@sebastienrousseau/dotfiles 0.2.500 → 0.2.502

package/scripts/dot/commands/fleet.sh

@@ -291,10 +291,21 @@ cmd_fleet_namespace() {
       local data_file
       data_file="$(resolve_source_dir)/.chezmoidata.toml"
       if grep -q "^namespace = " "$data_file" 2>/dev/null; then
-        if sed --version >/dev/null 2>&1; then
-          sed -i "s/^namespace = \".*\"/namespace = \"$new_ns\"/" "$data_file"
+        # Atomic write: render into a tempfile + mv so concurrent
+        # `dot fleet namespace set` callers can't corrupt the TOML.
+        # Avoids `sed -i` portability dance (GNU `-i` vs BSD `-i ''`).
+        local _tmp
+        _tmp="$(mktemp "${data_file}.XXXXXX")" || die "Cannot create tempfile"
+        # Explicit if/else instead of A && B || C — the latter (SC2015)
+        # silently runs C when B itself fails, masking real mv errors.
+        if sed "s/^namespace = \".*\"/namespace = \"$new_ns\"/" "$data_file" >"$_tmp"; then
+          if ! mv "$_tmp" "$data_file"; then
+            rm -f "$_tmp"
+            die "Failed to commit namespace update"
+          fi
         else
-          sed -i '' "s/^namespace = \".*\"/namespace = \"$new_ns\"/" "$data_file"
+          rm -f "$_tmp"
+          die "Failed to render namespace update"
         fi
       fi
       ui_ok "Namespace" "Set to '$new_ns'. Run 'dot sync' to apply."
@@ -349,6 +360,266 @@ cmd_fleet_enforce() {
   esac
 }
 
+_fleet_hosts_file() {
+  printf '%s\n' "${DOTFILES_FLEET_HOSTS:-$HOME/.config/dotfiles/fleet.toml}"
+}
+
+# Parse the hosts file. Format:
+#   [hosts.laptop]
+#   ssh = "user@laptop.local"
+#   profile = "workstation"
+#
+# Echoes one record per line: "<name>\t<ssh-target>\t<profile>".
+_fleet_hosts_iter() {
+  local f
+  f="$(_fleet_hosts_file)"
+  [[ -f "$f" ]] || return 0
+  awk '
+    BEGIN { name = ""; ssh = ""; profile = "" }
+    /^\[hosts\./ {
+      if (name != "") { printf "%s\t%s\t%s\n", name, ssh, profile }
+      gsub(/[\[\]]/, "", $0); sub(/^hosts\./, "", $0); name = $0
+      ssh = ""; profile = ""
+      next
+    }
+    /^ssh[[:space:]]*=/    { sub(/^ssh[[:space:]]*=[[:space:]]*/, ""); gsub(/"/, ""); ssh = $0; next }
+    /^profile[[:space:]]*=/ { sub(/^profile[[:space:]]*=[[:space:]]*/, ""); gsub(/"/, ""); profile = $0; next }
+    END {
+      if (name != "") { printf "%s\t%s\t%s\n", name, ssh, profile }
+    }
+  ' "$f"
+}
+
+# SSH-based "dot fleet apply" — push the local dotfiles state out to
+# each registered host. The §3 hero-feature: nobody else owns the
+# "Ansible for personal devices" niche.
+cmd_fleet_apply() {
+  local dry_run=0 only_host="" cmd="" jobs=4 verify_hosts=0
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --dry-run | -n)
+        dry_run=1
+        shift
+        ;;
+      --verify-hosts)
+        # Pre-flight check that every host already has a known_hosts
+        # entry, closing the TOFU window before any SSH connection.
+        # R3 audit N4. Without this, accept-new is the default and a
+        # first-connection MITM can seed an attacker key.
+        verify_hosts=1
+        shift
+        ;;
+      --host)
+        only_host="$2"
+        shift 2
+        ;;
+      --cmd)
+        cmd="$2"
+        shift 2
+        ;;
+      --jobs | -j)
+        jobs="$2"
+        shift 2
+        ;;
+      --help | -h)
+        cat <<EOF
+Usage: dot fleet apply [--host <name>] [--cmd <shell>] [--dry-run] [--jobs <n>]
+
+Push dotfiles state to every host registered in:
+  ${DOTFILES_FLEET_HOSTS:-\$HOME/.config/dotfiles/fleet.toml}
+
+Format of fleet.toml:
+  [hosts.laptop]
+  ssh     = "user@laptop.local"
+  profile = "workstation"
+
+Hostnames are validated against [A-Za-z0-9._@:+/-]+ before any SSH
+fan-out; invalid entries abort the apply.
+
+First-time SSH connections use StrictHostKeyChecking=accept-new (TOFU).
+If your threat model requires no TOFU window, pre-populate
+~/.ssh/known_hosts before running this command.
+
+Behavior:
+  By default each host runs:  dot sync && dot doctor --quiet
+  Override with --cmd "<shell>" to run an arbitrary command on every
+  host (e.g. --cmd "uptime").
+
+  WARNING: --cmd is the trust boundary. Whatever string you pass
+  executes on every remote host with the credentials your SSH key
+  carries. Verify the command before running.
+
+Flags:
+  --host <name>      Apply to a single host only.
+  --cmd <shell>      Run a custom command instead of 'dot sync'.
+  --dry-run, -n      Print resolved hosts + planned command; don't SSH.
+  --jobs <n>         Parallelism (default 4).
+  --verify-hosts     Refuse to open any SSH connection unless every
+                     target host already has a key in ~/.ssh/known_hosts.
+                     Use when your threat model excludes the TOFU window.
+EOF
+        return 0
+        ;;
+      *)
+        ui_err "Unknown arg" "$1"
+        return 1
+        ;;
+    esac
+  done
+
+  local hosts_file
+  hosts_file="$(_fleet_hosts_file)"
+  if [[ ! -f "$hosts_file" ]]; then
+    ui_err "Fleet" "no hosts file at $hosts_file"
+    ui_info "Hint" "create it with stanzas like '[hosts.laptop]\\nssh = \"user@laptop.local\"'"
+    return 1
+  fi
+
+  local entries
+  entries="$(_fleet_hosts_iter)"
+  if [[ -z "$entries" ]]; then
+    ui_err "Fleet" "hosts file is empty: $hosts_file"
+    return 1
+  fi
+  if [[ -n "$only_host" ]]; then
+    entries="$(printf '%s\n' "$entries" | awk -F'\t' -v h="$only_host" '$1 == h')"
+    [[ -n "$entries" ]] || {
+      ui_err "Fleet" "host not found: $only_host"
+      return 1
+    }
+  fi
+
+  local default_cmd='dot sync && dot doctor --quiet'
+  local effective_cmd="${cmd:-$default_cmd}"
+
+  ui_header "Fleet apply"
+  ui_info "Hosts file" "$hosts_file"
+  ui_info "Command" "$effective_cmd"
+  ui_info "Parallel" "$jobs"
+
+  if [[ "$dry_run" -eq 1 ]]; then
+    printf '%s\n' "$entries" | while IFS=$'\t' read -r name ssh profile; do
+      ui_info "$name" "$ssh  profile=$profile  cmd=$effective_cmd"
+    done
+    ui_ok "Dry-run" "no SSH connections opened"
+    return 0
+  fi
+
+  if ! command -v ssh >/dev/null 2>&1; then
+    ui_err "ssh" "not installed"
+    return 127
+  fi
+
+  local total=0 ok=0 fail=0
+  local tmpdir
+  # `-t` template includes PID + random, so two concurrent `dot fleet
+  # apply` invocations from the same user can't collide on $tmpdir.
+  tmpdir="$(mktemp -d -t dotfiles-fleet.XXXXXX)"
+  # Capture tmpdir's value at trap-definition time (via the eval-on-
+  # define `printf -v`), NOT at trap-fire time. A naive
+  # `trap 'rm -rf "$tmpdir"' RETURN` is unsafe under set -u because
+  # `local tmpdir` is destroyed before the RETURN trap evaluates.
+  # The SC2064 warning ("Use single quotes, otherwise this expands now
+  # rather than when signalled") is exactly the behaviour we want here —
+  # we explicitly want eager expansion. Suppress per-line.
+  local _cleanup
+  printf -v _cleanup 'rm -rf %q' "$tmpdir"
+  # shellcheck disable=SC2064
+  trap "$_cleanup" RETURN
+
+  # Validate every hostname against a conservative regex BEFORE fan-out.
+  # `user@host:port` characters only — refuses single quotes, backticks,
+  # `$()`, semicolons, spaces, any shell metacharacter. Closes the
+  # round-2 audit's hostname-injection finding.
+  while IFS=$'\t' read -r name ssh profile; do
+    [[ -n "$name" ]] || continue
+    if [[ ! "$ssh" =~ ^[a-zA-Z0-9._@:+/-]+$ ]]; then
+      ui_err "$name" "invalid ssh target ($ssh) — only [a-zA-Z0-9._@:+/-] allowed"
+      return 1
+    fi
+  done <<<"$entries"
+
+  # --verify-hosts: refuse the apply when any target host is missing
+  # from ~/.ssh/known_hosts. Closes the R3 audit N4 TOFU-window gap.
+  if ((verify_hosts == 1)); then
+    local known_hosts="${HOME}/.ssh/known_hosts"
+    if [[ ! -f "$known_hosts" ]]; then
+      ui_err "verify-hosts" "no $known_hosts — populate before --verify-hosts"
+      return 1
+    fi
+    local unknown_count=0
+    while IFS=$'\t' read -r name ssh profile; do
+      [[ -n "$name" && -n "$ssh" ]] || continue
+      # Strip `user@` prefix and `:port` suffix for the lookup.
+      local hostpart="${ssh#*@}"
+      hostpart="${hostpart%%:*}"
+      if ! ssh-keygen -F "$hostpart" -f "$known_hosts" >/dev/null 2>&1; then
+        ui_err "$name" "no known_hosts entry for $hostpart — would TOFU on first connect"
+        unknown_count=$((unknown_count + 1))
+      fi
+    done <<<"$entries"
+    if ((unknown_count > 0)); then
+      ui_err "verify-hosts" "$unknown_count host(s) missing from known_hosts — aborting"
+      return 1
+    fi
+    ui_ok "verify-hosts" "all hosts found in known_hosts"
+  fi
+
+  # Run one SSH per host, parallelised via background jobs with a
+  # semaphore. We DO NOT use `xargs -d` because that flag is GNU-only
+  # and the §3 hero feature must work on macOS BSD xargs too. Also
+  # avoids embedding `{}` substitution into a `bash -c` (the previous
+  # implementation had a quoting hazard around TOML hostnames).
+  _fleet_apply_one() {
+    local _name="$1" _ssh="$2" _cmd="$3" _tmp="$4"
+    if ssh -o BatchMode=yes -o ConnectTimeout=10 \
+      -o StrictHostKeyChecking=accept-new \
+      "$_ssh" "$_cmd" </dev/null \
+      >"$_tmp/$_name.out" 2>"$_tmp/$_name.err"; then
+      printf 'ok\n' >"$_tmp/$_name.status"
+    else
+      printf 'fail %d\n' "$?" >"$_tmp/$_name.status"
+    fi
+  }
+
+  local running=0
+  while IFS=$'\t' read -r name ssh profile; do
+    [[ -n "$name" && -n "$ssh" ]] || continue
+    total=$((total + 1))
+    while ((running >= jobs)); do
+      wait -n 2>/dev/null || break
+      running=$((running - 1))
+    done
+    _fleet_apply_one "$name" "$ssh" "$effective_cmd" "$tmpdir" &
+    running=$((running + 1))
+  done <<<"$entries"
+  wait
+
+  # `while < <(printf ...)` instead of `printf ... | while` — the
+  # pipe form runs the loop body in a subshell, so the ok/fail
+  # counters never propagate back to the parent. Caught by
+  # tests/unit/fleet/test_fleet_apply_mocked_ssh.sh which exercised
+  # the full apply path (the dry-run test missed this).
+  while IFS=$'\t' read -r name ssh profile; do
+    [[ -n "$name" ]] || continue
+    if [[ -s "$tmpdir/$name.status" ]] && head -1 "$tmpdir/$name.status" | grep -q '^ok'; then
+      ui_ok "$name" "$ssh"
+      ok=$((ok + 1))
+    else
+      local err_summary=""
+      [[ -s "$tmpdir/$name.err" ]] && err_summary=" — $(head -1 "$tmpdir/$name.err")"
+      ui_err "$name" "$ssh${err_summary}"
+      fail=$((fail + 1))
+    fi
+    local _evt_status="unknown"
+    [[ -s "$tmpdir/$name.status" ]] && _evt_status="$(head -1 "$tmpdir/$name.status")"
+    _fleet_emit_event "apply" "$_evt_status" "host=$name" "cmd=$effective_cmd"
+  done < <(printf '%s\n' "$entries")
+
+  ui_info "Summary" "$ok ok / $fail failed / $total total"
+  [[ "$fail" -eq 0 ]]
+}
+
 cmd_fleet() {
   local subcommand="${1:-status}"
   if [[ "${1:-}" == --* ]] || [[ -z "${1:-}" ]]; then
@@ -373,6 +644,9 @@ cmd_fleet() {
     enforce)
       cmd_fleet_enforce "$@"
       ;;
+    apply | push)
+      cmd_fleet_apply "$@"
+      ;;
     *)
       ui_header "Fleet Commands"
       echo ""
@@ -383,6 +657,7 @@ cmd_fleet() {
       ui_ok "events" "Show recent fleet events"
       ui_ok "namespace" "Show or set the active namespace"
       ui_ok "enforce" "Show or set RBAC enforcement mode (advisory|strict)"
+      ui_ok "apply" "SSH out to every host in fleet.toml and run 'dot sync'"
       ;;
   esac
 }

package/scripts/dot/commands/init.sh

@@ -0,0 +1,184 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# shellcheck shell=bash
+#
+# scripts/dot/commands/init.sh
+#
+# `dot init <github-user>` — bootstrap a foreign dotfiles repo through
+# this framework's harness. The §3 audit roadmap calls for an analogue
+# to `chezmoi init <user>` that turns this tool from "one person's
+# config" into a runtime for any dotfiles user.
+#
+# Behavior:
+#   dot init alice                # clones github.com/alice/dotfiles via chezmoi,
+#                                 # applies through the dot harness
+#   dot init https://...          # explicit URL
+#   dot init alice --dry-run      # preview without writing
+#   dot init alice --no-apply     # clone only; don't run chezmoi apply
+#
+# Safety:
+#   - Refuses to clobber an existing chezmoi source dir without --force.
+#   - Disclaims that the target's scripts will run with the user's
+#     privileges and prints the source URL for inspection.
+#   - Verifies the source URL is HTTPS (no plain git://) so MITM is harder.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../lib/ui.sh disable=SC1091
+source "$SCRIPT_DIR/../lib/ui.sh"
+# shellcheck source=../lib/utils.sh disable=SC1091
+source "$SCRIPT_DIR/../lib/utils.sh"
+
+_init_resolve_url() {
+  local arg="$1"
+  case "$arg" in
+    http://*)
+      printf "dot init: refusing plain HTTP (use HTTPS or git+ssh)\n" >&2
+      return 2
+      ;;
+    https://* | git@*:*)
+      # Trust full URLs as-is — these are the user's explicit intent.
+      printf "%s\n" "$arg"
+      ;;
+    */*)
+      # owner/repo shorthand: validate before constructing the URL so
+      # a crafted argument can't smuggle shell metacharacters into
+      # downstream tooling (chezmoi init, git clone).
+      if [[ ! "$arg" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]]; then
+        printf "dot init: invalid owner/repo (only [A-Za-z0-9._-]+/[A-Za-z0-9._-]+ allowed): %s\n" "$arg" >&2
+        return 2
+      fi
+      printf "https://github.com/%s.git\n" "$arg"
+      ;;
+    *)
+      # Bare user shorthand: same character whitelist as the path
+      # segment of a GitHub URL.
+      if [[ ! "$arg" =~ ^[A-Za-z0-9._-]+$ ]]; then
+        printf "dot init: invalid user (only [A-Za-z0-9._-] allowed): %s\n" "$arg" >&2
+        return 2
+      fi
+      printf "https://github.com/%s/dotfiles.git\n" "$arg"
+      ;;
+  esac
+}
+
+cmd_init() {
+  local user_arg="" dry_run=0 apply=1 force=0
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --dry-run | -n)
+        dry_run=1
+        shift
+        ;;
+      --no-apply)
+        apply=0
+        shift
+        ;;
+      --force | -f)
+        force=1
+        shift
+        ;;
+      --help | -h)
+        cat <<EOF
+Usage: dot init <github-user|owner/repo|url> [--dry-run] [--no-apply] [--force]
+
+Bootstrap a foreign dotfiles repo through chezmoi + the dot harness.
+
+Examples:
+  dot init alice                # github.com/alice/dotfiles
+  dot init alice/configs        # github.com/alice/configs
+  dot init https://example.com/repo.git
+  dot init alice --dry-run      # preview only
+  dot init alice --no-apply     # clone but don't apply
+
+Flags:
+  --dry-run, -n   Show resolved URL + target dir without cloning.
+  --no-apply      Clone the source but skip 'chezmoi apply'.
+  --force,   -f   Overwrite an existing chezmoi source dir.
+EOF
+        return 0
+        ;;
+      --)
+        shift
+        break
+        ;;
+      -*)
+        ui_err "Unknown flag" "$1"
+        return 1
+        ;;
+      *)
+        if [[ -n "$user_arg" ]]; then
+          ui_err "Too many arguments" "$1"
+          return 1
+        fi
+        user_arg="$1"
+        shift
+        ;;
+    esac
+  done
+
+  [[ -n "$user_arg" ]] || {
+    ui_err "init" "missing <user|repo|url>"
+    return 1
+  }
+
+  local url
+  url="$(_init_resolve_url "$user_arg")" || return $?
+
+  if ! command -v chezmoi >/dev/null 2>&1; then
+    ui_err "chezmoi" "not installed — run install.sh first"
+    return 127
+  fi
+
+  local source_dir
+  source_dir="${CHEZMOI_SOURCE_DIR:-$(chezmoi source-path 2>/dev/null || echo "$HOME/.local/share/chezmoi")}"
+
+  ui_header "Bootstrap dotfiles from $user_arg"
+  ui_info "Source URL" "$url"
+  ui_info "Target dir" "$source_dir"
+  local _apply_label="no"
+  [[ "$apply" -eq 1 ]] && _apply_label="yes"
+  ui_info "Apply after?" "$_apply_label"
+
+  if [[ "$dry_run" -eq 1 ]]; then
+    ui_ok "Dry-run" "no changes made"
+    return 0
+  fi
+
+  if [[ -e "$source_dir" ]] && [[ "$force" -ne 1 ]]; then
+    ui_err "Refusing" "$source_dir already exists; pass --force to overwrite"
+    return 1
+  fi
+
+  ui_warn "Trust" "The target repo's scripts will run with your user privileges."
+  ui_warn "Trust" "Inspect $url before proceeding if you don't know the author."
+  if [[ -t 0 ]] && [[ "${DOTFILES_NONINTERACTIVE:-0}" != "1" ]]; then
+    read -r -p "  Continue? [y/N] " resp
+    case "$resp" in
+      [yY] | [yY][eE][sS]) ;;
+      *)
+        ui_info "Init" "aborted by user"
+        return 1
+        ;;
+    esac
+  fi
+
+  local chezmoi_args=(init --source "$source_dir")
+  [[ "$apply" -eq 1 ]] && chezmoi_args+=(--apply)
+  chezmoi_args+=("$url")
+
+  ui_info "chezmoi" "${chezmoi_args[*]}"
+  if chezmoi "${chezmoi_args[@]}"; then
+    ui_ok "Init" "complete"
+    if [[ "$apply" -eq 1 ]]; then
+      ui_info "Hint" "run 'dot doctor' to validate the new environment"
+    else
+      ui_info "Hint" "run 'chezmoi diff' then 'chezmoi apply' when ready"
+    fi
+  else
+    local rc=$?
+    ui_err "Init" "chezmoi exited $rc"
+    return "$rc"
+  fi
+}

package/scripts/dot/commands/meta.sh

@@ -61,10 +61,13 @@ cmd_prewarm() {
   # Clear caches first
   ui_info "Cache" "Clearing shell initialization caches"
   local cache_dir="${XDG_CACHE_HOME:-$HOME/.cache}"
-  rm -rf "$cache_dir/zsh"/*-init.zsh "$cache_dir/zsh"/*.zwc 2>/dev/null || true
-  rm -rf "$cache_dir/bash"/*-init.bash 2>/dev/null || true
-  rm -rf "$cache_dir/fish"/*-init.fish 2>/dev/null || true
-  rm -rf "$cache_dir/nushell"/*.nu 2>/dev/null || true
+  # `find ... -delete` instead of `rm -rf $glob` so an unmatched literal
+  # pattern can't accidentally remove a real same-named directory, and
+  # so we don't pass `-r` on what should always be files.
+  [[ -d "$cache_dir/zsh" ]] && find "$cache_dir/zsh" -maxdepth 1 -type f \( -name '*-init.zsh' -o -name '*.zwc' \) -delete 2>/dev/null
+  [[ -d "$cache_dir/bash" ]] && find "$cache_dir/bash" -maxdepth 1 -type f -name '*-init.bash' -delete 2>/dev/null
+  [[ -d "$cache_dir/fish" ]] && find "$cache_dir/fish" -maxdepth 1 -type f -name '*-init.fish' -delete 2>/dev/null
+  [[ -d "$cache_dir/nushell" ]] && find "$cache_dir/nushell" -maxdepth 1 -type f -name '*.nu' -delete 2>/dev/null
   ui_info "Cache" "Cleared. Regenerating..."
   src_dir="$(resolve_source_dir)"
   if [ -n "$src_dir" ] && [ -f "$src_dir/scripts/ops/prewarm.sh" ]; then