@sebastienrousseau/dotfiles 0.2.468 → 0.2.481

package/scripts/diagnostics/history-analysis.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+histfile="${HISTFILE:-$HOME/.zsh_history}"
+db="${DOTFILES_HISTORY_DB:-$HOME/.local/share/dotfiles/history.sqlite}"
+
+if [[ ! -f "$histfile" ]]; then
+  echo "History file not found: $histfile" >&2
+  exit 1
+fi
+
+if ! command -v python3 >/dev/null; then
+  echo "python3 not found. Falling back to hstats if available." >&2
+  if command -v hstats >/dev/null; then
+    hstats
+    exit 0
+  fi
+  exit 1
+fi
+
+mkdir -p "$(dirname "$db")"
+
+python3 - "$histfile" "$db" <<'PY'
+import sys
+import sqlite3
+import re
+from pathlib import Path
+
+histfile = Path(sys.argv[1])
+db = Path(sys.argv[2])
+
+conn = sqlite3.connect(db)
+cur = conn.cursor()
+cur.execute("CREATE TABLE IF NOT EXISTS history (ts INTEGER, cmd TEXT)")
+cur.execute("DELETE FROM history")
+
+pattern = re.compile(r"^: (\d+):\d+;(.*)$")
+
+with histfile.open("r", encoding="utf-8", errors="ignore") as f:
+    for line in f:
+        line = line.rstrip("\n")
+        m = pattern.match(line)
+        if not m:
+            continue
+        ts = int(m.group(1))
+        cmd = m.group(2).strip()
+        if not cmd:
+            continue
+        cur.execute("INSERT INTO history (ts, cmd) VALUES (?, ?)", (ts, cmd))
+
+conn.commit()
+
+print("=== History Analysis ===")
+
+print("\nTop commands:")
+for row in cur.execute("""
+    SELECT substr(cmd, 1, instr(cmd || ' ', ' ') - 1) AS base, COUNT(*)
+    FROM history
+    GROUP BY base
+    ORDER BY COUNT(*) DESC
+    LIMIT 15
+"""):
+    print(f"{row[1]:>6}  {row[0]}")
+
+print("\nTop directories (cd):")
+for row in cur.execute("""
+    SELECT trim(substr(cmd, 4)) AS dir, COUNT(*)
+    FROM history
+    WHERE cmd LIKE 'cd %'
+    GROUP BY dir
+    ORDER BY COUNT(*) DESC
+    LIMIT 10
+"""):
+    print(f"{row[1]:>6}  {row[0]}")
+
+conn.close()
+PY

package/scripts/diagnostics/security-score.sh

@@ -0,0 +1,392 @@
+#!/usr/bin/env bash
+# Security Score Assessment
+# Usage: dot security-score [--verbose|-v] [--json]
+
+set -euo pipefail
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+# Parse arguments
+VERBOSE=false
+JSON_OUTPUT=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --verbose | -v)
+      VERBOSE=true
+      shift
+      ;;
+    --json)
+      JSON_OUTPUT=true
+      shift
+      ;;
+    *) shift ;;
+  esac
+done
+
+# Scoring
+TOTAL_POINTS=0
+MAX_POINTS=0
+declare -A CATEGORY_SCORES
+
+add_points() {
+  local category="$1"
+  local points="$2"
+  local max="$3"
+  local description="$4"
+  # $5 is status (pass/fail/partial) - used for icon selection below
+
+  TOTAL_POINTS=$((TOTAL_POINTS + points))
+  MAX_POINTS=$((MAX_POINTS + max))
+  CATEGORY_SCORES["$category"]=$((${CATEGORY_SCORES[$category]:-0} + points))
+
+  if ! $JSON_OUTPUT && $VERBOSE; then
+    local icon
+    if [[ $points -eq $max ]]; then
+      icon="${GREEN}✓${NC}"
+    elif [[ $points -gt 0 ]]; then
+      icon="${YELLOW}◐${NC}"
+    else
+      icon="${RED}✗${NC}"
+    fi
+    printf "  $icon %-40s %d/%d pts\n" "$description" "$points" "$max"
+  fi
+}
+
+print_header() {
+  if ! $JSON_OUTPUT; then
+    echo -e "\n${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+    echo -e "${CYAN}  Security Score Assessment${NC}"
+    echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}\n"
+  fi
+}
+
+section() {
+  if ! $JSON_OUTPUT; then
+    echo -e "\n${BLUE}▸ $1${NC}"
+    echo "───────────────────────────────────────────────"
+  fi
+}
+
+# === Security Checks ===
+
+check_encryption() {
+  section "Encryption (30 pts max)"
+
+  # Age encryption tool
+  if command -v age >/dev/null 2>&1; then
+    add_points "encryption" 5 5 "Age encryption installed" "pass"
+  else
+    add_points "encryption" 0 5 "Age encryption installed" "fail"
+  fi
+
+  # Age key exists
+  if [[ -f "${HOME}/.config/chezmoi/key.txt" ]]; then
+    add_points "encryption" 5 5 "Age encryption key present" "pass"
+
+    # Check key permissions
+    local perms
+    perms=$(stat -c "%a" "${HOME}/.config/chezmoi/key.txt" 2>/dev/null || stat -f "%OLp" "${HOME}/.config/chezmoi/key.txt" 2>/dev/null)
+    if [[ "$perms" == "600" ]]; then
+      add_points "encryption" 5 5 "Key file permissions (600)" "pass"
+    else
+      add_points "encryption" 2 5 "Key file permissions (600)" "partial"
+    fi
+  else
+    add_points "encryption" 0 10 "Age encryption configured" "fail"
+  fi
+
+  # SOPS available
+  if command -v sops >/dev/null 2>&1; then
+    add_points "encryption" 5 5 "SOPS secrets manager" "pass"
+  else
+    add_points "encryption" 0 5 "SOPS secrets manager" "fail"
+  fi
+
+  # GPG available
+  if command -v gpg >/dev/null 2>&1 && gpg --list-secret-keys 2>/dev/null | grep -q sec; then
+    add_points "encryption" 10 10 "GPG keys configured" "pass"
+  elif command -v gpg >/dev/null 2>&1; then
+    add_points "encryption" 3 10 "GPG keys configured" "partial"
+  else
+    add_points "encryption" 0 10 "GPG keys configured" "fail"
+  fi
+}
+
+check_ssh() {
+  section "SSH Security (25 pts max)"
+
+  # SSH directory permissions
+  if [[ -d "${HOME}/.ssh" ]]; then
+    local ssh_perms
+    ssh_perms=$(stat -c "%a" "${HOME}/.ssh" 2>/dev/null || stat -f "%OLp" "${HOME}/.ssh" 2>/dev/null)
+    if [[ "$ssh_perms" == "700" ]]; then
+      add_points "ssh" 5 5 "SSH directory permissions (700)" "pass"
+    else
+      add_points "ssh" 2 5 "SSH directory permissions (700)" "partial"
+    fi
+  else
+    add_points "ssh" 0 5 "SSH directory exists" "fail"
+  fi
+
+  # ED25519 key (preferred over RSA)
+  if [[ -f "${HOME}/.ssh/id_ed25519" ]]; then
+    add_points "ssh" 10 10 "ED25519 SSH key (modern)" "pass"
+  elif [[ -f "${HOME}/.ssh/id_rsa" ]]; then
+    add_points "ssh" 5 10 "SSH key present (RSA)" "partial"
+  else
+    add_points "ssh" 0 10 "SSH key present" "fail"
+  fi
+
+  # SSH agent
+  if [[ -n "${SSH_AUTH_SOCK:-}" ]] || pgrep -x ssh-agent >/dev/null 2>&1; then
+    add_points "ssh" 5 5 "SSH agent running" "pass"
+  else
+    add_points "ssh" 0 5 "SSH agent running" "fail"
+  fi
+
+  # SSH config exists
+  if [[ -f "${HOME}/.ssh/config" ]]; then
+    add_points "ssh" 5 5 "SSH config present" "pass"
+  else
+    add_points "ssh" 2 5 "SSH config present" "partial"
+  fi
+}
+
+check_git() {
+  section "Git Security (20 pts max)"
+
+  # Git installed
+  if ! command -v git >/dev/null 2>&1; then
+    add_points "git" 0 20 "Git installed" "fail"
+    return
+  fi
+
+  # Commit signing
+  if git config --global commit.gpgsign 2>/dev/null | grep -q true; then
+    add_points "git" 10 10 "Commit signing enabled" "pass"
+  else
+    add_points "git" 0 10 "Commit signing enabled" "fail"
+  fi
+
+  # User identity configured
+  if git config --global user.email >/dev/null 2>&1 && git config --global user.name >/dev/null 2>&1; then
+    add_points "git" 5 5 "Git identity configured" "pass"
+  else
+    add_points "git" 0 5 "Git identity configured" "fail"
+  fi
+
+  # Credential helper
+  if git config --global credential.helper >/dev/null 2>&1; then
+    add_points "git" 5 5 "Credential helper configured" "pass"
+  else
+    add_points "git" 0 5 "Credential helper configured" "fail"
+  fi
+}
+
+check_system() {
+  section "System Security (15 pts max)"
+
+  # Firewall (macOS or Linux)
+  if [[ "$(uname)" == "Darwin" ]]; then
+    if /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null | grep -q enabled; then
+      add_points "system" 5 5 "Firewall enabled" "pass"
+    else
+      add_points "system" 0 5 "Firewall enabled" "fail"
+    fi
+  else
+    # Check ufw via systemctl (doesn't need sudo) or sudo ufw status
+    local fw_enabled=false
+    if systemctl is-active --quiet ufw 2>/dev/null; then
+      fw_enabled=true
+    elif command -v ufw >/dev/null 2>&1 && sudo -n ufw status 2>/dev/null | grep -q "Status: active"; then
+      fw_enabled=true
+    elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state 2>/dev/null | grep -q running; then
+      fw_enabled=true
+    fi
+
+    if $fw_enabled; then
+      add_points "system" 5 5 "Firewall enabled" "pass"
+    else
+      add_points "system" 0 5 "Firewall enabled" "fail"
+    fi
+  fi
+
+  # Disk encryption (LUKS, FileVault, or ecryptfs)
+  if [[ "$(uname)" == "Darwin" ]]; then
+    if fdesetup status 2>/dev/null | grep -q "FileVault is On"; then
+      add_points "system" 10 10 "Disk encryption (FileVault)" "pass"
+    else
+      add_points "system" 0 10 "Disk encryption (FileVault)" "fail"
+    fi
+  else
+    local encryption_found=false
+    # Check LUKS
+    if lsblk 2>/dev/null | grep -q crypt || [[ -d /sys/block/dm-0 ]]; then
+      encryption_found=true
+      add_points "system" 10 10 "Disk encryption (LUKS)" "pass"
+    # Check Apple T2 chip (hardware SSD encryption)
+    elif lspci 2>/dev/null | grep -qi "T2.*Secure Enclave"; then
+      encryption_found=true
+      add_points "system" 10 10 "Hardware encryption (Apple T2)" "pass"
+    # Check ecryptfs (encrypted home)
+    elif mount 2>/dev/null | grep -q ecryptfs || [[ -d "$HOME/.ecryptfs" ]]; then
+      encryption_found=true
+      add_points "system" 10 10 "Home encryption (ecryptfs)" "pass"
+    # Check if running in encrypted VM/container
+    elif [[ -f /sys/class/dmi/id/product_name ]] && grep -qiE "virtual|vmware|kvm|qemu" /sys/class/dmi/id/product_name 2>/dev/null; then
+      encryption_found=true
+      add_points "system" 10 10 "Virtualized (host encryption)" "pass"
+    fi
+
+    if ! $encryption_found; then
+      add_points "system" 0 10 "Disk encryption" "unknown"
+    fi
+  fi
+}
+
+check_secrets() {
+  section "Secrets Management (10 pts max)"
+
+  # No secrets in dotfiles repo
+  if [[ -d "${HOME}/.dotfiles" ]]; then
+    local secrets_found=false
+    # Check for common secret patterns
+    if grep -rE "(api_key|api_secret|password|token)\\s*=\\s*['\"][^'\"]+['\"]" "${HOME}/.dotfiles" --include="*.sh" --include="*.zsh" --include="*.toml" 2>/dev/null | grep -v "example\|template\|placeholder" | head -1; then
+      secrets_found=true
+    fi
+
+    if $secrets_found; then
+      add_points "secrets" 0 5 "No hardcoded secrets" "fail"
+    else
+      add_points "secrets" 5 5 "No hardcoded secrets" "pass"
+    fi
+  else
+    add_points "secrets" 5 5 "No hardcoded secrets" "pass"
+  fi
+
+  # Environment variables for secrets
+  if [[ -f "${HOME}/.config/secrets/api-keys.env" ]] || [[ -d "${HOME}/.config/secrets" ]]; then
+    add_points "secrets" 5 5 "Secrets in dedicated location" "pass"
+  else
+    add_points "secrets" 2 5 "Secrets management setup" "partial"
+  fi
+}
+
+print_summary() {
+  local score=$((TOTAL_POINTS * 100 / MAX_POINTS))
+
+  if $JSON_OUTPUT; then
+    echo "{"
+    echo "  \"score\": $score,"
+    echo "  \"points\": $TOTAL_POINTS,"
+    echo "  \"max_points\": $MAX_POINTS,"
+    echo "  \"grade\": \"$(get_grade $score)\","
+    echo "  \"categories\": {"
+    local first=true
+    for cat in "${!CATEGORY_SCORES[@]}"; do
+      $first || echo ","
+      first=false
+      printf "    \"%s\": %d" "$cat" "${CATEGORY_SCORES[$cat]}"
+    done
+    echo ""
+    echo "  }"
+    echo "}"
+    return
+  fi
+
+  echo -e "\n${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+  echo -e "${CYAN}  Security Score${NC}"
+  echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}\n"
+
+  # Score bar
+  local bar_width=30
+  local filled=$((score * bar_width / 100))
+  local empty=$((bar_width - filled))
+
+  printf "  Score: ["
+  if [[ $score -ge 80 ]]; then
+    printf '%s' "${GREEN}"
+  elif [[ $score -ge 60 ]]; then
+    printf '%s' "${YELLOW}"
+  else
+    printf '%s' "${RED}"
+  fi
+  printf "%${filled}s" | tr ' ' '█'
+  printf '%s' "${NC}"
+  printf "%${empty}s" | tr ' ' '░'
+  printf "] "
+
+  # Grade
+  local grade
+  grade=$(get_grade $score)
+  case "$grade" in
+    A*) echo -e "${GREEN}${score}%  Grade: ${grade}${NC}" ;;
+    B*) echo -e "${GREEN}${score}%  Grade: ${grade}${NC}" ;;
+    C*) echo -e "${YELLOW}${score}%  Grade: ${grade}${NC}" ;;
+    *) echo -e "${RED}${score}%  Grade: ${grade}${NC}" ;;
+  esac
+
+  echo -e "\n  Points: ${TOTAL_POINTS}/${MAX_POINTS}"
+  echo ""
+
+  # Recommendations
+  if [[ $score -lt 100 ]]; then
+    echo -e "${BLUE}Recommendations:${NC}"
+
+    if ! command -v age >/dev/null 2>&1; then
+      echo "  • Install age for encryption: brew install age"
+    fi
+    if ! command -v sops >/dev/null 2>&1; then
+      echo "  • Install SOPS for secrets: brew install sops"
+    fi
+    if ! git config --global commit.gpgsign 2>/dev/null | grep -q true; then
+      echo "  • Enable commit signing: git config --global commit.gpgsign true"
+    fi
+    if [[ ! -f "${HOME}/.ssh/id_ed25519" ]]; then
+      echo "  • Generate ED25519 SSH key: ssh-keygen -t ed25519"
+    fi
+    echo ""
+  fi
+}
+
+get_grade() {
+  local score=$1
+  if [[ $score -ge 95 ]]; then
+    echo "A+"
+  elif [[ $score -ge 90 ]]; then
+    echo "A"
+  elif [[ $score -ge 85 ]]; then
+    echo "A-"
+  elif [[ $score -ge 80 ]]; then
+    echo "B+"
+  elif [[ $score -ge 75 ]]; then
+    echo "B"
+  elif [[ $score -ge 70 ]]; then
+    echo "B-"
+  elif [[ $score -ge 65 ]]; then
+    echo "C+"
+  elif [[ $score -ge 60 ]]; then
+    echo "C"
+  elif [[ $score -ge 55 ]]; then
+    echo "C-"
+  elif [[ $score -ge 50 ]]; then
+    echo "D"
+  else
+    echo "F"
+  fi
+}
+
+# Main
+print_header
+check_encryption
+check_ssh
+check_git
+check_system
+check_secrets
+print_summary

package/scripts/diagnostics/verify_state.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# MIT License
+# Copyright (c) 2026 Sebastien Rousseau
+# See LICENSE file for details.
+
+# Script: verify_state.sh
+# Description: Final verification of the dotfiles environment state.
+
+set -euo pipefail
+
+echo " Starting Final Environment Verification..."
+
+Errors=0
+
+check_file() {
+  if [[ ! -f "$1" ]]; then
+    echo " Missing file: $1"
+    Errors=$((Errors + 1))
+  else
+    echo " Found file: $1"
+  fi
+}
+
+check_alias_in_config() {
+  if ! grep -q "$1" "$HOME/.config/shell/aliases.sh"; then
+    echo " Missing alias definition '$1' in built config"
+    Errors=$((Errors + 1))
+  else
+    echo " Verified alias: $1"
+  fi
+}
+
+# 1. Verify Docs
+check_file ".chezmoitemplates/aliases/security/README.md"
+check_file ".chezmoitemplates/aliases/legal/README.md"
+
+# 2. Verify Scripts
+check_file "scripts/security/lock-configs.sh"
+check_file "scripts/tools/detect-collisions.py"
+check_file "scripts/tests/test-aliases.sh"
+
+# 3. Verify Generated Config Content (Key Features)
+# Security
+check_alias_in_config "lock-configs"
+check_alias_in_config "unlock-configs"
+check_alias_in_config "enable-signing"
+# Legal
+check_alias_in_config "scan-licenses"
+check_alias_in_config "add-headers"
+
+# 4. Verify Workflows
+check_file ".github/workflows/security-release.yml"
+
+if [[ $Errors -eq 0 ]]; then
+  echo " Verification Passed! All systems nominal."
+  exit 0
+else
+  echo "️  Verification Failed with $Errors errors."
+  exit 1
+fi

package/scripts/dot/commands/appearance.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Dotfiles CLI - Appearance Commands
+# theme, wallpaper, fonts, tune
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../lib/utils.sh
+source "$SCRIPT_DIR/../lib/utils.sh"
+
+cmd_theme() {
+  run_script "scripts/theme/switch.sh" "Theme switcher" "$@"
+}
+
+cmd_wallpaper() {
+  run_script "scripts/theme/wallpaper-sync.sh" "Wallpaper script" "$@"
+}
+
+cmd_fonts() {
+  run_script "scripts/fonts/install-nerd-fonts.sh" "Font install script" "$@"
+}
+
+cmd_tune() {
+  local src_dir
+  src_dir="$(require_source_dir)"
+
+  case "$(uname -s)" in
+    Darwin)
+      exec bash "$src_dir/scripts/tuning/macos.sh" "$@"
+      ;;
+    Linux)
+      exec bash "$src_dir/scripts/tuning/linux.sh" "$@"
+      ;;
+    *)
+      echo "OS tuning not supported on this platform."
+      exit 1
+      ;;
+  esac
+}
+
+# Dispatch
+case "${1:-}" in
+  theme)
+    shift
+    cmd_theme "$@"
+    ;;
+  wallpaper)
+    shift
+    cmd_wallpaper "$@"
+    ;;
+  fonts)
+    shift
+    cmd_fonts "$@"
+    ;;
+  tune)
+    shift
+    cmd_tune "$@"
+    ;;
+  *)
+    echo "Unknown appearance command: ${1:-}" >&2
+    exit 1
+    ;;
+esac