@sebastienrousseau/dotfiles 0.2.468 → 0.2.481

package/docs/NEOVIM_IDE_GUIDE.md

@@ -0,0 +1,52 @@
+# Neovim
+
+## Discover
+
+### 1. Modern Core
+- **Installation**: Uses Neovim Nightly (v0.11+) for the latest features and plugin compatibility.
+- **Configuration**: A modular and lazy-loaded configuration based on `lazy.nvim`.
+- **UI**: A beautiful and functional UI with a dashboard, status line, buffer line, and file explorer.
+- **LSP**: Full LSP support for diagnostics, code actions, and more, managed by `mason.nvim`.
+
+### 2. Language Support
+- **Rust**: Out-of-the-box support for Rust development with `rustaceanvim`.
+- **Python**: Full support for Python development with `basedpyright`, `ruff`, and `venv-selector`.
+- **Web**: Support for web development with `prettier` and `eslint`.
+
+### 3. AI Integration
+- **Copilot**: `copilot.lua` for code completion. Run `:Copilot auth` to sign in.
+- **Copilot Chat**: AI sidebar for asking questions and getting help (`<leader>cc`).
+
+### 4. VS Code Parity
+- **Problem Panel**: `trouble.nvim` for a VS Code-like problems panel (`<leader>xx`).
+- **Search & Replace**: `nvim-spectre` for project-wide search and replace (`<leader>S`).
+- **Auto-Pairs**: Automatically closes brackets and pairs.
+- **TODOs**: Highlights `TODO` and `FIXME` comments.
+- **Session**: Auto-restores your last session.
+
+## Keybindings
+| Key | Action |
+| --- | --- |
+| `<Space>ff` | Find Files |
+| `<Space>fg` | Grep (Search) text |
+| `<Space>fb` | File browser |
+| `<Space>fp` | Projects |
+| `<Space>e` | Toggle File Explorer |
+| `<Space>a` | Add file to Harpoon |
+| `<Ctrl>e` | Open Harpoon menu |
+| `gd` | Go to Definition |
+| `gr` | Go to References |
+| `<leader>ca` | Code actions |
+| `<leader>cf` | Format code |
+| `<leader>cr` | Rename symbol |
+| `<leader>tt` | Toggle terminal |
+| `<leader>tn` | Test nearest |
+| `<leader>tf` | Test file |
+| `<leader>ts` | Test suite |
+| `<F5>` | Continue (Debug) |
+| `<F10>` | Step over (Debug) |
+| `<F11>` | Step into (Debug) |
+| `<F12>` | Step out (Debug) |
+| `<leader>cc` | Toggle Copilot Chat |
+| `<leader>xx` | Toggle Diagnostics (Trouble) |
+| `<leader>S` | Toggle Spectre (Search/Replace) |

package/docs/OPERATIONS.md

@@ -0,0 +1,130 @@
+# Discover operations
+
+This guide covers the core workflows to keep your dotfiles running well across platforms.
+
+---
+
+## Platforms
+
+### macOS
+**Primary manager**: `Homebrew`
+
+- **Update system**:
+  ```bash
+  # Updates Dotfiles AND Homebrew packages
+  chezmoi update
+  ```
+  *Behind the scenes, this runs `brew bundle install` to match the `Brewfile.lock.json`.*
+
+- **Troubleshooting**:
+  - **Permission issues**: `sudo chown -R $(whoami) $(brew --prefix)/*`
+  - **Drift**: Run `brew bundle cleanup` to remove unmanaged packages.
+
+### Linux (Debian, Ubuntu, ZorinOS, Kali)
+**Primary manager**: `apt-get` / `snap`
+
+- **Update system**:
+  ```bash
+  # 1. Update OS packages
+  sudo apt update && sudo apt upgrade -y
+  
+  # 2. Update Dotfiles
+  chezmoi update
+  ```
+  > [!NOTE]
+  > On Linux, `chezmoi` focuses on configuration. Package updates work best with the OS package manager to avoid `sudo` conflicts.
+
+- **Troubleshooting**:
+  - **Font issues**: If icons are missing, run `./install/provision/run_onchange_50-install-fonts.sh` manually.
+  - **ZorinOS/GNOME**: Custom keybindings may require `dconf load` if Chezmoi does not apply them automatically.
+
+### Windows (WSL2)
+**Primary manager**: `apt-get` (inside WSL)
+
+- **Update system**: Same as **Linux**.
+
+- **WSL specifics**:
+  - **Access Windows files**: WSL mounts Windows drives at `/mnt/c/`.
+  - **Clipboard**: Dotfiles configures `win32yank.exe` automatically for clipboard sharing.
+  - **Performance**: Keep project files inside the Linux filesystem (`~/projects`), NOT in `/mnt/c/`, for 100x better IO performance.
+
+---
+
+## Workflows
+
+### Apply changes
+After editing any config file:
+```bash
+dot apply
+```
+*Triggers: `dot_zshrc` reload, audit logging.*
+
+### Roll back
+If an update breaks your setup, revert:
+```bash
+cd ~/.dotfiles
+git reset --hard HEAD@{1}  # Go back 1 operation
+chezmoi apply
+```
+
+### Debug
+If something runs slow or appears broken:
+
+1. **Check health**:
+   ```bash
+   dot doctor
+   ```
+2. **Verbose mode**:
+   ```bash
+   DOTFILES_DEBUG=1 dot apply
+   ```
+
+---
+
+## Tools
+
+### Make it yours
+- **Wallpaper rotation**:
+  ```bash
+  ~/.dotfiles/scripts/theme/wallpaper-rotate.sh --interval 300
+  ```
+- **Cursor theme (Linux)**:
+  ```bash
+  DOTFILES_CURSOR_THEME=Papirus ~/.dotfiles/scripts/theme/install-cursors.sh
+  ```
+- **File icons (Linux/macOS)**:
+  ```bash
+  DOTFILES_ICON_THEME=Papirus ~/.dotfiles/scripts/theme/install-file-icons.sh
+  ```
+- **Lock icon (Linux)**:
+  ```bash
+  DOTFILES_LOCK_ICON=~/.config/dotfiles/lock/icon.png ~/.dotfiles/scripts/theme/install-lock-icon.sh
+  ```
+- **GRUB theme (Linux)**:
+  ```bash
+  sudo ~/.dotfiles/scripts/theme/install-grub-theme.sh --apply
+  ```
+- **Boot logo (Linux)**:
+  ```bash
+  sudo ~/.dotfiles/scripts/theme/install-boot-logo.sh --apply
+  ```
+
+### Atuin
+- **Login**: `atuin login`
+- **Sync**: `atuin sync`
+- **Search**: `Ctrl-r` (Global history search)
+
+### Zoxide
+- **Jump**: `z project` matches `~/dev/project`
+- **Query**: `zi` (Interactive selection)
+
+### Yazi
+- **Open**: Type `y`
+- **Preview**: Spacebar to preview files
+- **Quit**: `q`
+
+---
+
+## Security policy
+- **GPG/SSH**: All commits use SSH signing.
+- **Audit log**: Review `~/.local/share/dotfiles.log` for a timeline of all changes that Dotfiles applied.

package/docs/PLAN.md

@@ -0,0 +1,161 @@
+# Universal Configuration Plan (Chezmoi)
+
+... [Previous Sections Unchanged] ...
+
+# Phase 15: Operational Documentation [COMPLETED]
+- [x] **Guide**: Created `OPERATIONS.md`.
+
+# Phase 16: Final Release Verification [COMPLETED]
+- [x] **Verification**: All systems passed.
+
+# Phase 17: Structural Optimizations (v0.3.0)
+
+## Goal
+Implement structural improvements for better organization and maintainability, anticipating v0.3.0.
+
+## Proposed Changes
+
+### [REFACTOR] Semantic Organization
+- **Move**: `dot_config/dotfiles` -> `dot_config/shell`.
+- **Reason**: `dotfiles` is redundant inside a dotfiles repo. `shell` describes the content (aliases, paths, functions).
+- **Update**: Update references in `dot_zshrc.tmpl` and install scripts.
+
+### [REFACTOR] Script Installation
+- **Move**: `bin/` -> `dot_local/bin/`.
+- **Reason**: Ensures scripts are automatically installed to `~/.local/bin` (user PATH).
+
+### [CLEANUP] Remove Legacy Files
+- **Delete**: `Makefile`, `package.json`.
+- **Reason**: Replaced by `chezmoi` and GitHub Actions.
+
+### [REFACTOR] Script Segregation
+- **Split**: `run_onchange_install_packages.sh.tmpl` into:
+    - `run_onchange_darwin_install-packages.sh.tmpl` (Homebrew)
+    - `run_onchange_linux_install-packages.sh.tmpl` (Apt)
+    - `run_onchange_after_install-vim-plug.sh.tmpl` (Universal)
+- **Reason**: Improves readability and maintainability.
+
+# Phase 18: Component Documentation Polish [COMPLETED]
+
+## Goal
+Update component documentation (`aliases`, `functions`, `paths`) to match the new `chezmoi` architecture and ensure accuracy.
+
+## Changes
+- **Aliases**: Updated `aliases/README.md` to explain modular `*.aliases.sh` loading.
+- **Functions**: Updated `functions/README.md` to remove legacy install instructions.
+- **Paths**: Updated `paths/README.md` to clarify precedence and `chezmoi` integration.
+- **Cleanup**: Standardized all nested alias READMEs to remove legacy HTML artifacts and restore banners.
+
+# Phase 19: Toolchain Expansion [COMPLETED]
+
+## Goal
+Add comprehensive support for modern DevOps/Cloud engineering tools.
+
+## Proposed Changes
+### [NEW] Aliases
+- **Kubernetes**: `kubectl` shortcuts (`k`), `helm`, `k9s`.
+- **IaC**: `terraform` (`tf`), `opentofu`, `ansible`.
+- **Languages**: `go` (`g`), `yarn`, `uv` (modern Python).
+- **Diagnostics**: `jq`, `yq`, `nc`, `curlie`.
+- **Structure**: Each component gets its own directory in `.chezmoitemplates/aliases/` with a standard `README.md`.
+
+# Phase 20: Intelligent Assistance [COMPLETED]
+
+## Goal
+Integrate AI capabilities and improved help systems.
+
+## Proposed Changes
+### [NEW] Functions
+- **`dothelp`**: Index and search all aliases/functions with descriptions.
+- **AI Wrappers**: Aliases for `gh copilot`, `fabric`, or generic LLM CLI tools.
+
+# Phase 22: Automated Testing [COMPLETED]
+
+## Goal
+Verify the dotfiles work on clean Linux environments.
+
+## Proposed Changes
+### [CI] GitHub Actions
+- **Container Job**: Run `chezmoi init --apply` inside a localized Docker container (Ubuntu/Fedora) to prove universal compatibility.
+
+# Phase 23: Enterprise Core & Security (The Trust Layer) [COMPLETED]
+
+## Goal
+Establish a "Trust Layer" for the dotfiles ecosystem, ensuring supply chain security and configuration integrity.
+
+## Changes
+- **SLSA & SBOM**: Implemented `security-release.yml` for provenance and SBOM generation.
+- **Signing**: Created `enable-signing` wizard alias for easy GPG/SSH configuration.
+- **Immutability**: Created `lock-configs.sh` script and `lock-configs`/`unlock-configs` aliases.
+
+- **Immutability**: Created `lock-configs.sh` script and `lock-configs`/`unlock-configs` aliases.
+
+# Phase 27: Self-Healing & Diagnostics [COMPLETED]
+
+## Goal
+Enable the system to self-diagnose and repair configuration drift.
+
+## Changes
+- **Scripts**: Created `scripts/diagnostics/doctor.sh` for system health checks.
+- **Aliases**: Added `dot doctor`, `dot drift` (`chezmoi verify`), and `dot heal` (`chezmoi apply`).
+
+# Phase 51: Regulatory Compliance [COMPLETED]
+
+## Goal
+Document and enforce compliance with SOC2, ISO, and GDPR standards.
+
+## Changes
+- **Documentation**: Created `COMPLIANCE.md` with control mappings.
+- **Privacy**: Added `privacy-mode` alias to disable CLI telemetry.
+- **Audit**: Added `dot audit` alias for tracking changes.
+
+# Phase 54: macOS Deep Integration [COMPLETED]
+
+## Goal
+Harden and optimize the macOS environment via code.
+
+## Changes
+- **Defaults**: Created `run_onchange_darwin_defaults.sh.tmpl` to apply secure/optimized `defaults`.
+- **Hardening**: Enabled screensaver passwords, firewall settings, and disabled guest access.
+
+## Goal
+Ensure legal compliance and proper attribution for the open-source project.
+
+## Changes
+- **Licensing**: Added `scan-licenses` alias (Trivy/FOSSology).
+- **Headers**: Added `add-headers` alias for automated copyright insertion.
+- **Compliance**: Added `check-cla` and `gen-notice` tools.
+
+# Phase 59: Font Typography [COMPLETED]
+
+## Goal
+Standardize typography and ensure high-quality font rendering across all environments.
+
+## Proposed Changes
+- **Nerd Fonts**: Automate installation of `JetBrainsMono Nerd Font` and `Symbols Nerd Font`.
+- **Fontconfig**: Deploy XML configuration for Linux font rendering (antialiasing, hinting).
+- **Aliases**: `update-fonts` to refresh font caches (`fc-cache`).
+
+# Phase 26: OS Bundling & Compliance [COMPLETED]
+
+## Goal
+Prepare the dotfiles for system-wide deployment and ensure strict adherence to standards.
+
+## Proposed Changes
+- **XDG Compliance**: Audit `00-default.paths.sh` to ensure all standard XDG variables are exported.
+- **Vendor Hooks**: Update `dot_zshrc.tmpl` to source system-level overrides from `/etc/dotfiles/defaults.d/` (Simulates "site-local" config).
+- **Bundling**: Create `scripts/core/package.sh` to create a distributable tarball and scaffold `.deb`/`.pkg` generation logic.
+
+# Phase 24: The Universal Installer (Zero-Dependency) [COMPLETED]
+
+## Goal
+Provide a frictionless, "one-curl" onboarding experience and capabilities to deploy configurations remotely.
+
+## Proposed Changes
+- **install.sh**: A standalone, zero-dependency bash script that:
+    1.  Detects OS/Arch.
+    2.  Installs `chezmoi` (binary or via package manager).
+    3.  Initializes the dotfiles repo.
+    4.  Runs `chezmoi apply`.
+    5.  Uses ANSI colors for a polished "TUI" feel.
+- **Teleportation**: `scripts/ops/teleport.sh` using `chezmoi archive` piped to SSH to ephemeralize configs on remote servers (e.g., `dot teleport user@server`).

package/docs/PR_DESCRIPTION.md

@@ -0,0 +1,149 @@
+# Release notes — v0.2.480
+
+## Release overview
+
+This release transforms the dotfiles into a high-performance, cross-platform system managed by **chezmoi**.
+
+### Architecture
+v0.2.480 is a portable **shell distribution** managed by `chezmoi` (source of truth in `~/.dotfiles`).
+
+- **XDG-first**: Configs strictly mapped to `~/.config/` (no `~/.foo` sprawl).
+- **Single entrypoint**: `dot_zshenv` acts as an XDG bootloader for instant environment setup.
+- **Modern toolchain**: Replaces classic Unix tools with high-performance Rust alternatives:
+  - `ls` → `eza`
+  - `cat` → `bat`
+  - `grep` → `ripgrep`
+  - `cd` → `zoxide` (smart directory jumping)
+  - `history` → `atuin` (syncable, encrypted SQLite history)
+- **Predictive shell**:
+  - **AI strategy**: Context-aware autosuggestions coupled with optional local LLM integration (`ai_core`).
+  - **Error analysis**: Wrappers analyze command failures through `gh copilot` or local models.
+
+### Non-goals
+- **Not a framework**: This is a curated distribution, not a plugin manager like Oh-My-Zsh.
+- **Not POSIX-pure**: Prioritizes modern Zsh/Rust features over strict POSIX compliance.
+- **Not minimal**: Optimizes for functionality and speed, not line-count minimalism.
+
+### Security
+- **Hardened by default**: Scripts run with `set -euo pipefail` to fail fast on errors.
+- **Supply chain safety**:
+  - **Pinned install**: Installation commands pin to the specific release tag (`v0.2.480`) to prevent drift.
+  - **Zero-trust**: No implicit reliance on `main` branch code in production.
+- **Threat model**: This project assumes a **trusted local machine** and focuses on supply-chain (pinned versions) and configuration safety (immutable history).
+- **Audit logging**: Dotfiles logs all `chezmoi` mutations to `~/.local/share/dotfiles.log` for day-2 operations review.
+
+### Changes
+- **Migrated**:
+  - Shell: `~/.zshrc` now sources generated templates from `~/.config/shell`.
+  - Neovim: `~/.config/nvim` fully managed through Lua/Lazy.nvim.
+  - Tmux: Modular config consolidated to `~/.dotfiles/dot_tmux.conf`.
+- **Packaging**:
+  - `Brewfile` (macOS) and `apt-get` (Linux) handled automatically.
+- **Structural**:
+  - **Renamed**: `dot_config/dotfiles` → `dot_config/shell` for semantic clarity.
+  - **Moved**: `bin/` → `dot_local/bin/` for automatic path integration.
+  - **Separated**: Install scripts split by OS (Darwin/Linux) for cleaner logic.
+- **Layered architecture**: Refactored shell config into explicit layers:
+  - `00-core`: Safety/Paths
+  - `50-logic`: Functions/Toolchain
+  - `90-ux`: Aliases/Theme
+- **Trust and reproducibility**:
+  - **Pinned formulae**: Generated `Brewfile.lock.json` for strictly reproducible macOS builds.
+  - **Binary pinning**: `install.sh` now enforces specific version tags for initial bootstrap.
+### Quality
+- **Conflict resolution**: Detected and resolved **46 namespace collisions** across all alias modules (Git, Go, Archives, etc.) to ensure zero overlap.
+- **Git safety**: Renamed colliding Go aliases (for example, `gr` -> `gor`) to protect core Git commands.
+- **Modernization**: Merged `list` into `modern` for a cohesive Rust-based toolchain experience (`eza`, `bat`).
+- **Standardization**: Removed duplicate logging functions in favor of a shared utility.
+- **Documentation**: All 30+ component READMEs now reflect current functionality.
+
+### Toolchain
+- **Kubernetes**: Added `kubectl`, `helm`, `k9s` aliases.
+- **IaC**: Added `terraform`, `opentofu`, `ansible`.
+- **Languages**: Added ecosystem support for `go`, `yarn`, `uv` (modern Python).
+- **AI integration**: Added wrappers for `gh copilot`, `fabric`, and local LLMs.
+- **Smart help**: Added `dothelp` to search and index custom functions.
+
+### Testing
+
+- **Automated testing**
+  - Docker CI (`ci-docker.yml`) runs on Ubuntu/Fedora/Arch.
+  - Integration tests validate alias syntax (`test-aliases.sh`).
+
+- **Enterprise core and security (the trust layer)**
+  - **SLSA and SBOM**: `security-release.yml` generates SPDX SBOMs and SLSA Level 3 Provenance.
+  - **Signing**: `enable-signing` wizard for GPG/SSH git signing.
+  - **Immutability**: `lock-configs` / `unlock-configs` protect critical dotfiles (`chflags`/`chattr`).
+
+- **Legal and licensing**
+  - **Compliance**: `scan-licenses` (FOSSology/Trivy), `check-cla` (GitHub checks).
+  - **Attribution**: `add-headers` automation and `gen-notice` generation.
+
+- **Self-healing and diagnostics**
+  - **Health**: `dot doctor` diagnoses environment (dependencies, XDG, paths).
+  - **Repair**: `dot heal` / `dot drift` aliases for auto-repair and drift detection.
+
+- **Regulatory compliance**
+  - **Documentation**: `COMPLIANCE.md` maps features to **SOC2 Type II** and **ISO 27001**.
+  - **Privacy**: `privacy-mode` alias disables CLI telemetry for 7+ frameworks.
+
+- **macOS deep integration**
+  - **Hardening**: `defaults` script hardens screensaver, firewall, and Finder settings.
+  - **Optimization**: Configures Safari for development, removes Dock clutter.
+
+- **Font typography**
+  - **Fonts**: Auto-installs `JetBrainsMono Nerd Font` and `Symbols Nerd Font`.
+  - **Rendering**: Linux `fontconfig` XML for sub-pixel antialiasing.
+
+- **Phase 58: Editor unification** (implemented)
+  - **Neovim IDE**: Full VS Code feature parity (Noice, Lualine, Gitsigns, Indent-Blankline).
+  - **Language support**: Optimized for Rust (Rustaceanvim) and Python (BasedPyright/Ruff).
+  - **Performance**: Lazy-loading architecture with `<30ms` startup.
+  - **CI/CD fixes**: Resolved CodeQL alerts (removed legacy Node.js) and fixed Docker builds.
+
+- **OS bundling and compliance**
+  - **Packaging**: `scripts/package.sh` generates versioned distribution tarballs.
+  - **Enterprise**: `/etc/dotfiles/defaults.d` hooks for site-local config overrides.
+  - **Standards**: Strict **XDG Base Directory** enforcement in `paths.sh`.
+
+- **The universal installer (zero-dep)**
+  - **Bootstrap**: `install.sh` runs through `curl | sh` with no dependencies.
+  - **Teleport**: `dot teleport user@host` deploys configs ephemerally through SSH.
+
+### Verification
+- **Performance**: Benchmark script `scripts/benchmark.sh` confirms <20ms startup.
+- **Integration**: `test-aliases.sh` validates syntax of all 32 alias modules.
+- **Security**: **Zero critical vulnerabilities** (CodeQL and Dependabot clean).
+- **Functionality**: Local migration tested on macOS, Linux, and WSL.
+
+
+### Install and migrate
+
+#### Option A: Fresh install (new machines)
+To set up a new machine, run the universal installer:
+```bash
+sh -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.480/install.sh)"
+```
+
+#### Option B: Migration (upgrade from earlier versions)
+
+> [!IMPORTANT]
+> This release changes the architecture from direct symlinks to `chezmoi` templates. Back up your configuration first.
+
+Existing `chezmoi` users can run `chezmoi apply` to upgrade, but the full installer works better for major version jumps.
+
+1. **Back up legacy configs**:
+   ```bash
+   mv ~/.zshrc ~/.zshrc.bak
+   mv ~/.config/nvim ~/.config/nvim.bak
+   ```
+2. **Run the installer**:
+   ```bash
+   sh -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/v0.2.480/install.sh)"
+   ```
+3. **Resolve conflicts**:
+   - If `chezmoi` prompts you to overwrite files (for example, `.zshrc`), select **overwrite** (or diff to check) because this release uses a new sourcing strategy.
+4. **Restart shell**:
+   ```bash
+   exec zsh
+   ```