@sebastienrousseau/dotfiles 0.2.499 → 0.2.501

package/scripts/git-hooks/pre-push

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# =============================================================================
+# pre-push hook
+#
+# 1. Refuses to push any commit that is not GPG/SSH-signed.
+# 2. Runs `scripts/qa/reliability-audit.sh --quick`. The audit is mandatory
+#    by default; explicit per-push bypass requires `DOTFILES_ALLOW_UNSKIPPED_PUSH=1`,
+#    and every bypass is logged to `~/.local/share/dotfiles/audit-bypass.log`.
+#
+# The legacy `DOTFILES_SKIP_PRE_PUSH_AUDIT=1` env var (opt-out) is rejected
+# with a migration message. The new variable is intentionally awkwardly
+# named so that setting it requires deliberate intent. See
+# `docs/security/AUDIT_BYPASS.md`.
+# =============================================================================
+
+set -euo pipefail
+
+repo_root="$(git rev-parse --show-toplevel)"
+
+# -----------------------------------------------------------------------------
+# Step 1 — signed-commit enforcement (unchanged)
+# -----------------------------------------------------------------------------
+while read -r local_ref local_sha remote_ref remote_sha; do
+  [ "$local_sha" = "0000000000000000000000000000000000000000" ] && continue
+
+  if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
+    range="$local_sha"
+  elif git cat-file -e "${remote_sha}^{commit}" 2>/dev/null; then
+    range="$remote_sha..$local_sha"
+  else
+    # Remote tip is not in the local object store yet (push without prior fetch).
+    # Fall back to checking commits reachable from local tip.
+    range="$local_sha"
+  fi
+
+  for c in $(git rev-list "$range"); do
+    if ! git verify-commit "$c" >/dev/null 2>&1; then
+      echo "Blocked: unsigned commit $c" >&2
+      exit 1
+    fi
+  done
+done
+
+# -----------------------------------------------------------------------------
+# Step 2 — reject the legacy opt-out variable
+# -----------------------------------------------------------------------------
+if [ "${DOTFILES_SKIP_PRE_PUSH_AUDIT:-}" = "1" ]; then
+  cat >&2 <<'EOF'
+ERROR: DOTFILES_SKIP_PRE_PUSH_AUDIT is no longer honored.
+
+The pre-push audit was previously opt-out — setting one env var was enough
+to skip it. That made bypass invisible and routine. Effective with #871,
+the policy is fail-closed: the audit always runs unless you explicitly
+authorize a bypass for this single push.
+
+To bypass for one push:
+  DOTFILES_ALLOW_UNSKIPPED_PUSH=1 git push
+
+Every bypass is recorded to ~/.local/share/dotfiles/audit-bypass.log
+and surfaced by `dot doctor` if any are recent.
+
+See: docs/security/AUDIT_BYPASS.md
+EOF
+  exit 1
+fi
+
+# -----------------------------------------------------------------------------
+# Step 3 — run the audit (or log + skip if explicitly bypassed)
+# -----------------------------------------------------------------------------
+if [ "${DOTFILES_ALLOW_UNSKIPPED_PUSH:-}" = "1" ]; then
+  bypass_log_dir="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles"
+  # The audit-bypass log lives under XDG_STATE_HOME (user state — never
+  # checked in, never deployed by chezmoi to other locations).
+  mkdir -p "$bypass_log_dir"
+  bypass_log="$bypass_log_dir/audit-bypass.log"
+
+  ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  branch="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown)"
+  remote="$(git remote get-url --push @{upstream} 2>/dev/null ||
+    git config --get remote.origin.url 2>/dev/null ||
+    echo unknown)"
+  reason="${DOTFILES_BYPASS_REASON:-no reason given}"
+
+  printf '%s\tbranch=%s\tremote=%s\treason=%s\n' \
+    "$ts" "$branch" "$remote" "$reason" >>"$bypass_log"
+
+  echo "WARN: pre-push audit bypassed (logged to $bypass_log)" >&2
+  exit 0
+fi
+
+bash "$repo_root/scripts/qa/reliability-audit.sh" --quick

package/scripts/git-hooks/prepare-commit-msg

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Appends the EUXIS branding signature to every commit message.
+# Signature source: ~/.euxis/data/config/branding/signature.txt
+
+set -euo pipefail
+
+# R5: validate commit message file argument
+if [[ -z "${1:-}" || ! -f "${1:-}" ]]; then
+  exit 0 # No file provided — git will handle the error
+fi
+
+COMMIT_MSG_FILE="$1"
+COMMIT_SOURCE="${2:-}"
+
+# Skip merge commits, amends with existing signature, and squash
+case "$COMMIT_SOURCE" in
+  merge | squash) exit 0 ;;
+esac
+
+SIGNATURE_FILE="$HOME/.euxis/data/config/branding/signature.txt"
+
+# Only append if the signature file exists and message doesn't already have it
+if [[ -f "$SIGNATURE_FILE" ]]; then
+  signature=$(cat "$SIGNATURE_FILE")
+  if ! grep -qF "THE ARCHITECT" "$COMMIT_MSG_FILE" 2>/dev/null; then
+    printf '\n%s\n' "$signature" >>"$COMMIT_MSG_FILE"
+  fi
+fi

package/scripts/lib/secrets_provider.sh

@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Provider-agnostic secrets bridge for dotfiles.
+
+set -euo pipefail
+
+DOT_SECRETS_HOME="${DOT_SECRETS_HOME:-$HOME/.config/dotfiles/secrets}"
+DOT_SECRETS_STORE_DIR="${DOT_SECRETS_STORE_DIR:-$DOT_SECRETS_HOME/store}"
+DOT_SECRETS_INDEX_FILE="${DOT_SECRETS_INDEX_FILE:-$DOT_SECRETS_HOME/index.txt}"
+DOT_SECRETS_AGE_KEY="${DOT_SECRETS_AGE_KEY:-$HOME/.config/chezmoi/key.txt}"
+DOT_SECRETS_SERVICE_PREFIX="${DOT_SECRETS_SERVICE_PREFIX:-dotfiles.secret}"
+
+dot_secrets_ensure_layout() {
+  mkdir -p "$DOT_SECRETS_STORE_DIR"
+  touch "$DOT_SECRETS_INDEX_FILE"
+  chmod 700 "$DOT_SECRETS_HOME" 2>/dev/null || true
+  chmod 700 "$DOT_SECRETS_STORE_DIR" 2>/dev/null || true
+  chmod 600 "$DOT_SECRETS_INDEX_FILE" 2>/dev/null || true
+}
+
+dot_secrets_provider() {
+  local provider="${DOTFILES_SECRETS_PROVIDER:-auto}"
+  if [[ "$provider" != "auto" ]]; then
+    printf "%s\n" "$provider"
+    return 0
+  fi
+
+  if [[ "${OSTYPE:-}" == darwin* ]] && command -v security >/dev/null 2>&1; then
+    printf "macos-keychain\n"
+    return 0
+  fi
+  if command -v pass >/dev/null 2>&1; then
+    printf "pass\n"
+    return 0
+  fi
+  if command -v age >/dev/null 2>&1 && [[ -f "$DOT_SECRETS_AGE_KEY" ]]; then
+    printf "plain-enc\n"
+    return 0
+  fi
+  printf "none\n"
+}
+
+dot_secrets_index_add() {
+  local key="${1:-}"
+  [[ -n "$key" ]] || return 1
+  dot_secrets_ensure_layout
+  if ! grep -qxF "$key" "$DOT_SECRETS_INDEX_FILE" 2>/dev/null; then
+    printf "%s\n" "$key" >>"$DOT_SECRETS_INDEX_FILE"
+  fi
+}
+
+dot_secrets_index_list() {
+  dot_secrets_ensure_layout
+  awk 'NF > 0' "$DOT_SECRETS_INDEX_FILE" | sort -u
+}
+
+dot_secrets_store_macos() {
+  local key="$1"
+  local value="$2"
+  local service="${DOT_SECRETS_SERVICE_PREFIX}.${key}"
+  security add-generic-password -U -a "${USER:-dotfiles}" -s "$service" -w "$value" >/dev/null
+}
+
+dot_secrets_get_macos() {
+  local key="$1"
+  local service="${DOT_SECRETS_SERVICE_PREFIX}.${key}"
+  security find-generic-password -a "${USER:-dotfiles}" -s "$service" -w 2>/dev/null || return 1
+}
+
+dot_secrets_store_pass() {
+  local key="$1" value="$2"
+  printf "%s\n" "$value" | pass insert -m -f "dotfiles/${key}" >/dev/null
+}
+
+dot_secrets_get_pass() {
+  local key="$1"
+  pass show "dotfiles/${key}" 2>/dev/null | head -n1
+}
+
+dot_secrets_store_plain_enc() {
+  local key="$1" value="$2"
+  local tmp_rec file
+  [[ -f "$DOT_SECRETS_AGE_KEY" ]] || {
+    echo "age key not found: $DOT_SECRETS_AGE_KEY" >&2
+    return 1
+  }
+  command -v age >/dev/null 2>&1 || {
+    echo "age not installed" >&2
+    return 1
+  }
+  command -v age-keygen >/dev/null 2>&1 || {
+    echo "age-keygen not installed" >&2
+    return 1
+  }
+  dot_secrets_ensure_layout
+  tmp_rec="$(umask 077 && mktemp)"
+  file="$DOT_SECRETS_STORE_DIR/${key}.age"
+  trap 'rm -f "$tmp_rec"' RETURN
+  age-keygen -y "$DOT_SECRETS_AGE_KEY" >"$tmp_rec"
+  printf "%s" "$value" | age -R "$tmp_rec" -o "$file"
+  chmod 600 "$file" 2>/dev/null || true
+}
+
+dot_secrets_get_plain_enc() {
+  local key="$1"
+  local file="$DOT_SECRETS_STORE_DIR/${key}.age"
+  [[ -f "$DOT_SECRETS_AGE_KEY" ]] || return 1
+  [[ -f "$file" ]] || return 1
+  age -d -i "$DOT_SECRETS_AGE_KEY" "$file" 2>/dev/null || return 1
+}
+
+dot_secrets_set() {
+  local key="${1:-}" value="${2:-}" provider
+  [[ -n "$key" ]] || return 1
+  provider="$(dot_secrets_provider)"
+  case "$provider" in
+    macos-keychain) dot_secrets_store_macos "$key" "$value" ;;
+    pass) dot_secrets_store_pass "$key" "$value" ;;
+    plain-enc) dot_secrets_store_plain_enc "$key" "$value" ;;
+    *)
+      echo "No supported secrets provider detected." >&2
+      return 1
+      ;;
+  esac
+  dot_secrets_index_add "$key"
+}
+
+dot_secrets_get() {
+  local key="${1:-}" provider
+  [[ -n "$key" ]] || return 1
+  provider="$(dot_secrets_provider)"
+  case "$provider" in
+    macos-keychain) dot_secrets_get_macos "$key" ;;
+    pass) dot_secrets_get_pass "$key" ;;
+    plain-enc) dot_secrets_get_plain_enc "$key" ;;
+    *) return 1 ;;
+  esac
+}
+
+dot_secrets_bucket_keys() {
+  local data_file="${1:-}" bucket="${2:-}"
+  [[ -f "$data_file" ]] || return 1
+  [[ -n "$bucket" ]] || return 1
+  awk -v b="$bucket" '
+    $0 ~ "^[[:space:]]*" b "[[:space:]]*=" {
+      line=$0
+      gsub(/^.*\[/, "", line)
+      gsub(/\].*$/, "", line)
+      gsub(/"/, "", line)
+      n=split(line, arr, ",")
+      for (i=1; i<=n; i++) {
+        gsub(/^[[:space:]]+|[[:space:]]+$/, "", arr[i])
+        if (arr[i] != "") print arr[i]
+      }
+      exit
+    }
+  ' "$data_file"
+}

package/scripts/maintenance/check-updates.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Dependency update checker for nightly CI
+# Reports available updates for all project dependencies
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+REPORT_DIR="$REPO_ROOT/nightly-reports"
+
+mkdir -p "$REPORT_DIR"
+
+check_github_actions_updates() {
+  echo "=== GitHub Actions Updates ===" >>"$REPORT_DIR/updates.txt"
+
+  # Extract all GitHub Actions from workflow files
+  find "$REPO_ROOT/.github/workflows" -name "*.yml" -o -name "*.yaml" | while read -r workflow; do
+    echo "Checking $(basename "$workflow")..." >&2
+    grep -E "uses: [^@]+@v[0-9]+" "$workflow" | sed 's/.*uses: //' | sort -u >>"$REPORT_DIR/actions-current.txt" 2>/dev/null || true
+  done
+
+  if [[ -f "$REPORT_DIR/actions-current.txt" ]]; then
+    # For each action, check if newer version exists (simplified check)
+    while read -r action_version; do
+      if [[ -n "$action_version" ]]; then
+        action_name=$(echo "$action_version" | cut -d'@' -f1)
+        current_version=$(echo "$action_version" | cut -d'@' -f2)
+        echo "  $action_name: $current_version (check manually)" >>"$REPORT_DIR/updates.txt"
+      fi
+    done <"$REPORT_DIR/actions-current.txt"
+  fi
+
+  echo "" >>"$REPORT_DIR/updates.txt"
+}
+
+check_precommit_updates() {
+  echo "=== Pre-commit Hook Updates ===" >>"$REPORT_DIR/updates.txt"
+
+  if command -v pre-commit &>/dev/null && [[ -f "$REPO_ROOT/.pre-commit-config.yaml" ]]; then
+    cd "$REPO_ROOT"
+    pre-commit autoupdate --dry-run >>"$REPORT_DIR/updates.txt" 2>&1 || true
+  else
+    echo "pre-commit not available or config missing" >>"$REPORT_DIR/updates.txt"
+  fi
+
+  echo "" >>"$REPORT_DIR/updates.txt"
+}
+
+check_chezmoi_updates() {
+  echo "=== Chezmoi Updates ===" >>"$REPORT_DIR/updates.txt"
+
+  if command -v curl &>/dev/null; then
+    LATEST_VERSION=$(curl -s "https://api.github.com/repos/twpayne/chezmoi/releases/latest" | grep '"tag_name"' | cut -d'"' -f4 | sed 's/^v//')
+    CURRENT_VERSION=$(grep "CHEZMOI_VERSION:" "$REPO_ROOT/.github/workflows/ci.yml" | cut -d'"' -f2 | head -1)
+
+    echo "Current Chezmoi: $CURRENT_VERSION" >>"$REPORT_DIR/updates.txt"
+    echo "Latest Chezmoi:  $LATEST_VERSION" >>"$REPORT_DIR/updates.txt"
+
+    if [[ "$CURRENT_VERSION" != "$LATEST_VERSION" ]]; then
+      echo "⚠️  Chezmoi update available: $CURRENT_VERSION → $LATEST_VERSION" >>"$REPORT_DIR/updates.txt"
+    else
+      echo "✅ Chezmoi is up to date" >>"$REPORT_DIR/updates.txt"
+    fi
+  else
+    echo "curl not available - cannot check Chezmoi version" >>"$REPORT_DIR/updates.txt"
+  fi
+
+  echo "" >>"$REPORT_DIR/updates.txt"
+}
+
+check_security_tools_updates() {
+  echo "=== Security Tools Updates ===" >>"$REPORT_DIR/updates.txt"
+
+  # Check shellcheck version
+  if command -v shellcheck &>/dev/null; then
+    SHELLCHECK_VERSION=$(shellcheck --version | grep version: | cut -d' ' -f2)
+    echo "Shellcheck: $SHELLCHECK_VERSION" >>"$REPORT_DIR/updates.txt"
+  fi
+
+  # Check other tools if available
+  for tool in shfmt stylua luacheck; do
+    if command -v "$tool" &>/dev/null; then
+      VERSION=$($tool --version 2>&1 | head -1 || echo "unknown")
+      echo "$tool: $VERSION" >>"$REPORT_DIR/updates.txt"
+    fi
+  done
+
+  echo "" >>"$REPORT_DIR/updates.txt"
+}
+
+generate_summary() {
+  {
+    echo "=== Update Summary ==="
+    echo "Generated: $(date -Iseconds)"
+    echo "Repository: $REPO_ROOT"
+    echo ""
+  } >>"$REPORT_DIR/updates.txt"
+
+  # Count potential updates (simplified heuristic)
+  local update_count
+  update_count=$(grep -c "⚠️\|→" "$REPORT_DIR/updates.txt" 2>/dev/null || echo "0")
+
+  if [[ $update_count -gt 0 ]]; then
+    echo "🔄 $update_count potential updates found" >>"$REPORT_DIR/updates.txt"
+  else
+    echo "✅ All dependencies appear current" >>"$REPORT_DIR/updates.txt"
+  fi
+}
+
+main() {
+  echo "Dependency Update Checker"
+  echo "========================"
+  echo "Checking for available updates..."
+
+  # Clear previous report
+  true >"$REPORT_DIR/updates.txt"
+
+  check_chezmoi_updates
+  check_precommit_updates
+  check_github_actions_updates
+  check_security_tools_updates
+  generate_summary
+
+  echo "Report generated: $REPORT_DIR/updates.txt"
+  echo ""
+  echo "Summary:"
+  tail -10 "$REPORT_DIR/updates.txt"
+}
+
+main "$@"

package/scripts/ops/ai-setup.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Universal AI Toolchain Setup & Authentication.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/dot/lib/ui.sh"
+
+ui_header "Universal AI Toolchain Setup"
+
+setup_tool() {
+  local name="$1"
+  local cmd="$2"
+  local auth_cmd="$3"
+
+  ui_section "Setting up $name"
+  if command -v "$cmd" >/dev/null 2>&1; then
+    ui_info "Tool found, initiating authentication..."
+    eval "$auth_cmd" || ui_warn "$name" "Setup/Auth skipped or failed."
+  else
+    ui_err "$name" "Binary not found. Run 'dot apply' or install via mise first."
+  fi
+}
+
+# 1. Claude
+setup_tool "Claude CLI" "claude" "claude --version" # Claude handles auth via web flow or env
+
+# 2. Gemini
+setup_tool "Gemini CLI" "gemini" "gemini info"
+
+# 3. Copilot
+setup_tool "Copilot CLI" "copilot" "copilot --version"
+
+# 4. Kiro
+setup_tool "Kiro CLI" "kiro-cli" "kiro-cli auth login"
+
+# 6. Aider
+setup_tool "Aider" "aider" "aider --version"
+
+# 7. Autohand Code
+setup_tool "Autohand Code" "autohand" "autohand --version"
+
+# 8. Mistral Vibe
+setup_tool "Mistral Vibe" "vibe" "vibe --version"
+
+# 9. Qwen Code
+setup_tool "Qwen Code" "qwen" "qwen --version"
+
+# 10. ZAI
+setup_tool "ZAI" "zai" "zai --version"
+
+ui_header "AI Setup Complete"
+ui_info "All tools are ready. Use 'dot ai' to check status."

package/scripts/ops/bundle.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Create an offline bundle of the dotfiles environment for air-gapped systems.
+
+set -euo pipefail
+
+_cleanup_files=()
+trap 'rm -f "${_cleanup_files[@]}"' EXIT
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/dot/lib/ui.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/dot/lib/log.sh"
+export DOT_COMMAND="bundle"
+
+# Concurrency guard
+LOCK_FILE="${XDG_RUNTIME_DIR:-/tmp}/dotfiles-bundle.lock"
+exec 9>"$LOCK_FILE"
+if ! flock -n 9; then
+  ui_warn "Already running" "Another bundle instance is active"
+  exit 0
+fi
+
+OUTPUT_DIR="${1:-$HOME/Downloads}"
+TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
+BUNDLE_FILE="$OUTPUT_DIR/dotfiles_offline_bundle_$TIMESTAMP.tar.zst"
+
+dot_log info "bundle_start"
+ui_header "Creating Offline Bundle (Zero-Network Mode)"
+
+# Ensure target directory exists
+mkdir -p "$OUTPUT_DIR"
+
+ui_info "Gathering artifacts..."
+# We use zstd for much faster compression of binary artifacts compared to gzip/xz
+if ! command -v tar >/dev/null || ! command -v zstd >/dev/null; then
+  ui_err "tar and zstd are required for bundling."
+  exit 1
+fi
+
+# Define paths to bundle
+declare -a paths_to_bundle=(
+  "$HOME/.dotfiles"
+  "$HOME/.config/chezmoi"
+  "$HOME/.local/share/mise"
+)
+
+# Optional: Add nix store if present and requested
+if [[ -d "/nix/store" ]] && [[ "${DOTFILES_BUNDLE_NIX:-0}" == "1" ]]; then
+  ui_warn "Including Nix store. This will be very large."
+  paths_to_bundle+=("/nix/store" "/nix/var/nix" "$HOME/.nix-profile")
+fi
+
+# Filter only existing paths
+declare -a valid_paths=()
+for p in "${paths_to_bundle[@]}"; do
+  if [[ -e "$p" ]]; then
+    valid_paths+=("$p")
+    ui_bullet "Adding: $p"
+  fi
+done
+
+ui_info "Compressing artifacts (this may take a while)..."
+# Use absolute paths and store them relative to / to preserve structure
+tar --zstd -cf "$BUNDLE_FILE" -P "${valid_paths[@]}" 2>/dev/null || {
+  ui_err "Failed to create bundle."
+  exit 1
+}
+
+bundle_size=$(stat -c '%s' "$BUNDLE_FILE" 2>/dev/null || stat -f '%z' "$BUNDLE_FILE" 2>/dev/null || echo 0)
+dot_log info "bundle_end" "file=$BUNDLE_FILE"
+dot_metric "bundle_size" "$bundle_size" "bytes"
+ui_ok "Bundle created" "$BUNDLE_FILE"
+ui_info "To restore on an offline machine:"
+ui_bullet "tar --zstd -xf $BUNDLE_FILE -P"
+ui_bullet "cd ~/.dotfiles && ./install.sh --force"

package/scripts/ops/chaos.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Chaos Engineering: Randomly corrupt config files to test self-healing (dot heal)
+# USE WITH CAUTION: This intentionally breaks your environment.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+ui_init
+
+if [[ "${1:-}" != "--force" ]]; then
+  ui_err "WARNING" "This script will intentionally break your dotfiles configuration."
+  ui_info "Purpose" "Tests 'dot heal' auto-repair capabilities."
+  echo ""
+  ui_info "To run, execute" "${0} --force"
+  exit 1
+fi
+
+ui_warn "Initiating Chaos Engineering Sequence..."
+
+# Target files for corruption/deletion
+TARGETS=(
+  "$HOME/.config/starship.toml"
+  "$HOME/.zshrc"
+  "$HOME/.config/alacritty/alacritty.toml"
+)
+
+# 1. Configuration Deletion
+for target in "${TARGETS[@]}"; do
+  if [[ -f "$target" ]] || [[ -L "$target" ]]; then
+    ui_err "Destroying" "$target"
+    rm -f "$target"
+  fi
+done
+
+# 2. Symlink Corruption
+ui_err "Creating" "broken symlinks..."
+ln -sf /tmp/nonexistent_file_xyz "$HOME/.config/broken_symlink_test"
+
+# 3. Path Mutation
+ui_err "Corrupting" "PATH..."
+export PATH="/bin"
+
+echo ""
+ui_ok "Chaos injected" "State is drifted and broken."
+ui_info "Recover" "dot heal"