@sebastienrousseau/dotfiles 0.2.481 → 0.2.500

package/scripts/release/package-policy-bundles.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Package tracked governance artifacts into a release bundle.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+OUTPUT_DIR="${OUTPUT_DIR:-$REPO_ROOT/dist/policy-bundles}"
+BUNDLE_VERSION="${BUNDLE_VERSION:-$(jq -r '.schemaVersion' "$REPO_ROOT/dot_config/dotfiles/policy-bundles.json")}"
+JSON_MODE=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --output-dir | -o)
+      OUTPUT_DIR="${2:-}"
+      shift 2
+      ;;
+    --version | -v)
+      BUNDLE_VERSION="${2:-}"
+      shift 2
+      ;;
+    --json | -j)
+      JSON_MODE=1
+      shift
+      ;;
+    *)
+      shift
+      ;;
+  esac
+done
+
+command -v jq >/dev/null 2>&1 || {
+  echo "jq is required for policy bundle packaging." >&2
+  exit 1
+}
+
+bundle_root="$OUTPUT_DIR/policy-bundles-$BUNDLE_VERSION"
+archive_file="$OUTPUT_DIR/policy-bundles-$BUNDLE_VERSION.tar.gz"
+checksum_file="$OUTPUT_DIR/policy-bundles-$BUNDLE_VERSION.sha256"
+
+rm -rf "$bundle_root"
+mkdir -p "$bundle_root/dot_config/dotfiles" "$bundle_root/.well-known" "$bundle_root/docs/security" "$bundle_root/docs/operations" "$bundle_root/docs/interop"
+
+files=(
+  "dot_config/dotfiles/policy-bundles.json"
+  "dot_config/dotfiles/model-registry.json"
+  "dot_config/dotfiles/prompt-registry.json"
+  "dot_config/dotfiles/agent-profiles.json"
+  "dot_config/dotfiles/agent-card.json"
+  "dot_config/dotfiles/mcp-policy.json"
+  "dot_config/dotfiles/mcp-registry.json"
+  "dot_config/dotfiles/mcp-lock.json"
+  ".well-known/agent.json"
+  ".well-known/agent-card.json"
+  ".well-known/mcp/server-card.json"
+  "docs/security/MCP_POLICY.md"
+  "docs/operations/TRUSTED_AGENT_WORKSTATION.md"
+  "docs/interop/A2A.md"
+)
+
+for file in "${files[@]}"; do
+  [[ -f "$REPO_ROOT/$file" ]] || {
+    echo "Missing required policy bundle artifact: $file" >&2
+    exit 1
+  }
+  mkdir -p "$bundle_root/$(dirname "$file")"
+  cp "$REPO_ROOT/$file" "$bundle_root/$file"
+done
+
+jq empty "$bundle_root/dot_config/dotfiles/policy-bundles.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/model-registry.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/prompt-registry.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/agent-profiles.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/agent-card.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/mcp-policy.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/mcp-registry.json" >/dev/null
+jq empty "$bundle_root/dot_config/dotfiles/mcp-lock.json" >/dev/null
+jq empty "$bundle_root/.well-known/agent.json" >/dev/null
+
+tar -C "$OUTPUT_DIR" -czf "$archive_file" "policy-bundles-$BUNDLE_VERSION"
+sha256sum "$archive_file" >"$checksum_file"
+
+# Generate CycloneDX SBOM
+sbom_file="$bundle_root/sbom.cyclonedx.json"
+if command -v syft >/dev/null 2>&1; then
+  syft dir:"$bundle_root" -o cyclonedx-json >"$sbom_file" 2>/dev/null
+else
+  # Minimal CycloneDX manifest via jq
+  jq -n \
+    --arg version "$BUNDLE_VERSION" \
+    --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    '{
+      bomFormat: "CycloneDX",
+      specVersion: "1.5",
+      version: 1,
+      metadata: {
+        timestamp: $timestamp,
+        component: {
+          type: "application",
+          name: "dotfiles-policy-bundles",
+          version: $version
+        }
+      },
+      components: []
+    }' >"$sbom_file"
+fi
+
+# Re-create archive with SBOM included
+tar -C "$OUTPUT_DIR" -czf "$archive_file" "policy-bundles-$BUNDLE_VERSION"
+sha256sum "$archive_file" >"$checksum_file"
+
+if [[ "$JSON_MODE" -eq 1 ]]; then
+  jq -n \
+    --arg version "$BUNDLE_VERSION" \
+    --arg output_dir "$OUTPUT_DIR" \
+    --arg archive "$archive_file" \
+    --arg checksum "$checksum_file" \
+    --arg sbom "$sbom_file" \
+    '{version: $version, output_dir: $output_dir, archive: $archive, checksum: $checksum, sbom: $sbom}'
+else
+  printf 'Policy bundle archive: %s\n' "$archive_file"
+  printf 'Policy bundle checksum: %s\n' "$checksum_file"
+fi

package/scripts/secrets/age-init.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
 set -euo pipefail
 
 SECRETS_DIR="$HOME/.config/chezmoi"

package/scripts/secrets/create-secrets-file.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
 set -euo pipefail
 
 OUT_FILE="${1:-$HOME/.config/chezmoi/encrypted_secrets.env.age}"

package/scripts/secrets/encrypt-ssh-key.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
 set -euo pipefail
 
 KEY_PATH="${1:-$HOME/.ssh/id_ed25519}"

package/scripts/security/backup.sh

@@ -1,5 +1,45 @@
-#!/bin/sh
-set -e
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Create compressed backup of home directory.
+##
+## Archives the home directory (excluding cache and trash) to a timestamped
+# shellcheck disable=SC1091
+## .tgz file. Supports custom source and destination directories via
+## environment variables.
+##
+## # Usage
+## dot backup
+## DOTFILES_BACKUP_DIR=/mnt/backup dot backup
+##
+## # Dependencies
+## - tar: Archive creation
+##
+## # Environment Variables
+## | Variable | Default | Description |
+## |----------|---------|-------------|
+## | DOTFILES_BACKUP_DIR | ~/.backups | Backup destination |
+## | DOTFILES_BACKUP_SRC | ~/ | Source directory |
+##
+## # Platform Notes
+## - macOS: Uses BSD tar
+## - Linux: Uses GNU tar
+## - WSL: Backup stored in Linux filesystem for performance
+##
+## # Security
+## Does not encrypt backups. Use age/gpg for sensitive data.
+##
+## # Idempotency
+## Creates new timestamped backup on each run.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+
+ui_init
+ui_header "Backup"
 
 BACKUP_DIR="${DOTFILES_BACKUP_DIR:-$HOME/.backups}"
 SRC_DIR="${DOTFILES_BACKUP_SRC:-$HOME}"
@@ -9,9 +49,9 @@ OUT="$BACKUP_DIR/dotfiles-backup-$STAMP.tgz"
 mkdir -p "$BACKUP_DIR"
 
 if ! tar --exclude="$HOME/.cache" --exclude="$HOME/.local/share/Trash" -czf "$OUT" "$SRC_DIR"; then
-  echo "[ERROR] Backup failed!" >&2
+  ui_err "Backup failed"
   rm -f "$OUT"
   exit 1
 fi
 
-echo "Backup written to: $OUT"
+ui_ok "Backup written" "$OUT"

package/scripts/security/dns-doh.sh

@@ -1,29 +1,51 @@
-#!/bin/sh
-set -e
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
 
-if [ "${DOTFILES_DOH:-}" != "1" ]; then
-  echo "DoH script is disabled by default."
-  echo "Re-run with DOTFILES_DOH=1 to apply."
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+
+DRY_RUN=0
+for arg in "$@"; do
+  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
+done
+_run_cmd() {
+  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
+}
+
+ui_init
+ui_header "DNS-over-HTTPS"
+
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  ui_info "Mode" "dry-run (no changes will be made)"
+elif [ "${DOTFILES_DOH:-}" != "1" ]; then
+  ui_warn "DoH" "disabled by default"
+  ui_info "Re-run" "DOTFILES_DOH=1"
   exit 1
 fi
 
-case "$(uname -s)" in
-  Linux)
+case "$(dot_platform_id)" in
+  linux | wsl)
     if command -v resolvectl >/dev/null; then
-      echo "Enabling DNS-over-HTTPS with systemd-resolved (Cloudflare)..."
-      sudo resolvectl dns-over-https on
-      sudo resolvectl dns 1.1.1.1 1.0.0.1
+      ui_info "Enabling" "systemd-resolved DoH (Cloudflare)"
+      _run_cmd sudo resolvectl dns-over-https on
+      _run_cmd sudo resolvectl dns 1.1.1.1 1.0.0.1
     else
-      echo "systemd-resolved not detected."
+      ui_err "systemd-resolved" "not detected"
       exit 1
     fi
     ;;
-  Darwin)
-    echo "Configure DoH in your browser (system-wide DoH requires profiles)."
+  macos)
+    ui_info "Configure" "DoH in your browser"
     exit 0
     ;;
   *)
-    echo "Unsupported OS for DoH config."
+    ui_err "Unsupported OS" "DoH config"
     exit 1
     ;;
 esac

package/scripts/security/encryption-check.sh

@@ -1,39 +1,54 @@
-#!/bin/sh
-set -e
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
 
-case "$(uname -s)" in
-  Darwin)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+
+ui_init
+ui_header "Encryption Check"
+
+case "$(dot_platform_id)" in
+  macos)
     if command -v fdesetup >/dev/null; then
       status=$(fdesetup status || true)
       echo "$status"
-      echo "$status" | grep -qi "FileVault is On" && exit 0
-      echo "Warning: FileVault appears to be off."
+      echo "$status" | grep -qi "FileVault is On" && {
+        ui_ok "FileVault" "On"
+        exit 0
+      }
+      ui_warn "FileVault" "appears to be off"
       exit 1
     else
-      echo "fdesetup not found."
+      ui_err "fdesetup" "not found"
       exit 1
     fi
     ;;
-  Linux)
+  linux | wsl)
     if command -v lsblk >/dev/null; then
       lsblk_output=$(lsblk -f)
       if command -v rg >/dev/null; then
         if echo "$lsblk_output" | rg -i "crypto|luks" >/dev/null; then
-          echo "Encrypted block device detected (LUKS)."
+          ui_ok "LUKS" "encrypted block device detected"
           exit 0
         fi
       else
         if echo "$lsblk_output" | grep -Ei "crypto|luks" >/dev/null; then
-          echo "Encrypted block device detected (LUKS)."
+          ui_ok "LUKS" "encrypted block device detected"
           exit 0
         fi
       fi
-      echo "Warning: No LUKS/crypto volume detected."
+      ui_warn "LUKS" "no crypto volume detected"
       exit 1
     fi
     ;;
   *)
-    echo "Unsupported OS for encryption check."
+    ui_err "Unsupported OS" "encryption check"
     exit 1
     ;;
 esac

package/scripts/security/enforce-policies.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
 # Security Policy Enforcement Script
 # This script enforces security policies across the dotfiles repository
 
@@ -12,24 +13,18 @@ readonly REPO_ROOT
 readonly POLICIES_DIR="${REPO_ROOT}/.github/security-policies"
 readonly LOG_FILE="${REPO_ROOT}/.security-audit.log"
 
-# Color codes for output (respect NO_COLOR: https://no-color.org)
-if [[ -z "${NO_COLOR:-}" ]] && [[ -t 1 ]]; then
-  readonly RED='\033[0;31m'
-  readonly GREEN='\033[0;32m'
-  readonly YELLOW='\033[1;33m'
-  readonly NC='\033[0m'
-else
-  readonly RED='' GREEN='' YELLOW='' NC=''
-fi
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "${SCRIPT_DIR}/../dot/lib/ui.sh"
+ui_init
 
-# Logging function
+# Logging function (also writes to log file)
 log() {
   local level="$1"
   shift
   local message="$*"
   local timestamp
   timestamp=$(date -u '+%Y-%m-%d %H:%M:%S UTC')
-
   echo "[${timestamp}] [${level}] ${message}" | tee -a "${LOG_FILE}"
 }
 
@@ -113,7 +108,7 @@ check_file_permissions() {
   while IFS= read -r -d '' file; do
     if [[ -f "$file" ]]; then
       local perms
-      perms=$(stat -c %a "$file" 2>/dev/null || stat -f %A "$file")
+      perms=$(stat -c %a "$file" 2>/dev/null || stat -f %OLp "$file")
       if [[ $perms -gt 755 ]]; then
         log "WARN" "❌ Overly permissive file: ${file} (${perms})"
         violations=$((violations + 1))
@@ -321,13 +316,13 @@ main() {
 
   # Final result
   if [[ $total_violations -eq 0 ]]; then
-    echo -e "${GREEN}✅ All security checks passed!${NC}"
+    ui_ok "All security checks passed"
     log "INFO" "Security policy enforcement completed successfully"
     exit 0
   else
-    echo -e "${RED}❌ Security policy enforcement failed with ${total_violations} violations${NC}"
-    echo -e "${YELLOW}📋 Check ${LOG_FILE} for details${NC}"
-    echo -e "${YELLOW}📋 Review security-report.md for summary${NC}"
+    ui_err "$total_violations violations" "Security policy enforcement failed"
+    ui_warn "Details" "Check ${LOG_FILE}"
+    ui_warn "Report" "Review security-report.md"
     log "ERROR" "Security policy enforcement failed with ${total_violations} violations"
     exit 1
   fi

package/scripts/security/firewall.sh

@@ -1,34 +1,90 @@
-#!/bin/sh
-set -e
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Configure system firewall with secure defaults.
+##
+## Enables firewall with deny-by-default policy and minimal exceptions.
+## Requires explicit opt-in via DOTFILES_FIREWALL=1 to prevent accidental
+## lockouts.
+##
+## # Usage
+## DOTFILES_FIREWALL=1 dot firewall
+##
+## # Dependencies
+## - macOS: socketfilterfw (built-in)
+## - Linux: ufw (Uncomplicated Firewall)
+##
+## # Platform Notes
+## ### Platform: macOS
+## - Enables Application Firewall via socketfilterfw
+## - Enables stealth mode (no ICMP responses)
+## - Allows signed applications
+##
+## ### Platform: Linux
+## - Configures UFW with deny incoming / allow outgoing
+## - Allows OpenSSH to prevent lockout
+## - Requires ufw package installed
+##
+## # Security
+## **Requires sudo.** All changes logged to dotfiles.log.
+##
+## # Side Effects
+## - Modifies system firewall rules
+## - May block existing connections
+##
+## # Idempotency
+## Safe to run repeatedly. Applies same rules each time.
 
-if [ "${DOTFILES_FIREWALL:-}" != "1" ]; then
-  echo "Firewall script is disabled by default."
-  echo "Re-run with DOTFILES_FIREWALL=1 to apply."
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+
+DRY_RUN=0
+for arg in "$@"; do
+  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
+done
+_run_cmd() {
+  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
+}
+
+ui_init
+ui_header "Firewall"
+
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  ui_info "Mode" "dry-run (no changes will be made)"
+elif [ "${DOTFILES_FIREWALL:-}" != "1" ]; then
+  ui_warn "Firewall" "disabled by default"
+  ui_info "Re-run" "DOTFILES_FIREWALL=1"
   exit 1
 fi
 
-case "$(uname -s)" in
-  Darwin)
-    echo "Enabling macOS firewall..."
-    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
-    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
-    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp on
-    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
+case "$(dot_platform_id)" in
+  macos)
+    ui_info "Enabling" "macOS firewall"
+    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
+    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
+    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp on
+    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
     ;;
-  Linux)
+  linux | wsl)
     if command -v ufw >/dev/null; then
-      echo "Enabling UFW..."
-      sudo ufw default deny incoming
-      sudo ufw default allow outgoing
-      sudo ufw allow OpenSSH
-      sudo ufw --force enable
+      ui_info "Enabling" "UFW"
+      _run_cmd sudo ufw default deny incoming
+      _run_cmd sudo ufw default allow outgoing
+      _run_cmd sudo ufw allow OpenSSH
+      _run_cmd sudo ufw --force enable
     else
-      echo "ufw not installed. Install ufw and re-run."
+      ui_err "ufw" "not installed; re-run after install"
       exit 1
     fi
     ;;
   *)
-    echo "Unsupported OS for firewall setup."
+    ui_err "Unsupported OS" "firewall setup"
     exit 1
     ;;
 esac

package/scripts/security/lock-configs.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 # MIT License
-# Copyright (c) 2026 Sebastien Rousseau
+# Copyright (c) 2026
 # See LICENSE file for details.
 
 # Script: lock-configs.sh
 # Description: Toggles immutability flags on critical configuration files.
 # Usage: lock-configs [lock|unlock]
 
-set -e
+set -euo pipefail
 
 ACTION="${1:-lock}"
 CRITICAL_FILES=(

package/scripts/security/lock-screen.sh

@@ -1,33 +1,55 @@
-#!/bin/sh
-set -e
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
 
-if [ "${DOTFILES_LOCK:-}" != "1" ]; then
-  echo "Lock screen script is disabled by default."
-  echo "Re-run with DOTFILES_LOCK=1 to apply."
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+
+DRY_RUN=0
+for arg in "$@"; do
+  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
+done
+_run_cmd() {
+  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
+}
+
+ui_init
+ui_header "Lock Screen"
+
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  ui_info "Mode" "dry-run (no changes will be made)"
+elif [ "${DOTFILES_LOCK:-}" != "1" ]; then
+  ui_warn "Lock screen" "disabled by default"
+  ui_info "Re-run" "DOTFILES_LOCK=1"
   exit 1
 fi
 
-case "$(uname -s)" in
-  Linux)
+case "$(dot_platform_id)" in
+  linux | wsl)
     if command -v gsettings >/dev/null; then
-      echo "Enabling screen lock and idle timeout..."
-      gsettings set org.gnome.desktop.screensaver lock-enabled true || true
-      gsettings set org.gnome.desktop.session idle-delay 300 || true
-      gsettings set org.gnome.desktop.screensaver lock-delay 0 || true
+      ui_info "Enabling" "screen lock and idle timeout"
+      _run_cmd gsettings set org.gnome.desktop.screensaver lock-enabled true || true
+      _run_cmd gsettings set org.gnome.desktop.session idle-delay 300 || true
+      _run_cmd gsettings set org.gnome.desktop.screensaver lock-delay 0 || true
     else
-      echo "gsettings not found."
+      ui_err "gsettings" "not found"
       exit 1
     fi
     ;;
-  Darwin)
-    echo "Enabling lock on sleep and screensaver (macOS)..."
-    defaults write com.apple.screensaver askForPassword -int 1 || true
-    defaults write com.apple.screensaver askForPasswordDelay -int 0 || true
+  macos)
+    ui_info "Enabling" "lock on sleep and screensaver (macOS)"
+    _run_cmd defaults write com.apple.screensaver askForPassword -int 1 || true
+    _run_cmd defaults write com.apple.screensaver askForPasswordDelay -int 0 || true
     # 5-minute idle timeout
-    defaults -currentHost write com.apple.screensaver idleTime -int 300 || true
+    _run_cmd defaults -currentHost write com.apple.screensaver idleTime -int 300 || true
     ;;
   *)
-    echo "Unsupported OS for lock screen hardening."
+    ui_err "Unsupported OS" "lock screen hardening"
     exit 1
     ;;
 esac