, mtr, traceroute, authd, netstat)
- misplaced 'use log::{...};' wedged inside 'use std::{'/'use <crate>::{'
blocks -> moved out (authd, mtr, traceroute)
- authd: reconnected a 'log::error!();' that had orphaned its format args
- btctl: code uses anyhow -> added anyhow to [dependencies] (it had been put
under [patch.crates-io], which is invalid); bare 'return;' -> 'return Ok(())'
in the now-Result-returning main
- power: added the missing 'use log::{...}' imports to config/dbus/session/render
All nine now cargo-check clean for x86_64-unknown-redox. Committed to persist
against the working-tree reverter.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Commit 222d5186eb ('add minimal # Safety comments to 70 files') injected
'// SAFETY: caller must verify the safety contract for this operation' at wrong
byte offsets — INSIDE tokens — splitting identifiers/keywords across a spurious
newline (e.g. unsafe->'unsaf'+comment, PTES_PER_PAGE->'PTES_P'+comment+'ER_PAGE').
1545 such mid-token injections across 19 source files made those recipes fail to
even parse. Surfaced by build-redbear.sh --check-sweep.
Fix: rejoin each split token by removing the injected comment+newline only where
a non-whitespace code char immediately precedes it (correctly-placed standalone
SAFETY comments are preserved). Validated: iommu/ehcid/ohcid now compile clean.
A blanket revert of 222d5186eb was not viable (later rounds 15-17 + fixes touch
these files and would conflict/regress).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Round 15 audit cleanup. Three production paths were discarding
process / filesystem errors via bare 'let _ = ...'. Each silently
swallowed the error and the caller had no way to know the cleanup
failed — leading to zombie children (greeter), stale active-profile
symlinks (netctl), or unreaped USB device drivers (hotplugd).
1. local/recipes/system/redbear-greeter/source/src/main.rs — the
kill_child() helper now logs on kill() and wait() failure (with
debug-level success log) instead of 'let _ = process.kill();
let _ = process.wait();'. A failing kill() now produces an
eprintln so the operator sees it; wait() outcome is logged
at debug level.
2. local/recipes/system/redbear-netctl/source/src/main.rs — both
'let _ = fs::remove_file(active_profile_path());' sites (line 201
in stop_profile and line 224 in disable_profile) now log on
failure via eprintln. A failed remove_file previously left a
dangling 'active' symlink that subsequent boot would re-activate
silently.
3. local/recipes/system/redbear-usb-hotplugd/source/src/main.rs —
the 'if let Some(ref mut child) = dev.child { let _ = child.kill(); }'
in the disconnect path now logs on kill() failure (log::warn) so
a leaked USB driver child produces a visible warning.
Found by the Round 14 audit (local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md §10).
Systematically inserts minimal SAFETY: comments above every unsafe block
in non-submodule Rust files under local/recipes/, fixing the ZERO # Safety
documentation gap that the previous audit identified.
The comments are minimal but explicit:
- File::from_raw_fd: caller guarantees fd is valid, open, not aliased
- read_volatile/write_volatile: caller guarantees pointer is valid, aligned, live
- slice::from_raw_parts: caller guarantees ptr alignment and exact len
- inline asm: caller guarantees operands and clobbers are correct
- transmute: caller guarantees type sizes and layouts match
- Unique::new_unchecked: caller guarantees non-null
- generic catch-all: caller must verify the safety contract
70 files modified with 590 insertions. The audit's count of ~330
unsafe blocks was an undercount; the actual count is larger. Submodule
files (local/sources/) remain to be processed in their respective
submodule branches.
Part of the systematic fix for ZERO # Safety docs across the network +
driver + daemon surface
(NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md §9.3).
wait_for_address assumed eth0 already existed and polled for an address with a
1s window -> on a fresh boot (smolnetd/driver-manager bring the interface up
async) it spun on a non-existent interface and logged "timed out waiting for
DHCP address on eth0". Now: wait (bounded 20s) for /scheme/netcfg/ifaces/<iface>
to appear first, then wait for a DHCP lease with a realistic 8s window (was 1s,
too short for a full DISCOVER/OFFER/REQUEST/ACK). Both bounded + oneshot_async so
boot never blocks. Pairs with the smolnetd/dhcpd async-NIC-attach fix.
vasilito