static-nix-shell: fix mkBash scripts to actually be invokable from the CLI

they need the `bash` package! how did this work before?

hosts/common/programs/rofi/rofi-run-command

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p sane-open
+#!nix-shell -i bash -p bash -p sane-open
 
 # use:
 # rofi-run-command <handler>.desktop [cmd [args ...]]

hosts/common/programs/rofi/rofi-snippets

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p gnused -p rofi -p wtype
+#!nix-shell -i bash -p bash -p gnused -p rofi -p wtype
 
 # "bookmarking"/snippets inspired by Luke Smith:
 # - <https://www.youtube.com/watch?v=d_11QaTlf1I>

hosts/common/programs/sane-input-handler/sane-input-handler

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils -p jq -p killall -p playerctl -p procps -p sane-open -p sway -p util-linux -p wireplumber
+#!nix-shell -i bash -p bash -p coreutils -p jq -p killall -p playerctl -p procps -p sane-open -p sway -p util-linux -p wireplumber
 # vim: set filetype=bash :
 
 # input map considerations

hosts/common/programs/sway-autoscaler/sway-autoscaler

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq -p sway -p util-linux
+#!nix-shell -i bash -p bash -p jq -p sway -p util-linux
 
 help() {
   echo "queries the focused window and apply an appropriate display-wide scale."

hosts/common/programs/swaynotificationcenter/swaync-fbcli

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p feedbackd -p procps -p swaynotificationcenter -p util-linux
+#!nix-shell -i bash -p bash -p feedbackd -p procps -p swaynotificationcenter -p util-linux
 
 # this script does some really unusual indirection with the `start` action:
 # IT'S INTENTIONAL.

hosts/common/programs/swaynotificationcenter/swaync-service-dispatcher

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p s6 -p s6-rc
+#!nix-shell -i bash -p bash -p s6 -p s6-rc
 
 # for default $PATH to take precedence over nix-shell PATH if invoked interactively,
 # otherwise we invoke a s6-rc which does not know where to find files.

hosts/common/programs/waybar/waybar-media

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq -p playerctl
+#!nix-shell -i bash -p bash -p jq -p playerctl
 status=$(playerctl status 2> /dev/null | tr 'A-Z' 'a-z')
 if [ -z "$status" ]; then
   status="inactive"

hosts/modules/derived-secrets/hash-path-with-salt

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash
+#!nix-shell -i bash -p bash
 file="$1"
 enc="$2"
 nibbles="$3"

hosts/modules/roles/client/install-bluetooth

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p gnused
+#!nix-shell -i bash -p bash -p gnused
 # usage: install-bluetooth <source_dir> <destdir>
 # source_dir contains plain-text files of any filename.
 # for each file, this extracts the MAC and creates a symlink in destdir which

modules/fs/ensure-dir

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash
+#!nix-shell -i bash -p bash
 
 set -e
 

modules/fs/ensure-file

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash
+#!nix-shell -i bash -p bash
 
 set -e
 

modules/fs/ensure-perms

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash
+#!nix-shell -i bash -p bash
 set -e
 
 fspath="$1"

modules/fs/ensure-symlink

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash
+#!nix-shell -i bash -p bash
 
 set -e
 

pkgs/additional/sane-open/sane-open

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p glib -p jq -p procps -p sway -p util-linux -p xdg-utils
+#!nix-shell -i bash -p bash -p glib -p jq -p procps -p sway -p util-linux -p xdg-utils
 
 set -e
 

pkgs/additional/sane-screenshot/sane-screenshot

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p libnotify -p swappy -p sway-contrib.grimshot -p util-linux -p wl-clipboard
+#!nix-shell -i bash -p bash -p libnotify -p swappy -p sway-contrib.grimshot -p util-linux -p wl-clipboard
 
 # loosely inspired by reddit user u/dragobich
 # - <https://www.reddit.com/r/hyprland/comments/12tal0f/comment/jh8j4sy/>

pkgs/additional/sane-scripts/src/sane-backup-ls

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p duplicity
+#!nix-shell -i bash -p bash -p duplicity
 
 # N.B. must be run as root
 

pkgs/additional/sane-scripts/src/sane-backup-restore

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p duplicity
+#!nix-shell -i bash -p bash -p duplicity
 
 # N.B. must be run as root
 

pkgs/additional/sane-scripts/src/sane-clone

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix
+#!nix-shell -i bash -p bash -p nix
 
 # use like `eval $(sane-clone tuba)` to clone and cd into a tuba checkout
 

pkgs/additional/sane-scripts/src/sane-deadlines

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils-full -p gnused
+#!nix-shell -i bash -p bash -p coreutils-full -p gnused
 
 # processes a tab-separated "deadlines" file and alerts for any upcoming events.
 #

pkgs/additional/sane-scripts/src/sane-dev-cargo-loop

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p inotify-tools -p ncurses
+#!nix-shell -i bash -p bash -p inotify-tools -p ncurses
 # watches PWD for any changes underneath it and re-runs `cargo build --a>
 # optionally, provide your own build command as the first argument
 

pkgs/additional/sane-scripts/src/sane-find-dotfiles

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p findutils
+#!nix-shell -i bash -p bash -p findutils
 # find where a package stores its dotfiles/dotdir
 # e.g. `sane-find-dotfiles foo` might print `/home/colin/.foo`, `/home/colin/.local/share/foo`, etc.
 

pkgs/additional/sane-scripts/src/sane-private-change-passwd

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p gocryptfs -p rsync
+#!nix-shell -i bash -p bash -p gocryptfs -p rsync
 
 # HOW TO USE
 # ```sh

pkgs/additional/sane-scripts/src/sane-private-do

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p util-linux
+#!nix-shell -i bash -p bash -p util-linux
 
 # unlock the private store, run some command, and then re-lock the store
 # N.B.: `mount`ing requires elevated privileges (cap_sys_admin).

pkgs/additional/sane-scripts/src/sane-private-init

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p gocryptfs
+#!nix-shell -i bash -p bash -p gocryptfs
 
 set -ex
 

pkgs/additional/sane-scripts/src/sane-private-lock

@@ -1,4 +1,4 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p util-linux.mount
+#!nix-shell -i bash -p bash -p util-linux.mount
 
 umount /home/colin/private

pkgs/additional/sane-scripts/src/sane-private-unlock

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p util-linux.mount
+#!nix-shell -i bash -p bash -p util-linux.mount
 
 # TODO: the mountpoint isn't created as part of startup: why?
 sudo mkdir -p /mnt/persist/private

pkgs/additional/sane-scripts/src/sane-rcp

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p rsync
+#!nix-shell -i bash -p bash -p rsync
 # rsync, with sane defaults
 # + verbosity
 # + default to cwd as destination if none is provided

pkgs/additional/sane-scripts/src/sane-reboot

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nettools -p systemd
+#!nix-shell -i bash -p bash -p nettools -p systemd
 
 target="$1"
 shift

pkgs/additional/sane-scripts/src/sane-reclaim-disk-space

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix
+#!nix-shell -i bash -p bash -p nix
 
 # script to reclaim some hard drive space
 # some of this is documented here:

pkgs/additional/sane-scripts/src/sane-secrets-dump

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p gnugrep -p oath-toolkit -p sops
+#!nix-shell -i bash -p bash -p gnugrep -p oath-toolkit -p sops
 # use: `sane-dump-secret /path/to/accounts/website.yaml`
 # dumps relevant information about the account, include a OTP code if present
 #

pkgs/additional/sane-scripts/src/sane-secrets-unlock

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils-full -p openssh -p ssh-to-age
+#!nix-shell -i bash -p bash -p coreutils-full -p openssh -p ssh-to-age
 # unlocks the SOPS store (i.e. populate a SOPS key from the user's SSH key)
 set -ex
 

pkgs/additional/sane-scripts/src/sane-secrets-update-keys

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils-full -p findutils -p sops
+#!nix-shell -i bash -p bash -p coreutils-full -p findutils -p sops
 # after modifying .sops.yaml, run this to re-encode all secrets to the new keys
 # pass the base directory (under which *everything* is a secret) as argument
 for i in $(find "$1" -print)

pkgs/additional/sane-scripts/src/sane-shutdown

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nettools -p systemd
+#!nix-shell -i bash -p bash -p nettools -p systemd
 
 target="$1"
 shift

pkgs/additional/sane-scripts/src/sane-stop-all-servo

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p systemd
+#!nix-shell -i bash -p bash -p systemd
 sudo systemctl stop \
   bitcoind-mainnet \
   coturn \

pkgs/additional/sane-scripts/src/sane-sudo-redirect

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils-full
+#!nix-shell -i bash -p bash -p coreutils-full
 
 # redirects to $1, when writing to $1 requires sudo permissions.
 # i.e. convert a failing command:

pkgs/additional/sane-scripts/src/sane-sync-from-iphone

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i zsh -p coreutils-full -p ifuse -p rsync
+#!nix-shell -i zsh -p coreutils-full -p ifuse -p rsync -p zsh
 # this really does need zsh because bash `test -e` behaves differently
 set -ex
 

pkgs/additional/sane-scripts/src/sane-vpn

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils-full -p iproute2 -p jq -p sane-scripts.ip-check
+#!nix-shell -i bash -p bash -p coreutils-full -p iproute2 -p jq -p sane-scripts.ip-check
 
 set -e
 

pkgs/additional/sane-scripts/src/sane-which

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils-full -p file -p gnugrep
+#!nix-shell -i bash -p bash -p coreutils-full -p file -p gnugrep
 # traces a PATH lookup by printing the source, resolution, and any symlinks traversed
 # finally, prints the content of the file
 

pkgs/additional/sane-scripts/src/sane-wipe

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p dconf -p libsecret -p s6-rc
+#!nix-shell -i bash -p bash -p dconf -p libsecret -p s6-rc
 
 help() {
   echo "usage: sane-wipe <resource>"

pkgs/additional/sane-sysinfo/sane-sysinfo

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash
+#!nix-shell -i bash -p bash
 
 usage() {
   echo "usage: sane-sysinfo [options...]"

pkgs/additional/static-nix-shell/default.nix

@@ -10,6 +10,25 @@
 let
   inherit (builtins) attrNames attrValues concatStringsSep foldl' map typeOf;
   inherit (lib) concatMapAttrs;
+  # insert an element `ins` into a list `into`,
+  # at its proper location assuming `into` is lexicographically ordered.
+  # does not adjust the order of existing elements.
+  insertTopo = ins: into: let
+    insertedUnlessLast = builtins.foldl' (acc: next:
+      if builtins.elem ins acc then
+        acc ++ [ next ]
+      else if (lib.naturalSort [ ins next ]) == [ ins next ] then
+        acc ++ [ ins next ]
+      else
+        acc ++ [ next ]
+    ) [] into
+    ;
+  in
+    if builtins.elem ins insertedUnlessLast then
+      insertedUnlessLast
+    else
+      into ++ [ ins ]
+    ;
   pkgs' = pkgs;
   # create an attrset of
   #   <name> = expected string in the nix-shell invocation
@@ -114,8 +133,8 @@ in rec {
   mkBash = { pname, pkgs ? {}, ...}@attrs:
     let
       pkgsAsAttrs = pkgsToAttrs "" pkgs' pkgs;
-      pkgsEnv = attrValues pkgsAsAttrs;
-      pkgExprs = attrNames pkgsAsAttrs;
+      pkgsEnv = [ bash ] ++ (attrValues pkgsAsAttrs);
+      pkgExprs = insertTopo "bash" (attrNames pkgsAsAttrs);
     in mkShell ({
       inherit pkgsEnv pkgExprs;
       interpreter = "${bash}/bin/bash";
@@ -126,8 +145,8 @@ in rec {
   mkZsh = { pname, pkgs ? {}, ...}@attrs:
     let
       pkgsAsAttrs = pkgsToAttrs "" pkgs' pkgs;
-      pkgsEnv = attrValues pkgsAsAttrs;
-      pkgExprs = attrNames pkgsAsAttrs;
+      pkgsEnv = [ zsh ] ++ (attrValues pkgsAsAttrs);
+      pkgExprs = insertTopo "zsh" (attrNames pkgsAsAttrs);
     in mkShell ({
       inherit pkgsEnv pkgExprs;
       interpreter = "${zsh}/bin/zsh";