Add recovery Brewfile and Clash public config

Brewfile

@@ -0,0 +1,140 @@
+# Generated from the current machine state on 2026-03-08.
+# Refresh with: ./scripts/brew/export-brewfile.sh
+
+tap "adoptopenjdk/openjdk"
+tap "algolia/algolia-cli"
+tap "cloudflare/cloudflare"
+tap "elastic/tap"
+tap "keyval-dev/odigos-cli"
+tap "konstructio/taps"
+tap "kubefirst/tools"
+tap "oven-sh/bun"
+tap "steipete/tap"
+tap "tw93/tap"
+
+brew "activemq"
+brew "allure"
+brew "ansible"
+brew "argocd"
+brew "autojump"
+brew "bc"
+brew "btop"
+brew "ccusage"
+brew "certbot"
+brew "cloudflared"
+brew "cmake"
+brew "cocoapods"
+brew "composer"
+brew "connect"
+brew "coreutils"
+brew "displayplacer"
+brew "docker-buildx"
+brew "docker-compose"
+brew "elastic/tap/elasticsearch-full"
+brew "elastic/tap/kibana-full"
+brew "ffmpeg"
+brew "filebeat"
+brew "fio"
+brew "frpc"
+brew "fzf"
+brew "gh"
+brew "ghostscript"
+brew "git"
+brew "git-lfs"
+brew "git-open"
+brew "gitea"
+brew "gox"
+brew "gradle"
+brew "gtk4"
+brew "helm"
+brew "htop"
+brew "httpd"
+brew "hugo"
+brew "iperf3"
+brew "istioctl"
+brew "jenv"
+brew "jmeter"
+brew "jpeg"
+brew "jq"
+brew "jupyterlab"
+brew "k6"
+brew "katana"
+brew "keyring"
+brew "libass"
+brew "libffi"
+brew "libmagic"
+brew "libtensorflow"
+brew "llm"
+brew "llvm@16"
+brew "make"
+brew "maven"
+brew "minio"
+brew "minio-mc"
+brew "mkcert"
+brew "mysql"
+brew "mysql@8.4"
+brew "neovim"
+brew "nginx"
+brew "nmap"
+brew "nvm"
+brew "oasdiff"
+brew "oath-toolkit"
+brew "ollama"
+brew "openjdk@11"
+brew "perl"
+brew "pgvector"
+brew "pipx"
+brew "poetry"
+brew "postgresql@14"
+brew "postgresql@15"
+brew "protobuf@3"
+brew "pyenv"
+brew "pygobject3"
+brew "python@3.10"
+brew "python@3.11"
+brew "python@3.9"
+brew "rbenv"
+brew "re2"
+brew "redis"
+brew "rubberband"
+brew "rust"
+brew "scipy"
+brew "socat"
+brew "speedtest-cli"
+brew "sshpass"
+brew "steipete/tap/imsg"
+brew "stress-ng"
+brew "swig"
+brew "sysbench"
+brew "ta-lib"
+brew "taglib"
+brew "tailscale"
+brew "tesseract-lang"
+brew "tmux"
+brew "tw93/tap/mole"
+brew "udp2raw-multiplatform"
+brew "uv"
+brew "vips"
+brew "virtualenv"
+brew "wasmedge"
+brew "watch"
+brew "wget"
+brew "wireguard-tools"
+brew "yarn"
+brew "yq"
+brew "yt-dlp"
+brew "zsh"
+brew "zsh-autosuggestions"
+brew "zsh-completions"
+brew "zsh-syntax-highlighting"
+
+cask "android-file-transfer"
+cask "betterdisplay"
+cask "chromedriver"
+cask "codex"
+cask "corretto@8"
+cask "gitbutler"
+cask "harbor"
+cask "musicbrainz-picard"
+cask "ngrok"
+cask "openclaw"

README.md

@@ -12,6 +12,7 @@ configuration shims.
 
 ## Layout
 
+- `Brewfile`: Homebrew formulae, taps, and casks for machine rebuilds.
 - `install/`: one-time setup helpers.
 - `zsh/`: shell fragments linked into `~/.zshrc.d/`.
 - `bin/`: thin wrappers that can safely override binaries via `~/bin`.
@@ -22,6 +23,7 @@ configuration shims.
 
 ```bash
 cd ~/work/codes/tools/macos/dotfiles
+brew bundle --file Brewfile
 ./install/doctor.sh
 ./install/link.sh
 ```
@@ -37,6 +39,18 @@ Do not commit secrets here.
 - Keep API tokens in `~/.config/secrets/` or the macOS Keychain.
 - Treat live Clash provider files as untracked machine state unless sanitized.
 
+## Tracked Recovery Assets
+
+- `Brewfile` rebuilds the Homebrew toolchain baseline.
+- `config/clash/config.public.yaml` preserves the ClashX base port/controller
+  settings that make the local mixed proxy port stay on `7890`.
+- `config/clash/clashx.public.yaml` is a sanitized export of the live Clash
+  config with hostnames and passwords replaced by placeholders.
+- `scripts/brew/export-brewfile.sh` refreshes `Brewfile` from the current
+  machine state.
+- `scripts/clash/export-public-config.rb` refreshes the sanitized Clash template
+  from the live local config.
+
 ## Suggested Approval Model
 
 - Long-lived approvals: repo-owned scripts in `scripts/` and `install/`.

RECOVERY.md

@@ -68,6 +68,12 @@ xcode-select --install
 - `jq`
 - `zsh`
 
+如果仓库已经可访问，建议在拉取 `dotfiles` 后立刻执行：
+
+```bash
+brew bundle --file ~/work/codes/tools/macos/dotfiles/Brewfile
+```
+
 ### 2. 拉取 dotfiles
 
 ```bash
@@ -176,12 +182,26 @@ python3 --version
 - `外部控制器 = 127.0.0.1:9090`
 - OpenAI / ChatGPT 相关域名走同一个稳定节点
 
+仓库里现在有两份公开配置：
+
+- `config/clash/config.public.yaml`
+- `config/clash/clashx.public.yaml`
+
 如果已经把 Clash 配置迁入 `dotfiles/config/clash/`，恢复后可直接重载：
 
 ```bash
 ./scripts/clash/reload.sh ~/.config/clash/clashx.yaml
 ```
 
+仓库里现在已经有一个脱敏模板：
+
+- `config/clash/clashx.public.yaml`
+
+恢复时有两种方式：
+
+1. 用它复制出本机工作副本，然后手动填回私有节点 `server/password`
+2. 重新从订阅或私有备份恢复完整节点段，再覆盖本机 live config
+
 检查代理与路由：
 
 ```bash
@@ -262,6 +282,7 @@ xcode-select --install
 mkdir -p ~/work/codes/tools/macos
 git clone http://192.168.1.83:33000/gao/dotfiles.git ~/work/codes/tools/macos/dotfiles
 cd ~/work/codes/tools/macos/dotfiles
+brew bundle --file Brewfile
 ./install/link.sh
 source ~/.zshrc
 

config/clash/README.md

@@ -9,5 +9,25 @@ Suggested migration flow:
 2. Remove inline credentials or move them into provider-managed files.
 3. Use `scripts/clash/reload.sh` after updating the live linked file.
 
+Current tracked assets:
+
+- `config.public.yaml`: base ClashX config with mixed-port/controller settings
+- `clashx.public.yaml`: sanitized export of the live config
+- `README.md`: usage notes and recovery guidance
+
+Refresh the sanitized export with:
+
+```bash
+./scripts/clash/export-public-config.rb ~/.config/clash/clashx.yaml ./config/clash/clashx.public.yaml
+```
+
+Right now `~/.config/clash/clashx.yaml` and
+`~/.config/clash/s.trojanflare.com.yaml` are byte-identical, so a single public
+template is enough.
+
+Also note that ClashX keeps the effective local port settings in the separate
+base `config.yaml`. That file is currently represented here as
+`config.public.yaml`.
+
 Do not commit provider passwords, tokens, or subscription URLs unless this
 repository is intentionally private and access-controlled.

config/clash/config.public.yaml

@@ -0,0 +1,18 @@
+# Base ClashX config. This file owns the live port settings in ClashX.
+mixed-port: 7890
+external-controller: 127.0.0.1:9090
+allow-lan: false
+mode: rule
+log-level: warning
+
+proxies:
+
+proxy-groups:
+
+rules:
+  - DOMAIN-SUFFIX,google.com,DIRECT
+  - DOMAIN-KEYWORD,google,DIRECT
+  - DOMAIN,google.com,DIRECT
+  - DOMAIN-SUFFIX,ad.com,REJECT
+  - GEOIP,CN,DIRECT
+  - MATCH,DIRECT

scripts/brew/export-brewfile.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+output_file="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/Brewfile}"
+tmp_file="$(mktemp)"
+
+{
+  echo "# Generated from the current machine state on $(date +%F)."
+  echo "# Refresh with: ./scripts/brew/export-brewfile.sh"
+  echo
+
+  HOMEBREW_NO_AUTO_UPDATE=1 brew tap | sort | sed 's/^/tap "/; s/$/"/'
+  echo
+  HOMEBREW_NO_AUTO_UPDATE=1 brew leaves | sort | sed 's/^/brew "/; s/$/"/'
+  echo
+  HOMEBREW_NO_AUTO_UPDATE=1 brew list --cask | sort | sed 's/^/cask "/; s/$/"/'
+} >"${tmp_file}"
+
+mv "${tmp_file}" "${output_file}"
+echo "Wrote ${output_file}"

scripts/clash/export-public-config.rb

@@ -0,0 +1,22 @@
+#!/usr/bin/env ruby
+require "yaml"
+
+source = ARGV[0] || File.expand_path("~/.config/clash/clashx.yaml")
+dest = ARGV[1] || File.expand_path("../../config/clash/clashx.public.yaml", __dir__)
+
+config = YAML.load_file(source)
+
+(config["proxies"] || []).each do |proxy|
+  next unless proxy.is_a?(Hash)
+
+  slug = proxy.fetch("name", "NODE")
+    .gsub(/[^A-Za-z0-9]+/, "_")
+    .gsub(/\A_+|_+\z/, "")
+    .upcase
+
+  proxy["server"] = "REPLACE_#{slug}_HOST" if proxy.key?("server")
+  proxy["password"] = "REPLACE_#{slug}_PASSWORD" if proxy.key?("password")
+end
+
+File.write(dest, config.to_yaml(line_width: -1))
+puts "Wrote #{dest}"