feat(install): show hidden files in macOS Finder

[DevSecNinja]

Why

Hidden dotfiles should be visible in Finder by default on macOS devices managed by these dotfiles.

Approach

Add a native macOS-only Chezmoi run_onchange script that sets the current user's com.apple.finder AppleShowAllFiles preference to true. It applies in both light and full installations, reports write failures, and leaves Linux and Windows unchanged.

Finder is deliberately not restarted automatically to avoid interrupting file operations. The setup output and installation documentation explain that users should relaunch Finder or sign out and back in. The preference is configured on the first apply and whenever the script changes.

Validation

• All 44 focused Finder, Chezmoi script, and shell syntax tests passed, including four new behavior tests.
• ShellCheck, shfmt, and the repository pre-commit hooks passed.
• Isolated macOS light/full chezmoi apply --dry-run --verbose previews include the preference.
• The full Bash CI suite was run but is not green on this macOS host: existing tests outside this change report failures. Those unrelated failures are not addressed here.

Summary by CodeRabbit

• New Features
  • macOS installations now configure Finder to show hidden files in both light and full setups. Relaunch Finder or log out and back in for the change to take effect.
• Documentation
  • Added installation guidance on when the Finder setting is applied and which platforms it affects. Linux and Windows are unchanged.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 7d49a7fe-bf35-4bfd-a21b-6558618e7157

📥 Commits

Reviewing files that changed from the base of the PR and between a8f5c4d and 434d67b.

📒 Files selected for processing (3)

• docs/installation.md
• home/.chezmoiscripts/darwin/run_onchange_20-configure-finder.sh
• tests/bash/finder-defaults.bats

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

A macOS setup script enables Finder’s AppleShowAllFiles preference. Tests cover successful and repeated writes, unsupported platforms, and write failures. Installation guidance describes when the preference is applied and how to make it take effect.

Changes

Finder hidden-file configuration

Layer / File(s)	Summary
Configure and document Finder preference home/.chezmoiscripts/darwin/run_onchange_20-configure-finder.sh, tests/bash/finder-defaults.bats, docs/installation.md	The script skips non-Darwin systems and writes AppleShowAllFiles=true on macOS. Tests cover repeated runs and write failures. Installation guidance describes when the setting is applied and how to make it take effect.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 434d6

The change enables hidden-file visibility in Finder after the user relaunches Finder or signs out and back in. No material merge-readiness risk is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 434d6

The change is limited to a macOS Finder display preference and does not show an access-control change. The preference persists until changed again, and its effect in Finder requires a relaunch or sign-out.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The preference write is confined to the user context running the script; no system-wide target or elevation appears in the script. The evidence does not establish the identity of every possible direct or elevated invocation.

Trust Boundaries and Controls

• observed — On Darwin, the script sources code beneath CHEZMOI_SOURCE_DIR and resolves external commands through the inherited environment. It accepts no positional input and supplies fixed arguments to the preference write.

Resilience and Maintainability Implications

• inferred — A successful write persists independently of the script. Removing the script alone would not reverse that state; whether automatic restoration is required is not established by the installation guidance.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling hidden files in macOS Finder during installation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}