@sebastienrousseau/dotfiles 0.2.481 → 0.2.500

package/scripts/diagnostics/security-score.sh

@@ -1,19 +1,41 @@
 #!/usr/bin/env bash
-# Security Score Assessment
-# Usage: dot security-score [--verbose|-v] [--json]
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Security Score Assessment.
+##
+## Evaluates system security posture across encryption, SSH, Git, system
+## hardening, and secrets management. Returns a letter grade (A+ to F) with
+## actionable recommendations.
+##
+## # Usage
+## dot security-score [--verbose|-v] [--json|-j] [--quiet|-q]
+##
+## # Dependencies
+## - age: Encryption tool check
+## - sops: Secrets manager check
+## - gpg: Key management check
+## - git: Commit signing verification
+##
+## # Platform Notes
+## - macOS: Checks socketfilterfw, FileVault, Little Snitch
+## - Linux: Checks ufw/firewalld, LUKS encryption
+## - WSL: Checks host encryption, virtualization detection
+##
+## # Security
+## Does not modify system state. Read-only checks only.
+##
+## # Idempotency
+## Safe to run repeatedly. No side effects.
 
 set -euo pipefail
+set +o xtrace 2>/dev/null || true
 
-# Colors
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-CYAN='\033[0;36m'
-NC='\033[0m'
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
 
 # Parse arguments
-VERBOSE=false
+VERBOSE=true
 JSON_OUTPUT=false
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -21,7 +43,11 @@ while [[ $# -gt 0 ]]; do
       VERBOSE=true
       shift
       ;;
-    --json)
+    --quiet | -q)
+      VERBOSE=false
+      shift
+      ;;
+    --json | -j)
       JSON_OUTPUT=true
       shift
       ;;
@@ -29,6 +55,12 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
+ui_init
+NC="${NORMAL}"
+RED="${RED:-}"
+GREEN="${GREEN:-}"
+YELLOW="${YELLOW:-}"
+
 # Scoring
 TOTAL_POINTS=0
 MAX_POINTS=0
@@ -39,7 +71,6 @@ add_points() {
   local points="$2"
   local max="$3"
   local description="$4"
-  # $5 is status (pass/fail/partial) - used for icon selection below
 
   TOTAL_POINTS=$((TOTAL_POINTS + points))
   MAX_POINTS=$((MAX_POINTS + max))
@@ -47,29 +78,42 @@ add_points() {
 
   if ! $JSON_OUTPUT && $VERBOSE; then
     local icon
+    local color=""
     if [[ $points -eq $max ]]; then
-      icon="${GREEN}✓${NC}"
+      icon="✓"
+      color="$GREEN"
     elif [[ $points -gt 0 ]]; then
-      icon="${YELLOW}◐${NC}"
+      icon="◐"
+      color="$YELLOW"
+    else
+      icon="✗"
+      color="$RED"
+    fi
+
+    if [[ "$UI_ENABLED" = "1" ]]; then
+      ui_status "$icon" "[OK]" "$description" "$points/$max pts" "$color"
     else
-      icon="${RED}✗${NC}"
+      ui_bullet "$description ($points/$max pts)"
     fi
-    printf "  $icon %-40s %d/%d pts\n" "$description" "$points" "$max"
   fi
 }
 
 print_header() {
   if ! $JSON_OUTPUT; then
-    echo -e "\n${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-    echo -e "${CYAN}  Security Score Assessment${NC}"
-    echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}\n"
+    echo ""
+    ui_dot_banner "Diagnostics"
+    ui_header "Security Score Assessment"
+    echo ""
   fi
 }
 
 section() {
   if ! $JSON_OUTPUT; then
-    echo -e "\n${BLUE}▸ $1${NC}"
-    echo "───────────────────────────────────────────────"
+    echo ""
+    ui_section "$1"
+    if [[ "$UI_ENABLED" != "1" ]]; then
+      echo "───────────────────────────────────────────────"
+    fi
   fi
 }
 
@@ -80,41 +124,41 @@ check_encryption() {
 
   # Age encryption tool
   if command -v age >/dev/null 2>&1; then
-    add_points "encryption" 5 5 "Age encryption installed" "pass"
+    add_points "encryption" 5 5 "Age encryption installed"
   else
-    add_points "encryption" 0 5 "Age encryption installed" "fail"
+    add_points "encryption" 0 5 "Age encryption installed"
   fi
 
   # Age key exists
   if [[ -f "${HOME}/.config/chezmoi/key.txt" ]]; then
-    add_points "encryption" 5 5 "Age encryption key present" "pass"
+    add_points "encryption" 5 5 "Age encryption key present"
 
     # Check key permissions
     local perms
     perms=$(stat -c "%a" "${HOME}/.config/chezmoi/key.txt" 2>/dev/null || stat -f "%OLp" "${HOME}/.config/chezmoi/key.txt" 2>/dev/null)
     if [[ "$perms" == "600" ]]; then
-      add_points "encryption" 5 5 "Key file permissions (600)" "pass"
+      add_points "encryption" 5 5 "Key file permissions (600)"
     else
-      add_points "encryption" 2 5 "Key file permissions (600)" "partial"
+      add_points "encryption" 2 5 "Key file permissions (600)"
     fi
   else
-    add_points "encryption" 0 10 "Age encryption configured" "fail"
+    add_points "encryption" 0 10 "Age encryption configured"
   fi
 
   # SOPS available
   if command -v sops >/dev/null 2>&1; then
-    add_points "encryption" 5 5 "SOPS secrets manager" "pass"
+    add_points "encryption" 5 5 "SOPS secrets manager"
   else
-    add_points "encryption" 0 5 "SOPS secrets manager" "fail"
+    add_points "encryption" 0 5 "SOPS secrets manager"
   fi
 
   # GPG available
   if command -v gpg >/dev/null 2>&1 && gpg --list-secret-keys 2>/dev/null | grep -q sec; then
-    add_points "encryption" 10 10 "GPG keys configured" "pass"
+    add_points "encryption" 10 10 "GPG keys configured"
   elif command -v gpg >/dev/null 2>&1; then
-    add_points "encryption" 3 10 "GPG keys configured" "partial"
+    add_points "encryption" 3 10 "GPG keys configured"
   else
-    add_points "encryption" 0 10 "GPG keys configured" "fail"
+    add_points "encryption" 0 10 "GPG keys configured"
   fi
 }
 
@@ -126,35 +170,35 @@ check_ssh() {
     local ssh_perms
     ssh_perms=$(stat -c "%a" "${HOME}/.ssh" 2>/dev/null || stat -f "%OLp" "${HOME}/.ssh" 2>/dev/null)
     if [[ "$ssh_perms" == "700" ]]; then
-      add_points "ssh" 5 5 "SSH directory permissions (700)" "pass"
+      add_points "ssh" 5 5 "SSH directory permissions (700)"
     else
-      add_points "ssh" 2 5 "SSH directory permissions (700)" "partial"
+      add_points "ssh" 2 5 "SSH directory permissions (700)"
     fi
   else
-    add_points "ssh" 0 5 "SSH directory exists" "fail"
+    add_points "ssh" 0 5 "SSH directory exists"
   fi
 
   # ED25519 key (preferred over RSA)
   if [[ -f "${HOME}/.ssh/id_ed25519" ]]; then
-    add_points "ssh" 10 10 "ED25519 SSH key (modern)" "pass"
+    add_points "ssh" 10 10 "ED25519 SSH key (modern)"
   elif [[ -f "${HOME}/.ssh/id_rsa" ]]; then
-    add_points "ssh" 5 10 "SSH key present (RSA)" "partial"
+    add_points "ssh" 5 10 "SSH key present (RSA)"
   else
-    add_points "ssh" 0 10 "SSH key present" "fail"
+    add_points "ssh" 0 10 "SSH key present"
   fi
 
   # SSH agent
   if [[ -n "${SSH_AUTH_SOCK:-}" ]] || pgrep -x ssh-agent >/dev/null 2>&1; then
-    add_points "ssh" 5 5 "SSH agent running" "pass"
+    add_points "ssh" 5 5 "SSH agent running"
   else
-    add_points "ssh" 0 5 "SSH agent running" "fail"
+    add_points "ssh" 0 5 "SSH agent running"
   fi
 
   # SSH config exists
   if [[ -f "${HOME}/.ssh/config" ]]; then
-    add_points "ssh" 5 5 "SSH config present" "pass"
+    add_points "ssh" 5 5 "SSH config present"
   else
-    add_points "ssh" 2 5 "SSH config present" "partial"
+    add_points "ssh" 2 5 "SSH config present"
   fi
 }
 
@@ -163,29 +207,29 @@ check_git() {
 
   # Git installed
   if ! command -v git >/dev/null 2>&1; then
-    add_points "git" 0 20 "Git installed" "fail"
+    add_points "git" 0 20 "Git installed"
     return
   fi
 
   # Commit signing
   if git config --global commit.gpgsign 2>/dev/null | grep -q true; then
-    add_points "git" 10 10 "Commit signing enabled" "pass"
+    add_points "git" 10 10 "Commit signing enabled"
   else
-    add_points "git" 0 10 "Commit signing enabled" "fail"
+    add_points "git" 0 10 "Commit signing enabled"
   fi
 
   # User identity configured
   if git config --global user.email >/dev/null 2>&1 && git config --global user.name >/dev/null 2>&1; then
-    add_points "git" 5 5 "Git identity configured" "pass"
+    add_points "git" 5 5 "Git identity configured"
   else
-    add_points "git" 0 5 "Git identity configured" "fail"
+    add_points "git" 0 5 "Git identity configured"
   fi
 
   # Credential helper
   if git config --global credential.helper >/dev/null 2>&1; then
-    add_points "git" 5 5 "Credential helper configured" "pass"
+    add_points "git" 5 5 "Credential helper configured"
   else
-    add_points "git" 0 5 "Credential helper configured" "fail"
+    add_points "git" 0 5 "Credential helper configured"
   fi
 }
 
@@ -195,9 +239,11 @@ check_system() {
   # Firewall (macOS or Linux)
   if [[ "$(uname)" == "Darwin" ]]; then
     if /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null | grep -q enabled; then
-      add_points "system" 5 5 "Firewall enabled" "pass"
+      add_points "system" 5 5 "Firewall enabled"
+    elif pgrep -x "Little Snitch" >/dev/null 2>&1 || [[ -d "/Applications/Little Snitch.app" ]]; then
+      add_points "system" 5 5 "Firewall enabled (Little Snitch)"
     else
-      add_points "system" 0 5 "Firewall enabled" "fail"
+      add_points "system" 0 5 "Firewall enabled"
     fi
   else
     # Check ufw via systemctl (doesn't need sudo) or sudo ufw status
@@ -211,41 +257,41 @@ check_system() {
     fi
 
     if $fw_enabled; then
-      add_points "system" 5 5 "Firewall enabled" "pass"
+      add_points "system" 5 5 "Firewall enabled"
     else
-      add_points "system" 0 5 "Firewall enabled" "fail"
+      add_points "system" 0 5 "Firewall enabled"
     fi
   fi
 
   # Disk encryption (LUKS, FileVault, or ecryptfs)
   if [[ "$(uname)" == "Darwin" ]]; then
     if fdesetup status 2>/dev/null | grep -q "FileVault is On"; then
-      add_points "system" 10 10 "Disk encryption (FileVault)" "pass"
+      add_points "system" 10 10 "Disk encryption (FileVault)"
     else
-      add_points "system" 0 10 "Disk encryption (FileVault)" "fail"
+      add_points "system" 0 10 "Disk encryption (FileVault)"
     fi
   else
     local encryption_found=false
     # Check LUKS
     if lsblk 2>/dev/null | grep -q crypt || [[ -d /sys/block/dm-0 ]]; then
       encryption_found=true
-      add_points "system" 10 10 "Disk encryption (LUKS)" "pass"
+      add_points "system" 10 10 "Disk encryption (LUKS)"
     # Check Apple T2 chip (hardware SSD encryption)
     elif lspci 2>/dev/null | grep -qi "T2.*Secure Enclave"; then
       encryption_found=true
-      add_points "system" 10 10 "Hardware encryption (Apple T2)" "pass"
+      add_points "system" 10 10 "Hardware encryption (Apple T2)"
     # Check ecryptfs (encrypted home)
     elif mount 2>/dev/null | grep -q ecryptfs || [[ -d "$HOME/.ecryptfs" ]]; then
       encryption_found=true
-      add_points "system" 10 10 "Home encryption (ecryptfs)" "pass"
+      add_points "system" 10 10 "Home encryption (ecryptfs)"
     # Check if running in encrypted VM/container
     elif [[ -f /sys/class/dmi/id/product_name ]] && grep -qiE "virtual|vmware|kvm|qemu" /sys/class/dmi/id/product_name 2>/dev/null; then
       encryption_found=true
-      add_points "system" 10 10 "Virtualized (host encryption)" "pass"
+      add_points "system" 10 10 "Virtualized (host encryption)"
     fi
 
     if ! $encryption_found; then
-      add_points "system" 0 10 "Disk encryption" "unknown"
+      add_points "system" 0 10 "Disk encryption"
     fi
   fi
 }
@@ -256,25 +302,29 @@ check_secrets() {
   # No secrets in dotfiles repo
   if [[ -d "${HOME}/.dotfiles" ]]; then
     local secrets_found=false
-    # Check for common secret patterns
-    if grep -rE "(api_key|api_secret|password|token)\\s*=\\s*['\"][^'\"]+['\"]" "${HOME}/.dotfiles" --include="*.sh" --include="*.zsh" --include="*.toml" 2>/dev/null | grep -v "example\|template\|placeholder" | head -1; then
+    local match=""
+    # Check for common secret patterns, ignore templates/placeholders and variable expansions.
+    match=$(grep -rE "(api_key|api_secret|password|token)[[:space:]]*=[[:space:]]*['\"][^'\"]+['\"]" \
+      "${HOME}/.dotfiles" --include="*.sh" --include="*.zsh" --include="*.toml" 2>/dev/null |
+      grep -v "example\\|template\\|placeholder" | grep -F -v "\${" | head -1 || true)
+    if [[ -n "$match" ]]; then
       secrets_found=true
     fi
 
     if $secrets_found; then
-      add_points "secrets" 0 5 "No hardcoded secrets" "fail"
+      add_points "secrets" 0 5 "No hardcoded secrets"
     else
-      add_points "secrets" 5 5 "No hardcoded secrets" "pass"
+      add_points "secrets" 5 5 "No hardcoded secrets"
     fi
   else
-    add_points "secrets" 5 5 "No hardcoded secrets" "pass"
+    add_points "secrets" 5 5 "No hardcoded secrets"
   fi
 
   # Environment variables for secrets
   if [[ -f "${HOME}/.config/secrets/api-keys.env" ]] || [[ -d "${HOME}/.config/secrets" ]]; then
-    add_points "secrets" 5 5 "Secrets in dedicated location" "pass"
+    add_points "secrets" 5 5 "Secrets in dedicated location"
   else
-    add_points "secrets" 2 5 "Secrets management setup" "partial"
+    add_points "secrets" 2 5 "Secrets management setup"
   fi
 }
 
@@ -300,16 +350,20 @@ print_summary() {
     return
   fi
 
-  echo -e "\n${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-  echo -e "${CYAN}  Security Score${NC}"
-  echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}\n"
+  echo ""
+  ui_header "Security Score"
+  echo ""
 
-  # Score bar
-  local bar_width=30
+  local bar_width=28
   local filled=$((score * bar_width / 100))
   local empty=$((bar_width - filled))
+  local block="#"
+  local pad="-"
 
-  printf "  Score: ["
+  local grade
+  grade=$(get_grade $score)
+
+  printf "  Score: "
   if [[ $score -ge 80 ]]; then
     printf '%s' "${GREEN}"
   elif [[ $score -ge 60 ]]; then
@@ -317,39 +371,28 @@ print_summary() {
   else
     printf '%s' "${RED}"
   fi
-  printf "%${filled}s" | tr ' ' '█'
+  printf "%${filled}s" | tr ' ' "$block"
   printf '%s' "${NC}"
-  printf "%${empty}s" | tr ' ' '░'
-  printf "] "
-
-  # Grade
-  local grade
-  grade=$(get_grade $score)
-  case "$grade" in
-    A*) echo -e "${GREEN}${score}%  Grade: ${grade}${NC}" ;;
-    B*) echo -e "${GREEN}${score}%  Grade: ${grade}${NC}" ;;
-    C*) echo -e "${YELLOW}${score}%  Grade: ${grade}${NC}" ;;
-    *) echo -e "${RED}${score}%  Grade: ${grade}${NC}" ;;
-  esac
+  printf "%${empty}s" | tr ' ' "$pad"
+  printf " %s%%  Grade: %s\n" "${score}" "${grade}"
 
-  echo -e "\n  Points: ${TOTAL_POINTS}/${MAX_POINTS}"
+  printf '%b\n' "\n  Points: ${TOTAL_POINTS}/${MAX_POINTS}"
   echo ""
 
   # Recommendations
   if [[ $score -lt 100 ]]; then
-    echo -e "${BLUE}Recommendations:${NC}"
-
+    ui_header "Recommendations"
     if ! command -v age >/dev/null 2>&1; then
-      echo "  • Install age for encryption: brew install age"
+      ui_bullet "Install age for encryption: brew install age"
     fi
     if ! command -v sops >/dev/null 2>&1; then
-      echo "  • Install SOPS for secrets: brew install sops"
+      ui_bullet "Install SOPS for secrets: brew install sops"
     fi
     if ! git config --global commit.gpgsign 2>/dev/null | grep -q true; then
-      echo "  • Enable commit signing: git config --global commit.gpgsign true"
+      ui_bullet "Enable commit signing: git config --global commit.gpgsign true"
     fi
     if [[ ! -f "${HOME}/.ssh/id_ed25519" ]]; then
-      echo "  • Generate ED25519 SSH key: ssh-keygen -t ed25519"
+      ui_bullet "Generate ED25519 SSH key: ssh-keygen -t ed25519"
     fi
     echo ""
   fi
@@ -383,6 +426,9 @@ get_grade() {
 }
 
 # Main
+export LANG="${LANG:-en_US.UTF-8}"
+export LC_ALL="${LC_ALL:-en_US.UTF-8}"
+
 print_header
 check_encryption
 check_ssh

package/scripts/diagnostics/smoke-test.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Smoke tests to quickly verify toolchain health after installation/updates.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+ui_init
+
+ui_header "Dotfiles Smoke Tests"
+
+declare -i passed=0
+declare -i failed=0
+
+check_cmd() {
+  local cmd="$1"
+  if command -v "$cmd" >/dev/null 2>&1; then
+    return 0
+  fi
+  if command -v mise >/dev/null 2>&1; then
+    if mise ls --installed 2>/dev/null | grep -qE "($cmd|aqua:.*$cmd)"; then
+      return 0
+    fi
+  fi
+  return 1
+}
+
+verify_cmd() {
+  local cmd="$1"
+  local expected_output="${2:-}"
+
+  if ! check_cmd "$cmd"; then
+    ui_err "$cmd" "not found"
+    failed+=1
+    return 1
+  fi
+
+  if [[ -n "$expected_output" ]]; then
+    local output
+    # shellcheck disable=SC2015
+    output=$($cmd --version 2>&1 || $cmd version 2>&1 || true)
+    if echo "$output" | grep -q "$expected_output"; then
+      ui_ok "$cmd"
+      passed+=1
+    else
+      ui_err "$cmd" "output mismatch"
+      failed+=1
+    fi
+  else
+    ui_ok "$cmd"
+    passed+=1
+  fi
+}
+
+# Core utilities
+verify_cmd "git" "git version"
+verify_cmd "zsh" "zsh"
+verify_cmd "chezmoi" "chezmoi version"
+
+# Rust Toolchain / Frontier
+verify_cmd "rg" "ripgrep"
+verify_cmd "bat" "bat"
+verify_cmd "eza" "eza"
+verify_cmd "zoxide" "zoxide"
+verify_cmd "zellij" "zellij"
+verify_cmd "shfmt" "3."
+
+# Process management
+verify_cmd "pueue" "pueue"
+
+# AI Tools
+# Prevent sgpt from prompting for a key by piping empty string
+export OPENAI_API_KEY="sk-placeholder-for-testing"
+verify_cmd "sgpt" "ShellGPT"
+verify_cmd "copilot" "copilot"
+verify_cmd "kiro-cli" "kiro-cli"
+
+echo ""
+if [[ $failed -eq 0 ]]; then
+  ui_ok "All $passed tests passed"
+else
+  ui_err "$failed failed" "$passed passed"
+  exit 1
+fi

package/scripts/diagnostics/snapshot.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Snapshot current system/tooling state
+# Usage: dot snapshot [--baseline|-b] [--force|-f]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+
+ui_init
+
+BASELINE=false
+FORCE=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --baseline | -b)
+      BASELINE=true
+      shift
+      ;;
+    --force | -f)
+      FORCE=true
+      shift
+      ;;
+    *) shift ;;
+  esac
+done
+
+STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/snapshots"
+mkdir -p "$STATE_DIR"
+
+if $BASELINE; then
+  output="$STATE_DIR/baseline.json"
+else
+  output="$STATE_DIR/snapshot_$(date +%Y%m%d_%H%M%S).json"
+fi
+
+if [[ -f "$output" && "$FORCE" != "true" ]]; then
+  ui_warn "Snapshot" "${output} already exists (use --force)"
+  exit 0
+fi
+
+safe() { printf '%s' "$1" | sed 's/"/\\"/g'; }
+
+get_version() {
+  local cmd="$1"
+  if command -v "$cmd" >/dev/null 2>&1; then
+    "$cmd" --version 2>/dev/null | head -1 | awk '{print $NF}'
+  else
+    echo ""
+  fi
+}
+
+os_name=$(uname -s 2>/dev/null || echo "unknown")
+kernel=$(uname -r 2>/dev/null || echo "unknown")
+shell_name=$(basename "${SHELL:-}" 2>/dev/null || echo "")
+
+dot_version=""
+if [[ -f "$SCRIPT_DIR/../../package.json" ]]; then
+  dot_version=$(sed -n 's/^[[:space:]]*"version"[[:space:]]*:[[:space:]]*"\([0-9.]*\)".*/\1/p' "$SCRIPT_DIR/../../package.json" | head -1)
+fi
+
+cat >"$output" <<JSON
+{
+  "timestamp": "$(date -Iseconds)",
+  "os": "$(safe "$os_name")",
+  "kernel": "$(safe "$kernel")",
+  "shell": "$(safe "$shell_name")",
+  "dotfiles_version": "$(safe "$dot_version")",
+  "tools": {
+    "chezmoi": "$(safe "$(get_version chezmoi)")",
+    "git": "$(safe "$(get_version git)")",
+    "zsh": "$(safe "$(get_version zsh)")",
+    "node": "$(safe "$(get_version node)")",
+    "python": "$(safe "$(python3 --version 2>/dev/null | awk '{print $2}')")",
+    "rustc": "$(safe "$(rustc --version 2>/dev/null | awk '{print $2}')")",
+    "go": "$(safe "$(go version 2>/dev/null | awk '{print $3}')")",
+    "nvim": "$(safe "$(nvim --version 2>/dev/null | head -1 | awk '{print $2}')")",
+    "tmux": "$(safe "$(tmux -V 2>/dev/null | awk '{print $2}')")",
+    "starship": "$(safe "$(get_version starship)")",
+    "mise": "$(safe "$(get_version mise)")"
+  }
+}
+JSON
+
+ui_dot_banner "Diagnostics"
+ui_ok "Snapshot" "$output"