audit-packages: add --fix flag to reinstall wrong-source packages

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

setup/audit-packages.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 # Verifies installed packages come from the expected source (pacman/AUR/flatpak).
 # Reports missing packages, wrong-source installs, and unexpected foreign packages.
+# Pass --fix / -f to automatically reinstall packages from the correct source.
 set -euo pipefail
 
 RED="\e[31m"; YELLOW="\e[33m"; GREEN="\e[32m"; CYAN="\e[36m"; BOLD="\e[1m"; RESET="\e[0m"
@@ -9,10 +10,17 @@ ok()   { echo -e "  ${GREEN}✔${RESET} $1"; }
 warn() { echo -e "  ${YELLOW}⚠${RESET} $1"; }
 err()  { echo -e "  ${RED}✘${RESET} $1"; }
 hdr()  { echo -e "\n${BOLD}${CYAN}$1${RESET}"; }
+fix()  { echo -e "  ${CYAN}↺${RESET} $1"; }
+
+FIX=0
+[[ "${1:-}" == "--fix" || "${1:-}" == "-f" ]] && FIX=1
 
 ISSUES=0
 flag() { ISSUES=$((ISSUES + 1)); }
 
+WRONG_SOURCE_OFFICIAL=()   # expected from pacman, installed from AUR
+WRONG_SOURCE_AUR=()        # expected from AUR, installed from official
+
 # ---------------------------------------------------------------------------
 # Expected package sources — keep in sync with setup/modules/
 # ---------------------------------------------------------------------------
@@ -95,6 +103,7 @@ for pkg in "${PACMAN_PKGS[@]}"; do
         err "$pkg — NOT INSTALLED"; flag
     elif is_from_aur "$pkg"; then
         warn "$pkg — installed, but from AUR instead of official repo"; flag
+        WRONG_SOURCE_OFFICIAL+=("$pkg")
     else
         ok "$pkg"
     fi
@@ -111,6 +120,7 @@ for pkg in "${AUR_PKGS[@]}"; do
         warn "$pkg — not installed (optional — may be intentional)"
     elif is_from_official "$pkg"; then
         warn "$pkg — installed from official repo, not AUR (may need AUR build for correct version)"; flag
+        WRONG_SOURCE_AUR+=("$pkg")
     else
         ok "$pkg"
     fi
@@ -148,14 +158,54 @@ while IFS= read -r pkg; do
     fi
 done <<< "$FOREIGN"
 
+# ---------------------------------------------------------------------------
+# Fix: reinstall wrong-source packages
+# ---------------------------------------------------------------------------
+
+FIXED=0
+
+if [ "$FIX" -eq 1 ]; then
+    if [ ${#WRONG_SOURCE_OFFICIAL[@]} -gt 0 ] || [ ${#WRONG_SOURCE_AUR[@]} -gt 0 ]; then
+        hdr "Reinstalling wrong-source packages"
+    fi
+
+    for pkg in "${WRONG_SOURCE_OFFICIAL[@]}"; do
+        fix "Reinstalling $pkg from official repo (was AUR)..."
+        if sudo pacman -S --noconfirm "$pkg"; then
+            ok "$pkg reinstalled from official repo"
+            FIXED=$((FIXED + 1))
+            ISSUES=$((ISSUES - 1))
+        else
+            err "$pkg reinstall failed"
+        fi
+    done
+
+    for pkg in "${WRONG_SOURCE_AUR[@]}"; do
+        fix "Reinstalling $pkg from AUR (was official repo)..."
+        if yay -S --aur --noconfirm "$pkg"; then
+            ok "$pkg reinstalled from AUR"
+            FIXED=$((FIXED + 1))
+            ISSUES=$((ISSUES - 1))
+        else
+            err "$pkg reinstall failed"
+        fi
+    done
+fi
+
 # ---------------------------------------------------------------------------
 # Summary
 # ---------------------------------------------------------------------------
 
 echo
+if [ "$FIX" -eq 1 ] && [ "$FIXED" -gt 0 ]; then
+    echo -e "${GREEN}${BOLD}Fixed ${FIXED} wrong-source package(s).${RESET}"
+fi
+
 if [ "$ISSUES" -eq 0 ]; then
     echo -e "${GREEN}${BOLD}All checks passed — no source mismatches or missing required packages.${RESET}"
 else
     echo -e "${RED}${BOLD}${ISSUES} issue(s) found — review items marked ✘ or ⚠ above.${RESET}"
+    [ "$FIX" -eq 0 ] && [ $((${#WRONG_SOURCE_OFFICIAL[@]} + ${#WRONG_SOURCE_AUR[@]})) -gt 0 ] && \
+        echo -e "${YELLOW}  Run with --fix to automatically reinstall wrong-source packages.${RESET}"
     exit 1
 fi