machines: support macOS and add to mac nest

[tylerthecoder]

Summary

• Make setups/machines/setup.sh cross-platform: skip pacman -S sftpman on macOS, install 1password-cli via Homebrew when op is missing, harden with set -euo pipefail and quoted paths.
• Wire setup.sh as the install hook in setups/machines/setup.json so op inject runs before the link step needs ssh_config.secret.
• Add machines to the mac nest's dependencies so ~/.ssh/config gets linked from the 1Password-injected template.

Test plan

• On Mac: owl nest install (brew installs 1password-cli if missing, then op inject runs)
• On Mac: owl nest link produces ~/.ssh/config → setups/machines/ssh_config.secret
• ssh octo (or any of the 4 hosts) resolves to the IP from the Dev 1Password vault
• On Arch: behavior unchanged — sftpman still installed via pacman

🤖 Generated with Claude Code

---

Note

Medium Risk
Moderate risk because it changes install-time behavior and tooling dependencies (package manager installs and op inject) that can fail differently across OSes and affect ~/.ssh/config generation.

Overview
Adds the machines setup to the mac nest so mac installs now generate and link ~/.ssh/config from the 1Password-injected template.

Wires setups/machines/setup.sh as an install hook and makes it cross-platform: installs sftpman only on Linux/pacman, bootstraps missing op via Homebrew (macOS) or yay (Linux), and hardens the script with set -euo pipefail and quoted paths.

^{Reviewed by Cursor Bugbot for commit ebe1103. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ebe1103. Configure here.}

[cursor]

Link runs before install in All operation

Medium Severity

The machines setup links ssh_config.secret (produced by op inject in the install hook), but the framework's Operation::All in apply_operation_once calls link_once before install_once. When a user runs owl nest all, the link step will fail with "source not found" (silently printing ❌) because ssh_config.secret hasn't been generated yet. The install then creates the file, but the link is never retried, leaving ~/.ssh/config unlinked.

Additional Locations (1)

• setups/machines/setup.sh#L42-L43

 

^{Reviewed by Cursor Bugbot for commit ebe1103. Configure here.}