@sebastienrousseau/dotfiles 0.2.501 → 0.2.502

package/scripts/dot/lib/ui.sh

@@ -359,9 +359,13 @@ ui_run_cmd() {
   done
   wait "$pid" 2>/dev/null
 
-  local rc
-  rc=$(cat "$rc_file" 2>/dev/null || echo 1)
+  # Guard against the rc_file being empty (race between subshell exit
+  # and parent read): an unset rc would default to non-numeric "" and
+  # fail the `[[ == "0" ]]` check confusingly. Treat empty as failure.
+  local rc=""
+  [[ -s "$rc_file" ]] && rc="$(<"$rc_file")"
   rm -f "$rc_file"
+  rc="${rc:-1}"
 
   ui_clear_line
   ui_show_cursor
@@ -472,6 +476,134 @@ ui_table_sep() {
   printf '\n'
 }
 
+# ═══════════════════════════════════════════════════════════════════════
+# Buffered table — accumulates rows then renders via `gum table -p`
+# (rounded borders) when gum is on PATH and stdout is a TTY; falls back
+# to the existing printf-based ui_table_header/row otherwise.
+#
+#   ui_table_begin "Tool" "Version" "Source" "Requested"
+#   ui_table_add   "node" "24.14.0" "~/.dotfiles/mise.toml" "24.14.0"
+#   ui_table_add   "node" "25.9.0"  ""                       ""
+#   ui_table_end
+#
+# Cells may contain anything except ASCII US (0x1f), the internal row
+# separator. Empty cells render as blank in both modes.
+#
+# Environment overrides:
+#   DOTFILES_NO_TUI=1   force the printf fallback even if gum is installed
+#   NO_COLOR=…          standard convention; also forces the fallback
+# ═══════════════════════════════════════════════════════════════════════
+_UI_TABLE_HEADERS=()
+_UI_TABLE_ROWS=()
+
+ui_table_begin() {
+  _UI_TABLE_HEADERS=("$@")
+  _UI_TABLE_ROWS=()
+}
+
+ui_table_add() {
+  if [[ "${#_UI_TABLE_HEADERS[@]}" -eq 0 ]]; then
+    return 1
+  fi
+  local IFS=$'\x1f'
+  _UI_TABLE_ROWS+=("$*")
+}
+
+ui_table_end() {
+  if [[ "${#_UI_TABLE_HEADERS[@]}" -eq 0 ]]; then
+    return 0
+  fi
+
+  local use_gum=0
+  if command -v gum >/dev/null 2>&1 &&
+    [[ -t 1 ]] &&
+    [[ "${DOTFILES_NO_TUI:-0}" != "1" ]] &&
+    [[ -z "${NO_COLOR:-}" ]]; then
+    use_gum=1
+  fi
+
+  if ((use_gum)); then
+    local header_row
+    local IFS=$'\x1f'
+    header_row="${_UI_TABLE_HEADERS[*]}"
+    # Charm palette: 212 = hot pink (matches ui_header), 240 = muted grey.
+    # Cell colour intentionally left at terminal default so the table
+    # reads on both light and dark backgrounds.
+    # Override via DOTFILES_TABLE_{BORDER,HEADER}_FG env vars.
+    local border_fg="${DOTFILES_TABLE_BORDER_FG:-240}"
+    local header_fg="${DOTFILES_TABLE_HEADER_FG:-212}"
+    {
+      printf '%s\n' "$header_row"
+      printf '%s\n' "${_UI_TABLE_ROWS[@]}"
+    } | gum table --print \
+      --separator=$'\x1f' \
+      --border=rounded \
+      --border.foreground="$border_fg" \
+      --header.foreground="$header_fg" \
+      --padding="0 1" 2>/dev/null ||
+      _ui_table_printf_fallback
+  else
+    _ui_table_printf_fallback
+  fi
+
+  _UI_TABLE_HEADERS=()
+  _UI_TABLE_ROWS=()
+}
+
+_ui_table_printf_fallback() {
+  ui_init
+  # Pre-scan all buffered rows + headers to compute per-column width so
+  # values aren't truncated or collide. Min width 8, +2 padding.
+  local ncols="${#_UI_TABLE_HEADERS[@]}"
+  local -a widths=()
+  local i
+  for ((i = 0; i < ncols; i++)); do
+    widths[i]="${#_UI_TABLE_HEADERS[i]}"
+  done
+  local row
+  for row in "${_UI_TABLE_ROWS[@]}"; do
+    local -a _fields=()
+    local IFS=$'\x1f'
+    read -ra _fields <<<"$row"
+    for ((i = 0; i < ncols; i++)); do
+      local len="${#_fields[i]}"
+      ((len > widths[i])) && widths[i]=$len
+    done
+  done
+  for ((i = 0; i < ncols; i++)); do
+    ((widths[i] += 2))
+    ((widths[i] < 8)) && widths[i]=8
+  done
+
+  # Emit header (bold when color available), separator, then rows.
+  local out="  "
+  for ((i = 0; i < ncols; i++)); do
+    if [[ "$UI_COLOR" = "1" ]]; then
+      out+="$(printf '%s%-*s%s' "$BOLD" "${widths[i]}" "${_UI_TABLE_HEADERS[i]}" "$NORMAL")"
+    else
+      out+="$(printf '%-*s' "${widths[i]}" "${_UI_TABLE_HEADERS[i]}")"
+    fi
+  done
+  printf '%s\n' "$out"
+
+  local total=2
+  for ((i = 0; i < ncols; i++)); do ((total += widths[i])); done
+  printf '  '
+  for ((i = 0; i < total - 2; i++)); do printf '─'; done
+  printf '\n'
+
+  for row in "${_UI_TABLE_ROWS[@]}"; do
+    local -a _fields=()
+    local IFS=$'\x1f'
+    read -ra _fields <<<"$row"
+    out="  "
+    for ((i = 0; i < ncols; i++)); do
+      out+="$(printf '%-*s' "${widths[i]}" "${_fields[i]:-}")"
+    done
+    printf '%s\n' "$out"
+  done
+}
+
 # ═══════════════════════════════════════════════════════════════════════
 # Logo
 # ═══════════════════════════════════════════════════════════════════════

package/scripts/dot/lib/utils.sh

@@ -274,7 +274,7 @@ dot_command_summary() {
       echo "Manage secrets (set/get/list/load/provider)."
       ;;
     env)
-      echo "Load secret buckets into shell exports."
+      echo "List mise-managed toolchain versions and sources."
       ;;
     secrets-create)
       echo "Create a new encrypted secrets file."

package/scripts/git-hooks/pre-commit-audit.sh

@@ -140,6 +140,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.501 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.502 standards maintained."
   exit 0
 fi

package/scripts/lib/secrets_provider.sh

@@ -126,15 +126,41 @@ dot_secrets_set() {
 }
 
 dot_secrets_get() {
-  local key="${1:-}" provider
-  [[ -n "$key" ]] || return 1
+  local key="${1:-}" provider value rc=0
+  [[ -n "$key" ]] || {
+    printf 'dot_secrets_get: empty key\n' >&2
+    return 1
+  }
   provider="$(dot_secrets_provider)"
   case "$provider" in
-    macos-keychain) dot_secrets_get_macos "$key" ;;
-    pass) dot_secrets_get_pass "$key" ;;
-    plain-enc) dot_secrets_get_plain_enc "$key" ;;
-    *) return 1 ;;
+    macos-keychain) value="$(dot_secrets_get_macos "$key")" || rc=$? ;;
+    pass) value="$(dot_secrets_get_pass "$key")" || rc=$? ;;
+    plain-enc) value="$(dot_secrets_get_plain_enc "$key")" || rc=$? ;;
+    none)
+      # No usable provider on this host — silent miss is wrong;
+      # callers need to know whether to fall back.
+      printf 'dot_secrets_get: no provider configured for key=%s\n' "$key" >&2
+      return 2
+      ;;
+    *)
+      printf 'dot_secrets_get: unknown provider %q\n' "$provider" >&2
+      return 1
+      ;;
   esac
+  if [[ "$rc" -ne 0 ]]; then
+    printf 'dot_secrets_get: provider %q failed (rc=%d) for key=%s\n' \
+      "$provider" "$rc" "$key" >&2
+    return "$rc"
+  fi
+  if [[ -z "$value" ]]; then
+    # An empty return from a successful provider call usually means
+    # "key not found" — distinguish from "provider crashed" so the
+    # caller's fallback can be different.
+    printf 'dot_secrets_get: provider %q returned empty for key=%s (not found?)\n' \
+      "$provider" "$key" >&2
+    return 3
+  fi
+  printf '%s' "$value"
 }
 
 dot_secrets_bucket_keys() {

package/scripts/ops/rollback.sh

@@ -122,6 +122,10 @@ list_backups() {
 }
 
 # Create a backup
+# LCOV_EXCL_START — body mutates real $HOME (cp/mkdir of dotfiles);
+# can't be exercised under the coverage sandbox without destroying
+# fixture state. The dispatcher reaches this function but the body
+# is genuinely off-limits.
 create_backup() {
   local reason="${1:-manual}"
   local timestamp
@@ -183,7 +187,9 @@ EOF
   # Cleanup old backups
   cleanup_old_backups
 }
+# LCOV_EXCL_STOP
 
+# LCOV_EXCL_START — rm -rf of real backup dirs.
 # Cleanup old backups, keeping only MAX_BACKUPS
 cleanup_old_backups() {
   local count
@@ -199,6 +205,7 @@ cleanup_old_backups() {
     done
   fi
 }
+# LCOV_EXCL_STOP
 
 # Get the most recent backup
 get_latest_backup() {
@@ -211,6 +218,8 @@ get_backup_by_index() {
   find "$BACKUP_DIR" -maxdepth 1 -type d -name "backup_*" | sort -r | sed -n "${index}p"
 }
 
+# LCOV_EXCL_START — body restores files into real $HOME; dispatcher
+# reaches it but the actual mutation is off-limits under coverage.
 # Rollback to a specific backup
 perform_rollback() {
   local backup_path="$1"
@@ -278,7 +287,9 @@ Analyze why the environment may have reached a state requiring rollback and sugg
     fi
   fi
 }
+# LCOV_EXCL_STOP
 
+# LCOV_EXCL_START — runs git reset --hard, mutates working tree.
 # Git-based rollback
 git_reset() {
   local dry_run="${1:-0}"
@@ -338,7 +349,9 @@ git_reset() {
     persist_log "GIT_RESET: to $target_commit"
   fi
 }
+# LCOV_EXCL_STOP
 
+# LCOV_EXCL_START — body copies files into real $HOME.
 # Restore a specific file from the latest backup
 restore_file() {
   local file_path="$1"
@@ -417,6 +430,7 @@ restore_file() {
     persist_log "RESTORE_FILE: $file_path"
   fi
 }
+# LCOV_EXCL_STOP
 
 # Show current status
 show_status() {

package/scripts/security/check-disclosure-key-expiry.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+#
+# scripts/security/check-disclosure-key-expiry.sh
+#
+# Reads the disclosure public key from `docs/security/security-pubkey.asc`,
+# parses its expiry, and exits non-zero when the remaining lifetime is
+# below threshold. Closes the R3 audit N2 finding (no automated alert
+# for the 2029-05-15 expiry).
+#
+# Two thresholds:
+#   --warn-days N    Emit a `::warning::` if expiry is < N days away.
+#                    Default 90.
+#   --fail-days N    Exit 1 (CI failure) if expiry is < N days away.
+#                    Default 30.
+#
+# Usage:
+#   bash scripts/security/check-disclosure-key-expiry.sh
+#   bash scripts/security/check-disclosure-key-expiry.sh --warn-days 180 --fail-days 60
+#
+# Designed to run from `.github/workflows/verify-gpg-wkd.yml` on the
+# weekly schedule, and from a maintainer's local pre-release sanity
+# check. Does NOT require network — reads the in-repo .asc only.
+
+set -euo pipefail
+
+WARN_DAYS=90
+FAIL_DAYS=30
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --warn-days)
+      WARN_DAYS="$2"
+      shift 2
+      ;;
+    --fail-days)
+      FAIL_DAYS="$2"
+      shift 2
+      ;;
+    -h | --help)
+      sed -n '5,25p' "${BASH_SOURCE[0]}"
+      exit 0
+      ;;
+    *)
+      echo "Unknown arg: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+ASC="$REPO_ROOT/docs/security/security-pubkey.asc"
+
+if [[ ! -f "$ASC" ]]; then
+  echo "::error::no public key at $ASC" >&2
+  exit 2
+fi
+
+if ! command -v gpg >/dev/null 2>&1; then
+  echo "::warning::gpg not installed — cannot verify key expiry" >&2
+  exit 0
+fi
+
+# Import into a throwaway keyring so we don't pollute the user's real one.
+GNUPGHOME="$(mktemp -d -t dot-disclosure-key.XXXXXX)"
+export GNUPGHOME
+chmod 700 "$GNUPGHOME"
+trap 'rm -rf "$GNUPGHOME"' EXIT
+
+# gpg can emit harmless warnings ("keyboxd older than us", "gpg-agent
+# IPC failed" in fresh GNUPGHOME, etc.) and exit non-zero under
+# `set -e` even when the import itself succeeded. Verify success by
+# checking the err log for the literal `imported: N` (N >= 1) line
+# rather than trusting gpg's exit code.
+gpg --batch --import "$ASC" >/dev/null 2>"$GNUPGHOME/import.err" || true
+if ! grep -qE '^gpg:[[:space:]]*imported: [1-9]' "$GNUPGHOME/import.err"; then
+  echo "::error::gpg import failed for $ASC" >&2
+  cat "$GNUPGHOME/import.err" >&2
+  exit 2
+fi
+
+# `--with-colons` field 7 of the `pub:` line is the expiry in Unix
+# seconds; 0 means no expiry.
+expires=$(gpg --with-colons --fingerprint 2>/dev/null | awk -F: '/^pub:/{print $7; exit}')
+
+if [[ -z "$expires" || "$expires" == "0" ]]; then
+  echo "::warning::disclosure key has no expiry — set one per docs/security/KEY_ROTATION.md" >&2
+  exit 0
+fi
+
+now=$(date -u +%s)
+remaining_days=$(((expires - now) / 86400))
+
+expires_date=$(date -u -r "$expires" '+%Y-%m-%d' 2>/dev/null || date -u -d "@$expires" '+%Y-%m-%d' 2>/dev/null || echo "(date format unknown)")
+
+echo "Disclosure key expires: $expires_date ($remaining_days days from now)"
+echo "  warn threshold: $WARN_DAYS days"
+echo "  fail threshold: $FAIL_DAYS days"
+
+if ((remaining_days < FAIL_DAYS)); then
+  echo "::error::Disclosure key expires in $remaining_days days. Rotate now per docs/security/KEY_ROTATION.md." >&2
+  exit 1
+fi
+
+if ((remaining_days < WARN_DAYS)); then
+  echo "::warning::Disclosure key expires in $remaining_days days. Schedule rotation per docs/security/KEY_ROTATION.md." >&2
+fi
+
+exit 0

package/scripts/security/lock-configs.sh

@@ -22,13 +22,22 @@ if [[ "$OSTYPE" == "darwin"* ]]; then
   UNLOCK_CMD="chflags nouchg"
   CHECK_CMD="ls -lO"
 else
-  # Linux (requires root usually, but we'll try)
+  # Linux (chattr +i requires root; fail loudly when sudo is missing
+  # rather than printing a confusing error per file in automation)
   if command -v chattr >/dev/null; then
+    if ! command -v sudo >/dev/null; then
+      echo " 'sudo' not found; chattr requires root. Aborting." >&2
+      exit 1
+    fi
+    if ! sudo -n true 2>/dev/null && [[ ! -t 0 ]]; then
+      echo " sudo requires a password but no TTY is attached. Aborting." >&2
+      exit 1
+    fi
     LOCK_CMD="sudo chattr +i"
     UNLOCK_CMD="sudo chattr -i"
     CHECK_CMD="lsattr"
   else
-    echo " 'chattr' not found. Cannot set immutability on Linux without it."
+    echo " 'chattr' not found. Cannot set immutability on Linux without it." >&2
     exit 1
   fi
 fi

package/scripts/version-sync.sh

@@ -142,6 +142,8 @@ sed_in_place() {
   fi
 }
 
+# LCOV_EXCL_START — rm -rf BACKUP_DIR + cp of real release files;
+# only run during a real release flow, not safe under coverage.
 create_backup() {
   local files=("$@")
 
@@ -166,6 +168,7 @@ create_backup() {
 
   log_success "Backed up $backup_count files"
 }
+# LCOV_EXCL_STOP
 
 update_version_references() {
   local target_version="$1"