From d5c1b8a155b1118180331d92572ca4e3a3af0288 Mon Sep 17 00:00:00 2001
From: nevaforget <dom@moonarch.de>
Date: Fri, 24 Apr 2026 13:59:20 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20audit=20LOW=20fixes=20=E2=80=94=20nmcli?=
 =?UTF-8?q?=20guards,=20sink=20cancel,=20cpugov=20stderr,=20gpu=20interval?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- moonarch-vpn: add `--` argument-terminator to `nmcli connection up/down`
  so a profile name starting with `-` is never interpreted as a flag.
- moonarch-sink-switcher: guard against empty `$sink` when walker is
  cancelled, since awk masks walker's non-zero exit. Prevents the error
  `pactl set-default-sink ""` on every dismissal.
- moonarch-waybar-cpugov: redirect stderr so non-cpufreq systems (VMs,
  some desktops) do not spam the journal on every 60s poll.
- waybar config: switch custom/gpu-usage from `restart-interval: 10` to
  `interval: 60`. The module lives in a closed drawer, a 10 s poll spawn
  was unnecessary background noise.
---
 defaults/bin/moonarch-sink-switcher | 6 +++++-
 defaults/bin/moonarch-vpn           | 4 ++--
 defaults/bin/moonarch-waybar-cpugov | 2 +-
 defaults/xdg/waybar/config          | 2 +-
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/defaults/bin/moonarch-sink-switcher b/defaults/bin/moonarch-sink-switcher
index 984ef99..0f03faf 100755
--- a/defaults/bin/moonarch-sink-switcher
+++ b/defaults/bin/moonarch-sink-switcher
@@ -5,7 +5,11 @@
 # choose audio sink via rofi
 # changes default sink and moves all streams to that sink
 
-sink=$(pactl list sinks short | awk '{print $1, $2}' | walker -d -p "󱡫 Sink Switcher" | awk '{print $1}') &&
+sink=$(pactl list sinks short | awk '{print $1, $2}' | walker -d -p "󱡫 Sink Switcher" | awk '{print $1}')
+
+# Walker cancel returns empty — awk masks its non-zero exit. Guard here so we
+# don't call `pactl set-default-sink ""` on dismissal.
+[[ -n "$sink" ]] || exit 0
 
 pactl set-default-sink "$sink" &&
 for input in $(pactl list sink-inputs short | awk '{print $1}'); do
diff --git a/defaults/bin/moonarch-vpn b/defaults/bin/moonarch-vpn
index 48d2b80..ad57f58 100755
--- a/defaults/bin/moonarch-vpn
+++ b/defaults/bin/moonarch-vpn
@@ -39,13 +39,13 @@ function extract_connection_name() {
 # Requires nm-applet (or another NM secret agent) for interactive auth.
 function connect_vpn() {
     local connection="$1"
-    nmcli connection up "$connection"
+    nmcli connection up -- "$connection"
 }
 
 # Disconnect a VPN.
 function disconnect_vpn() {
     local connection="$1"
-    nmcli connection down "$connection"
+    nmcli connection down -- "$connection"
 }
 
 # Toggle the VPN connection based on its current state.
diff --git a/defaults/bin/moonarch-waybar-cpugov b/defaults/bin/moonarch-waybar-cpugov
index 8903c20..20ce6e3 100755
--- a/defaults/bin/moonarch-waybar-cpugov
+++ b/defaults/bin/moonarch-waybar-cpugov
@@ -2,7 +2,7 @@
 # ABOUTME: Waybar-Modul das den CPU-Governor als JSON ausgibt.
 # ABOUTME: Wird von der Waybar custom/cpugov Config referenziert.
 
-CPU_GOV=$(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor)
+CPU_GOV=$(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor 2>/dev/null)
 
 case $CPU_GOV in
   performance)
diff --git a/defaults/xdg/waybar/config b/defaults/xdg/waybar/config
index 63ee4c0..4c12d27 100644
--- a/defaults/xdg/waybar/config
+++ b/defaults/xdg/waybar/config
@@ -319,7 +319,7 @@
     "custom/gpu-usage": {
         "exec": "moonarch-waybar-gpustat",
         "return-type": "json",
-        "restart-interval": 10
+        "interval": 60
     },
     "battery": {
         "bat": "BAT0",