arch-installer-safety

name	arch-installer-safety
description	Use when modifying install-arch.sh safety-sensitive behavior, including disk partitioning, encryption, LVM, chroot operations, bootloader/initramfs config, sudo, users, services, or cleanup.

Arch Installer Safety

Use this skill for changes that could affect data loss, bootability, system security, or install reliability.

Safety invariants

• Keep set -o errexit, set -o nounset, and set -o pipefail.
• Preserve the central helpers in install-arch.sh (run_cmd, in_target, as_user, write_file, append_file, enable_services) instead of duplicating dry-run or chroot logic.
• Quote variables, arrays, paths, command substitutions, and heredoc inputs correctly.
• Validate all user-controlled values before use: mode, hostname, username, target device, LUKS password, selected driver, and paths.
• Fail closed with clear errors. Do not add broad catches, silent fallbacks, or early returns that hide invalid state.

Destructive operations

• Confirm the target is root-run, UEFI-booted, online, a block device, large enough, unmounted, and not already using installer names such as cryptlvm or volgroup0.
• Never remove broad paths or use broad destructive commands without explicit target validation.
• Wait for partition nodes after changing partition tables.
• Keep cleanup idempotent and ownership-aware: unmount /mnt, swapoff the installer swap LV, deactivate volgroup0, and close cryptlvm only when the current run successfully acquired each resource.

Storage, encryption, and boot

• Use LUKS2 for encrypted root: cryptsetup luksFormat --type luks2.
• Do not log passwords or pass plaintext passwords as command arguments. Hash user passwords through stdin, validate the hash, and unset plaintext variables immediately.
• Preserve device suffix handling for NVMe, eMMC, and loop devices.
• Preserve GRUB encrypted-root configuration through /etc/default/grub using the LUKS partition UUID so both linux and linux-lts entries are covered.
• Preserve mkinitcpio hooks needed for encrypted LVM boot.

Chroot, sudo, and services

• Use in_target for arch-chroot /mnt ... commands.
• Use as_user for target-user commands so HOME, USER, and LOGNAME are correct.
• Prefer sudoers drop-ins validated with visudo -cf /etc/sudoers; avoid editing /etc/sudoers directly.
• Enable services through enable_services unless a command needs special sequencing.