@sebastienrousseau/dotfiles 0.2.499 → 0.2.501

package/scripts/diagnostics/security-score.sh

@@ -0,0 +1,438 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Security Score Assessment.
+##
+## Evaluates system security posture across encryption, SSH, Git, system
+## hardening, and secrets management. Returns a letter grade (A+ to F) with
+## actionable recommendations.
+##
+## # Usage
+## dot security-score [--verbose|-v] [--json|-j] [--quiet|-q]
+##
+## # Dependencies
+## - age: Encryption tool check
+## - sops: Secrets manager check
+## - gpg: Key management check
+## - git: Commit signing verification
+##
+## # Platform Notes
+## - macOS: Checks socketfilterfw, FileVault, Little Snitch
+## - Linux: Checks ufw/firewalld, LUKS encryption
+## - WSL: Checks host encryption, virtualization detection
+##
+## # Security
+## Does not modify system state. Read-only checks only.
+##
+## # Idempotency
+## Safe to run repeatedly. No side effects.
+
+set -euo pipefail
+set +o xtrace 2>/dev/null || true
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+
+# Parse arguments
+VERBOSE=true
+JSON_OUTPUT=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --verbose | -v)
+      VERBOSE=true
+      shift
+      ;;
+    --quiet | -q)
+      VERBOSE=false
+      shift
+      ;;
+    --json | -j)
+      JSON_OUTPUT=true
+      shift
+      ;;
+    *) shift ;;
+  esac
+done
+
+ui_init
+NC="${NORMAL}"
+RED="${RED:-}"
+GREEN="${GREEN:-}"
+YELLOW="${YELLOW:-}"
+
+# Scoring
+TOTAL_POINTS=0
+MAX_POINTS=0
+declare -A CATEGORY_SCORES
+
+add_points() {
+  local category="$1"
+  local points="$2"
+  local max="$3"
+  local description="$4"
+
+  TOTAL_POINTS=$((TOTAL_POINTS + points))
+  MAX_POINTS=$((MAX_POINTS + max))
+  CATEGORY_SCORES["$category"]=$((${CATEGORY_SCORES[$category]:-0} + points))
+
+  if ! $JSON_OUTPUT && $VERBOSE; then
+    local icon
+    local color=""
+    if [[ $points -eq $max ]]; then
+      icon="✓"
+      color="$GREEN"
+    elif [[ $points -gt 0 ]]; then
+      icon="◐"
+      color="$YELLOW"
+    else
+      icon="✗"
+      color="$RED"
+    fi
+
+    if [[ "$UI_ENABLED" = "1" ]]; then
+      ui_status "$icon" "[OK]" "$description" "$points/$max pts" "$color"
+    else
+      ui_bullet "$description ($points/$max pts)"
+    fi
+  fi
+}
+
+print_header() {
+  if ! $JSON_OUTPUT; then
+    echo ""
+    ui_dot_banner "Diagnostics"
+    ui_header "Security Score Assessment"
+    echo ""
+  fi
+}
+
+section() {
+  if ! $JSON_OUTPUT; then
+    echo ""
+    ui_section "$1"
+    if [[ "$UI_ENABLED" != "1" ]]; then
+      echo "───────────────────────────────────────────────"
+    fi
+  fi
+}
+
+# === Security Checks ===
+
+check_encryption() {
+  section "Encryption (30 pts max)"
+
+  # Age encryption tool
+  if command -v age >/dev/null 2>&1; then
+    add_points "encryption" 5 5 "Age encryption installed"
+  else
+    add_points "encryption" 0 5 "Age encryption installed"
+  fi
+
+  # Age key exists
+  if [[ -f "${HOME}/.config/chezmoi/key.txt" ]]; then
+    add_points "encryption" 5 5 "Age encryption key present"
+
+    # Check key permissions
+    local perms
+    perms=$(stat -c "%a" "${HOME}/.config/chezmoi/key.txt" 2>/dev/null || stat -f "%OLp" "${HOME}/.config/chezmoi/key.txt" 2>/dev/null)
+    if [[ "$perms" == "600" ]]; then
+      add_points "encryption" 5 5 "Key file permissions (600)"
+    else
+      add_points "encryption" 2 5 "Key file permissions (600)"
+    fi
+  else
+    add_points "encryption" 0 10 "Age encryption configured"
+  fi
+
+  # SOPS available
+  if command -v sops >/dev/null 2>&1; then
+    add_points "encryption" 5 5 "SOPS secrets manager"
+  else
+    add_points "encryption" 0 5 "SOPS secrets manager"
+  fi
+
+  # GPG available
+  if command -v gpg >/dev/null 2>&1 && gpg --list-secret-keys 2>/dev/null | grep -q sec; then
+    add_points "encryption" 10 10 "GPG keys configured"
+  elif command -v gpg >/dev/null 2>&1; then
+    add_points "encryption" 3 10 "GPG keys configured"
+  else
+    add_points "encryption" 0 10 "GPG keys configured"
+  fi
+}
+
+check_ssh() {
+  section "SSH Security (25 pts max)"
+
+  # SSH directory permissions
+  if [[ -d "${HOME}/.ssh" ]]; then
+    local ssh_perms
+    ssh_perms=$(stat -c "%a" "${HOME}/.ssh" 2>/dev/null || stat -f "%OLp" "${HOME}/.ssh" 2>/dev/null)
+    if [[ "$ssh_perms" == "700" ]]; then
+      add_points "ssh" 5 5 "SSH directory permissions (700)"
+    else
+      add_points "ssh" 2 5 "SSH directory permissions (700)"
+    fi
+  else
+    add_points "ssh" 0 5 "SSH directory exists"
+  fi
+
+  # ED25519 key (preferred over RSA)
+  if [[ -f "${HOME}/.ssh/id_ed25519" ]]; then
+    add_points "ssh" 10 10 "ED25519 SSH key (modern)"
+  elif [[ -f "${HOME}/.ssh/id_rsa" ]]; then
+    add_points "ssh" 5 10 "SSH key present (RSA)"
+  else
+    add_points "ssh" 0 10 "SSH key present"
+  fi
+
+  # SSH agent
+  if [[ -n "${SSH_AUTH_SOCK:-}" ]] || pgrep -x ssh-agent >/dev/null 2>&1; then
+    add_points "ssh" 5 5 "SSH agent running"
+  else
+    add_points "ssh" 0 5 "SSH agent running"
+  fi
+
+  # SSH config exists
+  if [[ -f "${HOME}/.ssh/config" ]]; then
+    add_points "ssh" 5 5 "SSH config present"
+  else
+    add_points "ssh" 2 5 "SSH config present"
+  fi
+}
+
+check_git() {
+  section "Git Security (20 pts max)"
+
+  # Git installed
+  if ! command -v git >/dev/null 2>&1; then
+    add_points "git" 0 20 "Git installed"
+    return
+  fi
+
+  # Commit signing
+  if git config --global commit.gpgsign 2>/dev/null | grep -q true; then
+    add_points "git" 10 10 "Commit signing enabled"
+  else
+    add_points "git" 0 10 "Commit signing enabled"
+  fi
+
+  # User identity configured
+  if git config --global user.email >/dev/null 2>&1 && git config --global user.name >/dev/null 2>&1; then
+    add_points "git" 5 5 "Git identity configured"
+  else
+    add_points "git" 0 5 "Git identity configured"
+  fi
+
+  # Credential helper
+  if git config --global credential.helper >/dev/null 2>&1; then
+    add_points "git" 5 5 "Credential helper configured"
+  else
+    add_points "git" 0 5 "Credential helper configured"
+  fi
+}
+
+check_system() {
+  section "System Security (15 pts max)"
+
+  # Firewall (macOS or Linux)
+  if [[ "$(uname)" == "Darwin" ]]; then
+    if /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2>/dev/null | grep -q enabled; then
+      add_points "system" 5 5 "Firewall enabled"
+    elif pgrep -x "Little Snitch" >/dev/null 2>&1 || [[ -d "/Applications/Little Snitch.app" ]]; then
+      add_points "system" 5 5 "Firewall enabled (Little Snitch)"
+    else
+      add_points "system" 0 5 "Firewall enabled"
+    fi
+  else
+    # Check ufw via systemctl (doesn't need sudo) or sudo ufw status
+    local fw_enabled=false
+    if systemctl is-active --quiet ufw 2>/dev/null; then
+      fw_enabled=true
+    elif command -v ufw >/dev/null 2>&1 && sudo -n ufw status 2>/dev/null | grep -q "Status: active"; then
+      fw_enabled=true
+    elif command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state 2>/dev/null | grep -q running; then
+      fw_enabled=true
+    fi
+
+    if $fw_enabled; then
+      add_points "system" 5 5 "Firewall enabled"
+    else
+      add_points "system" 0 5 "Firewall enabled"
+    fi
+  fi
+
+  # Disk encryption (LUKS, FileVault, or ecryptfs)
+  if [[ "$(uname)" == "Darwin" ]]; then
+    if fdesetup status 2>/dev/null | grep -q "FileVault is On"; then
+      add_points "system" 10 10 "Disk encryption (FileVault)"
+    else
+      add_points "system" 0 10 "Disk encryption (FileVault)"
+    fi
+  else
+    local encryption_found=false
+    # Check LUKS
+    if lsblk 2>/dev/null | grep -q crypt || [[ -d /sys/block/dm-0 ]]; then
+      encryption_found=true
+      add_points "system" 10 10 "Disk encryption (LUKS)"
+    # Check Apple T2 chip (hardware SSD encryption)
+    elif lspci 2>/dev/null | grep -qi "T2.*Secure Enclave"; then
+      encryption_found=true
+      add_points "system" 10 10 "Hardware encryption (Apple T2)"
+    # Check ecryptfs (encrypted home)
+    elif mount 2>/dev/null | grep -q ecryptfs || [[ -d "$HOME/.ecryptfs" ]]; then
+      encryption_found=true
+      add_points "system" 10 10 "Home encryption (ecryptfs)"
+    # Check if running in encrypted VM/container
+    elif [[ -f /sys/class/dmi/id/product_name ]] && grep -qiE "virtual|vmware|kvm|qemu" /sys/class/dmi/id/product_name 2>/dev/null; then
+      encryption_found=true
+      add_points "system" 10 10 "Virtualized (host encryption)"
+    fi
+
+    if ! $encryption_found; then
+      add_points "system" 0 10 "Disk encryption"
+    fi
+  fi
+}
+
+check_secrets() {
+  section "Secrets Management (10 pts max)"
+
+  # No secrets in dotfiles repo
+  if [[ -d "${HOME}/.dotfiles" ]]; then
+    local secrets_found=false
+    local match=""
+    # Check for common secret patterns, ignore templates/placeholders and variable expansions.
+    match=$(grep -rE "(api_key|api_secret|password|token)[[:space:]]*=[[:space:]]*['\"][^'\"]+['\"]" \
+      "${HOME}/.dotfiles" --include="*.sh" --include="*.zsh" --include="*.toml" 2>/dev/null |
+      grep -v "example\\|template\\|placeholder" | grep -F -v "\${" | head -1 || true)
+    if [[ -n "$match" ]]; then
+      secrets_found=true
+    fi
+
+    if $secrets_found; then
+      add_points "secrets" 0 5 "No hardcoded secrets"
+    else
+      add_points "secrets" 5 5 "No hardcoded secrets"
+    fi
+  else
+    add_points "secrets" 5 5 "No hardcoded secrets"
+  fi
+
+  # Environment variables for secrets
+  if [[ -f "${HOME}/.config/secrets/api-keys.env" ]] || [[ -d "${HOME}/.config/secrets" ]]; then
+    add_points "secrets" 5 5 "Secrets in dedicated location"
+  else
+    add_points "secrets" 2 5 "Secrets management setup"
+  fi
+}
+
+print_summary() {
+  local score=$((TOTAL_POINTS * 100 / MAX_POINTS))
+
+  if $JSON_OUTPUT; then
+    echo "{"
+    echo "  \"score\": $score,"
+    echo "  \"points\": $TOTAL_POINTS,"
+    echo "  \"max_points\": $MAX_POINTS,"
+    echo "  \"grade\": \"$(get_grade $score)\","
+    echo "  \"categories\": {"
+    local first=true
+    for cat in "${!CATEGORY_SCORES[@]}"; do
+      $first || echo ","
+      first=false
+      printf "    \"%s\": %d" "$cat" "${CATEGORY_SCORES[$cat]}"
+    done
+    echo ""
+    echo "  }"
+    echo "}"
+    return
+  fi
+
+  echo ""
+  ui_header "Security Score"
+  echo ""
+
+  local bar_width=28
+  local filled=$((score * bar_width / 100))
+  local empty=$((bar_width - filled))
+  local block="#"
+  local pad="-"
+
+  local grade
+  grade=$(get_grade $score)
+
+  printf "  Score: "
+  if [[ $score -ge 80 ]]; then
+    printf '%s' "${GREEN}"
+  elif [[ $score -ge 60 ]]; then
+    printf '%s' "${YELLOW}"
+  else
+    printf '%s' "${RED}"
+  fi
+  printf "%${filled}s" | tr ' ' "$block"
+  printf '%s' "${NC}"
+  printf "%${empty}s" | tr ' ' "$pad"
+  printf " %s%%  Grade: %s\n" "${score}" "${grade}"
+
+  printf '%b\n' "\n  Points: ${TOTAL_POINTS}/${MAX_POINTS}"
+  echo ""
+
+  # Recommendations
+  if [[ $score -lt 100 ]]; then
+    ui_header "Recommendations"
+    if ! command -v age >/dev/null 2>&1; then
+      ui_bullet "Install age for encryption: brew install age"
+    fi
+    if ! command -v sops >/dev/null 2>&1; then
+      ui_bullet "Install SOPS for secrets: brew install sops"
+    fi
+    if ! git config --global commit.gpgsign 2>/dev/null | grep -q true; then
+      ui_bullet "Enable commit signing: git config --global commit.gpgsign true"
+    fi
+    if [[ ! -f "${HOME}/.ssh/id_ed25519" ]]; then
+      ui_bullet "Generate ED25519 SSH key: ssh-keygen -t ed25519"
+    fi
+    echo ""
+  fi
+}
+
+get_grade() {
+  local score=$1
+  if [[ $score -ge 95 ]]; then
+    echo "A+"
+  elif [[ $score -ge 90 ]]; then
+    echo "A"
+  elif [[ $score -ge 85 ]]; then
+    echo "A-"
+  elif [[ $score -ge 80 ]]; then
+    echo "B+"
+  elif [[ $score -ge 75 ]]; then
+    echo "B"
+  elif [[ $score -ge 70 ]]; then
+    echo "B-"
+  elif [[ $score -ge 65 ]]; then
+    echo "C+"
+  elif [[ $score -ge 60 ]]; then
+    echo "C"
+  elif [[ $score -ge 55 ]]; then
+    echo "C-"
+  elif [[ $score -ge 50 ]]; then
+    echo "D"
+  else
+    echo "F"
+  fi
+}
+
+# Main
+export LANG="${LANG:-en_US.UTF-8}"
+export LC_ALL="${LC_ALL:-en_US.UTF-8}"
+
+print_header
+check_encryption
+check_ssh
+check_git
+check_system
+check_secrets
+print_summary

package/scripts/diagnostics/smoke-test.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Smoke tests to quickly verify toolchain health after installation/updates.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+ui_init
+
+ui_header "Dotfiles Smoke Tests"
+
+declare -i passed=0
+declare -i failed=0
+
+check_cmd() {
+  local cmd="$1"
+  if command -v "$cmd" >/dev/null 2>&1; then
+    return 0
+  fi
+  if command -v mise >/dev/null 2>&1; then
+    if mise ls --installed 2>/dev/null | grep -qE "($cmd|aqua:.*$cmd)"; then
+      return 0
+    fi
+  fi
+  return 1
+}
+
+verify_cmd() {
+  local cmd="$1"
+  local expected_output="${2:-}"
+
+  if ! check_cmd "$cmd"; then
+    ui_err "$cmd" "not found"
+    failed+=1
+    return 1
+  fi
+
+  if [[ -n "$expected_output" ]]; then
+    local output
+    # shellcheck disable=SC2015
+    output=$($cmd --version 2>&1 || $cmd version 2>&1 || true)
+    if echo "$output" | grep -q "$expected_output"; then
+      ui_ok "$cmd"
+      passed+=1
+    else
+      ui_err "$cmd" "output mismatch"
+      failed+=1
+    fi
+  else
+    ui_ok "$cmd"
+    passed+=1
+  fi
+}
+
+# Core utilities
+verify_cmd "git" "git version"
+verify_cmd "zsh" "zsh"
+verify_cmd "chezmoi" "chezmoi version"
+
+# Rust Toolchain / Frontier
+verify_cmd "rg" "ripgrep"
+verify_cmd "bat" "bat"
+verify_cmd "eza" "eza"
+verify_cmd "zoxide" "zoxide"
+verify_cmd "zellij" "zellij"
+verify_cmd "shfmt" "3."
+
+# Process management
+verify_cmd "pueue" "pueue"
+
+# AI Tools
+# Prevent sgpt from prompting for a key by piping empty string
+export OPENAI_API_KEY="sk-placeholder-for-testing"
+verify_cmd "sgpt" "ShellGPT"
+verify_cmd "copilot" "copilot"
+verify_cmd "kiro-cli" "kiro-cli"
+
+echo ""
+if [[ $failed -eq 0 ]]; then
+  ui_ok "All $passed tests passed"
+else
+  ui_err "$failed failed" "$passed passed"
+  exit 1
+fi

package/scripts/diagnostics/snapshot.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Snapshot current system/tooling state
+# Usage: dot snapshot [--baseline|-b] [--force|-f]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+
+ui_init
+
+BASELINE=false
+FORCE=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --baseline | -b)
+      BASELINE=true
+      shift
+      ;;
+    --force | -f)
+      FORCE=true
+      shift
+      ;;
+    *) shift ;;
+  esac
+done
+
+STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/snapshots"
+mkdir -p "$STATE_DIR"
+
+if $BASELINE; then
+  output="$STATE_DIR/baseline.json"
+else
+  output="$STATE_DIR/snapshot_$(date +%Y%m%d_%H%M%S).json"
+fi
+
+if [[ -f "$output" && "$FORCE" != "true" ]]; then
+  ui_warn "Snapshot" "${output} already exists (use --force)"
+  exit 0
+fi
+
+safe() { printf '%s' "$1" | sed 's/"/\\"/g'; }
+
+get_version() {
+  local cmd="$1"
+  if command -v "$cmd" >/dev/null 2>&1; then
+    "$cmd" --version 2>/dev/null | head -1 | awk '{print $NF}'
+  else
+    echo ""
+  fi
+}
+
+os_name=$(uname -s 2>/dev/null || echo "unknown")
+kernel=$(uname -r 2>/dev/null || echo "unknown")
+shell_name=$(basename "${SHELL:-}" 2>/dev/null || echo "")
+
+dot_version=""
+if [[ -f "$SCRIPT_DIR/../../package.json" ]]; then
+  dot_version=$(sed -n 's/^[[:space:]]*"version"[[:space:]]*:[[:space:]]*"\([0-9.]*\)".*/\1/p' "$SCRIPT_DIR/../../package.json" | head -1)
+fi
+
+cat >"$output" <<JSON
+{
+  "timestamp": "$(date -Iseconds)",
+  "os": "$(safe "$os_name")",
+  "kernel": "$(safe "$kernel")",
+  "shell": "$(safe "$shell_name")",
+  "dotfiles_version": "$(safe "$dot_version")",
+  "tools": {
+    "chezmoi": "$(safe "$(get_version chezmoi)")",
+    "git": "$(safe "$(get_version git)")",
+    "zsh": "$(safe "$(get_version zsh)")",
+    "node": "$(safe "$(get_version node)")",
+    "python": "$(safe "$(python3 --version 2>/dev/null | awk '{print $2}')")",
+    "rustc": "$(safe "$(rustc --version 2>/dev/null | awk '{print $2}')")",
+    "go": "$(safe "$(go version 2>/dev/null | awk '{print $3}')")",
+    "nvim": "$(safe "$(nvim --version 2>/dev/null | head -1 | awk '{print $2}')")",
+    "tmux": "$(safe "$(tmux -V 2>/dev/null | awk '{print $2}')")",
+    "starship": "$(safe "$(get_version starship)")",
+    "mise": "$(safe "$(get_version mise)")"
+  }
+}
+JSON
+
+ui_dot_banner "Diagnostics"
+ui_ok "Snapshot" "$output"