packages(arch): route byobu through yay (AUR-only); split official vs AUR lists so pacman --needed can't abort on a missing target; as_user prefers TARGET_USER for AUR builds

lib/log.sh

@@ -9,12 +9,13 @@ ok()   { printf '\033[1;32mok\033[0m %s\n' "$*"; }
 # run a command as root when not already root
 sudo_() { if (( EUID == 0 )); then "$@"; else sudo "$@"; fi; }
 
-# run a command AS the invoking (non-root) user — used for AUR builds, etc.
+# run a command AS the target non-root user — used for AUR builds, nvm, etc.
-# when root: drop to SUDO_USER (or USER) via runuser; when not root: run directly.
+# precedence (when running as root): TARGET_USER (set by create-user) > SUDO_USER > USER.
+# when not root: run directly as ourselves.
 as_user() {
-  local u="$USER"
+  local u="${SUDO_USER:-$USER}"
   if (( EUID == 0 )); then
-    u="${SUDO_USER:-$USER}"
+    u="${TARGET_USER:-${SUDO_USER:-$USER}}"
     command -v runuser >/dev/null 2>&1 && runuser -u "$u" -- "$@" || su "$u" -c "$*"
   else
     "$@"

modules/10-packages.sh

@@ -20,32 +20,54 @@ run_packages() {
 }
 
 # ── arch ─────────────────────────────────────────────────────────────────────
+# official-repo packages (verified in extra/core). Any name not in the official
+# repos would abort the whole `pacman --needed` batch, so keep this list clean
+# and route AUR-only tools through _install_aur_packages instead.
+ARCH_OFFICIAL=(git ufw mosh btop fzf ripgrep fd bat dust procs jq yq tree
+              ncdu duf tldr httpie rsync lazygit neovim curl unzip less starship
+              eza zoxide openssh)
+
+# AUR-only packages (not in official repos) — installed through yay after build.
+ARCH_AUR=(byobu)
+
 _pkg_arch() {
   sudo_ pacman -Sy --noconfirm --needed base-devel openssh
-  # most tools live in extra/community (the merged repos); names map 1:1
+  sudo_ pacman -Sy --noconfirm --needed "${ARCH_OFFICIAL[@]}"
-  local p=(git byobu ufw mosh btop fzf ripgrep fd bat dust procs jq yq tree
-           ncdu duf tldr httpie rsync lazygit neovim curl unzip less starship
-           eza zoxide openssh)
-  sudo_ pacman -Sy --noconfirm --needed "${p[@]}"
   _install_yay
-
+  _install_aur_packages
   # fd/bat ship with their real names on arch — no shims needed
 }
 
 _install_yay() {
   if command -v yay >/dev/null 2>&1; then ok "yay already installed"; return; fi
   log "building yay from AUR (requires a non-root sudoer)"
-  if (( EUID == 0 )) && [[ -z "${SUDO_USER:-}" ]]; then
+  if (( EUID == 0 )) && [[ -z "${TARGET_USER:-${SUDO_USER:-}}" ]]; then
-    err "running as root with no SUDO_USER — yay cannot build. Re-run bootstrap as a normal user with sudo."
+    err "running as root with no target/sudo user — yay cannot build. Run the create-user step first, or re-run bootstrap as a normal user with sudo."
     return 1
   fi
   local tmp; tmp="$(mktemp -d)"
+  # chown the build dir so the non-root build user can write into it
+  if (( EUID == 0 )); then
+    chown -R "${TARGET_USER:-${SUDO_USER}}" "$tmp"
+  fi
   as_user git clone --depth 1 https://aur.archlinux.org/yay.git "$tmp/yay"
   ( cd "$tmp/yay" && as_user makepkg -si --noconfirm )
   rm -rf "$tmp"
   command -v yay >/dev/null 2>&1 && ok "yay installed" || warn "yay install may need a manual pass"
 }
 
+_install_aur_packages() {
+  [[ "${#ARCH_AUR[@]}" -eq 0 ]] && return
+  if ! command -v yay >/dev/null 2>&1; then
+    warn "yay not available — skipping AUR packages: ${ARCH_AUR[*]}"
+    return
+  fi
+  log "installing AUR-only packages: ${ARCH_AUR[*]}"
+  # yay -S as the non-root target user (makepkg refuses root; TARGET_USER via as_user).
+  as_user yay -S --noconfirm --needed "${ARCH_AUR[@]}" \
+    || warn "some AUR packages failed: ${ARCH_AUR[*]} (install manually with: yay -S ${ARCH_AUR[*]})"
+}
+
 # ── debian/ubuntu ────────────────────────────────────────────────────────────
 _pkg_debian() {
   sudo_ apt-get update -y