@sebastienrousseau/dotfiles 0.2.499 → 0.2.500

package/dot_config/alacritty/alacritty.toml.tmpl

@@ -0,0 +1,55 @@
+{{- $fontFamily := default "JetBrainsMono Nerd Font" .terminal_font_family -}}
+{{- $fontSize := default 12 .terminal_font_size -}}
+{{- $t := index .themes (default "macos-monterey-dark" .theme) -}}
+{{- if not $t -}}{{- $t = index .themes "macos-monterey-dark" -}}{{- end }}
+{{- $tt := $t -}}
+{{- $themeName := default "macos-monterey-dark" .theme -}}
+{{- if hasSuffix "-light" $themeName -}}
+  {{- $darkTheme := index .themes (printf "%s-dark" (trimSuffix "-light" $themeName)) -}}
+  {{- if $darkTheme -}}{{- $tt = $darkTheme -}}{{- end -}}
+{{- end }}
+[window]
+padding = { x = 16, y = 12 }
+opacity = {{ if eq .chezmoi.os "darwin" }}0.92{{ else }}0.96{{ end }}
+option_as_alt = {{ if eq .chezmoi.os "darwin" }}"Both"{{ else }}"None"{{ end }}
+
+[font]
+size = {{ $fontSize }}
+normal = { family = "{{ $fontFamily }}" }
+{{- if eq .chezmoi.os "darwin" }}
+offset = { x = 0, y = 1 }
+{{- else }}
+offset = { x = 0, y = 0 }
+{{- end }}
+
+[colors.primary]
+background = "{{ $tt.term.bg }}"
+foreground = "{{ $tt.term.fg }}"
+
+[colors.cursor]
+cursor = "{{ $tt.term.cursor }}"
+text = "{{ $tt.term.cursor_text }}"
+
+[colors.selection]
+background = "{{ $tt.term.sel_bg }}"
+text = "{{ $tt.term.sel_fg }}"
+
+[colors.normal]
+black = "{{ $tt.term.c0 }}"
+red = "{{ $tt.term.c1 }}"
+green = "{{ $tt.term.c2 }}"
+yellow = "{{ $tt.term.c3 }}"
+blue = "{{ $tt.term.c4 }}"
+magenta = "{{ $tt.term.c5 }}"
+cyan = "{{ $tt.term.c6 }}"
+white = "{{ $tt.term.c7 }}"
+
+[colors.bright]
+black = "{{ $tt.term.c8 }}"
+red = "{{ $tt.term.c9 }}"
+green = "{{ $tt.term.c10 }}"
+yellow = "{{ $tt.term.c11 }}"
+blue = "{{ $tt.term.c12 }}"
+magenta = "{{ $tt.term.c13 }}"
+cyan = "{{ $tt.term.c14 }}"
+white = "{{ $tt.term.c15 }}"

package/dot_config/ansible/ansible.cfg

@@ -0,0 +1,11 @@
+[defaults]
+inventory = ./inventory
+retry_files_enabled = False
+host_key_checking = False
+stdout_callback = yaml
+nocows = 1
+
+[privilege_escalation]
+become = True
+become_method = sudo
+become_ask_pass = False

package/dot_config/atuin/config.toml

@@ -0,0 +1,40 @@
+# Atuin Configuration (~/.config/atuin/config.toml)
+# https://atuin.sh/docs/config
+
+# Core
+update_check = false
+db_path = "~/.local/share/atuin/history.db"
+key_path = "~/.local/share/atuin/key"
+session_path = "~/.local/share/atuin/session"
+
+# Sync
+auto_sync = true
+sync_frequency = "10m"
+sync_address = "https://api.atuin.sh"
+
+# UI
+style = "compact"
+inline_height = 20
+show_preview = true
+enter_accept = true
+
+# Search
+search_mode = "fuzzy"
+filter_mode = "global"
+workspaces = true
+
+# Privacy: skip commands that may contain secrets
+history_filter = [
+  "^export (SECRET|TOKEN|PASSWORD|API_KEY|AWS_)",
+  "^PASSWORD=",
+  "^ssh-keygen",
+  "^(aws|gcloud|az|kubectl).*(configure|auth|login|-k |--kubeconfig)",
+  "curl.*-H.*[Aa]uthorization",
+  "git clone.*https://.*:.*@",
+  "^vault ",
+  "^op (read|inject|run)",
+]
+
+# Skip ephemeral directories
+secrets_filter = true
+network_timeout = 30

package/dot_config/bat/config

@@ -0,0 +1,23 @@
+# Bat configuration (dotfiles)
+# See: https://github.com/sharkdp/bat
+
+# Theme
+--theme="TwoDark"
+
+# Style
+--style="numbers,changes,header,grid"
+
+# Paging
+--paging=auto
+--pager="less -FR"
+
+# Formatting
+--tabs=2
+--italic-text=always
+
+# Syntax mappings
+--map-syntax "*.conf:INI"
+--map-syntax ".gitignore:Git Ignore"
+--map-syntax "*.tmpl:Go HTML Template"
+--map-syntax "*.kdl:KDL"
+--map-syntax ".envrc:Bash"

package/dot_config/brave-flags.conf.tmpl

@@ -0,0 +1,7 @@
+{{- if eq .chezmoi.os "linux" -}}
+--enable-gpu-rasterization
+--enable-zero-copy
+--enable-features=VaapiVideoDecodeLinuxGL,VaapiVideoEncoder,CanvasOopRasterization
+--disable-features=UseChromeOSDirectVideoDecoder
+--max-old-space-size=4096
+{{- end -}}

package/dot_config/btop/btop.conf

@@ -0,0 +1,16 @@
+# btop configuration
+# Theme files live in ~/.config/btop/themes/
+color_theme = "tokyonight"
+
+# Basic UI preferences
+update_ms = 2000
+proc_sorting = "cpu lazy"
+proc_gradient = true
+net_auto = true
+
+# Hide top-level header when on small screens
+show_cpu_freq = true
+show_gpu_info = false
+
+# Enable mouse support
+mouse = true

package/dot_config/btop/themes/tokyonight.theme

@@ -0,0 +1,34 @@
+# Tokyonight (Night) theme for btop
+# Based on Tokyo Night palette
+
+# Main background
+bg = "#1a1b26"
+# Main text
+fg = "#c0caf5"
+
+# Titles and boxes
+title = "#7aa2f7"
+hi_fg = "#bb9af7"
+
+# Graphs
+selected_bg = "#24283b"
+selected_fg = "#c0caf5"
+
+# CPU
+cpu_box = "#7aa2f7"
+mem_box = "#9ece6a"
+net_box = "#7dcfff"
+proc_box = "#e0af68"
+
+# Graph colors
+cpu_graph = "#7aa2f7"
+mem_graph = "#9ece6a"
+net_graph = "#7dcfff"
+proc_graph = "#e0af68"
+
+# Status
+available = "#9ece6a"
+used = "#e0af68"
+free = "#7dcfff"
+warning = "#e0af68"
+critical = "#f7768e"

package/dot_config/bun/bunfig.toml.tmpl

@@ -0,0 +1,33 @@
+# Bun configuration
+# Managed by chezmoi - edit source at ~/.dotfiles/dot_config/bun/bunfig.toml.tmpl
+# Documentation: https://bun.sh/docs/runtime/bunfig
+
+[install]
+# Use a shared global cache
+globalBinDir = "{{ .chezmoi.homeDir }}/.bun/bin"
+
+# Prefer offline mode when possible
+prefer = "offline"
+
+# Auto-install peer dependencies
+peer = true
+
+# Registry (default)
+registry = "https://registry.npmjs.org/"
+
+# Scoped registries (uncomment and configure as needed)
+# [install.scopes]
+# "@mycompany" = { token = "$NPM_TOKEN", url = "https://npm.mycompany.com/" }
+
+[run]
+# Silence the bun install/update messages during bun run
+silent = false
+
+[test]
+# Test configuration
+coverage = false
+coverageDir = "coverage"
+
+[telemetry]
+# Disable telemetry
+enabled = false

package/dot_config/claude/mcp_servers.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://raw.githubusercontent.com/anthropics/claude-code/main/schemas/mcp-servers.json",
+  "mcpServers": {
+    "git": {
+      "command": "npx",
+      "args": ["-y", "mcp-server-git@2026.3.0"],
+      "env": {}
+    },
+    "memory": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-memory@2026.3.0"],
+      "env": {}
+    },
+    "sqlite": {
+      "command": "npx",
+      "args": ["-y", "mcp-server-sqlite@2026.3.0"],
+      "env": {}
+    }
+  }
+}

package/dot_config/containers/containers.conf

@@ -0,0 +1,14 @@
+# Podman/containers defaults
+[containers]
+netns = ""
+ipcns = ""
+utsns = ""
+
+[engine]
+# Use systemd cgroup driver when available
+cgroup_manager = "systemd"
+# Reduce noisy output
+events_logger = "journald"
+
+[network]
+# Default subnet and gateway can be overridden per user

package/dot_config/curl/dot_curlrc

@@ -0,0 +1,18 @@
+# cURL Configuration
+-w "\n"
+--anyauth
+--continue-at -
+--connect-timeout 60
+--compressed
+--ipv4
+--location
+--progress-bar
+--remote-time
+--referer ";auto"
+--show-error
+--ssl-reqd
+--trace-time
+--user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36 Edg/105.0.1343.53"
+-H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
+-H "Upgrade-Insecure-Requests: 1"
+-H "Accept-Language: en-US,en;q=0.8"

package/dot_config/dlv/config.yml

@@ -0,0 +1,39 @@
+# Delve debugger configuration
+# https://github.com/go-delve/delve/blob/master/Documentation/cli/README.md
+
+# Aliases for common commands
+aliases:
+  # Navigation
+  ll: "list"
+  bt: "stack"
+  # Breakpoints
+  bp: "breakpoints"
+  # Variables
+  lv: "locals"
+  av: "args"
+  # Execution
+  c: "continue"
+  n: "next"
+  s: "step"
+  so: "stepout"
+  # Info
+  gs: "goroutines"
+  gt: "goroutine"
+
+# Source list settings
+source-list-line-color: 34
+source-list-arrow-color: 33
+source-list-keyword-color: 31
+
+# Substitute source paths (useful for remote debugging)
+# substitute-path:
+#   - {from: "/build/path", to: "/local/path"}
+
+# Max string length to display
+max-string-len: 256
+
+# Max array values to display
+max-array-values: 128
+
+# Show goroutine current location
+show-location-expr: true

package/dot_config/docker/config.json

@@ -0,0 +1,15 @@
+{
+  "auths": {},
+  "credsStore": "",
+  "credHelpers": {},
+  "detachKeys": "ctrl-@",
+  "experimental": "disabled",
+  "plugins": {},
+  "proxies": {
+    "default": {
+      "httpProxy": "",
+      "httpsProxy": "",
+      "noProxy": ""
+    }
+  }
+}

package/dot_config/dotfiles/agent-card.json

@@ -0,0 +1,29 @@
+{
+  "specVersion": "0.3",
+  "name": "dotfiles-agent",
+  "version": "0.2.500",
+  "description": "Trusted workstation agent surface for local shell automation.",
+  "defaultProfile": "ask",
+  "protocols": ["mcp", "a2a"],
+  "platforms": ["macOS", "Linux", "WSL", "PowerShell"],
+  "entrypoints": {
+    "cli": "dot",
+    "mode": "dot mode",
+    "attestation": "dot attest --json",
+    "mcp": "dot mcp --strict --json",
+    "conformance": "dot agent conformance --strict --json",
+    "checkpoint": "dot agent checkpoint list",
+    "a2aCard": "dot agent a2a-card --json"
+  },
+  "profiles": ["ask", "plan", "apply", "audit"],
+  "security": {
+    "signedCommits": true,
+    "mcpRegistry": true,
+    "sessionLogging": true,
+    "workstationAttestation": true,
+    "replayableCheckpoints": true,
+    "fleetAttestationExport": true,
+    "policyBundleReleases": true,
+    "cardSigning": "ssh-ed25519"
+  }
+}

package/dot_config/dotfiles/agent-profiles.json

@@ -0,0 +1,92 @@
+{
+  "schemaVersion": "2026.03",
+  "defaultProfile": "ask",
+  "rbac": {
+    "roles": {
+      "viewer": {
+        "description": "Read-only access to configuration and status.",
+        "allowedProfiles": ["ask"],
+        "permissions": ["read", "status", "audit"]
+      },
+      "developer": {
+        "description": "Standard development workflow with bounded writes.",
+        "inherits": "viewer",
+        "allowedProfiles": ["ask", "plan", "apply"],
+        "permissions": ["read", "write", "status", "audit", "execute"]
+      },
+      "admin": {
+        "description": "Full access including fleet management and profile switching.",
+        "inherits": "developer",
+        "allowedProfiles": ["ask", "plan", "apply", "audit"],
+        "permissions": ["read", "write", "status", "audit", "execute", "fleet", "configure"]
+      }
+    },
+    "defaultRole": "developer",
+    "enforcement": "advisory"
+  },
+  "delegation": {
+    "enabled": false,
+    "maxDepth": 2,
+    "allowedDelegates": {
+      "security-reviewer": {
+        "profile": "audit",
+        "permissions": ["read", "audit"],
+        "maxSteps": 4,
+        "timeout": 120
+      },
+      "test-runner": {
+        "profile": "apply",
+        "permissions": ["read", "execute"],
+        "maxSteps": 6,
+        "timeout": 300
+      },
+      "lint-checker": {
+        "profile": "ask",
+        "permissions": ["read"],
+        "maxSteps": 2,
+        "timeout": 60
+      }
+    },
+    "securityPolicy": {
+      "requireParentApproval": true,
+      "logAllDelegations": true,
+      "maxConcurrentDelegates": 3
+    }
+  },
+  "profiles": {
+    "ask": {
+      "description": "Read-only guidance with no unattended changes.",
+      "approval": "manual",
+      "filesystem": "read-only",
+      "network": "off",
+      "mcpProfile": "strict-local",
+      "maxSteps": 1
+    },
+    "plan": {
+      "description": "Structured planning with local inspection and no writes.",
+      "approval": "manual",
+      "filesystem": "read-only",
+      "network": "limited",
+      "mcpProfile": "strict-local",
+      "maxSteps": 3
+    },
+    "apply": {
+      "description": "Bounded implementation with explicit approval and local policy guards.",
+      "approval": "on-request",
+      "filesystem": "workspace-write",
+      "network": "limited",
+      "mcpProfile": "strict-local",
+      "maxSteps": 6,
+      "canDelegate": true
+    },
+    "audit": {
+      "description": "Deep verification, scoring, and compliance analysis.",
+      "approval": "manual",
+      "filesystem": "read-only",
+      "network": "limited",
+      "mcpProfile": "enterprise-remote",
+      "maxSteps": 8,
+      "canDelegate": true
+    }
+  }
+}

package/dot_config/dotfiles/boot/README.md

@@ -0,0 +1,11 @@
+Place your Linux boot logo image here.
+
+Default path used by the script:
+- ~/.config/dotfiles/boot/logo.png
+
+Run:
+- sudo ~/.dotfiles/scripts/theme/install-boot-logo.sh --apply
+
+---
+
+Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/dot_config/dotfiles/grub/README.md

@@ -0,0 +1,11 @@
+Place your GRUB theme files here.
+
+Default path used by the script:
+- ~/.config/dotfiles/grub/theme
+
+Run:
+- sudo ~/.dotfiles/scripts/theme/install-grub-theme.sh --apply
+
+---
+
+Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/dot_config/dotfiles/lock/README.md

@@ -0,0 +1,11 @@
+Place your lock screen icon here.
+
+Default path used by the script:
+- ~/.config/dotfiles/lock/icon.png
+
+Example:
+- swaylock --image ~/.config/dotfiles/lock/icon.png
+
+---
+
+Made with ❤️ by [Sebastien Rousseau](https://sebastienrousseau.com)

package/dot_config/dotfiles/mcp-lock.json

@@ -0,0 +1,33 @@
+{
+  "lockVersion": "2026.03",
+  "profile": "strict-local",
+  "packages": {
+    "git": {
+      "command": "npx",
+      "package": "mcp-server-git@2026.3.0",
+      "source": "https://github.com/modelcontextprotocol/servers/releases/tag/2025.1.14",
+      "verification": {
+        "method": "tracked version pin",
+        "status": "approved"
+      }
+    },
+    "memory": {
+      "command": "npx",
+      "package": "@modelcontextprotocol/server-memory@2026.3.0",
+      "source": "https://www.npmjs.com/package/@modelcontextprotocol/server-memory",
+      "verification": {
+        "method": "tracked version pin",
+        "status": "approved"
+      }
+    },
+    "sqlite": {
+      "command": "npx",
+      "package": "mcp-server-sqlite@2026.3.0",
+      "source": "https://github.com/modelcontextprotocol/servers/releases/tag/2025.1.14",
+      "verification": {
+        "method": "tracked version pin",
+        "status": "approved"
+      }
+    }
+  }
+}

package/dot_config/dotfiles/mcp-policy.json

@@ -0,0 +1,52 @@
+{
+  "policyVersion": "2026.03",
+  "defaultProfile": "strict-local",
+  "profiles": {
+    "strict-local": {
+      "description": "Local-first MCP policy for regulated and high-trust environments.",
+      "allowedLaunchers": ["npx", "node", "uvx"],
+      "trustedTransports": ["stdio", "http"],
+      "authProfiles": ["none", "env-token"],
+      "blockedFilesystemRoots": ["/", "/home", "/Users"],
+      "blockedArgPatterns": ["^--allow-.*", "^--unsafe$", "^\\*$"],
+      "warnOnUnpinnedNpx": true,
+      "requireApprovedPackageLock": true,
+      "requireRegistryEntry": true,
+      "requireHttpsForHttpTransports": true,
+      "requireOauthForHttpTransports": true,
+      "requiredEnvByServer": {
+        "github": ["GITHUB_TOKEN"],
+        "brave-search": ["BRAVE_API_KEY"]
+      },
+      "forbidNetworkServersByDefault": [
+        "github",
+        "brave-search",
+        "fetch",
+        "puppeteer",
+        "filesystem"
+      ]
+    },
+    "enterprise-remote": {
+      "description": "Enterprise-ready MCP policy with registry-backed remote transports.",
+      "allowedLaunchers": ["npx", "node", "uvx"],
+      "trustedTransports": ["stdio", "http", "streamable-http"],
+      "authProfiles": ["none", "env-token", "oauth2", "sso"],
+      "streamableHttpConfig": {
+        "sessionTimeout": 3600,
+        "maxConcurrentSessions": 4
+      },
+      "blockedFilesystemRoots": ["/", "/home", "/Users"],
+      "blockedArgPatterns": ["^--allow-.*", "^--unsafe$", "^\\*$"],
+      "warnOnUnpinnedNpx": true,
+      "requireApprovedPackageLock": true,
+      "requireRegistryEntry": true,
+      "requireHttpsForHttpTransports": true,
+      "requireOauthForHttpTransports": true,
+      "requiredEnvByServer": {
+        "github": ["GITHUB_TOKEN"],
+        "brave-search": ["BRAVE_API_KEY"]
+      },
+      "forbidNetworkServersByDefault": []
+    }
+  }
+}

package/dot_config/dotfiles/mcp-registry.json

@@ -0,0 +1,47 @@
+{
+  "registryVersion": "2026.03",
+  "servers": {
+    "git": {
+      "transport": "stdio",
+      "launcher": "npx",
+      "package": "mcp-server-git@2026.3.0",
+      "auth": "env",
+      "authProfile": "env-token",
+      "scope": "repo-local",
+      "verification": "pinned-package"
+    },
+    "memory": {
+      "transport": "stdio",
+      "launcher": "npx",
+      "package": "@modelcontextprotocol/server-memory@2026.3.0",
+      "auth": "env",
+      "authProfile": "none",
+      "scope": "workspace-local",
+      "verification": "pinned-package"
+    },
+    "sqlite": {
+      "transport": "stdio",
+      "launcher": "npx",
+      "package": "mcp-server-sqlite@2026.3.0",
+      "auth": "env",
+      "authProfile": "none",
+      "scope": "workspace-local",
+      "verification": "pinned-package"
+    },
+    "example-remote": {
+      "transport": "streamable-http",
+      "url": "https://mcp.example.com/v1",
+      "headers": { "X-Org": "dotfiles" },
+      "auth": "oauth2",
+      "authProfile": "oauth2",
+      "authConfig": {
+        "provider": "https://auth.example.com",
+        "clientId": "${MCP_OAUTH_CLIENT_ID}",
+        "scopes": ["mcp:read", "mcp:write"]
+      },
+      "scope": "enterprise",
+      "verification": "registry-approved",
+      "enabled": false
+    }
+  }
+}

package/dot_config/dotfiles/model-registry.json

@@ -0,0 +1,20 @@
+{
+  "schemaVersion": "2026.03",
+  "defaultModel": "local-default",
+  "models": {
+    "local-default": {
+      "provider": "local",
+      "family": "workstation",
+      "intendedUse": "Local-first CLI assistance and bounded automation",
+      "changeControl": "signed-commit",
+      "riskLevel": "moderate"
+    },
+    "enterprise-audit": {
+      "provider": "remote",
+      "family": "audit",
+      "intendedUse": "Deep analysis with governed remote access",
+      "changeControl": "signed-commit-and-policy-review",
+      "riskLevel": "high"
+    }
+  }
+}