@sebastienrousseau/dotfiles 0.2.499 → 0.2.500

package/scripts/diagnostics/perf.sh

@@ -0,0 +1,225 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Shell Performance Profiling
+# Usage: dot perf [--json|-j] [--profile|-p] [--runs|-r N] [--target|-t MS]
+
+set -euo pipefail
+
+_cleanup_files=()
+trap 'rm -f "${_cleanup_files[@]}"' EXIT
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/log.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/log.sh"
+export DOT_COMMAND="perf"
+
+ui_init
+
+if ! command -v python3 >/dev/null 2>&1; then
+  ui_err "python3" "required for perf timing"
+  exit 1
+fi
+
+JSON_OUTPUT=false
+PROFILE=false
+RUNS=3
+TARGET_MS="${DOTFILES_PERF_TARGET_MS:-250}"
+MAX_MS="${DOTFILES_PERF_MAX_MS:-1000}"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --json | -j)
+      JSON_OUTPUT=true
+      shift
+      ;;
+    --profile | -p)
+      PROFILE=true
+      shift
+      ;;
+    --runs | -r)
+      RUNS="${2:-3}"
+      shift 2
+      ;;
+    --target | -t)
+      TARGET_MS="${2:-$TARGET_MS}"
+      shift 2
+      ;;
+    *)
+      shift
+      ;;
+  esac
+done
+
+time_shell_startup() {
+  local start end
+  start=$(python3 -c 'import time; print(int(time.time() * 1000))')
+  zsh -i -c exit >/dev/null 2>&1
+  end=$(python3 -c 'import time; print(int(time.time() * 1000))')
+  echo $((end - start))
+}
+
+calc_score() {
+  local mean_ms="$1"
+  if [[ "$mean_ms" -le "$TARGET_MS" ]]; then
+    echo 100
+    return
+  fi
+  if [[ "$mean_ms" -ge "$MAX_MS" ]]; then
+    echo 0
+    return
+  fi
+  echo $((100 - (mean_ms - TARGET_MS) * 100 / (MAX_MS - TARGET_MS)))
+}
+
+run_profile() {
+  zsh -c '
+    zmodload zsh/zprof
+# shellcheck disable=SC1091
+    source ~/.zshenv 2>/dev/null
+# shellcheck disable=SC1091
+    source ~/.config/zsh/.zshrc 2>/dev/null
+    zprof
+  ' 2>/dev/null | head -20
+}
+
+if $JSON_OUTPUT; then
+  times=()
+  for _ in $(seq 1 "$RUNS"); do
+    times+=("$(time_shell_startup)")
+  done
+  sum=0
+  min=999999
+  max=0
+  for t in "${times[@]}"; do
+    sum=$((sum + t))
+    if [[ "$t" -lt "$min" ]]; then min="$t"; fi
+    if [[ "$t" -gt "$max" ]]; then max="$t"; fi
+  done
+  mean=$((sum / RUNS))
+  score=$(calc_score "$mean")
+  cat <<JSON
+{
+  "mean_ms": $mean,
+  "min_ms": $min,
+  "max_ms": $max,
+  "runs": $RUNS,
+  "target_ms": $TARGET_MS,
+  "max_ms_target": $MAX_MS,
+  "score": $score
+}
+JSON
+  exit 0
+fi
+
+ui_dot_banner "Diagnostics"
+ui_header "Shell Performance"
+
+ui_section "Startup timing"
+
+times=()
+for _ in $(seq 1 "$RUNS"); do
+  times+=("$(time_shell_startup)")
+done
+sum=0
+min=999999
+max=0
+for t in "${times[@]}"; do
+  sum=$((sum + t))
+  if [[ "$t" -lt "$min" ]]; then min="$t"; fi
+  if [[ "$t" -gt "$max" ]]; then max="$t"; fi
+  if [[ "$UI_ENABLED" = "1" ]]; then
+    ui_kv "Run" "${t}ms"
+  else
+    echo "  Run: ${t}ms"
+  fi
+done
+mean=$((sum / RUNS))
+score=$(calc_score "$mean")
+
+if [[ "$UI_ENABLED" = "1" ]]; then
+  ui_kv "Average" "${mean}ms"
+  ui_kv "Min" "${min}ms"
+  ui_kv "Max" "${max}ms"
+  ui_kv "Target" "${TARGET_MS}ms"
+  ui_kv "Score" "${score}/100"
+else
+  echo "  Average: ${mean}ms"
+  echo "  Min:     ${min}ms"
+  echo "  Max:     ${max}ms"
+  echo "  Target:  ${TARGET_MS}ms"
+  echo "  Score:   ${score}/100"
+fi
+
+# Per-shell startup comparison
+ui_section "Per-shell startup"
+
+for shell_name in zsh bash fish; do
+  if command -v "$shell_name" >/dev/null 2>&1; then
+    local_start=$(python3 -c 'import time; print(int(time.time() * 1000))')
+    if [[ "$shell_name" == "fish" ]]; then
+      fish -c exit >/dev/null 2>&1 || true
+    else
+      "$shell_name" -i -c exit >/dev/null 2>&1 || true
+    fi
+    local_end=$(python3 -c 'import time; print(int(time.time() * 1000))')
+    shell_time=$((local_end - local_start))
+    if [[ "$UI_ENABLED" = "1" ]]; then
+      ui_kv "$shell_name" "${shell_time}ms"
+    else
+      echo "  $shell_name: ${shell_time}ms"
+    fi
+  fi
+done
+
+# Per-component breakdown (Zsh only, uses DOTFILES_DEBUG timing)
+ui_section "Component breakdown (estimated)"
+for component in "bare zsh" "paths+env" "aliases" "functions" "tools"; do
+  case "$component" in
+    "bare zsh")
+      c_start=$(python3 -c 'import time; print(int(time.time() * 1000))')
+      zsh --no-rcs -c exit >/dev/null 2>&1 || true
+      c_end=$(python3 -c 'import time; print(int(time.time() * 1000))')
+      ;;
+    "paths+env")
+      c_start=$(python3 -c 'import time; print(int(time.time() * 1000))')
+      DOTFILES_ULTRA_FAST=1 zsh -i -c exit >/dev/null 2>&1 || true
+      c_end=$(python3 -c 'import time; print(int(time.time() * 1000))')
+      ;;
+    *)
+      # Approximate — full minus ultra gives the delta
+      c_start=0
+      c_end=0
+      ;;
+  esac
+  c_time=$((c_end - c_start))
+  if [[ "$c_time" -gt 0 ]]; then
+    if [[ "$UI_ENABLED" = "1" ]]; then
+      ui_kv "$component" "${c_time}ms"
+    else
+      echo "  $component: ${c_time}ms"
+    fi
+  fi
+done
+
+if $PROFILE; then
+  echo ""
+  ui_section "Top contributors (zprof)"
+  run_profile
+  echo ""
+fi
+
+dot_log info "perf_complete" "mean_ms=$mean" "score=$score"
+dot_metric "shell_startup_mean" "$mean" "ms"
+dot_metric "perf_score" "$score" "percent"
+
+if [[ "$score" -eq 100 ]]; then
+  ui_ok "Performance" "Excellent"
+elif [[ "$score" -ge 80 ]]; then
+  ui_warn "Performance" "Good (tune to reach 100)"
+else
+  ui_err "Performance" "Needs attention"
+fi

package/scripts/diagnostics/scorecard.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Dotfiles Scorecard
+# Usage: dot scorecard [--json|-j]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/log.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/log.sh"
+export DOT_COMMAND="scorecard"
+
+ui_init
+set +x
+
+if ! command -v python3 >/dev/null 2>&1; then
+  ui_err "python3" "required for scorecard"
+  exit 1
+fi
+
+JSON_OUTPUT=false
+if [[ "${1:-}" == "--json" || "${1:-}" == "-j" ]]; then
+  JSON_OUTPUT=true
+fi
+
+extract_json() {
+  # strip any leading noise before the JSON payload
+  awk 'BEGIN{p=0} /^[[:space:]]*[{]/{p=1} p{print}'
+}
+
+health_json=$(env -u SHELLOPTS bash "$SCRIPT_DIR/health.sh" --json 2>/dev/null | extract_json)
+security_json=$(env -u SHELLOPTS bash "$SCRIPT_DIR/security-score.sh" --json 2>/dev/null | extract_json)
+perf_json=$(env -u SHELLOPTS bash "$SCRIPT_DIR/perf.sh" --json 2>/dev/null | extract_json)
+
+if [[ -z "$health_json" || -z "$security_json" || -z "$perf_json" ]]; then
+  ui_err "scorecard" "failed to collect JSON metrics"
+  exit 1
+fi
+
+health_score=$(python3 -c 'import json,sys; j=json.loads(sys.stdin.read()); print(j.get("score",0))' <<<"$health_json")
+health_warnings=$(python3 -c 'import json,sys; j=json.loads(sys.stdin.read()); print(j.get("warnings",0))' <<<"$health_json")
+health_failures=$(python3 -c 'import json,sys; j=json.loads(sys.stdin.read()); print(j.get("failures",0))' <<<"$health_json")
+security_score=$(python3 -c 'import json,sys; j=json.loads(sys.stdin.read()); print(j.get("score",0))' <<<"$security_json")
+perf_score=$(python3 -c 'import json,sys; j=json.loads(sys.stdin.read()); print(j.get("score",0))' <<<"$perf_json")
+perf_mean=$(python3 -c 'import json,sys; j=json.loads(sys.stdin.read()); print(j.get("mean_ms",0))' <<<"$perf_json")
+perf_target=$(python3 -c 'import json,sys; j=json.loads(sys.stdin.read()); print(j.get("target_ms",0))' <<<"$perf_json")
+
+# Drift count
+if command -v chezmoi >/dev/null 2>&1; then
+  drift_count=$(chezmoi status 2>/dev/null | wc -l | tr -d ' ')
+else
+  drift_count=0
+fi
+
+dot_log info "scorecard_complete" "health=$health_score" "security=$security_score" "perf=$perf_score"
+dot_metric "scorecard_health" "$health_score" "percent"
+dot_metric "scorecard_security" "$security_score" "percent"
+dot_metric "scorecard_perf" "$perf_score" "percent"
+
+if $JSON_OUTPUT; then
+  cat <<JSON
+{
+  "health": {"score": $health_score, "warnings": $health_warnings, "failures": $health_failures},
+  "security": {"score": $security_score},
+  "performance": {"score": $perf_score, "mean_ms": $perf_mean, "target_ms": $perf_target},
+  "drift": {"count": $drift_count}
+}
+JSON
+  exit 0
+fi
+
+ui_dot_banner "Diagnostics"
+ui_header "Dotfiles Scorecard"
+
+ui_section "Scores"
+ui_kv "Health" "${health_score}/100"
+ui_kv "Security" "${security_score}/100"
+ui_kv "Performance" "${perf_score}/100 (avg ${perf_mean}ms, target ${perf_target}ms)"
+ui_kv "Drift" "${drift_count} file(s)"
+
+if [[ "$security_score" -lt 100 ]]; then
+  ui_warn "Security" "Run 'dot security-score' to reach 100/100"
+else
+  ui_ok "Security" "100/100"
+fi
+
+if [[ "$perf_score" -lt 100 ]]; then
+  ui_warn "Performance" "Tune startup to reach 100/100"
+else
+  ui_ok "Performance" "100/100"
+fi
+
+if [[ "$health_failures" -gt 0 ]]; then
+  ui_err "Health" "Failures detected (run 'dot heal')"
+elif [[ "$health_warnings" -gt 0 ]]; then
+  ui_warn "Health" "Warnings detected (run 'dot heal')"
+else
+  ui_ok "Health" "All checks passing"
+fi
+
+ui_section "Tips"
+ui_info "Fix" "dot heal"
+ui_info "Profile" "dot perf --profile"
+ui_info "Security" "dot security-score"
+ui_info "Drift" "dot drift"
+
+exit_code=0
+if [[ "$security_score" -lt 100 ]]; then
+  exit_code=1
+fi
+if [[ "$perf_score" -lt 100 ]]; then
+  exit_code=1
+fi
+exit "$exit_code"

package/scripts/diagnostics/secret-governance.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# shellcheck source=../lib/secrets_provider.sh
+# shellcheck disable=SC1091
+source "$REPO_ROOT/scripts/lib/secrets_provider.sh"
+
+STRICT="${DOTFILES_ALIAS_STRICT_MODE:-${DOTFILES_SECRETS_STRICT_MODE:-0}}"
+
+cd "$REPO_ROOT"
+
+mapfile -t staged_files < <(git diff --cached --name-only --diff-filter=ACM || true)
+if [[ "${#staged_files[@]}" -eq 0 ]]; then
+  echo "Secret governance: no staged files."
+  exit 0
+fi
+
+staged_content() {
+  local f
+  for f in "${staged_files[@]}"; do
+    git show -- ":$f" 2>/dev/null || true
+  done
+}
+
+violations=0
+tmp_content="$(umask 077 && mktemp)"
+trap 'rm -f "$tmp_content"' EXIT
+staged_content >"$tmp_content"
+
+scan_patterns="(api[_-]?key|api[_-]?secret|token|password)[[:space:]]*[:=][[:space:]]*[\"'][^\"']{8,}[\"']"
+if grep -Eqi "$scan_patterns" "$tmp_content"; then
+  echo "Secret governance: potential plaintext secret pattern detected in staged content."
+  violations=$((violations + 1))
+fi
+
+if [[ "$STRICT" == "1" ]]; then
+  while IFS= read -r key; do
+    [[ -n "$key" ]] || continue
+    value="$(dot_secrets_get "$key" || true)"
+    [[ -n "$value" ]] || continue
+    [[ "${#value}" -ge 8 ]] || continue
+
+    if grep -Fq "$value" "$tmp_content"; then
+      echo "Secret governance: exact managed secret value leaked for key: $key"
+      violations=$((violations + 1))
+    fi
+  done < <(dot_secrets_index_list)
+fi
+
+if [[ "$violations" -gt 0 ]]; then
+  echo "Secret governance failed: $violations violation(s)."
+  exit 1
+fi
+
+echo "Secret governance passed."