@sebastienrousseau/dotfiles 0.2.481 → 0.2.500

package/dot_config/dotfiles/agent-profiles.json

@@ -0,0 +1,92 @@
+{
+  "schemaVersion": "2026.03",
+  "defaultProfile": "ask",
+  "rbac": {
+    "roles": {
+      "viewer": {
+        "description": "Read-only access to configuration and status.",
+        "allowedProfiles": ["ask"],
+        "permissions": ["read", "status", "audit"]
+      },
+      "developer": {
+        "description": "Standard development workflow with bounded writes.",
+        "inherits": "viewer",
+        "allowedProfiles": ["ask", "plan", "apply"],
+        "permissions": ["read", "write", "status", "audit", "execute"]
+      },
+      "admin": {
+        "description": "Full access including fleet management and profile switching.",
+        "inherits": "developer",
+        "allowedProfiles": ["ask", "plan", "apply", "audit"],
+        "permissions": ["read", "write", "status", "audit", "execute", "fleet", "configure"]
+      }
+    },
+    "defaultRole": "developer",
+    "enforcement": "advisory"
+  },
+  "delegation": {
+    "enabled": false,
+    "maxDepth": 2,
+    "allowedDelegates": {
+      "security-reviewer": {
+        "profile": "audit",
+        "permissions": ["read", "audit"],
+        "maxSteps": 4,
+        "timeout": 120
+      },
+      "test-runner": {
+        "profile": "apply",
+        "permissions": ["read", "execute"],
+        "maxSteps": 6,
+        "timeout": 300
+      },
+      "lint-checker": {
+        "profile": "ask",
+        "permissions": ["read"],
+        "maxSteps": 2,
+        "timeout": 60
+      }
+    },
+    "securityPolicy": {
+      "requireParentApproval": true,
+      "logAllDelegations": true,
+      "maxConcurrentDelegates": 3
+    }
+  },
+  "profiles": {
+    "ask": {
+      "description": "Read-only guidance with no unattended changes.",
+      "approval": "manual",
+      "filesystem": "read-only",
+      "network": "off",
+      "mcpProfile": "strict-local",
+      "maxSteps": 1
+    },
+    "plan": {
+      "description": "Structured planning with local inspection and no writes.",
+      "approval": "manual",
+      "filesystem": "read-only",
+      "network": "limited",
+      "mcpProfile": "strict-local",
+      "maxSteps": 3
+    },
+    "apply": {
+      "description": "Bounded implementation with explicit approval and local policy guards.",
+      "approval": "on-request",
+      "filesystem": "workspace-write",
+      "network": "limited",
+      "mcpProfile": "strict-local",
+      "maxSteps": 6,
+      "canDelegate": true
+    },
+    "audit": {
+      "description": "Deep verification, scoring, and compliance analysis.",
+      "approval": "manual",
+      "filesystem": "read-only",
+      "network": "limited",
+      "mcpProfile": "enterprise-remote",
+      "maxSteps": 8,
+      "canDelegate": true
+    }
+  }
+}

package/dot_config/dotfiles/boot/README.md

@@ -8,4 +8,4 @@ Run:
 
 ---
 
-Made with ❤️ by [Sebastien Rousseau](https://github.com/sebastienrousseau)
+Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/dot_config/dotfiles/grub/README.md

@@ -8,4 +8,4 @@ Run:
 
 ---
 
-Made with ❤️ by [Sebastien Rousseau](https://github.com/sebastienrousseau)
+Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/dot_config/dotfiles/lock/README.md

@@ -8,4 +8,4 @@ Example:
 
 ---
 
-Made with ❤️ by [Sebastien Rousseau](https://github.com/sebastienrousseau)
+Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/dot_config/dotfiles/mcp-lock.json

@@ -0,0 +1,33 @@
+{
+  "lockVersion": "2026.03",
+  "profile": "strict-local",
+  "packages": {
+    "git": {
+      "command": "npx",
+      "package": "mcp-server-git@2026.3.0",
+      "source": "https://github.com/modelcontextprotocol/servers/releases/tag/2025.1.14",
+      "verification": {
+        "method": "tracked version pin",
+        "status": "approved"
+      }
+    },
+    "memory": {
+      "command": "npx",
+      "package": "@modelcontextprotocol/server-memory@2026.3.0",
+      "source": "https://www.npmjs.com/package/@modelcontextprotocol/server-memory",
+      "verification": {
+        "method": "tracked version pin",
+        "status": "approved"
+      }
+    },
+    "sqlite": {
+      "command": "npx",
+      "package": "mcp-server-sqlite@2026.3.0",
+      "source": "https://github.com/modelcontextprotocol/servers/releases/tag/2025.1.14",
+      "verification": {
+        "method": "tracked version pin",
+        "status": "approved"
+      }
+    }
+  }
+}

package/dot_config/dotfiles/mcp-policy.json

@@ -0,0 +1,52 @@
+{
+  "policyVersion": "2026.03",
+  "defaultProfile": "strict-local",
+  "profiles": {
+    "strict-local": {
+      "description": "Local-first MCP policy for regulated and high-trust environments.",
+      "allowedLaunchers": ["npx", "node", "uvx"],
+      "trustedTransports": ["stdio", "http"],
+      "authProfiles": ["none", "env-token"],
+      "blockedFilesystemRoots": ["/", "/home", "/Users"],
+      "blockedArgPatterns": ["^--allow-.*", "^--unsafe$", "^\\*$"],
+      "warnOnUnpinnedNpx": true,
+      "requireApprovedPackageLock": true,
+      "requireRegistryEntry": true,
+      "requireHttpsForHttpTransports": true,
+      "requireOauthForHttpTransports": true,
+      "requiredEnvByServer": {
+        "github": ["GITHUB_TOKEN"],
+        "brave-search": ["BRAVE_API_KEY"]
+      },
+      "forbidNetworkServersByDefault": [
+        "github",
+        "brave-search",
+        "fetch",
+        "puppeteer",
+        "filesystem"
+      ]
+    },
+    "enterprise-remote": {
+      "description": "Enterprise-ready MCP policy with registry-backed remote transports.",
+      "allowedLaunchers": ["npx", "node", "uvx"],
+      "trustedTransports": ["stdio", "http", "streamable-http"],
+      "authProfiles": ["none", "env-token", "oauth2", "sso"],
+      "streamableHttpConfig": {
+        "sessionTimeout": 3600,
+        "maxConcurrentSessions": 4
+      },
+      "blockedFilesystemRoots": ["/", "/home", "/Users"],
+      "blockedArgPatterns": ["^--allow-.*", "^--unsafe$", "^\\*$"],
+      "warnOnUnpinnedNpx": true,
+      "requireApprovedPackageLock": true,
+      "requireRegistryEntry": true,
+      "requireHttpsForHttpTransports": true,
+      "requireOauthForHttpTransports": true,
+      "requiredEnvByServer": {
+        "github": ["GITHUB_TOKEN"],
+        "brave-search": ["BRAVE_API_KEY"]
+      },
+      "forbidNetworkServersByDefault": []
+    }
+  }
+}

package/dot_config/dotfiles/mcp-registry.json

@@ -0,0 +1,47 @@
+{
+  "registryVersion": "2026.03",
+  "servers": {
+    "git": {
+      "transport": "stdio",
+      "launcher": "npx",
+      "package": "mcp-server-git@2026.3.0",
+      "auth": "env",
+      "authProfile": "env-token",
+      "scope": "repo-local",
+      "verification": "pinned-package"
+    },
+    "memory": {
+      "transport": "stdio",
+      "launcher": "npx",
+      "package": "@modelcontextprotocol/server-memory@2026.3.0",
+      "auth": "env",
+      "authProfile": "none",
+      "scope": "workspace-local",
+      "verification": "pinned-package"
+    },
+    "sqlite": {
+      "transport": "stdio",
+      "launcher": "npx",
+      "package": "mcp-server-sqlite@2026.3.0",
+      "auth": "env",
+      "authProfile": "none",
+      "scope": "workspace-local",
+      "verification": "pinned-package"
+    },
+    "example-remote": {
+      "transport": "streamable-http",
+      "url": "https://mcp.example.com/v1",
+      "headers": { "X-Org": "dotfiles" },
+      "auth": "oauth2",
+      "authProfile": "oauth2",
+      "authConfig": {
+        "provider": "https://auth.example.com",
+        "clientId": "${MCP_OAUTH_CLIENT_ID}",
+        "scopes": ["mcp:read", "mcp:write"]
+      },
+      "scope": "enterprise",
+      "verification": "registry-approved",
+      "enabled": false
+    }
+  }
+}

package/dot_config/dotfiles/model-registry.json

@@ -0,0 +1,20 @@
+{
+  "schemaVersion": "2026.03",
+  "defaultModel": "local-default",
+  "models": {
+    "local-default": {
+      "provider": "local",
+      "family": "workstation",
+      "intendedUse": "Local-first CLI assistance and bounded automation",
+      "changeControl": "signed-commit",
+      "riskLevel": "moderate"
+    },
+    "enterprise-audit": {
+      "provider": "remote",
+      "family": "audit",
+      "intendedUse": "Deep analysis with governed remote access",
+      "changeControl": "signed-commit-and-policy-review",
+      "riskLevel": "high"
+    }
+  }
+}

package/dot_config/dotfiles/policy-bundles.json

@@ -0,0 +1,38 @@
+{
+  "schemaVersion": "2026.03",
+  "defaultBundle": "developer",
+  "bundles": {
+    "developer": {
+      "description": "Local development with bounded agent execution and strict-local MCP.",
+      "agentProfile": "apply",
+      "mcpProfile": "strict-local",
+      "signingRequired": true,
+      "attestationRequired": true,
+      "networkPolicy": "limited"
+    },
+    "offline": {
+      "description": "Disconnected local work with no remote MCP transport and no networked agents.",
+      "agentProfile": "ask",
+      "mcpProfile": "strict-local",
+      "signingRequired": true,
+      "attestationRequired": true,
+      "networkPolicy": "off"
+    },
+    "regulated": {
+      "description": "High-trust profile for controlled environments with explicit approvals and evidence export.",
+      "agentProfile": "audit",
+      "mcpProfile": "strict-local",
+      "signingRequired": true,
+      "attestationRequired": true,
+      "networkPolicy": "limited"
+    },
+    "enterprise": {
+      "description": "Enterprise remote profile with registry-backed MCP and governed audit posture.",
+      "agentProfile": "audit",
+      "mcpProfile": "enterprise-remote",
+      "signingRequired": true,
+      "attestationRequired": true,
+      "networkPolicy": "limited"
+    }
+  }
+}

package/dot_config/dotfiles/prompt-registry.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "2026.03",
+  "defaultPromptSet": "core",
+  "promptSets": {
+    "core": {
+      "description": "General workstation guidance and bounded implementation prompts.",
+      "changeControl": "signed-commit",
+      "reviewRequired": true
+    },
+    "regulated-audit": {
+      "description": "Compliance and high-trust audit prompts with stricter review expectations.",
+      "changeControl": "signed-commit-and-policy-review",
+      "reviewRequired": true
+    }
+  }
+}

package/dot_config/dotfiles/versions.env

@@ -0,0 +1,18 @@
+# Version pins for provisioned tools (Linux).
+# Override by editing this file or exporting env vars before running.
+STARSHIP_TAG="v1.24.2"
+ZOXIDE_TAG="0.9.9"
+NEOVIM_TAG="v0.11.6"
+LAZYGIT_TAG="v0.60.0"
+ATUIN_TAG="v18.13.3"
+ZELLIJ_TAG="v0.43.1"
+UV_TAG="0.10.12"
+
+# Update & runtime tooling
+TOPGRADE_TAG="v17.1.0"
+MISE_TAG="v2026.3.8"
+YAZI_TAG="v26.1.22"
+
+# AI CLI Tools
+MODS_TAG="v1.8.1"
+

package/dot_config/environment.d/50-ssh-agent.conf

@@ -0,0 +1,2 @@
+# SSH agent — point all sessions at the systemd-managed agent socket
+SSH_AUTH_SOCK=${XDG_RUNTIME_DIR}/ssh-agent.socket

package/dot_config/environment.d/90-wayland.conf

@@ -0,0 +1,19 @@
+# Wayland session environment variables
+ELECTRON_OZONE_PLATFORM_HINT=auto
+TERMINAL=ghostty
+
+# Qt Wayland support
+QT_QPA_PLATFORM=wayland
+QT_QPA_PLATFORMTHEME=gtk3
+
+# Firefox native Wayland
+MOZ_ENABLE_WAYLAND=1
+
+# SDL Wayland support
+SDL_VIDEODRIVER=wayland
+
+# Java AWT fix (JetBrains IDEs, Ghidra)
+_JAVA_AWT_WM_NONREPARENTING=1
+
+# DMS icon theme
+QS_ICON_THEME=Papirus-Dark

package/dot_config/firefox/user.js.tmpl

@@ -0,0 +1,58 @@
+// Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+// Firefox privacy and performance hardening
+// Apply by symlinking to ~/.mozilla/firefox/<profile>/user.js
+
+/* global user_pref */
+
+{{- $t := index .themes .theme -}}
+
+// Disable telemetry
+user_pref("toolkit.telemetry.enabled", false);
+user_pref("toolkit.telemetry.unified", false);
+user_pref("toolkit.telemetry.archive.enabled", false);
+user_pref("datareporting.healthreport.uploadEnabled", false);
+user_pref("datareporting.policy.dataSubmissionEnabled", false);
+user_pref("browser.ping-centre.telemetry", false);
+user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
+user_pref("browser.newtabpage.activity-stream.telemetry", false);
+
+// Disable Pocket
+user_pref("extensions.pocket.enabled", false);
+
+// Disable prefetching
+user_pref("network.prefetch-next", false);
+user_pref("network.dns.disablePrefetch", true);
+user_pref("network.predictor.enabled", false);
+
+// Enable HTTPS-Only
+user_pref("dom.security.https_only_mode", true);
+user_pref("dom.security.https_only_mode_ever_enabled", true);
+
+// Disable form autofill
+user_pref("extensions.formautofill.addresses.enabled", false);
+user_pref("extensions.formautofill.creditCards.enabled", false);
+
+// Enhanced tracking protection
+user_pref("browser.contentblocking.category", "strict");
+user_pref("privacy.trackingprotection.enabled", true);
+user_pref("privacy.trackingprotection.socialtracking.enabled", true);
+
+// DNS over HTTPS
+user_pref("network.trr.mode", 2);
+user_pref("network.trr.uri", "https://mozilla.cloudflare-dns.com/dns-query");
+
+// Disable WebRTC IP leak
+user_pref("media.peerconnection.ice.default_address_only", true);
+
+// Performance
+user_pref("gfx.webrender.all", true);
+user_pref("layers.acceleration.force-enabled", true);
+user_pref("layout.css.backdrop-filter.enabled", true);
+
+// Theme coordination
+// 0 = dark, 1 = light
+user_pref("layout.css.prefers-color-scheme.content-override", {{ if eq $t.mode "light" }}1{{ else }}0{{ end }});
+
+// UI
+user_pref("browser.uidensity", 1);
+user_pref("browser.compactmode.show", true);

package/dot_config/fish/completions/dot-theme-sync.fish.tmpl

@@ -0,0 +1,9 @@
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Completions for dot-theme-sync
+
+# Complete with theme names from themes.toml
+complete -c dot-theme-sync -f -a "{{- range $name, $_ := .themes }}{{ $name }} {{ end }}"
+
+# Complete with flags
+complete -c dot-theme-sync -l help -s h -d "Show help"
+complete -c dot-theme-sync -l full -d "Full chezmoi apply + reload"

package/dot_config/fish/completions/dot.fish.tmpl

@@ -0,0 +1,115 @@
+# Fish completion for 'dot' CLI
+# 🅳🅾🆃🅵🅸🅻🅴🆂 (v{{ .dotfiles_version }})
+
+# Disable file completions for subcommands
+complete -c dot -f
+
+# Core Commands
+complete -c dot -n "__fish_use_subcommand" -a apply -d "Apply dotfiles configuration"
+complete -c dot -n "__fish_use_subcommand" -a sync -d "Alias of apply"
+complete -c dot -n "__fish_use_subcommand" -a update -d "Pull latest changes and apply"
+complete -c dot -n "__fish_use_subcommand" -a clean-cache -d "Clear shell initialization caches"
+complete -c dot -n "__fish_use_subcommand" -a prewarm -d "Regenerate shell caches for ultra-fast startup"
+complete -c dot -n "__fish_use_subcommand" -a cl -d "Claude CLI with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a copilot -d "GitHub Copilot CLI with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a gemini -d "Gemini CLI with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a kiro -d "Kiro CLI with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a sgpt -d "Shell-GPT with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a ollama -d "Ollama with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a opencode -d "OpenCode with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a aider -d "Aider with context patterns"
+complete -c dot -n "__fish_use_subcommand" -a add -d "Add a file to chezmoi source"
+
+# AI Pattern completions for AI CLIs
+for cmd in cl copilot gemini kiro sgpt ollama opencode aider
+    complete -c dot -n "__fish_seen_subcommand_from $cmd" -s p -l pattern -x -a "(ls -1 ~/.config/ai/patterns 2>/dev/null | sed 's/\.md\$//')"
+end
+complete -c dot -n "__fish_use_subcommand" -a diff -d "Show chezmoi diff with exclusions"
+complete -c dot -n "__fish_use_subcommand" -a status -d "Show configuration drift"
+complete -c dot -n "__fish_use_subcommand" -a remove -d "Safely remove a managed file"
+complete -c dot -n "__fish_use_subcommand" -a cd -d "Print source directory path"
+complete -c dot -n "__fish_use_subcommand" -a edit -d "Open chezmoi source in $EDITOR"
+complete -c dot -n "__fish_use_subcommand" -a patterns -d "Manage AI steering patterns"
+complete -c dot -n "__fish_use_subcommand" -a commit -d "AI-powered conventional commit"
+
+# Diagnostics
+complete -c dot -n "__fish_use_subcommand" -a doctor -d "Check system health and configuration"
+complete -c dot -n "__fish_use_subcommand" -a heal -d "Auto-repair common dotfiles issues"
+complete -c dot -n "__fish_use_subcommand" -a health -d "Run comprehensive health check"
+complete -c dot -n "__fish_use_subcommand" -a smoke-test -d "Run automated toolchain verification"
+complete -c dot -n "__fish_use_subcommand" -a chaos -d "Simulate config corruption"
+complete -c dot -n "__fish_use_subcommand" -a scorecard -d "Show the unified scorecard"
+complete -c dot -n "__fish_use_subcommand" -a security-score -d "Score workstation security"
+complete -c dot -n "__fish_use_subcommand" -a drift -d "Drift dashboard"
+complete -c dot -n "__fish_use_subcommand" -a history -d "Shell history analysis"
+complete -c dot -n "__fish_use_subcommand" -a benchmark -d "Run shell startup benchmark"
+complete -c dot -n "__fish_use_subcommand" -a perf -d "Show current performance mode"
+complete -c dot -n "__fish_use_subcommand" -a snapshot -d "Capture workstation state"
+complete -c dot -n "__fish_use_subcommand" -a verify -d "Run verification checks"
+complete -c dot -n "__fish_use_subcommand" -a restore -d "Restore from backup or git ref"
+complete -c dot -n "__fish_use_subcommand" -a ai -d "Show AI helper status"
+complete -c dot -n "__fish_use_subcommand" -a ai-setup -d "Interactive setup for all AI CLI tools"
+complete -c dot -n "__fish_use_subcommand" -a ai-query -d "Context-aware RAG query over your dotfiles"
+complete -c dot -n "__fish_use_subcommand" -a attest -d "Export workstation attestation evidence"
+complete -c dot -n "__fish_use_subcommand" -a lint -d "Lint shell scripts"
+
+# Tools
+complete -c dot -n "__fish_use_subcommand" -a tools -d "Show or install nix packages"
+complete -c dot -n "__fish_use_subcommand" -a new -d "Create a new project from a template"
+complete -c dot -n "__fish_use_subcommand" -a sandbox -d "Launch a safe sandbox preview"
+complete -c dot -n "__fish_use_subcommand" -a keys -d "Show keybindings catalog"
+complete -c dot -n "__fish_use_subcommand" -a learn -d "Interactive tour"
+complete -c dot -n "__fish_use_subcommand" -a docs -d "Show repo README"
+complete -c dot -n "__fish_use_subcommand" -a env -d "Show managed tool versions"
+complete -c dot -n "__fish_use_subcommand" -a profile -d "Show or switch configuration profile"
+
+# Appearance
+complete -c dot -n "__fish_use_subcommand" -a theme -d "Switch terminal theme (dark/light)"
+complete -c dot -n "__fish_use_subcommand" -a wallpaper -d "Apply a wallpaper"
+complete -c dot -n "__fish_use_subcommand" -a fonts -d "Install Nerd Fonts"
+
+# Secrets & Security
+complete -c dot -n "__fish_use_subcommand" -a secrets-init -d "Initialize age key for secrets"
+complete -c dot -n "__fish_use_subcommand" -a secrets -d "Edit encrypted secrets"
+complete -c dot -n "__fish_use_subcommand" -a bundle -d "Create offline archive"
+complete -c dot -n "__fish_use_subcommand" -a upgrade -d "Update flake, plugins, and dotfiles"
+complete -c dot -n "__fish_use_subcommand" -a mcp -d "Inspect MCP policy and registry"
+complete -c dot -n "__fish_use_subcommand" -a mode -d "Show or set the agent profile"
+complete -c dot -n "__fish_use_subcommand" -a agent -d "Show agent metadata and logs"
+complete -c dot -n "__fish_use_subcommand" -a search -d "Find commands by keyword"
+
+# Meta
+complete -c dot -n "__fish_use_subcommand" -a "version --version" -d "Show version"
+complete -c dot -n "__fish_use_subcommand" -a help -d "Show help"
+
+# Focused command flags
+complete -c dot -n "__fish_seen_subcommand_from doctor" -s H -l heal -d "Auto-repair common issues"
+complete -c dot -n "__fish_seen_subcommand_from doctor" -s s -l score -d "Show score output"
+complete -c dot -n "__fish_seen_subcommand_from doctor" -s j -l json -d "Emit JSON summary"
+complete -c dot -n "__fish_seen_subcommand_from doctor" -s A -l ai -d "Include AI diagnostics"
+complete -c dot -n "__fish_seen_subcommand_from attest" -s j -l json -d "Emit JSON output"
+complete -c dot -n "__fish_seen_subcommand_from attest" -s w -l write -r -d "Write attestation to a file"
+complete -c dot -n "__fish_seen_subcommand_from lint" -s c -l check -d "Run check-only mode"
+complete -c dot -n "__fish_seen_subcommand_from lint" -s f -l fix -d "Apply safe fixes"
+complete -c dot -n "__fish_seen_subcommand_from mcp" -s s -l strict -d "Treat policy warnings as errors"
+complete -c dot -n "__fish_seen_subcommand_from mcp" -s j -l json -d "Emit JSON summary"
+complete -c dot -n "__fish_seen_subcommand_from mcp" -a registry -d "Show the MCP registry"
+complete -c dot -n "__fish_seen_subcommand_from health" -s v -l verbose -d "Show detailed checks"
+complete -c dot -n "__fish_seen_subcommand_from health" -s j -l json -d "Emit JSON summary"
+complete -c dot -n "__fish_seen_subcommand_from health" -s f -l fix -d "Apply common fixes"
+complete -c dot -n "__fish_seen_subcommand_from health" -s F -l force -d "Apply fixes without prompts"
+complete -c dot -n "__fish_seen_subcommand_from perf" -s j -l json -d "Emit JSON timing data"
+complete -c dot -n "__fish_seen_subcommand_from perf" -s p -l profile -d "Include profile output"
+complete -c dot -n "__fish_seen_subcommand_from perf" -s r -l runs -x -d "Set the number of runs"
+complete -c dot -n "__fish_seen_subcommand_from perf" -s t -l target -x -d "Set the timing target in milliseconds"
+complete -c dot -n "__fish_seen_subcommand_from security-score" -s v -l verbose -d "Show detailed scoring"
+complete -c dot -n "__fish_seen_subcommand_from security-score" -s q -l quiet -d "Reduce output noise"
+complete -c dot -n "__fish_seen_subcommand_from security-score" -s j -l json -d "Emit JSON summary"
+complete -c dot -n "__fish_seen_subcommand_from snapshot" -s b -l baseline -d "Capture the baseline snapshot"
+complete -c dot -n "__fish_seen_subcommand_from snapshot" -s f -l force -d "Overwrite an existing snapshot"
+complete -c dot -n "__fish_seen_subcommand_from verify" -s s -l security -d "Run security verification"
+complete -c dot -n "__fish_seen_subcommand_from restore" -s l -l list -d "List available backups"
+complete -c dot -n "__fish_seen_subcommand_from restore" -s L -l latest -d "Restore the latest backup"
+complete -c dot -n "__fish_seen_subcommand_from restore" -s g -l git -x -d "Restore from a git ref"
+complete -c dot -n "__fish_seen_subcommand_from restore" -s d -l diff -x -d "Show a diff for a git ref"
+complete -c dot -n "__fish_seen_subcommand_from restore" -s n -l dry-run -d "Preview the restore"

package/dot_config/fish/conf.d/000-perf-cache.fish

@@ -0,0 +1,56 @@
+# Startup performance cache
+# Loaded before vendor conf.d — intercepts slow commands with cached results.
+
+# Fast fish_add_path replacement — builtins only, no argparse overhead.
+# Shadows the standard fish_add_path function (autoloaded from /usr/share/fish/).
+# Handles the common calling conventions used by vendor conf.d scripts.
+function fish_add_path
+    set -l append false
+    set -l paths
+    for arg in $argv
+        switch $arg
+            case --append -a
+                set append true
+            case --global --path -g -p -P -U
+                # Accepted and ignored — we always use global scope + PATH
+            case '--*' '-*'
+                # Ignore unknown flags
+            case '*'
+                set -a paths $arg
+        end
+    end
+    for p in $paths
+        if not contains -- $p $PATH
+            if $append
+                set -g --append PATH $p
+            else
+                set -g --prepend PATH $p
+            end
+        end
+    end
+end
+
+# Cache flatpak --installations (saves ~11ms per startup).
+# The vendor /usr/share/fish/vendor_conf.d/flatpak.fish calls this on every
+# shell start. We wrap it so only the first call after cache expiry is slow.
+# Cache is refreshed by `dot prewarm` or manually:
+#   command flatpak --installations > ~/.cache/fish/flatpak-installations
+if type -q flatpak
+    function flatpak --wraps flatpak
+        if test (count $argv) -eq 1; and test "$argv[1]" = --installations
+            set -l cache "$HOME/.cache/fish/flatpak-installations"
+            if test -f "$cache"
+                while read -l line
+                    echo $line
+                end <"$cache"
+                return 0
+            end
+            mkdir -p "$HOME/.cache/fish"
+            command flatpak --installations 2>/dev/null | tee "$cache"
+            return 0
+        end
+        command flatpak $argv
+    end
+end
+
+status is-interactive; or return