Show HN: Whetuu – 一款使用 Zig 编写的零配置跨 Shell 提示符

Show HN: Whetuu – 一款使用 Zig 编写的零配置跨 Shell 提示符
Show HN: Whetuu – a zero-config cross-shell prompt written in Zig

原始链接: https://yamafaktory.github.io/whetuu/

Whetuu 是一款轻量级的命令行工具，专为以安全为核心的 shell 历史记录追踪而设计。它完全不需要网络连接——无遥测、无账号、无同步——确保数据始终保存在本地。 **主要特性：** * **隐私与控制：** 遵循 XDG 基础目录标准，仅存储一个历史记录文件和一个版本缓存。通过以空格开头的命令将被忽略，且仅记录执行成功的命令。 * **安全性：** Whetuu 通过清理控制字符来防止终端被篡改。它通过为两个子进程（git 和版本探测）使用固定参数，避免了任意命令执行的风险。 * **极简占用：** 无需配置文件或复杂的设置。只需在 shell 配置文件中添加两行代码即可完成安装，且易于卸载。 * **透明度：** 二进制文件采用静态链接，完全开源，并可通过 SHA256 哈希值进行验证。 **注意：** 为谨慎起见，Whetuu 会根据你所在的目录探测本地工具链版本（例如 `node --version`）。虽然它仅执行系统 `PATH` 中已有的二进制文件，但在进入不受信任的存储库时，用户仍应保持常规警惕。

```Hacker News新帖 | 过往 | 评论 | 提问 | 展示 | 招聘 | 提交登录Show HN: Whetuu – 一个用 Zig 编写的零配置跨 Shell 提示符 (yamafaktory.github.io)5 分，由 yamafaktory 发布于 57 分钟前 | 隐藏 | 过往 | 收藏 | 1 条评论帮助 kedislav 2 分钟前 [–] 请停止直接管道传输到 bash 或 sh。强制人们使用编辑器，阅读安装脚本，并告知他们如何运行它回复考虑申请 YC 2026 年秋季批次！申请截止日期为 7 月 27 日。准则 | 常见问题 | 列表 | API | 安全 | 法律 | 申请 YC | 联系搜索: ```

原文

A prompt sees every command you run, and the picker keeps them. That is a lot to hand a small tool, so here is exactly what whetuu does and does not do.

No network

There is no socket, no HTTP client and no sync anywhere in the binary. No telemetry and no update check. There is no account and no server to opt out of.

Two files

Running, whetuu writes exactly two. The history store, created with mode 600 and reset to it on every write, so one left readable by an older version corrects itself. And a cache of toolchain version strings at ~/.cache/whetuu/versions, which holds nothing else and can be deleted whenever you like.

Data outside it

Both files follow the XDG base directory spec, so neither lives in the install directory. Removing whetuu with rm -rf ~/.whetuu cannot take your history with it. whetuu paths prints both locations.

One install edit

The installer appends two lines to the config of the shell in $SHELL, and nothing else. Not the config of a shell you do not use, and never twice. WHETUU_NO_MODIFY=1 makes it print them instead. Everything lands in ~/.whetuu, so removing it is one directory.

Skip a command

Start a command with a space and it is never recorded. Use it for the ones carrying a token. Only successful commands are stored at all.

No shell, ever

whetuu runs two subprocesses: git and the toolchain version probe. Both get a fixed list of arguments rather than a command line, so nothing you type is ever interpreted as a command. State like a rebase in progress is read straight out of .git with no subprocess at all.

Escapes defanged

Every control byte in a command, a branch name or a directory becomes a ? before it reaches your terminal. A repository you just cloned cannot repaint your screen or move your cursor through whetuu.

Nothing to configure

No config file means no config parser, no theme format and nothing of yours being executed at startup. The attack surface is the binary and the two commands above.

One caveat

The language module picks which toolchain to probe from the files in the current directory, so entering an untrusted repository can make whetuu run something like node --version. It runs whatever your PATH resolves, never a binary from the repository.

Checkable downloads

The Linux builds are static musl with no runtime dependencies, and every release ships a SHA256SUMS file. The source is on GitHub and builds from it with one command.

Show HN: Whetuu – 一款使用 Zig 编写的零配置跨 Shell 提示符 Show HN: Whetuu – a zero-config cross-shell prompt written in Zig

Show HN: Whetuu – 一款使用 Zig 编写的零配置跨 Shell 提示符
Show HN: Whetuu – a zero-config cross-shell prompt written in Zig