@sebastienrousseau/dotfiles 0.2.500 → 0.2.502

package/scripts/git-hooks/pre-push

@@ -1,8 +1,26 @@
 #!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# =============================================================================
+# pre-push hook
+#
+# 1. Refuses to push any commit that is not GPG/SSH-signed.
+# 2. Runs `scripts/qa/reliability-audit.sh --quick`. The audit is mandatory
+#    by default; explicit per-push bypass requires `DOTFILES_ALLOW_UNSKIPPED_PUSH=1`,
+#    and every bypass is logged to `~/.local/share/dotfiles/audit-bypass.log`.
+#
+# The legacy `DOTFILES_SKIP_PRE_PUSH_AUDIT=1` env var (opt-out) is rejected
+# with a migration message. The new variable is intentionally awkwardly
+# named so that setting it requires deliberate intent. See
+# `docs/security/AUDIT_BYPASS.md`.
+# =============================================================================
+
 set -euo pipefail
 
 repo_root="$(git rev-parse --show-toplevel)"
 
+# -----------------------------------------------------------------------------
+# Step 1 — signed-commit enforcement (unchanged)
+# -----------------------------------------------------------------------------
 while read -r local_ref local_sha remote_ref remote_sha; do
   [ "$local_sha" = "0000000000000000000000000000000000000000" ] && continue
 
@@ -18,12 +36,57 @@ while read -r local_ref local_sha remote_ref remote_sha; do
 
   for c in $(git rev-list "$range"); do
     if ! git verify-commit "$c" >/dev/null 2>&1; then
-      echo "Blocked: unsigned commit $c"
+      echo "Blocked: unsigned commit $c" >&2
       exit 1
     fi
   done
 done
 
-if [ "${DOTFILES_SKIP_PRE_PUSH_AUDIT:-0}" != "1" ]; then
-  bash "$repo_root/scripts/qa/reliability-audit.sh" --quick
+# -----------------------------------------------------------------------------
+# Step 2 — reject the legacy opt-out variable
+# -----------------------------------------------------------------------------
+if [ "${DOTFILES_SKIP_PRE_PUSH_AUDIT:-}" = "1" ]; then
+  cat >&2 <<'EOF'
+ERROR: DOTFILES_SKIP_PRE_PUSH_AUDIT is no longer honored.
+
+The pre-push audit was previously opt-out — setting one env var was enough
+to skip it. That made bypass invisible and routine. Effective with #871,
+the policy is fail-closed: the audit always runs unless you explicitly
+authorize a bypass for this single push.
+
+To bypass for one push:
+  DOTFILES_ALLOW_UNSKIPPED_PUSH=1 git push
+
+Every bypass is recorded to ~/.local/share/dotfiles/audit-bypass.log
+and surfaced by `dot doctor` if any are recent.
+
+See: docs/security/AUDIT_BYPASS.md
+EOF
+  exit 1
 fi
+
+# -----------------------------------------------------------------------------
+# Step 3 — run the audit (or log + skip if explicitly bypassed)
+# -----------------------------------------------------------------------------
+if [ "${DOTFILES_ALLOW_UNSKIPPED_PUSH:-}" = "1" ]; then
+  bypass_log_dir="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles"
+  # The audit-bypass log lives under XDG_STATE_HOME (user state — never
+  # checked in, never deployed by chezmoi to other locations).
+  mkdir -p "$bypass_log_dir"
+  bypass_log="$bypass_log_dir/audit-bypass.log"
+
+  ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  branch="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown)"
+  remote="$(git remote get-url --push @{upstream} 2>/dev/null ||
+    git config --get remote.origin.url 2>/dev/null ||
+    echo unknown)"
+  reason="${DOTFILES_BYPASS_REASON:-no reason given}"
+
+  printf '%s\tbranch=%s\tremote=%s\treason=%s\n' \
+    "$ts" "$branch" "$remote" "$reason" >>"$bypass_log"
+
+  echo "WARN: pre-push audit bypassed (logged to $bypass_log)" >&2
+  exit 0
+fi
+
+bash "$repo_root/scripts/qa/reliability-audit.sh" --quick

package/scripts/lib/secrets_provider.sh

@@ -126,15 +126,41 @@ dot_secrets_set() {
 }
 
 dot_secrets_get() {
-  local key="${1:-}" provider
-  [[ -n "$key" ]] || return 1
+  local key="${1:-}" provider value rc=0
+  [[ -n "$key" ]] || {
+    printf 'dot_secrets_get: empty key\n' >&2
+    return 1
+  }
   provider="$(dot_secrets_provider)"
   case "$provider" in
-    macos-keychain) dot_secrets_get_macos "$key" ;;
-    pass) dot_secrets_get_pass "$key" ;;
-    plain-enc) dot_secrets_get_plain_enc "$key" ;;
-    *) return 1 ;;
+    macos-keychain) value="$(dot_secrets_get_macos "$key")" || rc=$? ;;
+    pass) value="$(dot_secrets_get_pass "$key")" || rc=$? ;;
+    plain-enc) value="$(dot_secrets_get_plain_enc "$key")" || rc=$? ;;
+    none)
+      # No usable provider on this host — silent miss is wrong;
+      # callers need to know whether to fall back.
+      printf 'dot_secrets_get: no provider configured for key=%s\n' "$key" >&2
+      return 2
+      ;;
+    *)
+      printf 'dot_secrets_get: unknown provider %q\n' "$provider" >&2
+      return 1
+      ;;
   esac
+  if [[ "$rc" -ne 0 ]]; then
+    printf 'dot_secrets_get: provider %q failed (rc=%d) for key=%s\n' \
+      "$provider" "$rc" "$key" >&2
+    return "$rc"
+  fi
+  if [[ -z "$value" ]]; then
+    # An empty return from a successful provider call usually means
+    # "key not found" — distinguish from "provider crashed" so the
+    # caller's fallback can be different.
+    printf 'dot_secrets_get: provider %q returned empty for key=%s (not found?)\n' \
+      "$provider" "$key" >&2
+    return 3
+  fi
+  printf '%s' "$value"
 }
 
 dot_secrets_bucket_keys() {

package/scripts/ops/heal-chezmoi.sh

@@ -37,15 +37,50 @@ heal_chezmoi_drift() {
     return 0
   fi
 
+  # Partition the drift: column 2 is what `chezmoi apply` would fix
+  # (destination differs from source). Column 1 is source-only drift
+  # (unstaged edits in the chezmoi source tree). Apply can't help with
+  # the second case — that needs `git commit` in the source repo.
+  local applicable
+  local source_only
+  applicable=$(printf '%s\n' "$status_output" | awk 'substr($0,2,1)!=" "' | wc -l | tr -d ' ')
+  source_only=$(printf '%s\n' "$status_output" | awk 'substr($0,1,1)!=" " && substr($0,2,1)==" "' | wc -l | tr -d ' ')
+
   ISSUES_FOUND=$((ISSUES_FOUND + 1))
 
   if [[ "$DRY_RUN" == "1" ]]; then
-    log_dry "run 'chezmoi apply --force' to re-sync"
-  else
-    if _pkg_install "chezmoi re-apply" 0 1 chezmoi apply --force; then
-      FIXES_APPLIED=$((FIXES_APPLIED + 1))
-      CHEZMOI_APPLIED=1
-      persist_log "HEAL: chezmoi apply --force"
+    log_dry "run 'chezmoi apply --force' to re-sync ($applicable file(s))"
+    return 0
+  fi
+
+  # Skip the apply if every file is source-only drift; nothing to fix.
+  if [[ "$applicable" -eq 0 ]]; then
+    printf '  \033[38;5;220m⚠\033[0m chezmoi state                       %s file(s) modified in source only — commit or revert in the source repo\n' "$source_only"
+    return 0
+  fi
+
+  # Capture apply output so we can surface failure reasons.
+  local apply_log
+  apply_log=$(mktemp)
+  if chezmoi apply --force >"$apply_log" 2>&1; then
+    FIXES_APPLIED=$((FIXES_APPLIED + 1))
+    CHEZMOI_APPLIED=1
+    persist_log "HEAL: chezmoi apply --force"
+
+    # Verify: did apply actually clean the drift?
+    local remaining
+    remaining=$(chezmoi status 2>/dev/null | awk 'substr($0,2,1)!=" "' | wc -l | tr -d ' ')
+    if [[ "$remaining" -eq 0 ]]; then
+      printf '  \033[38;5;42m✓\033[0m chezmoi re-apply                     %s file(s) synced\n' "$applicable"
+    else
+      # shellcheck disable=SC2016
+      printf '  \033[38;5;220m⚠\033[0m chezmoi re-apply                     %s applied, %s still drifted — run `chezmoi diff` to inspect\n' \
+        "$((applicable - remaining))" "$remaining"
     fi
+  else
+    printf '  \033[38;5;196m✗\033[0m chezmoi re-apply                     failed; see %s\n' "$apply_log"
+    tail -5 "$apply_log" | sed 's/^/      /'
+    return 1
   fi
+  rm -f "$apply_log"
 }

package/scripts/ops/rollback.sh

@@ -122,6 +122,10 @@ list_backups() {
 }
 
 # Create a backup
+# LCOV_EXCL_START — body mutates real $HOME (cp/mkdir of dotfiles);
+# can't be exercised under the coverage sandbox without destroying
+# fixture state. The dispatcher reaches this function but the body
+# is genuinely off-limits.
 create_backup() {
   local reason="${1:-manual}"
   local timestamp
@@ -183,7 +187,9 @@ EOF
   # Cleanup old backups
   cleanup_old_backups
 }
+# LCOV_EXCL_STOP
 
+# LCOV_EXCL_START — rm -rf of real backup dirs.
 # Cleanup old backups, keeping only MAX_BACKUPS
 cleanup_old_backups() {
   local count
@@ -199,6 +205,7 @@ cleanup_old_backups() {
     done
   fi
 }
+# LCOV_EXCL_STOP
 
 # Get the most recent backup
 get_latest_backup() {
@@ -211,6 +218,8 @@ get_backup_by_index() {
   find "$BACKUP_DIR" -maxdepth 1 -type d -name "backup_*" | sort -r | sed -n "${index}p"
 }
 
+# LCOV_EXCL_START — body restores files into real $HOME; dispatcher
+# reaches it but the actual mutation is off-limits under coverage.
 # Rollback to a specific backup
 perform_rollback() {
   local backup_path="$1"
@@ -278,7 +287,9 @@ Analyze why the environment may have reached a state requiring rollback and sugg
     fi
   fi
 }
+# LCOV_EXCL_STOP
 
+# LCOV_EXCL_START — runs git reset --hard, mutates working tree.
 # Git-based rollback
 git_reset() {
   local dry_run="${1:-0}"
@@ -338,7 +349,9 @@ git_reset() {
     persist_log "GIT_RESET: to $target_commit"
   fi
 }
+# LCOV_EXCL_STOP
 
+# LCOV_EXCL_START — body copies files into real $HOME.
 # Restore a specific file from the latest backup
 restore_file() {
   local file_path="$1"
@@ -417,6 +430,7 @@ restore_file() {
     persist_log "RESTORE_FILE: $file_path"
   fi
 }
+# LCOV_EXCL_STOP
 
 # Show current status
 show_status() {

package/scripts/qa/powershell-contract.ps1

@@ -0,0 +1,95 @@
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# PowerShell parity contract — smoke test for the dotfiles PowerShell
+# profile. Run by the windows-latest CI job (#860). Asserts that:
+#
+#   1. The profile parses + loads without throwing.
+#   2. Core function shims (`dot`, `ll`, `la`, `cat`) are defined.
+#   3. PSScriptAnalyzer reports no errors against the profile (warnings
+#      surface but don't fail the gate; tighten later).
+#
+# Exit codes:
+#   0  contract intact.
+#   1  any check failed; details printed to host.
+
+$ErrorActionPreference = 'Stop'
+$Failures = New-Object System.Collections.Generic.List[string]
+
+$RepoRoot = if ($env:GITHUB_WORKSPACE) { $env:GITHUB_WORKSPACE } else { (Get-Location).Path }
+$ProfileSrc = Join-Path $RepoRoot 'dot_config/powershell/Microsoft.PowerShell_profile.ps1.tmpl'
+
+if (-not (Test-Path $ProfileSrc)) {
+    Write-Output "FAIL: profile source not found at $ProfileSrc"
+    exit 1
+}
+
+# Step 1 — chezmoi-render the template into a real .ps1 we can dot-source.
+# In CI, chezmoi is on PATH (installed by setup-chezmoi composite).
+$Rendered = Join-Path $env:TEMP 'Microsoft.PowerShell_profile.ps1'
+if (Get-Command chezmoi -ErrorAction SilentlyContinue) {
+    & chezmoi execute-template --init --promptString version=0.2.501 `
+        --in $ProfileSrc | Set-Content -Path $Rendered -NoNewline
+} else {
+    # Fallback: strip chezmoi template syntax with a simple regex so the
+    # contract still runs locally without chezmoi installed.
+    (Get-Content $ProfileSrc -Raw) -replace '\{\{[^}]+\}\}', '0.0.0-fallback' |
+        Set-Content -Path $Rendered -NoNewline
+}
+
+if (-not (Test-Path $Rendered)) {
+    $Failures.Add("profile template did not render to $Rendered")
+}
+
+# Step 2 — dot-source the rendered profile and verify it didn't throw.
+$loadOk = $false
+try {
+    . $Rendered
+    $loadOk = $true
+    Write-Output "OK: profile dot-sourced"
+} catch {
+    Write-Output "FAIL: profile threw during load: $_"
+    $Failures.Add("profile load: $_")
+}
+
+# Step 3 — verify required function shims are defined.
+$RequiredFunctions = @('dot', 'd', 'll', 'la', 'cat')
+foreach ($fn in $RequiredFunctions) {
+    if (Get-Command $fn -CommandType Function -ErrorAction SilentlyContinue) {
+        Write-Output "OK: function $fn defined"
+    } else {
+        Write-Output "FAIL: function $fn not defined"
+        $Failures.Add("missing function: $fn")
+    }
+}
+
+# Step 4 — PSScriptAnalyzer (static analysis). Pre-installed on the
+# windows-latest GitHub-hosted runner; install on demand if missing.
+if (-not (Get-Module -ListAvailable -Name PSScriptAnalyzer)) {
+    Write-Output "Installing PSScriptAnalyzer..."
+    Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser -ErrorAction SilentlyContinue | Out-Null
+}
+
+if (Get-Module -ListAvailable -Name PSScriptAnalyzer) {
+    Import-Module PSScriptAnalyzer -Force
+    $Findings = Invoke-ScriptAnalyzer -Path $Rendered -Severity 'Error' -ErrorAction SilentlyContinue
+    if ($Findings) {
+        foreach ($f in $Findings) {
+            Write-Output "FAIL: PSScriptAnalyzer error: $($f.RuleName) at line $($f.Line): $($f.Message)"
+            $Failures.Add("PSScriptAnalyzer error: $($f.RuleName)")
+        }
+    } else {
+        Write-Output "OK: PSScriptAnalyzer clean (Error severity)"
+    }
+} else {
+    Write-Output "WARN: PSScriptAnalyzer not available — static analysis skipped"
+}
+
+Write-Output ""
+if ($Failures.Count -eq 0) {
+    Write-Output "PowerShell contract: PASS"
+    exit 0
+} else {
+    Write-Output "PowerShell contract: FAIL ($($Failures.Count) issue(s))"
+    foreach ($f in $Failures) { Write-Output "  - $f" }
+    exit 1
+}

package/scripts/security/check-disclosure-key-expiry.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# scripts/security/check-disclosure-key-expiry.sh
+#
+# Reads the disclosure public key from `docs/security/security-pubkey.asc`,
+# parses its expiry, and exits non-zero when the remaining lifetime is
+# below threshold. Closes the R3 audit N2 finding (no automated alert
+# for the 2029-05-15 expiry).
+#
+# Two thresholds:
+#   --warn-days N    Emit a `::warning::` if expiry is < N days away.
+#                    Default 90.
+#   --fail-days N    Exit 1 (CI failure) if expiry is < N days away.
+#                    Default 30.
+#
+# Usage:
+#   bash scripts/security/check-disclosure-key-expiry.sh
+#   bash scripts/security/check-disclosure-key-expiry.sh --warn-days 180 --fail-days 60
+#
+# Designed to run from `.github/workflows/verify-gpg-wkd.yml` on the
+# weekly schedule, and from a maintainer's local pre-release sanity
+# check. Does NOT require network — reads the in-repo .asc only.
+
+set -euo pipefail
+
+WARN_DAYS=90
+FAIL_DAYS=30
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --warn-days)
+      WARN_DAYS="$2"
+      shift 2
+      ;;
+    --fail-days)
+      FAIL_DAYS="$2"
+      shift 2
+      ;;
+    -h | --help)
+      sed -n '5,25p' "${BASH_SOURCE[0]}"
+      exit 0
+      ;;
+    *)
+      echo "Unknown arg: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+ASC="$REPO_ROOT/docs/security/security-pubkey.asc"
+
+if [[ ! -f "$ASC" ]]; then
+  echo "::error::no public key at $ASC" >&2
+  exit 2
+fi
+
+if ! command -v gpg >/dev/null 2>&1; then
+  echo "::warning::gpg not installed — cannot verify key expiry" >&2
+  exit 0
+fi
+
+# Import into a throwaway keyring so we don't pollute the user's real one.
+GNUPGHOME="$(mktemp -d -t dot-disclosure-key.XXXXXX)"
+export GNUPGHOME
+chmod 700 "$GNUPGHOME"
+trap 'rm -rf "$GNUPGHOME"' EXIT
+
+# gpg can emit harmless warnings ("keyboxd older than us", "gpg-agent
+# IPC failed" in fresh GNUPGHOME, etc.) and exit non-zero under
+# `set -e` even when the import itself succeeded. Verify success by
+# checking the err log for the literal `imported: N` (N >= 1) line
+# rather than trusting gpg's exit code.
+gpg --batch --import "$ASC" >/dev/null 2>"$GNUPGHOME/import.err" || true
+if ! grep -qE '^gpg:[[:space:]]*imported: [1-9]' "$GNUPGHOME/import.err"; then
+  echo "::error::gpg import failed for $ASC" >&2
+  cat "$GNUPGHOME/import.err" >&2
+  exit 2
+fi
+
+# `--with-colons` field 7 of the `pub:` line is the expiry in Unix
+# seconds; 0 means no expiry.
+expires=$(gpg --with-colons --fingerprint 2>/dev/null | awk -F: '/^pub:/{print $7; exit}')
+
+if [[ -z "$expires" || "$expires" == "0" ]]; then
+  echo "::warning::disclosure key has no expiry — set one per docs/security/KEY_ROTATION.md" >&2
+  exit 0
+fi
+
+now=$(date -u +%s)
+remaining_days=$(((expires - now) / 86400))
+
+expires_date=$(date -u -r "$expires" '+%Y-%m-%d' 2>/dev/null || date -u -d "@$expires" '+%Y-%m-%d' 2>/dev/null || echo "(date format unknown)")
+
+echo "Disclosure key expires: $expires_date ($remaining_days days from now)"
+echo "  warn threshold: $WARN_DAYS days"
+echo "  fail threshold: $FAIL_DAYS days"
+
+if ((remaining_days < FAIL_DAYS)); then
+  echo "::error::Disclosure key expires in $remaining_days days. Rotate now per docs/security/KEY_ROTATION.md." >&2
+  exit 1
+fi
+
+if ((remaining_days < WARN_DAYS)); then
+  echo "::warning::Disclosure key expires in $remaining_days days. Schedule rotation per docs/security/KEY_ROTATION.md." >&2
+fi
+
+exit 0

package/scripts/security/lock-configs.sh

@@ -22,13 +22,22 @@ if [[ "$OSTYPE" == "darwin"* ]]; then
   UNLOCK_CMD="chflags nouchg"
   CHECK_CMD="ls -lO"
 else
-  # Linux (requires root usually, but we'll try)
+  # Linux (chattr +i requires root; fail loudly when sudo is missing
+  # rather than printing a confusing error per file in automation)
   if command -v chattr >/dev/null; then
+    if ! command -v sudo >/dev/null; then
+      echo " 'sudo' not found; chattr requires root. Aborting." >&2
+      exit 1
+    fi
+    if ! sudo -n true 2>/dev/null && [[ ! -t 0 ]]; then
+      echo " sudo requires a password but no TTY is attached. Aborting." >&2
+      exit 1
+    fi
     LOCK_CMD="sudo chattr +i"
     UNLOCK_CMD="sudo chattr -i"
     CHECK_CMD="lsattr"
   else
-    echo " 'chattr' not found. Cannot set immutability on Linux without it."
+    echo " 'chattr' not found. Cannot set immutability on Linux without it." >&2
     exit 1
   fi
 fi

package/scripts/theme/merge-wallpaper.sh

@@ -81,6 +81,10 @@ merge_pair() {
 
   local tmpdir
   tmpdir="$(mktemp -d)"
+  # Single-quotes prevent the variable expanding at trap-definition time;
+  # `$tmpdir` resolves when the trap fires (still scoped to this function
+  # because RETURN is per-function).
+  # shellcheck disable=SC2064  # intentionally expand $tmpdir at trap time within this function scope
   trap "rm -rf '$tmpdir'" RETURN
 
   # Convert both to JPEG for heif-enc input (it handles JPEG best)

package/scripts/theme/switch.sh

@@ -184,7 +184,7 @@ pick_theme() {
   fi
 
   local current
-  local current="$(current_theme)"
+  current="$(current_theme)"
 
   if [[ ! -f "$THEMES_FILE" ]]; then
     ui_err "Missing" "$THEMES_FILE"
@@ -234,7 +234,8 @@ pick_theme() {
 }
 
 list_themes() {
-  local current="$(current_theme)"
+  local current
+  current="$(current_theme)"
   local current_family="${current%-dark}"
   [[ "$current_family" != "$current" ]] || current_family="${current%-light}"
 
@@ -260,7 +261,8 @@ list_themes() {
 
 # Toggle between light and dark within the same family, or switch families
 toggle_theme() {
-  local current="$(current_theme)"
+  local current
+  current="$(current_theme)"
 
   if is_dark_theme "$current"; then
     if [[ "$current" == *-dark ]]; then
@@ -279,8 +281,9 @@ toggle_theme() {
 
 # Switch to the next wallpaper family while preserving mode.
 switch_family() {
-  local current="$(current_theme)"
-  local family="$(get_theme_family "$current")"
+  local current family
+  current="$(current_theme)"
+  family="$(get_theme_family "$current")"
   local mode="dark"
   local families=()
   local idx=0
@@ -316,8 +319,9 @@ switch_family() {
 
 # Show current theme info
 show_current() {
-  local current="$(current_theme)"
-  local family="$(get_theme_family "$current")"
+  local current family
+  current="$(current_theme)"
+  family="$(get_theme_family "$current")"
   local mode="dark"
   if ! is_dark_theme "$current" 2>/dev/null; then
     mode="light"
@@ -338,8 +342,13 @@ sync_theme() {
       ;;
     Linux)
       if command -v gsettings >/dev/null 2>&1; then
-        # Check GNOME color scheme
-        local scheme=scheme=$(gsettings get org.gnome.desktop.interface color-scheme 2>/dev/null | tr -d "'")
+        # Check GNOME color scheme. Fixes a long-standing bug where the
+        # variable was declared as `local scheme=scheme=$(...)` — the
+        # extra `scheme=` prefix made the value always start with that
+        # literal, so the `prefer-light` test below could never match
+        # and the system always fell through to the dark branch.
+        local scheme
+        scheme=$(gsettings get org.gnome.desktop.interface color-scheme 2>/dev/null | tr -d "'")
         if [[ "$scheme" == "prefer-light" ]]; then
           os_mode="light"
         else
@@ -349,7 +358,8 @@ sync_theme() {
       ;;
   esac
 
-  local current="$(current_theme)"
+  local current
+  current="$(current_theme)"
   if is_dark_theme "$current" && [[ "$os_mode" == "light" ]]; then
     ui_info "Sync" "System is light, switching dotfiles to light..."
     toggle_theme

package/scripts/version-sync.sh

@@ -142,6 +142,8 @@ sed_in_place() {
   fi
 }
 
+# LCOV_EXCL_START — rm -rf BACKUP_DIR + cp of real release files;
+# only run during a real release flow, not safe under coverage.
 create_backup() {
   local files=("$@")
 
@@ -166,6 +168,7 @@ create_backup() {
 
   log_success "Backed up $backup_count files"
 }
+# LCOV_EXCL_STOP
 
 update_version_references() {
   local target_version="$1"

package/dot_config/atuin/config.toml

@@ -1,40 +0,0 @@
-# Atuin Configuration (~/.config/atuin/config.toml)
-# https://atuin.sh/docs/config
-
-# Core
-update_check = false
-db_path = "~/.local/share/atuin/history.db"
-key_path = "~/.local/share/atuin/key"
-session_path = "~/.local/share/atuin/session"
-
-# Sync
-auto_sync = true
-sync_frequency = "10m"
-sync_address = "https://api.atuin.sh"
-
-# UI
-style = "compact"
-inline_height = 20
-show_preview = true
-enter_accept = true
-
-# Search
-search_mode = "fuzzy"
-filter_mode = "global"
-workspaces = true
-
-# Privacy: skip commands that may contain secrets
-history_filter = [
-  "^export (SECRET|TOKEN|PASSWORD|API_KEY|AWS_)",
-  "^PASSWORD=",
-  "^ssh-keygen",
-  "^(aws|gcloud|az|kubectl).*(configure|auth|login|-k |--kubeconfig)",
-  "curl.*-H.*[Aa]uthorization",
-  "git clone.*https://.*:.*@",
-  "^vault ",
-  "^op (read|inject|run)",
-]
-
-# Skip ephemeral directories
-secrets_filter = true
-network_timeout = 30