@sebastienrousseau/dotfiles 0.2.500 → 0.2.502

package/dot_config/zsh/rc.d/30-options.zsh.tmpl

@@ -64,7 +64,7 @@ fi
 {{- end }}
 {{- /* When node_manager = "mise", Node.js is handled by mise activate in dot_zshrc.tmpl */}}
 
-# Completions: pre-warmed by `dot prewarm`, generated on-demand as fallback
+# Completions: generated on-demand on first interactive shell and cached
 if [[ "${DOTFILES_FAST:-0}" != "1" ]] && [[ "${DOTFILES_ULTRA_FAST:-0}" != "1" ]]; then
   [[ ! -f "${ZSH_COMPLETIONS_DIR}/_gh" ]] && command -v gh >/dev/null &&
     command gh completion -s zsh >| "${ZSH_COMPLETIONS_DIR}/_gh"
@@ -112,24 +112,44 @@ if [[ "${DOTFILES_FAST:-0}" != "1" ]] && [[ "${DOTFILES_ULTRA_FAST:-0}" != "1" ]
   }
   sdk() { _lazy_load_sdkman; sdk "$@"; }
 fi
-# Defer compinit to first prompt — opt-in for max performance
+# Defer compinit to first prompt — opt-in for max performance.
+#
+# Cache lifecycle (closes #864):
+#   * dump path lives at $XDG_CACHE_HOME/zsh/zcompdump-$ZSH_VERSION so
+#     the user-state directory is clean (and zsh's own search picks up
+#     `.zwc` siblings automatically — non-laptop profiles get the
+#     benefit even without re-running compinit).
+#   * `compinit -C` (skip security-check, use the cached dump) is used
+#     when the dump is fresh (< 24 h); full `compinit` rebuilds when
+#     the dump is older.
+#   * The dump is `zcompile`d in the background after each rebuild so
+#     subsequent shells load the bytecode form directly.
+#   * The fpath corpus itself is precompiled at chezmoi-apply time by
+#     `run_onchange_after_zcompile-completions.sh.tmpl` — that runs
+#     once per fpath change, not per shell start.
 : ${DOTFILES_ENABLE_COMPINIT:=0}
 : ${DOTFILES_DEFER_COMPINIT:=1}
+
+_DOTFILES_ZCOMPDUMP="${XDG_CACHE_HOME:-${HOME}/.cache}/zsh/zcompdump-${ZSH_VERSION:-${ZSH_NAME:-unknown}}"
+
 if [[ "${DOTFILES_ENABLE_COMPINIT}" == "1" ]] && [[ "${DOTFILES_FAST:-0}" != "1" ]] && [[ "${DOTFILES_ULTRA_FAST:-0}" != "1" ]]; then
   autoload -Uz compinit
+  [[ -d "${_DOTFILES_ZCOMPDUMP:h}" ]] || mkdir -p "${_DOTFILES_ZCOMPDUMP:h}"
+
   _deferred_compinit() {
     if [[ "${DOTFILES_DEFER_COMPINIT}" == "1" ]]; then
       _dotfiles_del_preexec _deferred_compinit
     else
       _dotfiles_del_precmd _deferred_compinit
     fi
-    if [[ -n ${ZDOTDIR}/.zcompdump(#qN.mh+24) ]]; then
-      compinit
+    # Fresh dump (< 24 h) → use cached fast path; otherwise rebuild.
+    if [[ -n ${_DOTFILES_ZCOMPDUMP}(#qN.mh+24) ]]; then
+      compinit -d "${_DOTFILES_ZCOMPDUMP}"
     else
-      compinit -C
+      compinit -C -d "${_DOTFILES_ZCOMPDUMP}"
     fi
-    # Compile zcompdump to bytecode in background for faster subsequent loads
-    { [[ ! -f "${ZDOTDIR}/.zcompdump.zwc" || "${ZDOTDIR}/.zcompdump" -nt "${ZDOTDIR}/.zcompdump.zwc" ]] && zcompile "${ZDOTDIR}/.zcompdump" } &!
+    # Compile to bytecode in background for faster subsequent loads
+    { [[ ! -f "${_DOTFILES_ZCOMPDUMP}.zwc" || "${_DOTFILES_ZCOMPDUMP}" -nt "${_DOTFILES_ZCOMPDUMP}.zwc" ]] && zcompile "${_DOTFILES_ZCOMPDUMP}" } &!
   }
   if [[ "${DOTFILES_DEFER_COMPINIT}" == "1" ]]; then
     _dotfiles_add_preexec _deferred_compinit

package/dot_local/bin/executable_bm

@@ -2,6 +2,8 @@
 # Universal directory bookmarking with history support
 # Works across Bash, Zsh, and Fish
 
+set -eu
+
 # Cross-platform sed in-place (BSD vs GNU)
 _sed_i() {
   if sed --version >/dev/null 2>&1; then

package/dot_local/bin/executable_dot

@@ -3,7 +3,7 @@
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
 set -euo pipefail
 
-# Dotfiles CLI Entry Point - v0.2.500
+# Dotfiles CLI Entry Point - v0.2.502
 
 # Ensure XDG Base Directory variables are set
 export XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
@@ -21,7 +21,7 @@ if [ -e "${HOME}/.nix-profile/etc/profile.d/nix.sh" ]; then
   . "${HOME}/.nix-profile/etc/profile.d/nix.sh"
 fi
 
-VERSION="0.2.500"
+VERSION="0.2.502"
 
 COMMAND="${1:-}"
 if [ -n "${1:-}" ]; then
@@ -160,6 +160,7 @@ Start Here|sync|Apply dotfiles to this machine.|Use after clone or after changes
 Start Here|doctor|Check the environment and surface issues.|Use when something feels off.
 Start Here|learn|Open the guided tour.|Best first stop for new users.
 Start Here|help|Show the overview or help for one command.|Use `dot help <command>` for detail.
+Daily Use|init|Bootstrap a foreign dotfiles repo through chezmoi + dot.|Usage: `dot init <github-user>`.
 Daily Use|status|Show local drift.|See what changed since the last apply.
 Daily Use|diff|Preview pending changes.|Safe way to inspect before applying.
 Daily Use|edit|Open the source directory.|Use the configured editor.
@@ -172,6 +173,8 @@ AI and Agents|ai|Show installed AI tools.|Launches the AI status view.
 AI and Agents|mcp|Inspect MCP policy and registry.|Supports `--strict|-s` and `--json|-j`.
 AI and Agents|mode|Show or set the agent profile.|Profiles: ask, plan, apply, audit.
 AI and Agents|agent|Show agent metadata, logs, checkpoints, and conformance.|Use for card, log, checkpoint, and conformance.
+AI and Agents|agents|Multi-harness agent context (AGENTS.md sync, Cursor/Codex stubs).|Subcommands: list, check, render.
+Fleet|registry|Browse reusable dotfile modules from the dot registry.|Subcommands: list, search, info, install, url, set-url.
 Fleet|fleet|Show fleet node status, drift, and namespace.|Enterprise fleet management.
 Configuration|env|Show managed tool versions.|Backed by mise.
 Configuration|profile|Show or switch the active profile.|Use for machine-specific behavior.
@@ -269,7 +272,6 @@ health|Run the health dashboard with optional fixes.|dot health -v\ndot health -
 perf|Measure shell performance and emit structured timing.|dot perf -j -r 1\ndot perf -p\ndot perf -t 200
 security-score|Assess workstation security posture.|dot security-score -j\ndot security-score -q
 snapshot|Capture the current workstation snapshot.|dot snapshot -b\ndot snapshot -b -f
-verify|Run post-change verification checks.|dot verify\ndot verify -s
 restore|Restore from a backup or git ref.|dot restore -l\ndot restore -L\ndot restore -g HEAD~1
 rollback|Restore a previous configuration snapshot.|dot rollback
 lint|Run shell quality checks for the repo.|dot lint\ndot lint -c\ndot lint -f
@@ -304,15 +306,14 @@ _dot_command_routes() {
   cat <<'EOF'
 sync|core
 apply|core
+init|init
 update|core
 add|core
 diff|core
 status|core
-remove|core
 cd|core
 edit|core
 commit|core
-clean-cache|core
 doctor|diagnostics
 scorecard|diagnostics
 score|diagnostics
@@ -328,12 +329,10 @@ heal|diagnostics
 health|diagnostics
 health-check|diagnostics
 smoke-test|diagnostics
-verify|diagnostics
 attest|diagnostics
 attestation|diagnostics
 security-score|diagnostics
 drift|diagnostics
-benchmark|diagnostics
 intelligence|diagnostics
 conflicts|diagnostics
 locks|diagnostics
@@ -344,12 +343,19 @@ ai-setup|ai
 ai-query|ai
 cl|ai
 claude|ai
+codex|ai
+copilot|ai
 gemini|ai
+goose|ai
 kiro|ai
 sgpt|ai
 ollama|ai
 opencode|ai
 aider|ai
+autohand|ai
+vibe|ai
+qwen|ai
+zai|ai
 env|tools
 profile|tools
 tools|tools
@@ -378,7 +384,6 @@ lock-screen|security
 usb-safety|security
 upgrade|meta
 cache-refresh|meta
-prewarm|meta
 docs|meta
 learn|meta
 keys|meta
@@ -386,7 +391,9 @@ sandbox|meta
 mcp|meta
 mode|meta
 agent|meta
+agents|agents
 fleet|fleet
+registry|registry
 patterns|patterns
 manual|manual
 search|search
@@ -532,6 +539,8 @@ if [[ -z "$COMMAND" ]]; then
   exit 0
 fi
 
+# `|| true` is intentional: an unknown command yields an empty route, which falls
+# through the case below into the user-command path that emits the proper error.
 route="$(_dot_command_route "$COMMAND" || true)"
 
 case "$route" in
@@ -539,6 +548,42 @@ case "$route" in
     _dispatch "$route" "$@"
     ;;
 
+  agents)
+    if [[ -n "$_SOURCE_DIR" ]] && [[ -f "$_SOURCE_DIR/scripts/dot/commands/agents.sh" ]]; then
+      # shellcheck disable=SC1091
+      source "$_SOURCE_DIR/scripts/dot/commands/agents.sh"
+      cmd_agents "$@"
+      exit $?
+    else
+      ui_fail "agents.sh not found"
+      exit 1
+    fi
+    ;;
+
+  init)
+    if [[ -n "$_SOURCE_DIR" ]] && [[ -f "$_SOURCE_DIR/scripts/dot/commands/init.sh" ]]; then
+      # shellcheck disable=SC1091
+      source "$_SOURCE_DIR/scripts/dot/commands/init.sh"
+      cmd_init "$@"
+      exit $?
+    else
+      ui_fail "init.sh not found"
+      exit 1
+    fi
+    ;;
+
+  registry)
+    if [[ -n "$_SOURCE_DIR" ]] && [[ -f "$_SOURCE_DIR/scripts/dot/commands/registry.sh" ]]; then
+      # shellcheck disable=SC1091
+      source "$_SOURCE_DIR/scripts/dot/commands/registry.sh"
+      cmd_registry "$@"
+      exit $?
+    else
+      ui_fail "registry.sh not found"
+      exit 1
+    fi
+    ;;
+
   manual)
     if [[ -n "$_SOURCE_DIR" ]] && [[ -f "$_SOURCE_DIR/scripts/dot/commands/manual.sh" ]]; then
       exec bash "$_SOURCE_DIR/scripts/dot/commands/manual.sh" "$@"
@@ -579,7 +624,9 @@ case "$route" in
   *)
     _user_cmd="${XDG_CONFIG_HOME:-$HOME/.config}/dotfiles/commands/${COMMAND}.sh"
     if [[ -f "$_user_cmd" ]]; then
-      source "$_user_cmd" "$@"
+      # Run in a subshell so a user `exit` doesn't kill the dot CLI.
+      (source "$_user_cmd" "$@")
+      exit $?
     else
       echo "Unknown command: ${COMMAND:-}" >&2
       echo "Run 'dot help' for available commands." >&2

package/dot_local/bin/executable_dot-bootstrap

@@ -30,7 +30,6 @@ step "Starting Deterministic Bootstrap (v0.2.493 Frontier)"
 # 1. Install Nix (if not present)
 if ! command -v nix >/dev/null 2>&1; then
   step "Installing Nix Package Manager..."
-  local nix_installer
   nix_installer=$(umask 077 && mktemp)
   if ! curl -fsSL -o "$nix_installer" https://nixos.org/nix/install; then
     rm -f "$nix_installer"

package/dot_local/bin/executable_dot-load-benchmark

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -e
+set -euo pipefail
 
 # Measure time to load heavy layers in a fresh interactive shell
 # Usage: dot-load-benchmark [runs]

package/dot_local/bin/executable_dot-theme-sync

@@ -466,14 +466,14 @@ reload_desktop() {
     local highlight_color
     case "$accent" in
       -1) highlight_color="0.847059 0.847059 0.862745 Graphite" ;;
-      0)  highlight_color="0.968627 0.831373 0.792157 Red" ;;
-      1)  highlight_color="0.968627 0.890196 0.745098 Orange" ;;
-      2)  highlight_color="1.000000 0.937255 0.690196 Yellow" ;;
-      3)  highlight_color="0.752941 0.964706 0.678431 Green" ;;
-      4)  highlight_color="0.698039 0.843137 1.000000 Blue" ;;
-      5)  highlight_color="0.968627 0.831373 1.000000 Purple" ;;
-      6)  highlight_color="1.000000 0.749020 0.823529 Pink" ;;
-      *)  highlight_color="0.698039 0.843137 1.000000 Blue" ;;
+      0) highlight_color="0.968627 0.831373 0.792157 Red" ;;
+      1) highlight_color="0.968627 0.890196 0.745098 Orange" ;;
+      2) highlight_color="1.000000 0.937255 0.690196 Yellow" ;;
+      3) highlight_color="0.752941 0.964706 0.678431 Green" ;;
+      4) highlight_color="0.698039 0.843137 1.000000 Blue" ;;
+      5) highlight_color="0.968627 0.831373 1.000000 Purple" ;;
+      6) highlight_color="1.000000 0.749020 0.823529 Pink" ;;
+      *) highlight_color="0.698039 0.843137 1.000000 Blue" ;;
     esac
 
     if defaults write -g AppleAccentColor -int "$accent" >/dev/null 2>&1 &&

package/dot_local/bin/executable_notify

@@ -2,6 +2,8 @@
 # Universal desktop notification (notify)
 # Supports macOS (osascript), Linux (notify-send), and WSL (powershell)
 
+set -eu
+
 title="${1:-Notification}"
 message="${2:-}"
 

package/dot_local/bin/executable_open

@@ -2,6 +2,8 @@
 # Universal file opener (open)
 # Maps to open (macOS), xdg-open (Linux), and explorer.exe (WSL)
 
+set -eu
+
 target="${1:-.}"
 
 # Helper for rich feedback if TTY is present

package/dot_local/bin/executable_tour

@@ -1,6 +1,8 @@
 #!/bin/sh
 # Interactive Tour using Gum
-# Part of Dotfiles v0.2.500
+# Part of Dotfiles v0.2.502
+
+set -eu
 
 if ! command -v gum >/dev/null; then
   echo "Error: 'gum' is not installed."
@@ -37,7 +39,7 @@ banner='██████╗  ██████╗ ████████╗
 ██████╔╝╚██████╔╝   ██║   ██║     ██║███████╗███████╗███████║
 ╚═════╝  ╚═════╝    ╚═╝   ╚═╝     ╚═╝╚══════╝╚══════╝╚══════╝
 
-v0.2.500 · Infrastructure‑grade shell environment'
+v0.2.502 · Infrastructure‑grade shell environment'
 
 gum style \
   --foreground 212 --border-foreground 212 --border double \

package/dot_local/bin/executable_up

@@ -2,7 +2,9 @@
 # Universal directory navigation with history support
 # Works across Bash, Zsh, and Fish
 
-levels=$1
+set -eu
+
+levels=${1:-1}
 target=".."
 
 case "$levels" in

package/dot_local/share/man/man1/dot.1

@@ -1,4 +1,4 @@
-.TH DOT 1 "April 2026" "dotfiles v0.2.500" "User Commands"
+.TH DOT 1 "May 2026" "dotfiles v0.2.502" "User Commands"
 .SH NAME
 dot \- dotfiles management CLI
 .SH SYNOPSIS

package/dot_local/share/zsh/completions/_dot

@@ -29,6 +29,10 @@ _dot() {
     'edit:Open chezmoi source in \$EDITOR'
     'commit:AI-powered conventional commit'
     'patterns:Manage AI steering patterns'
+    'init:Bootstrap a foreign dotfiles repo through chezmoi + dot'
+    'agents:Multi-harness agent context (AGENTS.md sync, Cursor/Codex stubs)'
+    'manual:Open or download the multi-format manual'
+    'search:Find commands by keyword'
 
     # Diagnostics
     'doctor:Check system health and configuration'

package/install.sh

@@ -52,7 +52,7 @@ show_help() {
 Usage: install.sh [version] [options]
 
 Arguments:
-  version       The version (tag or branch) to install (default: v0.2.500)
+  version       The version (tag or branch) to install (default: v0.2.502)
 
 Options:
   --help        Show this help message
@@ -64,7 +64,7 @@ EOF
 }
 
 main() {
-  local version="v0.2.500"
+  local version="v0.2.502"
   local version_set=0
   local minimal=0
   local _cleanup_files=()
@@ -72,20 +72,28 @@ main() {
 
   for arg in "$@"; do
     case "$arg" in
-      --help)
+      -h | --help)
         show_help
         exit 0
         ;;
       --silent) export DOTFILES_SILENT=1 ;;
       --force) export DOTFILES_NONINTERACTIVE=1 ;;
       --minimal) minimal=1 ;;
-      --*)
+      -*)
+        # Catch single-dash and double-dash unknowns the same way.
         error "Unknown option: $arg"
         ;;
       *)
         if [[ $version_set -eq 1 ]]; then
           error "Multiple versions specified: $version and $arg"
         fi
+        # Validate the positional looks like a semver (with or without
+        # leading v). Reject garbage early so an unknown positional
+        # like `foobar` doesn't trigger a 30s+ network download attempt.
+        # Caught by the install.sh fuzz harness (#881).
+        if [[ ! "$arg" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([-+][a-zA-Z0-9.-]+)?$ ]]; then
+          error "Unrecognized positional argument '$arg' — expected a semver version (e.g. v0.2.502)."
+        fi
         version="$arg"
         version_set=1
         ;;
@@ -127,10 +135,29 @@ main() {
       sudo mkdir -p /etc/apt/keyrings
       curl -fsSL https://repo.charm.sh/apt/gpg.key |
         sudo gpg --batch --yes --dearmor -o /etc/apt/keyrings/charm.gpg
-      # Verify Charm GPG key fingerprint
-      if ! gpg --no-default-keyring --keyring /etc/apt/keyrings/charm.gpg \
-        --list-keys --with-colons 2>/dev/null | grep -q "fid:"; then
-        echo "Warning: Could not verify Charm GPG key" >&2
+      # Pin the Charm GPG key fingerprint — a DNS attacker swapping
+      # repo.charm.sh/apt/gpg.key for a forged key with the same uid
+      # would otherwise pass the prior "any fid: present" check.
+      # Pinned value taken from https://repo.charm.sh/apt/gpg.key on
+      # 2026-05-16. If Charm rotates, update this and call it out in
+      # CHANGELOG.md.
+      CHARM_GPG_EXPECTED_FPR="C026D31B92F9BBE91D5DB75AB07AE17C9E0A6585"
+      charm_actual_fpr="$(gpg --no-default-keyring \
+        --keyring /etc/apt/keyrings/charm.gpg \
+        --with-colons --fingerprint 2>/dev/null |
+        awk -F: '/^fpr:/{print $10; exit}')"
+      if [[ -z "$charm_actual_fpr" ]]; then
+        echo "Error: Could not extract Charm GPG fingerprint — aborting" >&2
+        sudo rm -f /etc/apt/keyrings/charm.gpg
+        return 1
+      fi
+      if [[ "$charm_actual_fpr" != "$CHARM_GPG_EXPECTED_FPR" ]]; then
+        echo "Error: Charm GPG fingerprint mismatch" >&2
+        echo "  expected: $CHARM_GPG_EXPECTED_FPR" >&2
+        echo "  got:      $charm_actual_fpr" >&2
+        echo "  aborting (possible DNS / keyserver hijack)" >&2
+        sudo rm -f /etc/apt/keyrings/charm.gpg
+        return 1
       fi
       echo "deb [signed-by=/etc/apt/keyrings/charm.gpg] https://repo.charm.sh/apt/ * *" | sudo tee /etc/apt/sources.list.d/charm.list
       sudo apt-get update && sudo apt-get install gum -y >/dev/null 2>&1
@@ -152,43 +179,31 @@ main() {
       mkdir -p "$bin_dir"
       echo "   Installing chezmoi via binary download..."
 
-      # Prefer verified installer with SHA256 checksum when available
+      # Prefer verified installer with SHA256 checksum when available.
+      # When verification fails or the verified installer isn't present
+      # we refuse to bootstrap rather than silently downloading and
+      # executing an unverified script (the previous fall-back to
+      # `get.chezmoi.io` was an unsigned bootstrap and a security hole).
       local verified_installer
       verified_installer="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/scripts/ci/install-chezmoi-verified.sh"
       if [[ -x "$verified_installer" ]] || [[ -f "$verified_installer" ]]; then
         echo "   Using checksum-verified installer..."
         if ! bash "$verified_installer" "${CHEZMOI_VERSION:-2.47.1}" "$bin_dir"; then
-          echo "   Verified installer failed, falling back to get.chezmoi.io" >&2
-        else
-          return 0
+          echo "" >&2
+          echo "   The verified chezmoi installer failed." >&2
+          echo "   Refusing to fall back to an unverified bootstrap path." >&2
+          echo "   Install chezmoi manually from a trusted source, then re-run install.sh:" >&2
+          echo "     macOS:  brew install chezmoi" >&2
+          echo "     Linux:  see https://www.chezmoi.io/install/" >&2
+          return 1
         fi
+        return 0
       fi
-
-      # Fallback: download installer with size/shebang validation
-      local installer
-      installer=$(umask 077 && mktemp)
-      if ! curl -fsSL -o "$installer" https://get.chezmoi.io; then
-        rm -f "$installer"
-        echo "   Failed to download chezmoi installer" >&2
-        return 1
-      fi
-      # Validate: must be a shell script and not suspiciously large
-      if [[ "$(wc -c <"$installer")" -gt 102400 ]]; then
-        rm -f "$installer"
-        echo "   Chezmoi installer suspiciously large. Aborting." >&2
-        return 1
-      fi
-      if ! head -1 "$installer" | grep -q '^#!/'; then
-        rm -f "$installer"
-        echo "   Chezmoi installer doesn't look like a shell script. Aborting." >&2
-        return 1
-      fi
-      if ! BINDIR="$bin_dir" sh "$installer"; then
-        rm -f "$installer"
-        echo "   chezmoi binary installer failed" >&2
-        return 1
-      fi
-      rm -f "$installer"
+      echo "" >&2
+      echo "   scripts/ci/install-chezmoi-verified.sh is missing; cannot verify chezmoi bootstrap." >&2
+      echo "   Install chezmoi manually (brew install chezmoi / official binary)" >&2
+      echo "   and re-run install.sh." >&2
+      return 1
     fi
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/dotfiles",
-  "version": "0.2.500",
+  "version": "0.2.502",
   "description": "The Trusted Shell Platform — Universal dotfiles managed by Chezmoi. Features Bash & Zsh for macOS, Linux & WSL. Rust modern tooling & enterprise-grade security.",
   "main": "install.sh",
   "bin": {

package/scripts/ci/check-dangerous-chmod.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# =============================================================================
+# check-dangerous-chmod.sh — block `chmod 777` / `chmod 666` patterns
+# from landing in shell scripts.
+#
+# Invoked as a pre-commit local hook (no filename args; scans the repo).
+# Extracted from `config/pre-commit-config.yaml` under #866.
+# =============================================================================
+
+set -euo pipefail
+
+PATTERN='^[[:space:]]*chmod[[:space:]]+(-R[[:space:]]+)?(777|666)'
+
+if grep -rn --include='*.sh' -E "$PATTERN" . 2>/dev/null | grep -v '^Binary'; then
+  echo "ERROR: Dangerous chmod patterns found (777 or 666)." >&2
+  echo "Use the minimum permissions actually required; document any exception." >&2
+  exit 1
+fi