From 67e6e65311690403cb9756736006fd47135a766e Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Fri, 29 May 2026 15:14:10 -0400
Subject: [PATCH 1/3] Turn off Claude Code attribution via assimilate.sh
 (append-only)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add an idempotent step to assimilate.sh that sets Claude Code's commit/PR
attribution to empty in ~/.claude/settings.json. It only appends the
"attribution" key when it isn't already present (via jq merge), so existing
local settings are never overridden — matching the 'append if absent' intent.
Makes the attribution-off behavior reproducible on new machines.
---
 assimilate.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/assimilate.sh b/assimilate.sh
index cedc37b..64a18a9 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -257,4 +257,15 @@ if command -v nvim >/dev/null; then
   nvim --headless "+Lazy! restore" +qa || true
 fi
 
+# Turn off Claude Code commit/PR attribution. Appends the "attribution" key only
+# if it isn't already set, so existing local settings are never overridden.
+CLAUDE_SETTINGS="$HOME/.claude/settings.json"
+mkdir -p "$HOME/.claude"
+if [ ! -f "$CLAUDE_SETTINGS" ]; then
+  printf '{\n  "attribution": { "commit": "", "pr": "" }\n}\n' > "$CLAUDE_SETTINGS"
+elif ! jq -e 'has("attribution")' "$CLAUDE_SETTINGS" >/dev/null 2>&1; then
+  tmp=$(mktemp)
+  jq '. + {attribution: {commit: "", pr: ""}}' "$CLAUDE_SETTINGS" > "$tmp" && mv "$tmp" "$CLAUDE_SETTINGS"
+fi
+
 echo "> Assimilation successful!"

From 2a3922272e714c7f12d49658be3008241ae16afb Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Thu, 20 Aug 2026 18:55:54 -0400
Subject: [PATCH 2/3] feat: preserve Claude statusline configuration

---
 assimilate.sh | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/assimilate.sh b/assimilate.sh
index 64a18a9..39d5579 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -257,15 +257,18 @@ if command -v nvim >/dev/null; then
   nvim --headless "+Lazy! restore" +qa || true
 fi
 
-# Turn off Claude Code commit/PR attribution. Appends the "attribution" key only
-# if it isn't already set, so existing local settings are never overridden.
+# Configure Claude Code defaults. Appends each key only when it is absent, so
+# existing machine-local settings are never overridden.
 CLAUDE_SETTINGS="$HOME/.claude/settings.json"
 mkdir -p "$HOME/.claude"
 if [ ! -f "$CLAUDE_SETTINGS" ]; then
-  printf '{\n  "attribution": { "commit": "", "pr": "" }\n}\n' > "$CLAUDE_SETTINGS"
-elif ! jq -e 'has("attribution")' "$CLAUDE_SETTINGS" >/dev/null 2>&1; then
+  printf '{\n  "attribution": { "commit": "", "pr": "" },\n  "statusLine": { "type": "command", "command": "~/.claude/statusline.sh", "padding": 0 }\n}\n' > "$CLAUDE_SETTINGS"
+elif ! jq -e 'has("attribution") and has("statusLine")' "$CLAUDE_SETTINGS" >/dev/null 2>&1; then
   tmp=$(mktemp)
-  jq '. + {attribution: {commit: "", pr: ""}}' "$CLAUDE_SETTINGS" > "$tmp" && mv "$tmp" "$CLAUDE_SETTINGS"
+  jq '
+    if has("attribution") then . else . + {attribution: {commit: "", pr: ""}} end
+    | if has("statusLine") then . else . + {statusLine: {type: "command", command: "~/.claude/statusline.sh", padding: 0}} end
+  ' "$CLAUDE_SETTINGS" > "$tmp" && mv "$tmp" "$CLAUDE_SETTINGS"
 fi
 
 echo "> Assimilation successful!"

From 2399176bc1b448196835b70c7f20a8e2b2d33cec Mon Sep 17 00:00:00 2001
From: Alex Kan <29241719+akan72@users.noreply.github.com>
Date: Sun, 5 Jul 2026 11:55:28 -0400
Subject: [PATCH 3/3] Set 7-day minimum release age for npm and bun installs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extends the supply-chain protection uv got in #23 to the JS package
managers actually in use:

- npm: min-release-age=7 (days) appended to ~/.npmrc by assimilate.sh,
  append-only since npm login writes auth tokens there. Enforced by
  npm >= 11.10; older npms warn about the unknown key and ignore it.
- bun: [install].minimumReleaseAge = 604800 (seconds) in .bunfig.toml at
  the repo root — bun's global config path is $XDG_CONFIG_HOME/.bunfig.toml
  and XDG_CONFIG_HOME points at this repo. Also symlinked to ~/.bunfig.toml
  for contexts without XDG_CONFIG_HOME.

Verified on this machine: with vite@8.1.3 published 3 days ago, both npm
and bun resolve vite to 8.1.0, the newest version older than 7 days.
---
 .bunfig.toml  | 16 ++++++++++++++++
 assimilate.sh |  9 +++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 .bunfig.toml

diff --git a/.bunfig.toml b/.bunfig.toml
new file mode 100644
index 0000000..cc1bb0d
--- /dev/null
+++ b/.bunfig.toml
@@ -0,0 +1,16 @@
+# Bun global configuration — https://bun.com/docs/runtime/bunfig
+#
+# Lives at the repo root because bun's global config path is
+# $XDG_CONFIG_HOME/.bunfig.toml and $XDG_CONFIG_HOME points at this repo.
+# assimilate.sh also symlinks it to ~/.bunfig.toml for contexts where
+# XDG_CONFIG_HOME isn't exported (bun ignores ~/.bunfig.toml whenever
+# XDG_CONFIG_HOME is set — verified against bun 1.3.12).
+# A project-local bunfig.toml is merged on top, so repos can still override.
+
+[install]
+# Supply-chain hardening: never resolve a package version younger than 7 days
+# (value is in seconds). Same rolling window as uv's exclude-newer — most
+# malicious/compromised uploads are detected and yanked within a week, so
+# resolution just falls back to the newest version that clears the window.
+# Requires bun >= 1.2.22 (older bun ignores unknown bunfig keys).
+minimumReleaseAge = 604800
diff --git a/assimilate.sh b/assimilate.sh
index 39d5579..d9df406 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -68,6 +68,9 @@ sym agent-instructions.md           .claude/CLAUDE.md
 sym agent-instructions.md           .codex/AGENTS.md
 sym ssh/config                      .ssh/config
 sym uv/uv.toml                      .config/uv/uv.toml
+# bun reads $XDG_CONFIG_HOME/.bunfig.toml (the repo root) in shells; the
+# symlink covers contexts where XDG_CONFIG_HOME isn't exported.
+sym .bunfig.toml                    .bunfig.toml
 
 # Lock down sensitive symlink targets (chmod follows the symlink to the repo file).
 chmod 600 "$HOME/.gitconfig"
@@ -87,6 +90,12 @@ else
   fi
 fi
 
+# npm: refuse package versions younger than 7 days. Append-only because
+# ~/.npmrc may also contain authentication written by `npm login`.
+if ! grep -q '^min-release-age=' "$HOME/.npmrc" 2>/dev/null; then
+  echo 'min-release-age=7' >> "$HOME/.npmrc"
+fi
+
 # macOS-only symlinks and Homebrew (apps/paths don't exist on Linux)
 if [ "$OS" = "Darwin" ]; then
   sym hammerspoon                 .hammerspoon