@sebastienrousseau/dotfiles 0.2.481 → 0.2.499

package/scripts/diagnostics/history-analysis.sh

@@ -1,77 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-histfile="${HISTFILE:-$HOME/.zsh_history}"
-db="${DOTFILES_HISTORY_DB:-$HOME/.local/share/dotfiles/history.sqlite}"
-
-if [[ ! -f "$histfile" ]]; then
-  echo "History file not found: $histfile" >&2
-  exit 1
-fi
-
-if ! command -v python3 >/dev/null; then
-  echo "python3 not found. Falling back to hstats if available." >&2
-  if command -v hstats >/dev/null; then
-    hstats
-    exit 0
-  fi
-  exit 1
-fi
-
-mkdir -p "$(dirname "$db")"
-
-python3 - "$histfile" "$db" <<'PY'
-import sys
-import sqlite3
-import re
-from pathlib import Path
-
-histfile = Path(sys.argv[1])
-db = Path(sys.argv[2])
-
-conn = sqlite3.connect(db)
-cur = conn.cursor()
-cur.execute("CREATE TABLE IF NOT EXISTS history (ts INTEGER, cmd TEXT)")
-cur.execute("DELETE FROM history")
-
-pattern = re.compile(r"^: (\d+):\d+;(.*)$")
-
-with histfile.open("r", encoding="utf-8", errors="ignore") as f:
-    for line in f:
-        line = line.rstrip("\n")
-        m = pattern.match(line)
-        if not m:
-            continue
-        ts = int(m.group(1))
-        cmd = m.group(2).strip()
-        if not cmd:
-            continue
-        cur.execute("INSERT INTO history (ts, cmd) VALUES (?, ?)", (ts, cmd))
-
-conn.commit()
-
-print("=== History Analysis ===")
-
-print("\nTop commands:")
-for row in cur.execute("""
-    SELECT substr(cmd, 1, instr(cmd || ' ', ' ') - 1) AS base, COUNT(*)
-    FROM history
-    GROUP BY base
-    ORDER BY COUNT(*) DESC
-    LIMIT 15
-"""):
-    print(f"{row[1]:>6}  {row[0]}")
-
-print("\nTop directories (cd):")
-for row in cur.execute("""
-    SELECT trim(substr(cmd, 4)) AS dir, COUNT(*)
-    FROM history
-    WHERE cmd LIKE 'cd %'
-    GROUP BY dir
-    ORDER BY COUNT(*) DESC
-    LIMIT 10
-"""):
-    print(f"{row[1]:>6}  {row[0]}")
-
-conn.close()
-PY

package/scripts/diagnostics/security-score.sh

@@ -1,392 +0,0 @@
-#!/usr/bin/env bash
-# Security Score Assessment
-# Usage: dot security-score [--verbose|-v] [--json]
-
-set -euo pipefail
-
-# Colors
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-CYAN='\033[0;36m'
-NC='\033[0m'
-
-# Parse arguments
-VERBOSE=false
-JSON_OUTPUT=false
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --verbose | -v)
-      VERBOSE=true
-      shift
-      ;;
-    --json)
-      JSON_OUTPUT=true
-      shift
-      ;;
-    *) shift ;;
-  esac
-done
-
-# Scoring
-TOTAL_POINTS=0
-MAX_POINTS=0
-declare -A CATEGORY_SCORES
-
-add_points() {
-  local category="$1"
-  local points="$2"
-  local max="$3"
-  local description="$4"
-  # $5 is status (pass/fail/partial) - used for icon selection below
-
-  TOTAL_POINTS=$((TOTAL_POINTS + points))
-  MAX_POINTS=$((MAX_POINTS + max))
-  CATEGORY_SCORES["$category"]=$((${CATEGORY_SCORES[$category]:-0} + points))
-
-  if ! $JSON_OUTPUT && $VERBOSE; then
-    local icon
-    if [[ $points -eq $max ]]; then
-      icon="${GREEN}✓${NC}"
-    elif [[ $points -gt 0 ]]; then
-      icon="${YELLOW}◐${NC}"
-    else
-      icon="${RED}✗${NC}"
-    fi
-    printf "  $icon %-40s %d/%d pts\n" "$description" "$points" "$max"
-  fi
-}
-
-print_header() {
-  if ! $JSON_OUTPUT; then
-    echo -e "\n${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-    echo -e "${CYAN}  Security Score Assessment${NC}"
-    echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}\n"
-  fi
-}
-
-section() {
-  if ! $JSON_OUTPUT; then
-    echo -e "\n${BLUE}▸ $1${NC}"
-    echo "───────────────────────────────────────────────"
-  fi
-}
-
-# === Security Checks ===
-
-check_encryption() {
-  section "Encryption (30 pts max)"
-
-  # Age encryption tool
-  if command -v age >/dev/null 2>&1; then
-    add_points "encryption" 5 5 "Age encryption installed" "pass"
-  else
-    add_points "encryption" 0 5 "Age encryption installed" "fail"
-  fi
-
-  # Age key exists
-  if [[ -f "${HOME}/.config/chezmoi/key.txt" ]]; then
-    add_points "encryption" 5 5 "Age encryption key present" "pass"
-
-    # Check key permissions
-    local perms
-    perms=$(stat -c "%a" "${HOME}/.config/chezmoi/key.txt" 2>/dev/null || stat -f "%OLp" "${HOME}/.config/chezmoi/key.txt" 2>/dev/null)
-    if [[ "$perms" == "600" ]]; then
-      add_points "encryption" 5 5 "Key file permissions (600)" "pass"
-    else
-      add_points "encryption" 2 5 "Key file permissions (600)" "partial"
-    fi
-  else
-    add_points "encryption" 0 10 "Age encryption configured" "fail"
-  fi
-
-  # SOPS available
-  if command -v sops >/dev/null 2>&1; then
-    add_points "encryption" 5 5 "SOPS secrets manager" "pass"
-  else
-    add_points "encryption" 0 5 "SOPS secrets manager" "fail"
-  fi
-
-  # GPG available
-  if command -v gpg >/dev/null 2>&1 && gpg --list-secret-keys 2>/dev/null | grep -q sec; then
-    add_points "encryption" 10 10 "GPG keys configured" "pass"
-  elif command -v gpg >/dev/null 2>&1; then
-    add_points "encryption" 3 10 "GPG keys configured" "partial"
-  else
-    add_points "encryption" 0 10 "GPG keys configured" "fail"
-  fi
-}
-
-check_ssh() {
-  section "SSH Security (25 pts max)"
-
-  # SSH directory permissions
-  if [[ -d "${HOME}/.ssh" ]]; then
-    local ssh_perms
-    ssh_perms=$(stat -c "%a" "${HOME}/.ssh" 2>/dev/null || stat -f "%OLp" "${HOME}/.ssh" 2>/dev/null)
-    if [[ "$ssh_perms" == "700" ]]; then
-      add_points "ssh" 5 5 "SSH directory permissions (700)" "pass"
-    else
-      add_points "ssh" 2 5 "SSH directory permissions (700)" "partial"
-    fi
-  else
-    add_points "ssh" 0 5 "SSH directory exists" "fail"
-  fi
-
-  # ED25519 key (preferred over RSA)
-  if [[ -f "${HOME}/.ssh/id_ed25519" ]]; then
-    add_points "ssh" 10 10 "ED25519 SSH key (modern)" "pass"
-  elif [[ -f "${HOME}/.ssh/id_rsa" ]]; then
-    add_points "ssh" 5 10 "SSH key present (RSA)" "partial"
-  else
-    add_points "ssh" 0 10 "SSH key present" "fail"
-  fi
-
-  # SSH agent
-  if [[ -n "${SSH_AUTH_SOCK:-}" ]] || pgrep -x ssh-agent >/dev/null 2>&1; then
-    add_points "ssh" 5 5 "SSH agent running" "pass"
-  else
-    add_points "ssh" 0 5 "SSH agent running" "fail"
-  fi
-
-  # SSH config exists
-  if [[ -f "${HOME}/.ssh/config" ]]; then
-    add_points "ssh" 5 5 "SSH config present" "pass"
-  else
-    add_points "ssh" 2 5 "SSH config present" "partial"
-  fi
-}
-
-check_git() {
-  section "Git Security (20 pts max)"
-
-  # Git installed
-  if ! command -v git >/dev/null 2>&1; then
-    add_points "git" 0 20 "Git installed" "fail"
-    return
-  fi
-
-  # Commit signing
-  if git config --global commit.gpgsign 2>/dev/null | grep -q true; then
-    add_points "git" 10 10 "Commit signing enabled" "pass"
-  else
-    add_points "git" 0 10 "Commit signing enabled" "fail"
-  fi
-
-  # User identity configured
-  if git config --global user.email >/dev/null 2>&1 && git config --global user.name >/dev/null 2>&1; then
-    add_points "git" 5 5 "Git identity configured" "pass"
-  else
-    add_points "git" 0 5 "Git identity configured" "fail"
-  fi
-
-  # Credential helper
-  if git config --global credential.helper >/dev/null 2>&1; then
-    add_points "git" 5 5 "Credential helper configured" "pass"
-  else
-    add_points "git" 0 5 "Credential helper configured" "fail"
-  fi
-}
-
-check_system() {
-  section "System Security (15 pts max)"
-
-  # Firewall (macOS or Linux)
-  if [[ "$(uname)" == "Darwin" ]]; then
-    if /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null | grep -q enabled; then
-      add_points "system" 5 5 "Firewall enabled" "pass"
-    else
-      add_points "system" 0 5 "Firewall enabled" "fail"
-    fi
-  else
-    # Check ufw via systemctl (doesn't need sudo) or sudo ufw status
-    local fw_enabled=false
-    if systemctl is-active --quiet ufw 2>/dev/null; then
-      fw_enabled=true
-    elif command -v ufw >/dev/null 2>&1 && sudo -n ufw status 2>/dev/null | grep -q "Status: active"; then
-      fw_enabled=true
-    elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state 2>/dev/null | grep -q running; then
-      fw_enabled=true
-    fi
-
-    if $fw_enabled; then
-      add_points "system" 5 5 "Firewall enabled" "pass"
-    else
-      add_points "system" 0 5 "Firewall enabled" "fail"
-    fi
-  fi
-
-  # Disk encryption (LUKS, FileVault, or ecryptfs)
-  if [[ "$(uname)" == "Darwin" ]]; then
-    if fdesetup status 2>/dev/null | grep -q "FileVault is On"; then
-      add_points "system" 10 10 "Disk encryption (FileVault)" "pass"
-    else
-      add_points "system" 0 10 "Disk encryption (FileVault)" "fail"
-    fi
-  else
-    local encryption_found=false
-    # Check LUKS
-    if lsblk 2>/dev/null | grep -q crypt || [[ -d /sys/block/dm-0 ]]; then
-      encryption_found=true
-      add_points "system" 10 10 "Disk encryption (LUKS)" "pass"
-    # Check Apple T2 chip (hardware SSD encryption)
-    elif lspci 2>/dev/null | grep -qi "T2.*Secure Enclave"; then
-      encryption_found=true
-      add_points "system" 10 10 "Hardware encryption (Apple T2)" "pass"
-    # Check ecryptfs (encrypted home)
-    elif mount 2>/dev/null | grep -q ecryptfs || [[ -d "$HOME/.ecryptfs" ]]; then
-      encryption_found=true
-      add_points "system" 10 10 "Home encryption (ecryptfs)" "pass"
-    # Check if running in encrypted VM/container
-    elif [[ -f /sys/class/dmi/id/product_name ]] && grep -qiE "virtual|vmware|kvm|qemu" /sys/class/dmi/id/product_name 2>/dev/null; then
-      encryption_found=true
-      add_points "system" 10 10 "Virtualized (host encryption)" "pass"
-    fi
-
-    if ! $encryption_found; then
-      add_points "system" 0 10 "Disk encryption" "unknown"
-    fi
-  fi
-}
-
-check_secrets() {
-  section "Secrets Management (10 pts max)"
-
-  # No secrets in dotfiles repo
-  if [[ -d "${HOME}/.dotfiles" ]]; then
-    local secrets_found=false
-    # Check for common secret patterns
-    if grep -rE "(api_key|api_secret|password|token)\\s*=\\s*['\"][^'\"]+['\"]" "${HOME}/.dotfiles" --include="*.sh" --include="*.zsh" --include="*.toml" 2>/dev/null | grep -v "example\|template\|placeholder" | head -1; then
-      secrets_found=true
-    fi
-
-    if $secrets_found; then
-      add_points "secrets" 0 5 "No hardcoded secrets" "fail"
-    else
-      add_points "secrets" 5 5 "No hardcoded secrets" "pass"
-    fi
-  else
-    add_points "secrets" 5 5 "No hardcoded secrets" "pass"
-  fi
-
-  # Environment variables for secrets
-  if [[ -f "${HOME}/.config/secrets/api-keys.env" ]] || [[ -d "${HOME}/.config/secrets" ]]; then
-    add_points "secrets" 5 5 "Secrets in dedicated location" "pass"
-  else
-    add_points "secrets" 2 5 "Secrets management setup" "partial"
-  fi
-}
-
-print_summary() {
-  local score=$((TOTAL_POINTS * 100 / MAX_POINTS))
-
-  if $JSON_OUTPUT; then
-    echo "{"
-    echo "  \"score\": $score,"
-    echo "  \"points\": $TOTAL_POINTS,"
-    echo "  \"max_points\": $MAX_POINTS,"
-    echo "  \"grade\": \"$(get_grade $score)\","
-    echo "  \"categories\": {"
-    local first=true
-    for cat in "${!CATEGORY_SCORES[@]}"; do
-      $first || echo ","
-      first=false
-      printf "    \"%s\": %d" "$cat" "${CATEGORY_SCORES[$cat]}"
-    done
-    echo ""
-    echo "  }"
-    echo "}"
-    return
-  fi
-
-  echo -e "\n${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-  echo -e "${CYAN}  Security Score${NC}"
-  echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}\n"
-
-  # Score bar
-  local bar_width=30
-  local filled=$((score * bar_width / 100))
-  local empty=$((bar_width - filled))
-
-  printf "  Score: ["
-  if [[ $score -ge 80 ]]; then
-    printf '%s' "${GREEN}"
-  elif [[ $score -ge 60 ]]; then
-    printf '%s' "${YELLOW}"
-  else
-    printf '%s' "${RED}"
-  fi
-  printf "%${filled}s" | tr ' ' '█'
-  printf '%s' "${NC}"
-  printf "%${empty}s" | tr ' ' '░'
-  printf "] "
-
-  # Grade
-  local grade
-  grade=$(get_grade $score)
-  case "$grade" in
-    A*) echo -e "${GREEN}${score}%  Grade: ${grade}${NC}" ;;
-    B*) echo -e "${GREEN}${score}%  Grade: ${grade}${NC}" ;;
-    C*) echo -e "${YELLOW}${score}%  Grade: ${grade}${NC}" ;;
-    *) echo -e "${RED}${score}%  Grade: ${grade}${NC}" ;;
-  esac
-
-  echo -e "\n  Points: ${TOTAL_POINTS}/${MAX_POINTS}"
-  echo ""
-
-  # Recommendations
-  if [[ $score -lt 100 ]]; then
-    echo -e "${BLUE}Recommendations:${NC}"
-
-    if ! command -v age >/dev/null 2>&1; then
-      echo "  • Install age for encryption: brew install age"
-    fi
-    if ! command -v sops >/dev/null 2>&1; then
-      echo "  • Install SOPS for secrets: brew install sops"
-    fi
-    if ! git config --global commit.gpgsign 2>/dev/null | grep -q true; then
-      echo "  • Enable commit signing: git config --global commit.gpgsign true"
-    fi
-    if [[ ! -f "${HOME}/.ssh/id_ed25519" ]]; then
-      echo "  • Generate ED25519 SSH key: ssh-keygen -t ed25519"
-    fi
-    echo ""
-  fi
-}
-
-get_grade() {
-  local score=$1
-  if [[ $score -ge 95 ]]; then
-    echo "A+"
-  elif [[ $score -ge 90 ]]; then
-    echo "A"
-  elif [[ $score -ge 85 ]]; then
-    echo "A-"
-  elif [[ $score -ge 80 ]]; then
-    echo "B+"
-  elif [[ $score -ge 75 ]]; then
-    echo "B"
-  elif [[ $score -ge 70 ]]; then
-    echo "B-"
-  elif [[ $score -ge 65 ]]; then
-    echo "C+"
-  elif [[ $score -ge 60 ]]; then
-    echo "C"
-  elif [[ $score -ge 55 ]]; then
-    echo "C-"
-  elif [[ $score -ge 50 ]]; then
-    echo "D"
-  else
-    echo "F"
-  fi
-}
-
-# Main
-print_header
-check_encryption
-check_ssh
-check_git
-check_system
-check_secrets
-print_summary

package/scripts/dot/commands/appearance.sh

@@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-# Dotfiles CLI - Appearance Commands
-# theme, wallpaper, fonts, tune
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
-
-cmd_theme() {
-  run_script "scripts/theme/switch.sh" "Theme switcher" "$@"
-}
-
-cmd_wallpaper() {
-  run_script "scripts/theme/wallpaper-sync.sh" "Wallpaper script" "$@"
-}
-
-cmd_fonts() {
-  run_script "scripts/fonts/install-nerd-fonts.sh" "Font install script" "$@"
-}
-
-cmd_tune() {
-  local src_dir
-  src_dir="$(require_source_dir)"
-
-  case "$(uname -s)" in
-    Darwin)
-      exec bash "$src_dir/scripts/tuning/macos.sh" "$@"
-      ;;
-    Linux)
-      exec bash "$src_dir/scripts/tuning/linux.sh" "$@"
-      ;;
-    *)
-      echo "OS tuning not supported on this platform."
-      exit 1
-      ;;
-  esac
-}
-
-# Dispatch
-case "${1:-}" in
-  theme)
-    shift
-    cmd_theme "$@"
-    ;;
-  wallpaper)
-    shift
-    cmd_wallpaper "$@"
-    ;;
-  fonts)
-    shift
-    cmd_fonts "$@"
-    ;;
-  tune)
-    shift
-    cmd_tune "$@"
-    ;;
-  *)
-    echo "Unknown appearance command: ${1:-}" >&2
-    exit 1
-    ;;
-esac

package/scripts/dot/commands/core.sh

@@ -1,130 +0,0 @@
-#!/usr/bin/env bash
-# Dotfiles CLI - Core Commands
-# apply, sync, update, add, diff, status, remove, cd, edit
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../lib/utils.sh
-source "$SCRIPT_DIR/../lib/utils.sh"
-
-cmd_apply() {
-  local src_dir
-  src_dir="$(resolve_source_dir)"
-  if [ -n "$src_dir" ] && [ -f "$src_dir/scripts/ops/chezmoi-apply.sh" ]; then
-    exec bash "$src_dir/scripts/ops/chezmoi-apply.sh" "$@"
-  fi
-  exec chezmoi apply "$@"
-}
-
-cmd_sync() {
-  cmd_apply "$@"
-}
-
-cmd_update() {
-  local src_dir
-  src_dir="$(resolve_source_dir)"
-  if [ -n "$src_dir" ] && [ -f "$src_dir/scripts/ops/chezmoi-update.sh" ]; then
-    exec bash "$src_dir/scripts/ops/chezmoi-update.sh" "$@"
-  fi
-  echo "Updating Dotfiles..."
-  exec chezmoi update "$@"
-}
-
-cmd_add() {
-  if [ -z "$1" ]; then
-    echo "Usage: dot add <file>"
-    echo ""
-    echo "Add a file to the chezmoi source directory."
-    echo "The file will be managed by chezmoi from now on."
-    exit 1
-  fi
-  exec chezmoi add "$@"
-}
-
-cmd_diff() {
-  local src_dir
-  src_dir="$(resolve_source_dir)"
-  if [ -n "$src_dir" ] && [ -f "$src_dir/scripts/ops/chezmoi-diff.sh" ]; then
-    exec bash "$src_dir/scripts/ops/chezmoi-diff.sh" "$@"
-  fi
-  exec chezmoi diff "$@"
-}
-
-cmd_status() {
-  exec chezmoi status "$@"
-}
-
-cmd_remove() {
-  run_script "scripts/ops/chezmoi-remove.sh" "Remove helper" "$@"
-}
-
-cmd_cd() {
-  local src_dir
-  src_dir="$(resolve_source_dir)"
-  if [ -n "$src_dir" ]; then
-    echo "$src_dir"
-  else
-    echo "Dotfiles source not found." >&2
-    exit 1
-  fi
-}
-
-cmd_edit() {
-  local src_dir
-  src_dir="$(require_source_dir)"
-  if [ -n "${EDITOR:-}" ]; then
-    exec "$EDITOR" "$src_dir"
-  elif has_command nvim; then
-    exec nvim "$src_dir"
-  elif has_command vim; then
-    exec vim "$src_dir"
-  else
-    echo "No editor found. Set \$EDITOR to open $src_dir."
-    exit 1
-  fi
-}
-
-# Dispatch
-case "${1:-}" in
-  apply)
-    shift
-    cmd_apply "$@"
-    ;;
-  sync)
-    shift
-    cmd_sync "$@"
-    ;;
-  update)
-    shift
-    cmd_update "$@"
-    ;;
-  add)
-    shift
-    cmd_add "$@"
-    ;;
-  diff)
-    shift
-    cmd_diff "$@"
-    ;;
-  status)
-    shift
-    cmd_status "$@"
-    ;;
-  remove)
-    shift
-    cmd_remove "$@"
-    ;;
-  cd)
-    shift
-    cmd_cd "$@"
-    ;;
-  edit)
-    shift
-    cmd_edit "$@"
-    ;;
-  *)
-    echo "Unknown core command: ${1:-}" >&2
-    exit 1
-    ;;
-esac